We currently allow changing the mq flag (IFF_MULTI_QUEUE) for a persistent
device. This will result a mismatch between the number the queues in netdev and
tuntap. This is because we only allocate a 1q netdevice when IFF_MULTI_QUEUE was
not specified, so when we set the IFF_MULTI_QUEUE and try to attach more queues
later, netif_set_real_num_tx_queues() may fail which result a single queue
netdevice with multiple sockets attached.

Solve this by disallowing changing the mq flag for persistent device.

Bug was introduced by commit edfb6a14
(tuntap: reduce memory using of queues).
Reported-by: Sriram Narasimhan <sriram.narasimhan@hp.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The three arrays of strings: af_family_key_strings,
af_family_slock_key_strings and af_family_clock_key_strings have not
VSOCK's string
Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

To: linux-kernel@vger.kernel.org
Cc: x86@kernel.org, trinity@vger.kernel.org, Andy Lutomirski <luto@amacapital.net>, netdev@vger.kernel.org, "David S.
	Miller" <davem@davemloft.net>
Subject: [PATCH 5/5] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg

MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --
it's a hack that steals a bit to indicate to other networking code
that a compat entry was used.  So don't allow it from a non-compat
syscall.

This prevents an oops when running this code:

int main()
{
	int s;
	struct sockaddr_in addr;
	struct msghdr *hdr;

	char *highpage = mmap((void*)(TASK_SIZE_MAX - 4096), 4096,
	                      PROT_READ | PROT_WRITE,
	                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
	if (highpage == MAP_FAILED)
		err(1, "mmap");

	s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
	if (s == -1)
		err(1, "socket");

        addr.sin_family = AF_INET;
        addr.sin_port = htons(1);
        addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) != 0)
		err(1, "connect");

	void *evil = highpage + 4096 - COMPAT_MSGHDR_SIZE;
	printf("Evil address is %p\n", evil);

	if (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) < 0)
		err(1, "sendmmsg");

	return 0;
}

Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Unlike ipv4_redirect() and ipv4_sk_redirect(), ip_do_redirect()
doesn't call __build_flow_key() directly but via
ip_rt_build_flow_key() wrapper. This leads to __build_flow_key()
getting pointer to IPv4 header of the ICMP redirect packet
rather than pointer to the embedded IPv4 header of the packet
initiating the redirect.

As a result, handling of ICMP redirects initiated by TCP packets
is broken. Issue was introduced by

	4895c771 ("ipv4: Add FIB nexthop exceptions.")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

The phy_init_eee has to exit with an error when the
local device and its link partner both do not support EEE.
So this patch fixes a problem when verify this.
Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Daniel Petre reported crashes in icmp_dst_unreach() with following call
graph:

#3 [ffff88003fc03938] __stack_chk_fail at ffffffff81037f77
#4 [ffff88003fc03948] icmp_send at ffffffff814d5fec
#5 [ffff88003fc03ae8] ipv4_link_failure at ffffffff814a1795
#6 [ffff88003fc03af8] ipgre_tunnel_xmit at ffffffff814e7965
#7 [ffff88003fc03b78] dev_hard_start_xmit at ffffffff8146e032
#8 [ffff88003fc03bc8] sch_direct_xmit at ffffffff81487d66
#9 [ffff88003fc03c08] __qdisc_run at ffffffff81487efd
#10 [ffff88003fc03c48] dev_queue_xmit at ffffffff8146e5a7
#11 [ffff88003fc03c88] ip_finish_output at ffffffff814ab596

Daniel found a similar problem mentioned in
 http://lkml.indiana.edu/hypermail/linux/kernel/1007.0/00961.html

And indeed this is the root cause : skb->cb[] contains data fooling IP
stack.

We must clear IPCB in ip_tunnel_xmit() sooner in case dst_link_failure()
is called. Or else skb->cb[] might contain garbage from GSO segmentation
layer.

A similar fix was tested on linux-3.9, but gre code was refactored in
linux-3.10. I'll send patches for stable kernels as well.

