[PATCH 4.6 00/96] 4.6.6-stable review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 4.6.6 release.
There are 96 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.6.6-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.6.6-rc1

Miklos Szeredi <mszeredi@redhat.com>
    vfs: fix deadlock in file_remove_privs() on overlayfs

Scott Bauer <sbauer@plzdonthack.me>
    vfs: ioctl: prevent double-fetch in dedupe ioctl

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    intel_th: Fix a deadlock in modprobing

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    intel_th: pci: Add Kaby Lake PCH-H support

Gregory Greenman <gregory.greenman@intel.com>
    cfg80211: handle failed skb allocation

Dmitri Epshtein <dima@marvell.com>
    net: mvneta: set real interrupt per packet for tx_done

Ilya Dryomov <idryomov@gmail.com>
    libceph: apply new_state before new_up_client on incrementals

Tejun Heo <tj@kernel.org>
    libata: LITE-ON CX1-JB256-HP needs lower max_sectors

Lukasz Gemborowski <lukasz.gemborowski@nokia.com>
    i2c: mux: reg: wrong condition checked for of_address_to_resource return value

Sricharan R <sricharan@codeaurora.org>
    i2c: qup: Fix wrong value of index variable

Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    adv7604: Don't ignore pad number in subdev DV timings pad operations

Thomas Gleixner <tglx@linutronix.de>
    cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble

Alexey Dobriyan <adobriyan@gmail.com>
    posix_cpu_timer: Exit early when process has been reaped

James Patrick-Evans <james@jmp-e.com>
    media: fix airspy usb probe error path

Brian King <brking@linux.vnet.ibm.com>
    ipr: Clear interrupt on croc/crocodile when running with LSI

Alan Stern <stern@rowland.harvard.edu>
    SCSI: fix new bug in scsi_dev_info_list string matching

Bruno Prémont <bonbons@linux-vserver.org>
    qla2xxx: Fix NULL pointer deref in QLA interrupt

Paul Burton <paul.burton@imgtec.com>
    irqchip/mips-gic: Match IPI IRQ domain by bus token only

Paul Burton <paul.burton@imgtec.com>
    irqchip/mips-gic: Map to VPs using HW VPNum

Vegard Nossum <vegard.nossum@oracle.com>
    RDS: fix rds_tcp_init() error path

Oliver Hartkopp <socketcan@hartkopp.net>
    can: fix oops caused by wrong rtnl dellink usage

Oliver Hartkopp <socketcan@hartkopp.net>
    can: fix handling of unmodifiable configuration options fix

Thor Thayer <tthayer@opensource.altera.com>
    can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access

Wolfgang Grandegger <wg@grandegger.com>
    can: at91_can: RX queue could get stuck at high bus load

Peter Zijlstra <peterz@infradead.org>
    sched/fair: Fix effective_load() to consistently use smoothed load

Taras Kondratiuk <takondra@cisco.com>
    mmc: block: fix packed command header endianness

Ville Viinikka <ville@tuxera.com>
    mmc: block: fix free of uninitialized 'idata->buf'

Omar Sandoval <osandov@fb.com>
    block: fix use-after-free in sys_ioprio_get()

Randy Dunlap <rdunlap@infradead.org>
    init/Kconfig: keep Expert users menu together

Ursula Braun <ubraun@linux.vnet.ibm.com>
    qeth: delete napi struct when removing a qeth device

Dan Carpenter <dan.carpenter@oracle.com>
    platform/chrome: cros_ec_dev - double fetch bug in ioctl

Scott Mayhew <smayhew@redhat.com>
    lockd: unregister notifier blocks if the service fails to come up completely

Boris Brezillon <boris.brezillon@free-electrons.com>
    clk: at91: fix clk_programmable_set_parent()

Heiko Stuebner <heiko@sntech.de>
    clk: rockchip: initialize flags of clk_init_data in mmc-phase clock

Michal Suchanek <hramrach@gmail.com>
    spi: sun4i: fix FIFO limit

Michal Suchanek <hramrach@gmail.com>
    spi: sunxi: fix transfer timeout

Tomeu Vizoso <tomeu.vizoso@collabora.com>
    spi: rockchip: Signal unfinished DMA transfers

