[PATCH 3.4 000/107] 3.4.111-rc1 review

[lizf]

From: Zefan Li <lizefan@xxxxxxxxxx>

This is the start of the stable review cycle for the 3.4.111 release.
There are 107 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Mar 16 16:04:10 CST 2016.
Anything received after that time might be too late.

A combined patch relative to 3.4.110 will be posted as an additional
response to this.  A shortlog and diffstat can be found below.

thanks,

Zefan Li

--------------------

AMAN DEEP (1):
  usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init()
    function

Al Viro (3):
  9p: don't leave a half-initialized inode sitting around
  sg_start_req(): make sure that there's not too many elements in iovec
  get rid of s_files and files_lock

Aleksei Mamlin (1):
  libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk
    VB0250EAVER

Alex Deucher (1):
  drm/radeon/combios: add some validation of lvds values

Alexei Potashnik (1):
  target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT

Andrey Vagin (1):
  netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get

Andy Lutomirski (2):
  x86/xen: Probe target addresses in set_aliased_prot() before the
    hypercall
  x86/ldt: Make modify_ldt synchronous

Anssi Hannula (1):
  ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
    DragonFly

Arne Fitzenreiter (2):
  libata: add ATA_HORKAGE_NOTRIM
  libata: force disable trim for SuperSSpeed S238

Bart Van Assche (1):
  libfc: Fix fc_fcp_cleanup_each_cmd()

Ben Hutchings (2):
  isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
  ppp, slip: Validate VJ compression slot parameters completely

Ben Zhang (1):
  kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not
    every one

Bernhard Bender (1):
  Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen

Brian Campbell (1):
  xhci: Calculate old endpoints correctly on device reset

Chris Metcalf (1):
  tile: use free_bootmem_late() for initrd

Claudio Cappelli (1):
  USB: option: add 2020:4000 ID

Clemens Ladisch (2):
  ALSA: tlv: compute TLV_*_ITEM lengths automatically
  ALSA: tlv: add DECLARE_TLV_DB_RANGE()

Dan Carpenter (1):
  rds: fix an integer overflow test in rds_info_getsockopt()

Daniel Borkmann (1):
  rtnetlink: verify IFLA_VF_INFO attributes before passing them to
    driver

David Ahern (1):
  net: Fix RCU splat in af_key

David Daney (1):
  MIPS: Make set_pte() SMP safe.

David Howells (2):
  KEYS: Fix race between key destruction and finding a keyring by name
  KEYS: Fix crash when attempt to garbage collect an uninstantiated
    keyring

Dennis Yang (1):
  dm btree remove: fix bug in redistribute3

Dirk Behme (1):
  USB: sierra: add 1199:68AB device ID

Dominic Sacrà (1):
  ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4

Edward Hyunkoo Jee (1):
  inet: frags: fix defragmented packet's IP header for af_packet

Eric Northup (1):
  KVM: x86: work around infinite loop in microcode when #AC is delivered

Felix Fietkau (1):
  MIPS: Fix sched_getaffinity with MT FPAFF enabled

Filipe Manana (1):
  Btrfs: use kmem_cache_free when freeing entry in inode cache

Gioh Kim (1):
  fs/buffer.c: support buffer cache allocations with gfp modifiers

Hannes Frederic Sowa (3):
  net: add validation for the socket syscall protocol argument
  ipv6: probe routes asynchronous in rt6_probe
  net: fix warnings in 'make htmldocs' by moving macro definition out of
    field declaration

Heiko Carstens (1):
  s390/process: fix sfpc inline assembly

Herbert Xu (2):
  net: Clone skb before setting peeked flag
  crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer

Herton R. Krzesinski (1):
  ipc,sem: fix use after free on IPC_RMID after a task using same
    semaphore set exits

Jan Beulich (1):
  x86/LDT: Print the real LDT base address

Jason Wang (1):
  virtio-net: drop NETIF_F_FRAGLIST

Jiri Pirko (1):
  niu: don't count tx error twice in case of headroom realloc fails

Joe Perches (1):
  hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV
    instead

Joe Stringer (1):
  netfilter: nf_conntrack: Support expectations in different zones

