]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.3-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 11 Apr 2012 00:00:33 +0000 (17:00 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 11 Apr 2012 00:00:33 +0000 (17:00 -0700)
added patches:
acer-wmi-no-wifi-rfkill-on-sony-machines.patch
fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch
iwlegacy-do-not-nulify-il-vif-on-reset.patch
mfd-clear-twl6030-irq-status-register-only-once.patch
revert-x86-ioapic-add-register-level-checks-to-detect.patch
sched-x86-fix-overflow-in-cyc2ns_offset.patch
tomoyo-fix-mount-flags-checking-order.patch
usb-add-motorola-rokr-e6-id-to-the-usbnet-driver-zaurus.patch

queue-3.3/acer-wmi-no-wifi-rfkill-on-sony-machines.patch [new file with mode: 0644]
queue-3.3/fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch [new file with mode: 0644]
queue-3.3/iwlegacy-do-not-nulify-il-vif-on-reset.patch [new file with mode: 0644]
queue-3.3/mfd-clear-twl6030-irq-status-register-only-once.patch [new file with mode: 0644]
queue-3.3/revert-x86-ioapic-add-register-level-checks-to-detect.patch [new file with mode: 0644]
queue-3.3/sched-x86-fix-overflow-in-cyc2ns_offset.patch [new file with mode: 0644]
queue-3.3/series
queue-3.3/tomoyo-fix-mount-flags-checking-order.patch [new file with mode: 0644]
queue-3.3/usb-add-motorola-rokr-e6-id-to-the-usbnet-driver-zaurus.patch [new file with mode: 0644]

diff --git a/queue-3.3/acer-wmi-no-wifi-rfkill-on-sony-machines.patch b/queue-3.3/acer-wmi-no-wifi-rfkill-on-sony-machines.patch
new file mode 100644 (file)
index 0000000..015c2c4
--- /dev/null
@@ -0,0 +1,37 @@
+From 5719b81988f3c24ff694dc3a37e35b35630a3966 Mon Sep 17 00:00:00 2001
+From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
+Date: Fri, 23 Mar 2012 12:36:44 +0800
+Subject: acer-wmi: No wifi rfkill on Sony machines
+
+From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
+
+commit 5719b81988f3c24ff694dc3a37e35b35630a3966 upstream.
+
+The wireless rfkill should charged by sony-laptop but not acer-wmi.
+So, add Sony's SNY5001 acpi device to blacklist in acer-wmi.
+
+Tested on Sony Vaio
+
+Cc: Carlos Corbacho <carlos@strangeworlds.co.uk>
+Cc: Matthew Garrett <mjg@redhat.com>
+Cc: Mattia Dongili <malattia@linux.it>
+Cc: Dimitris N <ddarlac@gmail.com>
+Tested-by: Dimitris N <ddarlac@gmail.com>
+Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/acer-wmi.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -692,6 +692,7 @@ static const struct acpi_device_id norfk
+       { "VPC2004", 0},
+       { "IBM0068", 0},
+       { "LEN0068", 0},
++      { "SNY5001", 0},        /* sony-laptop in charge */
+       { "", 0},
+ };
diff --git a/queue-3.3/fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch b/queue-3.3/fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch
new file mode 100644 (file)
index 0000000..19b5c71
--- /dev/null
@@ -0,0 +1,34 @@
+From 20e0fa98b751facf9a1101edaefbc19c82616a68 Mon Sep 17 00:00:00 2001
+From: Sachin Prabhu <sprabhu@redhat.com>
+Date: Thu, 22 Mar 2012 16:46:28 +0000
+Subject: Fix length of buffer copied in __nfs4_get_acl_uncached
+
+From: Sachin Prabhu <sprabhu@redhat.com>
+
+commit 20e0fa98b751facf9a1101edaefbc19c82616a68 upstream.
+
+_copy_from_pages() used to copy data from the temporary buffer to the
+user passed buffer is passed the wrong size parameter when copying
+data. res.acl_len contains both the bitmap and acl lenghts while
+acl_len contains the acl length after adjusting for the bitmap size.
