]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 9 Dec 2013 00:28:14 +0000 (16:28 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 9 Dec 2013 00:28:14 +0000 (16:28 -0800)
added patches:
hid-usbhid-quirk-for-sis-touchscreen.patch
hid-usbhid-quirk-for-synaptics-large-touchccreen.patch
input-allow-deselecting-serio-drivers-even-without-config_expert.patch
input-mousedev-allow-disabling-even-without-config_expert.patch
iwlwifi-dvm-don-t-override-mac80211-s-queue-setting.patch
lib-genalloc.c-fix-overflow-of-ending-address-of-memory-chunk.patch
tg3-avoid-double-freeing-of-rx-data-memory.patch

queue-3.10/hid-usbhid-quirk-for-sis-touchscreen.patch [new file with mode: 0644]
queue-3.10/hid-usbhid-quirk-for-synaptics-large-touchccreen.patch [new file with mode: 0644]
queue-3.10/input-allow-deselecting-serio-drivers-even-without-config_expert.patch [new file with mode: 0644]
queue-3.10/input-mousedev-allow-disabling-even-without-config_expert.patch [new file with mode: 0644]
queue-3.10/iwlwifi-dvm-don-t-override-mac80211-s-queue-setting.patch [new file with mode: 0644]
queue-3.10/lib-genalloc.c-fix-overflow-of-ending-address-of-memory-chunk.patch [new file with mode: 0644]
queue-3.10/series
queue-3.10/tg3-avoid-double-freeing-of-rx-data-memory.patch [new file with mode: 0644]

diff --git a/queue-3.10/hid-usbhid-quirk-for-sis-touchscreen.patch b/queue-3.10/hid-usbhid-quirk-for-sis-touchscreen.patch
new file mode 100644 (file)
index 0000000..173fa5e
--- /dev/null
@@ -0,0 +1,46 @@
+From 684524d35fe8d13be1f2649633e43bd02c96c695 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Wed, 2 Oct 2013 17:35:27 +0800
+Subject: HID: usbhid: quirk for SiS Touchscreen
+
+From: AceLan Kao <acelan.kao@canonical.com>
+
+commit 684524d35fe8d13be1f2649633e43bd02c96c695 upstream.
+
+BugLink: http://bugs.launchpad.net/bugs/1180881
+
+This device needs to be added to the quirks list with HID_QUIRK_NO_INIT_REPORTS,
+otherwise it causes 10 seconds timeout during report initialization.
+
+[12431.828467] hid-multitouch 0003:0457:1013.0475: usb_submit_urb(ctrl) failed: -1
+[12431.828507] hid-multitouch 0003:0457:1013.0475: timeout initializing reports
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h           |    3 +++
+ drivers/hid/usbhid/hid-quirks.c |    1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -915,4 +915,7 @@
+ #define USB_VENDOR_ID_PRIMAX  0x0461
+ #define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05
++#define USB_VENDOR_ID_SIS     0x0457
++#define USB_DEVICE_ID_SIS_TS  0x1013
++
+ #endif
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -114,6 +114,7 @@ static const struct hid_blacklist {
+       { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+       { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
+       { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
++      { USB_VENDOR_ID_SIS, USB_DEVICE_ID_SIS_TS, HID_QUIRK_NO_INIT_REPORTS },
+       { 0, 0 }
+ };
diff --git a/queue-3.10/hid-usbhid-quirk-for-synaptics-large-touchccreen.patch b/queue-3.10/hid-usbhid-quirk-for-synaptics-large-touchccreen.patch
new file mode 100644 (file)
index 0000000..71038c8
--- /dev/null
@@ -0,0 +1,47 @@
+From 8171a67d587a09e14a4949a81e070345fedcf410 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Wed, 2 Oct 2013 17:35:26 +0800
+Subject: HID: usbhid: quirk for Synaptics Large Touchccreen
+
+From: AceLan Kao <acelan.kao@canonical.com>
+
+commit 8171a67d587a09e14a4949a81e070345fedcf410 upstream.
+
+BugLink: http://bugs.launchpad.net/bugs/1180881
+
+Synaptics large touchscreen doesn't support some of the report request
+while initializing. The unspoorted request will make the device unreachable,
+and will lead to the following usb_submit_urb() function call timeout.
+So, add the IDs into HID_QUIRK_NO_INIT_REPORTS quirk.
