]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.8-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Feb 2013 21:11:51 +0000 (13:11 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Feb 2013 21:11:51 +0000 (13:11 -0800)
added patches:
alsa-bt87x-make-load_all-parameter-working-again.patch
alsa-emu10k1-fix-regression-in-emu1010-firmware-loading.patch
alsa-emu10k1-load-firmware-when-it-was-already-cached.patch
alsa-hda-hdmi-make-jacks-phantom-if-they-re-not-detectable.patch
ib-srp-avoid-endless-scsi-error-handling-loop.patch
ib-srp-avoid-sending-a-task-management-function-needlessly.patch
ib-srp-fail-i-o-requests-if-the-transport-is-offline.patch
ib-srp-track-connection-state-properly.patch
mm-do-not-grow-the-stack-vma-just-because-of-an-overrun-on-preceding-vma.patch
quota-autoload-the-quota_v2-module-for-qfmt_vfs_v1-quota-format.patch

queue-3.8/alsa-bt87x-make-load_all-parameter-working-again.patch [new file with mode: 0644]
queue-3.8/alsa-emu10k1-fix-regression-in-emu1010-firmware-loading.patch [new file with mode: 0644]
queue-3.8/alsa-emu10k1-load-firmware-when-it-was-already-cached.patch [new file with mode: 0644]
queue-3.8/alsa-hda-hdmi-make-jacks-phantom-if-they-re-not-detectable.patch [new file with mode: 0644]
queue-3.8/ib-srp-avoid-endless-scsi-error-handling-loop.patch [new file with mode: 0644]
queue-3.8/ib-srp-avoid-sending-a-task-management-function-needlessly.patch [new file with mode: 0644]
queue-3.8/ib-srp-fail-i-o-requests-if-the-transport-is-offline.patch [new file with mode: 0644]
queue-3.8/ib-srp-track-connection-state-properly.patch [new file with mode: 0644]
queue-3.8/mm-do-not-grow-the-stack-vma-just-because-of-an-overrun-on-preceding-vma.patch [new file with mode: 0644]
queue-3.8/quota-autoload-the-quota_v2-module-for-qfmt_vfs_v1-quota-format.patch [new file with mode: 0644]
queue-3.8/series [new file with mode: 0644]

diff --git a/queue-3.8/alsa-bt87x-make-load_all-parameter-working-again.patch b/queue-3.8/alsa-bt87x-make-load_all-parameter-working-again.patch
new file mode 100644 (file)
index 0000000..6843109
--- /dev/null
@@ -0,0 +1,60 @@
+From aacfddfdadb3540651d263245069631f341e953a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 25 Feb 2013 09:48:45 +0100
+Subject: ALSA: bt87x: Make load_all parameter working again
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit aacfddfdadb3540651d263245069631f341e953a upstream.
+
+Along with a clean up commit [e9f66d9b9: ALSA: pci: clean up using
+module_pci_driver()], bt87x driver lost the functionality of load_all
+parameter.  This patch does a partial revert of the commit only for
+bt87x.c to recover it.