+
+Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Cc: Josh Boyer <jwboyer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3625,7 +3625,7 @@ static ssize_t __nfs4_get_acl_uncached(s
+               if (acl_len > buflen)
+                       goto out_free;
+               _copy_from_pages(buf, pages, res.acl_data_offset,
+-                              res.acl_len);
++                              acl_len);
+       }
+       ret = acl_len;
+ out_free:
diff --git a/queue-3.3/iwlegacy-do-not-nulify-il-vif-on-reset.patch b/queue-3.3/iwlegacy-do-not-nulify-il-vif-on-reset.patch
new file mode 100644 (file)
index 0000000..8b0e007
--- /dev/null
@@ -0,0 +1,88 @@
+From 883a649b737cdbe3ede7e50f3f939fd706ed5c4e Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 13 Mar 2012 16:11:27 +0100
+Subject: iwlegacy: do not nulify il->vif on reset
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 883a649b737cdbe3ede7e50f3f939fd706ed5c4e upstream.
+
+This il->vif is dereferenced in different part of iwlegacy code, so do
+not nullify it. This should fix random crashes observed in companion
+with microcode errors i.e. crash in il3945_config_ap().
+
+Additionally this should address also
+WARNING: at drivers/net/wireless/iwlegacy/common.c:4656 il_mac_remove_interface
+at least one of the possible reasons of that warning.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlegacy/3945-mac.c |    1 -
+ drivers/net/wireless/iwlegacy/4965-mac.c |    1 -
+ drivers/net/wireless/iwlegacy/common.c   |   18 ++++++++++++++++--
+ 3 files changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/iwlegacy/3945-mac.c
+@@ -2684,7 +2684,6 @@ il3945_bg_restart(struct work_struct *da
+       if (test_and_clear_bit(S_FW_ERROR, &il->status)) {
+               mutex_lock(&il->mutex);
+-              il->ctx.vif = NULL;
+               il->is_open = 0;
+               mutex_unlock(&il->mutex);
+               il3945_down(il);
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -5381,7 +5381,6 @@ il4965_bg_restart(struct work_struct *da
+       if (test_and_clear_bit(S_FW_ERROR, &il->status)) {
+               mutex_lock(&il->mutex);
+-              il->ctx.vif = NULL;
+               il->is_open = 0;
+               __il4965_down(il);
+--- a/drivers/net/wireless/iwlegacy/common.c
++++ b/drivers/net/wireless/iwlegacy/common.c
+@@ -4575,6 +4575,7 @@ il_mac_add_interface(struct ieee80211_hw
+       struct il_priv *il = hw->priv;
+       struct il_vif_priv *vif_priv = (void *)vif->drv_priv;
+       int err;
++      bool reset;
+       u32 modes;
+       D_MAC80211("enter: type %d, addr %pM\n", vif->type, vif->addr);
+@@ -4594,6 +4595,16 @@ il_mac_add_interface(struct ieee80211_hw
+               goto out;
+       }
++      /*
++       * We do not support multiple virtual interfaces, but on hardware reset
++       * we have to add the same interface again.
++       */
++      reset = (il->ctx.vif == vif);
++      if (il->ctx.vif && !reset) {
++              err = -EOPNOTSUPP;
++              goto out;
++      }
++
+       modes = il->ctx.interface_modes | il->ctx.exclusive_interface_modes;
+       if (!(modes & BIT(vif->type))) {
+               err = -EOPNOTSUPP;
+@@ -4605,8 +4616,11 @@ il_mac_add_interface(struct ieee80211_hw
+       err = il_setup_interface(il, &il->ctx);
+       if (err) {
+-              il->ctx.vif = NULL;
+-              il->iw_mode = NL80211_IFTYPE_STATION;
++              IL_WARN("Fail to set mode %d\n", vif->type);
++              if (!reset) {
++                      il->ctx.vif = NULL;
++                      il->iw_mode = NL80211_IFTYPE_STATION;
++              }
+       }
+ out:
diff --git a/queue-3.3/mfd-clear-twl6030-irq-status-register-only-once.patch b/queue-3.3/mfd-clear-twl6030-irq-status-register-only-once.patch
new file mode 100644 (file)
index 0000000..c1d3939
--- /dev/null
@@ -0,0 +1,56 @@
+From 3f8349e6e98ba0455437724589072523865eae5e Mon Sep 17 00:00:00 2001
+From: Nishanth Menon <nm@ti.com>
+Date: Wed, 22 Feb 2012 20:03:45 -0600
+Subject: mfd: Clear twl6030 IRQ status register only once
+
+From: Nishanth Menon <nm@ti.com>
+
+commit 3f8349e6e98ba0455437724589072523865eae5e upstream.
