drop patches with post 4.8 Fixes: tags

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

24 files changed, 0 insertions, 1636 deletions

diff --git a/queue/ALSA-ctxfi-Fix-the-incorrect-check-of-dma_set_mask-c.patch b/queue/ALSA-ctxfi-Fix-the-incorrect-check-of-dma_set_mask-c.patch
deleted file mode 100644
index 418ed2f..0000000
--- a/queue/ALSA-ctxfi-Fix-the-incorrect-check-of-dma_set_mask-c.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From f363a06642f28caaa78cb6446bbad90c73fe183c Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Mon, 20 Mar 2017 10:08:19 +0100
-Subject: [PATCH] ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
-
-commit f363a06642f28caaa78cb6446bbad90c73fe183c upstream.
-
-In the commit [15c75b09f8d1: ALSA: ctxfi: Fallback DMA mask to 32bit],
-I forgot to put "!" at dam_set_mask() call check in cthw20k1.c (while
-cthw20k2.c is OK).  This patch fixes that obvious bug.
-
-(As a side note: although the original commit was completely wrong,
- it's still working for most of machines, as it sets to 32bit DMA mask
- in the end.  So the bug severity is low.)
-
-Fixes: 15c75b09f8d1 ("ALSA: ctxfi: Fallback DMA mask to 32bit")
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
-diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c
-index ab4cdab5cfa5..79edd88d5cd0 100644
---- a/sound/pci/ctxfi/cthw20k1.c
-+++ b/sound/pci/ctxfi/cthw20k1.c
-@@ -1905,7 +1905,7 @@ static int hw_card_start(struct hw *hw)
- 		return err;
- 
- 	/* Set DMA transfer mask */
--	if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
-+	if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
- 		dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
- 	} else {
- 		dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
--- 
-2.12.0
-
diff --git a/queue/Drivers-hv-vmbus-Don-t-leak-memory-when-a-channel-is.patch b/queue/Drivers-hv-vmbus-Don-t-leak-memory-when-a-channel-is.patch
deleted file mode 100644
index b743538..0000000
--- a/queue/Drivers-hv-vmbus-Don-t-leak-memory-when-a-channel-is.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 5e030d5ce9d99a899b648413139ff65bab12b038 Mon Sep 17 00:00:00 2001
-From: "K. Y. Srinivasan" <kys@microsoft.com>
-Date: Sun, 12 Mar 2017 20:00:30 -0700
-Subject: [PATCH] Drivers: hv: vmbus: Don't leak memory when a channel is
- rescinded
-
-commit 5e030d5ce9d99a899b648413139ff65bab12b038 upstream.
-
-When we close a channel that has been rescinded, we will leak memory since
-vmbus_teardown_gpadl() returns an error. Fix this so that we can properly
-cleanup the memory allocated to the ring buffers.
-
-Fixes: ccb61f8a99e6 ("Drivers: hv: vmbus: Fix a rescind handling bug")
-
-Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 57b2958205c7..321b8833fa6f 100644
---- a/drivers/hv/channel.c
-+++ b/drivers/hv/channel.c
-@@ -502,12 +502,15 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- 
- 	wait_for_completion(&info->waitevent);
- 
--	if (channel->rescind) {
--		ret = -ENODEV;
--		goto post_msg_err;
--	}
--
- post_msg_err:
-+	/*
-+	 * If the channel has been rescinded;
-+	 * we will be awakened by the rescind
-+	 * handler; set the error code to zero so we don't leak memory.
-+	 */
-+	if (channel->rescind)
-+		ret = 0;
-+
- 	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
- 	list_del(&info->msglistentry);
- 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
--- 
-2.12.0
-
diff --git a/queue/HID-wacom-Don-t-add-ghost-interface-as-shared-data.patch b/queue/HID-wacom-Don-t-add-ghost-interface-as-shared-data.patch
deleted file mode 100644
index 7be34b1..0000000
--- a/queue/HID-wacom-Don-t-add-ghost-interface-as-shared-data.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 8b4073596997f2ccbf68d8e72e07b827388a4536 Mon Sep 17 00:00:00 2001
-From: Aaron Armstrong Skomra <skomra@gmail.com>
-Date: Wed, 29 Mar 2017 10:35:39 -0700
-Subject: [PATCH] HID: wacom: Don't add ghost interface as shared data
-
-commit 8b4073596997f2ccbf68d8e72e07b827388a4536 upstream.
-
-A previous commit (below) adds a check for already probed interfaces to
-Wacom's matching heuristic. Unfortunately this causes the Bamboo Pen
-(CTL-460) to match itself to its 'ghost' touch interface. After
-subsequent changes to the driver this match to the ghost causes the
-kernel to crash. This patch avoids calling wacom_add_shared_data()
-for the BAMBOO_PEN's ghost touch interface.
-
-Fixes: 41372d5d40e7 ("HID: wacom: Augment 'oVid' and 'oPid' with heuristics for HID_GENERIC")
-Cc: stable <stable@vger.kernel.org>     # 4.9
-Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
-Signed-off-by: Jiri Kosina <jkosina@suse.cz>
-
-diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
-index 994bddc55b82..b676f02d4b7f 100644
---- a/drivers/hid/wacom_sys.c
-+++ b/drivers/hid/wacom_sys.c
-@@ -2165,6 +2165,14 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
- 
- 	wacom_update_name(wacom, wireless ? " (WL)" : "");
- 
-+	/* pen only Bamboo neither support touch nor pad */
-+	if ((features->type == BAMBOO_PEN) &&
-+	    ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
-+	    (features->device_type & WACOM_DEVICETYPE_PAD))) {
-+		error = -ENODEV;
-+		goto fail;
-+	}
-+
- 	error = wacom_add_shared_data(hdev);
- 	if (error)
- 		goto fail;
-@@ -2212,14 +2220,6 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
- 		goto fail_quirks;
- 	}
- 
--	/* pen only Bamboo neither support touch nor pad */
--	if ((features->type == BAMBOO_PEN) &&
--	    ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
--	    (features->device_type & WACOM_DEVICETYPE_PAD))) {
--		error = -ENODEV;
--		goto fail_quirks;
--	}
--
- 	if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR)
- 		error = hid_hw_open(hdev);
- 
--- 
-2.12.0
-
diff --git a/queue/Input-ALPS-fix-V8-protocol-handling-73-03-28.patch b/queue/Input-ALPS-fix-V8-protocol-handling-73-03-28.patch
deleted file mode 100644
index 591fdf9..0000000
--- a/queue/Input-ALPS-fix-V8-protocol-handling-73-03-28.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From e7348396c6d51b57c95c6646c390cd078e038e19 Mon Sep 17 00:00:00 2001
-From: Masaki Ota <masaki.ota@jp.alps.com>
-Date: Fri, 17 Mar 2017 14:10:57 -0700
-Subject: [PATCH] Input: ALPS - fix V8+ protocol handling (73 03 28)
-
-commit e7348396c6d51b57c95c6646c390cd078e038e19 upstream.
-
-Devices identified as E7="73 03 28" use slightly modified version of V8
-protocol, with lower count per electrode, different offsets, and different
-feature bits in OTP data.
-
-Fixes: aeaa881f9b17 ("Input: ALPS - set DualPoint flag for 74 03 28 devices")
-Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com>
-Acked-by: Pali Rohar <pali.rohar@gmail.com>
-Tested-by: Paul Donohue <linux-kernel@PaulSD.com>
-Tested-by: Nick Fletcher <nick.m.fletcher@gmail.com>
-Cc: stable@vger.kernel.org
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-
-diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
-index 72b28ebfe360..262d9b620fcf 100644
---- a/drivers/input/mouse/alps.c
-+++ b/drivers/input/mouse/alps.c
-@@ -2462,14 +2462,34 @@ static int alps_update_device_area_ss4_v2(unsigned char otp[][4],
- 	int num_y_electrode;
- 	int x_pitch, y_pitch, x_phys, y_phys;
- 
--	num_x_electrode = SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
--	num_y_electrode = SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
-+	if (IS_SS4PLUS_DEV(priv->dev_id)) {
-+		num_x_electrode =
-+			SS4PLUS_NUMSENSOR_XOFFSET + (otp[0][2] & 0x0F);
-+		num_y_electrode =
-+			SS4PLUS_NUMSENSOR_YOFFSET + ((otp[0][2] >> 4) & 0x0F);
- 
--	priv->x_max = (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
--	priv->y_max = (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
-+		priv->x_max =
-+			(num_x_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
-+		priv->y_max =
-+			(num_y_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
- 
--	x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
--	y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
-+		x_pitch = (otp[0][1] & 0x0F) + SS4PLUS_MIN_PITCH_MM;
-+		y_pitch = ((otp[0][1] >> 4) & 0x0F) + SS4PLUS_MIN_PITCH_MM;
-+
-+	} else {
-+		num_x_electrode =
-+			SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
-+		num_y_electrode =
-+			SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
-+
-+		priv->x_max =
-+			(num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
-+		priv->y_max =
-+			(num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
-+
-+		x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
-+		y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
-+	}
- 
- 	x_phys = x_pitch * (num_x_electrode - 1); /* In 0.1 mm units */
- 	y_phys = y_pitch * (num_y_electrode - 1); /* In 0.1 mm units */
-@@ -2485,7 +2505,10 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
- {
- 	unsigned char is_btnless;
- 
--	is_btnless = (otp[1][1] >> 3) & 0x01;
-+	if (IS_SS4PLUS_DEV(priv->dev_id))
-+		is_btnless = (otp[1][0] >> 1) & 0x01;
-+	else
-+		is_btnless = (otp[1][1] >> 3) & 0x01;
- 
- 	if (is_btnless)
- 		priv->flags |= ALPS_BUTTONPAD;
-@@ -2493,6 +2516,21 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
