...and make the user_path callers use that variant instead.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Currently, if we call getname() on a userland string more than once,
we'll get multiple copies of the string and multiple audit_names
records.

Add a function that will allow the audit_names code to satisfy getname
requests using info from the audit_names list, avoiding a new allocation
and audit_names records.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

getname() is intended to copy pathname strings from userspace into a
kernel buffer. The result is just a string in kernel space. It would
however be quite helpful to be able to attach some ancillary info to
the string.

For instance, we could attach some audit-related info to reduce the
amount of audit-related processing needed. When auditing is enabled,
we could also call getname() on the string more than once and not
need to recopy it from userspace.

This patchset converts the getname()/putname() interfaces to return
a struct instead of a string. For now, the struct just tracks the
string in kernel space and the original userland pointer for it.

Later, we'll add other information to the struct as it becomes
convenient.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

I see no callers in module code.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

First, it's incorrect to call putname() after __getname_gfp() since the
bare __getname_gfp() call skips the auditing code, while putname()
doesn't.

mount_block_root allocates a PATH_MAX buffer via __getname_gfp, and then
calls get_fs_names to fill the buffer. That function can call
get_filesystem_list which assumes that that buffer is a full page in
size. On arches where PAGE_SIZE != 4k, then this could potentially
overrun.

In practice, it's hard to imagine the list of filesystem names even
approaching 4k, but it's best to be safe. Just allocate a page for this
purpose instead.

With this, we can also remove the __getname_gfp() definition since there
are no more callers.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

In order to accomodate retrying path-based syscalls, we need to add a
new "type" argument to audit_inode_child. This will tell us whether
we're looking for a child entry that represents a create or a delete.

If we find a parent, don't automatically assume that we need to create a
new entry. Instead, use the information we have to try to find an
existing entry first. Update it if one is found and create a new one if
not.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

In the cases where we already know the length of the parent, pass it as
a parm so we don't need to recompute it. In the cases where we don't
know the length, pass in AUDIT_NAME_FULL (-1) to indicate that it should
be determined.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

All the callers set this to NULL now.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Currently, this gets set mostly by happenstance when we call into
audit_inode_child. While that might be a little more efficient, it seems
wrong. If the syscall ends up failing before audit_inode_child ever gets
called, then you'll have an audit_names record that shows the full path
but has the parent inode info attached.

Fix this by passing in a parent flag when we call audit_inode that gets
set to the value of LOOKUP_PARENT. We can then fix up the pathname for
the audit entry correctly from the get-go.

While we're at it, clean up the no-op macro for audit_inode in the
!CONFIG_AUDITSYSCALL case.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

For now, we just have two possibilities:

UNKNOWN: for a new audit_names record that we don't know anything about yet
NORMAL: for everything else

In later patches, we'll add other types so we can distinguish and update
records created under different circumstances.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Most of the callers get called with an inode and dentry in the reverse
order. The compiler then has to reshuffle the arg registers and/or
stack in order to pass them on to audit_inode_child.

Reverse those arguments for a micro-optimization.

Reported-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

If name is NULL then the condition in the loop will never be true. Also,
with this change, we can eliminate the check for n->name == NULL since
the equivalence check will never be true if it is.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

In some cases, we were passing in NULL even when we have a dentry.

Reported-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

As best I can tell, whenever retval == 0, nd->path.dentry and nd->inode
are also non-NULL. Eliminate those checks and the superfluous
audit_context check.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Pull pile 2 of vfs updates from Al Viro:
 "Stuff in this one - assorted fixes, lglock tidy-up, death to
  lock_super().

  There'll be a VFS pile tomorrow (with patches from Jeff Layton,
  sanitizing getname() and related parts of audit and preparing for
  ESTALE fixes), but I'd rather push the stuff in this one ASAP - some
  of the bugs closed here are quite unpleasant."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  vfs: bogus warnings in fs/namei.c
  consitify do_mount() arguments
  lglock: add DEFINE_STATIC_LGLOCK()
  lglock: make the per_cpu locks static
  lglock: remove unused DEFINE_LGLOCK_LOCKDEP()
  MAX_LFS_FILESIZE definition for 64bit needs LL...
  tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
  vfs: drop lock/unlock super
  ufs: drop lock/unlock super
  sysv: drop lock/unlock super
  hpfs: drop lock/unlock super
  fat: drop lock/unlock super
  ext3: drop lock/unlock super
  exofs: drop lock/unlock super
  dup3: Return an error when oldfd == newfd.
  fs: handle failed audit_log_start properly
  fs: prevent use after free in auditing when symlink following was denied

Pull pile 2 of execve and kernel_thread unification work from Al Viro:
 "Stuff in there: kernel_thread/kernel_execve/sys_execve conversions for
  several more architectures plus assorted signal fixes and cleanups.

