--- /dev/null
+From 66292ad92c6d3f2f1c137a1c826b331ca8595dfd Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+Date: Wed, 28 Mar 2012 12:28:33 +0200
+Subject: mmc: atmel-mci: correct data timeout computation
+
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+
+commit 66292ad92c6d3f2f1c137a1c826b331ca8595dfd upstream.
+
+The HSMCI operates at a rate of up to Master Clock divided by two.
+Moreover previous calculation can cause overflows and so wrong
+timeouts.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/atmel-mci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -480,7 +480,14 @@ err:
+ static inline unsigned int atmci_ns_to_clocks(struct atmel_mci *host,
+ unsigned int ns)
+ {
+- return (ns * (host->bus_hz / 1000000) + 999) / 1000;
++ /*
++ * It is easier here to use us instead of ns for the timeout,
++ * it prevents from overflows during calculation.
++ */
++ unsigned int us = DIV_ROUND_UP(ns, 1000);
++
++ /* Maximum clock frequency is host->bus_hz/2 */
++ return us * (DIV_ROUND_UP(host->bus_hz, 2000000));
+ }
+
+ static void atmci_set_timeout(struct atmel_mci *host,
--- /dev/null
+From 8c2fc8e413ecc2c96b696e28d4eb1bc6cee8dc84 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alf=20H=C3=B8gemark?= <alf@i100.no>
+Date: Wed, 4 Apr 2012 12:27:09 -0400
+Subject: mmc: sdhci-dove: Fix compile error by including module.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alf Høgemark <alf@i100.no>
+
+commit 8c2fc8e413ecc2c96b696e28d4eb1bc6cee8dc84 upstream.
+
+This patch fixes a compile error in drivers/mmc/host/sdhci-dove.c
+by including the linux/module.h file.
+
+Signed-off-by: Alf Høgemark <alf@i100.no>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-dove.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/host/sdhci-dove.c
++++ b/drivers/mmc/host/sdhci-dove.c
+@@ -20,6 +20,7 @@
+ */
+
+ #include <linux/io.h>
++#include <linux/module.h>
+ #include <linux/mmc/host.h>
+
+ #include "sdhci-pltfm.h"
--- /dev/null
+From 258f742635360175564e9470eb060ff4d4b984e7 Mon Sep 17 00:00:00 2001
+From: Frank Rowand <frank.rowand@am.sony.com>
+Date: Mon, 9 Apr 2012 17:59:03 -0700
+Subject: modpost: Fix modpost license checking of vmlinux.o
+
+From: Frank Rowand <frank.rowand@am.sony.com>
+
+commit 258f742635360175564e9470eb060ff4d4b984e7 upstream.
+
+Commit f02e8a6596b7 ("module: Sort exported symbols") sorts symbols
+placing each of them in its own elf section. This sorting and merging
+into the canonical sections are done by the linker.
+
+Unfortunately modpost to generate Module.symvers file parses vmlinux.o
+(which is not linked yet) and all modules object files (which aren't
+linked yet). These aren't sanitized by the linker yet. That breaks
+modpost that can't detect license properly for modules.
+
+This patch makes modpost aware of the new exported symbols structure.
+
+[ This above is a slightly corrected version of the explanation of the
+ problem, copied from commit 62a2635610db ("modpost: Fix modpost's
+ license checking V3"). That commit fixed the problem for module
+ object files, but not for vmlinux.o. This patch fixes modpost for
+ vmlinux.o. ]
+
+Signed-off-by: Frank Rowand <frank.rowand@am.sony.com>
+Signed-off-by: Alessio Igor Bogani <abogani@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/mod/modpost.c | 7 +++++--
+ scripts/mod/modpost.h | 1 +
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -132,8 +132,10 @@ static struct module *new_module(char *m
+ /* strip trailing .o */
+ s = strrchr(p, '.');
+ if (s != NULL)
+- if (strcmp(s, ".o") == 0)
++ if (strcmp(s, ".o") == 0) {
+ *s = '\0';
++ mod->is_dot_o = 1;
++ }
+
+ /* add to list */
+ mod->name = p;
+@@ -587,7 +589,8 @@ static void handle_modversions(struct mo
+ unsigned int crc;
+ enum export export;
+
+- if (!is_vmlinux(mod->name) && strncmp(symname, "__ksymtab", 9) == 0)
++ if ((!is_vmlinux(mod->name) || mod->is_dot_o) &&
++ strncmp(symname, "__ksymtab", 9) == 0)
+ export = export_from_secname(info, get_secindex(info, sym));
+ else
+ export = export_from_sec(info, get_secindex(info, sym));
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -113,6 +113,7 @@ struct module {
+ int has_cleanup;
+ struct buffer dev_table_buf;
+ char srcversion[25];
++ int is_dot_o;
+ };
+
+ struct elf_info {
x86-kgdb-fix-debug_rodata-limitation-using-text_poke.patch
cifs-fix-vfs-lock-usage-for-oplocked-files.patch
arm-tegra-remove-tegra30-errata-from-mach_tegra_dt.patch
+mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch
+mmc-atmel-mci-correct-data-timeout-computation.patch
+tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch
+tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch
+sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch
+modpost-fix-modpost-license-checking-of-vmlinux.o.patch
--- /dev/null
+From 620f6e8e855d6d447688a5f67a4e176944a084e8 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 4 Apr 2012 11:40:19 -0700
+Subject: sysctl: fix write access to dmesg_restrict/kptr_restrict
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 620f6e8e855d6d447688a5f67a4e176944a084e8 upstream.
