[PATCH 3.4 12/26] clockevents: Sanitize ticks to nsec conversion

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 97b9410643475d6557d2517c2aff9fd2221141a9 upstream.

Marc Kleine-Budde pointed out, that commit 77cc982 "clocksource: use
clockevents_config_and_register() where possible" caused a regression
for some of the converted subarchs.

The reason is, that the clockevents core code converts the minimal
hardware tick delta to a nanosecond value for core internal
usage. This conversion is affected by integer math rounding loss, so
the backwards conversion to hardware ticks will likely result in a
value which is less than the configured hardware limitation. The
affected subarchs used their own workaround (SIGH!) which got lost in
the conversion.

The solution for the issue at hand is simple: adding evt->mult - 1 to
the shifted value before the integer divison in the core conversion
function takes care of it. But this only works for the case where for
the scaled math mult/shift pair "mult <= 1 << shift" is true. For the
case where "mult > 1 << shift" we can apply the rounding add only for
the minimum delta value to make sure that the backward conversion is
not less than the given hardware limit. For the upper bound we need to
omit the rounding add, because the backwards conversion is always
larger than the original latch value. That would violate the upper
bound of the hardware device.

Though looking closer at the details of that function reveals another
bogosity: The upper bounds check is broken as well. Checking for a
resulting "clc" value greater than KTIME_MAX after the conversion is
pointless. The conversion does:

  u64 clc = (latch << evt->shift) / evt->mult;

So there is no sanity check for (latch << evt->shift) exceeding the
64bit boundary. The latch argument is "unsigned long", so on a 64bit
arch the handed in argument could easily lead to an unnoticed shift
overflow. With the above rounding fix applied the calculation before
the divison is:

   u64 clc = (latch << evt->shift) + evt->mult - 1;

So we need to make sure, that neither the shift nor the rounding add
is overflowing the u64 boundary.

[ukl: move assignment to rnd after eventually changing mult, fix build
 issue and correct comment with the right math]

Signed-off-by: Thomas Gleixner 
Cc: Russell King - ARM Linux 
Cc: Marc Kleine-Budde 
Cc: nicolas.fe...@atmel.com
Cc: Marc Pignat 
Cc: john.stu...@linaro.org
Cc: ker...@pengutronix.de
Cc: Ronald Wahl 
Cc: LAK 
Cc: Ludovic Desroches 
Link: 
http://lkml.kernel.org/r/1380052223-24139-1-git-send-email-u.kleine-koe...@pengutronix.de
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/time/clockevents.c |   65 +++---
 1 file changed, 50 insertions(+), 15 deletions(-)

--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -30,29 +30,64 @@ static RAW_NOTIFIER_HEAD(clockevents_cha
 /* Protection for the above */
 static DEFINE_RAW_SPINLOCK(clockevents_lock);
 
-/**
- * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
- * @latch: value to convert
- * @evt:   pointer to clock event device descriptor
- *
- * Math helper, returns latch value converted to nanoseconds (bound checked)
- */
-u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
+static u64 cev_delta2ns(unsigned long latch, struct clock_event_device *evt,
+   bool ismax)
 {
u64 clc = (u64) latch << evt->shift;
+   u64 rnd;
 
if (unlikely(!evt->mult)) {
evt->mult = 1;
WARN_ON(1);
}
+   rnd = (u64) evt->mult - 1;
+
+   /*
+* Upper bound sanity check. If the backwards conversion is
+* not equal latch, we know that the above shift overflowed.
+*/
+   if ((clc >> evt->shift) != (u64)latch)
+   clc = ~0ULL;
+
+   /*
+* Scaled math oddities:
+*
+* For mult <= (1 << shift) we can safely add mult - 1 to
+* prevent integer rounding loss. So the backwards conversion
+* from nsec to device ticks will be correct.
+*
+* For mult > (1 << shift), i.e. device frequency is > 1GHz we
+* need to be careful. Adding mult - 1 will result in a value
+* which when converted back to device ticks can be larger
+* than latch by up to (mult - 1) >> shift. For the min_delta
+* calculation we still want to apply this in order to stay
+* above the minimum device ticks limit. For the upper limit
+* we would end up with a latch value larger than the upper
+* limit of the device, so we omit the add to stay below the
+* device upper boundary.
+*
+* Also omit the add if it would overflow the u64 boundary.
+*/
+   if ((~0ULL - clc > rnd) &&
+   (!ismax || evt->mult <= (1U << evt->shift)))
+   clc += rnd;
 

[PATCH 3.4 00/26] 3.4.69-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.4.69 release.
There are 26 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Nov 11 06:50:22 UTC 2013.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.69-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 3.4.69-rc1

Alex Deucher 
drm/radeon/atom: workaround vbios bug in transmitter table on rs780

Chris Wilson 
drm: Prevent overwriting from userspace underallocating core ioctl structs

Khalid Aziz 
mm: fix aio performance regression for database caused by THP

Dan Carpenter 
aacraid: missing capable() check in compat ioctl

Ming Lei 
lib/scatterlist.c: don't flush_kernel_dcache_page on slab page

Baruch Siach 
xtensa: don't use alternate signal stack on threads

Dan Carpenter 
uml: check length in exitcode_proc_write()

Dan Carpenter 
Staging: bcm: info leak in ioctl

Dan Carpenter 
staging: ozwpan: prevent overflow in oz_cdev_write()

Takashi Iwai 
ASoC: dapm: Fix source list debugfs outputs

Takashi Iwai 
ASoC: wm_hubs: Add missing break in hp_supply_event()

Russell King 
ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM

Takashi Iwai 
ALSA: hda - Add a fixup for ASUS N76VZ

Helge Deller 
parisc: Do not crash 64bit SMP kernels on machines with >= 4GB RAM

Thomas Gleixner 
clockevents: Sanitize ticks to nsec conversion

Lukasz Dorau 
md: Fix skipping recovery for read-only arrays.

Gwendal Grignou 
libata: make ata_eh_qc_retry() bump scmd->allowed on bogus failures

Marc Kleine-Budde 
can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and 
abort pending TX

Dave Kleikamp 
jfs: fix error path in ialloc

Mark Cave-Ayland 
rtlwifi: rtl8192cu: Fix error in pointer arithmetic

Felix Fietkau 
mac80211: update sta->last_rx on acked tx frames

Emmanuel Grumbach 
mac80211: correctly close cancelled scans

Алексей Крамаренко 
USB: serial: ftdi_sio: add id for Z3X Box device

Oliver Neukum 
USB: quirks: add touchscreen that is dazzeled by remote wakeup

Oliver Neukum 
USB: quirks.c: add one device that cannot deal with suspension

Fangxiaozhi (Franko) 
USB: support new huawei devices in option.c


-

Diffstat:

 Makefile |   4 +-
 arch/parisc/kernel/head.S|   4 +
 arch/um/kernel/exitcode.c|   4 +-
 arch/xtensa/kernel/signal.c  |   2 +-
 drivers/ata/libata-eh.c  |   6 +-
 drivers/gpu/drm/drm_drv.c|   9 +-
 drivers/gpu/drm/radeon/atombios_encoders.c   |   2 +-
 drivers/md/raid1.c   |   1 +
 drivers/md/raid10.c  |   1 +
 drivers/net/can/flexcan.c|  10 +-
 drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |   3 +-
 drivers/scsi/aacraid/linit.c |   2 +
 drivers/staging/bcm/Bcmchar.c|   1 +
 drivers/staging/ozwpan/ozcdev.c  |   3 +
 drivers/usb/core/quirks.c|   6 +
 drivers/usb/serial/ftdi_sio.c|   1 +
 drivers/usb/serial/ftdi_sio_ids.h|   6 +
 drivers/usb/serial/option.c  | 216 +++
 fs/jfs/jfs_inode.c   |   3 +-
 kernel/time/clockevents.c|  65 ++--
 lib/scatterlist.c|   3 +-
 mm/swap.c|  31 +++-
 net/mac80211/ieee80211_i.h   |   3 +
 net/mac80211/scan.c  |  19 +++
 net/mac80211/status.c|   3 +
 sound/core/pcm.c |   4 +
 sound/pci/hda/patch_realtek.c|   1 +
 sound/soc/codecs/wm_hubs.c   |   1 +
 sound/soc/soc-dapm.c |   2 +-
 29 files changed, 383 insertions(+), 33 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 14/26] ALSA: hda - Add a fixup for ASUS N76VZ

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 6fc16e58adf50c0f1e4478538983fb5ff6f453d4 upstream.

ASUS N76VZ needs the same fixup as N56VZ for supporting the boost
speaker.

Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=846529
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6833,6 +6833,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
+   SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_ASUS_MODE4),
SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 13/26] parisc: Do not crash 64bit SMP kernels on machines with >= 4GB RAM

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Helge Deller 

commit 54e181e073fc1415e41917d725ebdbd7de956455 upstream.

Since the beginning of the parisc-linux port, sometimes 64bit SMP kernels were
not able to bring up other CPUs than the monarch CPU and instead crashed the
kernel.  The reason was unclear, esp. since it involved various machines (e.g.
J5600, J6750 and SuperDome). Testing showed, that those crashes didn't happened
when less than 4GB were installed, or if a 32bit Linux kernel was booted.

In the end, the fix for those SMP problems is trivial:
During the early phase of the initialization of the CPUs, including the monarch
CPU, the PDC_PSW firmware function to enable WIDE (=64bit) mode is called.
It's documented that this firmware function may clobber various registers, and
one one of those possibly clobbered registers is %cr30 which holds the task
thread info pointer.

Now, if %cr30 would always have been clobbered, then this bug would have been
detected much earlier. But lots of testing finally showed, that - at least for
%cr30 - on some machines only the upper 32bits of the 64bit register suddenly
turned zero after the firmware call.

So, after finding the root cause, the explanation for the various crashes
became clear:
- On 32bit SMP Linux kernels all upper 32bit were zero, so we didn't faced this
  problem.
- Monarch CPUs in 64bit mode always booted sucessfully, because the inital task
  thread info pointer was below 4GB.
- Secondary CPUs booted sucessfully on machines with less than 4GB RAM because
  the upper 32bit were zero anyay.
- Secondary CPus failed to boot if we had more than 4GB RAM and the task thread
  info pointer was located above the 4GB boundary.

Finally, the patch to fix this problem is trivial by saving the %cr30 register
before the firmware call and restoring it afterwards.

Signed-off-by: Helge Deller 
Signed-off-by: John David Anglin 
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/parisc/kernel/head.S |4 
 1 file changed, 4 insertions(+)

--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
ldw MEM_PDC_HI(%r0),%r6
depd%r6, 31, 32, %r3/* move to upper word */
 
+   mfctl   %cr30,%r6   /* PCX-W2 firmware bug */
+
ldo PDC_PSW(%r0),%arg0  /* 21 */
ldo PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
ldo PDC_PSW_WIDE_BIT(%r0),%arg2 /* 2 */
@@ -203,6 +205,8 @@ common_stext:
copy%r0,%arg3
 
 stext_pdc_ret:
+   mtctl   %r6,%cr30   /* restore task thread info */
+
/* restore rfi target address*/
ldd TI_TASK-THREAD_SZ_ALGN(%sp), %r10
tophys_r1   %r10


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 11/26] md: Fix skipping recovery for read-only arrays.

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Lukasz Dorau 

commit 61e4947c99c4494336254ec540c50186d186150b upstream.

Since:
commit 7ceb17e87bde79d285a8b988cfed9eaeebe60b86
md: Allow devices to be re-added to a read-only array.

spares are activated on a read-only array. In case of raid1 and raid10
personalities it causes that not-in-sync devices are marked in-sync
without checking if recovery has been finished.

If a read-only array is degraded and one of its devices is not in-sync
(because the array has been only partially recovered) recovery will be skipped.

This patch adds checking if recovery has been finished before marking a device
in-sync for raid1 and raid10 personalities. In case of raid5 personality
such condition is already present (at raid5.c:6029).

Bug was introduced in 3.10 and causes data corruption.

Signed-off-by: Pawel Baldysiak 
Signed-off-by: Lukasz Dorau 
Signed-off-by: NeilBrown 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/raid1.c  |1 +
 drivers/md/raid10.c |1 +
 2 files changed, 2 insertions(+)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1357,6 +1357,7 @@ static int raid1_spare_active(struct mdd
}
}
if (rdev
+   && rdev->recovery_offset == MaxSector
&& !test_bit(Faulty, >flags)
&& !test_and_set_bit(In_sync, >flags)) {
count++;
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1534,6 +1534,7 @@ static int raid10_spare_active(struct md
}
sysfs_notify_dirent_safe(tmp->replacement->sysfs_state);
} else if (tmp->rdev
+  && tmp->rdev->recovery_offset == MaxSector
   && !test_bit(Faulty, >rdev->flags)
   && !test_and_set_bit(In_sync, >rdev->flags)) {
count++;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 19/26] Staging: bcm: info leak in ioctl

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream.

The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
information to user space.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/bcm/Bcmchar.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1957,6 +1957,7 @@ cntrlEnd:
 
BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, 
DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");
 
+   memset(, 0, sizeof(DevInfo));
DevInfo.MaxRDMBufferSize = BUFFER_4K;
DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START;
DevInfo.u32RxAlignmentCorrection = 0;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 15/26] ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Russell King 

commit a4461f41b94cb52e0141af717dcf4ef6558c8e2e upstream.

Unable to handle kernel NULL pointer dereference at virtual address 0008
pgd = d530
[0008] *pgd=0d265831, *pte=, *ppte=
Internal error: Oops: 17 [#1] PREEMPT ARM
CPU: 0 PID: 2295 Comm: vlc Not tainted 3.11.0+ #755
task: dee74800 ti: e213c000 task.ti: e213c000
PC is at snd_pcm_info+0xc8/0xd8
LR is at 0x30232065
pc : []lr : [<30232065>]psr: a0070013
sp : e213dea8  ip : d81cb0d0  fp : c05f7678
r10: c05f7770  r9 : fdfd  r8 : 
r7 : d8a968a8  r6 : d8a96800  r5 : d8a96200  r4 : d81cb000
r3 :   r2 : d81cb000  r1 : 0001  r0 : d8a96200
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 15300019  DAC: 0015
Process vlc (pid: 2295, stack limit = 0xe213c248)
[] (snd_pcm_info) from [] (snd_pcm_info_user+0x34/0x9c)
[] (snd_pcm_info_user) from [] 
(snd_pcm_control_ioctl+0x274/0x280)
[] (snd_pcm_control_ioctl) from [] 
(snd_ctl_ioctl+0xc0/0x55c)
[] (snd_ctl_ioctl) from [] (do_vfs_ioctl+0x80/0x31c)
[] (do_vfs_ioctl) from [] (SyS_ioctl+0x3c/0x60)
[] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x48)
Code: e1a5 e59530dc e3a01001 e1a02004 (e5933008)
---[ end trace cb3d9bdb8dfefb3c ]---

This is provoked when the ASoC front end is open along with its backend,
(which causes the backend to have a runtime assigned to it) and then the
SNDRV_CTL_IOCTL_PCM_INFO is requested for the (visible) backend device.

Resolve this by ensuring that ASoC internal backend devices are not
visible to userspace, just as the commentry for snd_pcm_new_internal()
says it should be.

Signed-off-by: Russell King 
Acked-by: Mark Brown 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/pcm.c |4 
 1 file changed, 4 insertions(+)

--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -49,6 +49,8 @@ static struct snd_pcm *snd_pcm_get(struc
struct snd_pcm *pcm;
 
list_for_each_entry(pcm, _pcm_devices, list) {
+   if (pcm->internal)
+   continue;
if (pcm->card == card && pcm->device == device)
return pcm;
}
@@ -60,6 +62,8 @@ static int snd_pcm_next(struct snd_card
struct snd_pcm *pcm;
 
list_for_each_entry(pcm, _pcm_devices, list) {
+   if (pcm->internal)
+   continue;
if (pcm->card == card && pcm->device > device)
return pcm->device;
else if (pcm->card->number > card->number)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 20/26] uml: check length in exitcode_proc_write()

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 201f99f170df14ba52ea4c52847779042b7a623b upstream.

We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/um/kernel/exitcode.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/um/kernel/exitcode.c
+++ b/arch/um/kernel/exitcode.c
@@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struc
const char __user *buffer, size_t count, loff_t *pos)
 {
char *end, buf[sizeof("n\0")];
+   size_t size;
int tmp;
 
-   if (copy_from_user(buf, buffer, count))
+   size = min(count, sizeof(buf));
+   if (copy_from_user(buf, buffer, size))
return -EFAULT;
 
tmp = simple_strtol(buf, , 0);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 16/26] ASoC: wm_hubs: Add missing break in hp_supply_event()

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 268ff14525edba31da29a12a9dd693cdd6a7872e upstream.

Spotted by coverity CID 115170.

Signed-off-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/codecs/wm_hubs.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -413,6 +413,7 @@ static int hp_supply_event(struct snd_so
hubs->hp_startup_mode);
break;
}
+   break;
 
case SND_SOC_DAPM_PRE_PMD:
snd_soc_update_bits(codec, WM8993_CHARGE_PUMP_1,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 24/26] mm: fix aio performance regression for database caused by THP

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Khalid Aziz 

commit 7cb2ef56e6a8b7b368b2e883a0a47d02fed66911 upstream.

I am working with a tool that simulates oracle database I/O workload.
This tool (orion to be specific -
)
allocates hugetlbfs pages using shmget() with SHM_HUGETLB flag.  It then
does aio into these pages from flash disks using various common block
sizes used by database.  I am looking at performance with two of the most
common block sizes - 1M and 64K.  aio performance with these two block
sizes plunged after Transparent HugePages was introduced in the kernel.
Here are performance numbers:

pre-THP 2.6.39  3.11-rc5
1M read 8384 MB/s   5629 MB/s   6501 MB/s
64K read7867 MB/s   4576 MB/s   4251 MB/s

I have narrowed the performance impact down to the overheads introduced by
THP in __get_page_tail() and put_compound_page() routines.  perf top shows
>40% of cycles being spent in these two routines.  Every time direct I/O
to hugetlbfs pages starts, kernel calls get_page() to grab a reference to
the pages and calls put_page() when I/O completes to put the reference
away.  THP introduced significant amount of locking overhead to get_page()
and put_page() when dealing with compound pages because hugepages can be
split underneath get_page() and put_page().  It added this overhead
irrespective of whether it is dealing with hugetlbfs pages or transparent
hugepages.  This resulted in 20%-45% drop in aio performance when using
hugetlbfs pages.

Since hugetlbfs pages can not be split, there is no reason to go through
all the locking overhead for these pages from what I can see.  I added
code to __get_page_tail() and put_compound_page() to bypass all the
locking code when working with hugetlbfs pages.  This improved performance
significantly.  Performance numbers with this patch:

pre-THP 3.11-rc53.11-rc5 + Patch
1M read 8384 MB/s   6501 MB/s   8371 MB/s
64K read7867 MB/s   4251 MB/s   6510 MB/s

Performance with 64K read is still lower than what it was before THP, but
still a 53% improvement.  It does mean there is more work to be done but I
will take a 53% improvement for now.

Please take a look at the following patch and let me know if it looks
reasonable.

[a...@linux-foundation.org: tweak comments]
Signed-off-by: Khalid Aziz 
Cc: Pravin B Shelar 
Cc: Christoph Lameter 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Mel Gorman 
Cc: Rik van Riel 
Cc: Minchan Kim 
Cc: Andi Kleen 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/swap.c |   31 +--
 1 file changed, 29 insertions(+), 2 deletions(-)

--- a/mm/swap.c
+++ b/mm/swap.c
@@ -30,6 +30,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include "internal.h"
 
@@ -68,13 +69,26 @@ static void __put_compound_page(struct p
 {
compound_page_dtor *dtor;
 
-   __page_cache_release(page);
+   if (!PageHuge(page))
+   __page_cache_release(page);
dtor = get_compound_page_dtor(page);
(*dtor)(page);
 }
 
 static void put_compound_page(struct page *page)
 {
+   /*
+* hugetlbfs pages cannot be split from under us.  If this is a
+* hugetlbfs page, check refcount on head page and release the page if
+* the refcount becomes zero.
+*/
+   if (PageHuge(page)) {
+   page = compound_head(page);
+   if (put_page_testzero(page))
+   __put_compound_page(page);
+   return;
+   }
+
if (unlikely(PageTail(page))) {
/* __split_huge_page_refcount can run under us */
struct page *page_head = compound_trans_head(page);
@@ -159,8 +173,20 @@ bool __get_page_tail(struct page *page)
 */
unsigned long flags;
bool got = false;
-   struct page *page_head = compound_trans_head(page);
+   struct page *page_head;
+
+   /*
+* If this is a hugetlbfs page it cannot be split under us.  Simply
+* increment refcount for the head page.
+*/
+   if (PageHuge(page)) {
+   page_head = compound_head(page);
+   atomic_inc(_head->_count);
+   got = true;
+   goto out;
+   }
 
+   page_head = compound_trans_head(page);
if (likely(page != page_head && get_page_unless_zero(page_head))) {
/*
 * page_head wasn't a dangling pointer but it
@@ -178,6 +204,7 @@ bool __get_page_tail(struct page *page)
if (unlikely(!got))
put_page(page_head);
}
+out:
return got;
 }
 EXPORT_SYMBOL(__get_page_tail);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in

[PATCH 3.4 22/26] lib/scatterlist.c: dont flush_kernel_dcache_page on slab page

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ming Lei 

commit 3d77b50c5874b7e923be946ba793644f82336b75 upstream.