Andrey Ulanov <andreyu@google.com>
    namespace: update event counter when umounting a deleted dentry

Colin Ian King <colin.king@canonical.com>
    devpts: fix null pointer dereference on failed memory allocation

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    cpufreq: Avoid false-positive WARN_ON()s in cpufreq_update_policy()

Miklos Szeredi <mszeredi@redhat.com>
    9p: use file_dentry()

Vegard Nossum <vegard.nossum@oracle.com>
    ext4: verify extent header depth

Jeff Mahoney <jeffm@suse.com>
    ecryptfs: don't allow mmap when the lower fs doesn't support it

Jeff Mahoney <jeffm@suse.com>
    Revert "ecryptfs: forbid opening files without mmap handler"

Miklos Szeredi <mszeredi@redhat.com>
    locks: use file_inode()

Rhyland Klein <rklein@nvidia.com>
    power_supply: power_supply_read_temp only if use_cnt > 0

Daniel Bristot de Oliveira <bristot@redhat.com>
    cgroup: Disable IRQs while holding css_set_lock

Tejun Heo <tj@kernel.org>
    cgroup: set css->id to -1 during init

Wenwei Tao <ww.tao0320@gmail.com>
    cgroup: remove redundant cleanup in css_create

Alexander Shiyan <shc_work@mail.ru>
    pinctrl: imx: Do not treat a PIN without MUX register as an error

Tony Lindgren <tony@atomide.com>
    pinctrl: single: Fix missing flush of posted write for a wakeirq

Minfei Huang <mnghuan@gmail.com>
    pvclock: Add CPU barriers to get correct version value

Michael Welling <mwelling@ieee.org>
    Input: tsc200x - report proper input_dev name

Andrew Duggan <aduggan@synaptics.com>
    Input: synaptics-rmi4 - fix maximum size check for F12 control register 8

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Revert "Input: wacom_w8001 - drop use of ABS_MT_TOOL_TYPE"

Cameron Gutman <aicommander@gmail.com>
    Input: xpad - validate USB endpoint count during probe

Ping Cheng <pinglinux@gmail.com>
    Input: wacom_w8001 - ignore invalid pen data packets

Ping Cheng <pinglinux@gmail.com>
    Input: wacom_w8001 - w8001_MAX_LENGTH should be 13

Cameron Gutman <aicommander@gmail.com>
    Input: xpad - fix oops when attaching an unknown Xbox One gamepad

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: elantech - add more IC body types to the list

Sinclair Yeh <syeh@vmware.com>
    Input: vmmouse - remove port reservation

Kangjie Lu <kangjielu@gmail.com>
    ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt

Kangjie Lu <kangjielu@gmail.com>
    ALSA: timer: Fix leak in events via snd_timer_user_ccallback

Kangjie Lu <kangjielu@gmail.com>
    ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

Bob Liu <bob.liu@oracle.com>
    xen-blkfront: don't call talk_to_blkback when already connected to blkback

Bob Liu <bob.liu@oracle.com>
    xen-blkfront: fix resume issues after a migration

Jan Beulich <JBeulich@suse.com>
    xenbus: don't bail early from xenbus_dev_request_and_reply()

Jan Beulich <JBeulich@suse.com>
    xenbus: don't BUG() on user mode induced condition

Bob Liu <bob.liu@oracle.com>
    xen-blkfront: save uncompleted reqs in blkfront_resume()

Andrey Grodzovsky <andrey2805@gmail.com>
    xen/pciback: Fix conf_space read/write overlap check.

Vineet Gupta <vgupta@synopsys.com>
    ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame)

Alexey Brodkin <Alexey.Brodkin@synopsys.com>
    arc: unwind: warn only once if DW2_UNWIND is disabled

Josh Poimboeuf <jpoimboe@redhat.com>
    sched/debug: Fix deadlock when enabling sched events

Andrey Ryabinin <aryabinin@virtuozzo.com>
    kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w

Jiri Slaby <jslaby@suse.cz>
    pps: do not crash when failed to register

Andrey Ryabinin <aryabinin@virtuozzo.com>
    radix-tree: fix radix_tree_iter_retry() for tagged iterators.

