Update to 4.0.5

svn path=/dists/sid/linux/; revision=22735

6 files changed, 150 insertions, 183 deletions

diff --git a/debian/changelog b/debian/changelog
index d6f2852c8d14..c5405614c1e3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,153 @@
-linux (4.0.4-2) UNRELEASED; urgency=medium
+linux (4.0.5-1) UNRELEASED; urgency=medium
+
+  * New upstream stable update:
+    https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.5
+    - mnt: Fail collect_mounts when applied to unmounted mounts
+    - fs_pin: Allow for the possibility that m_list or s_list go unused.
+    - [x86] iommu/amd: Fix bug in put_pasid_state_wait
+    - [armhf] iommu/arm-smmu: Fix sign-extension of upstream bus addresses at
+      stage 1
+    - [x86] Revert "KVM: x86: drop fpu_activate hook"
+    - [x86] mce: Fix MCE severity messages
+    - [x86] fpu: Disable XSAVES* support for now
+    - [x86] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages
+    - [x86] KVM: MMU: fix smap permission check
+    - [x86] kvm: fix crash in kvm_vcpu_reload_apic_access_page
+    - [x86] KVM: MMU: fix SMAP virtualization
+    - [x86] kvm/fpu: Enable eager restore kvm FPU for MPX
+    - ktime: Fix ktime_divns to do signed division
+    - fs, omfs: add NULL terminator in the end up the token list
+    - omfs: fix sign confusion for bitmap loop counter
+    - xfs: xfs_attr_inactive leaves inconsistent attr fork state behind
+    - xfs: xfs_iozero can return positive errno
+    - ovl: don't remove non-empty opaque directory
+    - ovl: mount read-only if workdir can't be created
+    - mfd: da9052: Fix broken regulator probe
+    - libceph: request a new osdmap if lingering request maps to no osd
+    - Revert "libceph: clear r_req_lru_item in __unregister_linger_request()"
+    - Btrfs: fix racy system chunk allocation when setting block group ro
+    - xen/events: don't bind non-percpu VIRQs with percpu chip
+    - hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE
+    - iio/axp288_adc: add missing channel info mask
+    - iio:st_sensors: Fix oops when probing SPI devices
+    - iio: light: hid-sensor-prox: Fix modifier
+    - iio: pressure: hid-sensor-press: Fix modifier
+    - iio: adc: spmi-vadc: Fix overflow in output value normalization
+    - iio: adc: cc10001: Fix the channel number mapping
+    - iio: adc: cc10001: Fix incorrect use of power-up/power-down register
+    - iio: adc: cc10001: Add delay before setting START bit
+    - iio: adc: cc10001: Fix regulator_get_voltage() return value check
+    - iio: adc: xilinx: Fix register addresses
+    - iio: adc: xilinx: Fix "vccaux" channel .address
+    - iio: adc: xilinx: Fix VREFP scale
+    - iio: adc: xilinx: Fix VREFN sign
+    - hwmon: (tmp401) Do not auto-detect chip on I2C address 0x37
+    - hwmon: (nct6775) Add missing sysfs attribute initialization
+    - hwmon: (nct6683) Add missing sysfs attribute initialization
+    - clk: exynos5420: Restore GATE_BUS_TOP on suspend
+    - clk: add missing lock when call clk_core_enable in clk_set_parent
+    - brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails
+    - lib: Fix strnlen_user() to not touch memory after specified maximum
+    - d_walk() might skip too much
+    - module: Call module notifier on failure after complete_formation()
+    - ALSA: usb-audio: Add quirk for MS LifeCam Studio
+    - ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724
+    - ALSA: hda - Add headphone quirk for Lifebook E752
+    - ALSA: hda - Add headset mic quirk for Dell Inspiron 5548
+    - ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450
+    - ALSA: usb-audio: Add quirk for MS LifeCam HD-3000
+    - Revert "ALSA: hda - Add mute-LED mode control to Thinkpad"
+    - ALSA: hda - Fix noise on AMD radeon 290x controller
+    - ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls
+    - ASoC: uda1380: Avoid accessing i2c bus when codec is disabled
+    - ASoC: dapm: Modify widget stream name according to prefix
+    - ASoC: wm8960: fix "RINPUT3" audio route error
+    - ASoC: wm8994: correct BCLK DIV 348 to 384
+    - RDMA/core: Fix for parsing netlink string attribute
+    - staging: gdm724x: Correction of variable usage after applying ALIGN()
+    - staging: vt6656: use ieee80211_tx_info to select packet type.