+
+TWL6030 family of PMIC use a shadow interrupt status register
+while kernel processes the current interrupt event.
+However, any write(0 or 1) to register INT_STS_A, INT_STS_B or
+INT_STS_C clears all 3 interrupt status registers.
+
+Since clear of the interrupt is done on 32k clk, depending on I2C
+bus speed, we could in-adverently clear the status of a interrupt
+status pending on shadow register in the current implementation.
+This is due to the fact that multi-byte i2c write operation into
+three seperate status register could result in multiple load
+and clear of status and result in lost interrupts.
+
+Instead, doing a single byte write to INT_STS_A register with 0x0
+will clear all three interrupt status registers without the related
+risk.
+
+Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/twl6030-irq.c |   13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/mfd/twl6030-irq.c
++++ b/drivers/mfd/twl6030-irq.c
+@@ -185,8 +185,17 @@ static int twl6030_irq_thread(void *data
+                       }
+               local_irq_enable();
+               }
+-              ret = twl_i2c_write(TWL_MODULE_PIH, sts.bytes,
+-                              REG_INT_STS_A, 3); /* clear INT_STS_A */
++
++              /*
++               * NOTE:
++               * Simulation confirms that documentation is wrong w.r.t the
++               * interrupt status clear operation. A single *byte* write to
++               * any one of STS_A to STS_C register results in all three
++               * STS registers being reset. Since it does not matter which
++               * value is written, all three registers are cleared on a
++               * single byte write, so we just use 0x0 to clear.
++               */
++              ret = twl_i2c_write_u8(TWL_MODULE_PIH, 0x00, REG_INT_STS_A);
+               if (ret)
+                       pr_warning("twl6030: I2C error in clearing PIH ISR\n");
diff --git a/queue-3.3/revert-x86-ioapic-add-register-level-checks-to-detect.patch b/queue-3.3/revert-x86-ioapic-add-register-level-checks-to-detect.patch
new file mode 100644 (file)
index 0000000..656fb3d
--- /dev/null
@@ -0,0 +1,95 @@
+From dd97ac4172cb1c7a4c848bc37302e11540732856 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 10 Apr 2012 16:04:49 -0700
+Subject: Revert "x86/ioapic: Add register level checks to detect bogus io-apic entries"
+
+This reverts commit a998dc2fa76f496d2944f0602b920d1d10d7467d
+[73d63d038ee9f769f5e5b46792d227fe20e442c5 upstream]
+
+It causes problems, so needs to be reverted from 3.2-stable for now.
+
+Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Jon Dufresne <jon@jondufresne.org>
+Cc: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: <yinghai@kernel.org>
+Cc: Josh Boyer <jwboyer@redhat.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Teck Choon Giam <giamteckchoon@gmail.com>
+Cc: Ben Guthro <ben@guthro.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/apic/io_apic.c |   40 ++++++++--------------------------------
+ 1 file changed, 8 insertions(+), 32 deletions(-)
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -3967,36 +3967,18 @@ int mp_find_ioapic_pin(int ioapic, u32 g
+ static __init int bad_ioapic(unsigned long address)
+ {
+       if (nr_ioapics >= MAX_IO_APICS) {
+-              pr_warn("WARNING: Max # of I/O APICs (%d) exceeded (found %d), skipping\n",
+-                      MAX_IO_APICS, nr_ioapics);
