Pull btrfs fixes from Chris Mason:
 "We have a small collection of fixes in my for-linus branch.

  The big thing that stands out is a revert of a new ioctl.  Users
  haven't shipped yet in btrfs-progs, and Dave Sterba found a better way
  to export the information"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: use right clone root offset for compressed extents
  btrfs: fix null pointer deference at btrfs_sysfs_add_one+0x105
  Btrfs: unset DCACHE_DISCONNECTED when mounting default subvol
  Btrfs: fix max_inline mount option
  Btrfs: fix a lockdep warning when cleaning up aborted transaction
  Revert "btrfs: add ioctl to export size of global metadata reservation"

Pull char/misc fixes from Greg KH:
 "Here are some small char/misc driver fixes, along with some
  documentation updates, for 3.14-rc3.  Nothing major, just a number of
  fixes for reported issues"

* tag 'char-misc-3.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  Revert "misc: eeprom: sunxi: Add new compatibles"
  Revert "ARM: sunxi: dt: Convert to the new SID compatibles"
  misc: mic: fix possible signed underflow (undefined behavior) in userspace API
  ARM: sunxi: dt: Convert to the new SID compatibles
  misc: eeprom: sunxi: Add new compatibles
  misc: genwqe: Fix potential memory leak when pinning memory
  Documentation:Update Documentation/zh_CN/arm64/memory.txt
  Documentation:Update Documentation/zh_CN/arm64/booting.txt
  Documentation:Chinese translation of Documentation/arm64/tagged-pointers.txt
  raw: set range for MAX_RAW_DEVS
  raw: test against runtime value of max_raw_minors
  Drivers: hv: vmbus: Don't timeout during the initial connection with host
  Drivers: hv: vmbus: Specify the target CPU that should receive notification
  VME: Correct read/write alignment algorithm
  mei: don't unset read cb ptr on reset
  mei: clear write cb from waiting list on reset

This reverts commit 01e219e8069516cdb98594d417b8bb8d906ed30d.

David Sterba found a different way to provide these features without adding a new
ioctl.  We haven't released any progs with this ioctl yet, so I'm taking this out
for now until we finalize things.

Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
CC: Jeff Mahoney <jeffm@suse.com>

Pull Xen bugfixes from Konrad Rzeszutek Wilk:
 "This has an healthy amount of code being removed - which we do not use
  anymore (the only user of it was ia64 Xen which had been removed
  already).  The other bug-fixes are to make Xen ARM be able to use the
  new event channel mechanism and proper export of header files to
  user-space.

  Summary:
   - Fix ARM and Xen FIFO not working.
   - Remove more Xen ia64 vestigates.
   - Fix UAPI missing Xen files"

* tag 'stable/for-linus-3.14-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  ia64/xen: Remove Xen support for ia64 even more
  xen: install xen/gntdev.h and xen/gntalloc.h
  xen/events: bind all new interdomain events to VCPU0

Pull networking updates from David Miller:

 1) Fix flexcan build on big endian, from Arnd Bergmann

 2) Correctly attach cpsw to GPIO bitbang MDIO drive, from Stefan Roese

 3) udp_add_offload has to use GFP_ATOMIC since it can be invoked from
    non-sleepable contexts.  From Or Gerlitz

 4) vxlan_gro_receive() does not iterate over all possible flows
    properly, fix also from Or Gerlitz

 5) CAN core doesn't use a proper SKB destructor when it hooks up
    sockets to SKBs.  Fix from Oliver Hartkopp

 6) ip_tunnel_xmit() can use an uninitialized route pointer, fix from
    Eric Dumazet

 7) Fix address family assignment in IPVS, from Michal Kubecek

 8) Fix ath9k build on ARM, from Sujith Manoharan

 9) Make sure fail_over_mac only applies for the correct bonding modes,
    from Ding Tianhong

10) The udp offload code doesn't use RCU correctly, from Shlomo Pongratz

11) Handle gigabit features properly in generic PHY code, from Florian
    Fainelli

