Minchan Kim reports that when a system has many swap areas, and tmpfs
swaps out to the ninth or more, shmem_getpage_gfp()'s attempts to read
back the page cannot locate it, and the read fails with -ENOMEM.

Whoops.  Yes, I blindly followed read_swap_header()'s pte_to_swp_entry(
swp_entry_to_pte()) technique for determining maximum usable swap
offset, without stopping to realize that that actually depends upon the
pte swap encoding shifting swap offset to the higher bits and truncating
it there.  Whereas our radix_tree swap encoding leaves offset in the
lower bits: it's swap "type" (that is, index of swap area) that was
truncated.

Fix it by reducing the SWP_TYPE_SHIFT() in swapops.h, and removing the
broken radix_to_swp_entry(swp_to_radix_entry()) from read_swap_header().

This does not reduce the usable size of a swap area any further, it
leaves it as claimed when making the original commit: no change from 3.0
on x86_64, nor on i386 without PAE; but 3.0's 512GB is reduced to 128GB
per swapfile on i386 with PAE.  It's not a change I would have risked
five years ago, but with x86_64 supported for ten years, I believe it's
appropriate now.

Hmm, and what if some architecture implements its swap pte with offset
encoded below type? That would equally break the maximum usable swap
offset check.  Happily, they all follow the same tradition of encoding
offset above type, but I'll prepare a check on that for next.

Reported-and-Reviewed-and-Tested-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org [3.1, 3.2, 3.3, 3.4]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull NFS client bugfixes from Trond Myklebust:
 "Highlights include:

   - Fix a couple of mount regressions due to the recent cleanups.
   - Fix an Oops in the open recovery code
   - Fix an rpc_pipefs upcall hang that results from some of the net
     namespace work from 3.4.x (stable kernel candidate).
   - Fix a couple of write and o_direct regressions that were found at
     last weeks Bakeathon testing event in Ann Arbor."

* tag 'nfs-for-3.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS: add an endian notation for sparse
  NFSv4.1: integer overflow in decode_cb_sequence_args()
  rpc_pipefs: allow rpc_purge_list to take a NULL waitq pointer
  NFSv4 do not send an empty SETATTR compound
  NFSv2: EOF incorrectly set on short read
  NFS: Use the NFS_DEFAULT_VERSION for v2 and v3 mounts
  NFS: fix directio refcount bug on commit
  NFSv4: Fix unnecessary delegation returns in nfs4_do_open
  NFSv4.1: Convert another trivial printk into a dprintk
  NFS4: Fix open bug when pnfs module blacklisted
  NFS: Remove incorrect BUG_ON in nfs_found_client
  NFS: Map minor mismatch error to protocol not support error.
  NFS: Fix a commit bug
  NFS4: Set parsed mount data version to 4
  NFSv4.1: Ensure we clear session state flags after a session creation
  NFSv4.1: Convert a trivial printk into a dprintk
  NFSv4: Fix up decode_attr_mdsthreshold
  NFSv4: Fix an Oops in the open recovery code
  NFSv4.1: Fix a request leak on the back channel

Pull USB fixes from Greg Kroah-Hartman:
 "Here are a bunch of tiny fixes for the USB core and drivers for
  3.5-rc3

  A bunch of gadget fixes, and new device ids, as well as some fixes for
  a number of different regressions that have been reported recently.
  We also fixed some PCI host controllers to resolve a long-standing bug
  with a whole class of host controllers that have been plaguing people
  for a number of kernel releases, preventing their systems from
  suspending properly.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'usb-3.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (41 commits)
  USB: fix gathering of interface associations
  usb: ehci-sh: fix illegal phy_init() running when platform_data is NULL
  usb: cdc-acm: fix devices not unthrottled on open
  Fix OMAP EHCI suspend/resume failure (i693)
  USB: ohci-hub: Mark ohci_finish_controller_resume() as __maybe_unused
  usb: use usb_serial_put in usb_serial_probe errors
  USB: EHCI: Fix build warning in xilinx ehci driver
  USB: fix PS3 EHCI systems
  xHCI: Increase the timeout for controller save/restore state operation
  xhci: Don't free endpoints in xhci_mem_cleanup()
  xhci: Fix invalid loop check in xhci_free_tt_info()
  xhci: Fix error path return value.
  USB: Checking the wrong variable in usb_disable_lpm()
  usb-storage: Add 090c:1000 to unusal-devs
  USB: serial-generic: use a single set of device IDs
  USB: serial: Enforce USB driver and USB serial driver match
  USB: add NO_D3_DURING_SLEEP flag and revert 151b61284776be2
  USB: option: add more YUGA device ids
  USB: mos7840: Fix compilation of usb serial driver
  USB: option: fix memory leak
  ...