+
+Reported-by: Clemens Ladisch <cladisch@googlemail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/bt87x.c |   19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/bt87x.c
++++ b/sound/pci/bt87x.c
+@@ -836,6 +836,8 @@ static struct {
+       {0x7063, 0x2000}, /* pcHDTV HD-2000 TV */
+ };
++static struct pci_driver driver;
++
+ /* return the id of the card, or a negative value if it's blacklisted */
+ static int snd_bt87x_detect_card(struct pci_dev *pci)
+ {
+@@ -962,11 +964,24 @@ static DEFINE_PCI_DEVICE_TABLE(snd_bt87x
+       { }
+ };
+-static struct pci_driver bt87x_driver = {
++static struct pci_driver driver = {
+       .name = KBUILD_MODNAME,
+       .id_table = snd_bt87x_ids,
+       .probe = snd_bt87x_probe,
+       .remove = snd_bt87x_remove,
+ };
+-module_pci_driver(bt87x_driver);
++static int __init alsa_card_bt87x_init(void)
++{
++      if (load_all)
++              driver.id_table = snd_bt87x_default_ids;
++      return pci_register_driver(&driver);
++}
++
++static void __exit alsa_card_bt87x_exit(void)
++{
++      pci_unregister_driver(&driver);
++}
++
++module_init(alsa_card_bt87x_init)
++module_exit(alsa_card_bt87x_exit)
diff --git a/queue-3.8/alsa-emu10k1-fix-regression-in-emu1010-firmware-loading.patch b/queue-3.8/alsa-emu10k1-fix-regression-in-emu1010-firmware-loading.patch
new file mode 100644 (file)
index 0000000..cd0c429
--- /dev/null
@@ -0,0 +1,36 @@
+From d28215996b0c3a900411769039aa3c54cf7008ab Mon Sep 17 00:00:00 2001
+From: Mihail Zenkov <mihail.zenkov@gmail.com>
+Date: Fri, 22 Feb 2013 11:25:27 +0000
+Subject: ALSA: emu10k1: Fix regression in emu1010 firmware loading
+
+From: Mihail Zenkov <mihail.zenkov@gmail.com>
+
+commit d28215996b0c3a900411769039aa3c54cf7008ab upstream.
+
+This patch fix regression in emu1010 firmware loading after
+http://git.alsa-project.org/?p=alsa-kprivate.git;a=commitdiff;h=b209c4dfcd960ab176d4746ab7dc442a3edb4575
+
+I just revert small part of this commit. Tested on emu1212m pci.
+
+Signed-off-by: Mihail Zenkov <mihail.zenkov@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/emu10k1/emu10k1_main.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -860,6 +860,11 @@ static int snd_emu10k1_emu1010_init(stru
+               }
+               snd_printk(KERN_INFO "emu1010: firmware file = %s, size = 0x%zx\n",
+                          filename, emu->firmware->size);
++              err = snd_emu1010_load_firmware(emu);
++              if (err != 0) {
++                      snd_printk(KERN_INFO "emu1010: Loading Firmware file %s failed\n", filename);
++                      return err;
++              }
+       }
+       /* ID, should read & 0x7f = 0x55 when FPGA programmed. */
diff --git a/queue-3.8/alsa-emu10k1-load-firmware-when-it-was-already-cached.patch b/queue-3.8/alsa-emu10k1-load-firmware-when-it-was-already-cached.patch
new file mode 100644 (file)
index 0000000..60b1aaf
--- /dev/null
@@ -0,0 +1,41 @@
+From b56ddbe55a363eee4ff7410a97050dad08215f7c Mon Sep 17 00:00:00 2001
+From: Florian Zeitz <florob@babelmonkeys.de>
+Date: Mon, 25 Feb 2013 09:53:35 +0100
+Subject: ALSA: emu10k1: Load firmware when it was already cached
+
+From: Florian Zeitz <florob@babelmonkeys.de>
+
+commit b56ddbe55a363eee4ff7410a97050dad08215f7c upstream.
+
+This expands the regression fix from
+d28215996b0c3a900411769039aa3c54cf7008ab.
+The firmware also needs to be loaded when it was already cached.
+
+Signed-off-by: Florian Zeitz <florob@babelmonkeys.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/emu10k1/emu10k1_main.c |   11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -860,11 +860,12 @@ static int snd_emu10k1_emu1010_init(stru
+               }
+               snd_printk(KERN_INFO "emu1010: firmware file = %s, size = 0x%zx\n",
+                          filename, emu->firmware->size);
+-              err = snd_emu1010_load_firmware(emu);
+-              if (err != 0) {
+-                      snd_printk(KERN_INFO "emu1010: Loading Firmware file %s failed\n", filename);
+-                      return err;
+-              }
++      }
++
++      err = snd_emu1010_load_firmware(emu);
++      if (err != 0) {
++              snd_printk(KERN_INFO "emu1010: Loading Firmware failed\n");
++              return err;
+       }
+       /* ID, should read & 0x7f = 0x55 when FPGA programmed. */
diff --git a/queue-3.8/alsa-hda-hdmi-make-jacks-phantom-if-they-re-not-detectable.patch b/queue-3.8/alsa-hda-hdmi-make-jacks-phantom-if-they-re-not-detectable.patch
new file mode 100644 (file)
index 0000000..6aa1fe8
--- /dev/null
@@ -0,0 +1,37 @@
+From 30efd8debd1ef30be342d374f01e993509f5b76b Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 22 Feb 2013 10:16:28 +0100
+Subject: ALSA: hda - hdmi: Make jacks phantom, if they're not detectable
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 30efd8debd1ef30be342d374f01e993509f5b76b upstream.