12) Don't blindly invoke link operations in
    rtnl_link_get_slave_info_data_size, they are optional.  Fix from
    Fernando Luis Vazquez Cao

13) Add USB IDs for Netgear Aircard 340U, from Bjørn Mork

14) Handle netlink packet padding properly in openvswitch, from Thomas
    Graf

15) Fix oops when deleting chains in nf_tables, from Patrick McHardy

16) Fix RX stalls in xen-netback driver, from Zoltan Kiss

17) Fix deadlock in mac80211 stack, from Emmanuel Grumbach

18) inet_nlmsg_size() forgets to consider ifa_cacheinfo, fix from Geert
    Uytterhoeven

19) tg3_change_mtu() can deadlock, fix from Nithin Sujir

20) Fix regression in setting SCTP local source addresses on accepted
    sockets, caused by some generic ipv6 socket changes.  Fix from
    Matija Glavinic Pecotic

21) IPPROTO_* must be pure defines, otherwise module aliases don't get
    constructed properly.  Fix from Jan Moskyto

22) IPV6 netconsole setup doesn't work properly unless an explicit
    source address is specified, fix from Sabrina Dubroca

23) Use __GFP_NORETRY for high order skb page allocations in
    sock_alloc_send_pskb and skb_page_frag_refill.  From Eric Dumazet

24) Fix a regression added in netconsole over bridging, from Cong Wang

25) TCP uses an artificial offset of 1ms for SRTT, but this doesn't jive
    well with TCP pacing which needs the SRTT to be accurate.  Fix from
    Eric Dumazet

26) Several cases of missing header file includes from Rashika Kheria

27) Add ZTE MF667 device ID to qmi_wwan driver, from Raymond Wanyoike

28) TCP Small Queues doesn't handle nonagle properly in some corner
    cases, fix from Eric Dumazet

29) Remove extraneous read_unlock in bond_enslave, whoops.  From Ding
    Tianhong

30) Fix 9p trans_virtio handling of vmalloc buffers, from Richard Yao

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (136 commits)
  6lowpan: fix lockdep splats
  alx: add missing stats_lock spinlock init
  9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers
  bonding: remove unwanted bond lock for enslave processing
  USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support
  tcp: tsq: fix nonagle handling
  bridge: Prevent possible race condition in br_fdb_change_mac_address
  bridge: Properly check if local fdb entry can be deleted when deleting vlan
  bridge: Properly check if local fdb entry can be deleted in br_fdb_delete_by_port
  bridge: Properly check if local fdb entry can be deleted in br_fdb_change_mac_address
  bridge: Fix the way to check if a local fdb entry can be deleted
  bridge: Change local fdb entries whenever mac address of bridge device changes
  bridge: Fix the way to find old local fdb entries in br_fdb_change_mac_address
  bridge: Fix the way to insert new local fdb entries in br_fdb_changeaddr
  bridge: Fix the way to find old local fdb entries in br_fdb_changeaddr
  tcp: correct code comment stating 3 min timeout for FIN_WAIT2, we only do 1 min
  net: vxge: Remove unused device pointer
  net: qmi_wwan: add ZTE MF667
  3c59x: Remove unused pointer in vortex_eisa_cleanup()
  net: fix 'ip rule' iif/oif device rename
  ...

xen/gntdev.h and xen/gntalloc.h both provide userspace ABIs so they
should be installed.

CC: stable@vger.kernel.org
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

iovcnt is declared as a signed integer in both the userspace API and
as a local variable in mic_virtio.c. The while() loop in mic_virtio.c
iterates until the local variable iovcnt reaches the value 0. If
userspace passes e.g. INT_MIN as iovcnt field, this loop then appears
to depend on an undefined behavior (signed underflow) to complete.
The fix is to use unsigned integers in both the userspace API and
the local variable.