Commit b1adaf65ba03 ("[SCSI] block: add sg buffer copy helper
functions") introduces two sg buffer copy helpers, and calls
flush_kernel_dcache_page() on pages in SG list after these pages are
written to.

Unfortunately, the commit may introduce a potential bug:

 - Before sending some SCSI commands, kmalloc() buffer may be passed to
   block layper, so flush_kernel_dcache_page() can see a slab page
   finally

 - According to cachetlb.txt, flush_kernel_dcache_page() is only called
   on "a user page", which surely can't be a slab page.

 - ARCH's implementation of flush_kernel_dcache_page() may use page
   mapping information to do optimization so page_mapping() will see the
   slab page, then VM_BUG_ON() is triggered.

Aaro Koskinen reported the bug on ARM/kirkwood when DEBUG_VM is enabled,
and this patch fixes the bug by adding test of '!PageSlab(miter->page)'
before calling flush_kernel_dcache_page().

Signed-off-by: Ming Lei 
Reported-by: Aaro Koskinen 
Tested-by: Simon Baatz 
Cc: Russell King - ARM Linux 
Cc: Will Deacon 
Cc: Aaro Koskinen 
Acked-by: Catalin Marinas 
Cc: FUJITA Tomonori 
Cc: Tejun Heo 
Cc: "James E.J. Bottomley" 
Cc: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 lib/scatterlist.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -419,7 +419,8 @@ void sg_miter_stop(struct sg_mapping_ite
if (miter->addr) {
miter->__offset += miter->consumed;
 
-   if (miter->__flags & SG_MITER_TO_SG)
+   if ((miter->__flags & SG_MITER_TO_SG) &&
+   !PageSlab(miter->page))
flush_kernel_dcache_page(miter->page);
 
if (miter->__flags & SG_MITER_ATOMIC) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 23/26] aacraid: missing capable() check in compat ioctl

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit f856567b930dfcdbc3323261bf77240ccdde01f5 upstream.

In commit d496f94d22d1 ('[SCSI] aacraid: fix security weakness') we
added a check on CAP_SYS_RAWIO to the ioctl.  The compat ioctls need the
check as well.

Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/aacraid/linit.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -777,6 +777,8 @@ static long aac_compat_do_ioctl(struct a
 static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user 
*arg)
 {
struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+   if (!capable(CAP_SYS_RAWIO))
+   return -EPERM;
return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 26/26] drm/radeon/atom: workaround vbios bug in transmitter table on rs780

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream.

Some rs780 asics seem to be affected as well.

See:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=60791

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/radeon/atombios_encoders.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1430,7 +1430,7 @@ radeon_atom_encoder_dpms_dig(struct drm_
 * does the same thing and more.
 */
if ((rdev->family != CHIP_RV710) && (rdev->family != 
CHIP_RV730) &&
-   (rdev->family != CHIP_RS880))
+   (rdev->family != CHIP_RS780) && (rdev->family != 
CHIP_RS880))
atombios_dig_transmitter_setup(encoder, 
ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
}
if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && 
connector) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 02/26] USB: quirks.c: add one device that cannot deal with suspension

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 4294bca7b423d1a5aa24307e3d112a04075e3763 upstream.

The device is not responsive when resumed, unless it is reset.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/core/quirks.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -152,6 +152,9 @@ static const struct usb_device_id usb_qu
/* Broadcom BCM92035DGROM BT dongle */
{ USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
 
+   /* MAYA44USB sound device */
+   { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Action Semiconductor flash disk */
{ USB_DEVICE(0x10d6, 0x2200), .driver_info =
USB_QUIRK_STRING_FETCH_255 },


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 18/26] staging: ozwpan: prevent overflow in oz_cdev_write()

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit c2c65cd2e14ada6de44cb527e7f1990bede24e15 upstream.

We need to check "count" so we don't overflow the ei->data buffer.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/ozwpan/ozcdev.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/staging/ozwpan/ozcdev.c
+++ b/drivers/staging/ozwpan/ozcdev.c
@@ -153,6 +153,9 @@ ssize_t oz_cdev_write(struct file *filp,
struct oz_app_hdr *app_hdr;
struct oz_serial_ctx *ctx;
 
+   if (count > sizeof(ei->data) - sizeof(*elt) - sizeof(*app_hdr))
+   return -EINVAL;
+
spin_lock_bh(_cdev.lock);
pd = g_cdev.active_pd;
if (pd)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 17/26] ASoC: dapm: Fix source list debugfs outputs

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit ff18620c2157671a8ee21ebb8e6a3520ea209b1f upstream.

... due to a copy & paste error.

Spotted by coverity CID 710923.

Signed-off-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1590,7 +1590,7 @@ static ssize_t dapm_widget_power_read_fi
w->active ? "active" : "inactive");
 
list_for_each_entry(p, >sources, list_sink) {
-   if (p->connected && !p->connected(w, p->sink))
+   if (p->connected && !p->connected(w, p->source))
continue;
 
if (p->connect)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 21/26] xtensa: dont use alternate signal stack on threads

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Baruch Siach 

commit cba9a90053e3b7973eff4f1946f33032e98eeed5 upstream.

According to create_thread(3): "The new thread does not inherit the creating
thread's alternate signal stack". Since commit f9a3879a (Fix sigaltstack
corruption among cloned threads), current->sas_ss_size is set to 0 for cloned
processes sharing VM with their parent. Don't use the (nonexistent) alternate
signal stack in this case. This has been broken since commit 29c4dfd9 ([XTENSA]
Remove non-rt signal handling).

Fixes the SA_ONSTACK part of the nptl/tst-cancel20 test from uClibc.

Signed-off-by: Baruch Siach 
Signed-off-by: Max Filippov 
Signed-off-by: Chris Zankel 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/xtensa/kernel/signal.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -343,7 +343,7 @@ static int setup_frame(int sig, struct k
 
sp = regs->areg[1];
 
-   if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && ! on_sig_stack(sp)) {
+   if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && sas_ss_flags(sp) == 0) {
sp = current->sas_ss_sp + current->sas_ss_size;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 07/26] rtlwifi: rtl8192cu: Fix error in pointer arithmetic

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Mark Cave-Ayland 

commit 9473ca6e920a3b9ca902753ce52833657f9221cc upstream.

An error in calculating the offset in an skb causes the driver to read
essential device info from the wrong locations. The main effect is that
automatic gain calculations are nonsense.

Signed-off-by: Mark Cave-Ayland 
Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80
(bool)GET_RX_DESC_PAGGR(pdesc));
rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
if (phystatus) {
-   p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
+   p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+stats->rx_bufshift);
rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
 p_drvinfo);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 05/26] mac80211: correctly close cancelled scans

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Emmanuel Grumbach 

commit a754055a1296fcbe6f32de3a5eaca6efb2fd1865 upstream.

__ieee80211_scan_completed is called from a worker. This
means that the following flow is possible.

 * driver calls ieee80211_scan_completed
 * mac80211 cancels the scan (that is already complete)
 * __ieee80211_scan_completed runs

When scan_work will finally run, it will see that the scan
hasn't been aborted and might even trigger another scan on
another band. This leads to a situation where cfg80211's
scan is not done and no further scan can be issued.

Fix this by setting a new flag when a HW scan is being
cancelled so that no other scan will be triggered.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/mac80211/ieee80211_i.h |3 +++
 net/mac80211/scan.c|   19 +++
 2 files changed, 22 insertions(+)

--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -789,12 +789,15 @@ struct tpt_led_trigger {
  * that the scan completed.
  * @SCAN_ABORTED: Set for our scan work function when the driver reported
  * a scan complete for an aborted scan.
+ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
+ * cancelled.
  */
 enum {
SCAN_SW_SCANNING,
SCAN_HW_SCANNING,
SCAN_COMPLETED,
SCAN_ABORTED,
+   SCAN_HW_CANCELLED,
 };
 
 /**
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -259,6 +259,9 @@ static bool ieee80211_prep_hw_scan(struc
enum ieee80211_band band;
int i, ielen, n_chans;
 
+   if (test_bit(SCAN_HW_CANCELLED, >scanning))
+   return false;
+
do {
if (local->hw_scan_band == IEEE80211_NUM_BANDS)
return false;
@@ -844,7 +847,23 @@ void ieee80211_scan_cancel(struct ieee80
if (!local->scan_req)
goto out;
 
+   /*
+* We have a scan running and the driver already reported completion,
+* but the worker hasn't run yet or is stuck on the mutex - mark it as
+* cancelled.
+*/
+   if (test_bit(SCAN_HW_SCANNING, >scanning) &&
+   test_bit(SCAN_COMPLETED, >scanning)) {
+   set_bit(SCAN_HW_CANCELLED, >scanning);
+   goto out;
+   }
+
if (test_bit(SCAN_HW_SCANNING, >scanning)) {
+   /*
+* Make sure that __ieee80211_scan_completed doesn't trigger a
+* scan on another band.
+*/
+   set_bit(SCAN_HW_CANCELLED, >scanning);
if (local->ops->cancel_hw_scan)
drv_cancel_hw_scan(local, local->scan_sdata);
goto out;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 04/26] USB: serial: ftdi_sio: add id for Z3X Box device

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Алексей Крамаренко 

commit e1466ad5b1aeda303f9282463d55798d2eda218c upstream.

Custom VID/PID for Z3X Box device, popular tool for cellphone flashing.

Signed-off-by: Alexey E. Kramarenko 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/serial/ftdi_sio.c |1 +
 drivers/usb/serial/ftdi_sio_ids.h |6 ++
 2 files changed, 7 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -916,6 +916,7 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
/* Crucible Devices */
{ USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
+   { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
{ },/* Optional parameter entry */
{ } /* Terminating entry */
 };
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1307,3 +1307,9 @@
  * Manufacturer: Crucible Technologies
  */
 #define FTDI_CT_COMET_PID  0x8e08
+
+/*
+ * Product: Z3X Box
+ * Manufacturer: Smart GSM Team
+ */
+#define FTDI_Z3X_PID   0x0011


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 09/26] can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and abort pending TX

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Kleine-Budde 

commit d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa upstream.

In patch

0d1862e can: flexcan: fix flexcan_chip_start() on imx6

the loop in flexcan_chip_start() that iterates over all mailboxes after the
soft reset of the CAN core was removed. This loop put all mailboxes (even the
ones marked as reserved 1...7) into EMPTY/INACTIVE mode. On mailboxes 8...63,
this aborts any pending TX messages.

After a cold boot there is random garbage in the mailboxes, which leads to
spontaneous transmit of CAN frames during first activation. Further if the
interface was disabled with a pending message (usually due to an error
condition on the CAN bus), this message is retransmitted after enabling the
interface again.

This patch fixes the regression by:
1) Limiting the maximum number of used mailboxes to 8, 0...7 are used by the RX
FIFO, 8 is used by TX.
2) Marking the TX mailbox as EMPTY/INACTIVE, so that any pending TX of that
mailbox is aborted.

Cc: Lothar Waßmann 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/can/flexcan.c |   10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -60,7 +60,7 @@
 #define FLEXCAN_MCR_BCCBIT(16)
 #define FLEXCAN_MCR_LPRIO_EN   BIT(13)
 #define FLEXCAN_MCR_AENBIT(12)
-#define FLEXCAN_MCR_MAXMB(x)   ((x) & 0xf)
+#define FLEXCAN_MCR_MAXMB(x)   ((x) & 0x1f)
 #define FLEXCAN_MCR_IDAM_A (0 << 8)
 #define FLEXCAN_MCR_IDAM_B (1 << 8)
 #define FLEXCAN_MCR_IDAM_C (2 << 8)
@@ -701,9 +701,11 @@ static int flexcan_chip_start(struct net
 *
 */
reg_mcr = flexcan_read(>mcr);
+   reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
-   FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS;
+   FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS |
+   FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
flexcan_write(reg_mcr, >mcr);
 
@@ -744,6 +746,10 @@ static int flexcan_chip_start(struct net
>cantxfg[i].can_ctrl);
}
 
+   /* Abort any pending TX, mark Mailbox as INACTIVE */
+   flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+ >cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+
/* acceptance mask/acceptance code (accept everything) */
flexcan_write(0x0, >rxgmask);
flexcan_write(0x0, >rx14mask);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 03/26] USB: quirks: add touchscreen that is dazzeled by remote wakeup

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 614ced91fc6fbb5a1cdd12f0f1b6c9197d9f1350 upstream.

The device descriptors are messed up after remote wakeup

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/core/quirks.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -119,6 +119,9 @@ static const struct usb_device_id usb_qu
/* Alcor Micro Corp. Hub */
{ USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME },
 
+   /* MicroTouch Systems touchscreen */
+   { USB_DEVICE(0x0596, 0x051e), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* appletouch */
{ USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 08/26] jfs: fix error path in ialloc

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dave Kleikamp 

commit 8660998608cfa1077e560034db81885af8e1e885 upstream.

If insert_inode_locked() fails, we shouldn't be calling
unlock_new_inode().

Signed-off-by: Dave Kleikamp 
Tested-by: Michael L. Semon 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/jfs/jfs_inode.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/fs/jfs/jfs_inode.c
+++ b/fs/jfs/jfs_inode.c
@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *paren
 
if (insert_inode_locked(inode) < 0) {
rc = -EINVAL;
-   goto fail_unlock;
+   goto fail_put;
}
 
inode_init_owner(inode, parent, mode);
@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *paren
 fail_drop:
dquot_drop(inode);
inode->i_flags |= S_NOQUOTA;
-fail_unlock:
clear_nlink(inode);
unlock_new_inode(inode);
 fail_put:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.4 06/26] mac80211: update sta->last_rx on acked tx frames

[Greg Kroah-Hartman]

3.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

commit 0c5b93290b2f3c7a376567c03ae8d385b0e99851 upstream.

When clients are idle for too long, hostapd sends nullfunc frames for
probing. When those are acked by the client, the idle time needs to be
updated.

To make this work (and to avoid unnecessary probing), update sta->last_rx
whenever an ACK was received for a tx packet. Only do this if the flag
IEEE80211_HW_REPORTS_TX_ACK_STATUS is set.

Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/mac80211/status.c |3 +++
 1 file changed, 3 insertions(+)

--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -183,6 +183,9 @@ static void ieee80211_frame_acked(struct
struct ieee80211_local *local = sta->local;
struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+   if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+   sta->last_rx = jiffies;
+
if (ieee80211_is_data_qos(mgmt->frame_control)) {
struct ieee80211_hdr *hdr = (void *) skb->data;
u8 *qc = ieee80211_get_qos_ctl(hdr);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 12/74] mac80211: use sta_info_get_bss() for nl80211 tx and client probing

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

commit 03bb7f42765ce596604f03d179f3137d7df05bba upstream.

This allows calls for clients in AP_VLANs (e.g. for 4-addr) to succeed

Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/mac80211/cfg.c |2 +-
 net/mac80211/tx.c  |3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3315,7 +3315,7 @@ static int ieee80211_probe_client(struct
return -EINVAL;
}
band = chanctx_conf->def.chan->band;
-   sta = sta_info_get(sdata, peer);
+   sta = sta_info_get_bss(sdata, peer);
if (sta) {
qos = test_sta_flag(sta, WLAN_STA_WME);
} else {
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1100,7 +1100,8 @@ ieee80211_tx_prepare(struct ieee80211_su
tx->sta = rcu_dereference(sdata->u.vlan.sta);
if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
return TX_DROP;
-   } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+   } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
+ IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
   tx->sdata->control_port_protocol == tx->skb->protocol) {
tx->sta = sta_info_get_bss(sdata, hdr->addr1);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 13/74] mac80211: update sta->last_rx on acked tx frames

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

commit 0c5b93290b2f3c7a376567c03ae8d385b0e99851 upstream.

When clients are idle for too long, hostapd sends nullfunc frames for
probing. When those are acked by the client, the idle time needs to be
updated.

To make this work (and to avoid unnecessary probing), update sta->last_rx
whenever an ACK was received for a tx packet. Only do this if the flag
IEEE80211_HW_REPORTS_TX_ACK_STATUS is set.

Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/mac80211/status.c |3 +++
 1 file changed, 3 insertions(+)

--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct
struct ieee80211_local *local = sta->local;
struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+   if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+   sta->last_rx = jiffies;
+
if (ieee80211_is_data_qos(mgmt->frame_control)) {
struct ieee80211_hdr *hdr = (void *) skb->data;
u8 *qc = ieee80211_get_qos_ctl(hdr);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 14/74] mac80211: fix crash if bitrate calculation goes wrong

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Johannes Berg 

commit d86aa4f8ca58898ec6a94c0635da20b948171ed7 upstream.

If a frame's timestamp is calculated, and the bitrate
calculation goes wrong and returns zero, the system
will attempt to divide by zero and crash. Catch this
case and print the rate information that the driver
reported when this happens.

Reported-by: Thomas Lindroth 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/mac80211/util.c |4 
 1 file changed, 4 insertions(+)

--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2174,6 +2174,10 @@ u64 ieee80211_calculate_rx_timestamp(str
}
 
rate = cfg80211_calculate_bitrate();
+   if (WARN_ONCE(!rate,
+ "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
+ status->flag, status->rate_idx, status->vht_nss))
+   return 0;
 
/* rewind from end of MPDU */
if (status->flag & RX_FLAG_MACTIME_END)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 16/74] cfg80211: fix warning when using WEXT for IBSS

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Bruno Randolf 

commit f478f33a93f9353dcd1fe55445343d76b1c3f84a upstream.

Fix kernel warning when using WEXT for configuring ad-hoc mode,
e.g.  "iwconfig wlan0 essid test channel 1"

WARNING: at net/wireless/chan.c:373 cfg80211_chandef_usable+0x50/0x21c 
[cfg80211]()

The warning is caused by an uninitialized variable center_freq1.

Signed-off-by: Bruno Randolf 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/wireless/ibss.c |3 +++
 1 file changed, 3 insertions(+)

--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -269,6 +269,8 @@ int cfg80211_ibss_wext_join(struct cfg80
if (chan->flags & IEEE80211_CHAN_DISABLED)
continue;
wdev->wext.ibss.chandef.chan = chan;
+   wdev->wext.ibss.chandef.center_freq1 =
+   chan->center_freq;
break;
}
 
@@ -353,6 +355,7 @@ int cfg80211_ibss_wext_siwfreq(struct ne
if (chan) {
wdev->wext.ibss.chandef.chan = chan;
wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+   wdev->wext.ibss.chandef.center_freq1 = freq;
wdev->wext.ibss.channel_fixed = true;
} else {
/* cfg80211_ibss_wext_join will pick one if needed */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 17/74] mwifiex: fix SDIO interrupt lost issue

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Amitkumar Karwar 

commit 453b0c3f6910672f79da354077af728d92f95c5b upstream.

601216e "mwifiex: process RX packets in SDIO IRQ thread directly"
introduced a command timeout issue which can be reproduced easily on
an AM33xx platform using a test application written by Daniel Mack:

https://gist.github.com/zonque/6579314

mwifiex_main_process() is called from both the SDIO handler and
the workqueue. In case an interrupt occurs right after the
int_status check, but before updating the mwifiex_processing flag,
this interrupt gets lost, resulting in a command timeout and
consequently a card reset.

Let main_proc_lock protect both int_status and mwifiex_processing
flag. This fixes the interrupt lost issue.

