Merge tag 'v3.10.105' into update

This is the 3.10.105 stable release

diff --cc Makefile
Simple merge

diff --cc arch/arm/boot/compressed/head.S
index a7cd67383883c65b9c123807b9776d1d49fa6410,9fef67ab1692909ba7dd715ce6cc9248adf00c93..d76329eda4c527433ec69a4a286b3b6e02301ed1
--- 1/arch/arm/boot/compressed/head.S
--- 2/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@@ -715,10 -715,8 +715,10 @@@ __armv7_mmu_cache_on
                orrne   r0, r0, #1              @ MMU enabled
                movne   r1, #0xfffffffd         @ domain 0 = client
                bic     r6, r6, #1 << 31        @ 32-bit translation system
-               bic     r6, r6, #3 << 0         @ use only ttbr0
+               bic     r6, r6, #(7 << 0) | (1 << 4)    @ use only ttbr0
                mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
 +              mcrne   p15, 0, r0, c8, c7, 0   @ flush I,D TLBs
 +              mcr     p15, 0, r0, c7, c5, 4   @ ISB
                mcrne   p15, 0, r1, c3, c0, 0   @ load domain access control
                mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
  #endif

diff --cc arch/arm/kernel/devtree.c
Simple merge

diff --cc arch/arm64/include/asm/elf.h
Simple merge

diff --cc arch/arm64/kernel/debug-monitors.c
Simple merge

diff --cc arch/arm64/kernel/entry.S
Simple merge

diff --cc arch/arm64/kernel/traps.c
index 7da4cb8d42f3b6a3631280236e81cbadfc7a1783,488a7b36d48e9dea10f317f722178036432cd59e..8e65005684b1afc9e7bc7ce8759909621e156ddd
--- 1/arch/arm64/kernel/traps.c
--- 2/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@@ -410,39 -306,34 +410,56 @@@ asmlinkage long do_ni_syscall(struct pt
        return sys_ni_syscall();
  }
  
 +#ifdef CONFIG_MEDIATEK_SOLUTION
 +static void (*async_abort_handler)(struct pt_regs *regs, void *);
 +static void *async_abort_priv;
 +
 +int register_async_abort_handler(void (*fn)(struct pt_regs *regs, void *), void *priv)
 +{
 +      async_abort_handler = fn;
 +      async_abort_priv = priv;
 +
 +      return 0;
 +}
 +#endif
 +
  /*
-  * bad_mode handles the impossible case in the exception vector.
+  * bad_mode handles the impossible case in the exception vector. This is always
+  * fatal.
   */
  asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
  {
-       siginfo_t info;
-       void __user *pc = (void __user *)instruction_pointer(regs);
        console_verbose();
  
 +#ifdef CONFIG_MEDIATEK_SOLUTION
 +      /*
 +       * reason is defined in entry.S, 3 means BAD_ERROR,
 +       * which would be triggered by async abort
 +       */
 +      if ((reason == 3) && async_abort_handler) {
 +              async_abort_handler(regs, async_abort_priv);
 +      }
 +#endif
        pr_crit("Bad mode in %s handler detected, code 0x%08x\n",
                handler[reason], esr);
+ 
+       die("Oops - bad mode", regs, 0);
+       local_irq_disable();
+       panic("bad mode");
+ }
+ 
+ /*
+  * bad_el0_sync handles unexpected, but potentially recoverable synchronous
+  * exceptions taken from EL0. Unlike bad_mode, this returns.
+  */
+ asmlinkage void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr)
+ {
+       siginfo_t info;
+       void __user *pc = (void __user *)instruction_pointer(regs);
+       console_verbose();
+ 
+       pr_crit("Bad EL0 synchronous exception detected on CPU%d, code 0x%08x\n",
+               smp_processor_id(), esr);
        __show_regs(regs);
  
        info.si_signo = SIGILL;

diff --cc crypto/blkcipher.c
index 0122bec38564d6c5de533d0e80b03d23e95f673b,39b09f25e3f51a1ad70709a97daf7134d909eeb6..09b24322c8b13d92219622ae8af78283c2209fc7
--- 1/crypto/blkcipher.c
--- 2/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@@ -233,10 -238,12 +233,12 @@@ static int blkcipher_walk_next(struct b
                return blkcipher_walk_done(desc, walk, -EINVAL);
        }
  
