Linux Kernel - Tüm Sürümler

Bu konuyu okuyanlar

Militarist

Dekan
Katılım
4 Mayıs 2008
Mesajlar
7,620
Reaksiyon puanı
130
Puanları
63
1zxvzow.jpg


Linux Kernel 3.4.7 Stable

Linux çekirdeği Unix benzeri işletim sistemleri içinde yer alan Linux ailesinin çekirdeğidir.[1] Açık Kaynak ve Özgür Yazılım hareketinin en ünlü örneklerindendir.[2]

Linux çekirdeği GNU Genel Kamu Lisansı sürüm 2 (GPLv2) altında yayınlanmıştır[3] ve dünyanın dört bir yanından katılımcıların katkılarıyla geliştirilir. Günlük geliştirme faaliyetleri Linux çekirdeği e-posta listeleri[4] üzerinden yürütülür.

Linux çekirdeği ilk olarak Finlandiyalı bilgisayar bilimi öğrencisi[5] Linus Torvalds tarafından 1991 yılında tasarlanıp yaratıldı. Kısa zamanda Linux'un çevresinde toplanan geliştiriciler ve kullanıcılar diğer Özgür Yazılım projelerinden uyarladıkları kodlarla yeni bir işletim sistemi oluşturmaya başladılar.[6] Linux çekirdeğine binlerce programcı katkıda bulundu.[7] Linux çekirdeği üzerine inşa edilmiş çok sayıda Linux dağıtımı vardır.

GNU/Linux işletim sistemiyle çalışan bir bilgisayarda Linux çekirdeği sürümünü öğrenmek için, komut satırında
uname -r komutu kullanılabilir.

http://tr.wikipedia.org/wiki/Linux_çekirdeği

http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.4.7

Kod:
commit 0d0eef55e03a76885b5d665b1f5572e1f4975886
Author: Greg Kroah-Hartman <[email protected]>
Date:   Sun Jul 29 08:04:57 2012 -0700

    Linux 3.4.7

commit 5d0c7b47b27d51c45700b1153ac86752ff743aa6
Author: Jeff Layton <[email protected]>
Date:   Wed Jul 11 09:09:36 2012 -0400

    cifs: when CONFIG_HIGHMEM is set, serialize the read/write kmaps
    
    commit 3cf003c08be785af4bee9ac05891a15bcbff856a upstream.
    
    [The async read code was broadened to include uncached reads in 3.5, so
    the mainline patch did not apply directly. This patch is just a backport
    to account for that change.]
    
    Jian found that when he ran fsx on a 32 bit arch with a large wsize the
    process and one of the bdi writeback kthreads would sometimes deadlock
    with a stack trace like this:
    
    crash> bt
    PID: 2789   TASK: f02edaa0  CPU: 3   COMMAND: "fsx"
     #0 [eed63cbc] schedule at c083c5b3
     #1 [eed63d80] kmap_high at c0500ec8
     #2 [eed63db0] cifs_async_writev at f7fabcd7 [cifs]
     #3 [eed63df0] cifs_writepages at f7fb7f5c [cifs]
     #4 [eed63e50] do_writepages at c04f3e32
     #5 [eed63e54] __filemap_fdatawrite_range at c04e152a
     #6 [eed63ea4] filemap_fdatawrite at c04e1b3e
     #7 [eed63eb4] cifs_file_aio_write at f7fa111a [cifs]
     #8 [eed63ecc] do_sync_write at c052d202
     #9 [eed63f74] vfs_write at c052d4ee
    #10 [eed63f94] sys_write at c052df4c
    #11 [eed63fb0] ia32_sysenter_target at c0409a98
        EAX: 00000004  EBX: 00000003  ECX: abd73b73  EDX: 012a65c6
        DS:  007b      ESI: 012a65c6  ES:  007b      EDI: 00000000
        SS:  007b      ESP: bf8db178  EBP: bf8db1f8  GS:  0033
        CS:  0073      EIP: 40000424  ERR: 00000004  EFLAGS: 00000246
    
    Each task would kmap part of its address array before getting stuck, but
    not enough to actually issue the write.
    
    This patch fixes this by serializing the marshal_iov operations for
    async reads and writes. The idea here is to ensure that cifs
    aggressively tries to populate a request before attempting to fulfill
    another one. As soon as all of the pages are kmapped for a request, then
    we can unlock and allow another one to proceed.
    
    There's no need to do this serialization on non-CONFIG_HIGHMEM arches
    however, so optimize all of this out when CONFIG_HIGHMEM isn't set.
    
    Reported-by: Jian Li <[email protected]>
    Signed-off-by: Jeff Layton <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a22ad130fc91983ac717a24e29838bf2969a67d4
Author: Tushar Behera <[email protected]>
Date:   Thu Jul 12 18:06:28 2012 +0900

    ARM: SAMSUNG: Update default rate for xusbxti clock
    
    commit bdd3cc26ba651e33780ade33f1410320cf2d0cf4 upstream.
    
    The rate of xusbxti clock is set in individual machine files.
    The default value should be defined at the clock definition
    and individual machine files should modify it if required.
    
    Division by zero in kernel.
    [<c0011849>] (unwind_backtrace+0x1/0x9c) from [<c022c663>] (Ldiv0+0x9/0x12)
    [<c022c663>] (Ldiv0+0x9/0x12) from [<c001a3c3>] (s3c_setrate_clksrc+0x33/0x78)
    [<c001a3c3>] (s3c_setrate_clksrc+0x33/0x78) from [<c0019e67>] (clk_set_rate+0x2f/0x78)
    
    Signed-off-by: Tushar Behera <[email protected]>
    Signed-off-by: Kukjin Kim <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5a4db9ee4f44658077a11c71d78a17573016fc0e
Author: Mikulas Patocka <[email protected]>
Date:   Fri Jul 20 14:25:07 2012 +0100

    dm raid1: set discard_zeroes_data_unsupported
    
    commit 7c8d3a42fe1c58a7e8fd3f6a013e7d7b474ff931 upstream.
    
    We can't guarantee that REQ_DISCARD on dm-mirror zeroes the data even if
    the underlying disks support zero on discard.  So this patch sets
    ti->discard_zeroes_data_unsupported.
    
    For example, if the mirror is in the process of resynchronizing, it may
    happen that kcopyd reads a piece of data, then discard is sent on the
    same area and then kcopyd writes the piece of data to another leg.
    Consequently, the data is not zeroed.
    
    The flag was made available by commit 983c7db347db8ce2d8453fd1d89b7a4bb6920d56
    (dm crypt: always disable discard_zeroes_data).
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Alasdair G Kergon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 91aafba4414743c24c6d06ccca75113e4abd13a8
Author: Mikulas Patocka <[email protected]>
Date:   Fri Jul 20 14:25:03 2012 +0100

    dm raid1: fix crash with mirror recovery and discard
    
    commit 751f188dd5ab95b3f2b5f2f467c38aae5a2877eb upstream.
    
    This patch fixes a crash when a discard request is sent during mirror
    recovery.
    
    Firstly, some background.  Generally, the following sequence happens during
    mirror synchronization:
    - function do_recovery is called
    - do_recovery calls dm_rh_recovery_prepare
    - dm_rh_recovery_prepare uses a semaphore to limit the number
      simultaneously recovered regions (by default the semaphore value is 1,
      so only one region at a time is recovered)
    - dm_rh_recovery_prepare calls __rh_recovery_prepare,
      __rh_recovery_prepare asks the log driver for the next region to
      recover. Then, it sets the region state to DM_RH_RECOVERING. If there
      are no pending I/Os on this region, the region is added to
      quiesced_regions list. If there are pending I/Os, the region is not
      added to any list. It is added to the quiesced_regions list later (by
      dm_rh_dec function) when all I/Os finish.
    - when the region is on quiesced_regions list, there are no I/Os in
      flight on this region. The region is popped from the list in
      dm_rh_recovery_start function. Then, a kcopyd job is started in the
      recover function.
    - when the kcopyd job finishes, recovery_complete is called. It calls
      dm_rh_recovery_end. dm_rh_recovery_end adds the region to
      recovered_regions or failed_recovered_regions list (depending on
      whether the copy operation was successful or not).
    
    The above mechanism assumes that if the region is in DM_RH_RECOVERING
    state, no new I/Os are started on this region. When I/O is started,
    dm_rh_inc_pending is called, which increases reg->pending count. When
    I/O is finished, dm_rh_dec is called. It decreases reg->pending count.
    If the count is zero and the region was in DM_RH_RECOVERING state,
    dm_rh_dec adds it to the quiesced_regions list.
    
    Consequently, if we call dm_rh_inc_pending/dm_rh_dec while the region is
    in DM_RH_RECOVERING state, it could be added to quiesced_regions list
    multiple times or it could be added to this list when kcopyd is copying
    data (it is assumed that the region is not on any list while kcopyd does
    its jobs). This results in memory corruption and crash.
    
    There already exist bypasses for REQ_FLUSH requests: REQ_FLUSH requests
    do not belong to any region, so they are always added to the sync list
    in do_writes. dm_rh_inc_pending does not increase count for REQ_FLUSH
    requests. In mirror_end_io, dm_rh_dec is never called for REQ_FLUSH
    requests. These bypasses avoid the crash possibility described above.
    
    These bypasses were improperly implemented for REQ_DISCARD when
    the mirror target gained discard support in commit
    5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4 (dm raid1: support discard).
    
    In do_writes, REQ_DISCARD requests is always added to the sync queue and
    immediately dispatched (even if the region is in DM_RH_RECOVERING).  However,
    dm_rh_inc and dm_rh_dec is called for REQ_DISCARD resusts.  So it violates the
    rule that no I/Os are started on DM_RH_RECOVERING regions, and causes the list
    corruption described above.
    
    This patch changes it so that REQ_DISCARD requests follow the same path
    as REQ_FLUSH. This avoids the crash.
    
    Reference: https://bugzilla.redhat.com/837607
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Alasdair G Kergon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5b8bbc39d5678179f2fd4ee2e09005d8f277834c
Author: Mikulas Patocka <[email protected]>
Date:   Fri Jul 20 14:25:05 2012 +0100

    dm thin: do not send discards to shared blocks
    
    commit 650d2a06b4fe1cc1d218c20e256650f68bf0ca31 upstream.
    
    When process_discard receives a partial discard that doesn't cover a
    full block, it sends this discard down to that block. Unfortunately, the
    block can be shared and the discard would corrupt the other snapshots
    sharing this block.
    
    This patch detects block sharing and ends the discard with success when
    sending it to the shared block.
    
    The above change means that if the device supports discard it can't be
    guaranteed that a discard request zeroes data. Therefore, we set
    ti->discard_zeroes_data_unsupported.
    
    Thin target discard support with this bug arrived in commit
    104655fd4dcebd50068ef30253a001da72e3a081 (dm thin: support discards).
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>
    Signed-off-by: Alasdair G Kergon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 08603bdd6b0b65248921c8be05febe574dd78905
Author: Boaz Harrosh <[email protected]>
Date:   Fri Jun 8 05:29:40 2012 +0300

    pnfs-obj: don't leak objio_state if ore_write/read fails
    
    commit 9909d45a8557455ca5f8ee7af0f253debc851f1a upstream.
    
    [Bug since 3.2 Kernel]
    Signed-off-by: Boaz Harrosh <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f6ecbea43e774dfc0b3678d2cdda9d4b43cfecf8
Author: Boaz Harrosh <[email protected]>
Date:   Fri Jun 8 04:30:40 2012 +0300

    ore: Remove support of partial IO request (NFS crash)
    
    commit 62b62ad873f2accad9222a4d7ffbe1e93f6714c1 upstream.
    
    Do to OOM situations the ore might fail to allocate all resources
    needed for IO of the full request. If some progress was possible
    it would proceed with a partial/short request, for the sake of
    forward progress.
    
    Since this crashes NFS-core and exofs is just fine without it just
    remove this contraption, and fail.
    
    TODO:
    	Support real forward progress with some reserved allocations
    	of resources, such as mem pools and/or bio_sets
    
    [Bug since 3.2 Kernel]
    CC: Benny Halevy <[email protected]>
    Signed-off-by: Boaz Harrosh <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0234af60fb13cbb7caa6f757e4d8e29cd87aaba6
Author: Boaz Harrosh <[email protected]>
Date:   Fri Jun 8 01:19:07 2012 +0300

    ore: Fix NFS crash by supporting any unaligned RAID IO
    
    commit 9ff19309a9623f2963ac5a136782ea4d8b5d67fb upstream.
    