Reported-by: Sven Neumann 
Reported-by: Andreas Fenkart 
Tested-by: Daniel Mack 
Reviewed-by: Dylan Reid 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Bing Zhao 
Signed-off-by: Paul Stewart 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/mwifiex/main.c |6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -270,10 +270,12 @@ process_start:
}
} while (true);
 
-   if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter))
+   spin_lock_irqsave(>main_proc_lock, flags);
+   if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) {
+   spin_unlock_irqrestore(>main_proc_lock, flags);
goto process_start;
+   }
 
-   spin_lock_irqsave(>main_proc_lock, flags);
adapter->mwifiex_processing = false;
spin_unlock_irqrestore(>main_proc_lock, flags);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 15/74] ath9k: fix tx queue scheduling after channel changes

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

commit ec30326ea773900da210c495e14cfeb532550ba2 upstream.

Otherwise, if queues are full during a scan, tx scheduling does not
resume after switching back to the home channel.

Signed-off-by: Felix Fietkau 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath9k/main.c |   23 +++
 1 file changed, 11 insertions(+), 12 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -209,6 +209,7 @@ static bool ath_complete_reset(struct at
struct ath_hw *ah = sc->sc_ah;
struct ath_common *common = ath9k_hw_common(ah);
unsigned long flags;
+   int i;
 
if (ath_startrecv(sc) != 0) {
ath_err(common, "Unable to restart recv logic\n");
@@ -236,6 +237,15 @@ static bool ath_complete_reset(struct at
}
work:
ath_restart_work(sc);
+
+   for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+   if (!ATH_TXQ_SETUP(sc, i))
+   continue;
+
+   spin_lock_bh(>tx.txq[i].axq_lock);
+   ath_txq_schedule(sc, >tx.txq[i]);
+   spin_unlock_bh(>tx.txq[i].axq_lock);
+   }
}
 
if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx != 3)
@@ -543,21 +553,10 @@ chip_reset:
 
 static int ath_reset(struct ath_softc *sc)
 {
-   int i, r;
+   int r;
 
ath9k_ps_wakeup(sc);
-
r = ath_reset_internal(sc, NULL);
-
-   for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-   if (!ATH_TXQ_SETUP(sc, i))
-   continue;
-
-   spin_lock_bh(>tx.txq[i].axq_lock);
-   ath_txq_schedule(sc, >tx.txq[i]);
-   spin_unlock_bh(>tx.txq[i].axq_lock);
-   }
-
ath9k_ps_restore(sc);
 
return r;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 18/74] rtlwifi: rtl8192cu: Fix error in pointer arithmetic

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mark Cave-Ayland 

commit 9473ca6e920a3b9ca902753ce52833657f9221cc upstream.

An error in calculating the offset in an skb causes the driver to read
essential device info from the wrong locations. The main effect is that
automatic gain calculations are nonsense.

Signed-off-by: Mark Cave-Ayland 
Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80
(bool)GET_RX_DESC_PAGGR(pdesc));
rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
if (phystatus) {
-   p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
+   p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+stats->rx_bufshift);
rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
 p_drvinfo);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 22/74] can: flexcan: fix mx28 detection by rearanging OF match table

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Kleine-Budde 

commit e358784297992b012e8071764d996191dd2b1a54 upstream.

The current implemetation of of_match_device() relies that the of_device_id
table in the driver is sorted from most specific to least specific compatible.

Without this patch the mx28 is detected as the less specific p1010. This leads
to a p1010 specific workaround is activated on the mx28, which is not needed.

Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/can/flexcan.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -983,9 +983,9 @@ static void unregister_flexcandev(struct
 }
 
 static const struct of_device_id flexcan_of_match[] = {
-   { .compatible = "fsl,p1010-flexcan", .data = _p1010_devtype_data, },
-   { .compatible = "fsl,imx28-flexcan", .data = _imx28_devtype_data, },
{ .compatible = "fsl,imx6q-flexcan", .data = _imx6q_devtype_data, },
+   { .compatible = "fsl,imx28-flexcan", .data = _imx28_devtype_data, },
+   { .compatible = "fsl,p1010-flexcan", .data = _p1010_devtype_data, },
{ /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, flexcan_of_match);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 19/74] iwlwifi: pcie: add SKUs for 6000, 6005 and 6235 series

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Emmanuel Grumbach 

commit 08a5dd3842f2ac61c6d69661d2d96022df8ae359 upstream.

Add some new PCI IDs to the table for 6000, 6005 and 6235 series.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/iwlwifi/iwl-6000.c   |6 ++
 drivers/net/wireless/iwlwifi/iwl-config.h |1 +
 drivers/net/wireless/iwlwifi/pcie/drv.c   |   10 ++
 3 files changed, 17 insertions(+)

--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -268,6 +268,12 @@ const struct iwl_cfg iwl6035_2agn_cfg =
.ht_params = _ht_params,
 };
 
+const struct iwl_cfg iwl6035_2agn_sff_cfg = {
+   .name = "Intel(R) Centrino(R) Ultimate-N 6235 AGN",
+   IWL_DEVICE_6035,
+   .ht_params = _ht_params,
+};
+
 const struct iwl_cfg iwl1030_bgn_cfg = {
.name = "Intel(R) Centrino(R) Wireless-N 1030 BGN",
IWL_DEVICE_6030,
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -316,6 +316,7 @@ extern const struct iwl_cfg iwl2000_2bgn
 extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
 extern const struct iwl_cfg iwl2030_2bgn_cfg;
 extern const struct iwl_cfg iwl6035_2agn_cfg;
+extern const struct iwl_cfg iwl6035_2agn_sff_cfg;
 extern const struct iwl_cfg iwl105_bgn_cfg;
 extern const struct iwl_cfg iwl105_bgn_d_cfg;
 extern const struct iwl_cfg iwl135_bgn_cfg;
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -138,13 +138,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
 
 /* 6x00 Series */
{IWL_PCI_DEVICE(0x422B, 0x1101, iwl6000_3agn_cfg)},
+   {IWL_PCI_DEVICE(0x422B, 0x1108, iwl6000_3agn_cfg)},
{IWL_PCI_DEVICE(0x422B, 0x1121, iwl6000_3agn_cfg)},
+   {IWL_PCI_DEVICE(0x422B, 0x1128, iwl6000_3agn_cfg)},
{IWL_PCI_DEVICE(0x422C, 0x1301, iwl6000i_2agn_cfg)},
{IWL_PCI_DEVICE(0x422C, 0x1306, iwl6000i_2abg_cfg)},
{IWL_PCI_DEVICE(0x422C, 0x1307, iwl6000i_2bg_cfg)},
{IWL_PCI_DEVICE(0x422C, 0x1321, iwl6000i_2agn_cfg)},
{IWL_PCI_DEVICE(0x422C, 0x1326, iwl6000i_2abg_cfg)},
{IWL_PCI_DEVICE(0x4238, 0x, iwl6000_3agn_cfg)},
+   {IWL_PCI_DEVICE(0x4238, 0x1118, iwl6000_3agn_cfg)},
{IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
{IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
 
@@ -152,12 +155,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
{IWL_PCI_DEVICE(0x0082, 0x1301, iwl6005_2agn_cfg)},
{IWL_PCI_DEVICE(0x0082, 0x1306, iwl6005_2abg_cfg)},
{IWL_PCI_DEVICE(0x0082, 0x1307, iwl6005_2bg_cfg)},
+   {IWL_PCI_DEVICE(0x0082, 0x1308, iwl6005_2agn_cfg)},
{IWL_PCI_DEVICE(0x0082, 0x1321, iwl6005_2agn_cfg)},
{IWL_PCI_DEVICE(0x0082, 0x1326, iwl6005_2abg_cfg)},
+   {IWL_PCI_DEVICE(0x0082, 0x1328, iwl6005_2agn_cfg)},
{IWL_PCI_DEVICE(0x0085, 0x1311, iwl6005_2agn_cfg)},
+   {IWL_PCI_DEVICE(0x0085, 0x1318, iwl6005_2agn_cfg)},
{IWL_PCI_DEVICE(0x0085, 0x1316, iwl6005_2abg_cfg)},
{IWL_PCI_DEVICE(0x0082, 0xC020, iwl6005_2agn_sff_cfg)},
{IWL_PCI_DEVICE(0x0085, 0xC220, iwl6005_2agn_sff_cfg)},
+   {IWL_PCI_DEVICE(0x0085, 0xC228, iwl6005_2agn_sff_cfg)},
{IWL_PCI_DEVICE(0x0082, 0x4820, iwl6005_2agn_d_cfg)},
{IWL_PCI_DEVICE(0x0082, 0x1304, iwl6005_2agn_mow1_cfg)},/* low 5GHz 
active */
{IWL_PCI_DEVICE(0x0082, 0x1305, iwl6005_2agn_mow2_cfg)},/* high 5GHz 
active */
@@ -239,8 +246,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
 
 /* 6x35 Series */
{IWL_PCI_DEVICE(0x088E, 0x4060, iwl6035_2agn_cfg)},
+   {IWL_PCI_DEVICE(0x088E, 0x406A, iwl6035_2agn_sff_cfg)},
{IWL_PCI_DEVICE(0x088F, 0x4260, iwl6035_2agn_cfg)},
+   {IWL_PCI_DEVICE(0x088F, 0x426A, iwl6035_2agn_sff_cfg)},
{IWL_PCI_DEVICE(0x088E, 0x4460, iwl6035_2agn_cfg)},
+   {IWL_PCI_DEVICE(0x088E, 0x446A, iwl6035_2agn_sff_cfg)},
{IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
{IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 23/74] can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and abort pending TX

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Kleine-Budde 

commit d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa upstream.

In patch

0d1862e can: flexcan: fix flexcan_chip_start() on imx6

the loop in flexcan_chip_start() that iterates over all mailboxes after the
soft reset of the CAN core was removed. This loop put all mailboxes (even the
ones marked as reserved 1...7) into EMPTY/INACTIVE mode. On mailboxes 8...63,
this aborts any pending TX messages.

After a cold boot there is random garbage in the mailboxes, which leads to
spontaneous transmit of CAN frames during first activation. Further if the
interface was disabled with a pending message (usually due to an error
condition on the CAN bus), this message is retransmitted after enabling the
interface again.

This patch fixes the regression by:
1) Limiting the maximum number of used mailboxes to 8, 0...7 are used by the RX
FIFO, 8 is used by TX.
2) Marking the TX mailbox as EMPTY/INACTIVE, so that any pending TX of that
mailbox is aborted.

Cc: Lothar Waßmann 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/can/flexcan.c |   10 --
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -63,7 +63,7 @@
 #define FLEXCAN_MCR_BCCBIT(16)
 #define FLEXCAN_MCR_LPRIO_EN   BIT(13)
 #define FLEXCAN_MCR_AENBIT(12)
-#define FLEXCAN_MCR_MAXMB(x)   ((x) & 0xf)
+#define FLEXCAN_MCR_MAXMB(x)   ((x) & 0x1f)
 #define FLEXCAN_MCR_IDAM_A (0 << 8)
 #define FLEXCAN_MCR_IDAM_B (1 << 8)
 #define FLEXCAN_MCR_IDAM_C (2 << 8)
@@ -745,9 +745,11 @@ static int flexcan_chip_start(struct net
 *
 */
reg_mcr = flexcan_read(>mcr);
+   reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
-   FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS;
+   FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS |
+   FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
flexcan_write(reg_mcr, >mcr);
 
@@ -792,6 +794,10 @@ static int flexcan_chip_start(struct net
>cantxfg[i].can_ctrl);
}
 
+   /* Abort any pending TX, mark Mailbox as INACTIVE */
+   flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+ >cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+
/* acceptance mask/acceptance code (accept everything) */
flexcan_write(0x0, >rxgmask);
flexcan_write(0x0, >rx14mask);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 24/74] SCSI: sd: call blk_pm_runtime_init before add_disk

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Aaron Lu 

commit 10c580e4239df5c3344ca00322eca86ab2de880b upstream.

Sujit has found a race condition that would make q->nr_pending
unbalanced, it occurs as Sujit explained:

"
sd_probe_async() ->
add_disk() ->
disk_add_event() ->
schedule(disk_events_workfn)
sd_revalidate_disk()
blk_pm_runtime_init()
return;

Let's say the disk_events_workfn() calls sd_check_events() which tries
to send test_unit_ready() and because of sd_revalidate_disk() trying to
send another commands the test_unit_ready() might be re-queued as the
tagged command queuing is disabled.

So the race condition is -

Thread 1  | Thread 2
sd_revalidate_disk()  | sd_check_events()
...nr_pending = 0 as q->dev = NULL| scsi_queue_insert()
blk_runtime_pm_init() | blk_pm_requeue_request() ->
  | nr_pending = -1 since
  | q->dev != NULL
"

The problem is, the test_unit_ready request doesn't get counted the
first time it is queued, so the later decrement of q->nr_pending in
blk_pm_requeue_request makes it unbalanced.

Fix this by calling blk_pm_runtime_init before add_disk so that all
requests initiated there will all be counted.

Signed-off-by: Aaron Lu 
Reported-and-tested-by: Sujit Reddy Thumma 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/sd.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2843,6 +2843,7 @@ static void sd_probe_async(void *data, a
gd->events |= DISK_EVENT_MEDIA_CHANGE;
}
 
+   blk_pm_runtime_init(sdp->request_queue, dev);
add_disk(gd);
if (sdkp->capacity)
sd_dif_config_host(sdkp);
@@ -2851,7 +2852,6 @@ static void sd_probe_async(void *data, a
 
sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
  sdp->removable ? "removable " : "");
-   blk_pm_runtime_init(sdp->request_queue, dev);
scsi_autopm_put_device(sdp);
put_device(>dev);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 21/74] can: at91-can: fix device to driver data mapping for platform devices

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Kleine-Budde 

commit 5abbeea553c8260ed4e2ac4aae962aff800b6c6d upstream.

In commit:

3078cde7 can: at91_can: add dt support

device tree support was added to the at91_can driver. In this commit the
mapping of device to driver data was mixed up. This results in the sam9x5
parameters being used for the sam9263 and the workaround for the broken mailbox
0 on the sam9263 not being activated.

This patch fixes the broken platform_device_id table.

Cc: Ludovic Desroches 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/can/at91_can.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -1409,10 +1409,10 @@ static int at91_can_remove(struct platfo
 
 static const struct platform_device_id at91_can_id_table[] = {
{
-   .name = "at91_can",
+   .name = "at91sam9x5_can",
.driver_data = (kernel_ulong_t)_at91sam9x5_data,
}, {
-   .name = "at91sam9x5_can",
+   .name = "at91_can",
.driver_data = (kernel_ulong_t)_at91sam9263_data,
}, {
/* sentinel */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 01/74] usb-storage: add quirk for mandatory READ_CAPACITY_16

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 32c37fc30c52508711ea6a108cfd5855b8a07176 upstream.

Some USB drive enclosures do not correctly report an
overflow condition if they hold a drive with a capacity
over 2TB and are confronted with a READ_CAPACITY_10.
They answer with their capacity modulo 2TB.
The generic layer cannot cope with that. It must be told
to use READ_CAPACITY_16 from the beginning.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/storage/scsiglue.c |5 -
 drivers/usb/storage/unusual_devs.h |7 +++
 include/linux/usb_usual.h  |4 +++-
 3 files changed, 14 insertions(+), 2 deletions(-)

--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -211,8 +211,11 @@ static int slave_configure(struct scsi_d
/*
 * Many devices do not respond properly to READ_CAPACITY_16.
 * Tell the SCSI layer to try READ_CAPACITY_10 first.
+* However some USB 3.0 drive enclosures return capacity
+* modulo 2TB. Those must use READ_CAPACITY_16
 */
-   sdev->try_rc_10_first = 1;
+   if (!(us->fflags & US_FL_NEEDS_CAP16))
+   sdev->try_rc_10_first = 1;
 
/* assume SPC3 or latter devices support sense size > 18 */
if (sdev->scsi_level > SCSI_SPC_2)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1925,6 +1925,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Oliver Neukum  */
+UNUSUAL_DEV(  0x174c, 0x55aa, 0x0100, 0x0100,
+   "ASMedia",
+   "AS2105",
+   USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+   US_FL_NEEDS_CAP16),
+
 /* Reported by Jesse Feddema  */
 UNUSUAL_DEV(  0x177f, 0x0400, 0x, 0x,
"Yarvik",
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -66,7 +66,9 @@
US_FLAG(INITIAL_READ10, 0x0010) \
/* Initial READ(10) (and others) must be retried */ \
US_FLAG(WRITE_CACHE,0x0020) \
-   /* Write Cache status is not available */
+   /* Write Cache status is not available */   \
+   US_FLAG(NEEDS_CAP16,0x0040)
+   /* cannot handle READ_CAPACITY_10 */
 
 #define US_FLAG(name, value)   US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 20/74] jfs: fix error path in ialloc

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dave Kleikamp 

commit 8660998608cfa1077e560034db81885af8e1e885 upstream.

If insert_inode_locked() fails, we shouldn't be calling
unlock_new_inode().

Signed-off-by: Dave Kleikamp 
Tested-by: Michael L. Semon 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/jfs/jfs_inode.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/fs/jfs/jfs_inode.c
+++ b/fs/jfs/jfs_inode.c
@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *paren
 
if (insert_inode_locked(inode) < 0) {
rc = -EINVAL;
-   goto fail_unlock;
+   goto fail_put;
}
 
inode_init_owner(inode, parent, mode);
@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *paren
 fail_drop:
dquot_drop(inode);
inode->i_flags |= S_NOQUOTA;
-fail_unlock:
clear_nlink(inode);
unlock_new_inode(inode);
 fail_put:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 29/74] md: avoid deadlock when md_set_badblocks.

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Bian Yu 

commit 905b0297a9533d7a6ee00a01a990456636877dd6 upstream.

When operate harddisk and hit errors, md_set_badblocks is called after
scsi_restart_operations which already disabled the irq. but md_set_badblocks
will call write_sequnlock_irq and enable irq. so softirq can preempt the
current thread and that may cause a deadlock. I think this situation should
use write_sequnlock_irqsave/irqrestore instead.

I met the situation and the call trace is below:
[  638.919974] BUG: spinlock recursion on CPU#0, scsi_eh_13/1010
[  638.921923]  lock: 0x8800d4d51fc8, .magic: dead4ead, .owner: 
scsi_eh_13/1010, .owner_cpu: 0
[  638.923890] CPU: 0 PID: 1010 Comm: scsi_eh_13 Not tainted 3.12.0-rc5+ #37
[  638.925844] Hardware name: To be filled by O.E.M. To be filled by 
O.E.M./MAHOBAY, BIOS 4.6.5 03/05/2013
[  638.927816]  880037ad4640 880118c03d50 8172ff85 
0007
[  638.929829]  8800d4d51fc8 880118c03d70 81730030 
8800d4d51fc8
[  638.931848]  81a72eb0 880118c03d90 81730056 
8800d4d51fc8
[  638.933884] Call Trace:
[  638.935867][] dump_stack+0x55/0x76
[  638.937878]  [] spin_dump+0x8a/0x8f
[  638.939861]  [] spin_bug+0x21/0x26
[  638.941836]  [] do_raw_spin_lock+0xa4/0xc0
[  638.943801]  [] _raw_spin_lock+0x66/0x80
[  638.945747]  [] ? scsi_device_unbusy+0x9d/0xd0
[  638.947672]  [] ? _raw_spin_unlock+0x2b/0x50
[  638.949595]  [] scsi_device_unbusy+0x9d/0xd0
[  638.951504]  [] scsi_finish_command+0x37/0xe0
[  638.953388]  [] scsi_softirq_done+0xa8/0x140
[  638.955248]  [] blk_done_softirq+0x7b/0x90
[  638.957116]  [] __do_softirq+0xfd/0x330
[  638.958987]  [] ? __lock_release+0x6f/0x100
[  638.960861]  [] call_softirq+0x1c/0x30
[  638.962724]  [] do_softirq+0x8d/0xc0
[  638.964565]  [] irq_exit+0x10e/0x150
[  638.966390]  [] smp_apic_timer_interrupt+0x4a/0x60
[  638.968223]  [] apic_timer_interrupt+0x6f/0x80
[  638.970079][] ? __lock_release+0x6f/0x100
[  638.971899]  [] ? _raw_spin_unlock_irq+0x3a/0x50
[  638.973691]  [] ? _raw_spin_unlock_irq+0x30/0x50
[  638.975475]  [] md_set_badblocks+0x1f3/0x4a0
[  638.977243]  [] rdev_set_badblocks+0x27/0x80
[  638.978988]  [] raid5_end_read_request+0x36b/0x4e0 
[raid456]
[  638.980723]  [] bio_endio+0x1d/0x40
[  638.982463]  [] req_bio_endio.isra.65+0x83/0xa0
[  638.984214]  [] blk_update_request+0x7f/0x350
[  638.985967]  [] blk_update_bidi_request+0x31/0x90
[  638.987710]  [] __blk_end_bidi_request+0x20/0x50
[  638.989439]  [] __blk_end_request_all+0x1f/0x30
[  638.991149]  [] blk_peek_request+0x106/0x250
[  638.992861]  [] ? scsi_kill_request.isra.32+0xe9/0x130
[  638.994561]  [] scsi_request_fn+0x4a/0x3d0
[  638.996251]  [] __blk_run_queue+0x37/0x50
[  638.997900]  [] blk_run_queue+0x2f/0x50
[  638.999553]  [] scsi_run_queue+0xe0/0x1c0
[  639.001185]  [] scsi_run_host_queues+0x21/0x40
[  639.002798]  [] scsi_restart_operations+0x177/0x200
[  639.004391]  [] scsi_error_handler+0xc9/0xe0
[  639.005996]  [] ? scsi_unjam_host+0xd0/0xd0
[  639.007600]  [] kthread+0xdb/0xe0
[  639.009205]  [] ? flush_kthread_worker+0x170/0x170
[  639.010821]  [] ret_from_fork+0x7c/0xb0
[  639.012437]  [] ? flush_kthread_worker+0x170/0x170

This bug was introduce in commit  2e8ac30312973dd20e68073653
(the first time rdev_set_badblock was call from interrupt context),
so this patch is appropriate for 3.5 and subsequent kernels.