+
+Just as for analog codecs, a jack that isn't suitable for detection
+(in this case, NO_PRESENCE was set) should be a phantom Jack
+instead of a normal one.
+
+Thanks to Raymond Yau for spotting.
+
+BugLink: https://bugs.launchpad.net/bugs/961286
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=903869
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1573,6 +1573,9 @@ static int generic_hdmi_build_jack(struc
+       if (pcmdev > 0)
+               sprintf(hdmi_str + strlen(hdmi_str), ",pcm=%d", pcmdev);
++      if (!is_jack_detectable(codec, per_pin->pin_nid))
++              strncat(hdmi_str, " Phantom",
++                      sizeof(hdmi_str) - strlen(hdmi_str) - 1);
+       return snd_hda_jack_add_kctl(codec, per_pin->pin_nid, hdmi_str, 0);
+ }
diff --git a/queue-3.8/ib-srp-avoid-endless-scsi-error-handling-loop.patch b/queue-3.8/ib-srp-avoid-endless-scsi-error-handling-loop.patch
new file mode 100644 (file)
index 0000000..a02fa5b
--- /dev/null
@@ -0,0 +1,93 @@
+From c7c4e7ff8047e43c45628b85ac200582e9404c39 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 21 Feb 2013 17:19:04 +0000
+Subject: IB/srp: Avoid endless SCSI error handling loop
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit c7c4e7ff8047e43c45628b85ac200582e9404c39 upstream.
+
+If a SCSI command times out it is passed to the SCSI error
+handler. The SCSI error handler will try to abort the commands that
+timed out.  If aborting fails, a device reset will be attempted.  If
+the device reset also fails a host reset will be attempted.  If the
+host reset also fails the whole procedure will be repeated.
+
+srp_abort() and srp_reset_device() fail for a QP in the error state.
+srp_reset_host() fails after host removal has started.  Hence if the
+SCSI error handler gets invoked after host removal has started and
+with the QP in the error state an endless loop will be triggered.
+
+Modify the SCSI error handling functions in ib_srp as follows:
+- Abort SCSI commands properly even if the QP is in the error state.
+- Make srp_reset_host() reset SCSI requests even after host removal
+  has already started or if reconnecting fails.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: David Dillow <dave@thedillows.org>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |   29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -700,23 +700,24 @@ static int srp_reconnect_target(struct s
+       struct Scsi_Host *shost = target->scsi_host;
+       int i, ret;
+-      if (target->state != SRP_TARGET_LIVE)
+-              return -EAGAIN;
+-
+       scsi_target_block(&shost->shost_gendev);
+       srp_disconnect_target(target);
+       /*
+-       * Now get a new local CM ID so that we avoid confusing the
+-       * target in case things are really fouled up.
++       * Now get a new local CM ID so that we avoid confusing the target in
++       * case things are really fouled up. Doing so also ensures that all CM
++       * callbacks will have finished before a new QP is allocated.
+        */
+       ret = srp_new_cm_id(target);
+-      if (ret)
+-              goto unblock;
+-
+-      ret = srp_create_target_ib(target);
+-      if (ret)
+-              goto unblock;
++      /*
++       * Whether or not creating a new CM ID succeeded, create a new
++       * QP. This guarantees that all completion callback function
++       * invocations have finished before request resetting starts.