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h           |    2 ++
+ drivers/hid/usbhid/hid-quirks.c |    2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -786,6 +786,8 @@
+ #define USB_DEVICE_ID_SYNAPTICS_COMP_TP       0x0009
+ #define USB_DEVICE_ID_SYNAPTICS_WTP   0x0010
+ #define USB_DEVICE_ID_SYNAPTICS_DPAD  0x0013
++#define USB_DEVICE_ID_SYNAPTICS_LTS1  0x0af8
++#define USB_DEVICE_ID_SYNAPTICS_LTS2  0x1d10
+ #define USB_VENDOR_ID_THINGM          0x27b8
+ #define USB_DEVICE_ID_BLINK1          0x01ed
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -112,6 +112,8 @@ static const struct hid_blacklist {
+       { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+       { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
+       { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++      { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
++      { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+       { 0, 0 }
+ };
diff --git a/queue-3.10/input-allow-deselecting-serio-drivers-even-without-config_expert.patch b/queue-3.10/input-allow-deselecting-serio-drivers-even-without-config_expert.patch
new file mode 100644 (file)
index 0000000..d1d7c70
--- /dev/null
@@ -0,0 +1,79 @@
+From bcd2623073e98f69f84720308db0b142c4da0bd6 Mon Sep 17 00:00:00 2001
+From: Tom Gundersen <teg@jklm.no>
+Date: Thu, 31 Oct 2013 00:38:30 -0700
+Subject: Input: allow deselecting serio drivers even without CONFIG_EXPERT
+
+From: Tom Gundersen <teg@jklm.no>
+
+commit bcd2623073e98f69f84720308db0b142c4da0bd6 upstream.
+
+There is plenty of consumer hardware (e.g., mac books) that does not use AT
+keyboards or PS/2 mice. It therefore makes sense for distro kernels to
+build the related drivers as modules to avoid loading them on hardware that
+does not need them. As such, these options should no longer be protected by
+EXPERT.
+
+Moreover, building these drivers as modules gets rid of the following ugly
+error during boot:
+
+[    2.337745] i8042: PNP: No PS/2 controller found. Probing ports directly.
+[    3.439537] i8042: No controller found
+
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/Kconfig |    4 ++--
+ drivers/input/serio/Kconfig    |    6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/input/keyboard/Kconfig
++++ b/drivers/input/keyboard/Kconfig
+@@ -2,7 +2,7 @@
+ # Input core configuration
+ #
+ menuconfig INPUT_KEYBOARD
+-      bool "Keyboards" if EXPERT || !X86
++      bool "Keyboards"
+       default y
+       help
+         Say Y here, and a list of supported keyboards will be displayed.
+@@ -67,7 +67,7 @@ config KEYBOARD_ATARI
+         module will be called atakbd.
+ config KEYBOARD_ATKBD
+-      tristate "AT keyboard" if EXPERT || !X86
++      tristate "AT keyboard"
+       default y
+       select SERIO
+       select SERIO_LIBPS2
+--- a/drivers/input/serio/Kconfig
++++ b/drivers/input/serio/Kconfig
+@@ -2,7 +2,7 @@
+ # Input core configuration
+ #
+ config SERIO
+-      tristate "Serial I/O support" if EXPERT || !X86
++      tristate "Serial I/O support"
+       default y
+       help
+         Say Yes here if you have any input device that uses serial I/O to
+@@ -19,7 +19,7 @@ config SERIO
+ if SERIO
+ config SERIO_I8042
+-      tristate "i8042 PC Keyboard controller" if EXPERT || !X86
++      tristate "i8042 PC Keyboard controller"
+       default y
+       depends on !PARISC && (!ARM || ARCH_SHARK || FOOTBRIDGE_HOST) && \
+                  (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !S390
+@@ -169,7 +169,7 @@ config SERIO_MACEPS2
+         module will be called maceps2.
+ config SERIO_LIBPS2
+-      tristate "PS/2 driver library" if EXPERT
++      tristate "PS/2 driver library"
+       depends on SERIO_I8042 || SERIO_I8042=n
+       help
+         Say Y here if you are using a driver for device connected
diff --git a/queue-3.10/input-mousedev-allow-disabling-even-without-config_expert.patch b/queue-3.10/input-mousedev-allow-disabling-even-without-config_expert.patch
new file mode 100644 (file)
index 0000000..2ffd459
--- /dev/null
@@ -0,0 +1,33 @@
+From dfaaed08ecc01bd513248ba7999daf50ce028352 Mon Sep 17 00:00:00 2001
+From: Tom Gundersen <teg@jklm.no>
+Date: Thu, 31 Oct 2013 00:44:49 -0700
+Subject: Input: mousedev - allow disabling even without CONFIG_EXPERT
+
+From: Tom Gundersen <teg@jklm.no>
+
+commit dfaaed08ecc01bd513248ba7999daf50ce028352 upstream.
