[PATCH 4.3 00/71] 4.3.3-stable review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 4.3.3 release.
There are 71 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Dec 14 20:05:02 UTC 2015.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.3.3-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.3.3-rc1

Hans Verkuil <hverkuil@xs4all.nl>
    cobalt: fix Kconfig dependency

Lu, Han <han.lu@intel.com>
    ALSA: hda/hdmi - apply Skylake fix-ups to Broxton display codec

Dan Williams <dan.j.williams@intel.com>
    ALSA: pci: depend on ZONE_DMA

Arnd Bergmann <arnd@arndb.de>
    ceph: fix message length computation

Ming Lei <ming.lei@canonical.com>
    block: fix segment split

Junxiao Bi <junxiao.bi@oracle.com>
    ocfs2: fix umask ignored issue

Jeff Layton <jlayton@poochiereds.net>
    nfs: if we have no valid attrs, then don't declare the attribute cache valid

Jeff Layton <jlayton@poochiereds.net>
    nfs4: resend LAYOUTGET when there is a race that changes the seqid

Benjamin Coddington <bcodding@redhat.com>
    nfs4: start callback_ident at idr 1

Daniel Borkmann <daniel@iogearbox.net>
    debugfs: fix refcount imbalance in start_creating

Andrew Elble <aweits@rit.edu>
    nfsd: eliminate sending duplicate and repeated delegations

Jeff Layton <jlayton@poochiereds.net>
    nfsd: serialize state seqid morphing operations

Stefan Richter <stefanr@s5r6.in-berlin.de>
    firewire: ohci: fix JMicron JMB38x IT context discovery

Daeho Jeong <daeho.jeong@samsung.com>
    ext4, jbd2: ensure entering into panic after recording an error in superblock

Lukas Czerner <lczerner@redhat.com>
    ext4: fix potential use after free in __ext4_journal_stop

Theodore Ts'o <tytso@mit.edu>
    ext4 crypto: fix bugs in ext4_encrypted_zeroout()

Theodore Ts'o <tytso@mit.edu>
    ext4 crypto: fix memory leak in ext4_bio_write_page()

Ilya Dryomov <idryomov@gmail.com>
    rbd: don't put snap_context twice in rbd_queue_workfn()

David Sterba <dsterba@suse.com>
    btrfs: fix signed overflows in btrfs_sync_file

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix race when listing an inode's xattrs

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix race leading to incorrect item deletion when dropping extents

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix regression when running delayed references

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix truncation of compressed and inlined extents

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix file corruption and data loss after cloning inline extents

David Sterba <dsterba@suse.com>
    btrfs: check unsupported filters in balance arguments

Robin Ruede <r.ruede@gmail.com>
    btrfs: fix resending received snapshot with parent

Eric Dumazet <edumazet@google.com>
    net_sched: fix qdisc_tree_decrease_qlen() races

Paolo Abeni <pabeni@redhat.com>
    openvswitch: fix hangup on vxlan/gre/geneve device deletion

Eric Dumazet <edumazet@google.com>
    ipv6: sctp: implement sctp_v6_destroy_sock()

Konstantin Khlebnikov <koct9i@gmail.com>
    net/neighbour: fix crash at dumping device-agnostic proxy entries

Eric Dumazet <edumazet@google.com>
    ipv6: add complete rcu protection around np->opt

Daniel Borkmann <daniel@iogearbox.net>
    bpf, array: fix heap out-of-bounds access when updating elements

Quentin Casasnovas <quentin.casasnovas@oracle.com>
    RDS: fix race condition when sending a message on unbound socket

Michal Kubeček <mkubecek@suse.cz>
    ipv6: distinguish frag queues by device for multicast and link-local packets

Ying Xue <ying.xue@windriver.com>
    tipc: fix error handling of expanding buffer headroom

Aaro Koskinen <aaro.koskinen@iki.fi>
    broadcom: fix PHY_ID_BCM5481 entry in the id table

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    vrf: fix double free and memory corruption on register_netdevice failure

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    net: ip6mr: fix static mfc/dev leaks on table destruction

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    net: ipmr: fix static mfc/dev leaks on table destruction

Daniel Borkmann <daniel@iogearbox.net>
    net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds

Eric Dumazet <edumazet@google.com>
    tcp: initialize tp->copied_seq in case of cross SYN connection