+       bsize = min(walk->blocksize, n);
+ 
        walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
                         BLKCIPHER_WALK_DIFF);
 -      if (!scatterwalk_aligned(&walk->in, alignmask) ||
 -          !scatterwalk_aligned(&walk->out, alignmask)) {
 +      if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
 +          !scatterwalk_aligned(&walk->out, walk->alignmask)) {
                walk->flags |= BLKCIPHER_WALK_COPY;
                if (!walk->page) {
                        walk->page = (void *)__get_free_page(GFP_ATOMIC);

diff --cc drivers/char/mem.c
Simple merge

diff --cc drivers/i2c/i2c-core.c
Simple merge

diff --cc drivers/mmc/card/block.c
Simple merge

diff --cc drivers/mtd/mtd_blkdevs.c
Simple merge

diff --cc drivers/thermal/thermal_core.c
Simple merge

diff --cc drivers/usb/class/cdc-acm.c
Simple merge

diff --cc drivers/usb/gadget/u_ether.c
index c1b2d1c8584449639f1a4a73b16e73a0e69cc8cb,ef5c623cf0dd03c8619bad11cd100aea68414041..589ea4edde19c2322db66ec6e90e0b3d661467c5
--- 1/drivers/usb/gadget/u_ether.c
--- 2/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@@ -935,21 -584,6 +935,22 @@@ static netdev_tx_t eth_start_xmit(struc
  
        req->length = length;
  
 +      /* throttle high/super speed IRQ rate back slightly */
 +      if (gadget_is_dualspeed(dev->gadget) &&
 +                       (dev->gadget->speed == USB_SPEED_HIGH ||
 +                        dev->gadget->speed == USB_SPEED_SUPER)) {
 +              dev->tx_qlen++;
 +              if (dev->tx_qlen == (qmult/2)) {
 +                      req->no_interrupt = 0;
 +                      dev->tx_qlen = 0;
 +              } else {
 +                      req->no_interrupt = 1;
 +              }
 +      } else {
 +              req->no_interrupt = 0;
 +      }
 +      rndis_test_tx_usb_out ++ ;
++
        retval = usb_ep_queue(in, req, GFP_ATOMIC);
        switch (retval) {
        default:

diff --cc drivers/usb/serial/usb-serial.c
Simple merge

diff --cc drivers/usb/storage/transport.c
Simple merge

diff --cc fs/coredump.c
Simple merge

diff --cc fs/ext4/ext4.h
Simple merge

diff --cc fs/ext4/inode.c
Simple merge

diff --cc fs/ext4/mballoc.c
Simple merge

diff --cc fs/ext4/super.c
Simple merge

diff --cc fs/seq_file.c
Simple merge

diff --cc fs/super.c
Simple merge

diff --cc fs/ubifs/dir.c
Simple merge

diff --cc fs/ubifs/xattr.c
Simple merge

diff --cc include/net/ndisc.h
Simple merge

diff --cc include/net/sock.h
Simple merge

diff --cc include/net/tcp.h
Simple merge

diff --cc kernel/events/core.c
Simple merge

diff --cc kernel/fork.c
Simple merge

diff --cc kernel/sched/core.c
Simple merge

diff --cc kernel/timer.c
Simple merge

diff --cc kernel/trace/trace.c
Simple merge

diff --cc mm/ksm.c
Simple merge

diff --cc mm/swapfile.c
Simple merge

diff --cc net/core/dev.c
Simple merge

diff --cc net/core/sock.c
Simple merge

diff --cc net/ipv4/ip_output.c
Simple merge

diff --cc net/ipv4/route.c
Simple merge

diff --cc net/ipv4/tcp_ipv4.c
Simple merge

diff --cc net/ipv4/tcp_output.c
Simple merge

diff --cc net/ipv6/addrconf.c
Simple merge

diff --cc net/ipv6/af_inet6.c
Simple merge

diff --cc net/ipv6/ndisc.c
Simple merge

diff --cc net/ipv6/route.c
Simple merge

diff --cc net/ipv6/tcp_ipv6.c
Simple merge

diff --cc net/packet/af_packet.c
Simple merge

diff --cc net/wireless/core.h
Simple merge

diff --cc net/wireless/scan.c
index ab406d0462b7985703106edd9dfcb41536fc1767,15ef12732d280005acf41545e4ae4024ca1bd95f..3e740e937ad11d356471a5f4f912c235afd48802
--- 1/net/wireless/scan.c
--- 2/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@@ -55,7 -55,20 +55,20 @@@
   * also linked into the probe response struct.
   */
  
 -#define IEEE80211_SCAN_RESULT_EXPIRE  (30 * HZ)
+ /*
+  * Limit the number of BSS entries stored in mac80211. Each one is
+  * a bit over 4k at most, so this limits to roughly 4-5M of memory.
+  * If somebody wants to really attack this though, they'd likely
+  * use small beacons, and only one type of frame, limiting each of
+  * the entries to a much smaller size (in order to generate more
+  * entries in total, so overhead is bigger.)
+  */
+ static int bss_entries_limit = 1000;
+ module_param(bss_entries_limit, int, 0644);
+ MODULE_PARM_DESC(bss_entries_limit,
+                  "limit to number of scan BSS entries (per wiphy, default 1000)");
+ 
 +#define IEEE80211_SCAN_RESULT_EXPIRE  (7 * HZ)
  
  static void bss_free(struct cfg80211_internal_bss *bss)
  {

diff --cc sound/core/pcm_lib.c
Simple merge