Joe Thornber (4):
  dm thin: allocate the cell_sort_array dynamically
  dm btree: silence lockdep lock inversion in dm_btree_del()
  dm btree: add ref counting ops for the leaves of top level btrees
  dm btree remove: fix a bug when rebalancing nodes after removal

Johan Hovold (1):
  USB: whiteheat: fix potential null-deref at probe

John Soni Jose (1):
  libiscsi: Fix host busy blocking during connection teardown

John Youn (2):
  usb: dwc3: Reset the transfer resource index on SET_INTERFACE
  usb: dwc3: Fix assignment of EP transfer resources

Joseph Qi (1):
  ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()

Juergen Gross (2):
  x86/ldt: Correct LDT access in single stepping logic
  x86/ldt: Correct FPU emulation access to LDT

Julian Anastasov (2):
  net: do not process device backlog during unregistration
  net: call rcu_read_lock early in process_backlog

Kirill A. Shutemov (1):
  mm: avoid setting up anonymous pages into file mapping

Linus Torvalds (1):
  Initialize msg/shm IPC objects before doing ipc_addid()

Lior Amsalem (1):
  ata: pmp: add quirk for Marvell 4140 SATA PMP

Marc-Andrà Lureau (1):
  vhost: actually track log eventfd file

Marcelo Leitner (1):
  ipv6: addrconf: validate new MTU before applying it

Marcelo Tosatti (1):
  KVM: x86: move steal time initialization to vcpu entry time

Martin Schwidefsky (1):
  s390/sclp: clear upper register halves in _sclp_print_early

Mathias Nyman (1):
  xhci: fix off by one error in TRB DMA address boundary check

Michael Walle (1):
  EDAC, ppc4xx: Access mci->csrows array elements properly

Michal Hocko (1):
  ext4: replace open coded nofail allocation in ext4_free_blocks()

Michal KubeÄek (1):
  ipv6: prevent fib6_run_gc() contention

Mikulas Patocka (1):
  libata: increase the timeout when setting transfer mode

Neil Brown (1):
  SUNRPC: never enqueue a ->rq_cong request on ->sending

NeilBrown (4):
  md: make sure everything is freed when dm-raid stops an array.
  md: flush ->event_work before stopping array.
  md/raid1: fix test for 'was read error from last working device'.
  md/raid1: extend spinlock to protect raid1_end_read_request against
    inconsistencies

Nicholas Bellinger (1):
  iscsi-target: Fix use-after-free during TPG session shutdown

Nikolay Borisov (2):
  bufferhead: Add _gfp version for sb_getblk()
  ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp

Oliver Neukum (1):
  usb-storage: ignore ZTE MF 823 card reader in mode 0x1225

Paolo Bonzini (1):
  KVM: svm: unconditionally intercept #DB

Peter Sanford (1):
  USB: cp210x: add ID for Aruba Networks controllers

Peter Zijlstra (1):
  perf: Fix fasync handling on inherited events

Quentin Casasnovas (1):
  RDS: fix race condition when sending a message on unbound socket

Rainer Weikusat (2):
  unix: avoid use-after-free in ep_remove_wait_queue
  af_unix: Guard against other == sk in unix_dgram_sendmsg

Richard Stearn (1):
  NET: AX.25: Stop heartbeat timer on disconnect.

Richard Weinberger (1):
  localmodconfig: Use Kbuild files too

Sanidhya Kashyap (1):
  hpfs: kstrdup() out of memory handling

Sasha Levin (2):
  RDS: verify the underlying transport exists before creating a
    connection
  atm: deal with setting entry before mkip was called

Seymour, Shane M (1):
  st: null pointer dereference panic caused by use after kref_put by
    st_open

Stefan Agner (1):
  can: mcp251x: fix resume when device is down

Tom Hughes (1):
  mac80211: clear subdir_stations when removing debugfs

Tomas Winkler (1):
  mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()

WANG Cong (1):
  pptp: verify sockaddr_len in pptp_bind() and pptp_connect()