    In RAID_5/6 We used to not permit an IO that it's end
    byte is not stripe_size aligned and spans more than one stripe.
    .i.e the caller must check if after submission the actual
    transferred bytes is shorter, and would need to resubmit
    a new IO with the remainder.
    
    Exofs supports this, and NFS was supposed to support this
    as well with it's short write mechanism. But late testing has
    exposed a CRASH when this is used with none-RPC layout-drivers.
    
    The change at NFS is deep and risky, in it's place the fix
    at ORE to lift the limitation is actually clean and simple.
    So here it is below.
    
    The principal here is that in the case of unaligned IO on
    both ends, beginning and end, we will send two read requests
    one like old code, before the calculation of the first stripe,
    and also a new site, before the calculation of the last stripe.
    If any "boundary" is aligned or the complete IO is within a single
    stripe. we do a single read like before.
    
    The code is clean and simple by splitting the old _read_4_write
    into 3 even parts:
    1._read_4_write_first_stripe
    2. _read_4_write_last_stripe
    3. _read_4_write_execute
    
    And calling 1+3 at the same place as before. 2+3 before last
    stripe, and in the case of all in a single stripe then 1+2+3
    is preformed additively.
    
    Why did I not think of it before. Well I had a strike of
    genius because I have stared at this code for 2 years, and did
    not find this simple solution, til today. Not that I did not try.
    
    This solution is much better for NFS than the previous supposedly
    solution because the short write was dealt  with out-of-band after
    IO_done, which would cause for a seeky IO pattern where as in here
    we execute in order. At both solutions we do 2 separate reads, only
    here we do it within a single IO request. (And actually combine two
    writes into a single submission)
    
    NFS/exofs code need not change since the ORE API communicates the new
    shorter length on return, what will happen is that this case would not
    occur anymore.
    
    hurray!!
    
    [Stable this is an NFS bug since 3.2 Kernel should apply cleanly]
    Signed-off-by: Boaz Harrosh <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 863c806617059e412ade0b1bbb6d215106be14c1
Author: Artem Bityutskiy <[email protected]>
Date:   Sat Jul 14 14:33:09 2012 +0300

    UBIFS: fix a bug in empty space fix-up
    
    commit c6727932cfdb13501108b16c38463c09d5ec7a74 upstream.
    
    UBIFS has a feature called "empty space fix-up" which is a quirk to work-around
    limitations of dumb flasher programs. Namely, of those flashers that are unable
    to skip NAND pages full of 0xFFs while flashing, resulting in empty space at
    the end of half-filled eraseblocks to be unusable for UBIFS. This feature is
    relatively new (introduced in v3.0).
    
    The fix-up routine (fixup_free_space()) is executed only once at the very first
    mount if the superblock has the 'space_fixup' flag set (can be done with -F
    option of mkfs.ubifs). It basically reads all the UBIFS data and metadata and
    writes it back to the same LEB. The routine assumes the image is pristine and
    does not have anything in the journal.
    
    There was a bug in 'fixup_free_space()' where it fixed up the log incorrectly.
    All but one LEB of the log of a pristine file-system are empty. And one
    contains just a commit start node. And 'fixup_free_space()' just unmapped this
    LEB, which resulted in wiping the commit start node. As a result, some users
    were unable to mount the file-system next time with the following symptom:
    
    UBIFS error (pid 1): replay_log_leb: first log node at LEB 3:0 is not CS node
    UBIFS error (pid 1): replay_log_leb: log error detected while replaying the log at LEB 3:0
    
    The root-cause of this bug was that 'fixup_free_space()' wrongly assumed
    that the beginning of empty space in the log head (c->lhead_offs) was known
    on mount. However, it is not the case - it was always 0. UBIFS does not store
    in it the master node and finds out by scanning the log on every mount.
    
    The fix is simple - just pass commit start node size instead of 0 to
    'fixup_leb()'.
    
    Signed-off-by: Artem Bityutskiy <[email protected]>
    Reported-by: Iwo Mergler <[email protected]>
    Tested-by: Iwo Mergler <[email protected]>
    Reported-by: James Nute <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ec8348902ff82ae44f25b3127f8f3ec47e1e6a07
Author: David Daney <[email protected]>
Date:   Thu Jul 19 09:11:14 2012 +0200

    MIPS: Properly align the .data..init_task section.
    
    commit 7b1c0d26a8e272787f0f9fcc5f3e8531df3b3409 upstream.
    
    Improper alignment can lead to unbootable systems and/or random
    crashes.
    
    [[email protected]: This is a lond standing bug since
    6eb10bc9e2deab06630261cd05c4cb1e9a60e980 (kernel.org) rsp.
    c422a10917f75fd19fa7fe070aaaa23e384dae6f (lmo) [MIPS: Clean up linker script
    using new linker script macros.] so dates back to 2.6.32.]
    
    Signed-off-by: David Daney <[email protected]>
    Cc: [email protected]
    Patchwork: https://patchwork.linux-mips.org/patch/3881/
    Signed-off-by: Ralf Baechle <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 60d091aeb66c0b201689862bcb803c32db712d05
Author: Jiri Kosina <[email protected]>
Date:   Fri Apr 20 12:15:44 2012 +0200

    HID: multitouch: Add support for Baanto touchscreen
    
    commit 9ed326951806c424b42dcf2e1125e25a98fb13d1 upstream.
    
    Reported-by: Tvrtko Ursulin <[email protected]>
    Tested-by: Tvrtko Ursulin <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit eb6cf92d839f43dbc2009a2440479f46f7adfd46
Author: Frank Kunz <[email protected]>
Date:   Thu Jul 5 22:32:49 2012 +0200

    HID: add Sennheiser BTD500USB device support
    
    commit 0e050923a797c1fc46ccc1e5182fd3090f33a75d upstream.
    
    The Sennheiser BTD500USB composit device requires the
    HID_QUIRK_NOGET flag to be set for working proper. Without the
    flag the device crashes during hid intialization.
    
    Signed-off-by: Frank Kunz <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e58cd46e372812120c547f1b311f7a1a00c22af4
Author: Daniel Nicoletti <[email protected]>
Date:   Wed Jul 4 10:20:31 2012 -0300

    HID: add battery quirk for Apple Wireless ANSI
    
    commit 0c47935c5b5cd4916cf1c1ed4a2894807f7bcc3e upstream.
    
    Add USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI, to the quirk list since it report
    wrong feature type and wrong percentage range.
    
    Signed-off-by: Daniel Nicoletti <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 07aa70120e4be526a468b9c3ea93b45cfbe95013
Author: Aaditya Kumar <[email protected]>
Date:   Tue Jul 17 15:48:07 2012 -0700

    mm: fix lost kswapd wakeup in kswapd_stop()
    
    commit 1c7e7f6c0703d03af6bcd5ccc11fc15d23e5ecbe upstream.
    
    Offlining memory may block forever, waiting for kswapd() to wake up
    because kswapd() does not check the event kthread->should_stop before
    sleeping.
    
    The proper pattern, from Documentation/memory-barriers.txt, is:
    
       ---  waker  ---
       event_indicated = 1;
       wake_up_process(event_daemon);
    
       ---  sleeper  ---
       for (;;) {
          set_current_state(TASK_UNINTERRUPTIBLE);
          if (event_indicated)
             break;
          schedule();
       }
    
       set_current_state() may be wrapped by:
          prepare_to_wait();
    
    In the kswapd() case, event_indicated is kthread->should_stop.
    
      === offlining memory (waker) ===
       kswapd_stop()
          kthread_stop()
             kthread->should_stop = 1
             wake_up_process()
             wait_for_completion()
    
      ===  kswapd_try_to_sleep (sleeper) ===
       kswapd_try_to_sleep()
          prepare_to_wait()
               .
               .
          schedule()
               .
               .
          finish_wait()
    
    The schedule() needs to be protected by a test of kthread->should_stop,
    which is wrapped by kthread_should_stop().
    
    Reproducer:
       Do heavy file I/O in background.
       Do a memory offline/online in a tight loop
    
    Signed-off-by: Aaditya Kumar <[email protected]>
    Acked-by: KOSAKI Motohiro <[email protected]>
    Reviewed-by: Minchan Kim <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2dbbb550c56cbaf9d8353f4546aab9a88786d279
Author: Al Viro <[email protected]>
Date:   Wed Jul 18 09:31:36 2012 +0100

    ext4: fix duplicated mnt_drop_write call in EXT4_IOC_MOVE_EXT
    
    commit 331ae4962b975246944ea039697a8f1cadce42bb upstream.
    
    Caused, AFAICS, by mismerge in commit ff9cb1c4eead ("Merge branch
    'for_linus' into for_linus_merged")
    
    Signed-off-by: Al Viro <[email protected]>
    Cc: Theodore Ts'o <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8db5153f9dca89afbeebe0b077e7cc1e5827e07a
Author: Mark Rustad <[email protected]>
Date:   Fri Jul 13 18:18:04 2012 -0700

    tcm_fc: Fix crash seen with aborts and large reads
    
    commit 3cc5d2a6b9a2fd1bf024aa5e52dd22961eecaf13 upstream.
    
    This patch fixes a crash seen when large reads have their exchange
    aborted by either timing out or being reset. Because the exchange
    abort results in the seq pointer being set to NULL, because the
    sequence is no longer valid, it must not be dereferenced. This
    patch changes the function ft_get_task_tag to return ~0 if it is
    unable to get the tag for this reason. Because the get_task_tag
    interface provides no means of returning an error, this seems
    like the best way to fix this issue at the moment.
    
    Signed-off-by: Mark Rustad <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fd25080998d00a94a87bf7fc9f843291db7250a6
Author: John Stultz <[email protected]>
Date:   Fri Jul 13 01:21:50 2012 -0400

    ntp: Fix STA_INS/DEL clearing bug
    
    commit 6b1859dba01c7d512b72d77e3fd7da8354235189 upstream.
    
    In commit 6b43ae8a619d17c4935c3320d2ef9e92bdeed05d, I
    introduced a bug that kept the STA_INS or STA_DEL bit
    from being cleared from time_status via adjtimex()
    without forcing STA_PLL first.
    
    Usually once the STA_INS is set, it isn't cleared
    until the leap second is applied, so its unlikely this
    affected anyone. However during testing I noticed it
    took some effort to cancel a leap second once STA_INS
    was set.
    
    Signed-off-by: John Stultz <[email protected]>
    Cc: Ingo Molnar <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Cc: Richard Cochran <[email protected]>
    Cc: Prarit Bhargava <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Thomas Gleixner <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5c8c9e57270fc5f54aa02144f7280f91ee2e3334
Author: Roland Dreier <[email protected]>
Date:   Mon Jul 16 17:10:17 2012 -0700

    target: Fix range calculation in WRITE SAME emulation when num blocks == 0
    
    commit 1765fe5edcb83f53fc67edeb559fcf4bc82c6460 upstream.
    
    When NUMBER OF LOGICAL BLOCKS is 0, WRITE SAME is supposed to write
    all the blocks from the specified LBA through the end of the device.
    However, dev->transport->get_blocks(dev) (perhaps confusingly) returns
    the last valid LBA rather than the number of blocks, so the correct
    number of blocks to write starting with lba is
    
    dev->transport->get_blocks(dev) - lba + 1
    
    (nab: Backport roland's for-3.6 patch to for-3.5)
    
    Signed-off-by: Roland Dreier <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 815faab2c4b7deb2cc6495186307ceb0983214a9
Author: Roland Dreier <[email protected]>
Date:   Mon Jul 16 15:17:10 2012 -0700

    target: Clean up returning errors in PR handling code
    
    commit d35212f3ca3bf4fb49d15e37f530c9931e2d2183 upstream.
    
     - instead of (PTR_ERR(file) < 0) just use IS_ERR(file)
     - return -EINVAL instead of EINVAL
     - all other error returns in target_scsi3_emulate_pr_out() use
       "goto out" -- get rid of the one remaining straight "return."
    
    Signed-off-by: Roland Dreier <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c82cd13737cfab6cb9d1b31e624896e627f9c9e4
Author: Jeff Layton <[email protected]>
Date:   Wed Jul 11 09:09:35 2012 -0400

    cifs: on CONFIG_HIGHMEM machines, limit the rsize/wsize to the kmap space
    
    commit 3ae629d98bd5ed77585a878566f04f310adbc591 upstream.
    
    We currently rely on being able to kmap all of the pages in an async
    read or write request. If you're on a machine that has CONFIG_HIGHMEM
    set then that kmap space is limited, sometimes to as low as 512 slots.
    
