--- /dev/null
+From 276bdb82dedb290511467a5a4fdbe9f0b52dce6f Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli@googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:54 +0000
+Subject: dccp: check ccid before dereferencing
+
+From: Mathias Krause <minipli@googlemail.com>
+
+commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream.
+
+ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with
+a NULL ccid pointer leading to a NULL pointer dereference. This could
+lead to a privilege escalation if the attacker is able to map page 0 and
+prepare it with a fake ccid_ops pointer.
+
+Signed-off-by: Mathias Krause <minipli@googlemail.com>
+Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/dccp/ccid.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/dccp/ccid.h
++++ b/net/dccp/ccid.h
+@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt(
+ u32 __user *optval, int __user *optlen)
+ {
+ int rc = -ENOPROTOOPT;
+- if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL)
+ rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len,
+ optval, optlen);
+ return rc;
+@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt(
+ u32 __user *optval, int __user *optlen)
+ {
+ int rc = -ENOPROTOOPT;
+- if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL)
+ rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len,
+ optval, optlen);
+ return rc;
--- /dev/null
+From c4903429a92be60e6fe59868924a65eca4cd1a38 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Tue, 28 Aug 2012 21:40:51 -0400
+Subject: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit c4903429a92be60e6fe59868924a65eca4cd1a38 upstream.
+
+This will cause udev to load vmwgfx instead of waiting for X
+to do it.
+
+Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -182,6 +182,7 @@ static struct pci_device_id vmw_pci_id_l
+ {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII},
+ {0, 0, 0}
+ };
++MODULE_DEVICE_TABLE(pci, vmw_pci_id_list);
+
+ static int enable_fbdev;
+
--- /dev/null
+From 67ddbb3e6568fb1820b2cc45b00c50702b114801 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 23 Aug 2012 10:51:55 -0400
+Subject: HID: add NOGET quirk for Eaton Ellipse MAX UPS
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 67ddbb3e6568fb1820b2cc45b00c50702b114801 upstream.
+
+This patch (as1603) adds a NOGET quirk for the Eaton Ellipse MAX UPS
+device. (The USB IDs were already present in hid-ids.h, apparently
+under a different name.)
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Laurent Bigonville <l.bigonville@edpnet.be>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -70,6 +70,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
--- /dev/null
+From 43ca6cb28c871f2fbad10117b0648e5ae3b0f638 Mon Sep 17 00:00:00 2001
+From: Luca Tettamanti <kronos.it@gmail.com>
+Date: Tue, 21 Aug 2012 17:36:28 +0200
+Subject: hwmon: (asus_atk0110) Add quirk for Asus M5A78L
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luca Tettamanti <kronos.it@gmail.com>
+
+commit 43ca6cb28c871f2fbad10117b0648e5ae3b0f638 upstream.
+
+The old interface is bugged and reads the wrong sensor when retrieving
+the reading for the chassis fan (it reads the CPU sensor); the new
+interface works fine.
+
+Reported-by: Göran Uddeborg <goeran@uddeborg.se>
+Tested-by: Göran Uddeborg <goeran@uddeborg.se>
+Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/asus_atk0110.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -34,6 +34,12 @@ static const struct dmi_system_id __init
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "SABERTOOTH X58")
+ }
++ }, {
++ /* Old interface reads the same sensor for fan0 and fan1 */
++ .ident = "Asus M5A78L",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "M5A78L")
++ }
+ },
+ { }
+ };
--- /dev/null
+From 7b125b94ca16b7e618c6241cb02c4c8060cea5e3 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 21 Aug 2012 21:57:15 -0700
+Subject: Input: i8042 - add Gigabyte T1005 series netbooks to noloop table
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 7b125b94ca16b7e618c6241cb02c4c8060cea5e3 upstream.
+
+They all define their chassis type as "Other" and therefore are not
+categorized as "laptops" by the driver, which tries to perform AUX IRQ
+delivery test which fails and causes touchpad not working.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42620
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -177,6 +177,20 @@ static const struct dmi_system_id __init
+ },
+ },
+ {
++ /* Gigabyte T1005 - defines wrong chassis type ("Other") */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "T1005"),
++ },
++ },
++ {
++ /* Gigabyte T1005M/P - defines wrong chassis type ("Other") */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "T1005M/P"),
++ },
++ },
++ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
--- /dev/null
+From bba3d8c3b3c0f2123be5bc687d1cddc13437c923 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Mon, 23 Jul 2012 12:16:19 +0100
+Subject: PARISC: Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit bba3d8c3b3c0f2123be5bc687d1cddc13437c923 upstream.