- 	return 0;
- }
- 
-+static int alps_update_dual_info_ss4_v2(unsigned char otp[][4],
-+				       struct alps_data *priv)
-+{
-+	bool is_dual = false;
-+
-+	if (IS_SS4PLUS_DEV(priv->dev_id))
-+		is_dual = (otp[0][0] >> 4) & 0x01;
-+
-+	if (is_dual)
-+		priv->flags |= ALPS_DUALPOINT |
-+					ALPS_DUALPOINT_WITH_PRESSURE;
-+
-+	return 0;
-+}
-+
- static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
- 				    struct alps_data *priv)
- {
-@@ -2508,6 +2546,8 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
- 
- 	alps_update_btn_info_ss4_v2(otp, priv);
- 
-+	alps_update_dual_info_ss4_v2(otp, priv);
-+
- 	return 0;
- }
- 
-@@ -2753,10 +2793,6 @@ static int alps_set_protocol(struct psmouse *psmouse,
- 		if (alps_set_defaults_ss4_v2(psmouse, priv))
- 			return -EIO;
- 
--		if (priv->fw_ver[1] == 0x1)
--			priv->flags |= ALPS_DUALPOINT |
--					ALPS_DUALPOINT_WITH_PRESSURE;
--
- 		break;
- 	}
- 
-@@ -2827,10 +2863,7 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
- 			   ec[2] >= 0x90 && ec[2] <= 0x9d) {
- 			protocol = &alps_v3_protocol_data;
- 		} else if (e7[0] == 0x73 && e7[1] == 0x03 &&
--			   e7[2] == 0x14 && ec[1] == 0x02) {
--			protocol = &alps_v8_protocol_data;
--		} else if (e7[0] == 0x73 && e7[1] == 0x03 &&
--			   e7[2] == 0x28 && ec[1] == 0x01) {
-+			   (e7[2] == 0x14 || e7[2] == 0x28)) {
- 			protocol = &alps_v8_protocol_data;
- 		} else {
- 			psmouse_dbg(psmouse,
-@@ -2840,7 +2873,8 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
- 	}
- 
- 	if (priv) {
--		/* Save the Firmware version */
-+		/* Save Device ID and Firmware version */
-+		memcpy(priv->dev_id, e7, 3);
- 		memcpy(priv->fw_ver, ec, 3);
- 		error = alps_set_protocol(psmouse, priv, protocol);
- 		if (error)
-diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
-index 6d279aa27cb9..4334f2805d93 100644
---- a/drivers/input/mouse/alps.h
-+++ b/drivers/input/mouse/alps.h
-@@ -54,6 +54,16 @@ enum SS4_PACKET_ID {
- 
- #define SS4_MASK_NORMAL_BUTTONS		0x07
- 
-+#define SS4PLUS_COUNT_PER_ELECTRODE	128
-+#define SS4PLUS_NUMSENSOR_XOFFSET	16
-+#define SS4PLUS_NUMSENSOR_YOFFSET	5
-+#define SS4PLUS_MIN_PITCH_MM		37
-+
-+#define IS_SS4PLUS_DEV(_b)	(((_b[0]) == 0x73) &&	\
-+				 ((_b[1]) == 0x03) &&	\
-+				 ((_b[2]) == 0x28)		\
-+				)
-+
- #define SS4_IS_IDLE_V2(_b)	(((_b[0]) == 0x18) &&		\
- 				 ((_b[1]) == 0x10) &&		\
- 				 ((_b[2]) == 0x00) &&		\
-@@ -283,6 +293,7 @@ struct alps_data {
- 	int addr_command;
- 	u16 proto_version;
- 	u8 byte0, mask0;
-+	u8 dev_id[3];
- 	u8 fw_ver[3];
- 	int flags;
- 	int x_max;
--- 
-2.12.0
-
diff --git a/queue/Input-ALPS-fix-trackstick-button-handling-on-V8-devi.patch b/queue/Input-ALPS-fix-trackstick-button-handling-on-V8-devi.patch
deleted file mode 100644
index 1042284..0000000
--- a/queue/Input-ALPS-fix-trackstick-button-handling-on-V8-devi.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 47e6fb4212d09f325c0847d05985dd3d71553095 Mon Sep 17 00:00:00 2001
-From: Masaki Ota <masaki.ota@jp.alps.com>
-Date: Fri, 17 Mar 2017 14:19:40 -0700
-Subject: [PATCH] Input: ALPS - fix trackstick button handling on V8 devices
-
-commit 47e6fb4212d09f325c0847d05985dd3d71553095 upstream.
-
-Alps stick devices always have physical buttons, so we should not check
-ALPS_BUTTONPAD flag to decide whether we should report them.
-
-Fixes: 4777ac220c43 ("Input: ALPS - add touchstick support for SS5 hardware")
-Signed-off-by: Masaki Ota <masaki.ota@jp.alps.com>
-Acked-by: Pali Rohar <pali.rohar@gmail.com>
-Tested-by: Paul Donohue <linux-kernel@PaulSD.com>
-Tested-by: Nick Fletcher <nick.m.fletcher@gmail.com>
-Cc: stable@vger.kernel.org
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-
-diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
-index 262d9b620fcf..f210e19ddba6 100644
---- a/drivers/input/mouse/alps.c
-+++ b/drivers/input/mouse/alps.c
-@@ -1282,10 +1282,8 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
- 	/* handle buttons */
- 	if (pkt_id == SS4_PACKET_ID_STICK) {
- 		f->ts_left = !!(SS4_BTN_V2(p) & 0x01);
--		if (!(priv->flags & ALPS_BUTTONPAD)) {
--			f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
--			f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
--		}
-+		f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
-+		f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
- 	} else {
- 		f->left = !!(SS4_BTN_V2(p) & 0x01);
- 		if (!(priv->flags & ALPS_BUTTONPAD)) {
--- 
-2.12.0
-
diff --git a/queue/NFS-prevent-double-free-in-async-nfs4_exchange_id.patch b/queue/NFS-prevent-double-free-in-async-nfs4_exchange_id.patch
deleted file mode 100644
index d82b090..0000000
--- a/queue/NFS-prevent-double-free-in-async-nfs4_exchange_id.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 63513232f8cd219dcaa5eafae028740ed3067d83 Mon Sep 17 00:00:00 2001
-From: Olga Kornievskaia <kolga@netapp.com>
-Date: Mon, 13 Mar 2017 10:36:19 -0400
-Subject: [PATCH] NFS prevent double free in async nfs4_exchange_id
-
-commit 63513232f8cd219dcaa5eafae028740ed3067d83 upstream.
-
-Since rpc_task is async, the release function should be called which
-will free the impl_id, scope, and owner.
-
-Trond pointed at 2 more problems:
--- use of client pointer after free in the nfs4_exchangeid_release() function
--- cl_count mismatch if rpc_run_task() isn't run
-
-Fixes: 8d89bd70bc9 ("NFS setup async exchange_id")
-Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
-Cc: stable@vger.kernel.org # 4.9
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index c1f5369cd339..c780d98035cc 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -7425,11 +7425,11 @@ static void nfs4_exchange_id_release(void *data)
- 	struct nfs41_exchange_id_data *cdata =
- 					(struct nfs41_exchange_id_data *)data;
- 
--	nfs_put_client(cdata->args.client);
- 	if (cdata->xprt) {
- 		xprt_put(cdata->xprt);
- 		rpc_clnt_xprt_switch_put(cdata->args.client->cl_rpcclient);
- 	}
-+	nfs_put_client(cdata->args.client);
- 	kfree(cdata->res.impl_id);
- 	kfree(cdata->res.server_scope);
- 	kfree(cdata->res.server_owner);
-@@ -7536,10 +7536,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
- 	task_setup_data.callback_data = calldata;
- 
- 	task = rpc_run_task(&task_setup_data);
--	if (IS_ERR(task)) {
--	status = PTR_ERR(task);
--		goto out_impl_id;
--	}
-+	if (IS_ERR(task))
-+		return PTR_ERR(task);
- 
- 	if (!xprt) {
- 		status = rpc_wait_for_completion_task(task);
-@@ -7567,6 +7565,7 @@ out_server_owner:
- 	kfree(calldata->res.server_owner);
- out_calldata:
- 	kfree(calldata);
-+	nfs_put_client(clp);
- 	goto out;
- }
- 
--- 
-2.12.0
-
diff --git a/queue/NFSv4.1-fix-infinite-loop-on-IO-BAD_STATEID-error.patch b/queue/NFSv4.1-fix-infinite-loop-on-IO-BAD_STATEID-error.patch
deleted file mode 100644
index 7819c6b..0000000
--- a/queue/NFSv4.1-fix-infinite-loop-on-IO-BAD_STATEID-error.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 0e3d3e5df07dcf8a50d96e0ecd6ab9a888f55dfc Mon Sep 17 00:00:00 2001
-From: Olga Kornievskaia <kolga@netapp.com>
-Date: Thu, 30 Mar 2017 13:49:03 -0400
-Subject: [PATCH] NFSv4.1 fix infinite loop on IO BAD_STATEID error
-
-commit 0e3d3e5df07dcf8a50d96e0ecd6ab9a888f55dfc upstream.
-
-Commit 63d63cbf5e03 "NFSv4.1: Don't recheck delegations that
-have already been checked" introduced a regression where when a
-client received BAD_STATEID error it would not send any TEST_STATEID
-and instead go into an infinite loop of resending the IO that caused
-the BAD_STATEID.
-
-Fixes: 63d63cbf5e03 ("NFSv4.1: Don't recheck delegations that have already been checked")
-Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
-Cc: stable@vger.kernel.org # 4.9+
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index c780d98035cc..201ca3f2c4ba 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -2442,17 +2442,14 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
- 	}
- 
- 	nfs4_stateid_copy(&stateid, &delegation->stateid);
--	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
-+	if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) ||
-+		!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
-+			&delegation->flags)) {
- 		rcu_read_unlock();
- 		nfs_finish_clear_delegation_stateid(state, &stateid);
- 		return;
- 	}
- 
--	if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags)) {
--		rcu_read_unlock();
--		return;
--	}
--
- 	cred = get_rpccred(delegation->cred);
- 	rcu_read_unlock();
- 	status = nfs41_test_and_free_expired_stateid(server, &stateid, cred);
--- 
-2.12.0
-
diff --git a/queue/auxdisplay-img-ascii-lcd-add-missing-sentinel-entry-.patch b/queue/auxdisplay-img-ascii-lcd-add-missing-sentinel-entry-.patch
deleted file mode 100644
index c8faed7..0000000
--- a/queue/auxdisplay-img-ascii-lcd-add-missing-sentinel-entry-.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From abda288bb207e5c681306299126af8c022709c18 Mon Sep 17 00:00:00 2001
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Date: Sun, 19 Feb 2017 16:33:35 -0800
-Subject: [PATCH] auxdisplay: img-ascii-lcd: add missing sentinel entry in
- img_ascii_lcd_matches
-
-commit abda288bb207e5c681306299126af8c022709c18 upstream.