    With 512 slots, we can only support up to a 2M r/wsize, and that's
    assuming that we can get our greedy little hands on all of them. There
    are other users however, so it's possible we'll end up stuck with a
    size that large.
    
    Since we can't handle a rsize or wsize larger than that currently, cap
    those options at the number of kmap slots we have. We could consider
    capping it even lower, but we currently default to a max of 1M. Might as
    well allow those luddites on 32 bit arches enough rope to hang
    themselves.
    
    A more robust fix would be to teach the send and receive routines how
    to contend with an array of pages so we don't need to marshal up a kvec
    array at all. That's a fairly significant overhaul though, so we'll need
    this limit in place until that's ready.
    
    Reported-by: Jian Li <[email protected]>
    Signed-off-by: Jeff Layton <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f952e137849253c0584a60cc2d73a220d9a091f8
Author: Jeff Layton <[email protected]>
Date:   Fri Jul 6 07:09:42 2012 -0400

    cifs: always update the inode cache with the results from a FIND_*
    
    commit cd60042cc1392e79410dc8de9e9c1abb38a29e57 upstream.
    
    When we get back a FIND_FIRST/NEXT result, we have some info about the
    dentry that we use to instantiate a new inode. We were ignoring and
    discarding that info when we had an existing dentry in the cache.
    
    Fix this by updating the inode in place when we find an existing dentry
    and the uniqueid is the same.
    
    Reported-and-Tested-by: Andrew Bartlett <[email protected]>
    Reported-by: Bill Robertson <[email protected]>
    Reported-by: Dion Edwards <[email protected]>
    Signed-off-by: Jeff Layton <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d8ae4bb4a1c12f9cfb373f215e624a9f1fca0767
Author: NeilBrown <[email protected]>
Date:   Thu Jul 19 15:59:18 2012 +1000

    md/raid1: close some possible races on write errors during resync
    
    commit 58e94ae18478c08229626daece2fc108a4a23261 upstream.
    
    commit 4367af556133723d0f443e14ca8170d9447317cb
       md/raid1: clear bad-block record when write succeeds.
    
    Added a 'reschedule_retry' call possibility at the end of
    end_sync_write, but didn't add matching code at the end of
    sync_request_write.  So if the writes complete very quickly, or
    scheduling makes it seem that way, then we can miss rescheduling
    the request and the resync could hang.
    
    Also commit 73d5c38a9536142e062c35997b044e89166e063b
        md: avoid races when stopping resync.
    
    Fix a race condition in this same code in end_sync_write but didn't
    make the change in sync_request_write.
    
    This patch updates sync_request_write to fix both of those.
    Patch is suitable for 3.1 and later kernels.
    
    Reported-by: Alexander Lyakas <[email protected]>
    Original-version-by: Alexander Lyakas <[email protected]>
    Signed-off-by: NeilBrown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2ac8a0f58a8782ff8024404a579eee260e8b2010
Author: NeilBrown <[email protected]>
Date:   Thu Jul 19 15:59:18 2012 +1000

    md: avoid crash when stopping md array races with closing other open fds.
    
    commit a05b7ea03d72f36edb0cec05e8893803335c61a0 upstream.
    
    md will refuse to stop an array if any other fd (or mounted fs) is
    using it.
    When any fs is unmounted of when the last open fd is closed all
    pending IO will be flushed (e.g. sync_blockdev call in __blkdev_put)
    so there will be no pending IO to worry about when the array is
    stopped.
    
    However in order to send the STOP_ARRAY ioctl to stop the array one
    must first get and open fd on the block device.
    If some fd is being used to write to the block device and it is closed
    after mdadm open the block device, but before mdadm issues the
    STOP_ARRAY ioctl, then there will be no last-close on the md device so
    __blkdev_put will not call sync_blockdev.
    
    If this happens, then IO can still be in-flight while md tears down
    the array and bad things can happen (use-after-free and subsequent
    havoc).
    
    So in the case where do_md_stop is being called from an open file
    descriptor, call sync_block after taking the mutex to ensure there
    will be no new openers.
    
    This is needed when setting a read-write device to read-only too.
    
    Reported-by: majianpeng <[email protected]>
    Signed-off-by: NeilBrown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 

sinan.nar

Öğrenci
Katılım
6 Eylül 2012
Mesajlar
15
Reaksiyon puanı
0
Puanları
0
ben burdan değilde kernel.org dan indirip derlemiştim bir arkadasımın bilgisayarı için.lenova u300 var mouse pad de multi touch yoktu onun için PAE desteği olan birşeyler yaptık ben bikaç kez derledim o gün.hatta derledıgımızı kurduk calıstırdık felan.su anda arkadasım kendı tekrar derledı kendı patch ini ekledi felan su anda multitouch i windows dan daha ii kullanıo :) hatta 11 dk sürdü 8 çekirdeğede compiling i dagıtınca...
 

Militarist

Dekan
Katılım
4 Mayıs 2008
Mesajlar
7,620
Reaksiyon puanı
130
Puanları
63
Linux Kernel 3.6.3 Stable

Kod:
commit 9f2a940965286754f3a34d5737c3097c05db8725
Author: Greg Kroah-Hartman <[email protected]>
Date:   Sun Oct 21 09:32:56 2012 -0700

    Linux 3.6.3

commit 0b90b298b19530b58a2b93c9f73f95ad21d32d2a
Author: Maxim Kachur <[email protected]>
Date:   Wed Oct 17 18:18:10 2012 +0200

    ALSA: emu10k1: add chip details for E-mu 1010 PCIe card
    
    commit 10f571d09106c3eb85951896522c9650596eff2e upstream.
    
    Add chip details for E-mu 1010 PCIe card. It has the same
    chip as found in E-mu 1010b but it uses different PCI id.
    
    Signed-off-by: Maxim Kachur <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f3c3eb99d6cbd372b9cb07fb21be972e06a76e44
Author: Takashi Iwai <[email protected]>
Date:   Thu Oct 11 16:43:40 2012 +0200

    ALSA: ac97 - Fix missing NULL check in snd_ac97_cvol_new()
    
    commit 733a48e5ae5bf28b046fad984d458c747cbb8c21 upstream.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=44721
    
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0c4439a4e9dafcd3c22652ce0c43c2c85aaa565a
Author: Peter Ujfalusi <[email protected]>
Date:   Tue Oct 2 15:31:16 2012 +0300

    ASoC: omap-abe-twl6040: Fix typo of Vibrator
    
    commit 034940a6b3afbe79022ab6922dd9d2982b78e6d5 upstream.
    
    It is not Vinrator but Vibrator.
    
    Signed-off-by: Peter Ujfalusi <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d45ee4a56528df458b9cc8f1acc71e7635f50c50
Author: Mark Brown <[email protected]>
Date:   Tue Oct 2 19:10:43 2012 +0100

    ASoC: wm2200: Fix non-inverted OUT2 mute control
    
    commit a1b98e12b7f8fad2f0aa3c08a3302bcac7ae1ec7 upstream.
    
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4b3de1fa722c1ac09445745a94ad283c23ef1e0d
Author: Mark Brown <[email protected]>
Date:   Tue Oct 2 12:02:48 2012 +0100

    ASoC: wm2200: Use rev A register patches on rev B
    
    commit 5ae9eb4cbdfd640269dbd66aa3c92ea8e11cc838 upstream.
    
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit aadc0b179205a575e47cbba85cdfe71199c361a2
Author: Guennadi Liakhovetski <[email protected]>
Date:   Wed Oct 3 14:33:50 2012 +0200

    ASoC: fsi: don't reschedule DMA from an atomic context
    
    commit 57451e437796548d658d03c2c4aab659eafcd799 upstream.
    
    shdma doesn't support transfer re-scheduling or triggering from callbacks
    or from atomic context. The fsi driver issues DMA transfers from a tasklet
    context, which is a bug. To fix it convert tasklet to a work.
    
    Reported-by: Do Q.Thang <[email protected]>
    Tested-by: Do Q.Thang <[email protected]>
    Signed-off-by: Guennadi Liakhovetski <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a2ffa569f0808f2ec15cda2198ab4ebc98731aab
Author: David Henningsson <[email protected]>
Date:   Wed Oct 17 12:43:44 2012 +0200

    ALSA: hda - Always check array bounds in alc_get_line_out_pfx
    
    commit 71aa5ebe36a4e936eff281b375a4707b6a8320f2 upstream.
    
    Even when CONFIG_SND_DEBUG is not enabled, we don't want to
    return an arbitrary memory location when the channel count is
    larger than we expected.
    
    Signed-off-by: David Henningsson <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5831e4dc072b50a8dc77e69d9247588f8559116c
Author: Takashi Iwai <[email protected]>
Date:   Tue Oct 16 16:52:26 2012 +0200

    ALSA: hda - Stop LPIB delay counting on broken hardware
    
    commit 1f04661fde9deda4a2cd5845258715a22d8af197 upstream.
    
    If LPIB reports a pretty bad value, we can't trust such hardware for
    calculating the PCM delay.  Automatically turn off the delay counting
    when such a problem is encountered.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=48911
    
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b393c7d4d577fa9f55fa7ba84d51bd30352b80da
Author: Takashi Iwai <[email protected]>
Date:   Fri Oct 12 17:28:18 2012 +0200

    ALSA: hda - Fix registration race of VGA switcheroo
    
    commit 128960a9ad67e2d119738f5211956e0304517551 upstream.
    
    Delay the registration of VGA switcheroo client to the end of the
    probing.  Otherwise a too quick switching may result in Oops during
    probing.
    
    Also add the check of the return value from snd_hda_lock_devices().
    
    Reported-and-tested-by: Daniel J Blueman <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 758881acfecdc1e872506a6dc156c4dbb99b8f2a
Author: Fabio Porcedda <[email protected]>
Date:   Fri Sep 7 15:27:42 2012 +0200

    usb: gadget: at91_udc: fix dt support
    
    commit 9c6d196d5aa35e07482f23c3e37755e7a82140e0 upstream.
    
    Don't fail the initialization check for the platform_data
    if there is avaiable an associated device tree node.
    
    Signed-off-by: Fabio Porcedda <[email protected]>
    Signed-off-by: Felipe Balbi <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 561948de6498c5a59ebd59f6e383eec7d6d7afd7
Author: Peter Huewe <[email protected]>
Date:   Thu Sep 27 16:09:33 2012 +0200

    tpm: Propagate error from tpm_transmit to fix a timeout hang
    
    commit abce9ac292e13da367bbd22c1f7669f988d931ac upstream.
    
    tpm_write calls tpm_transmit without checking the return value and
    assigns the return value unconditionally to chip->pending_data, even if
    it's an error value.
    This causes three bugs.
    
    So if we write to /dev/tpm0 with a tpm_param_size bigger than
    TPM_BUFSIZE=0x1000 (e.g. 0x100a)
    and a bufsize also bigger than TPM_BUFSIZE (e.g. 0x100a)
    tpm_transmit returns -E2BIG which is assigned to chip->pending_data as
    -7, but tpm_write returns that TPM_BUFSIZE bytes have been successfully
    been written to the TPM, altough this is not true (bug #1).
    
    As we did write more than than TPM_BUFSIZE bytes but tpm_write reports
    that only TPM_BUFSIZE bytes have been written the vfs tries to write
    the remaining bytes (in this case 10 bytes) to the tpm device driver via
    tpm_write which then blocks at
    
     /* cannot perform a write until the read has cleared
     either via tpm_read or a user_read_timer timeout */
     while (atomic_read(&chip->data_pending) != 0)
    	 msleep(TPM_TIMEOUT);
    
    for 60 seconds, since data_pending is -7 and nobody is able to
    read it (since tpm_read luckily checks if data_pending is greater than
    0) (#bug 2).
    
    After that the remaining bytes are written to the TPM which are
    interpreted by the tpm as a normal command. (bug #3)
    So if the last bytes of the command stream happen to be a e.g.
    tpm_force_clear this gets accidentally sent to the TPM.
    
    This patch fixes all three bugs, by propagating the error code of
    tpm_write and returning -E2BIG if the input buffer is too big,
    since the response from the tpm for a truncated value is bogus anyway.
    Moreover it returns -EBUSY to userspace if there is a response ready to be
    read.
    