+    - staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe
+    - staging: vt6655: implement IEEE80211_TX_STAT_NOACK_TRANSMITTED
+    - staging: vt6655: Fix 80211 control and management status reporting.
+    - staging: vt6655: vnt_tx_packet Correct TX order of OWNED_BY_NIC
+    - staging: vt6655: lock MACvWriteBSSIDAddress.
+    - [x86] perf/rapl: Enable Broadwell-U RAPL support
+    - target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST
+    - xhci: fix isoc endpoint dequeue from advancing too far on transaction error
+    - xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256
+    - xhci: gracefully handle xhci_irq dead device
+    - USB: visor: Match I330 phone more precisely
+    - USB: pl2303: Remove support for Samsung I330
+    - USB: cp210x: add ID for KCF Technologies PRN device
+    - usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices
+    - usb: gadget: configfs: Fix interfaces array NULL-termination
+    - powerpc/mce: fix off by one errors in mce event handling
+    - powerpc: Align TOC to 256 bytes
+    - mmc: atmel-mci: fix bad variable type for clkdiv
+    - tty/n_gsm.c: fix a memory leak when gsmtty is removed
+    - pty: Fix input race when closing
+    - ext4: fix lazytime optimization
+    - ext4: fix NULL pointer dereference when journal restart fails
+    - ext4: check for zero length extent explicitly
+    - jbd2: fix r_count overflows leading to buffer overflow in journal recovery
+    - ahci: avoton port-disable reset-quirk
+    - libata: Add helper to determine when PHY events should be ignored
+    - libata: Ignore spurious PHY event on LPM policy change
+    - libata: Blacklist queued TRIM on all Samsung 800-series
+    - [arm64] bpf: fix signedness bug in loading 64-bit immediate
+    - rt2x00: add new rt2800usb device DWA 130
+    - [armhf] 8325/1: exynos: move resume code to .text section
+    - gpio: gpio-kempld: Fix get_direction return value
+    - crypto: s390/ghash - Fix incorrect ghash icv buffer handling.
+    - mac80211: move WEP tailroom size check
+    - mac80211: don't use napi_gro_receive() outside NAPI context
+    - [s390x] mm: correct return value of pmd_pfn
+    - sched: Handle priority boosted tasks proper in setscheduler()
+    - sched: always use blk_schedule_flush_plug in io_schedule_out
+    - [armel,armhf] 8356/1: mm: handle non-pmd-aligned end of RAM
+    - [armhf] EXYNOS: Fix dereference of ERR_PTR returned by
+      of_genpd_get_from_provider
+    - [armhf] dts: set display clock correctly for exynos4412-trats2
+    - [armel,armhf] fix missing syscall trace exit
+    - [hppa] Fix crashes due to stack randomization on stack-grows-upwards
+      architectures
+    - gfp: add __GFP_NOACCOUNT
+    - kernfs: do not account ino_ida allocations to memcg
+    - mm, numa: really disable NUMA balancing by default on single node machines
+    - nfsd/blocklayout: pretend we can send deviceid notifications
+    - nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op
+    - svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures
+    - [x86] firmware: dmi_scan: Fix ordering of product_uuid
+    - [armhf] thermal: armada: Update Armada 380 thermal sensor coefficients
+    - md/raid5: don't record new size if resize_stripes fails.