This issue was reported @ https://lkml.org/lkml/2014/1/10/10

Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Sudeep Dutt <sudeep.dutt@intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit cfd280c91253 ("net: sync some IP headers with glibc") changed a set of
define's to an enum (with no explanation why) which introduced a bug
in module mip6 where aliases are generated using the IPPROTO_* defines;
mip6 doesn't load if require_module called with the aliases from
xfrm_get_type().

Reverting this change back to define's to fix the aliases.

modinfo mip6 (before this change)
alias:          xfrm-type-10-IPPROTO_DSTOPTS
alias:          xfrm-type-10-IPPROTO_ROUTING

modinfo mip6 (after this change)
alias:          xfrm-type-10-43
alias:          xfrm-type-10-60

Signed-off-by: Jan Moskyto Matejka <mq@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull NVMe driver update from Matthew Wilcox:
 "Looks like I missed the merge window ...  but these are almost all
  bugfixes anyway (the ones that aren't have been baking for months)"

* git://git.infradead.org/users/willy/linux-nvme:
  NVMe: Namespace use after free on surprise removal
  NVMe: Correct uses of INIT_WORK
  NVMe: Include device and queue numbers in interrupt name
  NVMe: Add a pci_driver shutdown method
  NVMe: Disable admin queue on init failure
  NVMe: Dynamically allocate partition numbers
  NVMe: Async IO queue deletion
  NVMe: Surprise removal handling
  NVMe: Abort timed out commands
  NVMe: Schedule reset for failed controllers
  NVMe: Device resume error handling
  NVMe: Cache dev->pci_dev in a local pointer
  NVMe: Fix lockdep warnings
  NVMe: compat SG_IO ioctl
  NVMe: remove deprecated IRQF_DISABLED
  NVMe: Avoid shift operation when writing cq head doorbell

Pull media updates from Mauro Carvalho Chehab:
 - a new jpeg codec driver for Samsung Exynos (jpeg-hw-exynos4)
 - a new dvb frontend for ds2103 chipset (m88ds2103)
 - a new sensor driver for Samsung S5K5BAF UXGA (s5k5baf)
 - new drivers for R-Car VSP1
 - a new radio driver: radio-raremono
 - a new tuner driver for ts2022 chipset (m88ts2022)
 - the analog part of em28xx is now a separate module that only
   load/runs if the device is not a pure digital TV device
 - added a staging driver for bcm2048 radio devices
 - the omap 2 video driver (omap24xx) was moved to staging.  This driver
   is for an old hardware and uses a deprecated Kernel internal API.  If
   nobody cares enough to fix it, it would be removed on a couple Kernel
   releases
 - the sn9c102 driver was moved to staging.  This driver was replaced by
   gspca, and disabled on some distros, as almost all devices are known
   to work properly with gspca.  It should be removed from kernel on a
   couple Kernel releases
 - lots of driver fixes, improvements and cleanups

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (421 commits)
  [media] media: v4l2-dev: fix video device index assignment
  [media] rc-core: reuse device numbers
  [media] em28xx-cards: properly initialize the device bitmap
  [media] Staging: media: Fix line length exceeding 80 characters in as102_drv.c
  [media] Staging: media: Fix line length exceeding 80 characters in as102_fe.c
  [media] Staging: media: Fix quoted string split across line in as102_fe.c
  [media] media: st-rc: Add reset support
  [media] m2m-deinterlace: fix allocated struct type
  [media] radio-usb-si4713: fix sparse non static symbol warnings
  [media] em28xx-audio: remove needless check before usb_free_coherent()
  [media] au0828: Fix sparse non static symbol warning
  Revert "[media] go7007-usb: only use go->dev after allocated"
  [media] em28xx-audio: provide an error code when URB submit fails
  [media] em28xx: fix check for audio only usb interfaces when changing the usb alternate setting
  [media] em28xx: fix usb alternate setting for analog and digital video endpoints > 0
  [media] em28xx: make 'em28xx_ctrl_ops' static
  em28xx-alsa: Fix error patch for init/fini
  [media] em28xx-audio: flush work at .fini
  [media] drxk: remove the option to load firmware asynchronously
  [media] em28xx: adjust period size at runtime
  ...