-
-The OF device table must be terminated, otherwise we'll be walking past it
-and into areas unknown.
-
-Fixes: 0cad855fbd08 ("auxdisplay: img-ascii-lcd: driver for simple ASCII...")
-Cc: stable@vger.kernel.org
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Tested-by: Fengguang Wu <fengguang.wu@intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
-index bf43b5d2aafc..83f1439e57fd 100644
---- a/drivers/auxdisplay/img-ascii-lcd.c
-+++ b/drivers/auxdisplay/img-ascii-lcd.c
-@@ -218,6 +218,7 @@ static const struct of_device_id img_ascii_lcd_matches[] = {
- 	{ .compatible = "img,boston-lcd", .data = &boston_config },
- 	{ .compatible = "mti,malta-lcd", .data = &malta_config },
- 	{ .compatible = "mti,sead3-lcd", .data = &sead3_config },
-+	{ /* sentinel */ }
- };
- 
- /**
--- 
-2.12.0
-
diff --git a/queue/blk-Ensure-users-for-current-bio_list-can-see-the-fu.patch b/queue/blk-Ensure-users-for-current-bio_list-can-see-the-fu.patch
deleted file mode 100644
index 38a2923..0000000
--- a/queue/blk-Ensure-users-for-current-bio_list-can-see-the-fu.patch
+++ /dev/null
@@ -1,198 +0,0 @@
-From f5fe1b51905df7cfe4fdfd85c5fb7bc5b71a094f Mon Sep 17 00:00:00 2001
-From: NeilBrown <neilb@suse.com>
-Date: Fri, 10 Mar 2017 17:00:47 +1100
-Subject: [PATCH] blk: Ensure users for current->bio_list can see the full
- list.
-
-commit f5fe1b51905df7cfe4fdfd85c5fb7bc5b71a094f upstream.
-
-Commit 79bd99596b73 ("blk: improve order of bio handling in generic_make_request()")
-changed current->bio_list so that it did not contain *all* of the
-queued bios, but only those submitted by the currently running
-make_request_fn.
-
-There are two places which walk the list and requeue selected bios,
-and others that check if the list is empty.  These are no longer
-correct.
-
-So redefine current->bio_list to point to an array of two lists, which
-contain all queued bios, and adjust various code to test or walk both
-lists.
-
-Signed-off-by: NeilBrown <neilb@suse.com>
-Fixes: 79bd99596b73 ("blk: improve order of bio handling in generic_make_request()")
-Signed-off-by: Jens Axboe <axboe@fb.com>
-
-diff --git a/block/bio.c b/block/bio.c
-index 5eec5e08417f..e75878f8b14a 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -376,10 +376,14 @@ static void punt_bios_to_rescuer(struct bio_set *bs)
- 	bio_list_init(&punt);
- 	bio_list_init(&nopunt);
- 
--	while ((bio = bio_list_pop(current->bio_list)))
-+	while ((bio = bio_list_pop(&current->bio_list[0])))
- 		bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio);
-+	current->bio_list[0] = nopunt;
- 
--	*current->bio_list = nopunt;
-+	bio_list_init(&nopunt);
-+	while ((bio = bio_list_pop(&current->bio_list[1])))
-+		bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio);
-+	current->bio_list[1] = nopunt;
- 
- 	spin_lock(&bs->rescue_lock);
- 	bio_list_merge(&bs->rescue_list, &punt);
-@@ -466,7 +470,9 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
- 		 * we retry with the original gfp_flags.
- 		 */
- 
--		if (current->bio_list && !bio_list_empty(current->bio_list))
-+		if (current->bio_list &&
-+		    (!bio_list_empty(&current->bio_list[0]) ||
-+		     !bio_list_empty(&current->bio_list[1])))
- 			gfp_mask &= ~__GFP_DIRECT_RECLAIM;
- 
- 		p = mempool_alloc(bs->bio_pool, gfp_mask);
-diff --git a/block/blk-core.c b/block/blk-core.c
-index 0eeb99ef654f..d772c221cc17 100644
---- a/block/blk-core.c
-+++ b/block/blk-core.c
-@@ -1973,7 +1973,14 @@ end_io:
-  */
- blk_qc_t generic_make_request(struct bio *bio)
- {
--	struct bio_list bio_list_on_stack;
-+	/*
-+	 * bio_list_on_stack[0] contains bios submitted by the current
-+	 * make_request_fn.
-+	 * bio_list_on_stack[1] contains bios that were submitted before
-+	 * the current make_request_fn, but that haven't been processed
-+	 * yet.
-+	 */
-+	struct bio_list bio_list_on_stack[2];
- 	blk_qc_t ret = BLK_QC_T_NONE;
- 
- 	if (!generic_make_request_checks(bio))
-@@ -1990,7 +1997,7 @@ blk_qc_t generic_make_request(struct bio *bio)
- 	 * should be added at the tail
- 	 */
- 	if (current->bio_list) {
--		bio_list_add(current->bio_list, bio);
-+		bio_list_add(&current->bio_list[0], bio);
- 		goto out;
- 	}
- 
-@@ -2009,18 +2016,17 @@ blk_qc_t generic_make_request(struct bio *bio)
- 	 * bio_list, and call into ->make_request() again.
- 	 */
- 	BUG_ON(bio->bi_next);
--	bio_list_init(&bio_list_on_stack);
--	current->bio_list = &bio_list_on_stack;
-+	bio_list_init(&bio_list_on_stack[0]);
-+	current->bio_list = bio_list_on_stack;
- 	do {
- 		struct request_queue *q = bdev_get_queue(bio->bi_bdev);
- 
- 		if (likely(blk_queue_enter(q, false) == 0)) {
--			struct bio_list hold;
- 			struct bio_list lower, same;
- 
- 			/* Create a fresh bio_list for all subordinate requests */
--			hold = bio_list_on_stack;
--			bio_list_init(&bio_list_on_stack);
-+			bio_list_on_stack[1] = bio_list_on_stack[0];
-+			bio_list_init(&bio_list_on_stack[0]);
- 			ret = q->make_request_fn(q, bio);
- 
- 			blk_queue_exit(q);
-@@ -2030,19 +2036,19 @@ blk_qc_t generic_make_request(struct bio *bio)
- 			 */
- 			bio_list_init(&lower);
- 			bio_list_init(&same);
--			while ((bio = bio_list_pop(&bio_list_on_stack)) != NULL)
-+			while ((bio = bio_list_pop(&bio_list_on_stack[0])) != NULL)
- 				if (q == bdev_get_queue(bio->bi_bdev))
- 					bio_list_add(&same, bio);
- 				else
- 					bio_list_add(&lower, bio);
- 			/* now assemble so we handle the lowest level first */
--			bio_list_merge(&bio_list_on_stack, &lower);
--			bio_list_merge(&bio_list_on_stack, &same);
--			bio_list_merge(&bio_list_on_stack, &hold);
-+			bio_list_merge(&bio_list_on_stack[0], &lower);
-+			bio_list_merge(&bio_list_on_stack[0], &same);
-+			bio_list_merge(&bio_list_on_stack[0], &bio_list_on_stack[1]);
- 		} else {
- 			bio_io_error(bio);
- 		}
--		bio = bio_list_pop(current->bio_list);
-+		bio = bio_list_pop(&bio_list_on_stack[0]);
- 	} while (bio);
- 	current->bio_list = NULL; /* deactivate */
- 
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index f4ffd1eb8f44..dfb75979e455 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -989,26 +989,29 @@ static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule)
- 	struct dm_offload *o = container_of(cb, struct dm_offload, cb);
- 	struct bio_list list;
- 	struct bio *bio;
-+	int i;
- 
- 	INIT_LIST_HEAD(&o->cb.list);
- 
- 	if (unlikely(!current->bio_list))
- 		return;
- 
--	list = *current->bio_list;
--	bio_list_init(current->bio_list);
--
--	while ((bio = bio_list_pop(&list))) {
--		struct bio_set *bs = bio->bi_pool;
--		if (unlikely(!bs) || bs == fs_bio_set) {
--			bio_list_add(current->bio_list, bio);
--			continue;
-+	for (i = 0; i < 2; i++) {
-+		list = current->bio_list[i];
-+		bio_list_init(&current->bio_list[i]);
-+
-+		while ((bio = bio_list_pop(&list))) {
-+			struct bio_set *bs = bio->bi_pool;
-+			if (unlikely(!bs) || bs == fs_bio_set) {
-+				bio_list_add(&current->bio_list[i], bio);
-+				continue;
-+			}
-+
-+			spin_lock(&bs->rescue_lock);
-+			bio_list_add(&bs->rescue_list, bio);
-+			queue_work(bs->rescue_workqueue, &bs->rescue_work);
-+			spin_unlock(&bs->rescue_lock);
- 		}
--
--		spin_lock(&bs->rescue_lock);
--		bio_list_add(&bs->rescue_list, bio);
--		queue_work(bs->rescue_workqueue, &bs->rescue_work);
--		spin_unlock(&bs->rescue_lock);
- 	}
- }
- 
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 063c43d83b72..0536658c9d40 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -974,7 +974,8 @@ static void wait_barrier(struct r10conf *conf)
- 				    !conf->barrier ||
- 				    (atomic_read(&conf->nr_pending) &&
- 				     current->bio_list &&
--				     !bio_list_empty(current->bio_list)),
-+				     (!bio_list_empty(&current->bio_list[0]) ||
-+				      !bio_list_empty(&current->bio_list[1]))),
- 				    conf->resync_lock);
- 		conf->nr_waiting--;
- 		if (!conf->nr_waiting)
--- 
-2.12.0
-
diff --git a/queue/clk-sunxi-ng-sun6i-Fix-enable-bit-offset-for-hdmi-dd.patch b/queue/clk-sunxi-ng-sun6i-Fix-enable-bit-offset-for-hdmi-dd.patch
deleted file mode 100644
index a5ee4fa..0000000
--- a/queue/clk-sunxi-ng-sun6i-Fix-enable-bit-offset-for-hdmi-dd.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 9ad0bb39fce319d7b92c17d306ed0a9f70a02e7d Mon Sep 17 00:00:00 2001
-From: Chen-Yu Tsai <wens@csie.org>
-Date: Tue, 14 Feb 2017 10:23:32 +0800
-Subject: [PATCH] clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc
- module clock
-
-commit 9ad0bb39fce319d7b92c17d306ed0a9f70a02e7d upstream.