+
+Commit bfdc0b4 adds code to restrict access to dmesg_restrict,
+however, it incorrectly alters kptr_restrict rather than
+dmesg_restrict.
+
+The original patch from Richard Weinberger
+(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as
+expected, and so the patch seems to have been misapplied.
+
+This adds the CAP_SYS_ADMIN check to both dmesg_restrict and
+kptr_restrict, since both are sensitive.
+
+Reported-by: Phillip Lougher <plougher@redhat.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
+Acked-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sysctl.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -166,7 +166,7 @@ static int proc_taint(struct ctl_table *
+ #endif
+
+ #ifdef CONFIG_PRINTK
+-static int proc_dmesg_restrict(struct ctl_table *table, int write,
++static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
+
+@@ -713,7 +713,7 @@ static struct ctl_table kern_table[] = {
+ .data = &dmesg_restrict,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
++ .proc_handler = proc_dointvec_minmax_sysadmin,
+ .extra1 = &zero,
+ .extra2 = &one,
+ },
+@@ -722,7 +722,7 @@ static struct ctl_table kern_table[] = {
+ .data = &kptr_restrict,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dmesg_restrict,
++ .proc_handler = proc_dointvec_minmax_sysadmin,
+ .extra1 = &zero,
+ .extra2 = &two,
+ },
+@@ -2422,7 +2422,7 @@ static int proc_taint(struct ctl_table *
+ }
+
+ #ifdef CONFIG_PRINTK
+-static int proc_dmesg_restrict(struct ctl_table *table, int write,
++static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+ if (write && !capable(CAP_SYS_ADMIN))
--- /dev/null
+From e1c4038282c7586c3544542b37872c434669d3ac Mon Sep 17 00:00:00 2001
+From: Mark Rustad <mark.d.rustad@intel.com>
+Date: Tue, 3 Apr 2012 10:24:41 -0700
+Subject: tcm_fc: Add abort flag for gracefully handling exchange timeout
+
+From: Mark Rustad <mark.d.rustad@intel.com>
+
+commit e1c4038282c7586c3544542b37872c434669d3ac upstream.
+
+Add abort flag and use it to terminate processing when an exchange
+is timed out or is reset. The abort flag is used in place of the
+transport_generic_free_cmd function call in the reset and timeout
+cases, because calling that function in that context would free
+memory that was in use. The aborted flag allows the lifetime to
+be managed in a more normal way, while truncating the processing.
+
+This change eliminates a source of memory corruption which
+manifested in a variety of ugly ways.