Many thanks to Daniel for providing reports, patches and testing !
Reported-by: Daniel Petre <daniel.petre@rcs-rds.ro>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix to release resources when ptp_clock_register() fail instead
of return error code directly.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>

Add the missing free_netdev() before return from function
qlge_probe() in the error handling case.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Acked-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull gfs2 fixes from Steven Whitehouse:
 "This time there are just four fixes.  There are a couple of minor
  updates to the quota code, a fix for KConfig to ensure that only valid
  combinations including GFS2 can be built, and a fix for a typo
  affecting end i/o processing when writing the journal.

  Also, there is a temporary fix for a performance regression relating
  to block reservations and directories.  A longer fix will be applied
  in due course, but this deals with the most immediate problem for now"

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes:
  GFS2: Fix typo in gfs2_log_end_write loop
  GFS2: fix DLM depends to fix build errors
  GFS2: Use single-block reservations for directories
  GFS2: two minor quota fixups

Pull powerpc fixes from Benjamin Herrenschmidt:
 "Some more P8 related bits, a bunch of fixes for our P7+/P8 HW crypto
  drivers, some added workarounds for those radeons that don't do proper
  64-bit MSIs and a couple of other trivialities by myself."

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/pseries: Make 32-bit MSI quirk work on systems lacking firmware support
  powerpc/powernv: Build a zImage.epapr
  powerpc: Make radeon 32-bit MSI quirk work on powernv
  powerpc: Context switch more PMU related SPRs
  powerpc/powernv: Fix condition for when to invalidate the TCE cache
  powerpc/pci: Fix bogus message at boot about empty memory resources
  powerpc: Fix TLB cleanup at boot on POWER8
  drivers/crypto/nx: Fixes for multiple races and issues

Pull networking fixes from David Miller:
 "It's been a while since my last pull request so quite a few fixes have
  piled up."

Indeed.

 1) Fix nf_{log,queue} compilation with PROC_FS disabled, from Pablo
    Neira Ayuso.

 2) Fix data corruption on some tg3 chips with TSO enabled, from Michael
    Chan.

 3) Fix double insertion of VLAN tags in be2net driver, from Sarveshwar
    Bandi.

 4) Don't have TCP's MD5 support pass > PAGE_SIZE page offsets in
    scatter-gather entries into the crypto layer, the crypto layer can't
    handle that.  From Eric Dumazet.

 5) Fix lockdep splat in 802.1Q MRP code, also from Eric Dumazet.

 6) Fix OOPS in netfilter log module when called from conntrack, from
    Hans Schillstrom.

 7) FEC driver needs to use netif_tx_{lock,unlock}_bh() rather than the
    non-BH disabling variants.  From Fabio Estevam.

 8) TCP GSO can generate out-of-order packets, fix from Eric Dumazet.

 9) vxlan driver doesn't update 'used' field of fdb entries when it
    should, from Sridhar Samudrala.

10) ipv6 should use kzalloc() to allocate inet6 socket cork options,
    otherwise we can OOPS in ip6_cork_release().  From Eric Dumazet.

11) Fix races in bonding set mode, from Nikolay Aleksandrov.

12) Fix checksum generation regression added by "r8169: fix 8168evl
    frame padding.", from Francois Romieu.

13) ip_gre can look at stale SKB data pointer, fix from Eric Dumazet.

14) Fix checksum handling when GSO is enabled in bnx2x driver with
    certain chips, from Yuval Mintz.

15) Fix double free in batman-adv, from Martin Hundebøll.

16) Fix device startup synchronization with firmware in tg3 driver, from
    Nithin Sujit.

17) perf networking dropmonitor doesn't work at all due to mixed up
    trace parameter ordering, from Ben Hutchings.

18) Fix proportional rate reduction handling in tcp_ack(), from Nandita
    Dukkipati.

