--- /dev/null
+From 3f8a6411fbada1fa482276591e037f3b1adcf55b Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 21 Apr 2013 22:56:32 -0400
+Subject: ext4: add check for inodes_count overflow in new resize ioctl
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 3f8a6411fbada1fa482276591e037f3b1adcf55b upstream.
+
+Addresses-Red-Hat-Bugzilla: #913245
+
+Reported-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
+Signed-off-by: Lingzhu Xiang <lxiang@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/resize.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1882,6 +1882,10 @@ retry:
+ return 0;
+
+ ext4_get_group_no_and_offset(sb, n_blocks_count - 1, &n_group, &offset);
++ if (n_group > (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) {
++ ext4_warning(sb, "resize would cause inodes_count overflow");
++ return -EINVAL;
++ }
+ ext4_get_group_no_and_offset(sb, o_blocks_count - 1, &o_group, &offset);
+
+ n_desc_blocks = num_desc_blocks(sb, n_group + 1);
--- /dev/null
+From 197887f03daecdb3ae21bafeb4155412abad3497 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joro@8bytes.org>
+Date: Tue, 9 Apr 2013 21:14:08 +0200
+Subject: iommu/amd: Properly initialize irq-table lock
+
+From: Joerg Roedel <joro@8bytes.org>
+
+commit 197887f03daecdb3ae21bafeb4155412abad3497 upstream.
+
+Fixes a lockdep warning.
+
+Reviewed-by: Shuah Khan <shuahkhan@gmail.com>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3947,6 +3947,9 @@ static struct irq_remap_table *get_irq_t
+ if (!table)
+ goto out;
+
++ /* Initialize table spin-lock */
++ spin_lock_init(&table->lock);
++
+ if (ioapic)
+ /* Keep the first 32 indexes free for IOAPIC interrupts */
+ table->min_index = 32;
--- /dev/null
+From f7a1dd6e3ad59f0cfd51da29dfdbfd54122c5916 Mon Sep 17 00:00:00 2001
+From: Hans Schillstrom <hans@schillstrom.com>
+Date: Sat, 27 Apr 2013 20:06:14 +0200
+Subject: ipvs: ip_vs_sip_fill_param() BUG: bad check of return value
+
+From: Hans Schillstrom <hans@schillstrom.com>
+
+commit f7a1dd6e3ad59f0cfd51da29dfdbfd54122c5916 upstream.
+
+The reason for this patch is crash in kmemdup
+caused by returning from get_callid with uniialized
+matchoff and matchlen.
+
+Removing Zero check of matchlen since it's done by ct_sip_get_header()
+
+BUG: unable to handle kernel paging request at ffff880457b5763f
+IP: [<ffffffff810df7fc>] kmemdup+0x2e/0x35
+PGD 27f6067 PUD 0
+Oops: 0000 [#1] PREEMPT SMP
+Modules linked in: xt_state xt_helper nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle xt_connmark xt_conntrack ip6_tables nf_conntrack_ftp ip_vs_ftp nf_nat xt_tcpudp iptable_mangle xt_mark ip_tables x_tables ip_vs_rr ip_vs_lblcr ip_vs_pe_sip ip_vs nf_conntrack_sip nf_conntrack bonding igb i2c_algo_bit i2c_core
+CPU 5
+Pid: 0, comm: swapper/5 Not tainted 3.9.0-rc5+ #5 /S1200KP
+RIP: 0010:[<ffffffff810df7fc>] [<ffffffff810df7fc>] kmemdup+0x2e/0x35
+RSP: 0018:ffff8803fea03648 EFLAGS: 00010282
+RAX: ffff8803d61063e0 RBX: 0000000000000003 RCX: 0000000000000003
+RDX: 0000000000000003 RSI: ffff880457b5763f RDI: ffff8803d61063e0
+RBP: ffff8803fea03658 R08: 0000000000000008 R09: 0000000000000011
+R10: 0000000000000011 R11: 00ffffffff81a8a3 R12: ffff880457b5763f
+R13: ffff8803d67f786a R14: ffff8803fea03730 R15: ffffffffa0098e90
+FS: 0000000000000000(0000) GS:ffff8803fea00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffff880457b5763f CR3: 0000000001a0c000 CR4: 00000000001407e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process swapper/5 (pid: 0, threadinfo ffff8803ee18c000, task ffff8803ee18a480)
