Merge branch topic/uek-4.1/upstream-cherry-picks of git://ca-git.us.oracle.com/linux...

* topic/uek-4.1/upstream-cherry-picks:
  Bluetooth: Fix potential NULL dereference in RFCOMM bind callback
  aacraid: Check size values after double-fetch from user
  mm: migrate dirty page without clear_page_dirty_for_io etc
  xen-netfront: cast grant table reference first to type int
  xen-netfront: do not cast grant table reference to signed short

diff --cc drivers/net/xen-netfront.c
index 96ccd4e943db49908b0821f1d515aef36072db15,57c846ab0a73a2f28f8c555942493b8c339d67d2..4f50f9e722cd2573a1f0490e64c703d6a3fe2a92
--- 1/drivers/net/xen-netfront.c
--- 2/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@@ -304,16 -305,17 +304,16 @@@ static void xennet_alloc_rx_buffers(str
                queue->rx_skbs[id] = skb;
  
                ref = gnttab_claim_grant_reference(&queue->gref_rx_head);
-               BUG_ON((signed short)ref < 0);
+               WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
                queue->grant_rx_ref[id] = ref;
  
 -              pfn = page_to_pfn(skb_frag_page(&skb_shinfo(skb)->frags[0]));
 +              page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
  
                req = RING_GET_REQUEST(&queue->rx, req_prod);
 -              gnttab_grant_foreign_access_ref(ref,
 -                                              queue->info->xbdev->otherend_id,
 -                                              pfn_to_mfn(pfn),
 -                                              0);
 -
 +              gnttab_page_grant_foreign_access_ref_one(ref,
 +                                                       queue->info->xbdev->otherend_id,
 +                                                       page,
 +                                                       0);
                req->id = id;
                req->gref = ref;
        }
@@@ -428,10 -429,10 +428,10 @@@ static void xennet_tx_setup_grant(unsig
        id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs);
        tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
        ref = gnttab_claim_grant_reference(&queue->gref_tx_head);
-       BUG_ON((signed short)ref < 0);
+       WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
  
        gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id,
 -                                      page_to_mfn(page), GNTMAP_readonly);
 +                                      gfn, GNTMAP_readonly);
  
        queue->tx_skbs[id].skb = skb;
        queue->grant_tx_page[id] = page;

diff --cc mm/migrate.c
Simple merge

diff --cc net/bluetooth/rfcomm/sock.c
Simple merge