Wengang Wang (1):
  rds: rds_ib_device.refcount overflow

Yao-Wen Mao (1):
  ALSA: usb-audio: add dB range mapping for some devices

Zefan Li (1):
  Revert "usb: dwc3: Reset the transfer resource index on SET_INTERFACE"

Zhao Junwang (1):
  drm: add a check for x/y in drm_mode_setcrtc

Zhuang Jin Can (2):
  xhci: report U3 when link is in resume state
  xhci: prevent bus_suspend if SS port resuming in phase 1

bingtian.ly@xxxxxxxxxx (1):
  net: avoid to hang up on sending due to sysctl configuration overflow.

lucien (1):
  sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state

 arch/mips/include/asm/pgtable.h                |  31 +++
 arch/mips/kernel/mips-mt-fpaff.c               |   5 +-
 arch/s390/kernel/process.c                     |   2 +-
 arch/s390/kernel/sclp.S                        |   4 +
 arch/tile/kernel/setup.c                       |   2 +-
 arch/x86/include/asm/desc.h                    |  15 --
 arch/x86/include/asm/kvm_host.h                |   1 +
 arch/x86/include/asm/mmu.h                     |   3 +-
 arch/x86/include/asm/mmu_context.h             |  49 ++++-
 arch/x86/kernel/cpu/common.c                   |   4 +-
 arch/x86/kernel/ldt.c                          | 267 ++++++++++++++-----------
 arch/x86/kernel/process_64.c                   |   6 +-
 arch/x86/kernel/step.c                         |   8 +-
 arch/x86/kvm/svm.c                             |  22 +-
 arch/x86/kvm/trace.h                           |   1 +
 arch/x86/kvm/vmx.c                             |   5 +-
 arch/x86/kvm/x86.c                             |   9 +-
 arch/x86/math-emu/fpu_entry.c                  |   3 +-
 arch/x86/math-emu/fpu_system.h                 |  21 +-
 arch/x86/math-emu/get_address.c                |   3 +-
 arch/x86/power/cpu.c                           |   3 +-
 arch/x86/xen/enlighten.c                       |  40 ++++
 drivers/ata/libata-core.c                      |   9 +-
 drivers/ata/libata-pmp.c                       |   7 +
 drivers/ata/libata-scsi.c                      |   3 +-
 drivers/crypto/ixp4xx_crypto.c                 |   1 -
 drivers/edac/ppc4xx_edac.c                     |   2 +-
 drivers/gpu/drm/drm_crtc.c                     |   7 +-
 drivers/gpu/drm/radeon/radeon_combios.c        |   7 +-
 drivers/input/touchscreen/usbtouchscreen.c     |   3 +
 drivers/isdn/i4l/isdn_ppp.c                    |  12 +-
 drivers/md/dm-thin.c                           |  14 +-
 drivers/md/md.c                                |  18 +-
 drivers/md/persistent-data/dm-btree-internal.h |   6 +
 drivers/md/persistent-data/dm-btree-remove.c   |  35 ++--
 drivers/md/persistent-data/dm-btree-spine.c    |  37 ++++
 drivers/md/persistent-data/dm-btree.c          |   9 +-
 drivers/md/raid1.c                             |   9 +-
 drivers/mmc/card/block.c                       |   2 +
 drivers/net/can/mcp251x.c                      |  15 +-
 drivers/net/ethernet/sun/niu.c                 |   4 +-
 drivers/net/ppp/ppp_generic.c                  |   6 +-
 drivers/net/ppp/pptp.c                         |   6 +
 drivers/net/slip/slhc.c                        |  12 +-
 drivers/net/slip/slip.c                        |   2 +-
 drivers/net/virtio_net.c                       |   4 +-
 drivers/scsi/libfc/fc_fcp.c                    |  19 +-
 drivers/scsi/libiscsi.c                        |  25 +--
 drivers/scsi/sg.c                              |   3 +
 drivers/scsi/st.c                              |   2 +-
 drivers/target/iscsi/iscsi_target.c            |  14 +-
 drivers/usb/dwc3/core.h                        |   1 -
 drivers/usb/dwc3/ep0.c                         |   5 -
 drivers/usb/dwc3/gadget.c                      |  70 +++++--
 drivers/usb/host/xhci-hub.c                    |  13 +-
 drivers/usb/host/xhci-mem.c                    |   2 +-
 drivers/usb/host/xhci-ring.c                   |   5 +-
 drivers/usb/host/xhci.c                        |   3 +