+
+Moust (if not all) modern software, including X, uses /dev/eventX rather than
+the legacy /dev/mouseX devices. It therefore makes sense for general-purpose
+(distro) kernels to use MOUSEDV=m (or even n), so let's drop the EXPERT=y
+requirement.
+
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/Kconfig |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/Kconfig
++++ b/drivers/input/Kconfig
+@@ -80,7 +80,7 @@ config INPUT_MATRIXKMAP
+ comment "Userland interfaces"
+ config INPUT_MOUSEDEV
+-      tristate "Mouse interface" if EXPERT
++      tristate "Mouse interface"
+       default y
+       help
+         Say Y here if you want your mouse to be accessible as char devices
diff --git a/queue-3.10/iwlwifi-dvm-don-t-override-mac80211-s-queue-setting.patch b/queue-3.10/iwlwifi-dvm-don-t-override-mac80211-s-queue-setting.patch
new file mode 100644 (file)
index 0000000..49c333d
--- /dev/null
@@ -0,0 +1,104 @@
+From f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 15 Oct 2013 22:04:54 +0300
+Subject: iwlwifi: dvm: don't override mac80211's queue setting
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d upstream.
+
+Since we set IEEE80211_HW_QUEUE_CONTROL, we can let
+mac80211 do the queue assignement and don't need to
+override its decisions.
+While reassiging the same values is harmless of course,
+it triggered  a WARNING when iwlwifi and mac80211 came
+to different conclusions. This happened when mac80211 set
+IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the
+packet to the cab_queue because no stations were asleep.
+
+iwlwifi should not override mac80211's decicions for
+offchannel packets and packets to  be sent after DTIM,
+but it should override mac80211's decision for AMPDUs
+since we have a special queue for them. So for AMPDU,
+we still override info->hw_queue by the AMPDU queue.
+
+This avoids:
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883()
+Modules linked in:
+CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1
+Hardware name:                  /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013
+ 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000
+ ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000
+ ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e
+Call Trace:
+ [<ffffffff8189aa62>] ? dump_stack+0x41/0x51
+ [<ffffffff8105a4f2>] ? warn_slowpath_common+0x78/0x90
+ [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
+ [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
+ [<ffffffff818a0040>] ? put_cred+0x15/0x15
+ [<ffffffff815f6db4>] ? iwlagn_mac_tx+0x19/0x2f
+ [<ffffffff8186cc45>] ? __ieee80211_tx+0x226/0x29b
+ [<ffffffff8186e6bd>] ? ieee80211_tx+0xa6/0xb5
+ [<ffffffff8186e98b>] ? ieee80211_monitor_start_xmit+0x1e9/0x204
+ [<ffffffff8171ce5f>] ? dev_hard_start_xmit+0x271/0x3ec
+ [<ffffffff817351ac>] ? sch_direct_xmit+0x66/0x164
+ [<ffffffff8171d1bf>] ? dev_queue_xmit+0x1e5/0x3c8
+ [<ffffffff817fac5a>] ? packet_sendmsg+0xac5/0xb3d
+ [<ffffffff81709a09>] ? sock_sendmsg+0x37/0x52
+ [<ffffffff810f9e0c>] ? __do_fault+0x338/0x36b
+ [<ffffffff81713820>] ? verify_iovec+0x44/0x94
+ [<ffffffff81709e63>] ? ___sys_sendmsg+0x1f1/0x283
+ [<ffffffff81140a73>] ? __inode_wait_for_writeback+0x67/0xae
+ [<ffffffff8111735e>] ? __cache_free.isra.46+0x178/0x187
+ [<ffffffff811173b1>] ? kmem_cache_free+0x44/0x84
+ [<ffffffff81132c22>] ? dentry_kill+0x13d/0x149
+ [<ffffffff81132f6f>] ? dput+0xe5/0xef
+ [<ffffffff81136e04>] ? fget_light+0x2e/0x7c
+ [<ffffffff8170ae62>] ? __sys_sendmsg+0x39/0x57
+ [<ffffffff818a7e39>] ? system_call_fastpath+0x16/0x1b
+---[ end trace 1b3eb79359c1d1e6 ]---
+
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/tx.c |   14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
+@@ -445,27 +445,19 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+       /* Copy MAC header from skb into command buffer */
+       memcpy(tx_cmd->hdr, hdr, hdr_len);
++      txq_id = info->hw_queue;
++
+       if (is_agg)
+               txq_id = priv->tid_data[sta_id][tid].agg.txq_id;
+       else if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
+               /*
+-               * Send this frame after DTIM -- there's a special queue
+-               * reserved for this for contexts that support AP mode.