    Signed-off-by: Peter Huewe <[email protected]>
    Signed-off-by: Kent Yoder <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3468e9db2687a4a3ad234f94ec7169028f470d3f
Author: Hiroaki SHIMODA <[email protected]>
Date:   Wed Oct 10 15:34:20 2012 +0000

    e1000e: Change wthresh to 1 to avoid possible Tx stalls
    
    commit 8edc0e624db3756783233e464879eb2e3b904c13 upstream.
    
    This patch originated from Hiroaki SHIMODA but has been modified
    by Intel with some minor cleanups and additional commit log text.
    
    Denys Fedoryshchenko and others reported Tx stalls on e1000e with
    BQL enabled.  Issue was root caused to hardware delays. They were
    introduced because some of the e1000e hardware with transmit
    writeback bursting enabled, waits until the driver does an
    explict flush OR there are WTHRESH descriptors to write back.
    
    Sometimes the delays in question were on the order of seconds,
    causing visible lag for ssh sessions and unacceptable tx
    completion latency, especially for BQL enabled kernels.
    
    To avoid possible Tx stalls, change WTHRESH back to 1.
    
    The current plan is to investigate a method for re-enabling
    WTHRESH while not harming BQL, but those patches will be later
    for net-next if they work.
    
    please enqueue for stable since v3.3 as this bug was introduced in
    commit 3f0cfa3bc11e7f00c9994e0f469cbc0e7da7b00c
    Author: Tom Herbert <[email protected]>
    Date:   Mon Nov 28 16:33:16 2011 +0000
    
        e1000e: Support for byte queue limits
    
        Changes to e1000e to use byte queue limits.
    
    Reported-by: Denys Fedoryshchenko <[email protected]>
    Tested-by: Denys Fedoryshchenko <[email protected]>
    Signed-off-by: Hiroaki SHIMODA <[email protected]>
    CC: [email protected]
    CC: [email protected]
    Signed-off-by: Jesse Brandeburg <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e722bf58d3647ff16a90ca9c27bb1809da36e389
Author: Brian Norris <[email protected]>
Date:   Fri Jul 13 09:28:24 2012 -0700

    mtd: nand: allow NAND_NO_SUBPAGE_WRITE to be set from driver
    
    commit bf7a01bf7987b63b121d572b240c132ec44129c4 upstream.
    
    The NAND_CHIPOPTIONS_MSK has limited utility and is causing real bugs. It
    silently masks off at least one flag that might be set by the driver
    (NAND_NO_SUBPAGE_WRITE). This breaks the GPMI NAND driver and possibly
    others.
    
    Really, as long as driver writers exercise a small amount of care with
    NAND_* options, this mask is not necessary at all; it was only here to
    prevent certain options from accidentally being set by the driver. But the
    original thought turns out to be a bad idea occasionally. Thus, kill it.
    
    Note, this patch fixes some major gpmi-nand breakage.
    
    Signed-off-by: Brian Norris <[email protected]>
    Tested-by: Huang Shijie <[email protected]>
    Cc: [email protected]
    Signed-off-by: Artem Bityutskiy <[email protected]>
    Signed-off-by: David Woodhouse <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    
    
    index a11253a..c429abd 100644

commit efe463f10b783cc62f6bf8103148a66adf15e038
Author: Jan Kara <[email protected]>
Date:   Wed Jul 11 23:16:25 2012 +0200

    jbd: Fix assertion failure in commit code due to lacking transaction credits
    
    commit 09e05d4805e6c524c1af74e524e5d0528bb3fef3 upstream.
    
    ext3 users of data=journal mode with blocksize < pagesize were occasionally
    hitting assertion failure in journal_commit_transaction() checking whether the
    transaction has at least as many credits reserved as buffers attached.  The
    core of the problem is that when a file gets truncated, buffers that still need
    checkpointing or that are attached to the committing transaction are left with
    buffer_mapped set. When this happens to buffers beyond i_size attached to a
    page stradding i_size, subsequent write extending the file will see these
    buffers and as they are mapped (but underlying blocks were freed) things go
    awry from here.
    
    The assertion failure just coincidentally (and in this case luckily as we would
    start corrupting filesystem) triggers due to journal_head not being properly
    cleaned up as well.
    
    Under some rare circumstances this bug could even hit data=ordered mode users.
    There the assertion won't trigger and we would end up corrupting the
    filesystem.
    
    We fix the problem by unmapping buffers if possible (in lots of cases we just
    need a buffer attached to a transaction as a place holder but it must not be
    written out anyway). And in one case, we just have to bite the bullet and wait
    for transaction commit to finish.
    
    Reviewed-by: Josef Bacik <[email protected]>
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 680fb76fbb854d3167477ce83388eb9db36d7dde
Author: Ondrej Zary <[email protected]>
Date:   Thu Oct 11 22:51:41 2012 +0000

    mcs7830: Fix link state detection
    
    commit dabdaf0caa3af520dbc1df87b2fb4e77224037bd upstream.
    
    The device had an undocumented "feature": it can provide a sequence of
    spurious link-down status data even if the link is up all the time.
    A sequence of 10 was seen so update the link state only after the device
    reports the same link state 20 times.
    
    Signed-off-by: Ondrej Zary <[email protected]>
    Reported-by: Michael Leun <[email protected]>
    Tested-by: Michael Leun <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6c34ed3be47036c173f7f43df112f93fbd89026f
Author: Jani Nikula <[email protected]>
Date:   Wed Sep 26 18:43:10 2012 +0300

    drm/i915: use adjusted_mode instead of mode for checking the 6bpc force flag
    
    commit 0c96c65b48fba3ffe9822a554cbc0cd610765cd5 upstream.
    
    The dithering introduced in
    
    commit 3b5c78a35cf7511c15e09a9b0ffab290a42d9bcf
    Author: Adam Jackson <[email protected]>
    Date:   Tue Dec 13 15:41:00 2011 -0800
    
        drm/i915/dp: Dither down to 6bpc if it makes the mode fit
    
    stores the INTEL_MODE_DP_FORCE_6BPC flag in the private_flags of the
    adjusted mode, while i9xx_crtc_mode_set() and ironlake_crtc_mode_set() use
    the original mode, without the flag, so it would never have any
    effect. However, the BPC was clamped by VBT settings, making things work by
    coincidence, until that part was removed in
    
    commit 4344b813f105a19f793f1fd93ad775b784648b95
    Author: Daniel Vetter <[email protected]>
    Date:   Fri Aug 10 11:10:20 2012 +0200
    
    Use adjusted_mode instead of mode when checking for
    INTEL_MODE_DP_FORCE_6BPC to make the flag have effect.
    
    v2: Don't forget to fix this in i9xx_crtc_mode_set() also, pointed out by
    Daniel both before and after sending the first patch.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47621
    CC: Adam Jackson <[email protected]>
    Signed-off-by: Jani Nikula <[email protected]>
    Reviewed-by: Adam Jackson <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 248f303079cbc3161e88e8ebbcc4dd25983e82b0
Author: Kenneth Graunke <[email protected]>
Date:   Sun Oct 7 08:51:07 2012 -0700

    drm/i915: Set guardband clipping workaround bit in the right register.
    
    commit 26b6e44afb58432a5e998da0343757404f9de9ee upstream.
    
    A previous patch, namely:
    
    commit bf97b276ca04cee9ab65ffd378fa8e6aedd71ff6
    Author: Daniel Vetter <[email protected]>
    Date:   Wed Apr 11 20:42:41 2012 +0200
    
        drm/i915: implement w/a for incorrect guarband clipping
    
    accidentally set bit 5 in 3D_CHICKEN, which has nothing to do with
    clipping.  This patch changes it to be set in 3D_CHICKEN3, where it
    belongs.
    
    The game "Dante" demonstrates random clipping issues when guardband
    clipping is enabled and bit 5 of 3D_CHICKEN3 isn't set.  So the
    workaround is actually necessary.
    
    Acked-by: Paul Menzel <[email protected]>
    Cc: Daniel Vetter <[email protected]>
    Cc: Oliver McFadden <[email protected]>
    Signed-off-by: Kenneth Graunke <[email protected]>
    Reviewed-by: Mika Kuoppala <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 673c45ace878af19df61f240bddc44938c47d11d
Author: Willy Tarreau <[email protected]>
Date:   Sat Oct 6 10:20:16 2012 +0200

    drm/i915: remove useless BUG_ON which caused a regression in 3.5.
    
    commit c77d7162a7ae451c2e895d7ef7fbeb0906107472 upstream.
    
    starting an old X server causes a kernel BUG since commit 1b50247a8d:
    
    ------------[ cut here ]------------
    kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3661!
    invalid opcode: 0000 [#1] SMP
    Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss uvcvideo
    +videobuf2_core videodev videobuf2_vmalloc videobuf2_memops uhci_hcd ath9k mac80211 snd_hda_codec_realtek ath9k_common microcode
    +ath9k_hw psmouse serio_raw sg ath cfg80211 atl1c lpc_ich mfd_core ehci_hcd snd_hda_intel snd_hda_codec snd_hwdep snd_pcm rtc_cmos
    +snd_timer snd evdev eeepc_laptop snd_page_alloc sparse_keymap
    
    Pid: 2866, comm: X Not tainted 3.5.6-rc1-eeepc #1 ASUSTeK Computer INC. 1005HA/1005HA
    EIP: 0060:[<c12dc291>] EFLAGS: 00013297 CPU: 0
    EIP is at i915_gem_entervt_ioctl+0xf1/0x110
    EAX: f5941df4 EBX: f5940000 ECX: 00000000 EDX: 00020000
    ESI: f5835400 EDI: 00000000 EBP: f51d7e38 ESP: f51d7e20
     DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
    CR0: 8005003b CR2: b760e0a0 CR3: 351b6000 CR4: 000007d0
    DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
    DR6: ffff0ff0 DR7: 00000400
    Process X (pid: 2866, ti=f51d6000 task=f61af8d0 task.ti=f51d6000)
    Stack:
     00000001 00000000 f5835414 f51d7e84 f5835400 f54f85c0 f51d7f10 c12b530b
     00000001 c151b139 c14751b6 c152e030 00000b32 00006459 00000059 0000e200
     00000001 00000000 00006459 c159ddd0 c12dc1a0 ffffffea 00000000 00000000
    Call Trace:
     [<c12b530b>] drm_ioctl+0x2eb/0x440
     [<c12dc1a0>] ? i915_gem_init+0xe0/0xe0
     [<c1052b2b>] ? enqueue_hrtimer+0x1b/0x50
     [<c1053321>] ? __hrtimer_start_range_ns+0x161/0x330
     [<c10530b3>] ? lock_hrtimer_base+0x23/0x50
     [<c1053163>] ? hrtimer_try_to_cancel+0x33/0x70
     [<c12b5020>] ? drm_version+0x90/0x90
     [<c10ca171>] vfs_ioctl+0x31/0x50
     [<c10ca2e4>] do_vfs_ioctl+0x64/0x510
     [<c10535de>] ? hrtimer_nanosleep+0x8e/0x100
     [<c1052c20>] ? update_rmtp+0x80/0x80
     [<c10ca7c9>] sys_ioctl+0x39/0x60
     [<c1433949>] syscall_call+0x7/0xb
    Code: 83 c4 0c 5b 5e 5f 5d c3 c7 44 24 04 2c 05 53 c1 c7 04 24 6f ef 47 c1 e8 6e e0 fd ff c7 83 38 1e 00 00 00 00 00 00 e9 3f ff ff
    +ff <0f> 0b eb fe 0f 0b eb fe 8d b4 26 00 00 00 00 0f 0b eb fe 8d b6
    EIP: [<c12dc291>] i915_gem_entervt_ioctl+0xf1/0x110 SS:ESP 0068:f51d7e20
    ---[ end trace dd332ec083cbd513 ]---
    
    The crash happens here in i915_gem_entervt_ioctl() :
    
        3659          BUG_ON(!list_empty(&dev_priv->mm.active_list));
        3660          BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
     -> 3661          BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
        3662          mutex_unlock(&dev->struct_mutex);
    
    Quoting Chris :
      "That BUG_ON there is silly and can simply be removed. The check is to
       verify that no batches were submitted to the kernel whilst the UMS/GEM
       client was suspended - to which the BUG_ONs are a crude approximation.
       Furthermore, the checks are too late, since it means we attempted to
       program the hardware whilst it was in an invalid state, the BUG_ONs are
       the least of your concerns at that point."
    