-
-The enable bit offset for the hdmi-ddc module clock is wrong. It is
-pointing to the main hdmi module clock enable bit.
-
-Reported-by: Bob Ham <rah@settrans.net>
-Fixes: c6e6c96d8fa6 ("clk: sunxi-ng: Add A31/A31s clocks")
-Cc: stable@vger.kernel.org # 4.9.x-
-Signed-off-by: Chen-Yu Tsai <wens@csie.org>
-Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
-
-diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
-index 4c9a920ff4ab..89e68d29bf45 100644
---- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
-+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
-@@ -608,7 +608,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(hdmi_clk, "hdmi", lcd_ch1_parents,
- 				 0x150, 0, 4, 24, 2, BIT(31),
- 				 CLK_SET_RATE_PARENT);
- 
--static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(31), 0);
-+static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(30), 0);
- 
- static SUNXI_CCU_GATE(ps_clk, "ps", "lcd1-ch1", 0x140, BIT(31), 0);
- 
--- 
-2.12.0
-
diff --git a/queue/ext4-fix-fencepost-in-s_first_meta_bg-validation.patch b/queue/ext4-fix-fencepost-in-s_first_meta_bg-validation.patch
deleted file mode 100644
index 019719b..0000000
--- a/queue/ext4-fix-fencepost-in-s_first_meta_bg-validation.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 2ba3e6e8afc9b6188b471f27cf2b5e3cf34e7af2 Mon Sep 17 00:00:00 2001
-From: Theodore Ts'o <tytso@mit.edu>
-Date: Wed, 15 Feb 2017 01:26:39 -0500
-Subject: [PATCH] ext4: fix fencepost in s_first_meta_bg validation
-
-commit 2ba3e6e8afc9b6188b471f27cf2b5e3cf34e7af2 upstream.
-
-It is OK for s_first_meta_bg to be equal to the number of block group
-descriptor blocks.  (It rarely happens, but it shouldn't cause any
-problems.)
-
-https://bugzilla.kernel.org/show_bug.cgi?id=194567
-
-Fixes: 3a4b77cd47bb837b8557595ec7425f281f2ca1fe
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-Cc: stable@vger.kernel.org
-
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index dde14a7ac6d7..a673558fe5f8 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -3860,7 +3860,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
- 		   EXT4_DESC_PER_BLOCK(sb);
- 	if (ext4_has_feature_meta_bg(sb)) {
--		if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
-+		if (le32_to_cpu(es->s_first_meta_bg) > db_count) {
- 			ext4_msg(sb, KERN_WARNING,
- 				 "first meta block group too large: %u "
- 				 "(group descriptor block count %u)",
--- 
-2.12.0
-
diff --git a/queue/hwrng-amd-Revert-managed-API-changes.patch b/queue/hwrng-amd-Revert-managed-API-changes.patch
deleted file mode 100644
index b89c933..0000000
--- a/queue/hwrng-amd-Revert-managed-API-changes.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-From 69db7009318758769d625b023402161c750f7876 Mon Sep 17 00:00:00 2001
-From: Prarit Bhargava <prarit@redhat.com>
-Date: Tue, 14 Mar 2017 07:36:01 -0400
-Subject: [PATCH] hwrng: amd - Revert managed API changes
-
-commit 69db7009318758769d625b023402161c750f7876 upstream.
-
-After commit 31b2a73c9c5f ("hwrng: amd - Migrate to managed API"), the
-amd-rng driver uses devres with pci_dev->dev to keep track of resources,
-but does not actually register a PCI driver.  This results in the
-following issues:
-
-1. The message
-
-WARNING: CPU: 2 PID: 621 at drivers/base/dd.c:349 driver_probe_device+0x38c
-
-is output when the i2c_amd756 driver loads and attempts to register a PCI
-driver.  The PCI & device subsystems assume that no resources have been
-registered for the device, and the WARN_ON() triggers since amd-rng has
-already do so.
-
-2.  The driver leaks memory because the driver does not attach to a
-device.  The driver only uses the PCI device as a reference.   devm_*()
-functions will release resources on driver detach, which the amd-rng
-driver will never do.  As a result,
-
-3.  The driver cannot be reloaded because there is always a use of the
-ioport and region after the first load of the driver.
-
-Revert the changes made by 31b2a73c9c5f ("hwrng: amd - Migrate to managed
-API").
-
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Prarit Bhargava <prarit@redhat.com>
-Fixes: 31b2a73c9c5f ("hwrng: amd - Migrate to managed API").
-Cc: Matt Mackall <mpm@selenic.com>
-Cc: Corentin LABBE <clabbe.montjoie@gmail.com>
-Cc: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com>
-Cc: Wei Yongjun <weiyongjun1@huawei.com>
-Cc: linux-crypto@vger.kernel.org
-Cc: linux-geode@lists.infradead.org
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-
-diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
-index 4a99ac756f08..9959c762da2f 100644
---- a/drivers/char/hw_random/amd-rng.c
-+++ b/drivers/char/hw_random/amd-rng.c
-@@ -55,6 +55,7 @@ MODULE_DEVICE_TABLE(pci, pci_tbl);
- struct amd768_priv {
- 	void __iomem *iobase;
- 	struct pci_dev *pcidev;
-+	u32 pmbase;
- };
- 
- static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
-@@ -148,33 +149,58 @@ found:
- 	if (pmbase == 0)
- 		return -EIO;
- 
--	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
-+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
- 	if (!priv)
- 		return -ENOMEM;
- 
--	if (!devm_request_region(&pdev->dev, pmbase + PMBASE_OFFSET,
--				PMBASE_SIZE, DRV_NAME)) {
-+	if (!request_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE, DRV_NAME)) {
- 		dev_err(&pdev->dev, DRV_NAME " region 0x%x already in use!\n",
- 			pmbase + 0xF0);
--		return -EBUSY;
-+		err = -EBUSY;
-+		goto out;
- 	}
- 
--	priv->iobase = devm_ioport_map(&pdev->dev, pmbase + PMBASE_OFFSET,
--			PMBASE_SIZE);
-+	priv->iobase = ioport_map(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
- 	if (!priv->iobase) {
- 		pr_err(DRV_NAME "Cannot map ioport\n");
--		return -ENOMEM;
-+		err = -EINVAL;
-+		goto err_iomap;
- 	}
- 
- 	amd_rng.priv = (unsigned long)priv;
-+	priv->pmbase = pmbase;
- 	priv->pcidev = pdev;
- 
- 	pr_info(DRV_NAME " detected\n");
--	return devm_hwrng_register(&pdev->dev, &amd_rng);
-+	err = hwrng_register(&amd_rng);
-+	if (err) {
-+		pr_err(DRV_NAME " registering failed (%d)\n", err);
-+		goto err_hwrng;
-+	}
-+	return 0;
-+
-+err_hwrng:
-+	ioport_unmap(priv->iobase);
-+err_iomap:
-+	release_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
-+out:
-+	kfree(priv);
-+	return err;
- }
- 
- static void __exit mod_exit(void)
- {
-+	struct amd768_priv *priv;
-+
-+	priv = (struct amd768_priv *)amd_rng.priv;
-+
-+	hwrng_unregister(&amd_rng);
-+
-+	ioport_unmap(priv->iobase);
-+
-+	release_region(priv->pmbase + PMBASE_OFFSET, PMBASE_SIZE);
-+
-+	kfree(priv);
- }
- 
- module_init(mod_init);
--- 
-2.12.0
-
diff --git a/queue/hwrng-geode-Revert-managed-API-changes.patch b/queue/hwrng-geode-Revert-managed-API-changes.patch
deleted file mode 100644
index 38fa111..0000000
--- a/queue/hwrng-geode-Revert-managed-API-changes.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 8c75704ebcac2ffa31ee7bcc359baf701b52bf00 Mon Sep 17 00:00:00 2001
-From: Prarit Bhargava <prarit@redhat.com>
-Date: Tue, 14 Mar 2017 07:36:02 -0400
-Subject: [PATCH] hwrng: geode - Revert managed API changes
-
-commit 8c75704ebcac2ffa31ee7bcc359baf701b52bf00 upstream.
-
-After commit e9afc746299d ("hwrng: geode - Use linux/io.h instead of
-asm/io.h") the geode-rng driver uses devres with pci_dev->dev to keep
-track of resources, but does not actually register a PCI driver.  This
-results in the following issues:
-
-1.  The driver leaks memory because the driver does not attach to a
-device.  The driver only uses the PCI device as a reference.   devm_*()
-functions will release resources on driver detach, which the geode-rng
-driver will never do.  As a result,
-
-2.  The driver cannot be reloaded because there is always a use of the
-ioport and region after the first load of the driver.
-
-Revert the changes made by  e9afc746299d ("hwrng: geode - Use linux/io.h
-instead of asm/io.h").
