3.4-stable patches

added patches:
	arm-cns3xxx-fix-mapping-of-private-memory-region.patch
	nfsd4-reject-negative-acl-lengths.patch

diff --git a/queue-3.4/arm-cns3xxx-fix-mapping-of-private-memory-region.patch b/queue-3.4/arm-cns3xxx-fix-mapping-of-private-memory-region.patch
new file mode 100644 (file)
index 0000000..c2599cd
--- /dev/null
+++ b/queue-3.4/arm-cns3xxx-fix-mapping-of-private-memory-region.patch
@@ -0,0 +1,105 @@
+From a3d9052c6296ad3398d3ad649c3c682c3e7ecfa6 Mon Sep 17 00:00:00 2001
+From: Mac Lin <mkl0301@gmail.com>
+Date: Mon, 25 Mar 2013 17:23:33 +0800
+Subject: ARM: cns3xxx: fix mapping of private memory region
+
+From: Mac Lin <mkl0301@gmail.com>
+
+commit a3d9052c6296ad3398d3ad649c3c682c3e7ecfa6 upstream.
+
+Since commit 0536bdf33faf (ARM: move iotable mappings within the vmalloc
+region), the Cavium CNS3xxx cannot boot anymore.
+
+This is caused by the pre-defined iotable mappings is not in the vmalloc
+region. This patch move the iotable mappings into the vmalloc region, and
+merge the MPCore private memory region (containing the SCU, the GIC and
+the TWD) as a single region.
+
+Signed-off-by: Mac Lin <mkl0301@gmail.com>
+Signed-off-by: Anton Vorontsov <anton@enomsg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-cns3xxx/core.c                 |   16 +++-------------
+ arch/arm/mach-cns3xxx/include/mach/cns3xxx.h |   16 ++++++++--------
+ 2 files changed, 11 insertions(+), 21 deletions(-)
+
+--- a/arch/arm/mach-cns3xxx/core.c
++++ b/arch/arm/mach-cns3xxx/core.c
+@@ -22,19 +22,9 @@
+ 
+ static struct map_desc cns3xxx_io_desc[] __initdata = {
+       {
+-              .virtual        = CNS3XXX_TC11MP_TWD_BASE_VIRT,
+-              .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_TWD_BASE),
+-              .length         = SZ_4K,
+-              .type           = MT_DEVICE,
+-      }, {
+-              .virtual        = CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT,
+-              .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_GIC_CPU_BASE),
+-              .length         = SZ_4K,
+-              .type           = MT_DEVICE,
+-      }, {
+-              .virtual        = CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT,
+-              .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_GIC_DIST_BASE),
+-              .length         = SZ_4K,
++              .virtual        = CNS3XXX_TC11MP_SCU_BASE_VIRT,
++              .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_SCU_BASE),
++              .length         = SZ_8K,
+               .type           = MT_DEVICE,
+       }, {
+               .virtual        = CNS3XXX_TIMER1_2_3_BASE_VIRT,
+--- a/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
++++ b/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
+@@ -94,10 +94,10 @@
+ #define RTC_INTR_STS_OFFSET                   0x34
+ 
+ #define CNS3XXX_MISC_BASE                     0x76000000      /* Misc Control */
+-#define CNS3XXX_MISC_BASE_VIRT                        0xFFF07000      /* Misc Control */
++#define CNS3XXX_MISC_BASE_VIRT                        0xFB000000      /* Misc Control */
+ 
+ #define CNS3XXX_PM_BASE                               0x77000000      /* Power Management Control */
+-#define CNS3XXX_PM_BASE_VIRT                  0xFFF08000
++#define CNS3XXX_PM_BASE_VIRT                  0xFB001000
+ 
+ #define PM_CLK_GATE_OFFSET                    0x00
+ #define PM_SOFT_RST_OFFSET                    0x04
+@@ -109,7 +109,7 @@
+ #define PM_PLL_HM_PD_OFFSET                   0x1C
+ 
+ #define CNS3XXX_UART0_BASE                    0x78000000      /* UART 0 */
+-#define CNS3XXX_UART0_BASE_VIRT                       0xFFF09000
++#define CNS3XXX_UART0_BASE_VIRT                       0xFB002000
+ 
+ #define CNS3XXX_UART1_BASE                    0x78400000      /* UART 1 */
+ #define CNS3XXX_UART1_BASE_VIRT                       0xFFF0A000
+@@ -130,7 +130,7 @@
+ #define CNS3XXX_I2S_BASE_VIRT                 0xFFF10000
+ 
+ #define CNS3XXX_TIMER1_2_3_BASE                       0x7C800000      /* Timer */
+-#define CNS3XXX_TIMER1_2_3_BASE_VIRT          0xFFF10800
++#define CNS3XXX_TIMER1_2_3_BASE_VIRT          0xFB003000
+ 
+ #define TIMER1_COUNTER_OFFSET                 0x00
+ #define TIMER1_AUTO_RELOAD_OFFSET             0x04
+@@ -227,16 +227,16 @@
+  * Testchip peripheral and fpga gic regions
+  */
+ #define CNS3XXX_TC11MP_SCU_BASE                       0x90000000      /* IRQ, Test chip */
+-#define CNS3XXX_TC11MP_SCU_BASE_VIRT          0xFF000000
++#define CNS3XXX_TC11MP_SCU_BASE_VIRT          0xFB004000
+ 
+ #define CNS3XXX_TC11MP_GIC_CPU_BASE           0x90000100      /* Test chip interrupt controller CPU interface */
+-#define CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT      0xFF000100
++#define CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT      (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x100)
+ 
+ #define CNS3XXX_TC11MP_TWD_BASE                       0x90000600
+-#define CNS3XXX_TC11MP_TWD_BASE_VIRT          0xFF000600
++#define CNS3XXX_TC11MP_TWD_BASE_VIRT          (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x600)
+ 
+ #define CNS3XXX_TC11MP_GIC_DIST_BASE          0x90001000      /* Test chip interrupt controller distributor */
+-#define CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT     0xFF001000
++#define CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT     (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x1000)
+ 
+ #define CNS3XXX_TC11MP_L220_BASE              0x92002000      /* L220 registers */
+ #define CNS3XXX_TC11MP_L220_BASE_VIRT         0xFF002000