19) IPSEC layer doesn't return an error when a valid state is detected,
    causing an OOPS.  Fix from Timo Teräs.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (85 commits)
  be2net: bug fix on returning an invalid nic descriptor
  tcp: xps: fix reordering issues
  net: Revert unused variable changes.
  xfrm: properly handle invalid states as an error
  virtio_net: enable napi for all possible queues during open
  tcp: bug fix in proportional rate reduction.
  net: ethernet: sun: drop unused variable
  net: ethernet: korina: drop unused variable
  net: ethernet: apple: drop unused variable
  qmi_wwan: Added support for Cinterion's PLxx WWAN Interface
  perf: net_dropmonitor: Remove progress indicator
  perf: net_dropmonitor: Use bisection in symbol lookup
  perf: net_dropmonitor: Do not assume ordering of dictionaries
  perf: net_dropmonitor: Fix symbol-relative addresses
  perf: net_dropmonitor: Fix trace parameter order
  net: fec: use a more proper compatible string for MVF type device
  qlcnic: Fix updating netdev->features
  qlcnic: remove netdev->trans_start updates within the driver
  qlcnic: Return proper error codes from probe failure paths
  tg3: Update version to 3.132
  ...

There was a missing _all in this loop iterator
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

Fix build errors by correcting DLM dependencies in GFS2.
Build errors happen when CONFIG_GFS2_FS_LOCKING_DLM=y and CONFIG_DLM=m:

fs/built-in.o: In function `gfs2_lock':
file.c:(.text+0xc7abd): undefined reference to `dlm_posix_get'
file.c:(.text+0xc7ad0): undefined reference to `dlm_posix_unlock'
file.c:(.text+0xc7ad9): undefined reference to `dlm_posix_lock'
fs/built-in.o: In function `gdlm_unmount':
lock_dlm.c:(.text+0xd6e5b): undefined reference to `dlm_release_lockspace'
fs/built-in.o: In function `sync_unlock':
lock_dlm.c:(.text+0xd6e9e): undefined reference to `dlm_unlock'
fs/built-in.o: In function `sync_lock':
lock_dlm.c:(.text+0xd6fb6): undefined reference to `dlm_lock'
fs/built-in.o: In function `gdlm_put_lock':
lock_dlm.c:(.text+0xd7238): undefined reference to `dlm_unlock'
fs/built-in.o: In function `gdlm_mount':
lock_dlm.c:(.text+0xd753e): undefined reference to `dlm_new_lockspace'
lock_dlm.c:(.text+0xd79d3): undefined reference to `dlm_release_lockspace'
fs/built-in.o: In function `gdlm_lock':
lock_dlm.c:(.text+0xd8179): undefined reference to `dlm_lock'
fs/built-in.o: In function `gdlm_cancel':
lock_dlm.c:(.text+0xd6b22): undefined reference to `dlm_unlock'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

This patch changes the multi-block allocation code, such that
directory inodes only get a single block reserved in the bitmap.
That way, the bitmaps are more tightly packed together, and there
are fewer spans of free blocks for in-use block reservations.
This means it takes less time to find a free span of blocks in the
bitmap, which speeds things up. This increases the performance of
some workloads by almost 2X. In Nate's mockup.py script (which does
(1) create dir, (2) create dir in dir, (3) create file in that dir)
the test executes in 23 steps rather than 43 steps, a 47%
performance improvement.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

This patch fixes two regression problems that Abhi found in the
GFS2 quota code.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

Recent commit e61133dd added support
for a new firmware feature to force an adapter to use 32 bit MSIs.
However, this firmware is not available for all systems. The hack below
allows devices needing 32 bit MSIs to work on these systems as well.
It is careful to only enable this on Gen2 slots, which should limit
this to configurations where this hack is needed and tested to work.

[Small change to factor out the hack into a separate function -- BenH]
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

The zImage.epapr wrapper allows to use zImages when booting via a flat
device-tree which can be used on powernv.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

This moves the quirk itself to pci_64.c as to get built on all ppc64
platforms (the only ones with a pci_dn), factors the two implementations
of get_pdn() into a single pci_get_dn() and use the quirk to do 32-bit
MSIs on IODA based powernv platforms.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

In commit 9353374b "Context switch the new EBB SPRs" we added support for
context switching some new EBB SPRs. However despite four of us signing
off on that patch we missed some. To be fair these are not actually new
SPRs, but they are now potentially user accessible so need to be context
switched.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

We use two flags, one to indicate an invalidation is needed after
creating a new entry and one to indicate an invalidation is needed
after removing an entry. However we were testing the wrong flag
in the remove case.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

The message is only meant to be displayed if resource 0 is empty,
but was displayed if any is.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

The TLB has 512 congruence classes (2048 entries 4 way set associative)
while P7 had 128
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Fixes a race on driver init with registering algorithms where the
driver status flag wasn't being set before self testing started.