  There'll be more (in particular, real fixes for the alpha
  do_notify_resume() irq mess)..."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal: (43 commits)
  alpha: don't open-code trace_report_syscall_{enter,exit}
  Uninclude linux/freezer.h
  m32r: trim masks
  avr32: trim masks
  tile: don't bother with SIGTRAP in setup_frame
  microblaze: don't bother with SIGTRAP in setup_rt_frame()
  mn10300: don't bother with SIGTRAP in setup_frame()
  frv: no need to raise SIGTRAP in setup_frame()
  x86: get rid of duplicate code in case of CONFIG_VM86
  unicore32: remove pointless test
  h8300: trim _TIF_WORK_MASK
  parisc: decide whether to go to slow path (tracesys) based on thread flags
  parisc: don't bother looping in do_signal()
  parisc: fix double restarts
  bury the rest of TIF_IRET
  sanitize tsk_is_polling()
  bury _TIF_RESTORE_SIGMASK
  unicore32: unobfuscate _TIF_WORK_MASK
  mips: NOTIFY_RESUME is not needed in TIF masks
  mips: merge the identical "return from syscall" per-ABI code
  ...

Conflicts:
	arch/arm/include/asm/thread_info.h

Pull writeback fixes from Fengguang Wu:
 "Three trivial writeback fixes"

* 'writeback-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux:
  CPU hotplug, writeback: Don't call writeback_set_ratelimit() too often during hotplug
  writeback: correct comment for move_expired_inodes()
  backing-dev: use kstrto* in preference to simple_strtoul

Pull kbuild misc changes from Michal Marek:
 "In the non-critical part of kbuild, I have
   - Some make coccicheck improvements and two new tests
   - Support for a cleaner html output in scripts/kernel-doc, named
     html5 (no, it does not play videos, yet)

  BTW, Randy wants to route further kernel-doc patches through the
  kbuild tree."

* 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  Update SmPL/Coccinelle section of MAINTAINERS
  coccicheck: Add the rep+ctxt mode
  scripts/coccinelle/tests/odd_ptr_err.cocci: semantic patch for IS_ERR/PTR_ERR inconsistency
  scripts/tags.sh: Add magic for pci access functions
  scripts/coccinelle: ptr_ret: Add ternary operator version
  scripts/kernel-doc: drop maintainer
  scripts/kernel-doc: added support for html5

Pull kconfig changes from Michal Marek:
 "kconfig in v3.7 is going to
   - initialize ncurses only once in menuconfig
   - be able to jump to a search result in menuconfig
   - change the misnomer oldnoconfig to a more meaningful name
     olddefconfig, keeping the old name as alias"

* 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  kconfig: replace 'oldnoconfig' with 'olddefconfig', and keep the old name as an alias
  menuconfig: Assign jump keys per-page instead of globally
  menuconfig: Do not open code textbox scroll up/down
  menuconfig: Add jump keys to search results
  menuconfig: Extend dialog_textbox so that it can return to a scrolled position
  menuconfig: Extend dialog_textbox so that it can exit on arbitrary keypresses
  menuconfig: Remove superfluous conditionnal
  kconfig: document oldnoconfig to what it really does in conf.c
  kconfig/mconf.c: revision of curses initialization.

Pull kbuild changes from Michal Marek:
 "The main part of kbuild for v3.7 contains:
   - Fix for scripts/Makefile.modpost to not choke on a '.ko' substring
     in the build directory path
   - Two warning fixes (modpost and main Makefile)
   - __compiletime_error works also with gcc 4.3
   - make tar{gz,bz2,xz}-pkg uses default compression settings instead
     of saving as many bytes as possible (this should actually be in the
     misc branch, I don't know why I applied it here)."