+Stack:
+ ffff8803d822a080 000000000000001c ffff8803fea036c8 ffffffffa000937a
+ ffffffff81f0d8a0 000000038135fdd5 ffff880300000014 ffff880300110000
+ ffffffff150118ac ffff8803d7e8a000 ffff88031e0118ac 0000000000000000
+Call Trace:
+ <IRQ>
+
+ [<ffffffffa000937a>] ip_vs_sip_fill_param+0x13a/0x187 [ip_vs_pe_sip]
+ [<ffffffffa007b209>] ip_vs_sched_persist+0x2c6/0x9c3 [ip_vs]
+ [<ffffffff8107dc53>] ? __lock_acquire+0x677/0x1697
+ [<ffffffff8100972e>] ? native_sched_clock+0x3c/0x7d
+ [<ffffffff8100972e>] ? native_sched_clock+0x3c/0x7d
+ [<ffffffff810649bc>] ? sched_clock_cpu+0x43/0xcf
+ [<ffffffffa007bb1e>] ip_vs_schedule+0x181/0x4ba [ip_vs]
+...
+
+Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/ipvs/ip_vs_pe_sip.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_pe_sip.c
++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
+@@ -37,14 +37,10 @@ static int get_callid(const char *dptr,
+ if (ret > 0)
+ break;
+ if (!ret)
+- return 0;
++ return -EINVAL;
+ dataoff += *matchoff;
+ }
+
+- /* Empty callid is useless */
+- if (!*matchlen)
+- return -EINVAL;
+-
+ /* Too large is useless */
+ if (*matchlen > IP_VS_PEDATA_MAXLEN)
+ return -EINVAL;
--- /dev/null
+From edb749f4390b3c1604233dc7c4fb0361f472e712 Mon Sep 17 00:00:00 2001
+From: Benjamin Poirier <bpoirier@suse.de>
+Date: Mon, 15 Apr 2013 10:13:50 -0400
+Subject: menuconfig: Fix memory leak introduced by jump keys feature
+
+From: Benjamin Poirier <bpoirier@suse.de>
+
+commit edb749f4390b3c1604233dc7c4fb0361f472e712 upstream.
+
+Fixes the memory leak of struct jump_key allocated in get_prompt_str()
+
+Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
+Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/kconfig/list.h | 13 +++++++++++++
+ scripts/kconfig/mconf.c | 3 +++
+ 2 files changed, 16 insertions(+)
+
+--- a/scripts/kconfig/list.h
++++ b/scripts/kconfig/list.h
+@@ -51,6 +51,19 @@ struct list_head {
+ pos = list_entry(pos->member.next, typeof(*pos), member))
+
+ /**
++ * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry
++ * @pos: the type * to use as a loop cursor.
++ * @n: another type * to use as temporary storage
++ * @head: the head for your list.
++ * @member: the name of the list_struct within the struct.
++ */
++#define list_for_each_entry_safe(pos, n, head, member) \
++ for (pos = list_entry((head)->next, typeof(*pos), member), \
++ n = list_entry(pos->member.next, typeof(*pos), member); \
++ &pos->member != (head); \
++ pos = n, n = list_entry(n->member.next, typeof(*n), member))
++
++/**
+ * list_empty - tests whether a list is empty
+ * @head: the list to test.
+ */
+--- a/scripts/kconfig/mconf.c
++++ b/scripts/kconfig/mconf.c
+@@ -389,6 +389,7 @@ again:
+ .targets = targets,
+ .keys = keys,
+ };
++ struct jump_key *pos, *tmp;
+
+ res = get_relations_str(sym_arr, &head);
+ dres = show_textbox_ext(_("Search Results"), (char *)
+@@ -402,6 +403,8 @@ again:
+ again = true;
+ }
+ str_free(&res);
++ list_for_each_entry_safe(pos, tmp, &head, entries)
++ free(pos);
+ } while (again);
+ free(sym_arr);
+ str_free(&title);
--- /dev/null
+From 07c449bbc6aa514098c4f12c7b04180cec2417c6 Mon Sep 17 00:00:00 2001
+From: David Cohen <david.a.cohen@intel.com>
+Date: Thu, 11 Apr 2013 13:22:14 +0930
+Subject: MODSIGN: do not send garbage to stderr when enabling modules signature
+
+From: David Cohen <david.a.cohen@intel.com>
+
+commit 07c449bbc6aa514098c4f12c7b04180cec2417c6 upstream.