Signed-off-by: Bian Yu 
Reviewed-by: Jianpeng Ma 
Signed-off-by: NeilBrown 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/md.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8072,6 +8072,7 @@ static int md_set_badblocks(struct badbl
u64 *p;
int lo, hi;
int rv = 1;
+   unsigned long flags;
 
if (bb->shift < 0)
/* badblocks are disabled */
@@ -8086,7 +8087,7 @@ static int md_set_badblocks(struct badbl
sectors = next - s;
}
 
-   write_seqlock_irq(>lock);
+   write_seqlock_irqsave(>lock, flags);
 
p = bb->page;
lo = 0;
@@ -8202,7 +8203,7 @@ static int md_set_badblocks(struct badbl
bb->changed = 1;
if (!acknowledged)
bb->unacked_exist = 1;
-   write_sequnlock_irq(>lock);
+   write_sequnlock_irqrestore(>lock, flags);
 
return rv;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 26/74] raid5: set bio bi_vcnt 0 for discard request

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Shaohua Li 

commit 37c61ff31e9b5e3fcf3cc6579f5c68f6ad40c4b1 upstream.

SCSI layer will add new payload for discard request. If two bios are merged
to one, the second bio has bi_vcnt 1 which is set in raid5. This will confuse
SCSI and cause oops.

Suitable for backport to 3.7+

Reported-by: Jes Sorensen 
Signed-off-by: Shaohua Li 
Signed-off-by: NeilBrown 
Acked-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/raid5.c |   12 
 1 file changed, 12 insertions(+)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -668,6 +668,12 @@ static void ops_run_io(struct stripe_hea
bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
bi->bi_io_vec[0].bv_offset = 0;
bi->bi_size = STRIPE_SIZE;
+   /*
+* If this is discard request, set bi_vcnt 0. We don't
+* want to confuse SCSI because SCSI will replace 
payload
+*/
+   if (rw & REQ_DISCARD)
+   bi->bi_vcnt = 0;
if (rrdev)
set_bit(R5_DOUBLE_LOCKED, >dev[i].flags);
 
@@ -706,6 +712,12 @@ static void ops_run_io(struct stripe_hea
rbi->bi_io_vec[0].bv_len = STRIPE_SIZE;
rbi->bi_io_vec[0].bv_offset = 0;
rbi->bi_size = STRIPE_SIZE;
+   /*
+* If this is discard request, set bi_vcnt 0. We don't
+* want to confuse SCSI because SCSI will replace 
payload
+*/
+   if (rw & REQ_DISCARD)
+   rbi->bi_vcnt = 0;
if (conf->mddev->gendisk)

trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
  rbi, 
disk_devt(conf->mddev->gendisk),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 25/74] ecryptfs: Fix memory leakage in keystore.c

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: "Geyslan G. Bem" 

commit 3edc8376c06133e3386265a824869cad03a4efd4 upstream.

In 'decrypt_pki_encrypted_session_key' function:

Initializes 'payload' pointer and releases it on exit.

Signed-off-by: Geyslan G. Bem 
Signed-off-by: Tyler Hicks 
Signed-off-by: Greg Kroah-Hartman 

---
 fs/ecryptfs/keystore.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1149,7 +1149,7 @@ decrypt_pki_encrypted_session_key(struct
struct ecryptfs_msg_ctx *msg_ctx;
struct ecryptfs_message *msg = NULL;
char *auth_tok_sig;
-   char *payload;
+   char *payload = NULL;
size_t payload_len = 0;
int rc;
 
@@ -1203,6 +1203,7 @@ decrypt_pki_encrypted_session_key(struct
}
 out:
kfree(msg);
+   kfree(payload);
return rc;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 32/74] vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger 

commit 60a01f558af9c48b0bb31f303c479e32721add3f upstream.

This patch addresses a long-standing bug where the get_user_pages_fast()
write parameter used for setting the underlying page table entry permission
bits was incorrectly set to write=1 for data_direction=DMA_TO_DEVICE, and
passed into get_user_pages_fast() via vhost_scsi_map_iov_to_sgl().

However, this parameter is intended to signal WRITEs to pinned userspace
PTEs for the virtio-scsi DMA_FROM_DEVICE -> READ payload case, and *not*
for the virtio-scsi DMA_TO_DEVICE -> WRITE payload case.

This bug would manifest itself as random process segmentation faults on
KVM host after repeated vhost starts + stops and/or with lots of vhost
endpoints + LUNs.

Cc: Stefan Hajnoczi 
Cc: Michael S. Tsirkin 
Cc: Asias He 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/vhost/scsi.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1017,7 +1017,7 @@ static void vhost_scsi_handle_vq(struct
if (data_direction != DMA_NONE) {
ret = vhost_scsi_map_iov_to_sgl(tv_cmd,
>iov[data_first], data_num,
-   data_direction == DMA_TO_DEVICE);
+   data_direction == DMA_FROM_DEVICE);
if (unlikely(ret)) {
vq_err(vq, "Failed to map iov to sgl\n");
goto err_free;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 30/74] md: Fix skipping recovery for read-only arrays.

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Lukasz Dorau 

commit 61e4947c99c4494336254ec540c50186d186150b upstream.

Since:
commit 7ceb17e87bde79d285a8b988cfed9eaeebe60b86
md: Allow devices to be re-added to a read-only array.

spares are activated on a read-only array. In case of raid1 and raid10
personalities it causes that not-in-sync devices are marked in-sync
without checking if recovery has been finished.

If a read-only array is degraded and one of its devices is not in-sync
(because the array has been only partially recovered) recovery will be skipped.

This patch adds checking if recovery has been finished before marking a device
in-sync for raid1 and raid10 personalities. In case of raid5 personality
such condition is already present (at raid5.c:6029).

Bug was introduced in 3.10 and causes data corruption.

Signed-off-by: Pawel Baldysiak 
Signed-off-by: Lukasz Dorau 
Signed-off-by: NeilBrown 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/raid1.c  |1 +
 drivers/md/raid10.c |1 +
 2 files changed, 2 insertions(+)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1479,6 +1479,7 @@ static int raid1_spare_active(struct mdd
}
}
if (rdev
+   && rdev->recovery_offset == MaxSector
&& !test_bit(Faulty, >flags)
&& !test_and_set_bit(In_sync, >flags)) {
count++;
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1762,6 +1762,7 @@ static int raid10_spare_active(struct md
}
sysfs_notify_dirent_safe(tmp->replacement->sysfs_state);
} else if (tmp->rdev
+  && tmp->rdev->recovery_offset == MaxSector
   && !test_bit(Faulty, >rdev->flags)
   && !test_and_set_bit(In_sync, >rdev->flags)) {
count++;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 27/74] raid5: avoid finding "discard" stripe

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Shaohua Li 

commit d47648fcf0611812286f68131b40251c6fa54f5e upstream.

SCSI discard will damage discard stripe bio setting, eg, some fields are
changed. If the stripe is reused very soon, we have wrong bios setting. We
remove discard stripe from hash list, so next time the strip will be fully
initialized.

Suitable for backport to 3.7+.

Signed-off-by: Shaohua Li 
Signed-off-by: NeilBrown 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/raid5.c |8 
 1 file changed, 8 insertions(+)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2812,6 +2812,14 @@ static void handle_stripe_clean_event(st
}
/* now that discard is done we can proceed with any sync */
clear_bit(STRIPE_DISCARD, >state);
+   /*
+* SCSI discard will change some bio fields and the stripe has
+* no updated data, so remove it from hash list and the stripe
+* will be reinitialized
+*/
+   spin_lock_irq(>device_lock);
+   remove_hash(sh);
+   spin_unlock_irq(>device_lock);
if (test_bit(STRIPE_SYNC_REQUESTED, >state))
set_bit(STRIPE_HANDLE, >state);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 31/74] target/pscsi: fix return value check

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 58932e96e438cd78f75e765d7b87ef39d3533d15 upstream.

In case of error, the function scsi_host_lookup() returns NULL
pointer not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.

Signed-off-by: Wei Yongjun 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/target/target_core_pscsi.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -134,10 +134,10 @@ static int pscsi_pmode_enable_hba(struct
 * pSCSI Host ID and enable for phba mode
 */
sh = scsi_host_lookup(phv->phv_host_id);
-   if (IS_ERR(sh)) {
+   if (!sh) {
pr_err("pSCSI: Unable to locate SCSI Host for"
" phv_host_id: %d\n", phv->phv_host_id);
-   return PTR_ERR(sh);
+   return -EINVAL;
}
 
phv->phv_lld_host = sh;
@@ -515,10 +515,10 @@ static int pscsi_configure_device(struct
sh = phv->phv_lld_host;
} else {
sh = scsi_host_lookup(pdv->pdv_host_id);
-   if (IS_ERR(sh)) {
+   if (!sh) {
pr_err("pSCSI: Unable to locate"
" pdv_host_id: %d\n", pdv->pdv_host_id);
-   return PTR_ERR(sh);
+   return -EINVAL;
}
}
} else {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 02/74] USB: support new huawei devices in option.c

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: "Fangxiaozhi (Franko)" 

commit d544db293a44a2a3b09feab7dbd59668b692de71 upstream.

Add new supporting declarations to option.c, to support Huawei new
devices with new bInterfaceSubClass value.

Signed-off-by: fangxiaozhi 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/serial/option.c |  216 
 1 file changed, 216 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -693,6 +693,222 @@ static const struct usb_device_id option
{ USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
{ USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7B) },
{ USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7C) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x01) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x02) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x03) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x04) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x05) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x06) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0A) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0B) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0D) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0E) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0F) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x10) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x12) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x13) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x14) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x15) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x17) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x18) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x19) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1A) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1B) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1C) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x31) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x32) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x33) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x34) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x35) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x36) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3A) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3B) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3D) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3E) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3F) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x48) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x49) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4A) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4B) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4C) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x61) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x62) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x63) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x64) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x65) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x66) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6A) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6B) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
+   { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
+   { 

[PATCH 3.10 35/74] scripts/kallsyms: filter symbols not in kernel address space

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Ming Lei 

commit f6537f2f0eba4eba3354e48dbe3047db6d8b6254 upstream.

This patch uses CONFIG_PAGE_OFFSET to filter symbols which
are not in kernel address space because these symbols are
generally for generating code purpose and can't be run at
kernel mode, so we needn't keep them in /proc/kallsyms.

For example, on ARM there are some symbols which may be
linked in relocatable code section, then perf can't parse
symbols any more from /proc/kallsyms, this patch fixes the
problem (introduced b9b32bf70f2fb710b07c94e13afbc729afe221da)

Cc: Russell King 
Cc: linux-arm-ker...@lists.infradead.org
Cc: Michal Marek 
Signed-off-by: Ming Lei 
Signed-off-by: Rusty Russell 
Signed-off-by: Greg Kroah-Hartman 

---
 scripts/kallsyms.c  |   12 +++-
 scripts/link-vmlinux.sh |2 ++
 2 files changed, 13 insertions(+), 1 deletion(-)

--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -55,6 +55,7 @@ static struct sym_entry *table;
 static unsigned int table_size, table_cnt;
 static int all_symbols = 0;
 static char symbol_prefix_char = '\0';
+static unsigned long long kernel_start_addr = 0;
 
 int token_profit[0x1];
 
@@ -65,7 +66,10 @@ unsigned char best_table_len[256];
 
 static void usage(void)
 {
-   fprintf(stderr, "Usage: kallsyms [--all-symbols] 
[--symbol-prefix=] < in.map > out.S\n");
+   fprintf(stderr, "Usage: kallsyms [--all-symbols] "
+   "[--symbol-prefix=] "
+   "[--page-offset=] "
+   "< in.map > out.S\n");
exit(1);
 }
 
@@ -194,6 +198,9 @@ static int symbol_valid(struct sym_entry
int i;
int offset = 1;
 
+   if (s->addr < kernel_start_addr)
+   return 0;
+
/* skip prefix char */
if (symbol_prefix_char && *(s->sym + 1) == symbol_prefix_char)
offset++;
@@ -646,6 +653,9 @@ int main(int argc, char **argv)
if ((*p == '"' && *(p+2) == '"') || (*p == '\'' 
&& *(p+2) == '\''))
p++;
symbol_prefix_char = *p;
+   } else if (strncmp(argv[i], "--page-offset=", 14) == 0) 
{
+   const char *p = [i][14];
+   kernel_start_addr = strtoull(p, NULL, 16);
} else
usage();
}
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -82,6 +82,8 @@ kallsyms()
kallsymopt="${kallsymopt} --all-symbols"
fi
 
+   kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
+
local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}   \
  ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS}"
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 39/74] ALSA: hda - Add a fixup for ASUS N76VZ

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 6fc16e58adf50c0f1e4478538983fb5ff6f453d4 upstream.

ASUS N76VZ needs the same fixup as N56VZ for supporting the boost
speaker.

Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=846529
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/patch_realtek.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4253,6 +4253,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x1028, 0x05db, "Dell", 
ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
+   SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_ASUS_MODE4),
SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 33/74] clockevents: Sanitize ticks to nsec conversion

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Gleixner 

commit 97b9410643475d6557d2517c2aff9fd2221141a9 upstream.

Marc Kleine-Budde pointed out, that commit 77cc982 "clocksource: use
clockevents_config_and_register() where possible" caused a regression
for some of the converted subarchs.

The reason is, that the clockevents core code converts the minimal
hardware tick delta to a nanosecond value for core internal
usage. This conversion is affected by integer math rounding loss, so
the backwards conversion to hardware ticks will likely result in a
value which is less than the configured hardware limitation. The
affected subarchs used their own workaround (SIGH!) which got lost in
the conversion.

The solution for the issue at hand is simple: adding evt->mult - 1 to
the shifted value before the integer divison in the core conversion
function takes care of it. But this only works for the case where for
the scaled math mult/shift pair "mult <= 1 << shift" is true. For the
case where "mult > 1 << shift" we can apply the rounding add only for
the minimum delta value to make sure that the backward conversion is
not less than the given hardware limit. For the upper bound we need to
omit the rounding add, because the backwards conversion is always
larger than the original latch value. That would violate the upper
bound of the hardware device.

Though looking closer at the details of that function reveals another
bogosity: The upper bounds check is broken as well. Checking for a
resulting "clc" value greater than KTIME_MAX after the conversion is
pointless. The conversion does:

  u64 clc = (latch << evt->shift) / evt->mult;

So there is no sanity check for (latch << evt->shift) exceeding the
64bit boundary. The latch argument is "unsigned long", so on a 64bit
arch the handed in argument could easily lead to an unnoticed shift
overflow. With the above rounding fix applied the calculation before
the divison is:

   u64 clc = (latch << evt->shift) + evt->mult - 1;

So we need to make sure, that neither the shift nor the rounding add
is overflowing the u64 boundary.

[ukl: move assignment to rnd after eventually changing mult, fix build
 issue and correct comment with the right math]

Signed-off-by: Thomas Gleixner 
Cc: Russell King - ARM Linux 
Cc: Marc Kleine-Budde 
Cc: nicolas.fe...@atmel.com
Cc: Marc Pignat 
Cc: john.stu...@linaro.org
Cc: ker...@pengutronix.de
Cc: Ronald Wahl 
Cc: LAK 
Cc: Ludovic Desroches 
Link: 
http://lkml.kernel.org/r/1380052223-24139-1-git-send-email-u.kleine-koe...@pengutronix.de
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/time/clockevents.c |   65 +++---
 1 file changed, 50 insertions(+), 15 deletions(-)

--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -30,29 +30,64 @@ static RAW_NOTIFIER_HEAD(clockevents_cha
 /* Protection for the above */
 static DEFINE_RAW_SPINLOCK(clockevents_lock);
 
-/**
- * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
- * @latch: value to convert
- * @evt:   pointer to clock event device descriptor
- *
- * Math helper, returns latch value converted to nanoseconds (bound checked)
- */
-u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
+static u64 cev_delta2ns(unsigned long latch, struct clock_event_device *evt,
+   bool ismax)
 {
u64 clc = (u64) latch << evt->shift;
+   u64 rnd;
 
if (unlikely(!evt->mult)) {
evt->mult = 1;
WARN_ON(1);
}
+   rnd = (u64) evt->mult - 1;
+
+   /*
+* Upper bound sanity check. If the backwards conversion is
+* not equal latch, we know that the above shift overflowed.
+*/
+   if ((clc >> evt->shift) != (u64)latch)
+   clc = ~0ULL;
+
+   /*
+* Scaled math oddities:
+*
+* For mult <= (1 << shift) we can safely add mult - 1 to
+* prevent integer rounding loss. So the backwards conversion
+* from nsec to device ticks will be correct.
+*
+* For mult > (1 << shift), i.e. device frequency is > 1GHz we
+* need to be careful. Adding mult - 1 will result in a value
+* which when converted back to device ticks can be larger
+* than latch by up to (mult - 1) >> shift. For the min_delta
+* calculation we still want to apply this in order to stay
+* above the minimum device ticks limit. For the upper limit
+* we would end up with a latch value larger than the upper
+* limit of the device, so we omit the add to stay below the
+* device upper boundary.
+*
+* Also omit the add if it would overflow the u64 boundary.
+*/
+   if ((~0ULL - clc > rnd) &&
+   (!ismax || evt->mult <= (1U << evt->shift)))
+   clc += rnd;
 

[PATCH 3.10 28/74] libata: make ata_eh_qc_retry() bump scmd->allowed on bogus failures

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Gwendal Grignou 

commit f13e220161e738c2710b9904dcb3cf8bb0bcce61 upstream.

libata EH decrements scmd->retries when the command failed for reasons
unrelated to the command itself so that, for example, commands aborted
due to suspend / resume cycle don't get penalized; however,
decrementing scmd->retries isn't enough for ATA passthrough commands.

Without this fix, ATA passthrough commands are not resend to the
drive, and no error is signalled to the caller because:

- allowed retry count is 1
- ata_eh_qc_complete fill the sense data, so result is valid
- sense data is filled with untouched ATA registers.

Signed-off-by: Gwendal Grignou 
Signed-off-by: Tejun Heo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ata/libata-eh.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1322,14 +1322,14 @@ void ata_eh_qc_complete(struct ata_queue
  * should be retried.  To be used from EH.
  *
  * SCSI midlayer limits the number of retries to scmd->allowed.
- * scmd->retries is decremented for commands which get retried
+ * scmd->allowed is incremented for commands which get retried
  * due to unrelated failures (qc->err_mask is zero).
  */
 void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 {
struct scsi_cmnd *scmd = qc->scsicmd;
-   if (!qc->err_mask && scmd->retries)
-   scmd->retries--;
+   if (!qc->err_mask)
+   scmd->allowed++;
__ata_eh_qc_complete(qc);
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 36/74] ARC: Incorrect mm reference used in vmalloc fault handler

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Vineet Gupta 

commit 9c41f4eeb9d51f3ece20428d35a3ea32cf3b5622 upstream.