++       */
++      if (ret == 0)
++              ret = srp_create_target_ib(target);
++      else
++              srp_create_target_ib(target);
+       for (i = 0; i < SRP_CMD_SQ_SIZE; ++i) {
+               struct srp_request *req = &target->req_ring[i];
+@@ -728,9 +729,9 @@ static int srp_reconnect_target(struct s
+       for (i = 0; i < SRP_SQ_SIZE; ++i)
+               list_add(&target->tx_ring[i]->list, &target->free_tx);
+-      ret = srp_connect_target(target);
++      if (ret == 0)
++              ret = srp_connect_target(target);
+-unblock:
+       scsi_target_unblock(&shost->shost_gendev, ret == 0 ? SDEV_RUNNING :
+                           SDEV_TRANSPORT_OFFLINE);
+@@ -1739,7 +1740,7 @@ static int srp_abort(struct scsi_cmnd *s
+       shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
+-      if (!req || target->qp_in_error || !srp_claim_req(target, req, scmnd))
++      if (!req || !srp_claim_req(target, req, scmnd))
+               return FAILED;
+       srp_send_tsk_mgmt(target, req->index, scmnd->device->lun,
+                         SRP_TSK_ABORT_TASK);
diff --git a/queue-3.8/ib-srp-avoid-sending-a-task-management-function-needlessly.patch b/queue-3.8/ib-srp-avoid-sending-a-task-management-function-needlessly.patch
new file mode 100644 (file)
index 0000000..54f56ee
--- /dev/null
@@ -0,0 +1,43 @@
+From 3780d1f08856f692116bcf026e4acf1c521df1c7 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 21 Feb 2013 17:18:00 +0000
+Subject: IB/srp: Avoid sending a task management function needlessly
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 3780d1f08856f692116bcf026e4acf1c521df1c7 upstream.
+
+Do not send a task management function if sending will fail anyway
+because either there is no RDMA/RC connection or the QP is in the
+error state.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: David Dillow <dave@thedillows.org>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1695,6 +1695,9 @@ static int srp_send_tsk_mgmt(struct srp_
+       struct srp_iu *iu;
+       struct srp_tsk_mgmt *tsk_mgmt;
++      if (!target->connected || target->qp_in_error)
++              return -1;
++
+       init_completion(&target->tsk_mgmt_done);
+       spin_lock_irq(&target->lock);
+@@ -1754,8 +1757,6 @@ static int srp_reset_device(struct scsi_
+       shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
+-      if (target->qp_in_error)
+-              return FAILED;
+       if (srp_send_tsk_mgmt(target, SRP_TAG_NO_REQ, scmnd->device->lun,
+                             SRP_TSK_LUN_RESET))
+               return FAILED;
diff --git a/queue-3.8/ib-srp-fail-i-o-requests-if-the-transport-is-offline.patch b/queue-3.8/ib-srp-fail-i-o-requests-if-the-transport-is-offline.patch
new file mode 100644 (file)
index 0000000..456fe34
--- /dev/null
@@ -0,0 +1,71 @@
+From 2ce19e72f4d570c87e025ee6fca4eae699a8b712 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 21 Feb 2013 17:20:00 +0000
+Subject: IB/srp: Fail I/O requests if the transport is offline
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 2ce19e72f4d570c87e025ee6fca4eae699a8b712 upstream.
+
+If an SRP target is no longer reachable and srp_reset_host() fails to
+reconnect then ib_srp will invoke scsi_remove_host().  That function
+will invoke __scsi_remove_device() for each LUN.  And that last
+function will change the device state from SDEV_TRANSPORT_OFFLINE into
+SDEV_CANCEL.  Certain user space software, e.g. older versions of
+multipathd, continue queueing I/O to SCSI devices that are in the
+SDEV_CANCEL state.
+
+If these I/O requests are submitted as SG_IO that means that the
+REQ_PREEMPT flag will be set and hence that these requests will be
+passed to srp_queuecommand().  These requests will time out.  If new
+requests are queued fast enough from user space these active requests
+will prevent __scsi_remove_device() to finish.