+
+When compiling kernel with -jN (N > 1), all warning/error messages
+printed while openssl is generating key pair may get mixed dots and
+other symbols openssl sends to stderr. This patch makes sure openssl
+logs go to default stdout.
+
+Example of the garbage on stderr:
+
+crypto/anubis.c:581: warning: ‘inter’ is used uninitialized in this function
+Generating a 4096 bit RSA private key
+.........
+drivers/gpu/drm/i915/i915_gem_gtt.c: In function ‘gen6_ggtt_insert_entries’:
+drivers/gpu/drm/i915/i915_gem_gtt.c:440: warning: ‘addr’ may be used uninitialized in this function
+.net/mac80211/tx.c: In function ‘ieee80211_subif_start_xmit’:
+net/mac80211/tx.c:1780: warning: ‘chanctx_conf’ may be used uninitialized in this function
+..drivers/isdn/hardware/mISDN/hfcpci.c: In function ‘hfcpci_softirq’:
+.....drivers/isdn/hardware/mISDN/hfcpci.c:2298: warning: ignoring return value of ‘driver_for_each_device’, declared with attribute warn_unused_result
+
+Signed-off-by: David Cohen <david.a.cohen@intel.com>
+Reviewed-by: mark gross <mark.gross@intel.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -175,7 +175,7 @@ signing_key.priv signing_key.x509: x509.
+ openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
+ -batch -x509 -config x509.genkey \
+ -outform DER -out signing_key.x509 \
+- -keyout signing_key.priv
++ -keyout signing_key.priv 2>&1
+ @echo "###"
+ @echo "### Key pair generated."
+ @echo "###"
--- /dev/null
+From 13f85203e1060da83d9ec1c1c5a63343eaab8de4 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 3 May 2013 17:19:01 +0000
+Subject: net/eth/ibmveth: Fixup retrieval of MAC address
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 13f85203e1060da83d9ec1c1c5a63343eaab8de4 upstream.
+
+Some ancient pHyp versions used to create a 8 bytes local-mac-address
+property in the device-tree instead of a 6 bytes one for veth.
+
+The Linux driver code to deal with that is an insane hack which also
+happens to break with some choices of MAC addresses in qemu by testing
+for a bit in the address rather than just looking at the size of the
+property.
+
+Sanitize this by doing the latter instead.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ibm/ibmveth.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1324,7 +1324,7 @@ static const struct net_device_ops ibmve
+
+ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ {
+- int rc, i;
++ int rc, i, mac_len;
+ struct net_device *netdev;
+ struct ibmveth_adapter *adapter;
+ unsigned char *mac_addr_p;
+@@ -1334,11 +1334,19 @@ static int ibmveth_probe(struct vio_dev
+ dev->unit_address);
+
+ mac_addr_p = (unsigned char *)vio_get_attribute(dev, VETH_MAC_ADDR,
+- NULL);
++ &mac_len);
+ if (!mac_addr_p) {
+ dev_err(&dev->dev, "Can't find VETH_MAC_ADDR attribute\n");
+ return -EINVAL;
+ }
++ /* Workaround for old/broken pHyp */
++ if (mac_len == 8)
++ mac_addr_p += 2;
++ else if (mac_len != 6) {
++ dev_err(&dev->dev, "VETH_MAC_ADDR attribute wrong len %d\n",
++ mac_len);
++ return -EINVAL;
++ }
+
+ mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev,
+ VETH_MCAST_FILTER_SIZE, NULL);
+@@ -1363,17 +1371,6 @@ static int ibmveth_probe(struct vio_dev
+
+ netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
+
+- /*
+- * Some older boxes running PHYP non-natively have an OF that returns
+- * a 8-byte local-mac-address field (and the first 2 bytes have to be
+- * ignored) while newer boxes' OF return a 6-byte field. Note that
+- * IEEE 1275 specifies that local-mac-address must be a 6-byte field.