++              printk(KERN_WARNING "WARNING: Max # of I/O APICs (%d) exceeded "
++                     "(found %d), skipping\n", MAX_IO_APICS, nr_ioapics);
+               return 1;
+       }
+       if (!address) {
+-              pr_warn("WARNING: Bogus (zero) I/O APIC address found in table, skipping!\n");
++              printk(KERN_WARNING "WARNING: Bogus (zero) I/O APIC address"
++                     " found in table, skipping!\n");
+               return 1;
+       }
+       return 0;
+ }
+-static __init int bad_ioapic_register(int idx)
+-{
+-      union IO_APIC_reg_00 reg_00;
+-      union IO_APIC_reg_01 reg_01;
+-      union IO_APIC_reg_02 reg_02;
+-
+-      reg_00.raw = io_apic_read(idx, 0);
+-      reg_01.raw = io_apic_read(idx, 1);
+-      reg_02.raw = io_apic_read(idx, 2);
+-
+-      if (reg_00.raw == -1 && reg_01.raw == -1 && reg_02.raw == -1) {
+-              pr_warn("I/O APIC 0x%x registers return all ones, skipping!\n",
+-                      mpc_ioapic_addr(idx));
+-              return 1;
+-      }
+-
+-      return 0;
+-}
+-
+ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
+ {
+       int idx = 0;
+@@ -4013,12 +3995,6 @@ void __init mp_register_ioapic(int id, u
+       ioapics[idx].mp_config.apicaddr = address;
+       set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
+-
+-      if (bad_ioapic_register(idx)) {
+-              clear_fixmap(FIX_IO_APIC_BASE_0 + idx);
+-              return;
+-      }
+-
+       ioapics[idx].mp_config.apicid = io_apic_unique_id(id);
+       ioapics[idx].mp_config.apicver = io_apic_get_version(idx);
+@@ -4039,10 +4015,10 @@ void __init mp_register_ioapic(int id, u
+       if (gsi_cfg->gsi_end >= gsi_top)
+               gsi_top = gsi_cfg->gsi_end + 1;
+-      pr_info("IOAPIC[%d]: apic_id %d, version %d, address 0x%x, GSI %d-%d\n",
+-              idx, mpc_ioapic_id(idx),
+-              mpc_ioapic_ver(idx), mpc_ioapic_addr(idx),
+-              gsi_cfg->gsi_base, gsi_cfg->gsi_end);
++      printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%x, "
++             "GSI %d-%d\n", idx, mpc_ioapic_id(idx),
++             mpc_ioapic_ver(idx), mpc_ioapic_addr(idx),
++             gsi_cfg->gsi_base, gsi_cfg->gsi_end);
+       nr_ioapics++;
+ }
diff --git a/queue-3.3/sched-x86-fix-overflow-in-cyc2ns_offset.patch b/queue-3.3/sched-x86-fix-overflow-in-cyc2ns_offset.patch
new file mode 100644 (file)
index 0000000..573288c
--- /dev/null
@@ -0,0 +1,93 @@
+From 9993bc635d01a6ee7f6b833b4ee65ce7c06350b1 Mon Sep 17 00:00:00 2001
+From: Salman Qazi <sqazi@google.com>
+Date: Fri, 9 Mar 2012 16:41:01 -0800
+Subject: sched/x86: Fix overflow in cyc2ns_offset
+
+From: Salman Qazi <sqazi@google.com>
+
+commit 9993bc635d01a6ee7f6b833b4ee65ce7c06350b1 upstream.
+
+When a machine boots up, the TSC generally gets reset.  However,
+when kexec is used to boot into a kernel, the TSC value would be
+carried over from the previous kernel.  The computation of
+cycns_offset in set_cyc2ns_scale is prone to an overflow, if the
+machine has been up more than 208 days prior to the kexec.  The
+overflow happens when we multiply *scale, even though there is
+enough room to store the final answer.
+
+We fix this issue by decomposing tsc_now into the quotient and
+remainder of division by CYC2NS_SCALE_FACTOR and then performing
+the multiplication separately on the two components.
+
+Refactor code to share the calculation with the previous
+fix in __cycles_2_ns().