+
+Avoid this by failing I/O requests in the SDEV_CANCEL state if the
+transport is offline.  Introduce a new variable to keep track of the
+transport state instead of failing requests if (!target->connected ||
+target->qp_in_error), so that the SCSI error handler has a chance to
+retry commands after a transport layer failure occurred.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |    7 +++++++
+ drivers/infiniband/ulp/srp/ib_srp.h |    1 +
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -734,6 +734,7 @@ static int srp_reconnect_target(struct s
+       scsi_target_unblock(&shost->shost_gendev, ret == 0 ? SDEV_RUNNING :
+                           SDEV_TRANSPORT_OFFLINE);
++      target->transport_offline = !!ret;
+       if (ret)
+               goto err;
+@@ -1353,6 +1354,12 @@ static int srp_queuecommand(struct Scsi_
+       unsigned long flags;
+       int len;
++      if (unlikely(target->transport_offline)) {
++              scmnd->result = DID_NO_CONNECT << 16;
++              scmnd->scsi_done(scmnd);
++              return 0;
++      }
++
+       spin_lock_irqsave(&target->lock, flags);
+       iu = __srp_get_tx_iu(target, SRP_IU_CMD);
+       if (!iu)
+--- a/drivers/infiniband/ulp/srp/ib_srp.h
++++ b/drivers/infiniband/ulp/srp/ib_srp.h
+@@ -140,6 +140,7 @@ struct srp_target_port {
+       unsigned int            cmd_sg_cnt;
+       unsigned int            indirect_size;
+       bool                    allow_ext_sg;
++      bool                    transport_offline;
+       /* Everything above this point is used in the hot path of
+        * command processing. Try to keep them packed into cachelines.
diff --git a/queue-3.8/ib-srp-track-connection-state-properly.patch b/queue-3.8/ib-srp-track-connection-state-properly.patch
new file mode 100644 (file)
index 0000000..2b44faa
--- /dev/null
@@ -0,0 +1,31 @@
+From e1b2f13aba9ff714d23ecd4a950e744ee7ad72e1 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 21 Feb 2013 17:16:54 +0000
+Subject: IB/srp: Track connection state properly
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit e1b2f13aba9ff714d23ecd4a950e744ee7ad72e1 upstream.
+
+Remove an assignment that incorrectly overwrites the connection state
+update by srp_connect_target().
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: David Dillow <dave@thedillows.org>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1972,7 +1972,6 @@ static int srp_add_target(struct srp_hos
+       spin_unlock(&host->target_lock);
+       target->state = SRP_TARGET_LIVE;
+-      target->connected = false;
+       scsi_scan_target(&target->scsi_host->shost_gendev,
+                        0, target->scsi_id, SCAN_WILD_CARD, 0);
diff --git a/queue-3.8/mm-do-not-grow-the-stack-vma-just-because-of-an-overrun-on-preceding-vma.patch b/queue-3.8/mm-do-not-grow-the-stack-vma-just-because-of-an-overrun-on-preceding-vma.patch
new file mode 100644 (file)
index 0000000..0b6553d
--- /dev/null
@@ -0,0 +1,78 @@
+From 09884964335e85e897876d17783c2ad33cf8a2e0 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 27 Feb 2013 08:36:04 -0800
+Subject: mm: do not grow the stack vma just because of an overrun on preceding vma
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 09884964335e85e897876d17783c2ad33cf8a2e0 upstream.
+
+The stack vma is designed to grow automatically (marked with VM_GROWSUP
+or VM_GROWSDOWN depending on architecture) when an access is made beyond
+the existing boundary.  However, particularly if you have not limited
+your stack at all ("ulimit -s unlimited"), this can cause the stack to
+grow even if the access was really just one past *another* segment.
+
+And that's wrong, especially since we first grow the segment, but then
+immediately later enforce the stack guard page on the last page of the
+segment.  So _despite_ first growing the stack segment as a result of
+the access, the kernel will then make the access cause a SIGSEGV anyway!
