Pull device-mapper updates from Alasdair Kergon:
 "Allow devices that hold metadata for the device-mapper thin
  provisioning target to be extended easily; allow WRITE SAME on
  multipath devices; an assortment of little fixes and clean-ups."

* tag 'dm-3.10-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm: (21 commits)
  dm cache: set config value
  dm cache: move config fns
  dm thin: generate event when metadata threshold passed
  dm persistent metadata: add space map threshold callback
  dm persistent data: add threshold callback to space map
  dm thin: detect metadata device resizing
  dm persistent data: support space map resizing
  dm thin: open dev read only when possible
  dm thin: refactor data dev resize
  dm cache: replace memcpy with struct assignment
  dm cache: fix typos in comments
  dm cache policy: fix description of lookup fn
  dm: document iterate_devices
  dm persistent data: fix error message typos
  dm cache: tune migration throttling
  dm mpath: enable WRITE SAME support
  dm table: fix write same support
  dm bufio: avoid a possible __vmalloc deadlock
  dm snapshot: fix error return code in snapshot_ctr
  dm cache: fix error return code in cache_create
  ...

Pull HID fixes from Jiri Kosina:

 - fix usage of sleeping lock in atomic context from Jiri Kosina

 - build fix for hid-steelseries under certain .config setups by Simon Wood

 - simple mismerge fix from Fernando Luis Vázquez Cao

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: debug: fix RCU preemption issue
  HID: hid-steelseries fix led class build issue
  HID: reintroduce fix-up for certain Sony RF receivers

Pull sound fixes from Takashi Iwai:
 "This contains small fixes since the previous pull request:

   - A few regression fixes and small updates of HD-audio

   - Yet another fix for Haswell HDMI audio

   - A copule of trivial fixes in ASoC McASP, DPAM and WM8994"

* tag 'sound-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  Revert "ALSA: hda - Don't set up active streams twice"
  ALSA: Add comment for control TLV API
  ALSA: hda - Apply pin-enablement workaround to all Haswell HDMI codecs
  ALSA: HDA: Fix Oops caused by dereference NULL pointer
  ALSA: mips/sgio2audio: Remove redundant platform_set_drvdata()
  ALSA: mips/hal2: Remove redundant platform_set_drvdata()
  ALSA: hda - Fix 3.9 regression of EAPD init on Conexant codecs
  sound: Fix make allmodconfig on MIPS
  ALSA: hda - Fix system panic when DMA > 40 bits for Nvidia audio controllers
  ALSA: atmel: Remove redundant platform_set_drvdata()
  ASoC: McASP: Fix receive clock polarity in DAIFMT_NB_NF mode.
  ASoC: wm8994: missing break in wm8994_aif3_hw_params()
  ASoC: McASP: Add pins output direction for rx clocks when configured in CBS_CFS format
  ASoC: dapm: use clk_prepare_enable and clk_disable_unprepare

Pull MIPS updates from Ralf Baechle:

 - More work on DT support for various platforms

 - Various fixes that were to late to make it straight into 3.9

 - Improved platform support, in particular the Netlogic XLR and
   BCM63xx, and the SEAD3 and Malta eval boards.

 - Support for several Ralink SOC families.

 - Complete support for the microMIPS ASE which basically reencodes the
   existing MIPS32/MIPS64 ISA to use non-constant size instructions.

 - Some fallout from LTO work which remove old cruft and will generally
   make the MIPS kernel easier to maintain and resistant to compiler
   optimization, even in absence of LTO.

 - KVM support.  While MIPS has announced hardware virtualization
   extensions this KVM extension uses trap and emulate mode for
   virtualization of MIPS32.  More KVM work to add support for VZ
   hardware virtualizaiton extensions and MIPS64 will probably already
   be merged for 3.11.

Most of this has been sitting in -next for a long time.  All defconfigs
have been build or run time tested except three for which fixes are being
sent by other maintainers.