+
+Signed-off-by: Salman Qazi <sqazi@google.com>
+Acked-by: John Stultz <john.stultz@linaro.org>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Paul Turner <pjt@google.com>
+Cc: john stultz <johnstul@us.ibm.com>
+Link: http://lkml.kernel.org/r/20120310004027.19291.88460.stgit@dungbeetle.mtv.corp.google.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/timer.h |    8 ++------
+ arch/x86/kernel/tsc.c        |    3 ++-
+ include/linux/kernel.h       |   13 +++++++++++++
+ 3 files changed, 17 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/include/asm/timer.h
++++ b/arch/x86/include/asm/timer.h
+@@ -57,14 +57,10 @@ DECLARE_PER_CPU(unsigned long long, cyc2
+ static inline unsigned long long __cycles_2_ns(unsigned long long cyc)
+ {
+-      unsigned long long quot;
+-      unsigned long long rem;
+       int cpu = smp_processor_id();
+       unsigned long long ns = per_cpu(cyc2ns_offset, cpu);
+-      quot = (cyc >> CYC2NS_SCALE_FACTOR);
+-      rem = cyc & ((1ULL << CYC2NS_SCALE_FACTOR) - 1);
+-      ns += quot * per_cpu(cyc2ns, cpu) +
+-              ((rem * per_cpu(cyc2ns, cpu)) >> CYC2NS_SCALE_FACTOR);
++      ns += mult_frac(cyc, per_cpu(cyc2ns, cpu),
++                      (1UL << CYC2NS_SCALE_FACTOR));
+       return ns;
+ }
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -620,7 +620,8 @@ static void set_cyc2ns_scale(unsigned lo
+       if (cpu_khz) {
+               *scale = (NSEC_PER_MSEC << CYC2NS_SCALE_FACTOR)/cpu_khz;
+-              *offset = ns_now - (tsc_now * *scale >> CYC2NS_SCALE_FACTOR);
++              *offset = ns_now - mult_frac(tsc_now, *scale,
++                                           (1UL << CYC2NS_SCALE_FACTOR));
+       }
+       sched_clock_idle_wakeup_event(0);
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -85,6 +85,19 @@
+ }                                                     \
+ )
++/*
++ * Multiplies an integer by a fraction, while avoiding unnecessary
++ * overflow or loss of precision.
++ */
++#define mult_frac(x, numer, denom)(                   \
++{                                                     \
++      typeof(x) quot = (x) / (denom);                 \
++      typeof(x) rem  = (x) % (denom);                 \
++      (quot * (numer)) + ((rem * (numer)) / (denom)); \
++}                                                     \
++)
++
++
+ #define _RET_IP_              (unsigned long)__builtin_return_address(0)
+ #define _THIS_IP_  ({ __label__ __here; __here: (unsigned long)&&__here; })
index d79cf2fa5c3ff617dad055968aa919c5efa073ce..92f4a33793af83900a8d62e8d0e95e0ab0ba8358 100644 (file)
@@ -61,3 +61,11 @@ regmap-prevent-division-by-zero-in-rbtree_show.patch
 modpost-fix-modpost-license-checking-of-vmlinux.o.patch
 mfd-fix-section-mismatch-warning-for-da9052-spi.patch
 android-lowmemorykiller-remove-task-handoff-notifier.patch
+tomoyo-fix-mount-flags-checking-order.patch
+iwlegacy-do-not-nulify-il-vif-on-reset.patch
+revert-x86-ioapic-add-register-level-checks-to-detect.patch
+acer-wmi-no-wifi-rfkill-on-sony-machines.patch
+fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch
+sched-x86-fix-overflow-in-cyc2ns_offset.patch
+mfd-clear-twl6030-irq-status-register-only-once.patch
+usb-add-motorola-rokr-e6-id-to-the-usbnet-driver-zaurus.patch
diff --git a/queue-3.3/tomoyo-fix-mount-flags-checking-order.patch b/queue-3.3/tomoyo-fix-mount-flags-checking-order.patch
new file mode 100644 (file)
index 0000000..031e09c
--- /dev/null
@@ -0,0 +1,89 @@
+From df91e49477a9be15921cb2854e1d12a3bdb5e425 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Wed, 29 Feb 2012 21:53:22 +0900
+Subject: TOMOYO: Fix mount flags checking order.
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit df91e49477a9be15921cb2854e1d12a3bdb5e425 upstream.
+
+Userspace can pass in arbitrary combinations of MS_* flags to mount().
+
+If both MS_BIND and one of MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE are
+passed, device name which should be checked for MS_BIND was not checked because
+MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE had higher priority than MS_BIND.
+
+If both one of MS_BIND/MS_MOVE and MS_REMOUNT are passed, device name which
+should not be checked for MS_REMOUNT was checked because MS_BIND/MS_MOVE had
+higher priority than MS_REMOUNT.
+
+Fix these bugs by changing priority to MS_REMOUNT -> MS_BIND ->
+MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE -> MS_MOVE as with do_mount() does.