+    - md/raid0: fix restore to sector variable in raid0_make_request
+    - Revert "HID: logitech-hidpp: support combo keyboard touchpad TK820"
+    - [mips*] fix FP mode selection in lieu of .MIPS.abiflags data
+    - rtlwifi: rtl8192cu: Fix kernel deadlock
+    - Input: elantech - fix semi-mt protocol for v3 HW
+    - storvsc: Set the SRB flags correctly when no data transfer is needed
+    - sd: Disable support for 256 byte/sector disks
+    - ACPI / init: Fix the ordering of acpi_reserve_resources()
+    - iwlwifi: mvm: clean net-detect info if device was reset during suspend
+    - iwlwifi: mvm: Free fw_status after use to avoid memory leak
+    - iwlwifi: pcie: prevent using unmapped memory in fw monitor
+    - drm/radeon: add new bonaire pci id
+    - drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling
+    - drm/radeon: retry dcpd fetch
+    - drm/plane-helper: Adapt cursor hack to transitional helpers
+    - drm/radeon: don't share plls if monitors differ in audio support
+    - drm/radeon/audio: make sure connector is valid in hotplug case
+    - Revert "drm/radeon: only mark audio as connected if the monitor supports
+      it (v3)"
+    - drm/radeon: partially revert "fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling"
+    - dm: fix casting bug in dm_merge_bvec()
+    - dm: fix reload failure of 0 path multipath mapping on blk-mq devices
+    - drm/amdkfd: Don't report local memory size
+    - vfs: read file_handle only once in handle_to_path
+    - UBI: block: Add missing cache flushes
+    - pwm: img: Impose upper and lower timebase steps value
+    - md: fix race when unfreezing sync_action
+    - fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings
 
   [ Ben Hutchings ]
   * udeb: Remove i2o modules (fixes FTBFS on amd64) (Closes: #787004)
diff --git a/debian/patches/bugfix/all/fs_pin-allow-for-the-possibility-that-m_list-or-s_li.patch b/debian/patches/bugfix/all/fs_pin-allow-for-the-possibility-that-m_list-or-s_li.patch
deleted file mode 100644
index 41b164245a95..000000000000
--- a/debian/patches/bugfix/all/fs_pin-allow-for-the-possibility-that-m_list-or-s_li.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: "Eric W. Biederman" <ebiederm@xmission.com>
-Date: Thu, 2 Apr 2015 16:35:48 -0500
-Subject: fs_pin: Allow for the possibility that m_list or s_list go unused.
-Origin: https://git.kernel.org/linus/820f9f147dcce2602eefd9b575bbbd9ea14f0953
-
-This is needed to support lazily umounting locked mounts.  Because the
-entire unmounted subtree needs to stay together until there are no
-users with references to any part of the subtree.
-
-To support this guarantee that the fs_pin m_list and s_list nodes
-are initialized by initializing them in init_fs_pin allowing
-for the possibility that pin_insert_group does not touch them.
-
-Further use hlist_del_init in pin_remove so that there is
-a hlist_unhashed test before the list we attempt to update
-the previous list item.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- fs/fs_pin.c            | 4 ++--
- include/linux/fs_pin.h | 2 ++
- 2 files changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/fs/fs_pin.c b/fs/fs_pin.c
-index b06c987..611b540 100644
---- a/fs/fs_pin.c
-+++ b/fs/fs_pin.c
-@@ -9,8 +9,8 @@ static DEFINE_SPINLOCK(pin_lock);
- void pin_remove(struct fs_pin *pin)
- {
- 	spin_lock(&pin_lock);
--	hlist_del(&pin->m_list);
--	hlist_del(&pin->s_list);
-+	hlist_del_init(&pin->m_list);
-+	hlist_del_init(&pin->s_list);
- 	spin_unlock(&pin_lock);
- 	spin_lock_irq(&pin->wait.lock);
- 	pin->done = 1;
-diff --git a/include/linux/fs_pin.h b/include/linux/fs_pin.h
-index 9dc4e03..3886b3b 100644
---- a/include/linux/fs_pin.h
-+++ b/include/linux/fs_pin.h
-@@ -13,6 +13,8 @@ struct vfsmount;
- static inline void init_fs_pin(struct fs_pin *p, void (*kill)(struct fs_pin *))
- {
- 	init_waitqueue_head(&p->wait);
-+	INIT_HLIST_NODE(&p->s_list);
-+	INIT_HLIST_NODE(&p->m_list);
- 	p->kill = kill;
- }
- 
diff --git a/debian/patches/bugfix/all/md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch b/debian/patches/bugfix/all/md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch
deleted file mode 100644
index fba990d06f16..000000000000
--- a/debian/patches/bugfix/all/md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From: Eric Work <work.eric@gmail.com>
-Date: Mon, 18 May 2015 23:26:23 -0700
-Subject: md/raid0: fix restore to sector variable in raid0_make_request
-Origin: http://git.neil.brown.name/?p=md.git;a=commitdiff;h=a81157768a00e8cf8a7b43b5ea5cac931262374f
-Bug: https://bugzilla.kernel.org/show_bug.cgi?id=98501
-Bug-Debian: https://bugs.debian.org/786372
-
-The variable "sector" in "raid0_make_request()" was improperly updated
-by a call to "sector_div()" which modifies its first argument in place.