    Note that this regression has been introduced in
    
    commit 1b50247a8ddde4af5aaa0e6bc125615372ce6c16
    Author: Chris Wilson <[email protected]>
    Date:   Tue Apr 24 15:47:30 2012 +0100
    
        drm/i915: Remove the list of pinned inactive objects
    
    Signed-off-by: Willy Tarreau <[email protected]>
    Cc: Chris Wilson <[email protected]>
    [danvet: Added note about the regressing commit and cc: stable.]
    Signed-off-by: Daniel Vetter <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b567aa019fe3d2b9d341650b95c7afcc04a3c812
Author: Egbert Eich <[email protected]>
Date:   Mon Oct 15 08:21:39 2012 +0200

    drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy().
    
    commit 082918471139b07964967cfe5f70230909c82ae1 upstream.
    
    radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[]
    to destroy each of them.
    radeon_ext_tmds_enc_destroy() however also has code to destroy it's
    associated I2C bus rec which has been obtained by radeon_i2c_lookup()
    and is therefore also in the i2c_bus[] list.
    This causes a double free resulting in a kernel panic when unloading
    the radeon driver.
    Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this
    problem.
    
    agd5f: fix compiler warning
    
    Signed-off-by: Egbert Eich <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cd7700b6aa48cc94b83ad54eb3cb1fea38c0d2c8
Author: Sasha Levin <[email protected]>
Date:   Thu Oct 4 19:56:40 2012 -0400

    fs: prevent use after free in auditing when symlink following was denied
    
    commit ffd8d101a3a7d3f2e79deee1e342801703b6dc70 upstream.
    
    Commit "fs: add link restriction audit reporting" has added auditing of failed
    attempts to follow symlinks. Unfortunately, the auditing was being done after
    the struct path structure was released earlier.
    
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Al Viro <[email protected]>
    Cc: Dave Jones <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 724373bd489eb02e1999e2714fcc00658e081a9b
Author: Sasha Levin <[email protected]>
Date:   Thu Oct 4 19:57:31 2012 -0400

    fs: handle failed audit_log_start properly
    
    commit d1c7d97ad58836affde6e39980b96527510b572e upstream.
    
    audit_log_start() may return NULL, this is unchecked by the caller in
    audit_log_link_denied() and could cause a NULL ptr deref.
    
    Introduced by commit a51d9eaa ("fs: add link restriction audit reporting").
    
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Al Viro <[email protected]>
    Cc: Dave Jones <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 47b401b98b81ae1495a84f00f1d6b88316310da9
Author: Jean-Christian de Rivaz <[email protected]>
Date:   Wed Oct 10 12:49:02 2012 +0000

    Add CDC-ACM support for the CX93010-2x UCMxx USB Modem
    
    commit e7d491a19d3e3aac544070293891a2542ae0c565 upstream.
    
    This USB V.92/V.32bis Controllered Modem have the USB vendor ID 0x0572
    and device ID 0x1340. It need the NO_UNION_NORMAL quirk to be recognized.
    
    Reference:
    http://www.conexant.com/servlets/DownloadServlet/DSH-201723-005.pdf?docid=1725&revid=5
    See idVendor and idProduct in table 6-1. Device Descriptors
    
    Signed-off-by: Jean-Christian de Rivaz <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0a7f602a2129426e10f2c5a02f864804bf0c8fb5
Author: Michal Marek <[email protected]>
Date:   Mon Oct 15 21:16:56 2012 +0200

    kbuild: Fix accidental revert in commit fe04ddf
    
    commit 3ce9e53e788881da0d5f3912f80e0dd6b501f304 upstream.
    
    Commit fe04ddf7c291 ("kbuild: Do not package /boot and /lib in make
    tar-pkg") accidentally reverted two previous kbuild commits.  I don't
    know what I was thinking.
    
    This brings back changes made by commits 24cc7fb69a5b ("x86/kbuild:
    archscripts depends on scripts_basic") and c1c1a59e37da ("firmware: fix
    directory creation rule matching with make 3.80")
    
    Reported-by: Jan Beulich <[email protected]>
    Signed-off-by: Michal Marek <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c71964b93fde02f9607e49191d55bd430767892c
Author: Gabor Juhos <[email protected]>
Date:   Sat Sep 8 14:02:21 2012 +0200

    MIPS: ath79: Fix CPU/DDR frequency calculation for SRIF PLLs
    
    commit 97541ccfb9db2bb9cd1dde6344d5834438d14bda upstream.
    
    Besides the CPU and DDR PLLs, the CPU and DDR frequencies
    can be derived from other PLLs in the SRIF block on the
    AR934x SoCs. The current code does not checks if the SRIF
    PLLs are used and this can lead to incorrectly calculated
    CPU/DDR frequencies.
    
    Fix it by calculating the frequencies from SRIF PLLs if
    those are used on a given board.
    
    Signed-off-by: Gabor Juhos <[email protected]>
    Cc: [email protected]
    Patchwork: https://patchwork.linux-mips.org/patch/4324/
    Signed-off-by: Ralf Baechle <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ac43c058283e037c5acdee95ada41075e0e2dde5
Author: Amerigo Wang <[email protected]>
Date:   Tue Oct 9 17:48:16 2012 +0000

    pktgen: fix crash when generating IPv6 packets
    
    commit 5aa8b572007c4bca1e6d3dd4c4820f1ae49d6bb2 upstream.
    
    For IPv6, sizeof(struct ipv6hdr) = 40, thus the following
    expression will result negative:
    
            datalen = pkt_dev->cur_pkt_size - 14 -
                      sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
                      pkt_dev->pkt_overhead;
    
    And,  the check "if (datalen < sizeof(struct pktgen_hdr))" will be
    passed as "datalen" is promoted to unsigned, therefore will cause
    a crash later.
    
    This is a quick fix by checking if "datalen" is negative. The following
    patch will increase the default value of 'min_pkt_size' for IPv6.
    
    This bug should exist for a long time, so Cc -stable too.
    
    Signed-off-by: Cong Wang <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a150793f1f0866effaba2521fdf06130aab60d35
Author: Jason Wessel <[email protected]>
Date:   Sun Aug 26 22:37:03 2012 -0500

    kdb,vt_console: Fix missed data due to pager overruns
    
    commit 17b572e82032bc246324ce136696656b66d4e3f1 upstream.
    
    It is possible to miss data when using the kdb pager.  The kdb pager
    does not pay attention to the maximum column constraint of the screen
    or serial terminal.  This result is not incrementing the shown lines
    correctly and the pager will print more lines that fit on the screen.
    Obviously that is less than useful when using a VGA console where you
    cannot scroll back.
    
    The pager will now look at the kdb_buffer string to see how many
    characters are printed.  It might not be perfect considering you can
    output ASCII that might move the cursor position, but it is a
    substantially better approximation for viewing dmesg and trace logs.
    
    This also means that the vt screen needs to set the kdb COLUMNS
    variable.
    
    Signed-off-by: Jason Wessel <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 774cb096b98e8af73bd9f3b9b82abe8786289929
Author: Dan Carpenter <[email protected]>
Date:   Thu Oct 11 14:20:58 2012 +1100

    md/raid10: use correct limit variable
    
    commit 91502f099dfc5a1e8812898e26ee280713e1d002 upstream.
    
    Clang complains that we are assigning a variable to itself.  This should
    be using bad_sectors like the similar earlier check does.
    
    Bug has been present since 3.1-rc1.  It is minor but could
    conceivably cause corruption or other bad behaviour.
    
    Signed-off-by: Dan Carpenter <[email protected]>
    Signed-off-by: NeilBrown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fd39be7ff6f81f2dc91ba6e5f87944abef5b4802
Author: Felix Fietkau <[email protected]>
Date:   Mon Oct 8 14:39:33 2012 +0200

    mac80211: use ieee80211_free_txskb to fix possible skb leaks
    
    commit c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 upstream.
    
    A few places free skbs using dev_kfree_skb even though they're called
    after ieee80211_subif_start_xmit might have cloned it for tracking tx
    status. Use ieee80211_free_txskb here to prevent skb leaks.
    
    Signed-off-by: Felix Fietkau <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e36434d7c5606b6e16d1851cc99c0325cff91447
Author: Felix Fietkau <[email protected]>
Date:   Wed Oct 3 21:07:52 2012 +0200

    ath9k: use ieee80211_free_txskb
    
    commit 249ee72249140fe5b9adc988f97298f0aa5db2fc upstream.
    
    Using ieee80211_free_txskb for tx frames is required, since mac80211 clones
    skbs for which socket tx status is requested.
    
    Signed-off-by: Felix Fietkau <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ddf93ad023c6c334d9fae3d8a34989da286c8e4f
Author: Frederic Weisbecker <[email protected]>
Date:   Thu Oct 4 01:46:44 2012 +0200

    nohz: Fix one jiffy count too far in idle cputime
    
    commit 2b17c545a4cdbbbadcd7f1e9684c2d7db8f085a6 upstream.
    
    When we stop the tick in idle, we save the current jiffies value
    in ts->idle_jiffies. This snapshot is substracted from the later
    value of jiffies when the tick is restarted and the resulting
    delta is accounted as idle cputime. This is how we handle the
    idle cputime accounting without the tick.
    
    But sometimes we need to schedule the next tick to some time in
    the future instead of completely stopping it. In this case, a
    tick may happen before we restart the periodic behaviour and
    from that tick we account one jiffy to idle cputime as usual but
    we also increment the ts->idle_jiffies snapshot by one so that
    when we compute the delta to account, we substract the one jiffy
    we just accounted.
    
    To prepare for stopping the tick outside idle, we introduced a
    check that prevents from fixing up that ts->idle_jiffies if we
    are not running the idle task. But we use idle_cpu() for that
    and this is a problem if we run the tick while another CPU
    remotely enqueues a ttwu to our runqueue:
    
    CPU 0:                            CPU 1:
    
    tick_sched_timer() {              ttwu_queue_remote()
           if (idle_cpu(CPU 0))
               ts->idle_jiffies++;
    }
    
    Here, idle_cpu() notes that &rq->wake_list is not empty and
    hence won't consider the CPU as idle. As a result,
    ts->idle_jiffies won't be incremented. But this is wrong because
    we actually account the current jiffy to idle cputime. And that
    jiffy won't get substracted from the nohz time delta. So in the
    end, this jiffy is accounted twice.
    
    Fix this by changing idle_cpu(smp_processor_id()) with
    is_idle_task(current). This way the jiffy is substracted
    correctly even if a ttwu operation is enqueued on the CPU.
    
    Signed-off-by: Frederic Weisbecker <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 88f3373714366d54bc72e73919b6ef66b74bd6f8
Author: Hildner, Christian <[email protected]>
Date:   Mon Oct 8 15:49:03 2012 +0200

    timers: Fix endless looping between cascade() and internal_add_timer()
    
    commit 26cff4e2aa4d666dc6a120ea34336b5057e3e187 upstream.
    
    Adding two (or more) timers with large values for "expires" (they have
    to reside within tv5 in the same list) leads to endless looping
    between cascade() and internal_add_timer() in case CONFIG_BASE_SMALL
    is one and jiffies are crossing the value 1 << 18. The bug was
    introduced between 2.6.11 and 2.6.12 (and survived for quite some
    time).
    
    This patch ensures that when cascade() is called timers within tv5 are
    not added endlessly to their own list again, instead they are added to
    the next lower tv level tv4 (as expected).
    
    Signed-off-by: Christian Hildner <[email protected]>
    Reviewed-by: Jan Kiszka <[email protected]>
    Link: http://lkml.kernel.org/r/98673C87CB31274881CFFE0B65ECC87B0F5FC1963E@DEFTHW99EA4MSX.ww902.siemens.net
    Signed-off-by: Thomas Gleixner <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d6168c18c127871be6a54c63f9d54c87d74dcfbc
Author: Dan Carpenter <[email protected]>
Date:   Tue Oct 9 10:18:23 2012 +0300

    timekeeping: Cast raw_interval to u64 to avoid shift overflow
    
    commit 5b3900cd409466c0070b234d941650685ad0c791 upstream.
    
    We fixed a bunch of integer overflows in timekeeping code during the 3.6
    cycle.  I did an audit based on that and found this potential overflow.
    
    Signed-off-by: Dan Carpenter <[email protected]>
    Acked-by: John Stultz <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Thomas Gleixner <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f7bc7a25988f7761deb5b5f17289ac58a3fb2811
Author: Daniel Drake <[email protected]>
Date:   Tue Sep 4 11:45:32 2012 -0400

    viafb: don't touch clock state on OLPC XO-1.5
    
    commit 012a1211845eab69a5488d59eb87d24cc518c627 upstream.
    