+
+Also, unconditionally return -EINVAL if more than one of
+MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE is passed so that TOMOYO will not
+generate inaccurate audit logs, for commit 7a2e8a8f "VFS: Sanity check mount
+flags passed to change_mnt_propagation()" clarified that these flags must be
+exclusively passed.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/tomoyo/mount.c |   38 ++++++++++++++++++++------------------
+ 1 file changed, 20 insertions(+), 18 deletions(-)
+
+--- a/security/tomoyo/mount.c
++++ b/security/tomoyo/mount.c
+@@ -199,30 +199,32 @@ int tomoyo_mount_permission(char *dev_na
+       if (flags & MS_REMOUNT) {
+               type = tomoyo_mounts[TOMOYO_MOUNT_REMOUNT];
+               flags &= ~MS_REMOUNT;
+-      }
+-      if (flags & MS_MOVE) {
+-              type = tomoyo_mounts[TOMOYO_MOUNT_MOVE];
+-              flags &= ~MS_MOVE;
+-      }
+-      if (flags & MS_BIND) {
++      } else if (flags & MS_BIND) {
+               type = tomoyo_mounts[TOMOYO_MOUNT_BIND];
+               flags &= ~MS_BIND;
+-      }
+-      if (flags & MS_UNBINDABLE) {
+-              type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_UNBINDABLE];
+-              flags &= ~MS_UNBINDABLE;
+-      }
+-      if (flags & MS_PRIVATE) {
++      } else if (flags & MS_SHARED) {
++              if (flags & (MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
++                      return -EINVAL;
++              type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SHARED];
++              flags &= ~MS_SHARED;
++      } else if (flags & MS_PRIVATE) {
++              if (flags & (MS_SHARED | MS_SLAVE | MS_UNBINDABLE))
++                      return -EINVAL;
+               type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_PRIVATE];
+               flags &= ~MS_PRIVATE;
+-      }
+-      if (flags & MS_SLAVE) {
++      } else if (flags & MS_SLAVE) {
++              if (flags & (MS_SHARED | MS_PRIVATE | MS_UNBINDABLE))
++                      return -EINVAL;
+               type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SLAVE];
+               flags &= ~MS_SLAVE;
+-      }
+-      if (flags & MS_SHARED) {
+-              type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SHARED];
+-              flags &= ~MS_SHARED;
++      } else if (flags & MS_UNBINDABLE) {
++              if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE))
++                      return -EINVAL;
++              type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_UNBINDABLE];
++              flags &= ~MS_UNBINDABLE;
++      } else if (flags & MS_MOVE) {
++              type = tomoyo_mounts[TOMOYO_MOUNT_MOVE];
++              flags &= ~MS_MOVE;
+       }
+       if (!type)
+               type = "<NULL>";
diff --git a/queue-3.3/usb-add-motorola-rokr-e6-id-to-the-usbnet-driver-zaurus.patch b/queue-3.3/usb-add-motorola-rokr-e6-id-to-the-usbnet-driver-zaurus.patch
new file mode 100644 (file)
index 0000000..0985df0
--- /dev/null
@@ -0,0 +1,34 @@
+From a2daf263107ba3eb6db33931881731fa51c95045 Mon Sep 17 00:00:00 2001
+From: Guan Xin <guanx.bac@gmail.com>
+Date: Mon, 26 Mar 2012 04:11:46 +0000
+Subject: USB: Add Motorola Rokr E6 Id to the USBNet driver "zaurus"
+
+From: Guan Xin <guanx.bac@gmail.com>
+
+commit a2daf263107ba3eb6db33931881731fa51c95045 upstream.
+
+Added Vendor/Device Id of Motorola Rokr E6 (22b8:6027) so it can be
+recognized by the "zaurus" USBNet driver.
+Applies to Linux 3.2.13 and 2.6.39.4.
+Signed-off-by: Guan Xin <guanx.bac@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/zaurus.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/usb/zaurus.c
++++ b/drivers/net/usb/zaurus.c
+@@ -337,6 +337,11 @@ static const struct usb_device_id produc
+       .driver_info = ZAURUS_PXA_INFO,
+ },
+ {
++      /* Motorola Rokr E6 */
++      USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6027, USB_CLASS_COMM,
++                      USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
++      .driver_info = (unsigned long) &bogus_mdlm_info,
++}, {
+       /* Motorola MOTOMAGX phones */
+       USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM,
+                       USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),