  Added the cra_alignmask field for CBC and ECB modes.

  Fixed a bug in GCM where AES block size was being used instead of
authsize.

  Removed use of blkcipher_walk routines for scatterlist processing.
Corner cases in the code prevent us from processing an entire
scatterlist at a time and walking the buffers in block sized chunks
turns out to be unecessary anyway.

  Fixed off-by-one error in saving off extra data in the sha code.

  Fixed accounting error for number of bytes processed in the sha code.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

In function be_get_nic_desc(), it will go through the descriptor array
returned from f/w. By comparing the desc_type field, it determines whether
there is a nic descriptor in the array or not. In the case of no nic
descriptor, this function should return NULL.

The code may return an invalide descriptor, when there is no nic descriptor
in the array and the desc_count is less than MAX_RESOURCE_DESC. In this case,
even there is no nic descriptor, it will still return the lase descriptor
since the i doesn't equal to MAX_RESOURCE_DESC.

This patch fix this issue by returning the descriptor when find it and return
NULL for other cases.
Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
Reviewed-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Acked-by: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3853b584 ("xps: Improvements in TX queue selection")
introduced ooo_okay flag, but the condition to set it is slightly wrong.

In our traces, we have seen ACK packets being received out of order,
and RST packets sent in response.

We should test if we have any packets still in host queue.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull GPIO fixes from Linus Walleij:
 - An OMAP fix that makes ethernet work again.
 - Fix for build problem when building the MCP23S08 driver as module.
 - IRQ conflicts in the Langwell driver.
 - Fix IRQ coherency issues in the MXS driver.
 - Return correct errorcode on errorpath when removing GPIO chips.

* tag 'gpio-fixes-v3.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: Don't override the error code in probe error handling
  gpio: mxs: Use set and clear capabilities of the gpio controller
  gpio-langwell: fix irq conflicts when DT is not used
  gpio: mcp23s08: Fix build error when CONFIG_SPI_MASTER=y && CONFIG_I2C=m
  gpio/omap: ensure gpio context is initialised

Pull PCI updates from Bjorn Helgaas:
 "Here are some more fixes for v3.10.  The Moorestown update broke Intel
  Medfield devices, so I reverted it.  The acpiphp change fixes a
  regression: we broke hotplug notifications to host bridges when we
  split acpiphp into the host-bridge related part and the
  endpoint-related part.

  Moorestown
      Revert "x86/pci/mrst: Use configuration mechanism 1 for 00:00.0, 00:02.0, 00:03.0"
  Hotplug
      PCI: acpiphp: Re-enumerate devices when host bridge receives Bus Check"

* tag 'pci-v3.10-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  Revert "x86/pci/mrst: Use configuration mechanism 1 for 00:00.0, 00:02.0, 00:03.0"
  PCI: acpiphp: Re-enumerate devices when host bridge receives Bus Check

Pull input updates from Dmitry Torokhov:
 "A few fixups to Wacom and eGalax touchscreen driver"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: wacom - add an eraser to DTH2242/DTK2241
  Input: wacom - add a few new styli for Cintiq series
  Input: wacom - add three new display tablets
  Input: egalax_ts - ABS_MT_POSITION_Y not reported well

This reverts commits:

c573972c
1a590434
da2e2c21

They were meant for net-next not net.
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull tty/serial fixes from Greg Kroah-Hartman:
 "Here are some tty / serial driver fixes for 3.10-rc2.

  Nothing huge, although the rocket driver fix looks large, it's just
  moving the code around to fix the reported build issues in it.  Other
  than that, this has the fix for the of-reported lockdep warning from
  the vt layer, as well as some other needed bugfixes.