    As detailed in the thread titled "viafb PLL/clock tweaking causes XO-1.5
    instability," enabling or disabling the IGA1/IGA2 clocks causes occasional
    stability problems during suspend/resume cycles on this platform.
    
    This is rather odd, as the documentation suggests that clocks have two
    states (on/off) and the default (stable) configuration is configured to
    enable the clock only when it is needed. However, explicitly enabling *or*
    disabling the clock triggers this system instability, suggesting that there
    is a 3rd state at play here.
    
    Leaving the clock enable/disable registers alone solves this problem.
    This fixes spurious reboots during suspend/resume behaviour introduced by
    commit b692a63a.
    
    Signed-off-by: Daniel Drake <[email protected]>
    Signed-off-by: Florian Tobias Schandinat <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c3588050e41a77f043295a21b2e845420063be1c
Author: Alexander Holler <[email protected]>
Date:   Tue Aug 14 09:11:09 2012 +0200

    video/udlfb: fix line counting in fb_write
    
    commit b8c4321f3d194469007f5f5f2b34ec278c264a04 upstream.
    
    Line 0 and 1 were both written to line 0 (on the display) and all subsequent
    lines had an offset of -1. The result was that the last line on the display
    was never overwritten by writes to /dev/fbN.
    
    Signed-off-by: Alexander Holler <[email protected]>
    Acked-by: Bernie Thompson <[email protected]>
    Signed-off-by: Florian Tobias Schandinat <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1c40e1c8d1e50dca33dc3f3f9dbb046f4996c2be
Author: Matthew Garrett <[email protected]>
Date:   Fri Jun 22 13:49:31 2012 -0400

    module: taint kernel when lve module is loaded
    
    commit c99af3752bb52ba3aece5315279a57a477edfaf1 upstream.
    
    Cloudlinux have a product called lve that includes a kernel module. This
    was previously GPLed but is now under a proprietary license, but the
    module continues to declare MODULE_LICENSE("GPL") and makes use of some
    EXPORT_SYMBOL_GPL symbols. Forcibly taint it in order to avoid this.
    
    Signed-off-by: Matthew Garrett <[email protected]>
    Cc: Alex Lyashkov <[email protected]>
    Signed-off-by: Rusty Russell <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit da1e481fd9ce08caf46bacb5a0e29e9007e3b59c
Author: Ian Kent <[email protected]>
Date:   Thu Oct 11 08:00:33 2012 +0800

    autofs4 - fix reset pending flag on mount fail
    
    commit 49999ab27eab6289a8e4f450e148bdab521361b2 upstream.
    
    In autofs4_d_automount(), if a mount fail occurs the AUTOFS_INF_PENDING
    mount pending flag is not cleared.
    
    One effect of this is when using the "browse" option, directory entry
    attributes show up with all "?"s due to the incorrect callback and
    subsequent failure return (when in fact no callback should be made).
    
    Signed-off-by: Ian Kent <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e68aa412d98d72b8096f93f6c02999c8a40df3ac
Author: Tejun Heo <[email protected]>
Date:   Thu Sep 20 14:09:30 2012 -0700

    block: fix request_queue->flags initialization
    
    commit 60ea8226cbd5c8301f9a39edc574ddabcb8150e0 upstream.
    
    A queue newly allocated with blk_alloc_queue_node() has only
    QUEUE_FLAG_BYPASS set.  For request-based drivers,
    blk_init_allocated_queue() is called and q->queue_flags is overwritten
    with QUEUE_FLAG_DEFAULT which doesn't include BYPASS even though the
    initial bypass is still in effect.
    
    In blk_init_allocated_queue(), or QUEUE_FLAG_DEFAULT to q->queue_flags
    instead of overwriting.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Acked-by: Vivek Goyal <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 90bc64b0e24471e1dc84c1bf4154c9b4cef3e43e
Author: Konrad Rzeszutek Wilk <[email protected]>
Date:   Wed Oct 10 13:30:47 2012 -0400

    xen/bootup: allow read_tscp call for Xen PV guests.
    
    commit cd0608e71e9757f4dae35bcfb4e88f4d1a03a8ab upstream.
    
    The hypervisor will trap it. However without this patch,
    we would crash as the .read_tscp is set to NULL. This patch
    fixes it and sets it to the native_read_tscp call.
    
    Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0afcf7b25f746c2cc7d97123133372eed58d9a9c
Author: Konrad Rzeszutek Wilk <[email protected]>
Date:   Wed Oct 10 13:25:48 2012 -0400

    xen/bootup: allow {read|write}_cr8 pvops call.
    
    commit 1a7bbda5b1ab0e02622761305a32dc38735b90b2 upstream.
    
    We actually do not do anything about it. Just return a default
    value of zero and if the kernel tries to write anything but 0
    we BUG_ON.
    
    This fixes the case when an user tries to suspend the machine
    and it blows up in save_processor_state b/c 'read_cr8' is set
    to NULL and we get:
    
    kernel BUG at /home/konrad/ssd/linux/arch/x86/include/asm/paravirt.h:100!
    invalid opcode: 0000 [#1] SMP
    Pid: 2687, comm: init.late Tainted: G           O 3.6.0upstream-00002-gac264ac-dirty #4 Bochs Bochs
    RIP: e030:[<ffffffff814d5f42>]  [<ffffffff814d5f42>] save_processor_state+0x212/0x270
    
    .. snip..
    Call Trace:
     [<ffffffff810733bf>] do_suspend_lowlevel+0xf/0xac
     [<ffffffff8107330c>] ? x86_acpi_suspend_lowlevel+0x10c/0x150
     [<ffffffff81342ee2>] acpi_suspend_enter+0x57/0xd5
    
    Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 95983a8f8297917edd1b149980722a9a55de4979
Author: Konrad Rzeszutek Wilk <[email protected]>
Date:   Wed Oct 10 13:23:36 2012 -0400

    xen/pv-on-hvm kexec: add quirk for Xen 3.4 and shutdown watches.
    
    commit cb6b6df111e46b9d0f79eb971575fd50555f43f4 upstream.
    
    The commit 254d1a3f02ebc10ccc6e4903394d8d3f484f715e, titled
    "xen/pv-on-hvm kexec: shutdown watches from old kernel" assumes that the
    XenBus backend can deal with reading of values from:
     "control/platform-feature-xs_reset_watches":
    
        ... a patch for xenstored is required so that it
        accepts the XS_RESET_WATCHES request from a client (see changeset
        23839:42a45baf037d in xen-unstable.hg). Without the patch for xenstored
        the registration of watches will fail and some features of a PVonHVM
        guest are not available. The guest is still able to boot, but repeated
        kexec boots will fail."
    
    Sadly this is not true when using a Xen 3.4 hypervisor and booting a PVHVM
    guest. We end up hanging at:
    
      err = xenbus_scanf(XBT_NIL, "control",
                            "platform-feature-xs_reset_watches", "%d", &supported);
    
    This can easily be seen with guests hanging at xenbus_init:
    
    NX (Execute Disable) protection: active
    SMBIOS 2.4 present.
    DMI: Xen HVM domU, BIOS 3.4.0 05/13/2011
    Hypervisor detected: Xen HVM
    Xen version 3.4.
    Xen Platform PCI: I/O protocol version 1
    ... snip ..
    calling  xenbus_init+0x0/0x27e @ 1
    
    Reverting the commit or using the attached patch fixes the issue. This fix
    checks whether the hypervisor is older than 4.0 and if so does not try to
    perform the read.
    
    Fixes-Oracle-Bug: 14708233
    Acked-by: Olaf Hering <[email protected]>
    [v2: Added a comment in the source code]
    Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 69c7c6695e93be50b4984a28b838a8dea0fd143b
Author: Alex Williamson <[email protected]>
Date:   Wed Oct 10 09:10:32 2012 -0600

    vfio: Fix PCI INTx disable consistency
    
    commit 899649b7d4ead76c19e39251ca886eebe3f811a8 upstream.
    
    The virq_disabled flag tracks the userspace view of INTx masking
    across interrupt mode changes, but we're not consistently applying
    this to the interrupt and masking handler notion of the device.
    Currently if the user sets DisINTx while in MSI or MSIX mode, then
    returns to INTx mode (ex. rebooting a qemu guest), the hardware has
    DisINTx+, but the management of INTx thinks it's enabled, making it
    impossible to actually clear DisINTx.  Fix this by updating the
    handler state when INTx is re-enabled.
    
    Signed-off-by: Alex Williamson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 7c1af9af57eafaad181505ef594d0214d0724647
Author: Alex Williamson <[email protected]>
Date:   Wed Oct 10 09:10:32 2012 -0600

    vfio: Move PCI INTx eventfd setting earlier
    
    commit 9dbdfd23b7638d054f3b0e70c64dfb9f297f2a9f upstream.
    
    We need to be ready to recieve an interrupt as soon as we call
    request_irq, so our eventfd context setting needs to be moved
    earlier.  Without this, an interrupt from our device or one
    sharing the interrupt line can pass a NULL into eventfd_signal
    and oops.
    
    Signed-off-by: Alex Williamson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1a5392619baf037a0aab6689ece7f4b9368d81be
Author: Roland Dreier <[email protected]>
Date:   Tue Sep 18 15:10:56 2012 -0700

    qla2xxx: Fix endianness of task management response code
    
    commit e4b11b89f9039ca97b2ed1b6efeb6749fbdeb252 upstream.
    
    The qla2xxx firmware actually expects the task management response
    code in a CTIO IOCB with SCSI status mode 1 to be in little-endian
    byte order, ie the response code should be the first byte in the
    sense_data[] array.  The old code erroneously byte-swapped the
    response code, which puts it in the wrong place on the wire and leads
    to initiators thinking every task management request succeeds (since
    they see 0 in the byte where they look for the response code).
    
    Signed-off-by: Roland Dreier <[email protected]>
    Cc: Chad Dupuis <[email protected]>
    Cc: Arun Easi <[email protected]>
    Acked-by: Saurav Kashyap <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f73ce26cefaf7ea6ccb5df0db704211d0b8d0b89
Author: Nicholas Bellinger <[email protected]>
Date:   Sat Sep 29 17:15:37 2012 -0700

    target/file: Re-enable optional fd_buffered_io=1 operation
    
    commit b32f4c7ed85c5cee2a21a55c9f59ebc9d57a2463 upstream.
    
    This patch re-adds the ability to optionally run in buffered FILEIO mode
    (eg: w/o O_DSYNC) for device backends in order to once again use the
    Linux buffered cache as a write-back storage mechanism.
    
    This logic was originally dropped with mainline v3.5-rc commit:
    
    commit a4dff3043c231d57f982af635c9d2192ee40e5ae
    Author: Nicholas Bellinger <[email protected]>
    Date:   Wed May 30 16:25:41 2012 -0700
    
        target/file: Use O_DSYNC by default for FILEIO backends
    
    This difference with this patch is that fd_create_virtdevice() now
    forces the explicit setting of emulate_write_cache=1 when buffered FILEIO
    operation has been enabled.
    
    (v2: Switch to FDBD_HAS_BUFFERED_IO_WCE + add more detailed
         comment as requested by hch)
    
    Reported-by: Ferry <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6b84f5da1a2bb47910c79c193fbfb90ac79daf51
Author: Peter Senna Tschudin <[email protected]>
Date:   Mon Sep 17 20:05:33 2012 +0200

    target: fix return code in target_core_init_configfs error path
    
    commit 37bb7899ca366dc212b71b150e78566d04808cc0 upstream.
    
    This patch fixes error cases within target_core_init_configfs() to
    properly set ret = -ENOMEM before jumping to the out_global exception
    path.
    
    This was originally discovered with the following Coccinelle semantic
    match information:
    
    Convert a nonnegative error return code to a negative one, as returned
    elsewhere in the function.  A simplified version of the semantic match
    that finds this problem is as follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    (
    if@p1 (\(ret < 0\|ret != 0\))
     { ... return ret; }
    |
    ret@p1 = 0
    )
    ... when != ret = e1
        when != &ret
    *if(...)
    {
      ... when != ret = e2
          when forall
     return ret;
    }
    // </smpl>
    
    Signed-off-by: Peter Senna Tschudin <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d53872319140a8b04b5a20a71d63004fa15f7534
Author: Paolo Bonzini <[email protected]>
Date:   Fri Sep 7 17:30:39 2012 +0200

    target: fix truncation of mode data, support zero allocation length
    
    commit 7a3f369ce31694017996524a1cdb08208a839077 upstream.
    