+
+The following build error occured during a parisc build with
+swap-over-NFS patches applied.
+
+net/core/sock.c:274:36: error: initializer element is not constant
+net/core/sock.c:274:36: error: (near initialization for 'memalloc_socks')
+net/core/sock.c:274:36: error: initializer element is not constant
+
+Dave Anglin says:
+> Here is the line in sock.i:
+>
+> struct static_key memalloc_socks = ((struct static_key) { .enabled =
+> ((atomic_t) { (0) }) });
+
+The above line contains two compound literals. It also uses a designated
+initializer to initialize the field enabled. A compound literal is not a
+constant expression.
+
+The location of the above statement isn't fully clear, but if a compound
+literal occurs outside the body of a function, the initializer list must
+consist of constant expressions.
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/atomic.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -141,7 +141,7 @@ static __inline__ int __atomic_add_unles
+
+ #define atomic_sub_and_test(i,v) (atomic_sub_return((i),(v)) == 0)
+
+-#define ATOMIC_INIT(i) ((atomic_t) { (i) })
++#define ATOMIC_INIT(i) { (i) }
+
+ #define smp_mb__before_atomic_dec() smp_mb()
+ #define smp_mb__after_atomic_dec() smp_mb()
+@@ -150,7 +150,7 @@ static __inline__ int __atomic_add_unles
+
+ #ifdef CONFIG_64BIT
+
+-#define ATOMIC64_INIT(i) ((atomic64_t) { (i) })
++#define ATOMIC64_INIT(i) { (i) }
+
+ static __inline__ s64
+ __atomic64_add_return(s64 i, atomic64_t *v)
fuse-fix-retrieve-length.patch
i2c-designware-fix-build-error-if-config_i2c_designware_platform-y-config_i2c_designware_pci-y.patch
i2c-i801-add-device-ids-for-intel-lynx-point-lp-pch.patch
+hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch
+input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch
+drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch
+parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch
+xen-use-correct-masking-in-xen_swiotlb_alloc_coherent.patch
+xen-pciback-fix-proper-flr-steps.patch
+x86-microcode-amd-fix-broken-ucode-patch-size-check.patch
+dccp-check-ccid-before-dereferencing.patch
+hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch
--- /dev/null
+From 36bf50d7697be18c6bfd0401e037df10bff1e573 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Tue, 31 Jul 2012 15:41:45 +0200
+Subject: x86, microcode, AMD: Fix broken ucode patch size check
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 36bf50d7697be18c6bfd0401e037df10bff1e573 upstream.
+
+This issue was recently observed on an AMD C-50 CPU where a patch of
+maximum size was applied.
+
+Commit be62adb49294 ("x86, microcode, AMD: Simplify ucode verification")
+added current_size in get_matching_microcode(). This is calculated as
+size of the ucode patch + 8 (ie. size of the header). Later this is
+compared against the maximum possible ucode patch size for a CPU family.
+And of course this fails if the patch has already maximum size.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Link: http://lkml.kernel.org/r/1344361461-10076-1-git-send-email-bp@amd64.org
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/microcode_amd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -143,11 +143,12 @@ static int get_matching_microcode(int cp
+ unsigned int *current_size)
+ {
+ struct microcode_header_amd *mc_hdr;
+- unsigned int actual_size;
++ unsigned int actual_size, patch_size;
+ u16 equiv_cpu_id;
+
+ /* size of the current patch we're staring at */
+- *current_size = *(u32 *)(ucode_ptr + 4) + SECTION_HDR_SIZE;
++ patch_size = *(u32 *)(ucode_ptr + 4);
++ *current_size = patch_size + SECTION_HDR_SIZE;
+
+ equiv_cpu_id = find_equiv_id();
+ if (!equiv_cpu_id)
+@@ -174,7 +175,7 @@ static int get_matching_microcode(int cp
+ /*
+ * now that the header looks sane, verify its size
+ */
+- actual_size = verify_ucode_size(cpu, *current_size, leftover_size);
++ actual_size = verify_ucode_size(cpu, patch_size, leftover_size);
+ if (!actual_size)
+ return 0;
+
--- /dev/null
+From 80ba77dfbce85f2d1be54847de3c866de1b18a9a Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Wed, 5 Sep 2012 16:35:20 -0400
+Subject: xen/pciback: Fix proper FLR steps.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 80ba77dfbce85f2d1be54847de3c866de1b18a9a upstream.