  All of these have been in linux-next for a while"

* tag 'tty-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  tty: mxser: Fix build warning introduced by dfc7b837 (Re: linux-next: build warning after merge of the tty.current tree)
  tty: mxser: fix usage of opmode_ioaddr
  serial: 8250_dw: add ACPI ID for Intel BayTrail
  TTY: Fix tty miss restart after we turn off flow-control
  tty/vt: Fix vc_deallocate() lock order
  TTY: ehv_bytechan: add missing platform_driver_unregister() when module exit
  TTY: rocket, fix more no-PCI warnings
  serial: mcf: missing uart_unregister_driver() on error in mcf_init()
  tty: serial: mpc5xxx: fix error handing in mpc52xx_uart_init()
  serial: samsung: add missing platform_driver_unregister() when module exit
  serial: pl011: protect attribute read from NULL platform data struct
  tty: nwpserial: Pass correct pointer to free_irq()
  serial: 8250_dw: Add valid clk pointer check

Pull staging driver fixes from Greg Kroah-Hartman:
 "Here are some staging tree driver fixes for 3.10-rc2

  The drivers/iio/ changes are here as they are still tied into
  drivers/staging/iio/.

  Nothing major, just a number of small bugfixes, and a larger
  documentation update for the ramster code."

* tag 'staging-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (28 commits)
  staging: dwc2: remove compile warning for USB_DWC2_TRACK_MISSED_SOFS
  iio: exynos_adc: fix wrong structure extration in suspend and resume
  iio:common:st: added disable function after read info raw data
  iio: dac: Fix build error when CONFIG_SPI_MASTER=y && CONFIG_I2C=m
  staging:iio:light:tsl2x7x: fix the error handling in tsl2x7x_probe()
  staging/iio/mxs-lradc: fix preenable for multiple buffers
  staging: imx-drm: imx-tve: Check the return value of 'regulator_enable()'
  staging: video: imx: Select VIDEOMODE_HELPERS for parallel display
  staging: ramster: add how-to document
  staging: dwc2: Fix dma-enabled platform devices using a default dma_mask
  staging: vt6656: [bug] Fix missing spin lock in iwctl_siwpower.
  staging: Swap zram and zsmalloc in Kconfig
  staging: android: logger: use kuid_t instead of uid_t
  staging: zcache: Fix incorrect module_param_array types
  staging/solo6x10: depend on CONFIG_FONTS
  staging/drm: imx: add missing dependencies
  staging: ste_rmi4: Suppress 'ignoring return value of ‘regulator_enable()' warning
  staging: sep: fix driver build and kconfig
  staging: nvec: cleanup childs on remove
  staging: nvec: implement unregistering of notifiers
  ...

Merge tag 'driver-core-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core fixes from Greg Kroah-Hartman:
 "Here are 3 tiny driver core fixes for 3.10-rc2.

  A needed symbol export, a change to make it easier to track down
  offending sysfs files with incorrect attributes, and a klist bugfix.

  All have been in linux-next for a while"

* tag 'driver-core-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  klist: del waiter from klist_remove_waiters before wakeup waitting process
  driver core: print sysfs attribute name when warning about bogus permissions
  driver core: export subsys_virtual_register

Pull char/misc driver fixes from Greg Kroah-Hartman:
 "Here are some small char/misc driver fixes for 3.10-rc2.

  Nothing major here, just a number of fixes for things that people have
  reported, and a MAINTAINERS update for the recent changes for the
  hyperv files that went into 3.10-rc1."

* tag 'char-misc-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port
  uio: UIO_DMEM_GENIRQ should depend on HAS_DMA
  MAINTAINERS: update Hyper-V file list
  mei: bus: Reset event_cb when disabling a device
  Drivers: hv: Fix a bug in get_vp_index()
  mei: fix out of array access to me clients array
  Char: lp, protect LPGETSTATUS with port_mutex
  dummy-irq: require the user to specify an IRQ number

Pull USB fixes from Greg Kroah-Hartman:
 "Here are a number of tiny USB bugfixes / new device ids for 3.10-rc2

  The majority of these are USB gadget fixes, but they are all small.
  Other than that, some USB host controller fixes, and USB serial driver
  fixes for problems reported with them.