    The offset was not bumped back to the full size after writing the
    header of the MODE SENSE response, so the last 1 or 2 bytes were
    not copied.
    
    On top of this, support zero-length requests by checking for the
    return value of transport_kmap_data_sg.
    
    Testcase: sg_raw -r20 /dev/sdb 5a 00 0a 00 00 00 00 00 14 00
        last byte should be 0x1e
        it is 0x00 without the patch
        it is correct with the patch
    
    Signed-off-by: Paolo Bonzini <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ac71b560d2d821de7f623fc9d1831981433a9ff3
Author: Paolo Bonzini <[email protected]>
Date:   Fri Sep 7 17:30:38 2012 +0200

    target: support zero allocation length in INQUIRY
    
    commit ffe7b0e9326d9c68f5688bef691dd49f1e0d3651 upstream.
    
    INQUIRY processing already uses an on-heap bounce buffer for loopback,
    but not for other fabrics.  Switch this to a cheaper on-stack bounce
    buffer, similar to the one used by MODE SENSE and REQUEST SENSE, and
    use it unconditionally.  With this in place, zero allocation length is
    handled simply by checking the return address of transport_kmap_data_sg.
    
    Testcase: sg_raw /dev/sdb 12 00 83 00 00 00
        should fail with ILLEGAL REQUEST / INVALID FIELD IN CDB sense
        does not fail without the patch
        fails correctly with the series
    
    Signed-off-by: Paolo Bonzini <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6324a752e0113df97f8a59902fcb22c38eede27f
Author: Trond Myklebust <[email protected]>
Date:   Wed Sep 12 16:49:15 2012 -0400

    SUNRPC: Ensure that the TCP socket is closed when in CLOSE_WAIT
    
    commit a519fc7a70d1a918574bb826cc6905b87b482eb9 upstream.
    
    Instead of doing a shutdown() call, we need to do an actual close().
    Ditto if/when the server is sending us junk RPC headers.
    
    Signed-off-by: Trond Myklebust <[email protected]>
    Tested-by: Simon Kirby <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit eba428c5ad1614ae139610d3becb504ce2637187
Author: Stefan Richter <[email protected]>
Date:   Sat Oct 6 14:12:56 2012 +0200

    firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel)
    
    commit 790198f74c9d1b46b6a89504361b1a844670d050 upstream.
    
    Fix two bugs of the /dev/fw* character device concerning the
    FW_CDEV_IOC_GET_INFO ioctl with nonzero fw_cdev_get_info.bus_reset.
    (Practically all /dev/fw* clients issue this ioctl right after opening
    the device.)
    
    Both bugs are caused by sizeof(struct fw_cdev_event_bus_reset) being 36
    without natural alignment and 40 with natural alignment.
    
     1) Memory corruption, affecting i386 userland on amd64 kernel:
        Userland reserves a 36 bytes large buffer, kernel writes 40 bytes.
        This has been first found and reported against libraw1394 if
        compiled with gcc 4.7 which happens to order libraw1394's stack such
        that the bug became visible as data corruption.
    
     2) Information leak, affecting all kernel architectures except i386:
        4 bytes of random kernel stack data were leaked to userspace.
    
    Hence limit the respective copy_to_user() to the 32-bit aligned size of
    struct fw_cdev_event_bus_reset.
    
    Reported-by: Simon Kirby <[email protected]>
    Signed-off-by: Stefan Richter <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d16325665f213bfb893c978f54d43b142a0daecd
Author: Colin Cross <[email protected]>
Date:   Mon Oct 8 14:01:12 2012 -0700

    ARM: OMAP: counter: add locking to read_persistent_clock
    
    commit 9d7d6e363b06934221b81a859d509844c97380df upstream.
    
    read_persistent_clock uses a global variable, use a spinlock to
    ensure non-atomic updates to the variable don't overlap and cause
    time to move backwards.
    
    Signed-off-by: Colin Cross <[email protected]>
    Signed-off-by: R Sricharan <[email protected]>
    Signed-off-by: Tony Lindgren <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9d03830aa8319e80d33e021f6a3f8ffe1adbe780
Author: Simon Horman <[email protected]>
Date:   Fri Sep 28 02:12:45 2012 +0100

    ARM: 7541/1: Add ARM ERRATA 775420 workaround
    
    commit 7253b85cc62d6ff84143d96fe6cd54f73736f4d7 upstream.
    
    arm: Add ARM ERRATA 775420 workaround
    
    Workaround for the 775420 Cortex-A9 (r2p2, r2p6,r2p8,r2p10,r3p0) erratum.
    In case a date cache maintenance operation aborts with MMU exception, it
    might cause the processor to deadlock. This workaround puts DSB before
    executing ISB if an abort may occur on cache maintenance.
    
    Based on work by Kouei Abe and feedback from Catalin Marinas.
    
    Signed-off-by: Kouei Abe <[email protected]>
    [ [email protected]: Changed to implementation
      suggested by [email protected] ]
    Acked-by: Catalin Marinas <[email protected]>
    Signed-off-by: Simon Horman <[email protected]>
    Signed-off-by: Russell King <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6eac60584d2030cc4d47ef3fc2738012416d8c4f
Author: Richard W.M. Jones <[email protected]>
Date:   Tue Oct 2 17:25:46 2012 +0200

    SCSI: virtio-scsi: initialize scatterlist structure
    
    commit 2e9c9dfde00a6466441e93033cf2c37f720bdacf upstream.
    
    The sg struct is used without being initialized, which breaks
    when CONFIG_DEBUG_SG is enabled.
    
    Signed-off-by: Richard W.M. Jones <[email protected]>
    Signed-off-by: Paolo Bonzini <[email protected]>
    Signed-off-by: James Bottomley <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 22273f50017471428d85e3e6c6d04020fcaec97d
Author: Lukas Czerner <[email protected]>
Date:   Thu Aug 16 16:38:45 2012 +0200

    SCSI: scsi_debug: Fix off-by-one bug when unmapping region
    
    commit bc977749e967daa56de1922cf4cb38525631c51c upstream.
    
    Currently it is possible to unmap one more block than user requested to
    due to the off-by-one error in unmap_region(). This is probably due to
    the fact that the end variable despite its name actually points to the
    last block to unmap + 1. However in the condition it is handled as the
    last block of the region to unmap.
    
    The bug was not previously spotted probably due to the fact that the
    region was not zeroed, which has changed with commit
    be1dd78de5686c062bb3103f9e86d444a10ed783. With that commit we were able
    to corrupt the ext4 file system on 256M scsi_debug device with LBPRZ
    enabled using fstrim.
    
    Since the 'end' semantic is the same in several functions there this
    commit just fixes the condition to use the 'end' variable correctly in
    that context.
    
    Reported-by: Paolo Bonzini <[email protected]>
    Signed-off-by: Lukas Czerner <[email protected]>
    Reviewed-by: Martin K. Petersen <[email protected]>
    Acked-by: Douglas Gilbert <[email protected]>
    Signed-off-by: James Bottomley <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 54acbe4085b9c629e0164c90211d55e54e0ec6c0
Author: K. Y. Srinivasan <[email protected]>
Date:   Tue Oct 2 11:03:31 2012 -0700

    SCSI: storvsc: Account for in-transit packets in the RESET path
    
    commit 5c1b10ab7f93d24f29b5630286e323d1c5802d5c upstream.
    
    Properly account for I/O in transit before returning from the RESET call.
    In the absense of this patch, we could have a situation where the host may
    respond to a command that was issued prior to the issuance of the RESET
    command at some arbitrary time after responding to the RESET command.
    Currently, the host does not do anything with the RESET command.
    
    Signed-off-by: K. Y. Srinivasan <[email protected]>
    Signed-off-by: James Bottomley <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 12fe0605dcdf67072d37be195938c3c0d90bb3c6
Author: Nicholas Bellinger <[email protected]>
Date:   Wed Oct 3 15:42:48 2012 -0700

    iscsi-target: Bump defaults for nopin_timeout + nopin_response_timeout values
    
    commit cf0eb28d3ba60098865bf7dbcbfdd6b1cc483e3b upstream.
    
    This patch increases the default for nopin_timeout to 15 seconds (wait
    between sending a new NopIN ping) and nopin_response_timeout to 30 seconds
    (wait for NopOUT response before failing the connection) in order to avoid
    false positives by iSCSI Initiators who are not always able (under load) to
    respond to NopIN echo PING requests within the current 5 second window.
    
    False positives have been observed recently using Open-iSCSI code on v3.3.x
    with heavy large-block READ workloads over small MTU 1 Gb/sec ports, and
    increasing these values to more reasonable defaults significantly reduces
    the possibility of false positive NopIN response timeout events under
    this specific workload.
    
    Historically these have been set low to initiate connection recovery as
    soon as possible if we don't hear a ping back, but for modern v3.x code
    on 1 -> 10 Gb/sec ports these new defaults make alot more sense.
    
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Cc: Andy Grover <[email protected]>
    Cc: Mike Christie <[email protected]>
    Cc: Hannes Reinecke <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 331ddcc26a40ba6313c66b29a4305dbbfabb9f87
Author: Nicholas Bellinger <[email protected]>
Date:   Sun Sep 30 12:20:02 2012 -0700

    iscsi-target: Add explicit set of cache_dynamic_acls=1 for TPG demo-mode
    
    commit 38b11bae6ba02da352340aff12ee25755977b222 upstream.
    
    We've had reports in the past about this specific case, so it's time to
    go ahead and explicitly set cache_dynamic_acls=1 for generate_node_acls=1
    (TPG demo-mode) operation.
    
    During normal generate_node_acls=0 operation with explicit NodeACLs ->
    se_node_acl memory is persistent to the configfs group located at
    /sys/kernel/config/target/$TARGETNAME/$TPGT/acls/$INITIATORNAME, so in
    the generate_node_acls=1 case we want the reservation logic to reference
    existing per initiator IQN se_node_acl memory (not to generate a new
    se_node_acl), so go ahead and always set cache_dynamic_acls=1 when
    TPG demo-mode is enabled.
    
    Reported-by: Ronnie Sahlberg <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 521af6701599c0e9aea335228675f07ea65fd0d4
Author: Christoph Hellwig <[email protected]>
Date:   Wed Sep 26 08:00:37 2012 -0400

    iscsit: remove incorrect unlock in iscsit_build_sendtargets_resp
    
    commit 904753da183566c71211d23c169a80184648c121 upstream.
    
    Fix a potential multiple spin-unlock -> deadlock scenario during the
    overflow check within iscsit_build_sendtargets_resp() as found by
    sparse static checking.
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6386543caae11034a29c2af89793a076745c0eb4
Author: Nicholas Bellinger <[email protected]>
Date:   Sat Sep 22 17:21:06 2012 -0700

    iscsi-target: Correctly set 0xffffffff field within ISCSI_OP_REJECT PDU
    
    commit f25590f39d543272f7ae7b00d533359c8d7ff331 upstream.
    
    This patch adds a missing iscsi_reject->ffffffff assignment within
    iscsit_send_reject() code to properly follow RFC-3720 Section 10.17
    Bytes 16 -> 19 for the PDU format definition of ISCSI_OP_REJECT.
    
    We've not seen any initiators care about this bytes in practice, but
    as Ronnie reported this was causing trouble with wireshark packet
    decoding lets go ahead and fix this up now.
    
    Reported-by: Ronnie Sahlberg <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b080b7e727de8abc0c883de3d6a85a7ac3da31a5
Author: Hugh Dickins <[email protected]>
Date:   Sun Oct 7 20:32:51 2012 -0700

    tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
    
    commit 35c2a7f4908d404c9124c2efc6ada4640ca4d5d5 upstream.
    
    Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
    	u64 inum = fid->raw[2];
    which is unhelpfully reported as at the end of shmem_alloc_inode():
    
    BUG: unable to handle kernel paging request at ffff880061cd3000
    IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
    Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
    Call Trace:
     [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
     [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
     [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
     [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6
    
    Right, tmpfs is being stupid to access fid->raw[2] before validating that
    fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
    fall at the end of a page, and the next page not be present.
    
    But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
    careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
    could oops in the same way: add the missing fh_len checks to those.
    
    Reported-by: Sasha Levin <[email protected]>
    Signed-off-by: Hugh Dickins <[email protected]>
    Cc: Al Viro <[email protected]>
    Cc: Sage Weil <[email protected]>
    Cc: Steven Whitehouse <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Signed-off-by: Al Viro <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5224f4e0e077c6c6336dc9640c81ea9799e620a6
Author: Jason Wessel <[email protected]>
Date:   Fri Aug 10 12:21:15 2012 -0500

    mips,kgdb: fix recursive page fault with CONFIG_KPROBES
    
    commit f0a996eeeda214f4293e234df33b29bec003b536 upstream.
    