+- * The RPA doc specifies that the first byte must be 10b, so we'll
+- * just look for it to solve this 8 vs. 6 byte field issue
+- */
+- if ((*mac_addr_p & 0x3) != 0x02)
+- mac_addr_p += 2;
+-
+ adapter->mac_addr = 0;
+ memcpy(&adapter->mac_addr, mac_addr_p, 6);
+
--- /dev/null
+From 741a698f420c34c458294a6accecfbad702a7c52 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Fri, 3 May 2013 14:11:23 +0200
+Subject: perf/x86: Blacklist all MEM_*_RETIRED events for Ivy Bridge
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 741a698f420c34c458294a6accecfbad702a7c52 upstream.
+
+Errata BV98 states that all MEM_*_RETIRED events corrupt the
+counter value of the SMT sibling's counters. Blacklist these
+events
+
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: eranian@google.com
+Link: http://lkml.kernel.org/r/20130503121256.083340271@chello.nl
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: http://lkml.kernel.org/n/tip-jwra43mujrv1oq9xk6mfe57v@git.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -125,10 +125,15 @@ static struct event_constraint intel_ivb
+ INTEL_UEVENT_CONSTRAINT(0x08a3, 0x4), /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
+ INTEL_UEVENT_CONSTRAINT(0x0ca3, 0x4), /* CYCLE_ACTIVITY.STALLS_L1D_PENDING */
+ INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
+- INTEL_EVENT_CONSTRAINT(0xd0, 0xf), /* MEM_UOPS_RETIRED.* */
+- INTEL_EVENT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
+- INTEL_EVENT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
+- INTEL_EVENT_CONSTRAINT(0xd3, 0xf), /* MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
++ /*
++ * Errata BV98 -- MEM_*_RETIRED events can leak between counters of SMT
++ * siblings; disable these events because they can corrupt unrelated
++ * counters.
++ */
++ INTEL_EVENT_CONSTRAINT(0xd0, 0x0), /* MEM_UOPS_RETIRED.* */
++ INTEL_EVENT_CONSTRAINT(0xd1, 0x0), /* MEM_LOAD_UOPS_RETIRED.* */
++ INTEL_EVENT_CONSTRAINT(0xd2, 0x0), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
++ INTEL_EVENT_CONSTRAINT(0xd3, 0x0), /* MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
+ EVENT_CONSTRAINT_END
+ };
+
--- /dev/null
+From 9a6bc14350b130427725f33e371e86212fa56c85 Mon Sep 17 00:00:00 2001
+From: Vince Weaver <vincent.weaver@maine.edu>
+Date: Mon, 29 Apr 2013 15:52:27 -0400
+Subject: perf/x86/intel: Add support for IvyBridge model 58 Uncore
+
+From: Vince Weaver <vincent.weaver@maine.edu>
+
+commit 9a6bc14350b130427725f33e371e86212fa56c85 upstream.
+
+According to Intel Vol3b 18.9, the IvyBridge model 58 uncore is
+the same as that of SandyBridge.
+
+I've done some simple tests and with this patch things seem to
+work on my mac-mini.
+
+Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
+Cc: Stephane Eranian <eranian@gmail.com>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1304291549320.15827@vincent-weaver-1.um.maine.edu
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_uncore.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+@@ -2853,6 +2853,7 @@ static int __init uncore_cpu_init(void)
+ msr_uncores = nhm_msr_uncores;
+ break;
+ case 42: /* Sandy Bridge */
++ case 58: /* Ivy Bridge */
+ if (snb_uncore_cbox.num_boxes > max_cores)
+ snb_uncore_cbox.num_boxes = max_cores;
+ msr_uncores = snb_msr_uncores;
--- /dev/null
+From 1b0dac2ac6debdbf1541e15f2cede03613cf4465 Mon Sep 17 00:00:00 2001
+From: Jan-Simon Möller <dl9pf@gmx.de>
+Date: Tue, 30 Apr 2013 12:02:33 +0200
+Subject: perf/x86/intel: Fix unintended variable name reuse
+
+From: Jan-Simon Möller <dl9pf@gmx.de>
+
+commit 1b0dac2ac6debdbf1541e15f2cede03613cf4465 upstream.