Semantic conflict with kvm updates done as per Ralf

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (118 commits)
  MIPS: Add new GIC clockevent driver.
  MIPS: Formatting clean-ups for clocksources.
  MIPS: Refactor GIC clocksource code.
  MIPS: Move 'gic_frequency' to common location.
  MIPS: Move 'gic_present' to common location.
  MIPS: MIPS16e: Add unaligned access support.
  MIPS: MIPS16e: Support handling of delay slots.
  MIPS: MIPS16e: Add instruction formats.
  MIPS: microMIPS: Optimise 'strnlen' core library function.
  MIPS: microMIPS: Optimise 'strlen' core library function.
  MIPS: microMIPS: Optimise 'strncpy' core library function.
  MIPS: microMIPS: Optimise 'memset' core library function.
  MIPS: microMIPS: Add configuration option for microMIPS kernel.
  MIPS: microMIPS: Disable LL/SC and fix linker bug.
  MIPS: microMIPS: Add vdso support.
  MIPS: microMIPS: Add unaligned access support.
  MIPS: microMIPS: Support handling of delay slots.
  MIPS: microMIPS: Add support for exception handling.
  MIPS: microMIPS: Floating point support.
  MIPS: microMIPS: Fix macro naming in micro-assembler.
  ...

Pull second set of arc arch updates from Vineet Gupta:
 "Aliasing VIPT dcache support for ARC

  I'm satisified with testing, specially with fuse which has
  historically given grief to VIPT arches (ARM/PARISC...)"

* tag 'arc-v3.10-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: [TB10x] Remove GENERIC_GPIO
  ARC: [mm] Aliasing VIPT dcache support 4/4
  ARC: [mm] Aliasing VIPT dcache support 3/4
  ARC: [mm] Aliasing VIPT dcache support 2/4
  ARC: [mm] Aliasing VIPT dcache support 1/4
  ARC: [mm] refactor the core (i|d)cache line ops loops
  ARC: [mm] serious bug in vaddr based icache flush

Pull m68knommu updates from Greg Ungerer:
 "The bulk of the changes are generalizing the ColdFire v3 core support
  and adding in 537x CPU support.  Also a couple of other bug fixes, one
  to fix a reintroduction of a past bug in the romfs filesystem nommu
  support."

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68knommu: enable Timer on coldfire 532x
  m68knommu: fix ColdFire 5373/5329 QSPI base address
  m68knommu: add support for configuring a Freescale M5373EVB board
  m68knommu: add support for the ColdFire 537x family of CPUs
  m68knommu: make ColdFire M532x platform support more v3 generic
  m68knommu: create and use a common M53xx ColdFire class of CPUs
  m68k: remove unused asm/dbg.h
  m68k: Set ColdFire ACR1 cache mode depending on kernel configuration
  romfs: fix nommu map length to keep inside filesystem
  m68k: clean up unused "config ROMVECSIZE"

Pull blackfin updates from Steven Miao.

* tag 'for-linus' of git://github.com/realmz/blackfin-linux:
  bfin cache: dcplb map: add 16M dcplb map for BF60x
  blackfin: smp: fix smp build after drop asm/system.h
  blackfin: fix bootup core clock and system clock display
  Platform Nand: Set the GPIO for NAND read as input
  blackfin: rename vmImage to uImage after we move to buildroot
  blackfin: twi: Remove bogus #endif
  bf609: rsi: Add bf609 rsi MMR macro and board platform data.
  blackfin: dmc: Improve DDR2 write through in DMC effict controller.

Pull microblaze updates from Michal Simek.

* 'next' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Enable IRQ in arch_cpu_idle
  microblaze: Fix uaccess_ok macro
  microblaze: Add support for new cpu versions and target architecture
  microblaze: Do not select OPT_LIB_ASM by default
  microblaze: Fix initrd support
  microblaze: Do not use r6 in head.S
  microblaze: pci: Remove duplicated header
  microblaze: Set the default irq_domain
  microblaze: pci: Remove duplicated include from pci-common.c

Share configuration option processing code between the dm cache
ctr and message functions.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Move process_config_option() in dm-cache-target.c to make the
next patch more readable.

Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Generate a dm event when the amount of remaining thin pool metadata
space falls below a certain level.

The threshold is taken to be a quarter of the size of the metadata
device with a minimum threshold of 4MB.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Add a threshold callback to dm persistent data space maps.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Add a threshold callback function to the persistent data space map
interface for a subsequent patch to use.

dm-thin and dm-cache are interested in knowing when they're getting
low on metadata or data blocks.  This patch introduces a new method
for registering a callback against a threshold.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Allow the dm thin pool metadata device to be extended.

Whenever a pool is resumed, detect whether the size of the metadata
device has increased, and if so, extend the metadata to use the new
space.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Support extending a dm persistent data metadata space map.