-
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Prarit Bhargava <prarit@redhat.com>
-Fixes: 6e9b5e76882c ("hwrng: geode - Migrate to managed API")
-Cc: Matt Mackall <mpm@selenic.com>
-Cc: Corentin LABBE <clabbe.montjoie@gmail.com>
-Cc: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com>
-Cc: Wei Yongjun <weiyongjun1@huawei.com>
-Cc: linux-crypto@vger.kernel.org
-Cc: linux-geode@lists.infradead.org
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-
-diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
-index e7a245942029..e1d421a36a13 100644
---- a/drivers/char/hw_random/geode-rng.c
-+++ b/drivers/char/hw_random/geode-rng.c
-@@ -31,6 +31,9 @@
- #include <linux/module.h>
- #include <linux/pci.h>
- 
-+
-+#define PFX	KBUILD_MODNAME ": "
-+
- #define GEODE_RNG_DATA_REG   0x50
- #define GEODE_RNG_STATUS_REG 0x54
- 
-@@ -82,6 +85,7 @@ static struct hwrng geode_rng = {
- 
- static int __init mod_init(void)
- {
-+	int err = -ENODEV;
- 	struct pci_dev *pdev = NULL;
- 	const struct pci_device_id *ent;
- 	void __iomem *mem;
-@@ -89,27 +93,43 @@ static int __init mod_init(void)
- 
- 	for_each_pci_dev(pdev) {
- 		ent = pci_match_id(pci_tbl, pdev);
--		if (ent) {
--			rng_base = pci_resource_start(pdev, 0);
--			if (rng_base == 0)
--				return -ENODEV;
--
--			mem = devm_ioremap(&pdev->dev, rng_base, 0x58);
--			if (!mem)
--				return -ENOMEM;
--			geode_rng.priv = (unsigned long)mem;
--
--			pr_info("AMD Geode RNG detected\n");
--			return devm_hwrng_register(&pdev->dev, &geode_rng);
--		}
-+		if (ent)
-+			goto found;
- 	}
--
- 	/* Device not found. */
--	return -ENODEV;
-+	goto out;
-+
-+found:
-+	rng_base = pci_resource_start(pdev, 0);
-+	if (rng_base == 0)
-+		goto out;
-+	err = -ENOMEM;
-+	mem = ioremap(rng_base, 0x58);
-+	if (!mem)
-+		goto out;
-+	geode_rng.priv = (unsigned long)mem;
-+
-+	pr_info("AMD Geode RNG detected\n");
-+	err = hwrng_register(&geode_rng);
-+	if (err) {
-+		pr_err(PFX "RNG registering failed (%d)\n",
-+		       err);
-+		goto err_unmap;
-+	}
-+out:
-+	return err;
-+
-+err_unmap:
-+	iounmap(mem);
-+	goto out;
- }
- 
- static void __exit mod_exit(void)
- {
-+	void __iomem *mem = (void __iomem *)geode_rng.priv;
-+
-+	hwrng_unregister(&geode_rng);
-+	iounmap(mem);
- }
- 
- module_init(mod_init);
--- 
-2.12.0
-
diff --git a/queue/iommu-vt-d-Fix-NULL-pointer-dereference-in-device_to.patch b/queue/iommu-vt-d-Fix-NULL-pointer-dereference-in-device_to.patch
deleted file mode 100644
index 40efc43..0000000
--- a/queue/iommu-vt-d-Fix-NULL-pointer-dereference-in-device_to.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 5003ae1e735e6bfe4679d9bed6846274f322e77e Mon Sep 17 00:00:00 2001
-From: Koos Vriezen <koos.vriezen@gmail.com>
-Date: Wed, 1 Mar 2017 21:02:50 +0100
-Subject: [PATCH] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
-
-commit 5003ae1e735e6bfe4679d9bed6846274f322e77e upstream.
-
-The function device_to_iommu() in the Intel VT-d driver
-lacks a NULL-ptr check, resulting in this oops at boot on
-some platforms:
-
- BUG: unable to handle kernel NULL pointer dereference at 00000000000007ab
- IP: [<ffffffff8132234a>] device_to_iommu+0x11a/0x1a0
- PGD 0
-
- [...]
-
- Call Trace:
-   ? find_or_alloc_domain.constprop.29+0x1a/0x300
-   ? dw_dma_probe+0x561/0x580 [dw_dmac_core]
-   ? __get_valid_domain_for_dev+0x39/0x120
-   ? __intel_map_single+0x138/0x180
-   ? intel_alloc_coherent+0xb6/0x120
-   ? sst_hsw_dsp_init+0x173/0x420 [snd_soc_sst_haswell_pcm]
-   ? mutex_lock+0x9/0x30
-   ? kernfs_add_one+0xdb/0x130
-   ? devres_add+0x19/0x60
-   ? hsw_pcm_dev_probe+0x46/0xd0 [snd_soc_sst_haswell_pcm]
-   ? platform_drv_probe+0x30/0x90
-   ? driver_probe_device+0x1ed/0x2b0
-   ? __driver_attach+0x8f/0xa0
-   ? driver_probe_device+0x2b0/0x2b0
-   ? bus_for_each_dev+0x55/0x90
-   ? bus_add_driver+0x110/0x210
-   ? 0xffffffffa11ea000
-   ? driver_register+0x52/0xc0
-   ? 0xffffffffa11ea000
-   ? do_one_initcall+0x32/0x130
-   ? free_vmap_area_noflush+0x37/0x70
-   ? kmem_cache_alloc+0x88/0xd0
-   ? do_init_module+0x51/0x1c4
-   ? load_module+0x1ee9/0x2430
-   ? show_taint+0x20/0x20
-   ? kernel_read_file+0xfd/0x190
-   ? SyS_finit_module+0xa3/0xb0
-   ? do_syscall_64+0x4a/0xb0
-   ? entry_SYSCALL64_slow_path+0x25/0x25
- Code: 78 ff ff ff 4d 85 c0 74 ee 49 8b 5a 10 0f b6 9b e0 00 00 00 41 38 98 e0 00 00 00 77 da 0f b6 eb 49 39 a8 88 00 00 00 72 ce eb 8f <41> f6 82 ab 07 00 00 04 0f 85 76 ff ff ff 0f b6 4d 08 88 0e 49
- RIP  [<ffffffff8132234a>] device_to_iommu+0x11a/0x1a0
-  RSP <ffffc90001457a78>
- CR2: 00000000000007ab
- ---[ end trace 16f974b6d58d0aad ]---
-
-Add the missing pointer check.
-
-Fixes: 1c387188c60f53b338c20eee32db055dfe022a9b ("iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions")
-Signed-off-by: Koos Vriezen <koos.vriezen@gmail.com>
-Cc: stable@vger.kernel.org # 4.8.15+
-Signed-off-by: Joerg Roedel <jroedel@suse.de>
-
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index 238ad3447712..91d60493b57c 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -916,7 +916,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
- 				 * which we used for the IOMMU lookup. Strictly speaking
- 				 * we could do this for all PCI devices; we only need to
- 				 * get the BDF# from the scope table for ACPI matches. */
--				if (pdev->is_virtfn)
-+				if (pdev && pdev->is_virtfn)
- 					goto got_pdev;
- 
- 				*bus = drhd->devices[i].bus;
--- 
-2.12.0
-
diff --git a/queue/jbd2-don-t-leak-memory-if-setting-up-journal-fails.patch b/queue/jbd2-don-t-leak-memory-if-setting-up-journal-fails.patch
deleted file mode 100644
index ae495de..0000000
--- a/queue/jbd2-don-t-leak-memory-if-setting-up-journal-fails.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From cd9cb405e0b948363811dc74dbb2890f56f2cb87 Mon Sep 17 00:00:00 2001
-From: Eric Biggers <ebiggers@google.com>
-Date: Wed, 15 Mar 2017 15:08:48 -0400
-Subject: [PATCH] jbd2: don't leak memory if setting up journal fails
-
-commit cd9cb405e0b948363811dc74dbb2890f56f2cb87 upstream.
-
-In journal_init_common(), if we failed to allocate the j_wbuf array, or
-if we failed to create the buffer_head for the journal superblock, we
-leaked the memory allocated for the revocation tables.  Fix this.
-
-Cc: stable@vger.kernel.org # 4.9
-Fixes: f0c9fd5458bacf7b12a9a579a727dc740cbe047e
-Signed-off-by: Eric Biggers <ebiggers@google.com>
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-Reviewed-by: Jan Kara <jack@suse.cz>
-
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index a1a359bfcc9c..5adc2fb62b0f 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -1125,10 +1125,8 @@ static journal_t *journal_init_common(struct block_device *bdev,
- 
- 	/* Set up a default-sized revoke table for the new mount. */
- 	err = jbd2_journal_init_revoke(journal, JOURNAL_REVOKE_DEFAULT_HASH);
--	if (err) {
--		kfree(journal);
--		return NULL;
--	}
-+	if (err)
-+		goto err_cleanup;
- 
- 	spin_lock_init(&journal->j_history_lock);
- 
-@@ -1145,23 +1143,25 @@ static journal_t *journal_init_common(struct block_device *bdev,
- 	journal->j_wbufsize = n;
- 	journal->j_wbuf = kmalloc_array(n, sizeof(struct buffer_head *),
- 					GFP_KERNEL);
--	if (!journal->j_wbuf) {
--		kfree(journal);
--		return NULL;
--	}
-+	if (!journal->j_wbuf)
-+		goto err_cleanup;
- 
- 	bh = getblk_unmovable(journal->j_dev, start, journal->j_blocksize);
- 	if (!bh) {
- 		pr_err("%s: Cannot get buffer for journal superblock\n",
- 			__func__);
--		kfree(journal->j_wbuf);
--		kfree(journal);
--		return NULL;
-+		goto err_cleanup;
- 	}
- 	journal->j_sb_buffer = bh;
- 	journal->j_superblock = (journal_superblock_t *)bh->b_data;
- 
- 	return journal;
-+
-+err_cleanup:
-+	kfree(journal->j_wbuf);
-+	jbd2_journal_destroy_revoke(journal);
-+	kfree(journal);
-+	return NULL;
- }
- 
- /* jbd2_journal_init_dev and jbd2_journal_init_inode:
-diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
-index cfc38b552118..f9aefcda5854 100644
---- a/fs/jbd2/revoke.c
-+++ b/fs/jbd2/revoke.c
-@@ -280,6 +280,7 @@ int jbd2_journal_init_revoke(journal_t *journal, int hash_size)
- 
- fail1:
- 	jbd2_journal_destroy_revoke_table(journal->j_revoke_table[0]);
-+	journal->j_revoke_table[0] = NULL;
- fail0:
- 	return -ENOMEM;
- }
--- 
-2.12.0
-
diff --git a/queue/lib-syscall-Clear-return-values-when-no-stack.patch b/queue/lib-syscall-Clear-return-values-when-no-stack.patch
deleted file mode 100644
index 97e8f27..0000000
--- a/queue/lib-syscall-Clear-return-values-when-no-stack.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 854fbd6e5f60fe99e8e3a569865409fca378f143 Mon Sep 17 00:00:00 2001
-From: Kees Cook <keescook@chromium.org>
-Date: Thu, 23 Mar 2017 15:46:16 -0700
-Subject: [PATCH] lib/syscall: Clear return values when no stack
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 854fbd6e5f60fe99e8e3a569865409fca378f143 upstream.