* 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  compiler-gcc4.h: correct verion check for __compiletime_error
  modpost: Permit .GCC.command.line sections
  Kbuild: use normal compression settings for tar*-pkg
  scripts/Makefile.modpost: error in finding modules from .mod files.
  kbuild: Remove useless warning while appending KCFLAGS

Pull fbdev updates from Florian Tobias Schandinat:
 "This includes:
   - large updates for OMAP
     - basic OMAP5 DSS support for DPI and DSI outputs
     - large cleanups and restructuring
   - some update to Exynos and da8xx-fb
   - removal of the pnx4008 driver (arch removed)
   - various other small patches"

Fix up some trivial conflicts (mostly just include line changes, but
also some due to the renaming of the deferred work functions by Tejun).

* tag 'fbdev-updates-for-3.7' of git://github.com/schandinat/linux-2.6: (193 commits)
  gbefb: fix compile error
  video: mark nuc900fb_map_video_memory as __devinit
  video/mx3fb: set .owner to prevent module unloading while being used
  video: exynos_dp: use clk_prepare_enable and clk_disable_unprepare
  drivers/video/exynos/exynos_mipi_dsi.c: fix error return code
  drivers/video/savage/savagefb_driver.c: fix error return code
  video: s3c-fb: use clk_prepare_enable and clk_disable_unprepare
  da8xx-fb: save and restore LCDC context across suspend/resume cycle
  da8xx-fb: add pm_runtime support
  video/udlfb: fix line counting in fb_write
  OMAPDSS: add missing include for string.h
  OMAPDSS: DISPC: Configure color conversion coefficients for writeback
  OMAPDSS: DISPC: Add manager like functions for writeback
  OMAPDSS: DISPC: Configure writeback FIFOs
  OMAPDSS: DISPC: Configure writeback specific parameters in dispc_wb_setup()
  OMAPDSS: DISPC: Configure overlay-like parameters in dispc_wb_setup
  OMAPDSS: DISPC: Add function to set channel in for writeback
  OMAPDSS: DISPC: Don't set chroma resampling bit for writeback
  OMAPDSS: DISPC: Downscale chroma if plane is writeback
  OMAPDSS: DISPC: Configure input and output sizes for writeback
  ...

Pull v9fs update from Eric Van Hensbergen.

* tag 'for-linus-merge-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9P: Fix race between p9_write_work() and p9_fd_request()
  9P: Fix race in p9_write_work()
  9P: fix test at the end of p9_write_work()
  9P: Fix race in p9_read_work()
  9p: don't use __getname/__putname for uname/aname
  net/9p: Check errno validity
  fs/9p: avoid debug OOPS when reading a long symlink

The follow_link() function always initializes its *p argument,
or returns an error, but when building with 'gcc -s', the compiler
gets confused by the __always_inline attribute to the function
and can no longer detect where the cookie was initialized.

The solution is to always initialize the pointer from follow_link,
even in the error path. When building with -O2, this has zero impact
on generated code and adds a single instruction in the error path
for a -Os build on ARM.

Without this patch, building with gcc-4.6 through gcc-4.8 and
CONFIG_CC_OPTIMIZE_FOR_SIZE results in:

fs/namei.c: In function 'link_path_walk':
fs/namei.c:649:24: warning: 'cookie' may be used uninitialized in this function [-Wuninitialized]
fs/namei.c:1544:9: note: 'cookie' was declared here
fs/namei.c: In function 'path_lookupat':
fs/namei.c:649:24: warning: 'cookie' may be used uninitialized in this function [-Wuninitialized]
fs/namei.c:1934:10: note: 'cookie' was declared here
fs/namei.c: In function 'path_openat':
fs/namei.c:649:24: warning: 'cookie' may be used uninitialized in this function [-Wuninitialized]
fs/namei.c:2899:9: note: 'cookie' was declared here

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

__attribute__((error(msg))) was introduced in gcc 4.3 (not 4.4) and as I
was unable to find any gcc bugs pertaining to it, I'm presuming that it
has functioned as advertised since 4.3.0.

Signed-off-by: Daniel Santos <daniel.santos@pobox.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Allow .GCC.command.line sections in modules to prevent modpost warnings:
WARNING: sound/usb/snd-usbmidi-lib.o (.GCC.command.line): unexpected non-allocatable section.
Did you forget to use "ax"/"aw" in a .S file?
Note that for example <linux/init.h> contains
section definitions for use in .S files.

Signed-off-by: Jonathan Kliegman <kliegs@chromium.org>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Race scenario:

thread A			thread B

p9_write_work()                p9_fd_request()

if (list_empty
  (&m->unsent_req_list))
  ...