The extend itself is implemented by switching back to the boostrap
allocator and pointing to the new space.  The extra bitmap indexes are
then allocated from the new space, and finally we switch back to the
proper space map ops and tweak the reference counts.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

If a thin pool is created in read-only-metadata mode then only open the
metadata device read-only.

Previously it was always opened with FMODE_READ | FMODE_WRITE.

(Note that dm_get_device() still allows read-only dm devices to be used
read-write at the moment: If I create a read-only linear device for the
metadata, via dmsetup load --readonly, then I can still create a rw pool
out of it.)

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Refactor device size functions in preparation for similar metadata
device resizing functions.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Use struct assignment rather than memcpy in dm cache.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Fix up some typos in dm-cache comments.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Correct the documented requirement on the return code from dm cache policy
lookup functions stated in the policy module header file.

Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Document iterate_devices in device-mapper.h.

Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Fix some typos in dm-space-map-metadata.c error messages.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Tune the dm cache migration throttling.

i) Issue a tick every second, just in case there's no i/o going through.

ii) Drop the migration threshold right down to something suitable for
background work.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Enable WRITE SAME support in dm multipath.  As far as multipath is
concerned it is just another write request.

Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Tested-by: Bharata B Rao <bharata.rao@gmail.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

If device_not_write_same_capable() returns true then the iterate_devices
loop in dm_table_supports_write_same() should return false.

Reported-by: Bharata B Rao <bharata.rao@gmail.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # v3.8+
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

This patch uses memalloc_noio_save to avoid a possible deadlock in
dm-bufio.  (it could happen only with large block size, at most
PAGE_SIZE << MAX_ORDER (typically 8MiB).

__vmalloc doesn't fully respect gfp flags. The specified gfp flags are
used for allocation of requested pages, structures vmap_area, vmap_block
and vm_struct and the radix tree nodes.

However, the kernel pagetables are allocated always with GFP_KERNEL.
Thus the allocation of pagetables can recurse back to the I/O layer and
cause a deadlock.

This patch uses the function memalloc_noio_save to set per-process
PF_MEMALLOC_NOIO flag and the function memalloc_noio_restore to restore
it. When this flag is set, all allocations in the process are done with
implied GFP_NOIO flag, thus the deadlock can't happen.

This should be backported to stable kernels, but they don't have the
PF_MEMALLOC_NOIO flag and memalloc_noio_save/memalloc_noio_restore
functions. So, PF_MEMALLOC should be set and restored instead.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Return -ENOMEM instead of success if unable to allocate pending
exception mempool in snapshot_ctr.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Return -ENOMEM if memory allocation fails in cache_create
instead of 0 (to avoid NULL pointer dereference).

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Fix a regression in the calculation of the stripe_width in the
dm stripe target which led to incorrect processing of device limits.

The stripe_width is the stripe device length divided by the number of
stripes.  The group of commits in the range f14fa693 ("dm stripe: fix
size test") to eb850de6

 ("dm stripe: support for non power of 2
chunksize") interfered with each other (a merging error) and led to the
stripe_width being set incorrectly to the stripe device length divided by
chunk_size * stripe_count.

For example, a stripe device's table with: 0 33553920 striped 3 512 ...
should result in a stripe_width of 11184640 (33553920 / 3), but due to
the bug it was getting set to 21845 (33553920 / (512 * 3)).

The impact of this bug is that device topologies that previously worked
fine with the stripe target are no longer considered valid.  In
particular, there is a higher risk of seeing this issue if one of the
stripe devices has a 4K logical block size.  Resulting in an error
message like this:
"device-mapper: table: 253:4: len=21845 not aligned to h/w logical block size 4096 of dm-1"

The fix is to swap the order of the divisions and to use a temporary
variable for the second one, so that width retains the intended
value.

Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 3.6+
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

This reverts commit affdb62b

.

The commit introduced a regression with AD codecs where the stream is
always clean up.  Since the patch is just a minor optimization and
reverting the commit fixes the issue, let's just revert it.

Reported-and-tested-by: Michael Burian <michael.burian@sbg.at>
Cc: <stable@vger.kernel.org> [v3.9+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>

This tracks Alexandre Courbot's mainline GPIO rework

Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>

Pull trivial pstore update from Tony Luck:
 "Couple of pstore cleanups"

It turns out that the kmemdup() conversion ends up being undone by the
fact that the memory block also needed the ecc information (see commit
bd08ec33: "pstore/ram: Restore ecc information block"), so all that
remains after merging is the error return code change.