A vmalloc fault needs to sync up PGD/PTE entry from init_mm to current
task's "active_mm".  ARC vmalloc fault handler however was using mm.

A vmalloc fault for non user task context (actually pre-userland, from
init thread's open for /dev/console) caused the handler to deref NULL mm
(for mm->pgd)

The reasons it worked so far is amazing:

1. By default (!SMP), vmalloc fault handler uses a cached value of PGD.
   In SMP that MMU register is repurposed hence need for mm pointer deref.

2. In pre-3.12 SMP kernel, the problem triggering vmalloc didn't exist in
   pre-userland code path - it was introduced with commit 20bafb3d23d108bc
   "n_tty: Move buffers into n_tty_data"

Signed-off-by: Vineet Gupta 
Cc: Gilad Ben-Yossef 
Cc: Noam Camus 
Cc: Peter Hurley 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/mm/fault.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -16,7 +16,7 @@
 #include 
 #include 
 
-static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
+static int handle_vmalloc_fault(unsigned long address)
 {
/*
 * Synchronize this task's top level page-table
@@ -26,7 +26,7 @@ static int handle_vmalloc_fault(struct m
pud_t *pud, *pud_k;
pmd_t *pmd, *pmd_k;
 
-   pgd = pgd_offset_fast(mm, address);
+   pgd = pgd_offset_fast(current->active_mm, address);
pgd_k = pgd_offset_k(address);
 
if (!pgd_present(*pgd_k))
@@ -72,7 +72,7 @@ void do_page_fault(struct pt_regs *regs,
 * nothing more.
 */
if (address >= VMALLOC_START && address <= VMALLOC_END) {
-   ret = handle_vmalloc_fault(mm, address);
+   ret = handle_vmalloc_fault(address);
if (unlikely(ret))
goto bad_area_nosemaphore;
else


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 34/74] parisc: Do not crash 64bit SMP kernels on machines with >= 4GB RAM

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Helge Deller 

commit 54e181e073fc1415e41917d725ebdbd7de956455 upstream.

Since the beginning of the parisc-linux port, sometimes 64bit SMP kernels were
not able to bring up other CPUs than the monarch CPU and instead crashed the
kernel.  The reason was unclear, esp. since it involved various machines (e.g.
J5600, J6750 and SuperDome). Testing showed, that those crashes didn't happened
when less than 4GB were installed, or if a 32bit Linux kernel was booted.

In the end, the fix for those SMP problems is trivial:
During the early phase of the initialization of the CPUs, including the monarch
CPU, the PDC_PSW firmware function to enable WIDE (=64bit) mode is called.
It's documented that this firmware function may clobber various registers, and
one one of those possibly clobbered registers is %cr30 which holds the task
thread info pointer.

Now, if %cr30 would always have been clobbered, then this bug would have been
detected much earlier. But lots of testing finally showed, that - at least for
%cr30 - on some machines only the upper 32bits of the 64bit register suddenly
turned zero after the firmware call.

So, after finding the root cause, the explanation for the various crashes
became clear:
- On 32bit SMP Linux kernels all upper 32bit were zero, so we didn't faced this
  problem.
- Monarch CPUs in 64bit mode always booted sucessfully, because the inital task
  thread info pointer was below 4GB.
- Secondary CPUs booted sucessfully on machines with less than 4GB RAM because
  the upper 32bit were zero anyay.
- Secondary CPus failed to boot if we had more than 4GB RAM and the task thread
  info pointer was located above the 4GB boundary.

Finally, the patch to fix this problem is trivial by saving the %cr30 register
before the firmware call and restoring it afterwards.

Signed-off-by: Helge Deller 
Signed-off-by: John David Anglin 
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/parisc/kernel/head.S |4 
 1 file changed, 4 insertions(+)

--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
ldw MEM_PDC_HI(%r0),%r6
depd%r6, 31, 32, %r3/* move to upper word */
 
+   mfctl   %cr30,%r6   /* PCX-W2 firmware bug */
+
ldo PDC_PSW(%r0),%arg0  /* 21 */
ldo PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
ldo PDC_PSW_WIDE_BIT(%r0),%arg2 /* 2 */
@@ -203,6 +205,8 @@ common_stext:
copy%r0,%arg3
 
 stext_pdc_ret:
+   mtctl   %r6,%cr30   /* restore task thread info */
+
/* restore rfi target address*/
ldd TI_TASK-THREAD_SZ_ALGN(%sp), %r10
tophys_r1   %r10


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 37/74] ALSA: hda - Add missing initial vmaster hook at build_controls callback

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit b63eae0a6c84839275a4638a7baa391be965cd0e upstream.

The generic parser has a support of vmaster hook, but this is
initialized only in the init callback with the check of the presence
of the corresponding kctl.  However, since kctl is NULL at the very
first init callback that is called before build_controls callback, the
vmaster hook sync is skipped there.  Eventually this leads to the
uninitialized state depending on the hook implementation.

This patch adds a simple workaround, just calling the sync function
explicitly at build_controls callback.

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/hda_generic.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -4383,9 +4383,11 @@ int snd_hda_gen_build_controls(struct hd
true, >vmaster_mute.sw_kctl);
if (err < 0)
return err;
-   if (spec->vmaster_mute.hook)
+   if (spec->vmaster_mute.hook) {
snd_hda_add_vmaster_hook(codec, >vmaster_mute,
 spec->vmaster_mute_enum);
+   snd_hda_sync_vmaster_hook(>vmaster_mute);
+   }
}
 
free_kctls(spec); /* no longer needed */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 07/74] cpufreq / intel_pstate: Fix max_perf_pct on resume

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dirk Brandewie 

commit 52e0a509e5d6f902ec26bc2a8bb02b137dc453be upstream.

If the system is suspended while max_perf_pct is less than 100 percent
or no_turbo set policy->{min,max} will be set incorrectly with scaled
values which turn the scaled values into hard limits.

References: https://bugzilla.kernel.org/show_bug.cgi?id=61241
Reported-by: Patrick Bartels 
Signed-off-by: Dirk Brandewie 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/cpufreq/intel_pstate.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -629,8 +629,8 @@ static int __cpuinit intel_pstate_cpu_ex
 
 static int __cpuinit intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
-   int rc, min_pstate, max_pstate;
struct cpudata *cpu;
+   int rc;
 
rc = intel_pstate_init_cpu(policy->cpu);
if (rc)
@@ -644,9 +644,8 @@ static int __cpuinit intel_pstate_cpu_in
else
policy->policy = CPUFREQ_POLICY_POWERSAVE;
 
-   intel_pstate_get_min_max(cpu, _pstate, _pstate);
-   policy->min = min_pstate * 10;
-   policy->max = max_pstate * 10;
+   policy->min = cpu->pstate.min_pstate * 10;
+   policy->max = cpu->pstate.turbo_pstate * 10;
 
/* cpuinfo and default policy values */
policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 10;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 03/74] USB: quirks.c: add one device that cannot deal with suspension

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 4294bca7b423d1a5aa24307e3d112a04075e3763 upstream.

The device is not responsive when resumed, unless it is reset.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/core/quirks.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -130,6 +130,9 @@ static const struct usb_device_id usb_qu
/* Broadcom BCM92035DGROM BT dongle */
{ USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
 
+   /* MAYA44USB sound device */
+   { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Action Semiconductor flash disk */
{ USB_DEVICE(0x10d6, 0x2200), .driver_info =
USB_QUIRK_STRING_FETCH_255 },


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 05/74] USB: serial: ftdi_sio: add id for Z3X Box device

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Алексей Крамаренко 

commit e1466ad5b1aeda303f9282463d55798d2eda218c upstream.

Custom VID/PID for Z3X Box device, popular tool for cellphone flashing.

Signed-off-by: Alexey E. Kramarenko 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/serial/ftdi_sio.c |1 +
 drivers/usb/serial/ftdi_sio_ids.h |6 ++
 2 files changed, 7 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -906,6 +906,7 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
/* Crucible Devices */
{ USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
+   { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
{ },/* Optional parameter entry */
{ } /* Terminating entry */
 };
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1307,3 +1307,9 @@
  * Manufacturer: Crucible Technologies
  */
 #define FTDI_CT_COMET_PID  0x8e08
+
+/*
+ * Product: Z3X Box
+ * Manufacturer: Smart GSM Team
+ */
+#define FTDI_Z3X_PID   0x0011


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 08/74] bcache: Fixed incorrect order of arguments to bio_alloc_bioset()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Kent Overstreet 

commit d4eddd42f592a0cf06818fae694a3d271f842e4d upstream.

Signed-off-by: Kent Overstreet 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/bcache/request.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -1059,7 +1059,7 @@ static void request_write(struct cached_
 
if (bio->bi_rw & REQ_FLUSH) {
/* Also need to send a flush to the backing device */
-   struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
+   struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
 
dc->disk.bio_split);
 
flush->bi_rw= WRITE_FLUSH;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 09/74] cgroup: fix to break the while loop in cgroup_attach_task() correctly

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Anjana V Kumar 

commit ea84753c98a7ac6b74e530b64c444a912b3835ca upstream.

Both Anjana and Eunki reported a stall in the while_each_thread loop
in cgroup_attach_task().

It's because, when we attach a single thread to a cgroup, if the cgroup
is exiting or is already in that cgroup, we won't break the loop.

If the task is already in the cgroup, the bug can lead to another thread
being attached to the cgroup unexpectedly:

  # echo 5207 > tasks
  # cat tasks
  5207
  # echo 5207 > tasks
  # cat tasks
  5207
  5215

What's worse, if the task to be attached isn't the leader of the thread
group, we might never exit the loop, hence cpu stall. Thanks for Oleg's
analysis.

This bug was introduced by commit 081aa458c38ba576bdd4265fc807fa95b48b9e79
("cgroup: consolidate cgroup_attach_task() and cgroup_attach_proc()")

[ lizf: - fixed the first continue, pointed out by Oleg,
- rewrote changelog. ]

Reported-by: Eunki Kim 
Reported-by: Anjana V Kumar 
Signed-off-by: Anjana V Kumar 
Signed-off-by: Li Zefan 
Signed-off-by: Tejun Heo 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/cgroup.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1995,7 +1995,7 @@ static int cgroup_attach_task(struct cgr
 
/* @tsk either already exited or can't exit until the end */
if (tsk->flags & PF_EXITING)
-   continue;
+   goto next;
 
/* as per above, nr_threads may decrease, but not increase. */
BUG_ON(i >= group_size);
@@ -2003,7 +2003,7 @@ static int cgroup_attach_task(struct cgr
ent.cgrp = task_cgroup_from_root(tsk, root);
/* nothing to do if this task is already in the cgroup */
if (ent.cgrp == cgrp)
-   continue;
+   goto next;
/*
 * saying GFP_ATOMIC has no effect here because we did prealloc
 * earlier, but it's good form to communicate our expectations.
@@ -2011,7 +2011,7 @@ static int cgroup_attach_task(struct cgr
retval = flex_array_put(group, i, , GFP_ATOMIC);
BUG_ON(retval != 0);
i++;
-
+   next:
if (!threadgroup)
break;
} while_each_thread(leader, tsk);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 38/74] ALSA: hda - Fix unbalanced runtime PM refcount after S3/S4

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit e6bbe73ab044a3d39ddb74e4d9a401cf1d6f upstream.

When a machine goes to S3/S4 after power-save is enabled, the runtime
PM refcount might be incorrectly decreased because the power-down
triggered soon after resume assumes that the controller was already
powered up, and issues the pm_notify down.

This patch fixes the incorrect pm_notify call simply by checking the
current value properly.

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/pci/hda/hda_codec.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -4789,8 +4789,8 @@ static void hda_power_work(struct work_s
spin_unlock(>power_lock);
 
state = hda_call_codec_suspend(codec, true);
-   codec->pm_down_notified = 0;
-   if (!bus->power_keep_link_on && (state & AC_PWRST_CLK_STOP_OK)) {
+   if (!codec->pm_down_notified &&
+   !bus->power_keep_link_on && (state & AC_PWRST_CLK_STOP_OK)) {
codec->pm_down_notified = 1;
hda_call_pm_notify(bus, false);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 40/74] ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Russell King 

commit a4461f41b94cb52e0141af717dcf4ef6558c8e2e upstream.

Unable to handle kernel NULL pointer dereference at virtual address 0008
pgd = d530
[0008] *pgd=0d265831, *pte=, *ppte=
Internal error: Oops: 17 [#1] PREEMPT ARM
CPU: 0 PID: 2295 Comm: vlc Not tainted 3.11.0+ #755
task: dee74800 ti: e213c000 task.ti: e213c000
PC is at snd_pcm_info+0xc8/0xd8
LR is at 0x30232065
pc : []lr : [<30232065>]psr: a0070013
sp : e213dea8  ip : d81cb0d0  fp : c05f7678
r10: c05f7770  r9 : fdfd  r8 : 
r7 : d8a968a8  r6 : d8a96800  r5 : d8a96200  r4 : d81cb000
r3 :   r2 : d81cb000  r1 : 0001  r0 : d8a96200
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 15300019  DAC: 0015
Process vlc (pid: 2295, stack limit = 0xe213c248)
[] (snd_pcm_info) from [] (snd_pcm_info_user+0x34/0x9c)
[] (snd_pcm_info_user) from [] 
(snd_pcm_control_ioctl+0x274/0x280)
[] (snd_pcm_control_ioctl) from [] 
(snd_ctl_ioctl+0xc0/0x55c)
[] (snd_ctl_ioctl) from [] (do_vfs_ioctl+0x80/0x31c)
[] (do_vfs_ioctl) from [] (SyS_ioctl+0x3c/0x60)
[] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x48)
Code: e1a5 e59530dc e3a01001 e1a02004 (e5933008)
---[ end trace cb3d9bdb8dfefb3c ]---

This is provoked when the ASoC front end is open along with its backend,
(which causes the backend to have a runtime assigned to it) and then the
SNDRV_CTL_IOCTL_PCM_INFO is requested for the (visible) backend device.

Resolve this by ensuring that ASoC internal backend devices are not
visible to userspace, just as the commentry for snd_pcm_new_internal()
says it should be.

Signed-off-by: Russell King 
Acked-by: Mark Brown 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/core/pcm.c |4 
 1 file changed, 4 insertions(+)

--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -49,6 +49,8 @@ static struct snd_pcm *snd_pcm_get(struc
struct snd_pcm *pcm;
 
list_for_each_entry(pcm, _pcm_devices, list) {
+   if (pcm->internal)
+   continue;
if (pcm->card == card && pcm->device == device)
return pcm;
}
@@ -60,6 +62,8 @@ static int snd_pcm_next(struct snd_card
struct snd_pcm *pcm;
 
list_for_each_entry(pcm, _pcm_devices, list) {
+   if (pcm->internal)
+   continue;
if (pcm->card == card && pcm->device > device)
return pcm->device;
else if (pcm->card->number > card->number)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 04/74] USB: quirks: add touchscreen that is dazzeled by remote wakeup

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 614ced91fc6fbb5a1cdd12f0f1b6c9197d9f1350 upstream.

The device descriptors are messed up after remote wakeup

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/core/quirks.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -97,6 +97,9 @@ static const struct usb_device_id usb_qu
/* Alcor Micro Corp. Hub */
{ USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME },
 
+   /* MicroTouch Systems touchscreen */
+   { USB_DEVICE(0x0596, 0x051e), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* appletouch */
{ USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 06/74] x86: Update UV3 hub revision ID

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Russ Anderson 

commit dd3c9c4b603c664fedc12facf180db0f1794aafe upstream.

The UV3 hub revision ID is different than expected.  The first
revision was supposed to start at 1 but instead will start at 0.

Signed-off-by: Russ Anderson 
Link: http://lkml.kernel.org/r/20131014161733.ga6...@sgi.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/kernel/apic/x2apic_uv_x.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -98,7 +98,7 @@ static int __init early_get_pnodeid(void
break;
case UV3_HUB_PART_NUMBER:
case UV3_HUB_PART_NUMBER_X:
-   uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
+   uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
break;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 61/74] mm: Close races between THP migration and PMD numa clearing

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

commit 3f926ab945b60a5824369d21add7710622a2eac0 upstream.

THP migration uses the page lock to guard against parallel allocations
but there are cases like this still open

  Task ATask B
  - -
  do_huge_pmd_numa_page do_huge_pmd_numa_page
  lock_page
  mpol_misplaced == -1
  unlock_page
  goto clear_pmdnuma
lock_page
mpol_misplaced == 2
migrate_misplaced_transhuge
  pmd = pmd_mknonnuma
  set_pmd_at

During hours of testing, one crashed with weird errors and while I have
no direct evidence, I suspect something like the race above happened.
This patch extends the page lock to being held until the pmd_numa is
cleared to prevent migration starting in parallel while the pmd_numa is
being cleared. It also flushes the old pmd entry and orders pagetable
insertion before rmap insertion.

Signed-off-by: Mel Gorman 
Reviewed-by: Rik van Riel 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Srikar Dronamraju 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1381141781-10992-9-git-send-email-mgor...@suse.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/huge_memory.c |   33 +++--
 mm/migrate.c |   19 +++
 2 files changed, 26 insertions(+), 26 deletions(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1314,24 +1314,25 @@ int do_huge_pmd_numa_page(struct mm_stru
target_nid = mpol_misplaced(page, vma, haddr);
if (target_nid == -1) {
/* If the page was locked, there are no parallel migrations */
-   if (page_locked) {
-   unlock_page(page);
+   if (page_locked)
goto clear_pmdnuma;
-   }
 
-   /* Otherwise wait for potential migrations and retry fault */
+   /*
+* Otherwise wait for potential migrations and retry. We do
+* relock and check_same as the page may no longer be mapped.
+* As the fault is being retried, do not account for it.
+*/
spin_unlock(>page_table_lock);
wait_on_page_locked(page);
+   page_nid = -1;
goto out;
}
 
/* Page is misplaced, serialise migrations and parallel THP splits */
get_page(page);
spin_unlock(>page_table_lock);
-   if (!page_locked) {
+   if (!page_locked)
lock_page(page);
-   page_locked = true;
-   }
anon_vma = page_lock_anon_vma_read(page);
 
/* Confirm the PTE did not while locked */
@@ -1339,32 +1340,28 @@ int do_huge_pmd_numa_page(struct mm_stru
if (unlikely(!pmd_same(pmd, *pmdp))) {
unlock_page(page);
put_page(page);
+   page_nid = -1;
goto out_unlock;
}
 
-   /* Migrate the THP to the requested node */
+   /*
+* Migrate the THP to the requested node, returns with page unlocked
+* and pmd_numa cleared.
+*/
spin_unlock(>page_table_lock);
migrated = migrate_misplaced_transhuge_page(mm, vma,
pmdp, pmd, addr, page, target_nid);
if (migrated)
page_nid = target_nid;
-   else
-   goto check_same;
 
goto out;
-
-check_same:
-   spin_lock(>page_table_lock);
-   if (unlikely(!pmd_same(pmd, *pmdp))) {
-   /* Someone else took our fault */
-   page_nid = -1;
-   goto out_unlock;
-   }
 clear_pmdnuma:
+   BUG_ON(!PageLocked(page));
pmd = pmd_mknonnuma(pmd);
set_pmd_at(mm, haddr, pmdp, pmd);
VM_BUG_ON(pmd_numa(*pmdp));
update_mmu_cache_pmd(vma, addr, pmdp);
+   unlock_page(page);
 out_unlock:
spin_unlock(>page_table_lock);
 
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1710,12 +1710,12 @@ int migrate_misplaced_transhuge_page(str
unlock_page(new_page);
put_page(new_page); /* Free it */
 
-   unlock_page(page);
+   /* Retake the callers reference and putback on LRU */
+   get_page(page);
putback_lru_page(page);
-
-   count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
-   isolated = 0;
-   goto out;
+   mod_zone_page_state(page_zone(page),
+NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR);
+   goto out_fail;
}
 
/*
@@ -1732,9 +1732,9 @@ int migrate_misplaced_transhuge_page(str
entry = 

[PATCH 3.10 60/74] mm: numa: Sanitize task_numa_fault() callsites

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

commit c61109e34f60f6e85bb43c5a1cd51c0e3db40847 upstream.

There are three callers of task_numa_fault():

 - do_huge_pmd_numa_page():
 Accounts against the current node, not the node where the
 page resides, unless we migrated, in which case it accounts
 against the node we migrated to.