Johannes Weiner <hannes@cmpxchg.org>
    mm: memcontrol: fix cgroup creation failure after many small jobs

Hugh Dickins <hughd@google.com>
    mm: thp: refix false positive BUG in page_move_anon_rmap()

Dmitry Vyukov <dvyukov@google.com>
    vmlinux.lds: account for destructor sections

Mel Gorman <mgorman@techsingularity.net>
    mm, meminit: ensure node is online before checking whether pages are uninitialised

Mel Gorman <mgorman@techsingularity.net>
    mm, meminit: always return a valid node from early_pfn_to_nid

Mauro Carvalho Chehab <mchehab@s-opensource.com>
    uapi: export lirc.h header

David Rientjes <rientjes@google.com>
    mm, compaction: prevent VM_BUG_ON when terminating freeing scanner

Torsten Hilbrich <torsten.hilbrich@secunet.com>
    fs/nilfs2: fix potential underflow in call to crc32_le

David Rientjes <rientjes@google.com>
    mm, compaction: abort free scanner if split fails

Lukasz Odzioba <lukasz.odzioba@intel.com>
    mm/swap.c: flush lru pvecs on compound page arrival

Tejun Heo <tj@kernel.org>
    memcg: css_alloc should return an ERR_PTR value on error

Tejun Heo <tj@kernel.org>
    memcg: mem_cgroup_migrate() may be called with irq disabled

Mel Gorman <mgorman@techsingularity.net>
    mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask

Ludovic Desroches <ludovic.desroches@atmel.com>
    dmaengine: at_xdmac: double FIFO flush needed to compute residue

Ludovic Desroches <ludovic.desroches@atmel.com>
    dmaengine: at_xdmac: fix residue corruption

Ludovic Desroches <ludovic.desroches@atmel.com>
    dmaengine: at_xdmac: align descriptors on 64 bits

Lukas Wunner <lukas@wunner.de>
    x86/quirks: Add early quirk to reset Apple AirPort card

Lukas Wunner <lukas@wunner.de>
    x86/quirks: Reintroduce scanning of secondary buses

Lukas Wunner <lukas@wunner.de>
    x86/quirks: Apply nvidia_bugs quirk only on root bus

Michał Pecio <michal.pecio@gmail.com>
    USB: OHCI: Don't mark EDs as ED_OPER if scheduling fails


-------------

Diffstat:

 Makefile                                 |   4 +-
 arch/arc/Makefile                        |   2 -
 arch/arc/kernel/stacktrace.c             |   2 +-
 arch/x86/include/asm/pvclock.h           |   2 +
 arch/x86/kernel/early-quirks.c           | 105 ++++++++++++++++++---
 arch/x86/kernel/pvclock.c                |   4 +
 block/ioprio.c                           |   2 +
 drivers/ata/libata-core.c                |   6 ++
 drivers/bcma/bcma_private.h              |   2 -
 drivers/block/xen-blkfront.c             | 126 ++++++++++++-------------
 drivers/clk/at91/clk-programmable.c      |   2 +-
 drivers/clk/rockchip/clk-mmc-phase.c     |   1 +
 drivers/cpufreq/cpufreq.c                |   4 +
 drivers/dma/at_xdmac.c                   |  82 +++++++++++-----
 drivers/hwtracing/intel_th/core.c        |  35 ++++++-
 drivers/hwtracing/intel_th/intel_th.h    |   3 +
 drivers/hwtracing/intel_th/pci.c         |   5 +
 drivers/i2c/busses/i2c-qup.c             |   2 +
 drivers/i2c/muxes/i2c-mux-reg.c          |   2 +-
 drivers/input/joystick/xpad.c            |  26 ++++--
 drivers/input/mouse/elantech.c           |   8 +-
 drivers/input/mouse/vmmouse.c            |  22 +----
 drivers/input/rmi4/rmi_f12.c             |   9 +-
 drivers/input/touchscreen/tsc2004.c      |   7 +-
 drivers/input/touchscreen/tsc2005.c      |   7 +-
 drivers/input/touchscreen/tsc200x-core.c |  15 ++-
 drivers/input/touchscreen/tsc200x-core.h |   2 +-
 drivers/input/touchscreen/wacom_w8001.c  |  14 ++-
 drivers/irqchip/irq-mips-gic.c           |   4 +-
 drivers/media/i2c/adv7604.c              |  46 ++++++---
 drivers/media/usb/airspy/airspy.c        |   3 +-
 drivers/mmc/card/block.c                 |  16 ++--
 drivers/net/can/at91_can.c               |   5 +-
 drivers/net/can/c_can/c_can.c            |  38 ++++++--
 drivers/net/can/dev.c                    |   9 ++
 drivers/net/ethernet/marvell/mvneta.c    |   2 +-
 drivers/pinctrl/freescale/pinctrl-imx.c  |   4 +-
 drivers/pinctrl/pinctrl-single.c         |   3 +
 drivers/platform/chrome/cros_ec_dev.c    |   8 +-
 drivers/power/power_supply_core.c        |  27 +++---
 drivers/pps/clients/pps_parport.c        |   2 +-
 drivers/s390/net/qeth_l2_main.c          |   1 +
 drivers/s390/net/qeth_l3_main.c          |   1 +
 drivers/scsi/ipr.c                       |   1 +
 drivers/scsi/qla2xxx/qla_isr.c           |   2 +-
 drivers/scsi/scsi_devinfo.c              |  10 +-
 drivers/spi/spi-rockchip.c               |   4 +-
 drivers/spi/spi-sun4i.c                  |  23 ++++-
 drivers/spi/spi-sun6i.c                  |  10 +-
 drivers/tty/pty.c                        |   7 +-
 drivers/usb/host/ohci-q.c                |   3 +-
 drivers/xen/xen-pciback/conf_space.c     |   6 +-
 drivers/xen/xenbus/xenbus_dev_frontend.c |  14 +--
 drivers/xen/xenbus/xenbus_xs.c           |   3 -
 fs/9p/vfs_file.c                         |   6 +-
 fs/ecryptfs/file.c                       |  15 ++-
 fs/ecryptfs/kthread.c                    |  13 +--
 fs/ext4/extents.c                        |   4 +
 fs/inode.c                               |   6 +-
 fs/ioctl.c                               |   1 +
 fs/lockd/svc.c                           |  13 ++-
 fs/locks.c                               |   2 +-
 fs/namespace.c                           |   1 +
 fs/nilfs2/the_nilfs.c                    |   2 +-
 include/asm-generic/vmlinux.lds.h        |   4 +
 include/linux/bcma/bcma.h                |   1 +
 include/linux/memcontrol.h               |  25 ++---
 include/linux/radix-tree.h               |   1 +
 include/linux/rmap.h                     |   2 +-
 include/uapi/linux/Kbuild                |   1 +
 init/Kconfig                             |   1 +
 kernel/cgroup.c                          | 148 +++++++++++++++--------------
 kernel/cpu.c                             |   2 +
 kernel/sched/core.c                      |   6 +-
 kernel/sched/fair.c                      |  17 ++--
 kernel/time/posix-cpu-timers.c           |   1 +
 mm/compaction.c                          |  61 ++++++------
 mm/hugetlb.c                             |   2 +-
 mm/internal.h                            |   3 +-
 mm/memcontrol.c                          |  89 ++++++++++++++++--
 mm/memory.c                              |   3 +-
 mm/page_alloc.c                          |   6 +-
 mm/rmap.c                                |   9 +-
 mm/slab_common.c                         |   4 +-
 mm/swap.c                                |  11 +--
 net/ceph/osdmap.c                        | 156 ++++++++++++++++++++++---------
 net/rds/tcp.c                            |   5 +-
 net/wireless/util.c                      |   2 +
 sound/core/timer.c                       |   3 +
 89 files changed, 917 insertions(+), 462 deletions(-)