Pull core updates (RCU and locking) from Ingo Molnar:
 "Most of the diffstat comes from the RCU slow boot regression fixes,
  but there's also a debuggability improvements/fixes."

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  memblock: Document memblock_is_region_{memory,reserved}()
  rcu: Precompute RCU_FAST_NO_HZ timer offsets
  rcu: Move RCU_FAST_NO_HZ per-CPU variables to rcu_dynticks structure
  rcu: Update RCU_FAST_NO_HZ tracing for lazy callbacks
  rcu: RCU_FAST_NO_HZ detection of callback adoption
  spinlock: Indicate that a lockup is only suspected
  kdump: Execute kmsg_dump(KMSG_DUMP_PANIC) after smp_send_stop()
  panic: Make panic_on_oops configurable

Pull target updates from Nicholas Bellinger:
 "This series contains post merge qla_target.c / tcm_qla2xxx bugfixes
  from the past weeks, including the patch to allow target-core to use
  an optional session shutdown callback to help address an active I/O
  shutdown bug in tcm_qla2xxx code (Joern).

  Also included is a target regression bugfix releated to explict ALUA
  target port group CDB emulation that is CC'ed to stable (Roland)."

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  qla2xxx: Remove version.h header file inclusion
  tcm_qla2xxx: Handle malformed wwn strings properly
  tcm_qla2xxx: tcm_qla2xxx_handle_tmr() can be static
  qla2xxx: Don't leak commands we give up on in qlt_do_work()
  qla2xxx: Don't crash if we can't find cmd for failed CTIO
  tcm_qla2xxx: Don't insert nacls without sessions into the btree
  target: Return error to initiator if SET TARGET PORT GROUPS emulation fails
  tcm_qla2xxx: Clear session s_id + loop_id earlier during shutdown
  tcm_qla2xxx: Convert to TFO->put_session() usage
  target: Add TFO->put_session() caller for HW fabric session shutdown

Pull sound fixes from Takashi Iwai:

 - Fix a regression of USB-audio PCM assignment since 3.4
 - A few VGA-switcheroo-related fixes for proper HDMI audio enablement
 - Fixed the missing initializations of HD-audio verbs, which may have
   resulted in various breakage
 - Some driver-specific ASoC updates
 - A few fixes for the dynamic PCM code
 - The addition of pinctrl support for the i.MX audmux which didn't make
   it into -rc1 due to cross tree dependency issues
 - A few minor fixes in compress API codes

* tag 'sound-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - Don't forget to call init verbs added by fixup list
  ALSA: HDA: Pin fixup for Zotac Z68 motherboard
  ALSA: compress_core: cleanup pointers on stop
  ALSA: compress_core: don't wake up on pause
  ALSA: hda - Fix detection of Creative SoundCore3D controllers
  vga_switcheroo: Enable/disable audio clients at the right time
  ALSA: hda - HDMI Audio init all connectors when VGA-switcheroo is off
  vga_switcheroo: Fix error without CONFIG_VGA_SWITCHEROO
  ALSA: hda - Fix uninitialized HDMI controllers with VGA-switcheroo
  vga_switcheroo: Add a helper function to get the client state
  ALSA: usb-audio: Fix substream assignments
  ASoC: tegra: add MODULE_DEVICE_TABLE to tegra30_ahub
  ASoC: wm2000: Always use a 4s timeout for the firmware
  ASoC: dapm: Fix input list to use source widgets
  ASoC: dpcm: Fix dpcm_get_be() to check that DAI is BE
  ASoC: wm8994: Apply volume updates with clocks enabled
  ASoC: wm8994: Ensure all AIFnCLK events are run from the _late variants
  ASoC: imx-audmux: add pinctrl support
  ASoC: dapm: Fix connected widget capture path query.

Pull networking fixes from David S. Miller:

This has the fix for the wireless issues I ran into the other week as
well as:

 1) Fix CAN c_can driver transmit handling resulting in BUG check
    triggers, from AnilKumar Ch.

 2) Fix packet drop monitor sleeping in atomic context, from Eric
    Dumazet.

 3) Fix mv643xx_eth driver build regression, from Andrew Lunn.