* tag 'please-pull-pstore' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
  pstore/ram: fix error return code in ramoops_probe()
  fs: pstore: Replaced calls to kmalloc and memcpy with kmemdup

Pull NVMe driver update from Matthew Wilcox:
 "Lots of exciting new features in the NVM Express driver this time,
  including support for emulating SCSI commands, discard support and the
  ability to submit per-sector metadata with I/Os.

  It's still mostly bugfixes though!"

* git://git.infradead.org/users/willy/linux-nvme: (27 commits)
  NVMe: Use user defined admin ioctl timeout
  NVMe: Simplify Firmware Activate code slightly
  NVMe: Only clear the enable bit when disabling controller
  NVMe: Wait for device to acknowledge shutdown
  NVMe: Schedule timeout for sync commands
  NVMe: Meta-data support in NVME_IOCTL_SUBMIT_IO
  NVMe: Device specific stripe size handling
  NVMe: Split non-mergeable bio requests
  NVMe: Remove dead code in nvme_dev_add
  NVMe: Check for NULL memory in nvme_dev_add
  NVMe: Fix error clean-up on nvme_alloc_queue
  NVMe: Free admin queue on request_irq error
  NVMe: Add scsi unmap to SG_IO
  NVMe: queue usage fixes in nvme-scsi
  NVMe: Set TASK_INTERRUPTIBLE before processing queues
  NVMe: Add a character device for each nvme device
  NVMe: Fix endian-related problems in user I/O submission path
  NVMe: Fix I/O cancellation status on big-endian machines
  NVMe: Fix sparse warnings in scsi emulation
  NVMe: Don't fail initialisation unnecessarily
  ...

Pull ACPICA fixes from Rafael Wysocki:

 - _INI regression fix from Tomasz Nowicki.

 - Fix for a possible memory leak in _OSI support routine from Jung-uk
   Kim.

 - Fix for a possible buffer overflow during field unit read operation
   from Bob Moore.

* tag 'acpi-fixes-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: ACPICA: Fix for _INI regression
  ACPICA: _OSI support: Fix possible memory leak
  ACPICA: Fix possible buffer overflow during a field unit read operation

Pull ARM SoC fixes and straggler patches from Olof Johansson:
 "A collection of fixes for fall out from 3.10 merge window, some build
  fixes and warning cleanups and a small handful of patches that were
  small and contained and made sense to still include in 3.10 (some of
  these have also been in -next since the merge window opened).

  Largest continous series is for OMAP, but there's a handful for other
  platforms.

  For i.MX, one of the patches are framebuffer fixups due to fallout
  during the merge window, and the other removes some stale and broken
  code."

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (34 commits)
  ARM: exynos: dts: Fixed vbus-gpios
  ARM: EXYNOS5: Fix kernel dump in AFTR idle mode
  ARM: ux500: Rid ignored return value of regulator_enable() compiler warning
  ARM: ux500: read the correct soc_id number
  ARM: exynos: dts: cros5250: add cyapa trackpad
  video: mxsfb: Adapt to new videomode API
  ARM: imx: Select GENERIC_ALLOCATOR
  ARM: imx: compile fix for hotplug.c
  ARM: dts: don't assume boards are using twl4030 for omap3
  ARM: OMAP2+: Remove bogus IS_ERR_OR_NULL checking from id.c
  ARM: dts: Configure and fix the McSPI pins for 4430sdp
  ARM: dts: AM33XX: Add GPMC node
  ARM: dts: OMAP4460: Fix CPU OPP voltages
  ARM: dts: OMAP36xx: Fix CPU OPP voltages
  ARM: OMAP4+: omap2plus_defconfig: Enable audio via TWL6040 as module
  ARM: OMAP2: AM33XX: id: Add support for new AM335x PG2.1 Si
  omap: mux: add AM/DM37x gpios
  ARM: OMAP1: DMA: fix error handling in omap1_system_dma_init()
  ARM: OMAP2+: omap_device: use late_initcall_sync
  ARM: OMAP: RX-51: change probe order of touchscreen and panel SPI devices
  ...