+
+(nab: Drop unused struct fc_exch *ep in ft_recv_seq)
+
+Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
+Acked-by: Kiran Patil <Kiran.patil@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/tcm_fc/tcm_fc.h | 1 +
+ drivers/target/tcm_fc/tfc_cmd.c | 10 ++++++++--
+ drivers/target/tcm_fc/tfc_io.c | 2 ++
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/tcm_fc/tcm_fc.h
++++ b/drivers/target/tcm_fc/tcm_fc.h
+@@ -124,6 +124,7 @@ struct ft_cmd {
+ /* Local sense buffer */
+ unsigned char ft_sense_buffer[TRANSPORT_SENSE_BUFFER];
+ u32 was_ddp_setup:1; /* Set only if ddp is setup */
++ u32 aborted:1; /* Set if aborted by reset or timeout */
+ struct scatterlist *sg; /* Set only if DDP is setup */
+ u32 sg_cnt; /* No. of item in scatterlist */
+ };
+--- a/drivers/target/tcm_fc/tfc_cmd.c
++++ b/drivers/target/tcm_fc/tfc_cmd.c
+@@ -130,6 +130,8 @@ int ft_queue_status(struct se_cmd *se_cm
+ struct fc_exch *ep;
+ size_t len;
+
++ if (cmd->aborted)
++ return 0;
+ ft_dump_cmd(cmd, __func__);
+ ep = fc_seq_exch(cmd->seq);
+ lport = ep->lp;
+@@ -196,6 +198,8 @@ int ft_write_pending(struct se_cmd *se_c
+
+ ft_dump_cmd(cmd, __func__);
+
++ if (cmd->aborted)
++ return 0;
+ ep = fc_seq_exch(cmd->seq);
+ lport = ep->lp;
+ fp = fc_frame_alloc(lport, sizeof(*txrdy));
+@@ -266,10 +270,10 @@ static void ft_recv_seq(struct fc_seq *s
+ struct ft_cmd *cmd = arg;
+ struct fc_frame_header *fh;
+
+- if (IS_ERR(fp)) {
++ if (unlikely(IS_ERR(fp))) {
+ /* XXX need to find cmd if queued */
+ cmd->seq = NULL;
+- transport_generic_free_cmd(&cmd->se_cmd, 0);
++ cmd->aborted = true;
+ return;
+ }
+
+@@ -447,6 +451,8 @@ int ft_queue_tm_resp(struct se_cmd *se_c
+ struct se_tmr_req *tmr = se_cmd->se_tmr_req;
+ enum fcp_resp_rsp_codes code;
+
++ if (cmd->aborted)
++ return 0;
+ switch (tmr->response) {
+ case TMR_FUNCTION_COMPLETE:
+ code = FCP_TMF_CMPL;
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -84,6 +84,8 @@ int ft_queue_data_in(struct se_cmd *se_c
+ void *from;
+ void *to = NULL;
+
++ if (cmd->aborted)
++ return 0;
+ ep = fc_seq_exch(cmd->seq);
+ lport = ep->lp;
+ cmd->seq = lport->tt.seq_start_next(cmd->seq);
--- /dev/null
+From 06383f10c49f507220594a455c6491ca6f8c94ab Mon Sep 17 00:00:00 2001
+From: Mark Rustad <mark.d.rustad@intel.com>
+Date: Tue, 3 Apr 2012 10:24:52 -0700
+Subject: tcm_fc: Do not free tpg structure during wq allocation failure
+
+From: Mark Rustad <mark.d.rustad@intel.com>
+
+commit 06383f10c49f507220594a455c6491ca6f8c94ab upstream.
+
+Avoid freeing a registered tpg structure if an alloc_workqueue call
+fails. This fixes a bug where the failure was leaking memory associated
+with se_portal_group setup during the original core_tpg_register() call.
+
+Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
+Acked-by: Kiran Patil <Kiran.patil@intel.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/tcm_fc/tfc_conf.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/target/tcm_fc/tfc_conf.c
++++ b/drivers/target/tcm_fc/tfc_conf.c
+@@ -304,6 +304,7 @@ static struct se_portal_group *ft_add_tp
+ {
+ struct ft_lport_acl *lacl;
+ struct ft_tpg *tpg;
++ struct workqueue_struct *wq;
+ unsigned long index;
+ int ret;
+
+@@ -325,18 +326,20 @@ static struct se_portal_group *ft_add_tp
+ tpg->lport_acl = lacl;
+ INIT_LIST_HEAD(&tpg->lun_list);
+
+- ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
+- tpg, TRANSPORT_TPG_TYPE_NORMAL);
+- if (ret < 0) {
++ wq = alloc_workqueue("tcm_fc", 0, 1);
++ if (!wq) {
+ kfree(tpg);
+ return NULL;
+ }
+
+- tpg->workqueue = alloc_workqueue("tcm_fc", 0, 1);
+- if (!tpg->workqueue) {
++ ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
++ tpg, TRANSPORT_TPG_TYPE_NORMAL);
++ if (ret < 0) {
++ destroy_workqueue(wq);
+ kfree(tpg);
+ return NULL;
+ }
++ tpg->workqueue = wq;
+
+ mutex_lock(&ft_lport_lock);
+ list_add_tail(&tpg->list, &lacl->tpg_list);
projects / thirdparty / kernel / stable-queue.git / commitdiff