 - do_numa_page():
 Accounts against the current node, not the node where the
 page resides, unless we migrated, in which case it accounts
 against the node we migrated to.

 - do_pmd_numa_page():
 Accounts not at all when the page isn't migrated, otherwise
 accounts against the node we migrated towards.

This seems wrong to me; all three sites should have the same
sementaics, furthermore we should accounts against where the page
really is, we already know where the task is.

So modify all three sites to always account; we did after all receive
the fault; and always account to where the page is after migration,
regardless of success.

They all still differ on when they clear the PTE/PMD; ideally that
would get sorted too.

Signed-off-by: Mel Gorman 
Reviewed-by: Rik van Riel 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Srikar Dronamraju 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1381141781-10992-8-git-send-email-mgor...@suse.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/huge_memory.c |   25 +
 mm/memory.c  |   53 +
 2 files changed, 34 insertions(+), 44 deletions(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1291,18 +1291,19 @@ int do_huge_pmd_numa_page(struct mm_stru
struct anon_vma *anon_vma = NULL;
struct page *page;
unsigned long haddr = addr & HPAGE_PMD_MASK;
+   int page_nid = -1, this_nid = numa_node_id();
int target_nid;
-   int current_nid = -1;
-   bool migrated, page_locked;
+   bool page_locked;
+   bool migrated = false;
 
spin_lock(>page_table_lock);
if (unlikely(!pmd_same(pmd, *pmdp)))
goto out_unlock;
 
page = pmd_page(pmd);
-   current_nid = page_to_nid(page);
+   page_nid = page_to_nid(page);
count_vm_numa_event(NUMA_HINT_FAULTS);
-   if (current_nid == numa_node_id())
+   if (page_nid == this_nid)
count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
 
/*
@@ -1345,19 +1346,18 @@ int do_huge_pmd_numa_page(struct mm_stru
spin_unlock(>page_table_lock);
migrated = migrate_misplaced_transhuge_page(mm, vma,
pmdp, pmd, addr, page, target_nid);
-   if (!migrated)
+   if (migrated)
+   page_nid = target_nid;
+   else
goto check_same;
 
-   task_numa_fault(target_nid, HPAGE_PMD_NR, true);
-   if (anon_vma)
-   page_unlock_anon_vma_read(anon_vma);
-   return 0;
+   goto out;
 
 check_same:
spin_lock(>page_table_lock);
if (unlikely(!pmd_same(pmd, *pmdp))) {
/* Someone else took our fault */
-   current_nid = -1;
+   page_nid = -1;
goto out_unlock;
}
 clear_pmdnuma:
@@ -1372,8 +1372,9 @@ out:
if (anon_vma)
page_unlock_anon_vma_read(anon_vma);
 
-   if (current_nid != -1)
-   task_numa_fault(current_nid, HPAGE_PMD_NR, false);
+   if (page_nid != -1)
+   task_numa_fault(page_nid, HPAGE_PMD_NR, migrated);
+
return 0;
 }
 
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3525,12 +3525,12 @@ static int do_nonlinear_fault(struct mm_
 }
 
 int numa_migrate_prep(struct page *page, struct vm_area_struct *vma,
-   unsigned long addr, int current_nid)
+   unsigned long addr, int page_nid)
 {
get_page(page);
 
count_vm_numa_event(NUMA_HINT_FAULTS);
-   if (current_nid == numa_node_id())
+   if (page_nid == numa_node_id())
count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
 
return mpol_misplaced(page, vma, addr);
@@ -3541,7 +3541,7 @@ int do_numa_page(struct mm_struct *mm, s
 {
struct page *page = NULL;
spinlock_t *ptl;
-   int current_nid = -1;
+   int page_nid = -1;
int target_nid;
bool migrated = false;
 
@@ -3571,15 +3571,10 @@ int do_numa_page(struct mm_struct *mm, s
return 0;
}
 
-   current_nid = page_to_nid(page);
-   target_nid = numa_migrate_prep(page, vma, addr, current_nid);
+   page_nid = page_to_nid(page);
+   target_nid = numa_migrate_prep(page, vma, addr, page_nid);
pte_unmap_unlock(ptep, ptl);
if (target_nid == -1) {
-   /*
-* Account for the fault against the current node if it not
-* being replaced regardless of where 

[PATCH 3.10 56/74] clk: fixup argument order when setting VCO parameters

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Jonathan Austin 

commit 2f9f64bc5aa31836810cd25301aa4772ad73ebab upstream.

The order of arguments in the call to vco_set() for the ICST clocks appears to
have been switched in error, which results in the VCO not being initialised
correctly. This in turn stops the integrated LCD on things like Integrator/CP
from working correctly.

This patch fixes the order and restores the expected functionality.

Reviewed-by: Linus Walleij 
Signed-off-by: Jonathan Austin 
Signed-off-by: Mike Turquette 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/clk/versatile/clk-icst.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/clk/versatile/clk-icst.c
+++ b/drivers/clk/versatile/clk-icst.c
@@ -107,7 +107,7 @@ static int icst_set_rate(struct clk_hw *
 
vco = icst_hz_to_vco(icst->params, rate);
icst->rate = icst_hz(icst->params, vco);
-   vco_set(icst->vcoreg, icst->lockreg, vco);
+   vco_set(icst->lockreg, icst->vcoreg, vco);
return 0;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 62/74] mm: Account for a THP NUMA hinting update as one PTE update

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

commit 0255d491848032f6c601b6410c3b8ebded3a37b1 upstream.

A THP PMD update is accounted for as 512 pages updated in vmstat.  This is
large difference when estimating the cost of automatic NUMA balancing and
can be misleading when comparing results that had collapsed versus split
THP. This patch addresses the accounting issue.

Signed-off-by: Mel Gorman 
Reviewed-by: Rik van Riel 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Srikar Dronamraju 
Signed-off-by: Peter Zijlstra 
Link: 
http://lkml.kernel.org/r/1381141781-10992-10-git-send-email-mgor...@suse.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/mprotect.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -145,7 +145,7 @@ static inline unsigned long change_pmd_r
split_huge_page_pmd(vma, addr, pmd);
else if (change_huge_pmd(vma, pmd, addr, newprot,
 prot_numa)) {
-   pages += HPAGE_PMD_NR;
+   pages++;
continue;
}
/* fall through */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 55/74] aacraid: missing capable() check in compat ioctl

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit f856567b930dfcdbc3323261bf77240ccdde01f5 upstream.

In commit d496f94d22d1 ('[SCSI] aacraid: fix security weakness') we
added a check on CAP_SYS_RAWIO to the ioctl.  The compat ioctls need the
check as well.

Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/aacraid/linit.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -771,6 +771,8 @@ static long aac_compat_do_ioctl(struct a
 static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user 
*arg)
 {
struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+   if (!capable(CAP_SYS_RAWIO))
+   return -EPERM;
return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 42/74] ASoC: dapm: Fix source list debugfs outputs

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit ff18620c2157671a8ee21ebb8e6a3520ea209b1f upstream.

... due to a copy & paste error.

Spotted by coverity CID 710923.

Signed-off-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1797,7 +1797,7 @@ static ssize_t dapm_widget_power_read_fi
w->active ? "active" : "inactive");
 
list_for_each_entry(p, >sources, list_sink) {
-   if (p->connected && !p->connected(w, p->sink))
+   if (p->connected && !p->connected(w, p->source))
continue;
 
if (p->connect)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 57/74] mm: numa: Do not account for a hinting fault if we raced

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

commit 1dd49bfa3465756b3ce72214b58a33e4afb67aa3 upstream.

If another task handled a hinting fault in parallel then do not double
account for it.

Signed-off-by: Mel Gorman 
Reviewed-by: Rik van Riel 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Srikar Dronamraju 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1381141781-10992-5-git-send-email-mgor...@suse.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/huge_memory.c |5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1335,8 +1335,11 @@ int do_huge_pmd_numa_page(struct mm_stru
 
 check_same:
spin_lock(>page_table_lock);
-   if (unlikely(!pmd_same(pmd, *pmdp)))
+   if (unlikely(!pmd_same(pmd, *pmdp))) {
+   /* Someone else took our fault */
+   current_nid = -1;
goto out_unlock;
+   }
 clear_pmdnuma:
pmd = pmd_mknonnuma(pmd);
set_pmd_at(mm, haddr, pmdp, pmd);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 58/74] mm: Wait for THP migrations to complete during NUMA hinting faults

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

commit 42836f5f8baa33085f547098b74aa98991ee9216 upstream.

The locking for migrating THP is unusual. While normal page migration
prevents parallel accesses using a migration PTE, THP migration relies on
a combination of the page_table_lock, the page lock and the existance of
the NUMA hinting PTE to guarantee safety but there is a bug in the scheme.

If a THP page is currently being migrated and another thread traps a
fault on the same page it checks if the page is misplaced. If it is not,
then pmd_numa is cleared. The problem is that it checks if the page is
misplaced without holding the page lock meaning that the racing thread
can be migrating the THP when the second thread clears the NUMA bit
and faults a stale page.

This patch checks if the page is potentially being migrated and stalls
using the lock_page if it is potentially being migrated before checking
if the page is misplaced or not.

Signed-off-by: Mel Gorman 
Reviewed-by: Rik van Riel 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Srikar Dronamraju 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1381141781-10992-6-git-send-email-mgor...@suse.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/huge_memory.c |   23 ---
 1 file changed, 16 insertions(+), 7 deletions(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1305,13 +1305,14 @@ int do_huge_pmd_numa_page(struct mm_stru
if (current_nid == numa_node_id())
count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
 
-   target_nid = mpol_misplaced(page, vma, haddr);
-   if (target_nid == -1) {
-   put_page(page);
-   goto clear_pmdnuma;
-   }
+   /*
+* Acquire the page lock to serialise THP migrations but avoid dropping
+* page_table_lock if at all possible
+*/
+   if (trylock_page(page))
+   goto got_lock;
 
-   /* Acquire the page lock to serialise THP migrations */
+   /* Serialise against migrationa and check placement check placement */
spin_unlock(>page_table_lock);
lock_page(page);
 
@@ -1322,9 +1323,17 @@ int do_huge_pmd_numa_page(struct mm_stru
put_page(page);
goto out_unlock;
}
-   spin_unlock(>page_table_lock);
+
+got_lock:
+   target_nid = mpol_misplaced(page, vma, haddr);
+   if (target_nid == -1) {
+   unlock_page(page);
+   put_page(page);
+   goto clear_pmdnuma;
+   }
 
/* Migrate the THP to the requested node */
+   spin_unlock(>page_table_lock);
migrated = migrate_misplaced_transhuge_page(mm, vma,
pmdp, pmd, addr, page, target_nid);
if (!migrated)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 59/74] mm: Prevent parallel splits during THP migration

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

commit 587fe586f44a48f9691001ba6c45b86c8e4ba21f upstream.

THP migrations are serialised by the page lock but on its own that does
not prevent THP splits. If the page is split during THP migration then
the pmd_same checks will prevent page table corruption but the unlock page
and other fix-ups potentially will cause corruption. This patch takes the
anon_vma lock to prevent parallel splits during migration.

Signed-off-by: Mel Gorman 
Reviewed-by: Rik van Riel 
Cc: Andrea Arcangeli 
Cc: Johannes Weiner 
Cc: Srikar Dronamraju 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1381141781-10992-7-git-send-email-mgor...@suse.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/huge_memory.c |   44 ++--
 1 file changed, 30 insertions(+), 14 deletions(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1288,18 +1288,18 @@ out:
 int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long addr, pmd_t pmd, pmd_t *pmdp)
 {
+   struct anon_vma *anon_vma = NULL;
struct page *page;
unsigned long haddr = addr & HPAGE_PMD_MASK;
int target_nid;
int current_nid = -1;
-   bool migrated;
+   bool migrated, page_locked;
 
spin_lock(>page_table_lock);
if (unlikely(!pmd_same(pmd, *pmdp)))
goto out_unlock;
 
page = pmd_page(pmd);
-   get_page(page);
current_nid = page_to_nid(page);
count_vm_numa_event(NUMA_HINT_FAULTS);
if (current_nid == numa_node_id())
@@ -1309,12 +1309,29 @@ int do_huge_pmd_numa_page(struct mm_stru
 * Acquire the page lock to serialise THP migrations but avoid dropping
 * page_table_lock if at all possible
 */
-   if (trylock_page(page))
-   goto got_lock;
+   page_locked = trylock_page(page);
+   target_nid = mpol_misplaced(page, vma, haddr);
+   if (target_nid == -1) {
+   /* If the page was locked, there are no parallel migrations */
+   if (page_locked) {
+   unlock_page(page);
+   goto clear_pmdnuma;
+   }
+
+   /* Otherwise wait for potential migrations and retry fault */
+   spin_unlock(>page_table_lock);
+   wait_on_page_locked(page);
+   goto out;
+   }
 
-   /* Serialise against migrationa and check placement check placement */
+   /* Page is misplaced, serialise migrations and parallel THP splits */
+   get_page(page);
spin_unlock(>page_table_lock);
-   lock_page(page);
+   if (!page_locked) {
+   lock_page(page);
+   page_locked = true;
+   }
+   anon_vma = page_lock_anon_vma_read(page);
 
/* Confirm the PTE did not while locked */
spin_lock(>page_table_lock);
@@ -1324,14 +1341,6 @@ int do_huge_pmd_numa_page(struct mm_stru
goto out_unlock;
}
 
-got_lock:
-   target_nid = mpol_misplaced(page, vma, haddr);
-   if (target_nid == -1) {
-   unlock_page(page);
-   put_page(page);
-   goto clear_pmdnuma;
-   }
-
/* Migrate the THP to the requested node */
spin_unlock(>page_table_lock);
migrated = migrate_misplaced_transhuge_page(mm, vma,
@@ -1340,6 +1349,8 @@ got_lock:
goto check_same;
 
task_numa_fault(target_nid, HPAGE_PMD_NR, true);
+   if (anon_vma)
+   page_unlock_anon_vma_read(anon_vma);
return 0;
 
 check_same:
@@ -1356,6 +1367,11 @@ clear_pmdnuma:
update_mmu_cache_pmd(vma, addr, pmdp);
 out_unlock:
spin_unlock(>page_table_lock);
+
+out:
+   if (anon_vma)
+   page_unlock_anon_vma_read(anon_vma);
+
if (current_nid != -1)
task_numa_fault(current_nid, HPAGE_PMD_NR, false);
return 0;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 00/74] 3.10.19-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.10.19 release.
There are 74 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Nov 11 06:50:58 UTC 2013.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.19-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 3.10.19-rc1

Jon Mason 
NTB: Correct debugfs to work with more than 1 NTB Device

Jon Mason 
NTB: Correct USD/DSD Identification

Jon Mason 
NTB: Correct Number of Scratch Pad Registers

Jon Mason 
NTB: Add Error Handling in ntb_device_setup

Gu Zheng 
seq_file: always update file->f_pos in seq_lseek()

Alex Deucher 
drm/radeon/atom: workaround vbios bug in transmitter table on rs780

Chris Wilson 
drm: Pad drm_mode_get_connector to 64-bit boundary

Chris Wilson 
drm: Prevent overwriting from userspace underallocating core ioctl structs

Thomas Hellstrom 
drm/vmwgfx: Don't kill clients on VT switch

Thomas Hellstrom 
drm/vmwgfx: Don't put resources with invalid id's on lru list

Zhang Yanfei 
mm/vmalloc.c: fix an overflow bug in alloc_vmap_area()

Chen LinX 
mm/pagewalk.c: fix walk_page_range() access of wrong PTEs

Mel Gorman 
mm: Account for a THP NUMA hinting update as one PTE update

Mel Gorman 
mm: Close races between THP migration and PMD numa clearing

Mel Gorman 
mm: numa: Sanitize task_numa_fault() callsites

Mel Gorman 
mm: Prevent parallel splits during THP migration

Mel Gorman 
mm: Wait for THP migrations to complete during NUMA hinting faults

Mel Gorman 
mm: numa: Do not account for a hinting fault if we raced

Jonathan Austin 
clk: fixup argument order when setting VCO parameters

Dan Carpenter 
aacraid: missing capable() check in compat ioctl

Ming Lei 
lib/scatterlist.c: don't flush_kernel_dcache_page on slab page

Linus Torvalds 
Fix a few incorrectly checked [io_]remap_pfn_range() calls

Al Viro 
au1200fb: io_remap_pfn_range() sets VM_IO

Al Viro 
au1100fb: VM_IO is set by io_remap_pfn_range()

Uwe Kleine-König 
uio: provide vm access to UIO_MEM_PHYS maps

Uwe Kleine-König 
mm: make generic_access_phys available for modules

Baruch Siach 
xtensa: don't use alternate signal stack on threads

Dan Carpenter 
uml: check length in exitcode_proc_write()

Dan Carpenter 
staging: wlags49_h2: buffer overflow setting station name

Dan Carpenter 
Staging: sb105x: info leak in mp_get_count()

Dan Carpenter 
Staging: bcm: info leak in ioctl

Dan Carpenter 
staging: ozwpan: prevent overflow in oz_cdev_write()

Takashi Iwai 
ASoC: dapm: Fix source list debugfs outputs

Takashi Iwai 
ASoC: wm_hubs: Add missing break in hp_supply_event()

Russell King 
ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM

Takashi Iwai 
ALSA: hda - Add a fixup for ASUS N76VZ

Takashi Iwai 
ALSA: hda - Fix unbalanced runtime PM refcount after S3/S4

Takashi Iwai 
ALSA: hda - Add missing initial vmaster hook at build_controls callback

Vineet Gupta 
ARC: Incorrect mm reference used in vmalloc fault handler

Ming Lei 
scripts/kallsyms: filter symbols not in kernel address space

Helge Deller 
parisc: Do not crash 64bit SMP kernels on machines with >= 4GB RAM

Thomas Gleixner 
clockevents: Sanitize ticks to nsec conversion

Nicholas Bellinger 
vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter

Wei Yongjun 
target/pscsi: fix return value check

Lukasz Dorau 
md: Fix skipping recovery for read-only arrays.

Bian Yu 
md: avoid deadlock when md_set_badblocks.

Gwendal Grignou 
libata: make ata_eh_qc_retry() bump scmd->allowed on bogus failures

Shaohua Li 
raid5: avoid finding "discard" stripe

Shaohua Li 
raid5: set bio bi_vcnt 0 for discard request

Geyslan G. Bem 
ecryptfs: Fix memory leakage in keystore.c

Aaron Lu 
SCSI: sd: call blk_pm_runtime_init before add_disk

Marc Kleine-Budde 
can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and 
abort pending TX

Marc Kleine-Budde 
can: flexcan: fix mx28 detection by rearanging OF match table

Marc Kleine-Budde 
can: at91-can: fix device to driver data mapping for platform devices

Dave Kleikamp 
jfs: fix error path in ialloc

Emmanuel Grumbach 
iwlwifi: pcie: add SKUs for 6000, 6005 and 6235 series

Mark Cave-Ayland 
rtlwifi: rtl8192cu: Fix error in pointer arithmetic

Amitkumar Karwar 
mwifiex: fix SDIO interrupt lost issue

Bruno Randolf 
cfg80211: fix warning when using WEXT for IBSS

Felix Fietkau 
ath9k: fix tx queue scheduling after channel changes

Johannes Berg 
mac80211: fix crash if bitrate calculation 

[PATCH 3.10 51/74] au1100fb: VM_IO is set by io_remap_pfn_range()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Al Viro 

commit c607f450f6e49f5794f27617bedc638b51044d2e upstream.

Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/video/au1100fb.c |2 --
 1 file changed, 2 deletions(-)

--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -385,8 +385,6 @@ int au1100fb_fb_mmap(struct fb_info *fbi
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
pgprot_val(vma->vm_page_prot) |= (6 << 9); //CCA=6
 
-   vma->vm_flags |= VM_IO;
-
if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
vma->vm_end - vma->vm_start,
vma->vm_page_prot)) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 45/74] Staging: sb105x: info leak in mp_get_count()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit a8b33654b1e3b0c74d4a1fed041c9aae50b3c427 upstream.