+-               */
+-              txq_id = ctx->mcast_queue;
+-
+-              /*
+                * The microcode will clear the more data
+                * bit in the last frame it transmits.
+                */
+               hdr->frame_control |=
+                       cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+-      } else if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+-              txq_id = IWL_AUX_QUEUE;
+-      else
+-              txq_id = ctx->ac_to_queue[skb_get_queue_mapping(skb)];
++      }
+-      WARN_ON_ONCE(!is_agg && txq_id != info->hw_queue);
+       WARN_ON_ONCE(is_agg &&
+                    priv->queue_to_mac80211[txq_id] != info->hw_queue);
diff --git a/queue-3.10/lib-genalloc.c-fix-overflow-of-ending-address-of-memory-chunk.patch b/queue-3.10/lib-genalloc.c-fix-overflow-of-ending-address-of-memory-chunk.patch
new file mode 100644 (file)
index 0000000..4462c5d
--- /dev/null
@@ -0,0 +1,116 @@
+From 674470d97958a0ec72f72caf7f6451da40159cc7 Mon Sep 17 00:00:00 2001
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+Date: Wed, 11 Sep 2013 14:21:43 -0700
+Subject: lib/genalloc.c: fix overflow of ending address of memory chunk
+
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+
+commit 674470d97958a0ec72f72caf7f6451da40159cc7 upstream.
+
+In struct gen_pool_chunk, end_addr means the end address of memory chunk
+(inclusive), but in the implementation it is treated as address + size of
+memory chunk (exclusive), so it points to the address plus one instead of
+correct ending address.
+
+The ending address of memory chunk plus one will cause overflow on the
+memory chunk including the last address of memory map, e.g.  when starting
+address is 0xFFF00000 and size is 0x100000 on 32bit machine, ending
+address will be 0x100000000.
+
+Use correct ending address like starting address + size - 1.
+
+[akpm@linux-foundation.org: add comment to struct gen_pool_chunk:end_addr]
+Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/genalloc.h |    4 ++--
+ lib/genalloc.c           |   19 ++++++++++++-------
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -66,8 +66,8 @@ struct gen_pool_chunk {
+       struct list_head next_chunk;    /* next chunk in pool */
+       atomic_t avail;
+       phys_addr_t phys_addr;          /* physical starting address of memory chunk */
+-      unsigned long start_addr;       /* starting address of memory chunk */
+-      unsigned long end_addr;         /* ending address of memory chunk */
++      unsigned long start_addr;       /* start address of memory chunk */
++      unsigned long end_addr;         /* end address of memory chunk (inclusive) */
+       unsigned long bits[0];          /* bitmap for allocating memory chunk */
+ };
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -37,6 +37,11 @@
+ #include <linux/of_address.h>
+ #include <linux/of_device.h>
++static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
++{
++      return chunk->end_addr - chunk->start_addr + 1;
++}
++
+ static int set_bits_ll(unsigned long *addr, unsigned long mask_to_set)
+ {
+       unsigned long val, nval;
+@@ -188,7 +193,7 @@ int gen_pool_add_virt(struct gen_pool *p
+       chunk->phys_addr = phys;
+       chunk->start_addr = virt;
+-      chunk->end_addr = virt + size;
++      chunk->end_addr = virt + size - 1;
+       atomic_set(&chunk->avail, size);
+       spin_lock(&pool->lock);
+@@ -213,7 +218,7 @@ phys_addr_t gen_pool_virt_to_phys(struct
+       rcu_read_lock();
+       list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) {
+-              if (addr >= chunk->start_addr && addr < chunk->end_addr) {
++              if (addr >= chunk->start_addr && addr <= chunk->end_addr) {
+                       paddr = chunk->phys_addr + (addr - chunk->start_addr);
+                       break;
+               }
+@@ -242,7 +247,7 @@ void gen_pool_destroy(struct gen_pool *p
+               chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
+               list_del(&chunk->next_chunk);
+-              end_bit = (chunk->end_addr - chunk->start_addr) >> order;
++              end_bit = chunk_size(chunk) >> order;
+               bit = find_next_bit(chunk->bits, end_bit, 0);
+               BUG_ON(bit < end_bit);
+@@ -283,7 +288,7 @@ unsigned long gen_pool_alloc(struct gen_
+               if (size > atomic_read(&chunk->avail))
+                       continue;