 drivers/usb/host/xhci.h                        |   1 +
 drivers/usb/serial/cp210x.c                    |   1 +
 drivers/usb/serial/option.c                    |   1 +
 drivers/usb/serial/sierra.c                    |   1 +
 drivers/usb/serial/whiteheat.c                 |  31 +++
 drivers/usb/storage/unusual_devs.h             |  12 ++
 drivers/vhost/vhost.c                          |   1 +
 fs/9p/vfs_inode.c                              |   3 +-
 fs/9p/vfs_inode_dotl.c                         |   3 +-
 fs/btrfs/inode-map.c                           |   2 +-
 fs/buffer.c                                    |  43 ++--
 fs/ext4/extents.c                              |   7 +-
 fs/ext4/mballoc.c                              |  16 +-
 fs/file_table.c                                | 130 ------------
 fs/hpfs/super.c                                |  19 +-
 fs/internal.h                                  |   3 -
 fs/ocfs2/dlmglue.c                             |  10 +-
 fs/open.c                                      |   2 -
 fs/super.c                                     |  21 +-
 include/linux/buffer_head.h                    |  54 ++++-
 include/linux/fs.h                             |  13 --
 include/linux/libata.h                         |   2 +
 include/net/af_unix.h                          |   1 +
 include/net/ip6_fib.h                          |   2 +-
 include/net/sock.h                             |   1 +
 include/sound/tlv.h                            |  24 ++-
 ipc/msg.c                                      |  18 +-
 ipc/sem.c                                      |  23 ++-
 ipc/shm.c                                      |  13 +-
 ipc/util.c                                     |   8 +-
 kernel/events/core.c                           |  12 +-
 kernel/watchdog.c                              |   8 +
 mm/memory.c                                    |  17 +-
 net/atm/clip.c                                 |   3 +
 net/ax25/af_ax25.c                             |   3 +
 net/ax25/ax25_subr.c                           |   1 +
 net/core/datagram.c                            |  41 +++-
 net/core/dev.c                                 |  26 +--
 net/core/rtnetlink.c                           | 106 +++++-----
 net/core/sysctl_net_core.c                     |  14 +-
 net/decnet/af_decnet.c                         |   3 +
 net/ipv4/af_inet.c                             |   3 +
 net/ipv4/ip_fragment.c                         |   6 +-
 net/ipv4/sysctl_net_ipv4.c                     |  11 +-
 net/ipv6/addrconf.c                            |  17 +-
 net/ipv6/af_inet6.c                            |   3 +
 net/ipv6/ip6_fib.c                             |  19 +-
 net/ipv6/ndisc.c                               |   4 +-
 net/ipv6/route.c                               |  41 +++-
 net/irda/af_irda.c                             |   3 +
 net/key/af_key.c                               |  46 ++---
 net/mac80211/debugfs_netdev.c                  |   1 +
 net/netfilter/nf_conntrack_core.c              |  21 +-
 net/netfilter/nf_conntrack_expect.c            |   3 +-
 net/rds/ib_rdma.c                              |   4 +-
 net/rds/info.c                                 |   2 +-
 net/rds/send.c                                 |   4 +-
 net/sctp/sm_sideeffect.c                       |   2 +-
 net/sunrpc/xprt.c                              |   3 +
 net/unix/af_unix.c                             | 188 +++++++++++++++--
 scripts/kconfig/streamline_config.pl           |   2 +-
 security/keys/gc.c                             |  10 +-
 sound/usb/mixer.c                              |   2 +
 sound/usb/mixer_maps.c                         |  12 ++
 sound/usb/mixer_quirks.c                       |  37 ++++
 sound/usb/mixer_quirks.h                       |   4 +
 sound/usb/quirks-table.h                       |  68 +++++++
 125 files changed, 1390 insertions(+), 722 deletions(-)

-- 
1.9.1