The icount.reserved[] array isn't initialized so it leaks stack
information to userspace.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/sb105x/sb_pci_mp.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/sb105x/sb_pci_mp.c
+++ b/drivers/staging/sb105x/sb_pci_mp.c
@@ -1063,7 +1063,7 @@ static int mp_wait_modem_status(struct s
 
 static int mp_get_count(struct sb_uart_state *state, struct 
serial_icounter_struct *icnt)
 {
-   struct serial_icounter_struct icount;
+   struct serial_icounter_struct icount = {};
struct sb_uart_icount cnow;
struct sb_uart_port *port = state->port;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 47/74] uml: check length in exitcode_proc_write()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 201f99f170df14ba52ea4c52847779042b7a623b upstream.

We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/um/kernel/exitcode.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/um/kernel/exitcode.c
+++ b/arch/um/kernel/exitcode.c
@@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struc
const char __user *buffer, size_t count, loff_t *pos)
 {
char *end, buf[sizeof("n\0")];
+   size_t size;
int tmp;
 
-   if (copy_from_user(buf, buffer, count))
+   size = min(count, sizeof(buf));
+   if (copy_from_user(buf, buffer, size))
return -EFAULT;
 
tmp = simple_strtol(buf, , 0);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 48/74] xtensa: dont use alternate signal stack on threads

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Baruch Siach 

commit cba9a90053e3b7973eff4f1946f33032e98eeed5 upstream.

According to create_thread(3): "The new thread does not inherit the creating
thread's alternate signal stack". Since commit f9a3879a (Fix sigaltstack
corruption among cloned threads), current->sas_ss_size is set to 0 for cloned
processes sharing VM with their parent. Don't use the (nonexistent) alternate
signal stack in this case. This has been broken since commit 29c4dfd9 ([XTENSA]
Remove non-rt signal handling).

Fixes the SA_ONSTACK part of the nptl/tst-cancel20 test from uClibc.

Signed-off-by: Baruch Siach 
Signed-off-by: Max Filippov 
Signed-off-by: Chris Zankel 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/xtensa/kernel/signal.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -341,7 +341,7 @@ static int setup_frame(int sig, struct k
 
sp = regs->areg[1];
 
-   if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && ! on_sig_stack(sp)) {
+   if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && sas_ss_flags(sp) == 0) {
sp = current->sas_ss_sp + current->sas_ss_size;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 73/74] NTB: Correct USD/DSD Identification

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Mason 

commit b6750cfe0710a14fd147ba27fddbecae8ba88c77 upstream.

Due to ambiguous documentation, the USD/DSD identification is backward
when compared to the setting in BIOS.  Correct the bits to match the
BIOS setting.

Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ntb/ntb_hw.c |7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -531,9 +531,9 @@ static int ntb_xeon_setup(struct ntb_dev
}
 
if (val & SNB_PPD_DEV_TYPE)
-   ndev->dev_type = NTB_DEV_DSD;
-   else
ndev->dev_type = NTB_DEV_USD;
+   else
+   ndev->dev_type = NTB_DEV_DSD;
 
ndev->reg_ofs.pdb = ndev->reg_base + SNB_PDOORBELL_OFFSET;
ndev->reg_ofs.pdb_mask = ndev->reg_base + SNB_PDBMSK_OFFSET;
@@ -647,6 +647,9 @@ static int ntb_device_setup(struct ntb_d
if (rc)
return rc;
 
+   dev_info(>pdev->dev, "Device Type = %s\n",
+ndev->dev_type == NTB_DEV_USD ? "USD/DSP" : "DSD/USP");
+
/* Enable Bus Master and Memory Space on the secondary side */
writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 65/74] drm/vmwgfx: Dont put resources with invalid ids on lru list

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Hellstrom 

commit 26682480c202e7360cbcdc3bc9e962bf749c6b8d upstream.

The evict code may try to swap them out causing a BUG in the destroy
function.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_r
if (new_backup)
res->backup_offset = new_backup_offset;
 
-   if (!res->func->may_evict)
+   if (!res->func->may_evict || res->id == -1)
return;
 
write_lock(_priv->resource_lock);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 63/74] mm/pagewalk.c: fix walk_page_range() access of wrong PTEs

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen LinX 

commit 3017f079efd6af199b0852b5c425364513db460e upstream.

When walk_page_range walk a memory map's page tables, it'll skip
VM_PFNMAP area, then variable 'next' will to assign to vma->vm_end, it
maybe larger than 'end'.  In next loop, 'addr' will be larger than
'next'.  Then in /proc//pagemap file reading procedure, the 'addr'
will growing forever in pagemap_pte_range, pte_to_pagemap_entry will
access the wrong pte.

  BUG: Bad page map in process procrank  pte:8437526f pmd:785de067
  addr:9108d000 vm_flags:00200073 anon_vma:f0d99020 mapping:  (null) index:9108d
  CPU: 1 PID: 4974 Comm: procrank Tainted: GB   W  O 3.10.1+ #1
  Call Trace:
dump_stack+0x16/0x18
print_bad_pte+0x114/0x1b0
vm_normal_page+0x56/0x60
pagemap_pte_range+0x17a/0x1d0
walk_page_range+0x19e/0x2c0
pagemap_read+0x16e/0x200
vfs_read+0x84/0x150
SyS_read+0x4a/0x80
syscall_call+0x7/0xb

Signed-off-by: Liu ShuoX 
Signed-off-by: Chen LinX 
Acked-by: Kirill A. Shutemov 
Reviewed-by: Naoya Horiguchi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/pagewalk.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -242,7 +242,7 @@ int walk_page_range(unsigned long addr,
if (err)
break;
pgd++;
-   } while (addr = next, addr != end);
+   } while (addr = next, addr < end);
 
return err;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 64/74] mm/vmalloc.c: fix an overflow bug in alloc_vmap_area()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Zhang Yanfei 

commit bcb615a81b1765864c71c50afb56631e7a1e5283 upstream.

When searching a vmap area in the vmalloc space, we use (addr + size -
1) to check if the value is less than addr, which is an overflow.  But
we assign (addr + size) to vmap_area->va_end.

So if we come across the below case:

  (addr + size - 1) : not overflow
  (addr + size) : overflow

we will assign an overflow value (e.g 0) to vmap_area->va_end, And this
will trigger BUG in __insert_vmap_area, causing system panic.

So using (addr + size) to check the overflow should be the correct
behaviour, not (addr + size - 1).

Signed-off-by: Zhang Yanfei 
Reported-by: Ghennadi Procopciuc 
Tested-by: Daniel Baluta 
Cc: David Rientjes 
Cc: Minchan Kim 
Cc: KOSAKI Motohiro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Cc: Anatoly Muliarski 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/vmalloc.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -388,12 +388,12 @@ nocache:
addr = ALIGN(first->va_end, align);
if (addr < vstart)
goto nocache;
-   if (addr + size - 1 < addr)
+   if (addr + size < addr)
goto overflow;
 
} else {
addr = ALIGN(vstart, align);
-   if (addr + size - 1 < addr)
+   if (addr + size < addr)
goto overflow;
 
n = vmap_area_root.rb_node;
@@ -420,7 +420,7 @@ nocache:
if (addr + cached_hole_size < first->va_start)
cached_hole_size = first->va_start - addr;
addr = ALIGN(first->va_end, align);
-   if (addr + size - 1 < addr)
+   if (addr + size < addr)
goto overflow;
 
if (list_is_last(>list, _area_list))


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 74/74] NTB: Correct debugfs to work with more than 1 NTB Device

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Mason 

commit 1517a3f21a1dd321f16bcf44204bddff9d21abd0 upstream.

Debugfs was setup in NTB to only have a single debugfs directory.  This
resulted in the leaking of debugfs directories and files when multiple
NTB devices were present, due to each device stomping on the variables
containing the previous device's values (thus preventing them from being
freed on cleanup).  Correct this by creating a secondary directory of
the PCI BDF for each device present, and nesting the previously existing
information in those directories.

Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ntb/ntb_hw.c|   27 +++
 drivers/ntb/ntb_hw.h|   16 
 drivers/ntb/ntb_transport.c |   17 +
 3 files changed, 48 insertions(+), 12 deletions(-)

--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -78,6 +78,8 @@ enum {
BWD_HW,
 };
 
+static struct dentry *debugfs_dir;
+
 /* Translate memory window 0,1 to BAR 2,4 */
 #define MW_TO_BAR(mw)  (mw * 2 + 2)
 
@@ -998,6 +1000,28 @@ static void ntb_free_callbacks(struct nt
kfree(ndev->db_cb);
 }
 
+static void ntb_setup_debugfs(struct ntb_device *ndev)
+{
+   if (!debugfs_initialized())
+   return;
+
+   if (!debugfs_dir)
+   debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+   ndev->debugfs_dir = debugfs_create_dir(pci_name(ndev->pdev),
+  debugfs_dir);
+}
+
+static void ntb_free_debugfs(struct ntb_device *ndev)
+{
+   debugfs_remove_recursive(ndev->debugfs_dir);
+
+   if (debugfs_dir && simple_empty(debugfs_dir)) {
+   debugfs_remove_recursive(debugfs_dir);
+   debugfs_dir = NULL;
+   }
+}
+
 static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
struct ntb_device *ndev;
@@ -1010,6 +1034,7 @@ static int ntb_pci_probe(struct pci_dev
ndev->pdev = pdev;
ndev->link_status = NTB_LINK_DOWN;
pci_set_drvdata(pdev, ndev);
+   ntb_setup_debugfs(ndev);
 
rc = pci_enable_device(pdev);
if (rc)
@@ -1106,6 +1131,7 @@ err2:
 err1:
pci_disable_device(pdev);
 err:
+   ntb_free_debugfs(ndev);
kfree(ndev);
 
dev_err(>dev, "Error loading %s module\n", KBUILD_MODNAME);
@@ -1135,6 +1161,7 @@ static void ntb_pci_remove(struct pci_de
iounmap(ndev->reg_base);
pci_release_selected_regions(pdev, NTB_BAR_MASK);
pci_disable_device(pdev);
+   ntb_free_debugfs(ndev);
kfree(ndev);
 }
 
--- a/drivers/ntb/ntb_hw.h
+++ b/drivers/ntb/ntb_hw.h
@@ -127,6 +127,8 @@ struct ntb_device {
unsigned char link_status;
struct delayed_work hb_timer;
unsigned long last_ts;
+
+   struct dentry *debugfs_dir;
 };
 
 /**
@@ -155,6 +157,20 @@ static inline struct pci_dev *ntb_query_
return ndev->pdev;
 }
 
+/**
+ * ntb_query_debugfs() - return the debugfs pointer
+ * @ndev: pointer to ntb_device instance
+ *
+ * Given the ntb pointer, return the debugfs directory pointer for the NTB
+ * hardware device
+ *
+ * RETURNS: a pointer to the debugfs directory
+ */
+static inline struct dentry *ntb_query_debugfs(struct ntb_device *ndev)
+{
+   return ndev->debugfs_dir;
+}
+
 struct ntb_device *ntb_register_transport(struct pci_dev *pdev,
  void *transport);
 void ntb_unregister_transport(struct ntb_device *ndev);
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -157,7 +157,6 @@ struct ntb_transport {
bool transport_link;
struct delayed_work link_work;
struct work_struct link_cleanup;
-   struct dentry *debugfs_dir;
 };
 
 enum {
@@ -824,12 +823,12 @@ static void ntb_transport_init_queue(str
qp->tx_max_frame = min(transport_mtu, tx_size / 2);
qp->tx_max_entry = tx_size / qp->tx_max_frame;
 
-   if (nt->debugfs_dir) {
+   if (ntb_query_debugfs(nt->ndev)) {
char debugfs_name[4];
 
snprintf(debugfs_name, 4, "qp%d", qp_num);
qp->debugfs_dir = debugfs_create_dir(debugfs_name,
-nt->debugfs_dir);
+ntb_query_debugfs(nt->ndev));
 
qp->debugfs_stats = debugfs_create_file("stats", S_IRUSR,
qp->debugfs_dir, qp,
@@ -857,11 +856,6 @@ int ntb_transport_init(struct pci_dev *p
if (!nt)
return -ENOMEM;
 
-   if (debugfs_initialized())
-   nt->debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
-   else
-   nt->debugfs_dir = NULL;
-
nt->ndev = ntb_register_transport(pdev, nt);
if (!nt->ndev) {
rc = -EIO;
@@ -907,7 +901,6 @@ err2:
 

[PATCH 3.10 46/74] staging: wlags49_h2: buffer overflow setting station name

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit b5e2f339865fb443107e5b10603e53bbc92dc054 upstream.

We need to check the length parameter before doing the memcpy().  I've
actually changed it to strlcpy() as well so that it's NUL terminated.

You need CAP_NET_ADMIN to trigger these so it's not the end of the
world.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/wlags49_h2/wl_priv.c |9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/staging/wlags49_h2/wl_priv.c
+++ b/drivers/staging/wlags49_h2/wl_priv.c
@@ -570,6 +570,7 @@ int wvlan_uil_put_info(struct uilreq *ur
ltv_t   *pLtv;
bool_t  ltvAllocated = FALSE;
ENCSTRCTsEncryption;
+   size_t  len;
 
 #ifdef USE_WDS
hcf_16  hcfPort  = HCF_PORT_0;
@@ -686,7 +687,8 @@ int wvlan_uil_put_info(struct uilreq *ur
break;
case CFG_CNF_OWN_NAME:
memset(lp->StationName, 0, 
sizeof(lp->StationName));
-   memcpy((void *)lp->StationName, (void 
*)>u.u8[2], (size_t)pLtv->u.u16[0]);
+   len = min_t(size_t, pLtv->u.u16[0], 
sizeof(lp->StationName));
+   strlcpy(lp->StationName, 
>u.u8[2], len);
pLtv->u.u16[0] = 
CNV_INT_TO_LITTLE(pLtv->u.u16[0]);
break;
case CFG_CNF_LOAD_BALANCING:
@@ -1783,6 +1785,7 @@ int wvlan_set_station_nickname(struct ne
 {
struct wl_private *lp = wl_priv(dev);
unsigned long flags;
+   size_t len;
int ret = 0;

/**/
 
@@ -1793,8 +1796,8 @@ int wvlan_set_station_nickname(struct ne
wl_lock(lp, );
 
memset(lp->StationName, 0, sizeof(lp->StationName));
-
-   memcpy(lp->StationName, extra, wrqu->data.length);
+   len = min_t(size_t, wrqu->data.length, sizeof(lp->StationName));
+   strlcpy(lp->StationName, extra, len);
 
/* Commit the adapter parameters */
wl_apply(lp);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 67/74] drm: Prevent overwriting from userspace underallocating core ioctl structs

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Chris Wilson 

commit b062672e305ce071f21eb9e18b102c2a430e0999 upstream.

Apply the protections from

commit 1b2f1489633888d4a06028315dc19d65768a1c05
Author: Dave Airlie 
Date:   Sat Aug 14 20:20:34 2010 +1000

drm: block userspace under allocating buffer and having drivers overwrite 
it (v2)

to the core ioctl structs as well, for we found one instance where there
is a 32-/64-bit size mismatch and were guilty of writing beyond the end
of the user's buffer.

Signed-off-by: Chris Wilson 
Cc: Dave Airlie 
Reviewed-by: Ville Syrjälä 
Cc: dri-de...@lists.freedesktop.org
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/drm_drv.c |9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -406,9 +406,16 @@ long drm_ioctl(struct file *filp,
cmd = ioctl->cmd_drv;
}
else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
+   u32 drv_size;
+
ioctl = _ioctls[nr];
-   cmd = ioctl->cmd;
+
+   drv_size = _IOC_SIZE(ioctl->cmd);
usize = asize = _IOC_SIZE(cmd);
+   if (drv_size > asize)
+   asize = drv_size;
+
+   cmd = ioctl->cmd;
} else
goto err_i1;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 52/74] au1200fb: io_remap_pfn_range() sets VM_IO

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Al Viro 

commit 1fca06fafb235a88c4fa91294aa1726c0e22855b upstream.

... and single return is quite sufficient to get out of function, TYVM

Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/video/au1200fb.c |4 
 1 file changed, 4 deletions(-)

--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1258,13 +1258,9 @@ static int au1200fb_fb_mmap(struct fb_in
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
 
-   vma->vm_flags |= VM_IO;
-
return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
  vma->vm_end - vma->vm_start,
  vma->vm_page_prot);
-
-   return 0;
 }
 
 static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 71/74] NTB: Add Error Handling in ntb_device_setup

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Mason 

commit 3b12a0d15bd1559e72ad21d9d807fd2a6706f0ab upstream.

If an error is encountered in ntb_device_setup, it is possible that the
spci_cmd isn't populated.  Writes to the offset can result in a NULL
pointer dereference.  This issue is easily encountered by running in
NTB-RP mode, as it currently is not supported and will generate an
error.  To get around this issue, return if an error is encountered
prior to attempting to write to the spci_cmd offset.

Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ntb/ntb_hw.c |5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -644,10 +644,13 @@ static int ntb_device_setup(struct ntb_d
rc = -ENODEV;
}
 
+   if (rc)
+   return rc;
+
/* Enable Bus Master and Memory Space on the secondary side */
writew(PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER, ndev->reg_ofs.spci_cmd);
 
-   return rc;
+   return 0;
 }
 
 static void ntb_device_free(struct ntb_device *ndev)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 68/74] drm: Pad drm_mode_get_connector to 64-bit boundary

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Chris Wilson 

commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream.

Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
the 4 bytes beyond the end of its structure with a 32-bit userspace
running on a 64-bit kernel. This is due to the padding gcc inserts as
the drm_mode_get_connector struct includes a u64 and its size is not a
natural multiple of u64s.

64-bit kernel:

sizeof(drm_mode_get_connector)=80, alignof=8
sizeof(drm_mode_get_encoder)=20, alignof=4
sizeof(drm_mode_modeinfo)=68, alignof=4

32-bit userspace:

sizeof(drm_mode_get_connector)=76, alignof=4
sizeof(drm_mode_get_encoder)=20, alignof=4
sizeof(drm_mode_modeinfo)=68, alignof=4

Fortuituously we can insert explicit padding to the tail of our
structures without breaking ABI.

Reported-by: Pavel Roskin 
Signed-off-by: Chris Wilson 
Cc: Dave Airlie 
Cc: dri-de...@lists.freedesktop.org
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman 

---
 include/uapi/drm/drm_mode.h |2 ++
 1 file changed, 2 insertions(+)

--- a/include/uapi/drm/drm_mode.h
+++ b/include/uapi/drm/drm_mode.h
@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
__u32 connection;
__u32 mm_width, mm_height; /**< HxW in millimeters */
__u32 subpixel;
+
+   __u32 pad;
 };
 
 #define DRM_MODE_PROP_PENDING  (1<<0)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 66/74] drm/vmwgfx: Dont kill clients on VT switch

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Thomas Hellstrom 

commit c4249855ac5b2a383704d31e040d3831d6a25c6f upstream.

DRI clients that tried to grab the TTM lock when the master (X server) was
switched away during a VT switch were sent the SIGTERM signal by the
kernel. Fix this so that they are only sent that signal when the master has
exited.

Signed-off-by: Thomas Hellstrom 
Reviewed-by: Jakob Bornecrantz 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c |   17 -
 1 file changed, 12 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -740,9 +740,17 @@ static void vmw_postclose(struct drm_dev
struct vmw_fpriv *vmw_fp;
 
vmw_fp = vmw_fpriv(file_priv);
-   ttm_object_file_release(_fp->tfile);
-   if (vmw_fp->locked_master)
+
+   if (vmw_fp->locked_master) {
+   struct vmw_master *vmaster =
+   vmw_master(vmw_fp->locked_master);
+
+   ttm_lock_set_kill(>lock, true, SIGTERM);
+   ttm_vt_unlock(>lock);
drm_master_put(_fp->locked_master);
+   }
+
+   ttm_object_file_release(_fp->tfile);
kfree(vmw_fp);
 }
 
@@ -942,14 +950,13 @@ static void vmw_master_drop(struct drm_d
 
vmw_fp->locked_master = drm_master_get(file_priv->master);
ret = ttm_vt_lock(>lock, false, vmw_fp->tfile);
-   vmw_execbuf_release_pinned_bo(dev_priv);
-
if (unlikely((ret != 0))) {
DRM_ERROR("Unable to lock TTM at VT switch.\n");
drm_master_put(_fp->locked_master);
}
 
-   ttm_lock_set_kill(>lock, true, SIGTERM);
+   ttm_lock_set_kill(>lock, false, SIGTERM);
+   vmw_execbuf_release_pinned_bo(dev_priv);
 
if (!dev_priv->enable_fb) {
ret = ttm_bo_evict_mm(_priv->bdev, TTM_PL_VRAM);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 44/74] Staging: bcm: info leak in ioctl

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream.