-Commit 47d68979cc968535cb87f3e5f2e6a3533ea48fbd restored this variable
-after the call for later re-use.  Unfortunetly the restore was done after
-the referenced variable "bio" was advanced.  This lead to the original
-value and the restored value being different.  Here we move this line to
-the proper place.
-
-One observed side effect of this bug was discarding a file though
-unlinking would cause an unrelated file's contents to be discarded.
-
-Signed-off-by: NeilBrown <neilb@suse.de>
-Fixes: 47d68979cc96 ("md/raid0: fix bug with chunksize not a power of 2.")
-Cc: stable@vger.kernel.org (any that received above backport)
-URL: https://bugzilla.kernel.org/show_bug.cgi?id=98501
----
- drivers/md/raid0.c |    4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/md/raid0.c
-+++ b/drivers/md/raid0.c
-@@ -517,6 +517,9 @@ static void raid0_make_request(struct md
- 			 ? (sector & (chunk_sects-1))
- 			 : sector_div(sector, chunk_sects));
- 
-+		/* Restore due to sector_div */
-+		sector = bio->bi_iter.bi_sector;
-+
- 		if (sectors < bio_sectors(bio)) {
- 			split = bio_split(bio, sectors, GFP_NOIO, fs_bio_set);
- 			bio_chain(split, bio);
-@@ -524,7 +527,6 @@ static void raid0_make_request(struct md
- 			split = bio;
- 		}
- 
--		sector = bio->bi_iter.bi_sector;
- 		zone = find_zone(mddev->private, &sector);
- 		tmp_dev = map_sector(mddev, zone, sector, &sector);
- 		split->bi_bdev = tmp_dev->bdev;
diff --git a/debian/patches/bugfix/all/mnt-fail-collect_mounts-when-applied-to-unmounted-mo.patch b/debian/patches/bugfix/all/mnt-fail-collect_mounts-when-applied-to-unmounted-mo.patch
deleted file mode 100644
index 5c865967a0cf..000000000000
--- a/debian/patches/bugfix/all/mnt-fail-collect_mounts-when-applied-to-unmounted-mo.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: "Eric W. Biederman" <ebiederm@xmission.com>
-Date: Wed, 7 Jan 2015 14:28:26 -0600
-Subject: mnt: Fail collect_mounts when applied to unmounted mounts
-Origin: https://git.kernel.org/linus/cd4a40174b71acd021877341684d8bb1dc8ea4ae
-
-The only users of collect_mounts are in audit_tree.c
-
-In audit_trim_trees and audit_add_tree_rule the path passed into
-collect_mounts is generated from kern_path passed an audit_tree
-pathname which is guaranteed to be an absolute path.   In those cases
-collect_mounts is obviously intended to work on mounted paths and
-if a race results in paths that are unmounted when collect_mounts
-it is reasonable to fail early.