diff --git a/queue-3.4/nfsd4-reject-negative-acl-lengths.patch b/queue-3.4/nfsd4-reject-negative-acl-lengths.patch
new file mode 100644 (file)
index 0000000..dba2807
--- /dev/null
+++ b/queue-3.4/nfsd4-reject-negative-acl-lengths.patch
@@ -0,0 +1,34 @@
+From 64a817cfbded8674f345d1117b117f942a351a69 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 26 Mar 2013 14:11:13 -0400
+Subject: nfsd4: reject "negative" acl lengths
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 64a817cfbded8674f345d1117b117f942a351a69 upstream.
+
+Since we only enforce an upper bound, not a lower bound, a "negative"
+length can get through here.
+
+The symptom seen was a warning when we attempt to a kmalloc with an
+excessive size.
+
+Reported-by: Toralf Förster <toralf.foerster@gmx.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -263,7 +263,7 @@ nfsd4_decode_fattr(struct nfsd4_compound
+               iattr->ia_valid |= ATTR_SIZE;
+       }
+       if (bmval[0] & FATTR4_WORD0_ACL) {
+-              int nace;
++              u32 nace;
+               struct nfs4_ace *ace;
+ 
+               READ_BUF(4); len += 4;

diff --git a/queue-3.4/series b/queue-3.4/series
index da5177ee51266c3b58cc26a65dd058fde9b92558..012414525962311122dc3c656e16c2c970d9d94c 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -31,3 +31,5 @@ btrfs-limit-the-global-reserve-to-512mb.patch
 btrfs-don-t-drop-path-when-printing-out-tree-errors-in-scrub.patch
 usb-gadget-udc-core-fix-a-regression-during-gadget-driver-unbinding.patch
 loop-prevent-bdev-freeing-while-device-in-use.patch
+arm-cns3xxx-fix-mapping-of-private-memory-region.patch
+nfsd4-reject-negative-acl-lengths.patch