-
-Commit:
-
-  aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
-
-... added logic to handle a process stack not existing, but left sp and pc
-uninitialized, which can be later reported via /proc/$pid/syscall for zombie
-processes, potentially exposing kernel memory to userspace.
-
-  Zombie /proc/$pid/syscall before:
-  -1 0xffffffff9a060100 0xffff92f42d6ad900
-
-  Zombie /proc/$pid/syscall after:
-  -1 0x0 0x0
-
-Reported-by: Robert Święcki <robert@swiecki.net>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Reviewed-by: Andy Lutomirski <luto@kernel.org>
-Cc: Borislav Petkov <bp@alien8.de>
-Cc: Brian Gerst <brgerst@gmail.com>
-Cc: Denys Vlasenko <dvlasenk@redhat.com>
-Cc: H. Peter Anvin <hpa@zytor.com>
-Cc: Josh Poimboeuf <jpoimboe@redhat.com>
-Cc: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Cc: stable@vger.kernel.org # v4.9+
-Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
-Link: http://lkml.kernel.org/r/20170323224616.GA92694@beast
-Signed-off-by: Ingo Molnar <mingo@kernel.org>
-
-diff --git a/lib/syscall.c b/lib/syscall.c
-index 17d5ff5fa6a3..2c6cd1b5c3ea 100644
---- a/lib/syscall.c
-+++ b/lib/syscall.c
-@@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
- 
- 	if (!try_get_task_stack(target)) {
- 		/* Task has no stack, so the task isn't in a syscall. */
-+		*sp = *pc = 0;
- 		*callno = -1;
- 		return 0;
- 	}
--- 
-2.12.0
-
diff --git a/queue/mwifiex-pcie-don-t-leak-DMA-buffers-when-removing.patch b/queue/mwifiex-pcie-don-t-leak-DMA-buffers-when-removing.patch
deleted file mode 100644
index 3183553..0000000
--- a/queue/mwifiex-pcie-don-t-leak-DMA-buffers-when-removing.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 4e841d3eb9294ce4137fdb5d0a88f1bceab9c212 Mon Sep 17 00:00:00 2001
-From: Brian Norris <briannorris@chromium.org>
-Date: Fri, 10 Mar 2017 17:39:21 -0800
-Subject: [PATCH] mwifiex: pcie: don't leak DMA buffers when removing
-
-commit 4e841d3eb9294ce4137fdb5d0a88f1bceab9c212 upstream.
-
-When PCIe FLR support was added, much of the remove/release code for
-PCIe was migrated to ->down_dev(), but ->down_dev() is never called for
-device removal. Let's refactor the cleanup to be done in both cases.
-
-Also, drop the comments above mwifiex_cleanup_pcie(), because they were
-clearly wrong, and it's better to have clear and obvious code than to
-detail the code steps in comments anyway.
-
-Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Brian Norris <briannorris@chromium.org>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-
-diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
-index a0d918094889..b8c990d10d6e 100644
---- a/drivers/net/wireless/marvell/mwifiex/pcie.c
-+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
-@@ -2739,6 +2739,21 @@ static void mwifiex_pcie_device_dump(struct mwifiex_adapter *adapter)
- 	schedule_work(&card->work);
- }
- 
-+static void mwifiex_pcie_free_buffers(struct mwifiex_adapter *adapter)
-+{
-+	struct pcie_service_card *card = adapter->card;
-+	const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
-+
-+	if (reg->sleep_cookie)
-+		mwifiex_pcie_delete_sleep_cookie_buf(adapter);
-+
-+	mwifiex_pcie_delete_cmdrsp_buf(adapter);
-+	mwifiex_pcie_delete_evtbd_ring(adapter);
-+	mwifiex_pcie_delete_rxbd_ring(adapter);
-+	mwifiex_pcie_delete_txbd_ring(adapter);
-+	card->cmdrsp_buf = NULL;
-+}
-+
- /*
-  * This function initializes the PCI-E host memory space, WCB rings, etc.
-  *
-@@ -2850,13 +2865,6 @@ err_enable_dev:
- 
- /*
-  * This function cleans up the allocated card buffers.
-- *
-- * The following are freed by this function -
-- *      - TXBD ring buffers
-- *      - RXBD ring buffers
-- *      - Event BD ring buffers
-- *      - Command response ring buffer
-- *      - Sleep cookie buffer
-  */
- static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
- {
-@@ -2875,6 +2883,8 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
- 				    "Failed to write driver not-ready signature\n");
- 	}
- 
-+	mwifiex_pcie_free_buffers(adapter);
-+
- 	if (pdev) {
- 		pci_iounmap(pdev, card->pci_mmap);
- 		pci_iounmap(pdev, card->pci_mmap1);
-@@ -3126,10 +3136,7 @@ err_cre_txbd:
- 	pci_iounmap(pdev, card->pci_mmap1);
- }
- 
--/* This function cleans up the PCI-E host memory space.
-- * Some code is extracted from mwifiex_unregister_dev()
-- *
-- */
-+/* This function cleans up the PCI-E host memory space. */
- static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
- {
- 	struct pcie_service_card *card = adapter->card;
-@@ -3140,14 +3147,7 @@ static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
- 
- 	adapter->seq_num = 0;
- 
--	if (reg->sleep_cookie)
--		mwifiex_pcie_delete_sleep_cookie_buf(adapter);
--
--	mwifiex_pcie_delete_cmdrsp_buf(adapter);
--	mwifiex_pcie_delete_evtbd_ring(adapter);
--	mwifiex_pcie_delete_rxbd_ring(adapter);
--	mwifiex_pcie_delete_txbd_ring(adapter);
--	card->cmdrsp_buf = NULL;
-+	mwifiex_pcie_free_buffers(adapter);
- }
- 
- static struct mwifiex_if_ops pcie_ops = {
--- 
-2.12.0
-
diff --git a/queue/net-mlx5e-Use-the-proper-UAPI-values-when-offloading.patch b/queue/net-mlx5e-Use-the-proper-UAPI-values-when-offloading.patch
deleted file mode 100644
index 0c049da..0000000
--- a/queue/net-mlx5e-Use-the-proper-UAPI-values-when-offloading.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 09c91ddf2cd33489c2c14edfef43ae38d412888e Mon Sep 17 00:00:00 2001
-From: Or Gerlitz <ogerlitz@mellanox.com>
-Date: Tue, 21 Mar 2017 15:59:15 +0200
-Subject: [PATCH] net/mlx5e: Use the proper UAPI values when offloading TC vlan
- actions
-
-commit 09c91ddf2cd33489c2c14edfef43ae38d412888e upstream.
-
-Currently we use the non UAPI values and we miss erring on
-the modify action which is not supported, fix that.
-
-Fixes: 8b32580df1cb ('net/mlx5e: Add TC vlan action for SRIOV offloads')
-Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
-Reported-by: Petr Machata <petrm@mellanox.com>
-Reviewed-by: Jiri Pirko <jiri@mellanox.com>
-Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-index 2825b5665456..9c13abaf3885 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-@@ -1131,14 +1131,16 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
- 		}
- 
- 		if (is_tcf_vlan(a)) {
--			if (tcf_vlan_action(a) == VLAN_F_POP) {
-+			if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) {
- 				attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP;
--			} else if (tcf_vlan_action(a) == VLAN_F_PUSH) {
-+			} else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) {
- 				if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q))
- 					return -EOPNOTSUPP;
- 
- 				attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH;
- 				attr->vlan = tcf_vlan_push_vid(a);
-+			} else { /* action is TCA_VLAN_ACT_MODIFY */
-+				return -EOPNOTSUPP;
- 			}
- 			continue;
- 		}
--- 
-2.12.0
-
diff --git a/queue/parisc-Avoid-stalled-CPU-warnings-after-system-shutd.patch b/queue/parisc-Avoid-stalled-CPU-warnings-after-system-shutd.patch
deleted file mode 100644
index 38f90bc..0000000
--- a/queue/parisc-Avoid-stalled-CPU-warnings-after-system-shutd.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 476e75a44b56038bee9207242d4bc718f6b4de06 Mon Sep 17 00:00:00 2001
-From: Helge Deller <deller@gmx.de>
-Date: Wed, 29 Mar 2017 08:25:30 +0200
-Subject: [PATCH] parisc: Avoid stalled CPU warnings after system shutdown
-
-commit 476e75a44b56038bee9207242d4bc718f6b4de06 upstream.
-
-Commit 73580dac7618 ("parisc: Fix system shutdown halt") introduced an endless
-loop for systems which don't provide a software power off function.  But the
-soft lockup detector will detect this and report stalled CPUs after some time.
-Avoid those unwanted warnings by disabling the soft lockup detector.
-
-Fixes: 73580dac7618 ("parisc: Fix system shutdown halt")
-Signed-off-by: Helge Deller <deller@gmx.de>
-Cc: stable@vger.kernel.org # 4.9+
-
-diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
-index b76f503eee4a..4516a5b53f38 100644
---- a/arch/parisc/kernel/process.c
-+++ b/arch/parisc/kernel/process.c
-@@ -143,6 +143,8 @@ void machine_power_off(void)
- 	printk(KERN_EMERG "System shut down completed.\n"
- 	       "Please power this system off now.");
- 
-+	/* prevent soft lockup/stalled CPU messages for endless loop. */
-+	rcu_sysrq_start();
- 	for (;;);
- }
- 
--- 
-2.12.0
-
diff --git a/queue/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch b/queue/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch
deleted file mode 100644
index 95fb292..0000000
--- a/queue/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 Mon Sep 17 00:00:00 2001
-From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
-Date: Thu, 23 Feb 2017 09:31:18 -0300
-Subject: [PATCH] sctp: deny peeloff operation on asocs with threads sleeping
- on it
-
-commit dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 upstream.
-
-commit 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf")
-attempted to avoid a BUG_ON call when the association being used for a
-sendmsg() is blocked waiting for more sndbuf and another thread did a
-peeloff operation on such asoc, moving it to another socket.