+
+When we do FLR and save PCI config we did it in the wrong order.
+The end result was that if a PCI device was unbind from
+its driver, then binded to xen-pciback, and then back to its
+driver we would get:
+
+> lspci -s 04:00.0
+04:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection
+13:42:12 # 4 :~/
+> echo "0000:04:00.0" > /sys/bus/pci/drivers/pciback/unbind
+> modprobe e1000e
+e1000e: Intel(R) PRO/1000 Network Driver - 2.0.0-k
+e1000e: Copyright(c) 1999 - 2012 Intel Corporation.
+e1000e 0000:04:00.0: Disabling ASPM L0s L1
+e1000e 0000:04:00.0: enabling device (0000 -> 0002)
+xen: registering gsi 48 triggering 0 polarity 1
+Already setup the GSI :48
+e1000e 0000:04:00.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
+e1000e: probe of 0000:04:00.0 failed with error -2
+
+This fixes it by first saving the PCI configuration space, then
+doing the FLR.
+
+Reported-by: Ren, Yongjie <yongjie.ren@intel.com>
+Reported-and-Tested-by: Tobias Geiger <tobias.geiger@vido.info>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/xen-pciback/pci_stub.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -353,16 +353,16 @@ static int __devinit pcistub_init_device
+ if (err)
+ goto config_release;
+
+- dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n");
+- __pci_reset_function_locked(dev);
+-
+ /* We need the device active to save the state. */
+ dev_dbg(&dev->dev, "save state of device\n");
+ pci_save_state(dev);
+ dev_data->pci_saved_state = pci_store_saved_state(dev);
+ if (!dev_data->pci_saved_state)
+ dev_err(&dev->dev, "Could not store PCI conf saved state!\n");
+-
++ else {
++ dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n");
++ __pci_reset_function_locked(dev);
++ }
+ /* Now disable the device (this also ensures some private device
+ * data is setup before we export)
+ */
--- /dev/null
+From b5031ed1be0aa419250557123633453753181643 Mon Sep 17 00:00:00 2001
+From: Ronny Hegewald <ronny.hegewald@online.de>
+Date: Fri, 31 Aug 2012 09:57:52 +0000
+Subject: xen: Use correct masking in xen_swiotlb_alloc_coherent.
+
+From: Ronny Hegewald <ronny.hegewald@online.de>
+
+commit b5031ed1be0aa419250557123633453753181643 upstream.
+
+When running 32-bit pvops-dom0 and a driver tries to allocate a coherent
+DMA-memory the xen swiotlb-implementation returned memory beyond 4GB.
+
+The underlaying reason is that if the supplied driver passes in a
+DMA_BIT_MASK(64) ( hwdev->coherent_dma_mask is set to 0xffffffffffffffff)
+our dma_mask will be u64 set to 0xffffffffffffffff even if we set it to
+DMA_BIT_MASK(32) previously. Meaning we do not reset the upper bits.
+By using the dma_alloc_coherent_mask function - it does the proper casting
+and we get 0xfffffffff.
+
+This caused not working sound on a system with 4 GB and a 64-bit
+compatible sound-card with sets the DMA-mask to 64bit.
+
+On bare-metal and the forward-ported xen-dom0 patches from OpenSuse a coherent
+DMA-memory is always allocated inside the 32-bit address-range by calling
+dma_alloc_coherent_mask.
+
+This patch adds the same functionality to xen swiotlb and is a rebase of the
+original patch from Ronny Hegewald which never got upstream b/c the
+underlaying reason was not understood until now.
+
+The original email with the original patch is in:
+http://old-list-archives.xen.org/archives/html/xen-devel/2010-02/msg00038.html
+the original thread from where the discussion started is in:
+http://old-list-archives.xen.org/archives/html/xen-devel/2010-01/msg00928.html
+
+Signed-off-by: Ronny Hegewald <ronny.hegewald@online.de>
+Signed-off-by: Stefano Panella <stefano.panella@citrix.com>
+Acked-By: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/swiotlb-xen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -232,7 +232,7 @@ xen_swiotlb_alloc_coherent(struct device
+ return ret;
+
+ if (hwdev && hwdev->coherent_dma_mask)
+- dma_mask = hwdev->coherent_dma_mask;
++ dma_mask = dma_alloc_coherent_mask(hwdev, flags);
+
+ phys = virt_to_phys(ret);
+ dev_addr = xen_phys_to_bus(phys);
projects / thirdparty / kernel / stable-queue.git / commitdiff