+
+So do the same logic as the guard page check does, and consider an
+access to within one page of the next segment to be a bad access, rather
+than growing the stack to abut the next segment.
+
+Reported-and-tested-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/mmap.c |   27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2169,9 +2169,28 @@ int expand_downwards(struct vm_area_stru
+       return error;
+ }
++/*
++ * Note how expand_stack() refuses to expand the stack all the way to
++ * abut the next virtual mapping, *unless* that mapping itself is also
++ * a stack mapping. We want to leave room for a guard page, after all
++ * (the guard page itself is not added here, that is done by the
++ * actual page faulting logic)
++ *
++ * This matches the behavior of the guard page logic (see mm/memory.c:
++ * check_stack_guard_page()), which only allows the guard page to be
++ * removed under these circumstances.
++ */
+ #ifdef CONFIG_STACK_GROWSUP
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++      struct vm_area_struct *next;
++
++      address &= PAGE_MASK;
++      next = vma->vm_next;
++      if (next && next->vm_start == address + PAGE_SIZE) {
++              if (!(next->vm_flags & VM_GROWSUP))
++                      return -ENOMEM;
++      }
+       return expand_upwards(vma, address);
+ }
+@@ -2194,6 +2213,14 @@ find_extend_vma(struct mm_struct *mm, un
+ #else
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++      struct vm_area_struct *prev;
++
++      address &= PAGE_MASK;
++      prev = vma->vm_prev;
++      if (prev && prev->vm_end == address) {
++              if (!(prev->vm_flags & VM_GROWSDOWN))
++                      return -ENOMEM;
++      }
+       return expand_downwards(vma, address);
+ }
diff --git a/queue-3.8/quota-autoload-the-quota_v2-module-for-qfmt_vfs_v1-quota-format.patch b/queue-3.8/quota-autoload-the-quota_v2-module-for-qfmt_vfs_v1-quota-format.patch
new file mode 100644 (file)
index 0000000..4e98040
--- /dev/null
@@ -0,0 +1,32 @@
+From c3ad83d9efdfe6a86efd44945a781f00c879b7b4 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Thu, 24 Jan 2013 23:24:56 -0500
+Subject: quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit c3ad83d9efdfe6a86efd44945a781f00c879b7b4 upstream.
+
+Otherwise, ext4 file systems with the quota featured enable will get a
+very confusing "No such process" error message if the quota code is
+built as a module and the quota_v2 module has not been loaded.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
+Acked-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/quota.h |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/quota.h
++++ b/include/linux/quota.h
+@@ -405,6 +405,7 @@ struct quota_module_name {
+ #define INIT_QUOTA_MODULE_NAMES {\
+       {QFMT_VFS_OLD, "quota_v1"},\
+       {QFMT_VFS_V0, "quota_v2"},\
++      {QFMT_VFS_V1, "quota_v2"},\
+       {0, NULL}}
+ #endif /* _QUOTA_ */
diff --git a/queue-3.8/series b/queue-3.8/series
new file mode 100644 (file)
index 0000000..b790f17
--- /dev/null
@@ -0,0 +1,10 @@
+mm-do-not-grow-the-stack-vma-just-because-of-an-overrun-on-preceding-vma.patch
+alsa-bt87x-make-load_all-parameter-working-again.patch
+alsa-hda-hdmi-make-jacks-phantom-if-they-re-not-detectable.patch
+alsa-emu10k1-fix-regression-in-emu1010-firmware-loading.patch
+alsa-emu10k1-load-firmware-when-it-was-already-cached.patch
+ib-srp-track-connection-state-properly.patch
+ib-srp-avoid-sending-a-task-management-function-needlessly.patch
+ib-srp-avoid-endless-scsi-error-handling-loop.patch
+ib-srp-fail-i-o-requests-if-the-transport-is-offline.patch
+quota-autoload-the-quota_v2-module-for-qfmt_vfs_v1-quota-format.patch