I'm announcing the release of the 3.16.39 kernel. All users of the 3.16 kernel series should upgrade. The updated 3.16.y git tree can be found at: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-3.16.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git The diff from 3.16.38 is attached to this message. Ben. ------------ Documentation/filesystems/porting | 4 +- Documentation/module-signing.txt | 6 + Makefile | 2 +- arch/alpha/include/asm/uaccess.h | 19 ++- arch/arc/include/asm/irqflags.h | 2 +- arch/arc/include/asm/uaccess.h | 11 +- arch/arc/mm/tlbex.S | 6 +- arch/arm/boot/compressed/head.S | 2 +- arch/arm/boot/dts/kirkwood-ib62x0.dts | 2 +- arch/arm/common/sa1111.c | 22 +-- arch/arm/include/asm/dma-mapping.h | 2 +- arch/arm/kernel/sys_oabi-compat.c | 8 +- arch/arm/kvm/arm.c | 2 - arch/arm/kvm/mmu.c | 1 + arch/arm/mach-mvebu/coherency.c | 22 ++- .../mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c | 1 + arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 12 ++ arch/arm/mach-omap2/prcm43xx.h | 1 + arch/arm/mach-sa1100/generic.c | 3 + arch/arm/mm/dma-mapping.c | 59 +++++--- arch/arm64/crypto/aes-glue.c | 2 +- arch/arm64/include/asm/elf.h | 1 + arch/arm64/include/asm/spinlock.h | 10 ++ arch/arm64/include/uapi/asm/auxvec.h | 2 + arch/arm64/kernel/debug-monitors.c | 1 - arch/arm64/kernel/perf_event.c | 21 ++- arch/arm64/kernel/smp.c | 1 - arch/arm64/mm/proc.S | 2 + arch/avr32/include/asm/uaccess.h | 11 +- arch/avr32/kernel/avr32_ksyms.c | 2 +- arch/avr32/lib/copy_user.S | 8 +- arch/avr32/mach-at32ap/pio.c | 2 +- arch/blackfin/include/asm/uaccess.h | 9 +- arch/cris/include/asm/uaccess.h | 71 +++++----- arch/frv/include/asm/uaccess.h | 12 +- arch/hexagon/include/asm/uaccess.h | 3 +- arch/ia64/include/asm/uaccess.h | 20 ++- arch/m32r/include/asm/uaccess.h | 2 +- arch/metag/include/asm/cmpxchg_lnkget.h | 2 +- arch/metag/include/asm/uaccess.h | 3 +- arch/microblaze/include/asm/uaccess.h | 11 +- .../include/asm/mach-paravirt/kernel-entry-init.h | 2 + arch/mips/include/asm/pgtable.h | 6 +- arch/mips/include/asm/r4kcache.h | 4 + arch/mips/include/asm/uaccess.h | 3 + arch/mips/kernel/scall64-n32.S | 2 +- arch/mips/kernel/scall64-o32.S | 2 +- arch/mips/kvm/kvm_mips.c | 2 +- arch/mips/kvm/kvm_mips_emul.c | 98 ++++++++++--- arch/mips/kvm/kvm_tlb.c | 64 ++++++--- arch/mips/mm/sc-rm7k.c | 2 +- arch/mips/mti-malta/malta-setup.c | 8 +- arch/mips/net/bpf_jit.c | 2 +- arch/mn10300/include/asm/uaccess.h | 1 + arch/mn10300/lib/usercopy.c | 4 +- arch/openrisc/include/asm/uaccess.h | 35 ++--- arch/parisc/include/asm/uaccess.h | 7 +- arch/parisc/include/uapi/asm/errno.h | 4 +- arch/powerpc/include/asm/pci-bridge.h | 1 + arch/powerpc/include/asm/uaccess.h | 21 +-- arch/powerpc/kernel/exceptions-64s.S | 39 ++---- arch/powerpc/kernel/mce.c | 3 +- arch/powerpc/kernel/pci-common.c | 36 +++++ arch/powerpc/kernel/prom_init.c | 9 +- arch/powerpc/kernel/tm.S | 3 +- arch/powerpc/platforms/powernv/opal-dump.c | 7 +- arch/powerpc/platforms/powernv/opal-elog.c | 7 +- arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/platforms/pseries/pci.c | 4 + arch/powerpc/platforms/pseries/pci_dlpar.c | 7 +- arch/s390/include/asm/elf.h | 1 + arch/s390/include/asm/tlbflush.h | 3 +- arch/s390/include/asm/uaccess.h | 8 +- arch/s390/include/uapi/asm/auxvec.h | 2 + arch/s390/mm/pgtable.c | 4 +- arch/score/include/asm/uaccess.h | 46 +++--- arch/sh/include/asm/uaccess.h | 5 +- arch/sh/include/asm/uaccess_64.h | 1 + arch/sparc/include/asm/uaccess_32.h | 4 +- arch/tile/include/asm/elf.h | 1 + arch/tile/include/uapi/asm/auxvec.h | 2 + arch/x86/boot/compressed/eboot.c | 20 ++- arch/x86/include/asm/tlbflush.h | 7 + arch/x86/kernel/apic/apic.c | 3 + arch/x86/kernel/cpu/amd.c | 14 ++ arch/x86/kernel/cpu/perf_event_amd.c | 4 +- arch/x86/kernel/early-quirks.c | 105 ++++++++++++-- arch/x86/kernel/paravirt.c | 4 +- arch/x86/kvm/vmx.c | 77 +++++++--- arch/x86/syscalls/syscall_32.tbl | 2 +- block/genhd.c | 3 +- crypto/blkcipher.c | 3 +- crypto/cryptd.c | 9 +- crypto/gcm.c | 4 +- crypto/scatterwalk.c | 3 +- drivers/bcma/bcma_private.h | 2 - drivers/bluetooth/ath3k.c | 4 + drivers/bluetooth/btusb.c | 2 + drivers/char/hw_random/omap-rng.c | 16 ++- drivers/char/random.c | 13 +- drivers/char/tpm/tpm_tis.c | 9 +- drivers/clocksource/sun4i_timer.c | 9 +- drivers/crypto/caam/caamhash.c | 1 + drivers/crypto/nx/nx.c | 2 +- drivers/devfreq/devfreq.c | 2 +- drivers/firewire/net.c | 51 ++++--- drivers/firmware/efi/efi-stub-helper.c | 96 +++++++++---- drivers/firmware/efi/fdt.c | 13 +- drivers/gpio/Kconfig | 1 + drivers/gpio/gpio-intel-mid.c | 19 --- drivers/gpio/gpio-pca953x.c | 2 +- drivers/gpu/drm/drm_crtc.c | 3 + drivers/gpu/drm/drm_edid.c | 8 ++ drivers/gpu/drm/i915/intel_display.c | 20 +-- drivers/gpu/drm/msm/msm_drv.h | 6 + drivers/gpu/drm/msm/msm_gem.c | 9 ++ drivers/gpu/drm/msm/msm_gem_submit.c | 37 ++++- drivers/gpu/drm/nouveau/nouveau_acpi.c | 76 +++++----- drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +- drivers/gpu/drm/nouveau/nv04_fbcon.c | 4 +- drivers/gpu/drm/nouveau/nv50_fbcon.c | 2 +- drivers/gpu/drm/nouveau/nvc0_fbcon.c | 2 +- drivers/gpu/drm/qxl/qxl_draw.c | 2 + drivers/gpu/drm/radeon/atombios_encoders.c | 1 + drivers/gpu/drm/radeon/radeon_atombios.c | 4 +- drivers/gpu/drm/radeon/radeon_atpx_handler.c | 5 + drivers/gpu/drm/radeon/radeon_connectors.c | 15 +- drivers/gpu/drm/radeon/radeon_device.c | 4 + drivers/gpu/drm/radeon/radeon_kms.c | 4 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/radeon/si_dpm.c | 6 + drivers/hid/uhid.c | 33 +++-- drivers/hv/vmbus_drv.c | 3 + drivers/hwmon/adt7411.c | 5 +- drivers/i2c/busses/i2c-efm32.c | 2 +- drivers/i2c/busses/i2c-eg20t.c | 18 ++- drivers/i2c/busses/i2c-qup.c | 3 +- drivers/i2c/muxes/i2c-mux-pca954x.c | 2 +- drivers/iio/accel/kxsd9.c | 2 + drivers/iio/adc/at91_adc.c | 4 +- drivers/iio/adc/ti_am335x_adc.c | 14 +- .../iio/common/hid-sensors/hid-sensor-attributes.c | 4 +- drivers/iio/industrialio-core.c | 5 +- drivers/iio/proximity/as3935.c | 2 +- drivers/infiniband/core/multicast.c | 13 +- drivers/infiniband/hw/mlx4/mad.c | 23 +++ drivers/infiniband/hw/mlx4/mcg.c | 14 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mlx4/qp.c | 37 ++--- drivers/infiniband/ulp/ipoib/ipoib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 16 +++ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 ++ drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- drivers/input/joystick/xpad.c | 3 + drivers/input/keyboard/tegra-kbc.c | 2 +- drivers/input/serio/i8042.c | 17 +-- drivers/input/serio/libps2.c | 10 +- drivers/md/bcache/super.c | 11 +- drivers/md/dm-crypt.c | 2 +- drivers/md/dm-flakey.c | 23 +-- drivers/media/dvb-core/dvb_ringbuffer.c | 96 +++++++++++-- drivers/media/dvb-core/dvb_ringbuffer.h | 2 + drivers/media/pci/ngene/ngene-dvb.c | 2 +- drivers/media/platform/s5p-mfc/s5p_mfc.c | 11 ++ drivers/media/usb/em28xx/em28xx-i2c.c | 5 +- drivers/media/usb/usbvision/usbvision-video.c | 7 - drivers/mmc/card/block.c | 12 +- drivers/mtd/maps/pmcmsp-flash.c | 6 +- drivers/mtd/nand/davinci_nand.c | 3 + drivers/mtd/nand/nand_base.c | 2 +- drivers/mtd/ubi/attach.c | 27 +++- drivers/mtd/ubi/build.c | 5 +- drivers/mtd/ubi/ubi.h | 3 + drivers/mtd/ubi/vmt.c | 25 +++- drivers/net/can/dev.c | 27 ++-- drivers/net/can/flexcan.c | 13 +- drivers/net/ethernet/ethoc.c | 10 +- drivers/net/ethernet/marvell/mvneta.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 85 +++++++---- drivers/net/macvlan.c | 10 +- drivers/net/ppp/ppp_generic.c | 5 +- drivers/net/tun.c | 5 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c | 4 +- .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 2 +- drivers/net/wireless/brcm80211/brcmsmac/dma.c | 4 +- drivers/net/wireless/brcm80211/brcmsmac/stf.c | 2 +- drivers/net/wireless/iwlwifi/pcie/tx.c | 4 +- drivers/pci/quirks.c | 10 +- drivers/platform/x86/hp-wmi.c | 7 +- drivers/power/max17042_battery.c | 15 +- drivers/pps/clients/pps_parport.c | 2 +- drivers/rtc/rtc-ds1307.c | 28 +++- drivers/s390/block/dasd.c | 10 +- drivers/scsi/aacraid/commctrl.c | 13 +- drivers/scsi/arcmsr/arcmsr_hba.c | 8 +- drivers/scsi/constants.c | 5 +- drivers/scsi/megaraid/megaraid_sas_base.c | 6 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +- drivers/staging/comedi/drivers/daqboard2000.c | 2 +- drivers/staging/comedi/drivers/ni_mio_common.c | 12 +- drivers/staging/lustre/lustre/llite/llite_lib.c | 2 +- drivers/target/iscsi/iscsi_target.c | 22 ++- drivers/target/iscsi/iscsi_target_login.c | 5 +- drivers/target/target_core_device.c | 8 +- drivers/target/target_core_file.c | 3 +- drivers/target/target_core_iblock.c | 3 +- drivers/target/target_core_transport.c | 9 +- drivers/tty/serial/8250/8250_pci.c | 139 ++++++++++++++++++ drivers/tty/serial/atmel_serial.c | 14 +- drivers/tty/serial/samsung.c | 16 ++- drivers/tty/serial/sunhv.c | 6 - drivers/tty/vt/keyboard.c | 30 ++-- drivers/usb/class/cdc-acm.c | 5 +- drivers/usb/class/cdc-acm.h | 1 - drivers/usb/core/config.c | 93 ++++++++++-- drivers/usb/core/devio.c | 16 ++- drivers/usb/core/quirks.c | 6 + drivers/usb/dwc3/gadget.c | 23 +-- drivers/usb/gadget/fsl_qe_udc.c | 9 +- drivers/usb/gadget/udc-core.c | 2 +- drivers/usb/host/xhci-hub.c | 3 + drivers/usb/host/xhci-pci.c | 3 +- drivers/usb/host/xhci-ring.c | 13 +- drivers/usb/misc/usbtest.c | 7 +- drivers/usb/renesas_usbhs/fifo.c | 22 ++- drivers/usb/renesas_usbhs/mod.c | 11 +- drivers/usb/renesas_usbhs/mod_gadget.c | 9 +- drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 12 ++ drivers/usb/serial/mos7720.c | 2 +- drivers/usb/serial/mos7840.c | 4 +- drivers/usb/serial/option.c | 34 +++++ drivers/usb/serial/usb-serial-simple.c | 3 +- drivers/usb/serial/usb-serial.c | 4 +- drivers/vfio/pci/vfio_pci.c | 33 +++-- drivers/vfio/pci/vfio_pci_intrs.c | 69 +++++---- drivers/virtio/virtio_balloon.c | 2 + drivers/xen/xenbus/xenbus_dev_frontend.c | 14 +- fs/9p/acl.c | 40 +++--- fs/9p/vfs_inode.c | 2 +- fs/9p/vfs_inode_dotl.c | 2 +- fs/adfs/inode.c | 2 +- fs/affs/inode.c | 2 +- fs/attr.c | 35 +++-- fs/btrfs/acl.c | 6 +- fs/btrfs/inode.c | 2 +- fs/btrfs/ioctl.c | 12 ++ fs/btrfs/tree-log.c | 2 + fs/ceph/acl.c | 6 +- fs/ceph/file.c | 12 +- fs/ceph/inode.c | 2 +- fs/cifs/cifsencrypt.c | 16 ++- fs/cifs/dir.c | 24 +++- fs/cifs/inode.c | 4 +- fs/cifs/smb2ops.c | 30 +++- fs/ecryptfs/inode.c | 2 +- fs/exofs/inode.c | 2 +- fs/ext2/acl.c | 12 +- fs/ext2/inode.c | 2 +- fs/ext3/acl.c | 12 +- fs/ext3/inode.c | 2 +- fs/ext4/acl.c | 12 +- fs/ext4/balloc.c | 3 + fs/ext4/extents.c | 8 +- fs/ext4/inode.c | 37 ++++- fs/ext4/mballoc.c | 17 +-- fs/ext4/super.c | 35 ++++- fs/f2fs/acl.c | 6 +- fs/f2fs/file.c | 2 +- fs/fat/file.c | 2 +- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 24 ++++ fs/fuse/fuse_i.h | 2 +- fs/fuse/inode.c | 2 +- fs/gfs2/acl.c | 12 +- fs/gfs2/inode.c | 2 +- fs/hfs/inode.c | 2 +- fs/hfsplus/inode.c | 2 +- fs/hfsplus/posix_acl.c | 4 +- fs/hostfs/hostfs_kern.c | 9 +- fs/hpfs/inode.c | 2 +- fs/hugetlbfs/inode.c | 2 +- fs/jffs2/acl.c | 9 +- fs/jffs2/fs.c | 2 +- fs/jfs/acl.c | 6 +- fs/jfs/file.c | 2 +- fs/kernfs/file.c | 28 +++- fs/kernfs/inode.c | 2 +- fs/libfs.c | 2 +- fs/logfs/file.c | 2 +- fs/minix/file.c | 2 +- fs/ncpfs/inode.c | 2 +- fs/nfs/callback.c | 1 + fs/nfs/callback_xdr.c | 6 +- fs/nfs/nfs4proc.c | 13 +- fs/nfs/write.c | 5 +- fs/nfsd/vfs.c | 12 +- fs/nilfs2/inode.c | 2 +- fs/notify/fanotify/fanotify.c | 13 +- fs/notify/fanotify/fanotify_user.c | 36 +++-- fs/notify/group.c | 19 +++ fs/notify/notification.c | 23 +-- fs/ntfs/inode.c | 2 +- fs/ocfs2/acl.c | 9 +- fs/ocfs2/dlm/dlmconvert.c | 12 +- fs/ocfs2/dlmfs/dlmfs.c | 2 +- fs/ocfs2/file.c | 36 +++-- fs/omfs/file.c | 2 +- fs/posix_acl.c | 31 ++++ fs/proc/base.c | 2 +- fs/proc/generic.c | 2 +- fs/proc/proc_sysctl.c | 2 +- fs/ramfs/file-nommu.c | 2 +- fs/reiserfs/inode.c | 2 +- fs/reiserfs/xattr_acl.c | 8 +- fs/seq_file.c | 4 +- fs/sysv/file.c | 2 +- fs/ubifs/file.c | 2 +- fs/ubifs/tnc_commit.c | 2 +- fs/udf/file.c | 2 +- fs/ufs/truncate.c | 2 +- fs/utimes.c | 4 +- fs/xfs/xfs_acl.c | 16 +-- fs/xfs/xfs_file.c | 2 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_iops.c | 16 ++- fs/xfs/xfs_iops.h | 6 +- include/asm-generic/uaccess.h | 20 ++- include/linux/backing-dev.h | 2 + include/linux/bcma/bcma.h | 1 + include/linux/can/dev.h | 3 +- include/linux/compiler-gcc.h | 2 +- include/linux/efi.h | 9 ++ include/linux/fs.h | 2 +- include/linux/fsnotify_backend.h | 6 +- include/linux/i8042.h | 6 - include/linux/mlx5/qp.h | 4 +- include/linux/mroute.h | 2 +- include/linux/mroute6.h | 2 +- include/linux/netfilter/x_tables.h | 4 + include/linux/pagemap.h | 38 ++--- include/linux/posix_acl.h | 1 + include/linux/radix-tree.h | 1 + include/linux/serio.h | 24 +++- include/linux/swap.h | 2 + include/net/inet_ecn.h | 3 +- include/net/tcp.h | 2 + include/target/target_core_backend.h | 2 +- ipc/msg.c | 2 +- ipc/sem.c | 12 +- kernel/cpuset.c | 15 ++ kernel/fork.c | 10 +- kernel/module.c | 13 +- kernel/posix-cpu-timers.c | 1 + kernel/power/hibernate.c | 4 +- kernel/printk/braille.c | 4 +- kernel/sched/core.c | 23 ++- kernel/sched/sched.h | 13 -- kernel/time/timekeeping_debug.c | 9 +- kernel/trace/trace.c | 15 +- lib/mpi/mpicoder.c | 2 +- mm/backing-dev.c | 19 +++ mm/filemap.c | 93 ++++++------ mm/hugetlb.c | 4 + mm/ksm.c | 3 +- mm/shmem.c | 2 +- mm/workingset.c | 10 +- net/batman-adv/bridge_loop_avoidance.c | 137 +++++++++++++++--- net/batman-adv/distributed-arp-table.c | 10 +- net/batman-adv/originator.c | 15 ++ net/batman-adv/routing.c | 80 +++++++++-- net/batman-adv/send.c | 4 +- net/batman-adv/types.h | 20 ++- net/bluetooth/l2cap_sock.c | 2 +- net/bluetooth/rfcomm/sock.c | 20 +-- net/ceph/osdmap.c | 156 +++++++++++++++------ net/ipv4/ipmr.c | 3 +- net/ipv4/netfilter/arp_tables.c | 36 +++-- net/ipv4/netfilter/ip_tables.c | 33 ++++- net/ipv4/route.c | 3 +- net/ipv4/tcp_fastopen.c | 1 + net/ipv4/tcp_input.c | 3 +- net/ipv4/tcp_output.c | 3 +- net/ipv6/addrconf.c | 9 ++ net/ipv6/ip6_gre.c | 2 +- net/ipv6/ip6mr.c | 5 +- net/ipv6/netfilter/ip6_tables.c | 33 ++++- net/ipv6/route.c | 4 +- net/irda/af_irda.c | 12 +- net/l2tp/l2tp_core.c | 3 + net/l2tp/l2tp_ppp.c | 7 +- net/mac80211/cfg.c | 2 +- net/mac80211/tx.c | 6 +- net/netfilter/nf_conntrack_expect.c | 2 +- net/netfilter/nfnetlink_queue_core.c | 6 +- net/netfilter/x_tables.c | 50 +++++++ net/netlabel/netlabel_kapi.c | 12 +- net/sched/sch_generic.c | 9 +- net/sunrpc/auth_gss/auth_gss.c | 8 +- net/sunrpc/svc.c | 7 +- net/wireless/nl80211.c | 2 +- net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 15 +- scripts/recordmcount.c | 9 +- security/keys/proc.c | 2 +- sound/core/control.c | 2 + sound/core/pcm.c | 14 +- sound/core/rawmidi.c | 4 +- sound/core/timer.c | 34 ++++- sound/firewire/fireworks/fireworks.h | 1 - sound/firewire/fireworks/fireworks_hwdep.c | 71 +++++++--- sound/firewire/fireworks/fireworks_proc.c | 4 +- sound/firewire/fireworks/fireworks_transaction.c | 5 +- sound/pci/hda/hda_codec.c | 4 +- sound/pci/hda/hda_intel.c | 4 +- sound/pci/hda/patch_realtek.c | 9 ++ sound/soc/omap/omap-mcpdm.c | 5 +- tools/vm/slabinfo.c | 3 +- virt/kvm/kvm_main.c | 2 + 420 files changed, 3506 insertions(+), 1566 deletions(-) Adrien Vergé (1): USB: quirks: Fix another ELAN touchscreen Al Viro (26): alpha: fix copy_from_user() asm-generic: make copy_from_user() zero the destination properly asm-generic: make get_user() clear the destination on errors cris: buggered copy_from_user/copy_to_user/clear_user frv: fix clear_user() hexagon: fix strncpy_from_user() error return ia64: copy_from_user() should zero the destination on access_ok() failure metag: copy_from_user() should zero the destination on access_ok() failure mips: copy_from_user() must zero the destination on access_ok() failure mn10300: failing __get_user() and get_user() should zero mn10300: copy_from_user() should zero on access_ok() failure... openrisc: fix copy_from_user() parisc: fix copy_from_user() ppc32: fix copy_from_user() s390: get_user() should zero on failure score: fix __get_user/get_user score: fix copy_from_user() and friends sh64: failing __get_user() should zero sh: fix copy_from_user() sparc32: fix copy_from_user() blackfin: fix copy_from_user() m32r: fix __get_user() microblaze: fix copy_from_user() microblaze: fix __get_user() avr32: fix copy_from_user() fix fault_in_multipages_...() on architectures with no-op access_ok() Alan Stern (4): USB: validate wMaxPacketValue entries in endpoint descriptors USB: fix typo in wMaxPacketSize validation USB: avoid left shift by -1 USB: change bInterval default to 10 ms Aleksandr Makarov (2): USB: serial: option: add WeTelecom WM-D200 USB: serial: option: add WeTelecom 0x6802 and 0x6803 products Alex Deucher (4): drm/radeon: add a delay after ATPX dGPU power off drm/radeon: support backlight control for UNIPHY3 drm/radeon: fix firmware info version checks drm/radeon/si/dpm: add workaround for for Jet parts Alex Hung (1): hp-wmi: Fix wifi cannot be hard-unblocked Alex Vesker (2): IB/ipoib: Don't allow MC joins during light MC flush IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV Alex Williamson (1): vfio/pci: Fix NULL pointer oops in error interrupt setup handling Alexandre Belloni (1): tty/serial: atmel: fix RS485 half duplex with DMA Alexey Dobriyan (1): posix_cpu_timer: Exit early when process has been reaped Alexey Khoroshilov (3): i2c: efm32: fix a failure path in efm32_i2c_probe() USB: serial: mos7720: fix non-atomic allocation in write path USB: serial: mos7840: fix non-atomic allocation in write path Alexey Klimov (1): USB: serial: fix memleak in driver-registration error path Alexey Kuznetsov (1): fuse: fsync() did not return IO errors Alison Schofield (1): iio: proximity: as3935: set up buffer timestamps for non-zero values Amadeusz Sławiński (1): Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU Anders Darander (1): iio: adc: at91: unbreak channel adc channel 3 Andrey Pronin (1): tpm: read burstcount from TPM_STS in one 32-bit transaction Andrey Ryabinin (1): radix-tree: fix radix_tree_iter_retry() for tagged iterators. Andy Shevchenko (1): gpio: intel-mid: Remove potentially harmful code Ard Biesheuvel (2): crypto: cryptd - initialize child shash_desc on import crypto: arm64/aes-ctr - fix NULL dereference in tail processing Arend Van Spriel (1): brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() Artemy Kovalyov (1): IB/mlx5: Fix MODIFY_QP command input structure Ashish Samant (1): ocfs2: fix start offset to ocfs2_zero_range_for_truncate() Balbir Singh (1): sched/core: Fix a race between try_to_wake_up() and a woken up task Ben Hutchings (3): module: Invalidate signatures on force-loaded modules Documentation/module-signing.txt: Note need for version info if reusing a key