Pull xtensa updates from Chris Zankel:
 "Support for the latest MMU architecture that allows for a larger
  accessible memory region, and various bug-fixes"

* tag 'xtensa-next-20130508' of git://github.com/czankel/xtensa-linux:
  xtensa: Switch to asm-generic/linkage.h
  xtensa: fix redboot load address
  xtensa: ISS: fix timer_lock usage in rs_open
  xtensa: disable IRQs while IRQ handler is running
  xtensa: enable lockdep support
  xtensa: fix arch_irqs_disabled_flags implementation
  xtensa: add irq flags trace support
  xtensa: provide custom CALLER_ADDR* implementations
  xtensa: add stacktrace support
  xtensa: clean up stpill_registers
  xtensa: don't use a7 in simcalls
  xtensa: don't attempt to use unconfigured timers
  xtensa: provide default platform_pcibios_init implementation
  xtensa: remove KCORE_ELF again
  xtensa: document MMUv3 setup sequence
  xtensa: add MMU v3 support
  xtensa: fix ibreakenable register update
  xtensa: fix oprofile building as module

Pull ARC port updates from Vineet Gupta:
 "Support for two new platforms based on ARC700:
   - Abilis TB10x SoC [Chritisian/Pierrick]
   - Simulator only System-C Model [Mischa]

  ARC specific MM improvements:
   - Avoid full TLB flush (ASID increment) on munmap (even single page)
   - VIPT Cache Flushing improvements
     + Delayed dcache flush for non-aliasing dcache (big performance boost)
     + icache flush aliasing agnostic (no need to kill all possible aliases)

  Others:
   - Avoid needless rebuild of DTB files for every kernel build
   - Remove builtin cmdline as that is already provided by DeviceTree/bootargs
   - Fixing unaligned access emulation corner case
   - checkpatch fixes [Sachin]
   - Various fixlets [Noam]
   - Minor build failures/cleanups"

* tag 'arc-v3.10-rc1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: (35 commits)
  ARC: [mm] Lazy D-cache flush (non aliasing VIPT)
  ARC: [mm] micro-optimize page size icache invalidate
  ARC: [mm] remove the pessimistic all-alias-invalidate icache helpers
  ARC: [mm] consolidate icache/dcache sync code
  ARC: [mm] optimise icache flush for kernel mappings
  ARC: [mm] optimise icache flush for user mappings
  ARC: [mm] optimize needless full mm TLB flush on munmap
  ARC: Add support for nSIM OSCI System C model
  ARC: [TB10x] Adapt device tree to new compatible string
  ARC: [TB10x] Add support for TB10x platform
  ARC: [TB10x] Device tree of TB100 and TB101 Development Kits
  ARC: Prepare interrupt code for external controllers
  ARC: Allow embedded arc-intc to be properly placed in DT intc hierarchy
  ARC: [cmdline] Don't overwrite u-boot provided bootargs
  ARC: [cmdline] Remove CONFIG_CMDLINE
  ARC: [plat-arcfpga] defconfig update
  ARC: unaligned access emulation broken if callee-reg dest of LD/ST
  ARC: unaligned access emulation error handling consolidation
  ARC: Debug/crash-printing Improvements
  ARC: fix typo with clock speed
  ...

Pull tile update from Chris Metcalf:
 "The interesting bug fix is support for the upcoming "4.2" release of
  the Tilera hypervisor, which by default launches Linux at privilege
  level 2 instead of 1.  The fix lets new and old hypervisors and
  Linuxes interoperate more smoothly, so I've tagged it for
  stable@kernel.org so that older Linuxes will be able to boot under the
  newer hypervisor."

* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
  usb: tilegx: fix memleak when create hcd fail
  arch/tile: remove inline marking of EXPORT_SYMBOL functions
  rtc: rtc-tile: add missing platform_device_unregister() when module exit
  tile: support new Tilera hypervisor

Dave reported an oops triggered by trinity:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  IP: newseg+0x10d/0x390
  PGD cf8c1067 PUD cf8c2067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
  CPU: 2 PID: 7636 Comm: trinity-child2 Not tainted 3.9.0+#67
  ...
  Call Trace:
    ipcget+0x182/0x380
    SyS_shmget+0x5a/0x60
    tracesys+0xdd/0xe2

This bug was introduced by commit af73e4d9

 ("hugetlbfs: fix mmap
failure in unaligned size request").

Reported-by: Dave Jones <davej@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Li Zefan <lizfan@huawei.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Acked-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The semctl GETNCNT returns the number of semops waiting for the
specified semaphore to become nonzero.  After commit 9f1bc2c9


("ipc,sem: have only one list in struct sem_queue"), the semops waiting
on just one semaphore are waiting on that semaphore's list.

In order to return the correct count, we have to walk that list too, in
addition to the sem_array's list for complex operations.

Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>