  Also hopefully a fixed up USB_OTG Kconfig dependancy, that one seems
  to be almost impossible to get right for all of the different
  platforms these days."

* tag 'usb-3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits)
  USB: cxacru: potential underflow in cxacru_cm_get_array()
  USB: ftdi_sio: Add support for Newport CONEX motor drivers
  USB: option: add device IDs for Dell 5804 (Novatel E371) WWAN card
  usb: ohci: fix goto wrong tag in err case
  usb: isp1760-if: fix memleak when platform_get_resource fail
  usb: ehci-s5p: fix memleak when fallback to pdata
  USB: serial: clean up chars_in_buffer
  USB: ti_usb_3410_5052: fix chars_in_buffer overhead
  USB: io_ti: fix chars_in_buffer overhead
  USB: ftdi_sio: fix chars_in_buffer overhead
  USB: ftdi_sio: clean up get_modem_status
  USB: serial: add generic wait_until_sent implementation
  USB: serial: add wait_until_sent operation
  USB: set device dma_mask without reference to global data
  USB: Blacklisted Cinterion's PLxx WWAN Interface
  usb: option: Add Telewell TW-LTE 4G
  USB: EHCI: remove bogus #error
  USB: reset resume quirk needed by a hub
  USB: usb-stor: realtek_cr: Fix compile error
  usb, chipidea: fix link error when USB_EHCI_HCD is a module
  ...

Pull kvm bugfixes from Gleb Natapov.

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM/MIPS32: Wrap calls to gfn_to_pfn() with srcu_read_lock/unlock()
  KVM/MIPS32: Move include/asm/kvm.h => include/uapi/asm/kvm.h since it is a user visible API.
  KVM: take over co-maintainership from Marcelo, fix MAINTAINERS entry

Fix build error io vmw_vmci.ko when CONFIG_VMWARE_VMCI=m by chaning
iovec.o from lib-y to obj-y.

  ERROR: "memcpy_toiovec" [drivers/misc/vmw_vmci/vmw_vmci.ko] undefined!
  ERROR: "memcpy_fromiovec" [drivers/misc/vmw_vmci/vmw_vmci.ko] undefined!
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

plus send begin and end of express keys events for
Cintiq 13HD and DTH2242/DTK2241
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The error exit path needs err explicitly set. Otherwise it
returns success and the only caller, xfrm_output_resume(),
would oops in skb_dst(skb)->ops derefence as skb_dst(skb) is
NULL.

Bug introduced in commit bb65a9cb (xfrm: removes a superfluous
check and add a statistic).
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Cc: Li RongQing <roy.qing.li@gmail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 55257d72 (virtio-net: fill only rx
queues which are being used) only does the napi enabling during open for
curr_queue_pairs. This will break multiqueue receiving since napi of new queues
were still disabled after changing the number of queues.

This patch fixes this by enabling napi for all possible queues during open.

Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch is a fix for a bug triggering newly_acked_sacked < 0
in tcp_ack(.).

The bug is triggered by sacked_out decreasing relative to prior_sacked,
but packets_out remaining the same as pior_packets. This is because the
snapshot of prior_packets is taken after tcp_sacktag_write_queue() while
prior_sacked is captured before tcp_sacktag_write_queue(). The problem
is: tcp_sacktag_write_queue (tcp_match_skb_to_sack() -> tcp_fragment)
adjusts the pcount for packets_out and sacked_out (MSS change or other
reason). As a result, this delta in pcount is reflected in
(prior_sacked - sacked_out) but not in (prior_packets - packets_out).

This patch does the following:
1) initializes prior_packets at the start of tcp_ack() so as to
capture the delta in packets_out created by tcp_fragment.
2) introduces a new "previous_packets_out" variable that snapshots
packets_out right before tcp_clean_rtx_queue, so pkts_acked can be
correctly computed as before.
3) Computes pkts_acked using previous_packets_out, and computes
newly_acked_sacked using prior_packets.
Signed-off-by: Nandita Dukkipati <nanditad@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>