                               spin_lock(&client->lock);
                               req->status = REQ_STATUS_UNSENT;
                               list_add_tail(..., &m->unsent_req_list);
                               spin_unlock(&client->lock);
                               ....
                               if (n & POLLOUT &&
                               !test_and_set_bit(Wworksched, &m->wsched)
                               schedule_work(&m->wq);
                               --> not done because Wworksched is set

  clear_bit(Wworksched, &m->wsched);
  return;

--> nobody will take care of sending the new request.

This is not very likely to happen though, because p9_write_work()
being called with an empty unsent_req_list is not frequent.
But this also means that taking the lock earlier will not be costly.

Signed-off-by: Simon Derr <simon.derr@bull.net>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

This patch updates some email addresses and the new
mailing list address.

Signed-off-by: Nicolas Palix <nicolas.palix@imag.fr>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Michal Marek <mmarek@suse.cz>

This adds a 'rep+ctxt' mode which prints the warning
message followed by the context.

Signed-off-by: Nicolas Palix <nicolas.palix@imag.fr>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Pull i2c-embedded changes from Wolfram Sang:
 "The changes for i2c-embedded include:

   - massive rework of the omap driver
   - massive rework of the at91 driver.  In fact, the old driver gets
     removed; I am okay with this approach since the old driver was
     depending on BROKEN and its limitations made it practically
     unusable, so people used bitbanging instead.  But even if there are
     users, there is no platform_data or module parameter which would
     need to be converted.  It is just another driver doing I2C
     transfers, just way better.  Modifications of arch/arm/at91 related
     files have proper acks from the maintainer.
   - new driver for R-Car I2C
   - devicetree and generic_clock conversions and fixes
   - usual driver fixes and changes.

  The rework patches have come a long way and lots of people have been
  involved in creating/testing them.  Most patches have been in
  linux-next at least since 3.6-rc5.  A few have been added in the last
  week, I have to admit.

  An unexpected (but welcome :)) peak in private life is the cause for
  that.  The "late" patches shouldn't cause any merge conflicts and I
  will have a special eye on them during the stabilization phase.  This
  is an exception and I want to have the patches in place properly in
  time again for the next kernels."

* 'i2c-embedded/for-next' of git://git.pengutronix.de/git/wsa/linux: (44 commits)
  MXS: Implement DMA support into mxs-i2c
  i2c: add Renesas R-Car I2C driver
  i2c: s3c2410: use clk_prepare_enable and clk_disable_unprepare
  ARM: OMAP: convert I2C driver to PM QoS for MPU latency constraints
  i2c: nomadik: Add Device Tree support to the Nomadik I2C driver
  i2c: algo: pca: Fix chip reset function for PCA9665
  i2c: mpc: Wait for STOP to hit the bus
  i2c: davinci: preparation for switch to common clock framework
  omap-i2c: fix incorrect log message when using a device tree
  i2c: omap: sanitize exit path
  i2c: omap: switch over to autosuspend API
  i2c: omap: remove unnecessary pm_runtime_suspended check
  i2c: omap: switch to threaded IRQ support
  i2c: omap: remove redundant status read
  i2c: omap: get rid of the "complete" label
  i2c: omap: resize fifos before each message
  i2c: omap: simplify IRQ exit path
  i2c: omap: always return IRQ_HANDLED
  i2c: omap: simplify errata check
  i2c: omap: bus: add a receiver flag
  ...

Pull ARM SoC fixes from Olof Johansson:
 "A series of fixes (and in some cases, some cleanups):

  Via Tony Lindgren:
   - A collection of OMAP regression fixes, in particular because
     firmware no longer sets up all pin states before starting the
     kernel.
   - cpufreq fixes for OMAP (Rafael is on vacation and this was
     pre-agreed).
   - A longer series of misc regression fixes and cleanups, warning
     removals, etc for OMAP

  From Arnd Bergmann:
   - A series of warning fixes for various platforms (defconfig builds)

  Misc:
   - A couple of tegra fixes, one for i.MX, some vt8500 fixes, etc."

