From: Chuck Anderson <chuck.anderson@oracle.com>
Date: Sun, 27 Nov 2016 00:48:32 +0000 (-0800)
Subject: Merge branch topic/uek-4.1/upstream-cherry-picks of git://ca-git.us.oracle.com/linux... 
X-Git-Tag: v4.1.12-92~38
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=637b6a825c22a32e124606ed5d05993a6037e9be;p=users%2Fjedix%2Flinux-maple.git

Merge branch topic/uek-4.1/upstream-cherry-picks of git://ca-git.us.oracle.com/linux-uek into uek/uek-4.1

* topic/uek-4.1/upstream-cherry-picks:
  Bluetooth: Fix potential NULL dereference in RFCOMM bind callback
  aacraid: Check size values after double-fetch from user
  mm: migrate dirty page without clear_page_dirty_for_io etc
  xen-netfront: cast grant table reference first to type int
  xen-netfront: do not cast grant table reference to signed short
---

637b6a825c22a32e124606ed5d05993a6037e9be
diff --cc drivers/net/xen-netfront.c
index 96ccd4e943db,57c846ab0a73..4f50f9e722cd
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@@ -304,16 -305,17 +304,16 @@@ static void xennet_alloc_rx_buffers(str
  		queue->rx_skbs[id] = skb;
  
  		ref = gnttab_claim_grant_reference(&queue->gref_rx_head);
- 		BUG_ON((signed short)ref < 0);
+ 		WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
  		queue->grant_rx_ref[id] = ref;
  
 -		pfn = page_to_pfn(skb_frag_page(&skb_shinfo(skb)->frags[0]));
 +		page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
  
  		req = RING_GET_REQUEST(&queue->rx, req_prod);
 -		gnttab_grant_foreign_access_ref(ref,
 -						queue->info->xbdev->otherend_id,
 -						pfn_to_mfn(pfn),
 -						0);
 -
 +		gnttab_page_grant_foreign_access_ref_one(ref,
 +							 queue->info->xbdev->otherend_id,
 +							 page,
 +							 0);
  		req->id = id;
  		req->gref = ref;
  	}
@@@ -428,10 -429,10 +428,10 @@@ static void xennet_tx_setup_grant(unsig
  	id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs);
  	tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
  	ref = gnttab_claim_grant_reference(&queue->gref_tx_head);
- 	BUG_ON((signed short)ref < 0);
+ 	WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
  
  	gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id,
 -					page_to_mfn(page), GNTMAP_readonly);
 +					gfn, GNTMAP_readonly);
  
  	queue->tx_skbs[id].skb = skb;
  	queue->grant_tx_page[id] = page;