-
-The paths passed into audit_tag_tree don't have the absolute path
-check.  But are used to play with fsnotify and otherwise interact with
-the audit_trees, so again operating only on mounted paths appears
-reasonable.
-
-Avoid having to worry about what happens when we try and audit
-unmounted filesystems by restricting collect_mounts to mounts
-that appear in the mount tree.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
----
- fs/namespace.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -1709,8 +1709,11 @@ struct vfsmount *collect_mounts(struct p
- {
- 	struct mount *tree;
- 	namespace_lock();
--	tree = copy_tree(real_mount(path->mnt), path->dentry,
--			 CL_COPY_ALL | CL_PRIVATE);
-+	if (!check_mnt(real_mount(path->mnt)))
-+		tree = ERR_PTR(-EINVAL);
-+	else
-+		tree = copy_tree(real_mount(path->mnt), path->dentry,
-+				 CL_COPY_ALL | CL_PRIVATE);
- 	namespace_unlock();
- 	if (IS_ERR(tree))
- 		return ERR_CAST(tree);
diff --git a/debian/patches/bugfix/all/vfs-read-file_handle-only-once-in-handle_to_path.patch b/debian/patches/bugfix/all/vfs-read-file_handle-only-once-in-handle_to_path.patch
deleted file mode 100644
index ecc1bbb52b47..000000000000
--- a/debian/patches/bugfix/all/vfs-read-file_handle-only-once-in-handle_to_path.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From: Sasha Levin <sasha.levin@oracle.com>
-Subject: vfs: read file_handle only once in handle_to_path
-Date: Wed, 28 Jan 2015 15:30:43 -0500
-Origin: http://article.gmane.org/gmane.linux.file-systems/92438
-
-We used to read file_handle twice. Once to get the amount of extra bytes, and
-once to fetch the entire structure.
-
-This may be problematic since we do size verifications only after the first
-read, so if the number of extra bytes changes in userspace between the first
-and second calls, we'll have an incoherent view of file_handle.
-
-Instead, read the constant size once, and copy that over to the final
-structure without having to re-read it again.
-
-Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
----
-Change in v2:
- - Use the f_handle pointer rather than size of struct
-
- fs/fhandle.c |    5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
---- a/fs/fhandle.c
-+++ b/fs/fhandle.c
-@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd
- 		goto out_err;
- 	}
- 	/* copy the full handle */
--	if (copy_from_user(handle, ufh,
--			   sizeof(struct file_handle) +
-+	*handle = f_handle;
-+	if (copy_from_user(&handle->f_handle,
-+			   &ufh->f_handle,
- 			   f_handle.handle_bytes)) {
- 		retval = -EFAULT;
- 		goto out_handle;
diff --git a/debian/patches/series b/debian/patches/series
index 836e67898636..4c80c9e3ecbb 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -62,14 +62,10 @@ debian/i2o-disable-i2o_ext_adaptec-on-64bit.patch
 bugfix/all/aic94xx-remove-broken-fallback-for-missing-ctrl-a.patch
 bugfix/all/rtsx_usb_ms-use-msleep_interruptible-in-polling-loop.patch
 bugfix/all/net-mv643xx-disable-tso-by-default.patch
-bugfix/all/vfs-read-file_handle-only-once-in-handle_to_path.patch
 bugfix/all/ext4-allocate-entire-range-in-zero-range.patch
 debian/emmc-don-t-initialize-partitions-on-rpmb-flagged-areas.patch
-bugfix/all/mnt-fail-collect_mounts-when-applied-to-unmounted-mo.patch
-bugfix/all/fs_pin-allow-for-the-possibility-that-m_list-or-s_li.patch
 bugfix/all/rtc-hctosys-do-not-treat-lack-of-rtc-device-as-error.patch
 bugfix/all/rtc-hctosys-use-function-name-in-the-error-log.patch
-bugfix/all/md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch
 bugfix/all/cdc_ncm-fix-tx_bytes-statistics.patch
 bugfix/all/musb-musb-fix-order-of-conditions-for-assigning-end-p.patch