    This fault was detected using the kgdb test suite on boot and it
    crashes recursively due to the fact that CONFIG_KPROBES on mips adds
    an extra die notifier in the page fault handler.  The crash signature
    looks like this:
    
    kgdbts:RUN bad memory access test
    KGDB: re-enter exception: ALL breakpoints killed
    Call Trace:
    [<807b7548>] dump_stack+0x20/0x54
    [<807b7548>] dump_stack+0x20/0x54
    
    The fix for now is to have kgdb return immediately if the fault type
    is DIE_PAGE_FAULT and allow the kprobe code to decide what is supposed
    to happen.
    
    Signed-off-by: Jason Wessel <[email protected]>
    Cc: Masami Hiramatsu <[email protected]>
    Cc: David S. Miller <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 725b68f854c09d84dea31e896ebd56ef61157ae6
Author: Takashi Iwai <[email protected]>
Date:   Wed Oct 10 08:50:35 2012 +0200

    ALSA: hda - Fix memory leaks at error path in patch_cirrus.c
    
    commit c5e0b6dbad9b4d18c561af90b384d02373f1c994 upstream.
    
    The proper destructor should be called at the error path.
    
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1cddab0141470e2661d87625580206f24804badd
Author: David Henningsson <[email protected]>
Date:   Wed Oct 10 16:32:09 2012 +0200

    ALSA: hda - do not detect jack on internal speakers for Realtek
    
    commit f7f4b2322bf7b8c5929b7eb5a667091f32592580 upstream.
    
    This caused the internal speaker to mute itself because it was
    present, which happened after powersave.
    It was found on Dell XPS 15 (L502x), ALC665.
    
    Reported-by: Da Fox <[email protected]>
    Signed-off-by: David Henningsson <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ad505f023d46dd51a3c5344e395b703ede9cd0a4
Author: Takashi Iwai <[email protected]>
Date:   Wed Oct 10 08:41:42 2012 +0200

    ALSA: hda - Add missing hda_gen_spec to struct via_spec
    
    commit 7819d1c70eb6a57e43554d86e10b39d1e106ed65 upstream.
    
    The commit [4b527b65 ALSA: hda - limit internal mic boost for Asus
    X202E] introduced the use of auto-parser code, but it forgot to add
    struct hda_gen_spec at the head of codec->spec which the auto-parser
    assumes silently.  Without this record, it may result in memory
    corruption.
    
    This patch adds the missing piece.
    
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c347faa6f02f368679661b4fe475625c58a077d7
Author: Feng Tang <[email protected]>
Date:   Fri Sep 28 15:22:01 2012 +0800

    ACPI: EC: Add a quirk for CLEVO M720T/M730T laptop
    
    commit 67bfa9b60bd689601554526d144b21d529f78a09 upstream.
    
    By enlarging the GPE storm threshold back to 20, that laptop's
    EC works fine with interrupt mode instead of polling mode.
    
    https://bugzilla.kernel.org/show_bug.cgi?id=45151
    
    Reported-and-Tested-by: Francesco <[email protected]>
    Signed-off-by: Feng Tang <[email protected]>
    Signed-off-by: Len Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0bde288a5df7e108b40a4aa615c80652299a7f00
Author: Feng Tang <[email protected]>
Date:   Fri Sep 28 15:22:00 2012 +0800

    ACPI: EC: Make the GPE storm threshold a module parameter
    
    commit a520d52e99b14ba7db135e916348f12f2a6e09be upstream.
    
    The Linux EC driver includes a mechanism to detect GPE storms,
    and switch from interrupt-mode to polling mode.  However, polling
    mode sometimes doesn't work, so the workaround is problematic.
    Also, different systems seem to need the threshold for detecting
    the GPE storm at different levels.
    
    ACPI_EC_STORM_THRESHOLD was initially 20 when it's created, and
    was changed to 8 in 2.6.28 commit 06cf7d3c7 "ACPI: EC: lower interrupt storm
    threshold" to fix kernel bug 11892 by forcing the laptop in that bug to
    work in polling mode. However in bug 45151, it works fine in interrupt
    mode if we lift the threshold back to 20.
    
    This patch makes the threshold a module parameter so that user has a
    flexible option to debug/workaround this issue.
    
    The default is unchanged.
    
    This is also a preparation patch to fix specific systems:
    	https://bugzilla.kernel.org/show_bug.cgi?id=45151
    
    Signed-off-by: Feng Tang <[email protected]>
    Signed-off-by: Len Brown <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4f7ae03ec5e40b8755a1ea3080cf1bca388d4ded
Author: Stanislav Kinsbursky <[email protected]>
Date:   Tue Sep 18 13:37:23 2012 +0400

    lockd: create and use per-net NSM RPC clients on MON/UNMON requests
    
    commit cb7323fffa85df37161f4d3be45e1f787808309c upstream.
    
    NSM RPC client can be required on NFSv3 umount, when child reaper is dying
    (and destroying it's mount namespace). It means, that current nsproxy is set
    to NULL already, but creation of RPC client requires UTS namespace for gaining
    hostname string.
    
    This patch creates reference-counted per-net NSM client on first monitor
    request and destroys it after last unmonitor request.
    
    Signed-off-by: Stanislav Kinsbursky <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 66fad5377c6b06e24512035bb81095dc4787bc02
Author: Stanislav Kinsbursky <[email protected]>
Date:   Tue Sep 18 13:37:18 2012 +0400

    lockd: use rpc client's cl_nodename for id encoding
    
    commit 303a7ce92064c285a04c870f2dc0192fdb2968cb upstream.
    
    Taking hostname from uts namespace if not safe, because this cuold be
    performind during umount operation on child reaper death. And in this case
    current->nsproxy is NULL already.
    
    Signed-off-by: Stanislav Kinsbursky <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3a2ff25dc8d8e167fb3a09eea9cdb7426f6bb114
Author: Stanislav Kinsbursky <[email protected]>
Date:   Tue Sep 18 13:37:12 2012 +0400

    lockd: per-net NSM client creation and destruction helpers introduced
    
    commit e9406db20fecbfcab646bad157b4cfdc7cadddfb upstream.
    
    NSM RPC client can be required on NFSv3 umount, when child reaper is dying (and
    destroying it's mount namespace). It means, that current nsproxy is set to
    NULL already, but creation of RPC client requires UTS namespace for gaining
    hostname string.
    This patch introduces reference counted NFS RPC clients creation and
    destruction helpers (similar to RPCBIND RPC clients).
    
    Signed-off-by: Stanislav Kinsbursky <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 13a34f1542a04f7165c1b41dd6faff85a9ebf061
Author: Malahal Naineni <[email protected]>
Date:   Sun Sep 9 10:25:47 2012 -0500

    NFSD: pass null terminated buf to kstrtouint()
    
    commit 9959ba0c241a71c7ed8133401cfbbee2720da0b5 upstream.
    
    The 'buf' is prepared with null termination with intention of using it for
    this purpose, but 'name' is passed instead!
    
    Signed-off-by: Malahal Naineni <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 977469fff176739539ac78e2977d50214e2bdcf6
Author: J. Bruce Fields <[email protected]>
Date:   Wed Aug 29 15:21:58 2012 -0700

    nfsd4: fix nfs4 stateid leak
    
    commit cf9182e90b2af04245ac4fae497fe73fc71285b4 upstream.
    
    Processes that open and close multiple files may end up setting this
    oo_last_closed_stid without freeing what was previously pointed to.
    This can result in a major leak, visible for example by watching the
    nfsd4_stateids line of /proc/slabinfo.
    
    Reported-by: Cyril B. <[email protected]>
    Tested-by: Cyril B. <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 55db1c6363a84f7dcf9479ec791e390c0758aa05
Author: J. Bruce Fields <[email protected]>
Date:   Tue Aug 21 12:48:30 2012 -0400

    nfsd4: don't pin clientids to pseudoflavors
    
    commit 68eb35081e297b37db49d854cda144c6a3397699 upstream.
    
    I added cr_flavor to the data compared in same_creds without any
    justification, in d5497fc693a446ce9100fcf4117c3f795ddfd0d2 "nfsd4: move
    rq_flavor into svc_cred".
    
    Recent client changes then started making
    
    	mount -osec=krb5 server:/export /mnt/
    	echo "hello" >/mnt/TMP
    	umount /mnt/
    	mount -osec=krb5i server:/export /mnt/
    	echo "hello" >/mnt/TMP
    
    to fail due to a clid_inuse on the second open.
    
    Mounting sequentially like this with different flavors probably isn't
    that common outside artificial tests.  Also, the real bug here may be
    that the server isn't just destroying the former clientid in this case
    (because it isn't good enough at recognizing when the old state is
    gone).  But it prompted some discussion and a look back at the spec, and
    I think the check was probably wrong.  Fix and document.
    
    Signed-off-by: J. Bruce Fields <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9fa2b82e5592a7aa7a63b7f6a32c5aa9e580643a
Author: Bryan Schumaker <[email protected]>
Date:   Wed Sep 26 15:25:52 2012 -0400

    NFS: Remove bad delegations during open recovery
    
    commit 6938867edba929a65a167a97581231e76aeb10b4 upstream.
    
    I put the client into an open recovery loop by:
    	Client: Open file
    		read half
    	Server: Expire client (echo 0 > /sys/kernel/debug/nfsd/forget_clients)
    	Client: Drop vm cache (echo 3 > /proc/sys/vm/drop_caches)
    		finish reading file
    
    This causes a loop because the client never updates the nfs4_state after
    discovering that the delegation is invalid.  This means it will keep
    trying to read using the bad delegation rather than attempting to re-open
    the file.
    
    Signed-off-by: Bryan Schumaker <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 15adf810741b2e7c300932083d43b74188a05548
Author: Peng Tao <[email protected]>
Date:   Fri Aug 24 00:27:49 2012 +0800

    NFS41: fix error of setting blocklayoutdriver
    
    commit dc182549d439f60c332bf74d7f220a1bccf37da6 upstream.
    
    After commit e38eb650 (NFS: set_pnfs_layoutdriver() from
    nfs4_proc_fsinfo()), set_pnfs_layoutdriver() is called inside
    nfs4_proc_fsinfo(), but pnfs_blksize is not set. It causes setting
    blocklayoutdriver failure and pnfsblock mount failure.
    
    Signed-off-by: Peng Tao <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fda45cc12ebb7060131111442844f977555e3b9b
Author: Peng Tao <[email protected]>
Date:   Fri Aug 24 00:27:51 2012 +0800

    pnfsblock: fix partial page buffer wirte
    
    commit fe6e1e8d9fad86873eb74a26e80a8f91f9e870b5 upstream.
    
    If applications use flock to protect its write range, generic NFS
    will not do read-modify-write cycle at page cache level. Therefore
    LD should know how to handle non-sector aligned writes. Otherwise
    there will be data corruption.
    
    Signed-off-by: Peng Tao <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e99bc7155de4a2598f853001720228d728d5ad1f
Author: Russell King <[email protected]>
Date:   Tue Oct 9 11:13:26 2012 +0100

    ARM: vfp: fix saving d16-d31 vfp registers on v6+ kernels
    
    commit 846a136881b8f73c1f74250bf6acfaa309cab1f2 upstream.
    
    Michael Olbrich reported that his test program fails when built with
    -O2 -mcpu=cortex-a8 -mfpu=neon, and a kernel which supports v6 and v7
    CPUs:
    
    volatile int x = 2;
    volatile int64_t y = 2;
    
    int main() {
    	volatile int a = 0;
    	volatile int64_t b = 0;
    	while (1) {
    		a = (a + x) % (1 << 30);
    		b = (b + y) % (1 << 30);
    		assert(a == b);
    	}
    }
    
    and two instances are run.  When built for just v7 CPUs, this program
    works fine.  It uses the "vadd.i64 d19, d18, d16" VFP instruction.
    
    It appears that we do not save the high-16 double VFP registers across
    context switches when the kernel is built for v6 CPUs.  Fix that.
    
    Tested-By: Michael Olbrich <[email protected]>
    Signed-off-by: Russell King <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 

UngaBunga

Asistan
Katılım
16 Ocak 2012
Mesajlar
211
Reaksiyon puanı
0
Puanları
16
şöyle bir sıkıntım var bunu nasıl derleyebiliriz?
 
Üst