Merge branch 'linux-linaro-lsk-v3.14' into linux-linaro-lsk-v3.14-android

* linux-linaro-lsk-v3.14: (126 commits)
  Linux 3.14.49
  MIPS: KVM: Do not sign extend on unsigned MMIO load
  qla2xxx: Mark port lost when we receive an RSCN for it.
  Fix firmware loader uevent buffer NULL pointer dereference
  hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
  arm64: Don't report clear pmds and puds as huge
  agp/intel: Fix typo in needs_ilk_vtd_wa()
  rbd: use GFP_NOIO in rbd_obj_request_create()
  9p: don't leave a half-initialized inode sitting around
  9p: forgetting to cancel request on interrupted zero-copy RPC
  SUNRPC: Fix a memory leak in the backchannel code
  nfs: increase size of EXCHANGE_ID name string buffer
  fixing infinite OPEN loop in 4.0 stateid recovery
  NFS: Fix size of NFSACL SETACL operations
  watchdog: omap: assert the counter being stopped before reprogramming
  of: return NUMA_NO_NODE from fallback of_node_to_nid()
  block: Do a full clone when splitting discard bios
  USB: usbfs: allow URBs to be reaped after disconnection
  dell-laptop: Fix allocating & freeing SMI buffer page
  ideapad: fix software rfkill setting
  ...

4 files changed, 7 insertions, 3 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 9186550d77a6..08046f39f09c 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
 	if (err < 0) {
 		if (err == -EIO)
 			c->status = Disconnected;
-		goto reterr;
+		if (err != -ERESTARTSYS)
+			goto reterr;
 	}
 	if (req->status == REQ_STATUS_ERROR) {
 		p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index aade4a5c1c07..bde94d853b2b 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
 {
 	int j;
 	dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-	ceph_decode_32_safe(p, end, b->num_nodes, bad);
+	ceph_decode_8_safe(p, end, b->num_nodes, bad);
 	b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
 	if (b->node_weights == NULL)
 		return -ENOMEM;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c7a7a86afdb8..9e58c99e3bdc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
 {
 	struct ieee80211_local *local =
 		container_of(work, struct ieee80211_local, restart_work);
+	struct ieee80211_sub_if_data *sdata;
 
 	/* wait for scan work complete */
 	flush_workqueue(local->workqueue);
@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work)
 	     "%s called with hardware scan in progress\n", __func__);
 
 	rtnl_lock();
+	list_for_each_entry(sdata, &local->interfaces, list)
+		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
 	ieee80211_scan_cancel(local);
 	ieee80211_reconfig(local);
 	rtnl_unlock();
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index e860d4f7ed2a..ab219685336c 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
 
 	dprintk("RPC:        free allocations for req= %p\n", req);
 	WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
-	xbufp = &req->rq_private_buf;
+	xbufp = &req->rq_rcv_buf;
 	free_page((unsigned long)xbufp->head[0].iov_base);
 	xbufp = &req->rq_snd_buf;
 	free_page((unsigned long)xbufp->head[0].iov_base);