+
+The variable name events_group is already in used and led to a
+compilation error when using clang to build the Linux Kernel .
+The fix is just to rename the var. No functional change. Please
+apply.
+
+Fix suggested in discussion by PaX Team <pageexec@freemail.hu>
+
+Signed-off-by: Jan-Simon Möller <dl9pf@gmx.de>
+Cc: rostedt@goodmis.org
+Cc: a.p.zijlstra@chello.nl
+Cc: paulus@samba.org
+Cc: acme@ghostprotocols.net
+Link: http://lkml.kernel.org/r/1367316153-14808-1-git-send-email-dl9pf@gmx.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_uncore.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+@@ -2428,7 +2428,7 @@ static void __init uncore_types_exit(str
+ static int __init uncore_type_init(struct intel_uncore_type *type)
+ {
+ struct intel_uncore_pmu *pmus;
+- struct attribute_group *events_group;
++ struct attribute_group *attr_group;
+ struct attribute **attrs;
+ int i, j;
+
+@@ -2455,19 +2455,19 @@ static int __init uncore_type_init(struc
+ while (type->event_descs[i].attr.attr.name)
+ i++;
+
+- events_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
+- sizeof(*events_group), GFP_KERNEL);
+- if (!events_group)
++ attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
++ sizeof(*attr_group), GFP_KERNEL);
++ if (!attr_group)
+ goto fail;
+
+- attrs = (struct attribute **)(events_group + 1);
+- events_group->name = "events";
+- events_group->attrs = attrs;
++ attrs = (struct attribute **)(attr_group + 1);
++ attr_group->name = "events";
++ attr_group->attrs = attrs;
+
+ for (j = 0; j < i; j++)
+ attrs[j] = &type->event_descs[j].attr.attr;
+
+- type->events_group = events_group;
++ type->events_group = attr_group;
+ }
+
+ type->pmu_group = &uncore_pmu_attr_group;
--- /dev/null
+From 7cc23cd6c0c7d7f4bee057607e7ce01568925717 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Fri, 3 May 2013 14:11:25 +0200
+Subject: perf/x86/intel/lbr: Demand proper privileges for PERF_SAMPLE_BRANCH_KERNEL
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 7cc23cd6c0c7d7f4bee057607e7ce01568925717 upstream.
+
+We should always have proper privileges when requesting kernel
+data.
+
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: eranian@google.com
+Link: http://lkml.kernel.org/r/20130503121256.230745028@chello.nl
+[ Fix build error reported by fengguang.wu@intel.com, propagate error code back. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: http://lkml.kernel.org/n/tip-v0x9ky3ahzr6nm3c6ilwrili@git.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_lbr.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+@@ -310,7 +310,7 @@ void intel_pmu_lbr_read(void)
+ * - in case there is no HW filter
+ * - in case the HW filter has errata or limitations
+ */
+-static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
++static int intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
+ {
+ u64 br_type = event->attr.branch_sample_type;
+ int mask = 0;
+@@ -318,8 +318,11 @@ static void intel_pmu_setup_sw_lbr_filte
+ if (br_type & PERF_SAMPLE_BRANCH_USER)
+ mask |= X86_BR_USER;
+
+- if (br_type & PERF_SAMPLE_BRANCH_KERNEL)
++ if (br_type & PERF_SAMPLE_BRANCH_KERNEL) {
++ if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
++ return -EACCES;
+ mask |= X86_BR_KERNEL;
++ }
+
+ /* we ignore BRANCH_HV here */
+
+@@ -339,6 +342,8 @@ static void intel_pmu_setup_sw_lbr_filte
+ * be used by fixup code for some CPU
+ */
+ event->hw.branch_reg.reg = mask;
++
++ return 0;
+ }
+
+ /*
+@@ -386,7 +391,9 @@ int intel_pmu_setup_lbr_filter(struct pe
+ /*
+ * setup SW LBR filter
+ */
+- intel_pmu_setup_sw_lbr_filter(event);
++ ret = intel_pmu_setup_sw_lbr_filter(event);
++ if (ret)
++ return ret;
+
+ /*
+ * setup HW LBR filter, if any
--- /dev/null
+From 6e15eb3ba6c0249c9e8c783517d131b47db995ca Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Fri, 3 May 2013 14:11:24 +0200
+Subject: perf/x86/intel/lbr: Fix LBR filter
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 6e15eb3ba6c0249c9e8c783517d131b47db995ca upstream.