The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
information to user space.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/bcm/Bcmchar.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1960,6 +1960,7 @@ cntrlEnd:
 
BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, 
DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");
 
+   memset(, 0, sizeof(DevInfo));
DevInfo.MaxRDMBufferSize = BUFFER_4K;
DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START;
DevInfo.u32RxAlignmentCorrection = 0;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 72/74] NTB: Correct Number of Scratch Pad Registers

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Mason 

commit 87034511519815259e37336f52edf06d114d43b6 upstream.

The NTB Xeon hardware has 16 scratch pad registers and 16 back-to-back
scratch pad registers.  Correct the #define to represent this and update
the variable names to reflect their usage.

Signed-off-by: Jon Mason 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ntb/ntb_hw.c   |2 +-
 drivers/ntb/ntb_regs.h |4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -547,7 +547,7 @@ static int ntb_xeon_setup(struct ntb_dev
if (ndev->conn_type == NTB_CONN_B2B) {
ndev->reg_ofs.sdb = ndev->reg_base + SNB_B2B_DOORBELL_OFFSET;
ndev->reg_ofs.spad_write = ndev->reg_base + SNB_B2B_SPAD_OFFSET;
-   ndev->limits.max_spads = SNB_MAX_SPADS;
+   ndev->limits.max_spads = SNB_MAX_B2B_SPADS;
} else {
ndev->reg_ofs.sdb = ndev->reg_base + SNB_SDOORBELL_OFFSET;
ndev->reg_ofs.spad_write = ndev->reg_base + SNB_SPAD_OFFSET;
--- a/drivers/ntb/ntb_regs.h
+++ b/drivers/ntb/ntb_regs.h
@@ -53,8 +53,8 @@
 #define NTB_LINK_WIDTH_MASK0x03f0
 
 #define SNB_MSIX_CNT   4
-#define SNB_MAX_SPADS  16
-#define SNB_MAX_COMPAT_SPADS   8
+#define SNB_MAX_B2B_SPADS  16
+#define SNB_MAX_COMPAT_SPADS   16
 /* Reserve the uppermost bit for link interrupt */
 #define SNB_MAX_DB_BITS15
 #define SNB_DB_BITS_PER_VEC5


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 54/74] lib/scatterlist.c: dont flush_kernel_dcache_page on slab page

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Ming Lei 

commit 3d77b50c5874b7e923be946ba793644f82336b75 upstream.

Commit b1adaf65ba03 ("[SCSI] block: add sg buffer copy helper
functions") introduces two sg buffer copy helpers, and calls
flush_kernel_dcache_page() on pages in SG list after these pages are
written to.

Unfortunately, the commit may introduce a potential bug:

 - Before sending some SCSI commands, kmalloc() buffer may be passed to
   block layper, so flush_kernel_dcache_page() can see a slab page
   finally

 - According to cachetlb.txt, flush_kernel_dcache_page() is only called
   on "a user page", which surely can't be a slab page.

 - ARCH's implementation of flush_kernel_dcache_page() may use page
   mapping information to do optimization so page_mapping() will see the
   slab page, then VM_BUG_ON() is triggered.

Aaro Koskinen reported the bug on ARM/kirkwood when DEBUG_VM is enabled,
and this patch fixes the bug by adding test of '!PageSlab(miter->page)'
before calling flush_kernel_dcache_page().

Signed-off-by: Ming Lei 
Reported-by: Aaro Koskinen 
Tested-by: Simon Baatz 
Cc: Russell King - ARM Linux 
Cc: Will Deacon 
Cc: Aaro Koskinen 
Acked-by: Catalin Marinas 
Cc: FUJITA Tomonori 
Cc: Tejun Heo 
Cc: "James E.J. Bottomley" 
Cc: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 lib/scatterlist.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -529,7 +529,8 @@ void sg_miter_stop(struct sg_mapping_ite
miter->__offset += miter->consumed;
miter->__remaining -= miter->consumed;
 
-   if (miter->__flags & SG_MITER_TO_SG)
+   if ((miter->__flags & SG_MITER_TO_SG) &&
+   !PageSlab(miter->page))
flush_kernel_dcache_page(miter->page);
 
if (miter->__flags & SG_MITER_ATOMIC) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.11 10/94] cpufreq: s3c64xx: Rename index to driver_data

[Greg Kroah-Hartman]

3.11-stable review patch.  If anyone has any objections, please let me know.

--

From: Charles Keepax 

commit 0e8244322b7fc45fd11a1c45f70b6bacddf4986f upstream.

The index field of cpufreq_frequency_table has been renamed to
driver_data by commit 5070158 (cpufreq: rename index as driver_data
in cpufreq_frequency_table).

This patch updates the s3c64xx driver to match.

Signed-off-by: Charles Keepax 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/cpufreq/s3c64xx-cpufreq.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/cpufreq/s3c64xx-cpufreq.c
+++ b/drivers/cpufreq/s3c64xx-cpufreq.c
@@ -166,7 +166,7 @@ static void __init s3c64xx_cpufreq_confi
if (freq->frequency == CPUFREQ_ENTRY_INVALID)
continue;
 
-   dvfs = _dvfs_table[freq->index];
+   dvfs = _dvfs_table[freq->driver_data];
found = 0;
 
for (i = 0; i < count; i++) {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] ext4: explain encoding of 34-bit a,c,mtime values

[David Turner]

On Fri, 2013-11-08 at 14:37 -0700, Andreas Dilger wrote:
> On Nov 7, 2013, at 4:26 PM, David Turner  wrote:
> > On Fri, 2013-11-08 at 00:14 +0100, Jan Kara wrote:
> >> Still unnecessary type cast here (but that's a cosmetic issue).
> > ...
> >> Otherwise the patch looks good. You can add:
> >> Reviewed-by: Jan Kara 
> > 
> > Thanks.  A version with this correction and the reviewed-by follows.
> 
> Thanks for working on this.  It was (seriously) in my list of things to
> get done, but I figured I still had a few years to work on it...
> 
> My (unfinished) version of this patch had a nice comment at ext4_encode_time()
> that explained the encoding that is being used very clearly:
> 
> /*
>  * We need is an encoding that preserves the times for extra epoch "00":
>  *
>  * extra  msb of adjust for signed
>  * epoch  32-bit 32-bit tv_sec to
>  * bits   timedecoded 64-bit tv_sec  64-bit tv_sec  valid time range
>  * 0 01-0x8000..-0x0001  0x0 
> 1901-12-13..1969-12-31
>  * 0 000x0..0x07fff  0x0 
> 1970-01-01..2038-01-19
>  * 0 110x08000..0x0  0x1 
> 2038-01-19..2106-02-07
>  * 0 100x1..0x17fff  0x1 
> 2106-02-07..2174-02-25
>  * 1 010x18000..0x1  0x2 
> 2174-02-25..2242-03-16
>  * 1 000x2..0x27fff  0x2 
> 2242-03-16..2310-04-04
>  * 1 110x28000..0x2  0x3 
> 2310-04-04..2378-04-22
>  * 1 100x3..0x37fff  0x3 
> 2378-04-22..2446-05-10
>  */
> 
> It seems that your version of the patch seems to use a different encoding.  
> Not
> that this is a problem, per-se, since my patch wasn’t in use anywhere, but it
> would be nice to have a similarly clear explanation of what the mapping is so
> that it can be clearly understood.

I have included a patch with an explanation (the patch is against
tytso/dev -- I hope that's the correct place).  

> My ext4_{encode,decode}_extra_time() used add/subtract instead of mask/OR ops,
> which changed the on-disk format for times beyond 2038, but those were already
> broken, and presumably not in use by anyone yet. 

They were actually correct according to my patch's encoding (that is, my
patch used the existing encoding).  The existing encoding was written
correctly, but read wrongly.  As you say, this should not matter, since
nobody should be writing these timestamps, but I assumed that the
existing encoding had happened for a reason, and wanted to make the
minimal change.

If you believe it is important, I would be happy to change it.

>  However, it seemed to me this
> was easier to produce the correct results.  Have you tested your patch with
> a variety of timestamps to verify its correctness? 

I tested by using touch -d to create one file in each year between 1902
and 2446.  Then I unmounted and remounted the FS, and did ls -l and
manually verified that each file's date matched its name.

> It looks to me like you
> have mapped the 1901-1969 range onto 0x3 for the epoch bits, instead 
> of the (IMHO) natural 0x0 bits. The critical time ranges are listed 
> above.

I think the idea of this is that it is the bottom 34 bits of the 64-bit
signed time.  However, it occurs to me that this relies on a two's
complement machine.  Even though the C standard does not guarantee this,
I believe the kernel requires it, so that's probably OK.

Patch follows:

--
Add a comment explaining the encoding of ext4's extra {a,c,m}time
bits.

Signed-off-by: David Turner 
---
 fs/ext4/ext4.h | 18 ++
 1 file changed, 18 insertions(+)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 121da383..ab69f14 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -713,6 +713,24 @@ struct move_extent {
  sizeof((ext4_inode)->field))  \
<= (EXT4_GOOD_OLD_INODE_SIZE +  \
(einode)->i_extra_isize))   \
+/*
+ * We use the bottom 34 bits of the signed 64-bit time value, with
+ * the top two of these bits in the bottom of extra.  This leads
+ * to a slightly odd encoding, which works like this:
+ *
+ * extra  msb of
+ * epoch  32-bit
+ * bits   timedecoded 64-bit tv_sec   valid time range
+ * 0 000x0..0x07fff  1970-01-01..2038-01-19
+ * 0 010x08000..0x0  2038-01-19..2106-02-07
+ * 0 100x1..0x17fff  2106-02-07..2174-02-25
+ * 0 110x18000..0x1  2174-02-25..2242-03-16
+ * 1 000x2..0x27fff  2242-03-16..2310-04-04
+ * 1 010x28000..0x2  2310-04-04..2378-04-22
+ * 1 100x3..0x37fff  2378-04-22..2446-05-10
+
+ * 1 11-0x8000..-0x0001  1901-12-13..1969-12-31
+ */
 
 static inline __le32 ext4_encode_extra_time(struct timespec *time)
 {
-- 
1.8.1.2



--
To unsubscribe from this list: 

[PATCH 3.10 41/74] ASoC: wm_hubs: Add missing break in hp_supply_event()

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 268ff14525edba31da29a12a9dd693cdd6a7872e upstream.

Spotted by coverity CID 115170.

Signed-off-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/codecs/wm_hubs.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -530,6 +530,7 @@ static int hp_supply_event(struct snd_so
hubs->hp_startup_mode);
break;
}
+   break;
 
case SND_SOC_DAPM_PRE_PMD:
snd_soc_update_bits(codec, WM8993_CHARGE_PUMP_1,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.10 49/74] mm: make generic_access_phys available for modules

[Greg Kroah-Hartman]

3.10-stable review patch.  If anyone has any objections, please let me know.

--

From: Uwe Kleine-König 

commit 5a73633ef01cd8772defa6a3c34a588376a1df4c upstream.

In the next commit this function will be used in the uio subsystem

Signed-off-by: Uwe Kleine-König 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/memory.c |1 +
 1 file changed, 1 insertion(+)

--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4074,6 +4074,7 @@ int generic_access_phys(struct vm_area_s
 
return len;
 }
+EXPORT_SYMBOL_GPL(generic_access_phys);
 #endif
 
 /*


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.11 00/94] 3.11.8-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.11.8 release.
There are 94 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Nov 11 06:51:44 UTC 2013.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.11.8-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 3.11.8-rc1

Jon Mason 
NTB: Correct debugfs to work with more than 1 NTB Device

Jon Mason 
NTB: Correct USD/DSD Identification

Jon Mason 
NTB: Correct Number of Scratch Pad Registers

Jon Mason 
NTB: Add Error Handling in ntb_device_setup

Gu Zheng 
seq_file: always update file->f_pos in seq_lseek()

Tetsuo Handa 
mutex: Avoid gcc version dependent __builtin_constant_p() usage

Daniel Vetter 
drm/i915: Fix the PPT fdi lane bifurcate state handling on ivb

Rob Pearce 
drm/i915: No LVDS hardware on Intel D410PT and D425KT

Ville Syrjälä 
drm/i915: Add support for pipe_bpp readout

Ville Syrjälä 
drm/i915: Add HSW CRT output readout support

Alex Deucher 
drm/radeon: make missing smc ucode non-fatal (r7xx-SI)

Alex Deucher 
drm/radeon/atom: workaround vbios bug in transmitter table on rs780

Chris Wilson 
drm: Pad drm_mode_get_connector to 64-bit boundary

Chris Wilson 
drm: Prevent overwriting from userspace underallocating core ioctl structs

Chris Wilson 
drm/i915: Retry DP aux_ch communications with a different clock after 
failure

Rodrigo Vivi 
drm/i915: split aux_clock_divider logic in a separated function for reuse.

Thomas Hellstrom 
drm/vmwgfx: Don't kill clients on VT switch

Thomas Hellstrom 
drm/vmwgfx: Don't put resources with invalid id's on lru list

Chen LinX 
mm/pagewalk.c: fix walk_page_range() access of wrong PTEs

Cyrill Gorcunov 
mm: /proc/pid/pagemap: inspect _PAGE_SOFT_DIRTY only on present pages

Mel Gorman 
mm: Account for a THP NUMA hinting update as one PTE update

Mel Gorman 
mm: Close races between THP migration and PMD numa clearing

Mel Gorman 
mm: numa: Sanitize task_numa_fault() callsites

Mel Gorman 
mm: Prevent parallel splits during THP migration

Mel Gorman 
mm: Wait for THP migrations to complete during NUMA hinting faults

Mel Gorman 
mm: numa: Do not account for a hinting fault if we raced

Linus Walleij 
clk: nomadik: set all timers to use 2.4 MHz TIMCLK

Jonathan Austin 
clk: fixup argument order when setting VCO parameters

Dan Carpenter 
aacraid: missing capable() check in compat ioctl

Ming Lei 
lib/scatterlist.c: don't flush_kernel_dcache_page on slab page

Linus Torvalds 
Fix a few incorrectly checked [io_]remap_pfn_range() calls

Uwe Kleine-König 
uio: provide vm access to UIO_MEM_PHYS maps

Uwe Kleine-König 
mm: make generic_access_phys available for modules

Baruch Siach 
xtensa: don't use alternate signal stack on threads

Dan Carpenter 
uml: check length in exitcode_proc_write()

Dan Carpenter 
staging: wlags49_h2: buffer overflow setting station name

Dan Carpenter 
Staging: sb105x: info leak in mp_get_count()

Dan Carpenter 
Staging: bcm: info leak in ioctl

Dan Carpenter 
staging: ozwpan: prevent overflow in oz_cdev_write()

Takashi Iwai 
ASoC: dapm: Fix source list debugfs outputs

Takashi Iwai 
ASoC: wm_hubs: Add missing break in hp_supply_event()

Russell King 
ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM

Takashi Iwai 
ALSA: hda - Add a fixup for ASUS N76VZ

Takashi Iwai 
ALSA: hda - Fix unbalanced runtime PM refcount after S3/S4

Takashi Iwai 
ALSA: hda - Add missing initial vmaster hook at build_controls callback

Vineet Gupta 
ARC: Incorrect mm reference used in vmalloc fault handler

Ming Lei 
scripts/kallsyms: filter symbols not in kernel address space

Helge Deller 
parisc: Do not crash 64bit SMP kernels on machines with >= 4GB RAM

Thomas Gleixner 
clockevents: Sanitize ticks to nsec conversion

Nicholas Bellinger 
vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter

Wei Yongjun 
target/pscsi: fix return value check

Roland Dreier 
target: Fix assignment of LUN in tracepoints

Lukasz Dorau 
md: Fix skipping recovery for read-only arrays.

Bian Yu 
md: avoid deadlock when md_set_badblocks.

Rafael J. Wysocki 
Revert "select: use freezable blocking call"

Rafael J. Wysocki 
Revert "epoll: use freezable blocking call"

Stanislaw Gruszka 
Revert "rt2x00pci: Use PCI MSIs whenever possible"

Gwendal Grignou 
libata: make ata_eh_qc_retry() bump scmd->allowed on bogus failures

Shaohua Li 
raid5: avoid finding "discard" stripe

Shaohua Li 
raid5: set bio bi_vcnt 0 for discard request

Colin Ian King 
   

[PATCH 3.11 04/94] USB: quirks.c: add one device that cannot deal with suspension

[Greg Kroah-Hartman]

3.11-stable review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 4294bca7b423d1a5aa24307e3d112a04075e3763 upstream.

The device is not responsive when resumed, unless it is reset.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/usb/core/quirks.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -130,6 +130,9 @@ static const struct usb_device_id usb_qu
/* Broadcom BCM92035DGROM BT dongle */
{ USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
 
+   /* MAYA44USB sound device */
+   { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Action Semiconductor flash disk */
{ USB_DEVICE(0x10d6, 0x2200), .driver_info =
USB_QUIRK_STRING_FETCH_255 },


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.11 24/94] rtlwifi: rtl8192cu: Fix error in pointer arithmetic

[Greg Kroah-Hartman]

3.11-stable review patch.  If anyone has any objections, please let me know.

--

From: Mark Cave-Ayland 

commit 9473ca6e920a3b9ca902753ce52833657f9221cc upstream.

An error in calculating the offset in an skb causes the driver to read
essential device info from the wrong locations. The main effect is that
automatic gain calculations are nonsense.

Signed-off-by: Mark Cave-Ayland 
Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80
(bool)GET_RX_DESC_PAGGR(pdesc));
rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
if (phystatus) {
-   p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
+   p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+stats->rx_bufshift);
rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
 p_drvinfo);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.11 22/94] cfg80211: fix warning when using WEXT for IBSS

[Greg Kroah-Hartman]

3.11-stable review patch.  If anyone has any objections, please let me know.

--

From: Bruno Randolf 

commit f478f33a93f9353dcd1fe55445343d76b1c3f84a upstream.

Fix kernel warning when using WEXT for configuring ad-hoc mode,
e.g.  "iwconfig wlan0 essid test channel 1"

WARNING: at net/wireless/chan.c:373 cfg80211_chandef_usable+0x50/0x21c 
[cfg80211]()

The warning is caused by an uninitialized variable center_freq1.

Signed-off-by: Bruno Randolf 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/wireless/ibss.c |3 +++
 1 file changed, 3 insertions(+)

--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80
if (chan->flags & IEEE80211_CHAN_DISABLED)
continue;
wdev->wext.ibss.chandef.chan = chan;
+   wdev->wext.ibss.chandef.center_freq1 =
+   chan->center_freq;
break;
}
 
@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct ne
if (chan) {
wdev->wext.ibss.chandef.chan = chan;
wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+   wdev->wext.ibss.chandef.center_freq1 = freq;
wdev->wext.ibss.channel_fixed = true;
} else {
/* cfg80211_ibss_wext_join will pick one if needed */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.11 21/94] cfg80211: use the correct macro to check for active monitor support

[Greg Kroah-Hartman]

3.11-stable review patch.  If anyone has any objections, please let me know.

--

From: Luciano Coelho 

commit 180032973ee97daddf5c9d733e5b425b108f8679 upstream.

Use MONITOR_FLAG_ACTIVE, which is a flag mask, instead of
NL80211_MNTR_FLAG_ACTIVE, which is a flag index, when checking if the
hardware supports active monitoring.

Signed-off-by: Luciano Coelho 
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman 

---
 net/wireless/nl80211.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2379,7 +2379,7 @@ static int nl80211_set_interface(struct
change = true;
}
 
-   if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+   if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
!(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
return -EOPNOTSUPP;
 
@@ -2441,7 +2441,7 @@ static int nl80211_new_interface(struct
  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
  );
 
-   if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+   if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
!(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
return -EOPNOTSUPP;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.11 12/94] bcache: Fixed incorrect order of arguments to bio_alloc_bioset()

[Greg Kroah-Hartman]

3.11-stable review patch.  If anyone has any objections, please let me know.

--

From: Kent Overstreet 

commit d4eddd42f592a0cf06818fae694a3d271f842e4d upstream.

Signed-off-by: Kent Overstreet 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/md/bcache/request.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -1000,7 +1000,7 @@ static void request_write(struct cached_
 
if (bio->bi_rw & REQ_FLUSH) {
/* Also need to send a flush to the backing device */
-   struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
+   struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
 
dc->disk.bio_split);
 
flush->bi_rw= WRITE_FLUSH;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/