* tag 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (73 commits)
  ARM: pxa: armcore: fix PCI PIO warnings
  ARM: integrator: use __iomem pointers for MMIO, part 2
  ARM: assabet: fix bogus warning in get_assabet_scr (again)
  ARM: shmobile: mark shmobile_init_late as __init
  ARM: integrator_cp: fix build failure
  ARM: OMAP4/AM335x: hwmod: fix disable_module regression in hardreset handling
  ARM: OMAP3: fix workaround for EMU clockdomain
  arm/omap: Replace board_ref_clock with enum values
  ARM: OMAP2+: remove duplicated include from board-omap3stalker.c
  arch/arm/plat-omap/omap-pm-noop.c: Remove unecessary semicolon
  arch/arm/mach-omap2: Remove unecessary semicolon
  arch/arm/mach-omap1/devices.c: Remove unecessary semicolon
  ARM/dts: omap5-evm: pinmux configuration for audio
  ARM/dts: Add pinctrl driver entries for omap5
  ARM/dts: omap4-panda: pinmux configuration for audio
  ARM/dts: omap4-sdp: pinmux configuration for audio
  ARM/dts: omap5-evm: Disable unused McBSP3
  ARM/dts: omap4-sdp: Disable unused McBSP3
  ARM/dts: omap4-panda: Disable unused audio IPs
  ARM: OMAP: board-omap4panda: Pin mux configuration for audio needs
  ...

In autofs4_d_automount(), if a mount fail occurs the AUTOFS_INF_PENDING
mount pending flag is not cleared.

One effect of this is when using the "browse" option, directory entry
attributes show up with all "?"s due to the incorrect callback and
subsequent failure return (when in fact no callback should be made).

Signed-off-by: Ian Kent <ikent@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge misc fixes from Andrew Morton:
 "Followups, fixes and some random stuff I found on the internet."

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (11 patches)
  perf: fix duplicate header inclusion
  memcg, kmem: fix build error when CONFIG_INET is disabled
  rtc: kconfig: fix RTC_INTF defaults connected to RTC_CLASS
  rapidio: fix comment
  lib/kasprintf.c: use kmalloc_track_caller() to get accurate traces for kvasprintf
  rapidio: update for destination ID allocation
  rapidio: update asynchronous discovery initialization
  rapidio: use msleep in discovery wait
  mm: compaction: fix bit ranges in {get,clear,set}_pageblock_skip()
  arch/powerpc/platforms/pseries/hotplug-memory.c: section removal cleanups
  arch/powerpc/platforms/pseries/hotplug-memory.c: fix section handling code

The patch "drivers/video/gbefb.c: use devm_ functions" caused a
compile error.

drivers/video/gbefb.c:1159:16: error: implicit declaration of function
'devm_ioremap' [-Werror=implicit-function-declaration]
drivers/video/gbefb.c:1179:3: error: implicit declaration of function
'devm_ioremap_nocache' [-Werror=implicit-function-declaration]

Fix it by including linux/io.h which defines those functions.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Damien Cassou <damien.cassou@lifl.fr>

Pull block IO update from Jens Axboe:
 "Core block IO bits for 3.7.  Not a huge round this time, it contains:

   - First series from Kent cleaning up and generalizing bio allocation
     and freeing.

   - WRITE_SAME support from Martin.

   - Mikulas patches to prevent O_DIRECT crashes when someone changes
     the block size of a device.

   - Make bio_split() work on data-less bio's (like trim/discards).

   - A few other minor fixups."

Fixed up silent semantic mis-merge as per Mikulas Patocka and Andrew
Morton.  It is due to the VM no longer using a prio-tree (see commit
6b2dbba8: "mm: replace vma prio_tree with an interval tree").

So make set_blocksize() use mapping_mapped() instead of open-coding the
internal VM knowledge that has changed.

* 'for-3.7/core' of git://git.kernel.dk/linux-block: (26 commits)
  block: makes bio_split support bio without data
  scatterlist: refactor the sg_nents
  scatterlist: add sg_nents
  fs: fix in...

Pull a firewire fix from Stefan Richter:
 "Fixes an old bug of the /dev/fw* ioctl ABI."

* tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel)

Pull vfio fixes from Alex Williamson:
 "This includes a fix for PCI BAR mmaps after recent mm changes, fixing
  an interrupt race, and fixing a consistency bug in interrupt state
  when switching interrupt modes."

* tag 'vfio-for-v3.7-rc1' of git://github.com/awilliam/linux-vfio:
  vfio: Fix PCI INTx disable consistency
  vfio: Move PCI INTx eventfd setting earlier
  vfio: Fix PCI mmap after b3b9c293