Eric Dumazet <edumazet@google.com>
    tcp: fix potential huge kmalloc() calls in TCP_REPAIR

Yuchung Cheng <ycheng@google.com>
    tcp: disable Fast Open on timeouts after handshake

Eric Dumazet <edumazet@google.com>
    tcp: md5: fix lockdep annotation

Bjørn Mork <bjorn@mork.no>
    net: qmi_wwan: add XS Stick W100-2 from 4G Systems

Paolo Abeni <pabeni@redhat.com>
    net/ip6_tunnel: fix dst leak

Neil Horman <nhorman@tuxdriver.com>
    snmp: Remove duplicate OUTMCAST stat increment

Pavel Fedin <p.fedin@samsung.com>
    net: thunder: Check for driver data in nicvf_remove()

Dragos Tatulea <dragos@endocode.com>
    net: switchdev: fix return code of fdb_dump stub

Jason A. Donenfeld <Jason@zx2c4.com>
    ip_tunnel: disable preemption when updating per-cpu tstats

Eran Ben Elisha <eranbe@mellanox.com>
    net/mlx4_core: Fix sleeping while holding spinlock at rem_slave_counters

Tariq Toukan <tariqt@mellanox.com>
    net/mlx5e: Added self loopback prevention

lucien <lucien.xin@gmail.com>
    sctp: translate host order to network order when setting a hmacid

Daniel Borkmann <daniel@iogearbox.net>
    packet: fix tpacket_snd max frame len

Daniel Borkmann <daniel@iogearbox.net>
    packet: infer protocol from ethernet header if unset

Daniel Borkmann <daniel@iogearbox.net>
    packet: only allow extra vlan len on ethernet devices

Daniel Borkmann <daniel@iogearbox.net>
    packet: always probe for transport header

Daniel Borkmann <daniel@iogearbox.net>
    packet: do skb_probe_transport_header when we actually have data

Kamal Mostafa <kamal@canonical.com>
    tools/net: Use include/uapi with __EXPORTED_HEADERS__

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Revert "ipv6: ndisc: inherit metadata dst when creating ndisc requests"

Martin KaFai Lau <kafai@fb.com>
    ipv6: Check rt->dst.from for the DST_NOCACHE route

Martin KaFai Lau <kafai@fb.com>
    ipv6: Check expire on DST_NOCACHE route

Martin KaFai Lau <kafai@fb.com>
    ipv6: Avoid creating RTF_CACHE from a rt that is not managed by fib6 tree

Hannes Frederic Sowa <hannes@stressinduktion.org>
    af-unix: passcred support for sendpage

Rainer Weikusat <rweikusat@mobileactivedefense.com>
    unix: avoid use-after-free in ep_remove_wait_queue

Hannes Frederic Sowa <hannes@stressinduktion.org>
    af_unix: take receive queue lock while appending new skb

Hannes Frederic Sowa <hannes@stressinduktion.org>
    af_unix: don't append consumed skbs to sk_receive_queue

Hannes Frederic Sowa <hannes@stressinduktion.org>
    af-unix: fix use-after-free with concurrent readers while splicing

françois romieu <romieu@fr.zoreil.com>
    r8169: fix kasan reported skb use-after-free.

Paul Gortmaker <paul.gortmaker@windriver.com>
    certs: add .gitignore to stop git nagging about x509_certificate_list


-------------

Diffstat:

 Makefile                                           |   4 +-
 block/blk-merge.c                                  |   4 +-
 certs/.gitignore                                   |   4 +
 drivers/block/rbd.c                                |   1 +
 drivers/firewire/ohci.c                            |   5 +
 drivers/media/pci/cobalt/Kconfig                   |   2 +-
 drivers/net/ethernet/cavium/thunder/nicvf_main.c   |  10 +-
 .../net/ethernet/mellanox/mlx4/resource_tracker.c  |  39 ++-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  56 +++-
 drivers/net/ethernet/realtek/r8169.c               |   6 +-
 drivers/net/phy/broadcom.c                         |   2 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/vrf.c                                  |  15 +-
 fs/btrfs/delayed-ref.c                             | 113 ++++++++
 fs/btrfs/extent-tree.c                             |  14 +
 fs/btrfs/file.c                                    |  26 +-
 fs/btrfs/inode.c                                   |  92 +++++--
 fs/btrfs/ioctl.c                                   | 200 ++++++++++----
 fs/btrfs/send.c                                    |  10 +-
 fs/btrfs/volumes.h                                 |   8 +
 fs/btrfs/xattr.c                                   |   4 +-
 fs/ceph/mds_client.c                               |   2 +-
 fs/debugfs/inode.c                                 |   6 +-
 fs/ext4/crypto.c                                   |  23 +-
 fs/ext4/ext4_jbd2.c                                |   6 +-
 fs/ext4/extents.c                                  |   3 +
 fs/ext4/page-io.c                                  |   5 +-
 fs/ext4/super.c                                    |  12 +-
 fs/jbd2/journal.c                                  |   6 +-
 fs/nfs/inode.c                                     |   6 +-
 fs/nfs/nfs4client.c                                |   2 +-
 fs/nfs/pnfs.c                                      |  56 ++--
 fs/nfsd/nfs4state.c                                | 127 +++++++--
 fs/nfsd/state.h                                    |  19 +-
 fs/ocfs2/namei.c                                   |   2 +
 include/linux/ipv6.h                               |   2 +-
 include/linux/jbd2.h                               |   1 +
 include/linux/mlx5/mlx5_ifc.h                      |  24 +-
 include/net/af_unix.h                              |   1 +
 include/net/ip6_fib.h                              |   3 +-
 include/net/ip6_tunnel.h                           |   3 +-
 include/net/ip_tunnels.h                           |   3 +-
 include/net/ipv6.h                                 |  22 +-
 include/net/ndisc.h                                |   3 +-
 include/net/sch_generic.h                          |   3 +
 include/net/switchdev.h                            |   2 +-
 kernel/.gitignore                                  |   1 -
 kernel/bpf/arraymap.c                              |   2 +-
 net/core/neighbour.c                               |   4 +-
 net/core/scm.c                                     |   2 +
 net/dccp/ipv6.c                                    |  33 ++-
 net/ipv4/ipmr.c                                    |  15 +-
 net/ipv4/tcp_input.c                               |  23 +-
 net/ipv4/tcp_ipv4.c                                |   3 +-
 net/ipv4/tcp_timer.c                               |  12 +
 net/ipv6/addrconf.c                                |   2 +-
 net/ipv6/af_inet6.c                                |  13 +-
 net/ipv6/datagram.c                                |   4 +-
 net/ipv6/exthdrs.c                                 |   3 +-
 net/ipv6/inet6_connection_sock.c                   |  11 +-
 net/ipv6/ip6_tunnel.c                              |   2 +-
 net/ipv6/ip6mr.c                                   |  15 +-
 net/ipv6/ipv6_sockglue.c                           |  33 ++-
 net/ipv6/mcast.c                                   |   2 -
 net/ipv6/ndisc.c                                   |  10 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |   5 +-
 net/ipv6/raw.c                                     |   8 +-
 net/ipv6/reassembly.c                              |  10 +-
 net/ipv6/route.c                                   |  24 +-
 net/ipv6/syncookies.c                              |   2 +-
 net/ipv6/tcp_ipv6.c                                |  28 +-
 net/ipv6/udp.c                                     |   8 +-
 net/l2tp/l2tp_ip6.c                                |   8 +-
 net/openvswitch/dp_notify.c                        |   2 +-
 net/openvswitch/vport-netdev.c                     |   8 +-
 net/packet/af_packet.c                             |  86 ++++---
 net/rds/connection.c                               |   6 -
 net/rds/send.c                                     |   4 +-
 net/sched/sch_api.c                                |  27 +-
 net/sched/sch_generic.c                            |   2 +-
 net/sched/sch_mq.c                                 |   4 +-
 net/sched/sch_mqprio.c                             |   4 +-
 net/sctp/auth.c                                    |   4 +-
 net/sctp/socket.c                                  |   9 +-
 net/tipc/udp_media.c                               |   7 +-
 net/unix/af_unix.c                                 | 286 ++++++++++++++++++---
 sound/pci/Kconfig                                  |  24 +-
 sound/pci/hda/patch_hdmi.c                         |   3 +-
 tools/net/Makefile                                 |   7 +-
 89 files changed, 1321 insertions(+), 403 deletions(-)