+
+The LBR 'from' adddress is under full userspace control; ensure
+we validate it before reading from it.
+
+Note: is_module_text_address() can potentially be quite
+expensive; for those running into that with high overhead
+in modules optimize it using an RCU backed rb-tree.
+
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: eranian@google.com
+Link: http://lkml.kernel.org/r/20130503121256.158211806@chello.nl
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: http://lkml.kernel.org/n/tip-mk8i82ffzax01cnqo829iy1q@git.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_lbr.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+@@ -442,8 +442,18 @@ static int branch_type(unsigned long fro
+ return X86_BR_NONE;
+
+ addr = buf;
+- } else
+- addr = (void *)from;
++ } else {
++ /*
++ * The LBR logs any address in the IP, even if the IP just
++ * faulted. This means userspace can control the from address.
++ * Ensure we don't blindy read any address by validating it is
++ * a known text address.
++ */
++ if (kernel_text_address(from))
++ addr = (void *)from;
++ else
++ return X86_BR_NONE;
++ }
+
+ /*
+ * decoder needs to know the ABI especially
--- /dev/null
+From e5195c1f31f399289347e043d6abf3ffa80f0005 Mon Sep 17 00:00:00 2001
+From: Stefan Bader <stefan.bader@canonical.com>
+Date: Fri, 26 Apr 2013 13:49:32 +0000
+Subject: r8169: fix 8168evl frame padding.
+
+From: Stefan Bader <stefan.bader@canonical.com>
+
+commit e5195c1f31f399289347e043d6abf3ffa80f0005 upstream.
+
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+Cc: hayeswang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/realtek/r8169.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -5787,6 +5787,14 @@ static netdev_tx_t rtl8169_start_xmit(st
+ goto err_stop_0;
+ }
+
++ /* 8168evl does not automatically pad to minimum length. */
++ if (unlikely(tp->mac_version == RTL_GIGA_MAC_VER_34 &&
++ skb->len < ETH_ZLEN)) {
++ if (skb_padto(skb, ETH_ZLEN))
++ goto err_update_stats;
++ skb_put(skb, ETH_ZLEN - skb->len);
++ }
++
+ if (unlikely(le32_to_cpu(txd->opts1) & DescOwn))
+ goto err_stop_0;
+
+@@ -5858,6 +5866,7 @@ err_dma_1:
+ rtl8169_unmap_tx_skb(d, tp->tx_skb + entry, txd);
+ err_dma_0:
+ dev_kfree_skb(skb);
++err_update_stats:
+ dev->stats.tx_dropped++;
+ return NETDEV_TX_OK;
+
rpmsg-fix-kconfig-dependencies-for-virtio.patch
remoteproc-fix-kconfig-dependencies-for-virtio.patch
hugetlbfs-fix-mmap-failure-in-unaligned-size-request.patch
+iommu-amd-properly-initialize-irq-table-lock.patch
+menuconfig-fix-memory-leak-introduced-by-jump-keys-feature.patch
+net-eth-ibmveth-fixup-retrieval-of-mac-address.patch
+perf-x86-intel-add-support-for-ivybridge-model-58-uncore.patch
+perf-x86-intel-fix-unintended-variable-name-reuse.patch
+perf-x86-blacklist-all-mem_-_retired-events-for-ivy-bridge.patch
+perf-x86-intel-lbr-fix-lbr-filter.patch
+perf-x86-intel-lbr-demand-proper-privileges-for-perf_sample_branch_kernel.patch
+ipvs-ip_vs_sip_fill_param-bug-bad-check-of-return-value.patch
+ext4-add-check-for-inodes_count-overflow-in-new-resize-ioctl.patch
+modsign-do-not-send-garbage-to-stderr-when-enabling-modules-signature.patch
+r8169-fix-8168evl-frame-padding.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