Linux 3.16.39 Benjamin Coddington (1): nfs: don't create zero-length requests Cameron Gutman (1): Input: xpad - validate USB endpoint count during probe Chen-Yu Tsai (1): clocksource/drivers/sun4i: Clear interrupts after stopping timer in probe function Chris Blake (1): PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset Chris Mason (1): Btrfs: remove root_log_ctx from ctx list before btrfs_sync_log returns Christian König (1): drm/radeon: fix radeon_move_blit on 32bit systems Chuck Lever (2): svc: Avoid garbage replies when pc_func() returns rpc_drop_reply NFS: Don't drop CB requests with invalid principals Dan Carpenter (12): em28xx-i2c: rt_mutex_trylock() returns zero on failure qxl: check for kmap failures mtd: pmcmsp-flash: Allocating too much in init_msp_flash() crypto: nx - off by one bug in nx_of_update_msc() MIPS: RM7000: Double locking bug in rm7k_tc_disable() tools/vm/slabinfo: fix an unintentional printf sparc: serial: sunhv: fix a double lock bug avr32: off by one in at32_init_pio() hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common() usb: gadget: fsl_qe_udc: off by one in setup_received_handle() usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame() scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() Dan Williams (1): block: fix bdi vs gendisk lifetime mismatch Daniel Borkmann (1): bpf, mips: fix off-by-one in ctx offset allocation Daniel Mentz (1): ARC: Call trace_hardirqs_on() before enabling irqs Daniel Vetter (1): drm: Reject page_flip for !DRIVER_MODESET Daniele Palmas (3): USB: serial: option: add support for Telit LE910 PID 0x1206 USB: serial: option: add support for Telit LE920A4 USB: serial: simple: add support for another Infineon flashloader Dave Carroll (1): aacraid: Check size values after double-fetch from user Dave Weinstein (1): arm: oabi compat: add missing access checks David Daney (1): MIPS: Fix page table corruption on THP permission changes. David Hildenbrand (1): s390/mm: fix gmap tlb flush issues David Howells (3): KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace KEYS: Fix short sprintf buffer in /proc/keys show function Dmitri Epshtein (1): net: mvneta: set real interrupt per packet for tx_done Dmitry Torokhov (3): tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Input: i8042 - break load dependency between atkbd/psmouse and i8042 Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Dmitry Tunin (1): Bluetooth: Add support of 13d3:3490 AR3012 device Emanuel Czirai (1): x86/AMD: Apply erratum 665 on machines without a BIOS fix Erez Shitrit (2): IB/core: Fix use after free in send_leave function IB/ipoib: Fix memory corruption in ipoib cm mode connect flow Eric Biggers (1): dm crypt: fix free of bad values after tfm allocation failure Eric Dumazet (3): tcp: fix use after free in tcp_xmit_retransmit_queue() qdisc: fix a module refcount leak in qdisc_create_dflt() tcp: fix a compile error in DBGUNDO() Eric Wheeler (1): bcache: register_bcache(): call blkdev_put() when cache_alloc() fails Fabian Frederick (1): sysv, ipc: fix security-layer leaking Fabio Estevam (1): can: flexcan: fix resume function Felipe Balbi (2): usb: dwc3: gadget: increment request->actual once usb: gadget: udc: core: don't starve DMA resources Felix Fietkau (1): mac80211: fix purging multicast PS buffer queue Feng Li (1): iscsi-target: Fix panic when adding second TCP connection to iSCSI session Florian Fainelli (4): net: ethoc: Fix early error paths brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() Florian Westphal (2): netfilter: x_tables: validate targets of jumps netfilter: x_tables: speed up jump target validation Forrest Liu (1): Btrfs: add missing blk_finish_plug in btrfs_sync_log() Gavin Li (1): cdc-acm: fix wrong pipe type on rx interrupt xfers Gregor Boirie (1): iio:core: fix IIO_VAL_FRACTIONAL sign handling Gregory CLEMENT (1): ARM: 8561/3: dma-mapping: Don't use outer_flush_range when the L2C is coherent Guenter Roeck (2): avr32: fix 'undefined reference to `___copy_from_user' openrisc: fix the fix of copy_from_user() Haishuang Yan (1): ip6_gre: Set flowi6_proto as IPPROTO_GRE in xmit path. Hector Palacios (1): mtd: nand: fix bug writing 1 byte less than page size Helge Deller (1): parisc: Fix order of EREFUSED define in errno.h Herbert Xu (4): macvlan: Fix potential use-after free for broadcasts crypto: gcm - Filter out async ghash if necessary crypto: scatterwalk - Fix test in scatterwalk_done crypto: skcipher - Fix blkcipher walk OOM crash Ian Abbott (3): staging: comedi: daqboard2000: bug fix board type matching code staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility staging: comedi: ni_mio_common: fix wrong insn_write handler Ilan Tayari (1): xfrm: Fix memory leak of aead algorithm name Ilya Dryomov (1): libceph: apply new_state before new_up_client on incrementals Iosif Harutyunov (1): ubi: Fix race condition between ubi device creation and udev Jack Morgenstein (2): IB/mlx4: Fix code indentation in QP1 MAD flow IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV Jaganath Kanakkassery (1): Bluetooth: Fix potential NULL dereference in RFCOMM bind callback James Hogan (11): tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO MIPS: c-r4k: Fix protected_writeback_scache_line for EVA arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO s390: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO metag: Fix __cmpxchg_u32 asm constraint for CMP MIPS: KVM: Fix mapped fault broken commpage handling MIPS: KVM: Add missing gfn range check MIPS: KVM: Fix gfn range check in kseg0 tlb faults MIPS: KVM: Propagate kseg0/mapped tlb fault errors MIPS: KVM: Check for pfn noslot case KVM: MIPS: Drop other CPU ASIDs on guest MMU changes Jan Beulich (2): xenbus: don't BUG() on user mode induced condition xenbus: don't look up transaction IDs for ordinary writes Jan Kara (6): ext4: fix deadlock during page writeback fsnotify: add a way to stop queueing events on group shutdown fanotify: fix list corruption in fanotify_get_response() fs: Give dentry to inode_change_ok() instead of inode fs: Avoid premature clearing of capabilities posix_acl: Clear SGID bit when setting file permissions Javier Martinez Canillas (2): s5p-mfc: Set device name for reserved memory region devs s5p-mfc: Add release callback for memory region devs Jeff Mahoney (1): btrfs: ensure that file descriptor used with subvol ioctls is a dir Jeffrey Hugo (1): efi/libstub: Allocate headspace in efi_get_memory_map() Jia He (1): mm/hugetlb: avoid soft lockup in set_max_huge_pages() Jim Lin (1): usb: xhci: Fix panic if disconnect Jim Mattson (1): KVM: nVMX: Fix memory corruption when using VMCS shadowing Jimi Damon (1): serial: 8250: added acces i/o products quad and octal serial cards Jiri Slaby (1): pps: do not crash when failed to register Johannes Berg (2): ipv6: suppress sparse warnings in IP6_ECN_set_ce() nl80211: validate number of probe response CSA counters Johannes Weiner (2): mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page() mm: filemap: don't plant shadow entries without radix tree node John Stultz (1): timekeeping: Cap array access in timekeeping_debug Joseph Qi (1): ocfs2/dlm: fix race between convert and migration Joseph Salisbury (1): usb: quirks: Add no-lpm quirk for Elan Karl Beldan (1): mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl Keerthy (2): ARM: AM43XX: hwmod: Fix RSTST register offset for pruss rtc: ds1307: Fix relying on reset value for weekday Kent Overstreet (1): bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. Konrad Leszczynski (1): usb: dwc3: fix for the isoc transfer EP_BUSY flag Konstantin Neumoin (1): balloon: check the number of available pages in leak balloon Krzysztof Kozlowski (2): serial: samsung: Fix ERR pointer dereference on deferred probe serial: samsung: Fix possible out of bounds access on non-DT platform Kweh, Hock Leong (1): iio: fix pressure data output unit in hid-sensor-attributes Lance Richardson (1): ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Laura Abbott (1): ftrace/recordmcount: Work around for addition of metag magic but not relocations Lauro Costa (1): Bluetooth: Add USB ID 13D3:3487 to ath3k Linus Torvalds (1): Using BUG_ON() as an assert() is _never_ acceptable Linus Walleij (3): gpio: Fix OF build problem on UM iio: accel: kxsd9: Fix raw read return iio: accel: kxsd9: Fix scaling bug Liping Zhang (2): netfilter: nf_ct_expect: remove the redundant slash when policy name is empty netfilter: nfnetlink_queue: reject verdict request from different portid Lu Baolu (1): usb: misc: usbtest: add fix for driver hang Lubomir Rintel (1): USB: serial: option: add D-Link DWM-156/A3 Lukas Wunner (6): drm/nouveau: Don't leak runtime pm ref on driver unload drm/radeon: Don't leak runtime pm ref on driver unload drm/radeon: Don't leak runtime pm ref on driver load x86/quirks: Apply nvidia_bugs quirk only on root bus x86/quirks: Reintroduce scanning of secondary buses x86/quirks: Add early quirk to reset Apple AirPort card Lyude (1): drm/radeon: Poll for both connect/disconnect on analog connectors Mahesh Salgaonkar (2): powerpc/powernv: Fix MCE handler to avoid trashing CR0/CR1 registers. powerpc/book3s: Fix MCE console messages for unrecoverable MCE. Mario Kleiner (2): drm/edid: Add 6 bpc quirk for display AEO model 0. drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown" Masahiro Yamada (1): Input: tegra-kbc - fix inverted reset logic Mathias Krause (1): xfrm_user: propagate sec ctx allocation errors Mathias Nyman (2): xhci: always handle "Command Ring Stopped" events xhci: don't dereference a xhci member after removing xhci Matt Fleming (1): perf/x86/amd: Make HW_CACHE_REFERENCES and HW_CACHE_MISSES measure L2 Matt Redfearn (1): MIPS: paravirt: Fix undefined reference to smp_bootstrap Mauricio Faria de Oliveira (1): powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb) Mauro Carvalho Chehab (1): ngene: properly handle __user ptr Maxim Patlasov (1): fuse: fuse_flush must check mapping->flags for errors Michael Ellerman (1): powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support Michael Neuling (1): powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() Michael Walle (1): hwmon: (adt7411) set bit 3 in CFG1 register Michal Hocko (1): kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd Mike Christie (1): target: Fix max_unmap_lba_count calc overflow Mike Snitzer (1): dm flakey: error READ bios during the down_interval Mikulas Patocka (1): drm/nouveau/fbcon: fix font width not divisible by 8 Mukesh Ojha (1): powerpc/powernv : Drop reference added by kset_find_obj() Neal Cardwell (1): tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data Nicholas Bellinger (2): target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP target: Fix race between iscsi-target connection shutdown + ABORT_TASK Nicolai Stange (1): lib/mpi: mpi_read_raw_data(): fix nbits calculation Nicolas Dichtel (1): ipv6: add missing netconf notif when 'all' is updated Nicolas Iooss (1): printk: fix parsing of "brl=" option Nikolay Aleksandrov (1): ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Nishanth Menon (1): hwrng: omap - Fix assumption that runtime_get_sync will always succeed Olga Kornievskaia (1): SUNRPC: allow for upcalls for same uid but different gss service Paolo Bonzini (2): KVM: nVMX: fix lifetime issues for vmcs02 compiler-gcc: disable -ftracer for __noclone functions Paul Blakey (1): net/mlx5: Added missing check of msg length in verifying its signature Paul Burton (1): MIPS: Malta: Fix IOCU disable switch read for MIPS64 Paul Moore (1): netlabel: add address family checks to netlbl_{sock,req}_delattr() Pavel Shilovsky (1): CIFS: Fix a possible invalid memory access in smb2_query_symlink() Peter Rosin (1): i2c: mux: pca954x: retry updating the mux selection on failure Peter Ujfalusi (1): ASoC: omap-mcpdm: Fix irq resource handling Peter Wu (4): ALSA: hda - fix use-after-free after module unload drm/nouveau/acpi: ensure matching ACPI handle and supported functions drm/nouveau/acpi: return supported DSM functions drm/nouveau/acpi: check for function 0x1B before using it Phil Turnbull (1): ceph: Correctly return NXIO errors from ceph_llseek Rabin Vincent (1): cifs: fix crash due to race in hmac(md5) handling Radim Krčmář (1): KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write Richard Weinberger (2): ubi: Make volume resize power cut aware ubi: Be more paranoid while seaching for the most recent Fastmap Rob Clark (3): drm/msm: use mutex_lock_interruptible for submit ioctl drm/msm: fix use of copy_from_user() while holding spinlock drm/msm: protect against faults from copy_from_user() in submit ioctl Robert Deliën (1): USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices Roderick Colenbrander (1): HID: uhid: fix timeout when probe races with IO Roger Quadros (1): ARM: 8617/1: dma: fix dma_max_pfn() Russell King (3): crypto: caam - fix non-hmac hashes ARM: sa1100: clear reset status prior to reboot ARM: sa1111: fix pcmcia suspend/resume Sabrina Dubroca (1): l2tp: fix use-after-free during module unload Sachin Prabhu (1): cifs: Check for existing directory when opening file with O_CREAT Sara Sharon (1): iwlwifi: pcie: fix access to scratch buffer Sebastian Andrzej Siewior (1): x86/mm: Disable preemption during CR3 read+write Sebastian Reichel (1): ARM: OMAP3: hwmod data: Add sysc information for DSI Sergei Miroshnichenko (1): can: dev: fix deadlock reported after bus-off Sheng-Hui J. Chu (1): USB: serial: ftdi_sio: add device ID for WICED USB UART dev board Shrirang Bagul (1): ALSA: hda - On-board speaker fixup on ACER Veriton Simon Baatz (1): ARM: kirkwood: ib62x0: fix size of u-boot environment partition Simon Wunderlich (1): batman-adv: lock crc access in bridge loop avoidance Soeren Moch (1): media: dvb_ringbuffer: Add memory barriers Soheil Hassas Yeganeh (2): tcp: consider recv buf for the initial window scale tun: fix transmit timestamp support Srinivas Ramana (1): ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 Stefan Haberland (1): s390/dasd: fix hanging device after clear subchannel Stefan Richter (1): firewire: net: guard against rx buffer overflows Stephan Mueller (1): random: add interrupt callback to VMBus IRQ handler Steven Rostedt (1): x86/paravirt: Do not trace _paravirt_ident_*() functions Steven Rostedt (Red Hat) (1): tracing: Move mutex to protect against resetting of seq data Sudeep Holla (1): i2c: qup: skip qup_i2c_suspend if the device is already runtime suspended Suzuki K Poulose (1): kvm-arm: Unmap shadow pagetables properly Suzuki K. Poulose (1): arm64: perf: reject groups spanning multiple HW PMUs Sven Eckelmann (10): ath9k: Fix programming of minCCA power threshold batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag batman-adv: Fix orig_node_vlan leak on orig_node_release batman-adv: Fix kerneldoc member names in for main structs batman-adv: Fix non-atomic bla_claim::backbone_gw access batman-adv: Fix reference leak in batadv_find_router batman-adv: Free last_bonding_candidate on release of orig_node batman-adv: Fix speedy join in gateway client mode batman-adv: Add missing refcnt for last_candidate Sven Van Asbroeck (1): power: supply: max17042_battery: fix model download bug. Takashi Iwai (5): ALSA: ctl: Stop notification after disconnection ALSA: pcm: Free chmap at PCM free callback, too ALSA: hda: Fix krealloc() with __GFP_ZERO usage ALSA: timer: Fix zero-division by continue of uninitialized instance ALSA: rawmidi: Fix possible deadlock with virmidi registration Takashi Sakamoto (1): ALSA: fireworks: accessing to user space outside spinlock Taras Kondratiuk (1): mmc: block: fix packed command header endianness Tejun Heo (1): kernfs: don't depend on d_find_any_alias() when generating notifications Theodore Ts'o (3): random: print a warning for the first ten uninitialized random users ext4: validate s_reserved_gdt_blocks on mount ext4: validate that metadata blocks do not overlap superblock Thomas Garnier (1): PM / hibernate: Restore processor state before using per-CPU variables Thomas Petazzoni (1): ARM: mvebu: fix HW I/O coherency related deadlocks Trond Myklebust (2): NFSv4.x: Fix a refcount leak in nfs_callback_up_net NFSv4.1: Fix the CREATE_SESSION slot number accounting Tyrel Datwyler (1): scsi: fix upper bounds check of sense key in scsi_sense_key_string() Vegard Nossum (11): ext4: check for extents that wrap around ext4: don't call ext4_should_journal_data() on the journal inode ext4: fix reference counting bug on block allocation error ext4: short-cut orphan cleanup on error xfrm: fix crash in XFRM_MSG_GETSA netlink handler net/irda: fix NULL pointer dereference on memory allocation failure block: fix use-after-free in seq file fs/seq_file: fix out-of-bounds read ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE ALSA: timer: fix NULL pointer dereference on memory allocation failure ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Vignesh R (2): gpio: pca953x: Fix NBANK calculation for PCA9536 iio: adc: ti_am335x_adc: Protect FIFO1 from concurrent access Vincent Stehlé (1): ubifs: Fix assertion in layout_in_gaps() Vineet Gupta (2): ARC: uaccess: get_user to zero out dest in cause of fault ARC: use ASL assembler mnemonic Vlad Tsyrklevich (1): vfio/pci: Fix integer overflows, bitmask check Vladis Dronov (1): usbvision: revert commit 588afcc1 WANG Cong (1): ppp: defer netns reference release for ppp channel Wanpeng Li (2): sched/cputime: Fix prev steal time accouting during CPU hotplug x86/apic: Do not init irq remapping if ioapic is disabled Wei Fang (1): fuse: fix wrong assignment of ->flags in fuse_send_init() Wei Yongjun (1): ipv6: addrconf: fix dev refcont leak when DAD failed Will Deacon (2): arm64: debug: unmask PSTATE.D earlier arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb() Xiaolong Ye (1): PM / devfreq: Fix incorrect type issue. Yadi.hu (1): i2c-eg20t: fix race between i2c init and interrupt enable Yan, Zheng (1): libceph: set 'exists' flag for newly up osd Yinghai Lu (1): megaraid_sas: Fix probing cards without io port Yoshihiro Shimoda (4): usb: renesas_usbhs: fix the sequence in xfer_work() usb: renesas_usbhs: fix NULL pointer dereference in xfer_work() usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable() usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition Zefan Li (1): cpuset: make sure new tasks conform to the current config of the cpuset phil.turnbull@oracle.com (2): l2tp: Correctly return -EBADF from pppol2tp_getname. irda: Free skb on irda_accept error path. zhong jiang (1): mm,ksm: fix endless looping in allocating memory when ksm enable