 4) Inetpeer freeing needs an RCU grace period in order to avoid races
    during tree invalidation.  From Eric Dumazet.

 5) Fix endianness bugs in xt_HMARK netfilter module, from Hans
    Schillstrom.

 6) Add proper module refcounting to l2tp_eth to avoid crash on module
    unload, from Eric Dumazet.

 7) Fix truncation of neighbour entry dumps due to logic errors in
    neigh_dump_info() and friends, from Eric Dumazet.

 8) The conversion of fib6_age() to dst_neigh_lookup() accidently
    reversed the logic of a flags test, fix from Thomas Graf.

 9) Fix checksum configuration in newer sky2 chips, from Stephen
    Hemminger.

10) Revert BQL support in NIU driver, doesn't work.

11) l2tp_ip_sendmsg() illegally uses a route without a proper reference.
    From Eric Dumazet.

12) be2net driver references an SKB after it's potentially been freed,
    also from Eric Dumazet.

13) Fix RCU stalls in dummy net driver init.  Also from Eric Dumazet.

14) lpc_eth has several bugs in it's transmit engine leading to packet
    leaks and improper queue wakes, from Eric Dumazet.

15) Apply short DMA workaround to more tg3 chips, from Matt Carlson.

16) Add tilegx network driver.

17) Bonding queue mapping for a packet can get corrupted, fix from Eric
    Dumazet.

18) Fix bug in netpoll_send_udp() SKB management that can leave garbage
    in the payload in certain situations.  From Eric Dumazet.

19) bnx2x driver interprets chip RX checksum offload incorrectly in
    encapsulation situations.  Fix from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (75 commits)
  bnx2x: fix checksum validation
  netpoll: fix netpoll_send_udp() bugs
  bonding: Fix corrupted queue_mapping
  bonding:record primary when modify it via sysfs
  tilegx network driver: initial support
  tg3: Apply short DMA frag workaround to 5906
  net: stmmac: Fix clock en-/disable calls
  lpc_eth: fix tx completion
  lpc_eth: add missing ndo_change_mtu()
  dummy: fix rcu_sched self-detected stalls
  net: Reorder initialization in ip_route_output to fix gcc warning
  virtio-net: fix a race on 32bit arches
  r8169: avoid NAPI scheduling delay.
  net: Make linux/tcp.h C++ friendly (trivial)
  netdev: fix drivers/net/phy/ kernel-doc warnings
  net/core: fix kernel-doc warnings
  be2net: fix a race in be_xmit()
  l2tp: fix a race in l2tp_ip_sendmsg()
  mac80211: add back channel change flag
  NFC: Fix possible NULL ptr deref when getting the name of a socket
  ...

This patch (as1558) fixes a problem affecting several ASUS computers:
The machine crashes or corrupts memory when going into suspend if the
ehci-hcd driver is bound to any controllers.  Users have been forced
to unbind or unload ehci-hcd before putting their systems to sleep.

After extensive testing, it was determined that the machines don't
like going into suspend when any EHCI controllers are in the PCI D3
power state.  Presumably this is a firmware bug, but there's nothing
we can do about it except to avoid putting the controllers in D3
during system sleep.

The patch adds a new flag to indicate whether the problem is present,
and avoids changing the controller's power state if the flag is set.
Runtime suspend is unaffected; this matters only for system suspend.
However as a side effect, the controller will not respond to remote
wakeup requests while the system is asleep.  Hence USB wakeup is not
functional -- but of course, this is already true in the current state
of affairs.

A similar patch has already been applied as commit
151b61284776be2d6f02d48c23c3625678960b97 (USB: EHCI: fix crash during
suspend on ASUS computers).  The patch supersedes that one and reverts
it.  There are two differences:

	The old patch added the flag at the USB level; this patch
	adds it at the PCI level.

	The old patch applied to all chipsets with the same vendor,
	subsystem vendor, and product IDs; this patch makes an
	exception for a known-good system (based on DMI information).

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Dâniel Fraga <fragabr@gmail.com>
Tested-by: Andrey Rahmatullin <wrar@wrar.name>
Tested-by: Steven Rostedt <rostedt@goodmis.org>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds an optional target_core_fabric_ops->put_session() caller
within the existing target_put_session() code path.

This is required by tcm_qla2xxx code in order to invoke it's own fabric
specific session shutdown handler using se_session->sess_kref.

Signed-off-by: Joern Engel <joern@logfs.org>
Cc: Roland Dreier <roland@purestorage.com>
Cc: Arun Easi <arun.easi@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>