-
-As Ben Hutchings noticed, then in such case it would return without
-locking back the socket and would cause two unlocks in a row.
-
-Further analysis also revealed that it could allow a double free if the
-application managed to peeloff the asoc that is created during the
-sendmsg call, because then sctp_sendmsg() would try to free the asoc
-that was created only for that call.
-
-This patch takes another approach. It will deny the peeloff operation
-if there is a thread sleeping on the asoc, so this situation doesn't
-exist anymore. This avoids the issues described above and also honors
-the syscalls that are already being handled (it can be multiple sendmsg
-calls).
-
-Joint work with Xin Long.
-
-Fixes: 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf")
-Cc: Alexander Popov <alex.popov@linux.com>
-Cc: Ben Hutchings <ben@decadent.org.uk>
-Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
-Signed-off-by: Xin Long <lucien.xin@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index b5321486fbed..465a9c8464f9 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -4862,6 +4862,12 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
- 	if (!asoc)
- 		return -EINVAL;
- 
-+	/* If there is a thread waiting on more sndbuf space for
-+	 * sending on this asoc, it cannot be peeled.
-+	 */
-+	if (waitqueue_active(&asoc->wait))
-+		return -EBUSY;
-+
- 	/* An association cannot be branched off from an already peeled-off
- 	 * socket, nor is this supported for tcp style sockets.
- 	 */
-@@ -7599,8 +7605,6 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
- 		 */
- 		release_sock(sk);
- 		current_timeo = schedule_timeout(current_timeo);
--		if (sk != asoc->base.sk)
--			goto do_error;
- 		lock_sock(sk);
- 
- 		*timeo_p = current_timeo;
--- 
-2.12.0
-
diff --git a/queue/series b/queue/series
index 066a169..3f7dfb7 100644
--- a/queue/series
+++ b/queue/series
@@ -1,4 +1,3 @@
-sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch
 drm-vc4-Fix-termination-of-the-initial-scan-for-bran.patch
 drm-vc4-Use-runtime-autosuspend-to-avoid-thrashing-V.patch
 give-up-on-gcc-ilog2-constant-optimizations.patch
@@ -8,8 +7,6 @@ parisc-Optimize-flush_kernel_vmap_range-and-invalida.patch
 parisc-Fix-system-shutdown-halt.patch
 perf-core-Fix-use-after-free-in-perf_release.patch
 perf-core-Fix-event-inheritance-on-fork.patch
-xprtrdma-Squelch-kbuild-sparse-complaint.patch
-NFS-prevent-double-free-in-async-nfs4_exchange_id.patch
 cpufreq-Fix-and-clean-up-show_cpuinfo_cur_freq.patch
 powerpc-boot-Fix-zImage-TOC-alignment.patch
 md-raid1-10-fix-potential-deadlock.patch
@@ -22,7 +19,6 @@ gfs2-Avoid-alignment-hole-in-struct-lm_lockname.patch
 percpu-acquire-pcpu_lock-when-updating-pcpu_nr_empty.patch
 cgroup-pids-remove-spurious-suspicious-RCU-usage-war.patch
 drm-amdgpu-si-add-dpm-quirk-for-Oland.patch
-ext4-fix-fencepost-in-s_first_meta_bg-validation.patch
 net-openvswitch-Set-the-ipv6-source-tunnel-key-addre.patch
 net-bcmgenet-Do-not-suspend-PHY-if-Wake-on-LAN-is-en.patch
 net-properly-release-sk_frag.page.patch
@@ -32,7 +28,6 @@ net-unix-properly-re-increment-inflight-counter-of-G.patch
 qmi_wwan-add-Dell-DW5811e.patch
 net-vrf-Reset-rt6i_idev-in-local-dst-after-put.patch
 net-mlx5-Add-missing-entries-for-set-query-rate-limi.patch
-net-mlx5e-Use-the-proper-UAPI-values-when-offloading.patch
 net-mlx5-Increase-number-of-max-QPs-in-default-profi.patch
 net-mlx5e-Count-GSO-packets-correctly.patch
 net-mlx5e-Count-LRO-packets-correctly.patch
@@ -41,8 +36,6 @@ net-bcmgenet-remove-bcmgenet_internal_phy_setup.patch
 ipv4-provide-stronger-user-input-validation-in-nl_fi.patch
 socket-bpf-fix-sk_filter-use-after-free-in-sk_clone_.patch
 tcp-initialize-icsk_ack.lrcvtime-at-session-start-ti.patch
-Input-ALPS-fix-V8-protocol-handling-73-03-28.patch
-Input-ALPS-fix-trackstick-button-handling-on-V8-devi.patch
 Input-elan_i2c-add-ASUS-EeeBook-X205TA-special-touch.patch
 Input-i8042-add-noloop-quirk-for-Dell-Embedded-Box-P.patch
 Input-iforce-validate-number-of-endpoints-before-usi.patch
@@ -53,7 +46,6 @@ Input-cm109-validate-number-of-endpoints-before-usin.patch
 Input-kbtab-validate-number-of-endpoints-before-usin.patch
 Input-sur40-validate-number-of-endpoints-before-usin.patch
 ALSA-seq-Fix-racy-cell-insertions-during-snd_seq_poo.patch
-ALSA-ctxfi-Fix-the-incorrect-check-of-dma_set_mask-c.patch
 ALSA-hda-Adding-a-group-of-pin-definition-to-fix-hea.patch
 USB-serial-option-add-Quectel-UC15-UC20-EC21-and-EC2.patch
 USB-serial-qcserial-add-Dell-DW5811e.patch
@@ -83,14 +75,9 @@ mmc-sdhci-of-at91-Support-external-regulators.patch
 mmc-sdhci-of-arasan-fix-incorrect-timeout-clock.patch
 mmc-sdhci-Do-not-disable-interrupts-while-waiting-fo.patch
 mmc-sdhci-pci-Do-not-disable-interrupts-in-sdhci_int.patch
-hwrng-amd-Revert-managed-API-changes.patch
-hwrng-geode-Revert-managed-API-changes.patch
-clk-sunxi-ng-sun6i-Fix-enable-bit-offset-for-hdmi-dd.patch
 clk-sunxi-ng-mp-Adjust-parent-rate-for-pre-dividers.patch
-mwifiex-pcie-don-t-leak-DMA-buffers-when-removing.patch
 crypto-ccp-Assign-DMA-commands-to-the-channel-s-CCP.patch
 xen-acpi-upload-PM-state-from-init-domain-to-Xen.patch
-iommu-vt-d-Fix-NULL-pointer-dereference-in-device_to.patch
 Revert-ARM-at91-dt-sama5d2-Use-new-compatible-for-oh.patch
 ARM-at91-pm-cpu_idle-switch-DDR-to-power-down-mode.patch
 arm64-kaslr-Fix-up-the-kernel-image-alignment.patch
@@ -98,11 +85,8 @@ cpufreq-Restore-policy-min-max-limits-on-CPU-online.patch
 cgroup-net_cls-iterate-the-fds-of-only-the-tasks-whi.patch
 blk-mq-don-t-complete-un-started-request-in-timeout-.patch
 drm-amdgpu-reinstate-oland-workaround-for-sclk.patch
-auxdisplay-img-ascii-lcd-add-missing-sentinel-entry-.patch
-jbd2-don-t-leak-memory-if-setting-up-journal-fails.patch
 intel_th-Don-t-leak-module-refcount-on-failure-to-ac.patch
 Drivers-hv-vmbus-Don-t-leak-channel-ids.patch
-Drivers-hv-vmbus-Don-t-leak-memory-when-a-channel-is.patch
 libceph-don-t-set-weight-to-IN-when-OSD-is-destroyed.patch
 device-dax-fix-pmd-pte-fault-fallback-handling.patch
 drm-bridge-analogix-dp-Fix-runtime-PM-state-on-drive.patch
@@ -125,7 +109,6 @@ metag-ptrace-Provide-default-TXSTATUS-for-short-NT_P.patch
 metag-ptrace-Reject-partial-NT_METAG_RPIPE-writes.patch
 fscrypt-remove-broken-support-for-detecting-keyring-.patch
 sched-rt-Add-a-missing-rescheduling-point.patch
-usb-musb-fix-possible-spinlock-deadlock.patch
 libceph-force-GFP_NOIO-for-socket-allocations.patch
 xen-setup-Don-t-relocate-p2m-over-existing-one.patch
 xfs-only-update-mount-resv-fields-on-success-in-__xf.patch
@@ -164,18 +147,14 @@ ALSA-seq-Fix-race-during-FIFO-resize.patch
 ALSA-hda-fix-a-problem-for-lineout-on-a-Dell-AIO-mac.patch
 ASoC-atmel-classd-fix-audio-clock-rate.patch
 ASoC-Intel-Skylake-fix-invalid-memory-access-due-to-.patch
-HID-wacom-Don-t-add-ghost-interface-as-shared-data.patch
 mmc-sdhci-Disable-runtime-pm-when-the-sdio_irq-is-en.patch
 mmc-sdhci-of-at91-fix-MMC_DDR_52-timing-selection.patch
-NFSv4.1-fix-infinite-loop-on-IO-BAD_STATEID-error.patch
 nfsd-map-the-ENOKEY-to-nfserr_perm-for-avoiding-warn.patch
 parisc-Clean-up-fixup-routines-for-get_user-put_user.patch
-parisc-Avoid-stalled-CPU-warnings-after-system-shutd.patch
 parisc-Fix-access-fault-handling-in-pa_memcpy.patch
 ACPI-Fix-incompatibility-with-mcount-based-function-.patch
 ACPI-Do-not-create-a-platform_device-for-IOAPIC-IOxA.patch
 tty-serial-atmel-fix-race-condition-TX-DMA.patch
-tty-serial-atmel-fix-TX-path-in-atmel_console_write.patch
 USB-fix-linked-list-corruption-in-rh_call_control.patch
 serial-mxs-auart-Fix-baudrate-calculation.patch
 KVM-x86-clear-bus-pointer-when-destroyed.patch
@@ -185,7 +164,6 @@ drm-vc4-Allocate-the-right-amount-of-space-for-boot-.patch
 drm-etnaviv-re-protect-fence-allocation-with-GPU-mut.patch
 x86-mm-KASLR-Exclude-EFI-region-from-KASLR-VA-space-.patch
 x86-mce-Fix-copy-paste-error-in-exception-table-entr.patch
-lib-syscall-Clear-return-values-when-no-stack.patch
 mm-rmap-fix-huge-file-mmap-accounting-in-the-memcg-s.patch
 mm-hugetlb-use-pte_present-instead-of-pmd_present-in.patch
 ARM-BCM5301X-Add-back-handler-ignoring-external-impr.patch
@@ -194,7 +172,6 @@ ARM-dts-BCM5301X-Correct-GIC_PPI-interrupt-flags.patch
 MIPS-Lantiq-Fix-cascaded-IRQ-setup.patch
 mm-workingset-fix-premature-shadow-node-shrinking-wi.patch
 blk-improve-order-of-bio-handling-in-generic_make_re.patch
-blk-Ensure-users-for-current-bio_list-can-see-the-fu.patch
 padata-avoid-race-in-reordering.patch
 nvme-core-Fix-race-kicking-freed-request_queue.patch
 nvme-pci-Disable-on-removal-when-disconnected.patch
diff --git a/queue/tty-serial-atmel-fix-TX-path-in-atmel_console_write.patch b/queue/tty-serial-atmel-fix-TX-path-in-atmel_console_write.patch
deleted file mode 100644
index 6232b35..0000000
--- a/queue/tty-serial-atmel-fix-TX-path-in-atmel_console_write.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 497e1e16f45c70574dc9922c7f75c642c2162119 Mon Sep 17 00:00:00 2001
-From: Nicolas Ferre <nicolas.ferre@microchip.com>
-Date: Mon, 20 Mar 2017 16:38:57 +0100
-Subject: [PATCH] tty/serial: atmel: fix TX path in atmel_console_write()
-
-commit 497e1e16f45c70574dc9922c7f75c642c2162119 upstream.