+-              end_bit = (chunk->end_addr - chunk->start_addr) >> order;
++              end_bit = chunk_size(chunk) >> order;
+ retry:
+               start_bit = pool->algo(chunk->bits, end_bit, start_bit, nbits,
+                               pool->data);
+@@ -330,8 +335,8 @@ void gen_pool_free(struct gen_pool *pool
+       nbits = (size + (1UL << order) - 1) >> order;
+       rcu_read_lock();
+       list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) {
+-              if (addr >= chunk->start_addr && addr < chunk->end_addr) {
+-                      BUG_ON(addr + size > chunk->end_addr);
++              if (addr >= chunk->start_addr && addr <= chunk->end_addr) {
++                      BUG_ON(addr + size - 1 > chunk->end_addr);
+                       start_bit = (addr - chunk->start_addr) >> order;
+                       remain = bitmap_clear_ll(chunk->bits, start_bit, nbits);
+                       BUG_ON(remain);
+@@ -400,7 +405,7 @@ size_t gen_pool_size(struct gen_pool *po
+       rcu_read_lock();
+       list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk)
+-              size += chunk->end_addr - chunk->start_addr;
++              size += chunk_size(chunk);
+       rcu_read_unlock();
+       return size;
+ }
index b09fce8e109b59147ee4f58464302cdf8d04ae29..4795bd840bd9d269e8763af3a342e7d0386eb957 100644 (file)
@@ -34,3 +34,10 @@ irq-enable-all-irqs-unconditionally-in-irq_resume.patch
 net-update-consumers-of-msg_more-to-recognize-msg_sendpage_notlast.patch
 x86-64-build-always-pass-in-mno-sse.patch
 scsi-disable-write-same-for-raid-and-virtual-host-adapter-drivers.patch
+iwlwifi-dvm-don-t-override-mac80211-s-queue-setting.patch
+tg3-avoid-double-freeing-of-rx-data-memory.patch
+hid-usbhid-quirk-for-synaptics-large-touchccreen.patch
+hid-usbhid-quirk-for-sis-touchscreen.patch
+lib-genalloc.c-fix-overflow-of-ending-address-of-memory-chunk.patch
+input-allow-deselecting-serio-drivers-even-without-config_expert.patch
+input-mousedev-allow-disabling-even-without-config_expert.patch
diff --git a/queue-3.10/tg3-avoid-double-freeing-of-rx-data-memory.patch b/queue-3.10/tg3-avoid-double-freeing-of-rx-data-memory.patch
new file mode 100644 (file)
index 0000000..090d9bc
--- /dev/null
@@ -0,0 +1,54 @@
+From 85aec73d595b8847f9c4ea571deb127913f0d508 Mon Sep 17 00:00:00 2001
+From: Ivan Vecera <ivecera@redhat.com>
+Date: Wed, 6 Nov 2013 14:02:36 +0100
+Subject: tg3: avoid double-freeing of rx data memory
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+commit 85aec73d595b8847f9c4ea571deb127913f0d508 upstream.
+
+If build_skb fails the memory associated with the ring buffer is freed but
+the ri->data member is not zeroed in this case. This causes a double-free
+of this memory in tg3_free_rings->... path. The patch moves this block after
+setting ri->data to NULL.
+It would be nice to fix this bug also in stable >= v3.4 trees.
+
+Cc: Nithin Nayak Sujir <nsujir@broadcom.com>
+Cc: Michael Chan <mchan@broadcom.com>
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Acked-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/tg3.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -6722,12 +6722,6 @@ static int tg3_rx(struct tg3_napi *tnapi
+                       pci_unmap_single(tp->pdev, dma_addr, skb_size,
+                                        PCI_DMA_FROMDEVICE);
+-                      skb = build_skb(data, frag_size);
+-                      if (!skb) {
+-                              tg3_frag_free(frag_size != 0, data);
+-                              goto drop_it_no_recycle;
+-                      }
+-                      skb_reserve(skb, TG3_RX_OFFSET(tp));
+                       /* Ensure that the update to the data happens
+                        * after the usage of the old DMA mapping.
+                        */
+@@ -6735,6 +6729,12 @@ static int tg3_rx(struct tg3_napi *tnapi
+                       ri->data = NULL;
++                      skb = build_skb(data, frag_size);
++                      if (!skb) {
++                              tg3_frag_free(frag_size != 0, data);
++                              goto drop_it_no_recycle;
++                      }
++                      skb_reserve(skb, TG3_RX_OFFSET(tp));
+               } else {
+                       tg3_recycle_rx(tnapi, tpr, opaque_key,
+                                      desc_idx, *post_ptr);