-
-A side effect of 89d8232411a8 ("tty/serial: atmel_serial: BUG: stop DMA
-from transmitting in stop_tx") is that the console can be called with
-TX path disabled. Then the system would hang trying to push charecters
-out in atmel_console_putchar().
-
-Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
-Fixes: 89d8232411a8 ("tty/serial: atmel_serial: BUG: stop DMA from transmitting
-in stop_tx")
-Cc: stable <stable@vger.kernel.org>	#4.4+
-Acked-by: Richard Genoud <richard.genoud@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 5f644515ed33..1f50a83ef958 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -2488,6 +2488,9 @@ static void atmel_console_write(struct console *co, const char *s, u_int count)
- 	pdc_tx = atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN;
- 	atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS);
- 
-+	/* Make sure that tx path is actually able to send characters */
-+	atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN);
-+
- 	uart_console_write(port, s, count, atmel_console_putchar);
- 
- 	/*
--- 
-2.12.0
-
diff --git a/queue/usb-musb-fix-possible-spinlock-deadlock.patch b/queue/usb-musb-fix-possible-spinlock-deadlock.patch
deleted file mode 100644
index 18a8f4c..0000000
--- a/queue/usb-musb-fix-possible-spinlock-deadlock.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From bc1e2154542071e3cfe1734b143af9b8bdacf8bd Mon Sep 17 00:00:00 2001
-From: Bin Liu <b-liu@ti.com>
-Date: Fri, 10 Mar 2017 14:43:37 -0600
-Subject: [PATCH] usb: musb: fix possible spinlock deadlock
-
-commit bc1e2154542071e3cfe1734b143af9b8bdacf8bd upstream.
-
-The DSPS glue calls del_timer_sync() in its musb_platform_disable()
-implementation, which requires the caller to not hold a lock. But
-musb_remove() calls musb_platform_disable() will musb->lock held. This
-could causes spinlock deadlock.
-
-So change musb_remove() to call musb_platform_disable() without holds
-musb->lock. This doesn't impact the musb_platform_disable implementation
-in other glue drivers.
-
-root@am335x-evm:~# modprobe -r musb-dsps
-[  126.134879] musb-hdrc musb-hdrc.1: remove, state 1
-[  126.140465] usb usb2: USB disconnect, device number 1
-[  126.146178] usb 2-1: USB disconnect, device number 2
-[  126.416985] musb-hdrc musb-hdrc.1: USB bus 2 deregistered
-[  126.423943]
-[  126.425525] ======================================================
-[  126.431997] [ INFO: possible circular locking dependency detected ]
-[  126.438564] 4.11.0-rc1-00003-g1557f13bca04-dirty #77 Not tainted
-[  126.444852] -------------------------------------------------------
-[  126.451414] modprobe/778 is trying to acquire lock:
-[  126.456523]  (((&glue->timer))){+.-...}, at: [<c01b8788>] del_timer_sync+0x0/0xd0
-[  126.464403]
-[  126.464403] but task is already holding lock:
-[  126.470511]  (&(&musb->lock)->rlock){-.-...}, at: [<bf30b7f8>] musb_remove+0x50/0x1
-30 [musb_hdrc]
-[  126.479965]
-[  126.479965] which lock already depends on the new lock.
-[  126.479965]
-[  126.488531]
-[  126.488531] the existing dependency chain (in reverse order) is:
-[  126.496368]
-[  126.496368] -> #1 (&(&musb->lock)->rlock){-.-...}:
-[  126.502968]        otg_timer+0x80/0xec [musb_dsps]
-[  126.507990]        call_timer_fn+0xb4/0x390
-[  126.512372]        expire_timers+0xf0/0x1fc
-[  126.516754]        run_timer_softirq+0x80/0x178
-[  126.521511]        __do_softirq+0xc4/0x554
-[  126.525802]        irq_exit+0xe8/0x158
-[  126.529735]        __handle_domain_irq+0x58/0xb8
-[  126.534583]        __irq_usr+0x54/0x80
-[  126.538507]
-[  126.538507] -> #0 (((&glue->timer))){+.-...}:
-[  126.544636]        del_timer_sync+0x40/0xd0
-[  126.549066]        musb_remove+0x6c/0x130 [musb_hdrc]
-[  126.554370]        platform_drv_remove+0x24/0x3c
-[  126.559206]        device_release_driver_internal+0x14c/0x1e0
-[  126.565225]        bus_remove_device+0xd8/0x108
-[  126.569970]        device_del+0x1e4/0x308
-[  126.574170]        platform_device_del+0x24/0x8c
-[  126.579006]        platform_device_unregister+0xc/0x20
-[  126.584394]        dsps_remove+0x14/0x30 [musb_dsps]
-[  126.589595]        platform_drv_remove+0x24/0x3c
-[  126.594432]        device_release_driver_internal+0x14c/0x1e0
-[  126.600450]        driver_detach+0x38/0x6c
-[  126.604740]        bus_remove_driver+0x4c/0xa0
-[  126.609407]        SyS_delete_module+0x11c/0x1e4
-[  126.614252]        __sys_trace_return+0x0/0x10
-
-Fixes: ea2f35c01d5ea ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
-Cc: <stable@vger.kernel.org> #4.9+
-Acked-by: Tony Lindgren <tony@atomide.com>
-Signed-off-by: Bin Liu <b-liu@ti.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
-index d8bae6ca8904..0c3664ab705e 100644
---- a/drivers/usb/musb/musb_core.c
-+++ b/drivers/usb/musb/musb_core.c
-@@ -2490,8 +2490,8 @@ static int musb_remove(struct platform_device *pdev)
- 	musb_host_cleanup(musb);
- 	musb_gadget_cleanup(musb);
- 
--	spin_lock_irqsave(&musb->lock, flags);
- 	musb_platform_disable(musb);
-+	spin_lock_irqsave(&musb->lock, flags);
- 	musb_disable_interrupts(musb);
- 	musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
- 	spin_unlock_irqrestore(&musb->lock, flags);
--- 
-2.12.0
-
diff --git a/queue/xprtrdma-Squelch-kbuild-sparse-complaint.patch b/queue/xprtrdma-Squelch-kbuild-sparse-complaint.patch
deleted file mode 100644
index 08f41e9..0000000
--- a/queue/xprtrdma-Squelch-kbuild-sparse-complaint.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From eed50879d64ab1b9f76445dbab822e43a098b309 Mon Sep 17 00:00:00 2001
-From: Chuck Lever <chuck.lever@oracle.com>
-Date: Sat, 11 Mar 2017 15:52:47 -0500
-Subject: [PATCH] xprtrdma: Squelch kbuild sparse complaint
-
-commit eed50879d64ab1b9f76445dbab822e43a098b309 upstream.
-
-New complaint from kbuild for 4.9.y:
-
-net/sunrpc/xprtrdma/verbs.c:489:19: sparse: incompatible types in
-    comparison expression (different type sizes)
-
-verbs.c:
-489	max_sge = min(ia->ri_device->attrs.max_sge, RPCRDMA_MAX_SEND_SGES);
-
-I can't reproduce this running sparse here. Likewise, "make W=1
-net/sunrpc/xprtrdma/verbs.o" never indicated any issue.
-
-A little poking suggests that because the range of its values is
-small, gcc can make the actual width of RPCRDMA_MAX_SEND_SGES
-smaller than the width of an unsigned integer.
-
-Fixes: 16f906d66cd7 ("xprtrdma: Reduce required number of send SGEs")
-Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
-Cc: stable@kernel.org
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-
-diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
-index 81cd31acf690..3b332b395045 100644
---- a/net/sunrpc/xprtrdma/verbs.c
-+++ b/net/sunrpc/xprtrdma/verbs.c
-@@ -503,7 +503,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
- 	struct ib_cq *sendcq, *recvcq;
- 	int rc;
- 
--	max_sge = min(ia->ri_device->attrs.max_sge, RPCRDMA_MAX_SEND_SGES);
-+	max_sge = min_t(unsigned int, ia->ri_device->attrs.max_sge,
-+			RPCRDMA_MAX_SEND_SGES);
- 	if (max_sge < RPCRDMA_MIN_SEND_SGES) {
- 		pr_warn("rpcrdma: HCA provides only %d send SGEs\n", max_sge);
- 		return -ENOMEM;
--- 
-2.12.0
-