--- /dev/null
+From 9e9432c267e4047db98b9d4fba95099c6effcef9 Mon Sep 17 00:00:00 2001
+From: Chuck Ebbert <cebbert@redhat.com>
+Date: Sat, 30 Jan 2010 20:28:19 +0100
+Subject: block: fix bugs in bio-integrity mempool usage
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+commit 9e9432c267e4047db98b9d4fba95099c6effcef9 upstream.
+
+Fix two bugs in the bio integrity code:
+
+ use_bip_pool() always returns 0 because it checks against the wrong limit,
+ causing the mempool to be used only when regular allocation fails.
+
+ When the mempool is used as a fallback we don't free the data properly.
+
+Signed-Off-By: Chuck Ebbert <cebbert@redhat.com>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/bio-integrity.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/bio-integrity.c
++++ b/fs/bio-integrity.c
+@@ -61,7 +61,7 @@ static inline unsigned int vecs_to_idx(u
+
+ static inline int use_bip_pool(unsigned int idx)
+ {
+- if (idx == BIOVEC_NR_POOLS)
++ if (idx == BIOVEC_MAX_IDX)
+ return 1;
+
+ return 0;
+@@ -95,6 +95,7 @@ struct bio_integrity_payload *bio_integr
+
+ /* Use mempool if lower order alloc failed or max vecs were requested */
+ if (bip == NULL) {
++ idx = BIOVEC_MAX_IDX; /* so we free the payload properly later */
+ bip = mempool_alloc(bs->bio_integrity_pool, gfp_mask);
+
+ if (unlikely(bip == NULL)) {
--- /dev/null
+From 7ab02af428c2d312c0cf8fb0b01cc1eb21131a3d Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 2 Feb 2010 12:37:44 -0800
+Subject: Fix 'flush_old_exec()/setup_new_exec()' split
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 7ab02af428c2d312c0cf8fb0b01cc1eb21131a3d upstream.
+
+Commit 221af7f87b9 ("Split 'flush_old_exec' into two functions") split
+the function at the point of no return - ie right where there were no
+more error cases to check. That made sense from a technical standpoint,
+but when we then also combined it with the actual personality setting
+going in between flush_old_exec() and setup_new_exec(), it needs to be a
+bit more careful.
+
+In particular, we need to make sure that we really flush the old
+personality bits in the 'flush' stage, rather than later in the 'setup'
+stage, since otherwise we might be flushing the _new_ personality state
+that we're just setting up.
+
+So this moves the flags and personality flushing (and 'flush_thread()',
+which is the arch-specific function that generally resets lazy FP state
+etc) of the old process into flush_old_exec(), so that it doesn't affect
+any state that execve() is setting up for the new process environment.
+
+This was reported by Michal Simek as breaking his Microblaze qemu
+environment.
+
+Reported-and-tested-by: Michal Simek <michal.simek@petalogix.com>
+Cc: Peter Anvin <hpa@zytor.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exec.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -951,6 +951,11 @@ int flush_old_exec(struct linux_binprm *
+ goto out;
+
+ bprm->mm = NULL; /* We're using it now */
++
++ current->flags &= ~PF_RANDOMIZE;
++ flush_thread();
++ current->personality &= ~bprm->per_clear;
++
+ return 0;
+
+ out:
+@@ -987,9 +992,6 @@ void setup_new_exec(struct linux_binprm
+ tcomm[i] = '\0';
+ set_task_comm(current, tcomm);
+
+- current->flags &= ~PF_RANDOMIZE;
+- flush_thread();
+-
+ /* Set the new mm task size. We have to do that late because it may
+ * depend on TIF_32BIT which is only updated in flush_thread() on
+ * some architectures like powerpc
+@@ -1005,8 +1007,6 @@ void setup_new_exec(struct linux_binprm
+ set_dumpable(current->mm, suid_dumpable);
+ }
+
+- current->personality &= ~bprm->per_clear;
+-
+ /*
+ * Flush performance counters when crossing a
+ * security domain:
--- /dev/null
+From a996996dd75a9086b12d1cb4010f26e1748993f0 Mon Sep 17 00:00:00 2001
+From: Matt Mackall <mpm@selenic.com>
+Date: Fri, 29 Jan 2010 21:50:36 +1300
+Subject: random: drop weird m_time/a_time manipulation
+
+From: Matt Mackall <mpm@selenic.com>
+
+commit a996996dd75a9086b12d1cb4010f26e1748993f0 upstream.
+
+No other driver does anything remotely like this that I know of except
+for the tty drivers, and I can't see any reason for random/urandom to do
+it. In fact, it's a (trivial, harmless) timing information leak. And
+obviously, it generates power- and flash-cycle wasting I/O, especially
+if combined with something like hwrngd. Also, it breaks ubifs's
+expectations.
+
+Signed-off-by: Matt Mackall <mpm@selenic.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/random.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1051,12 +1051,6 @@ random_read(struct file *file, char __us
+ /* like a named pipe */
+ }
+
+- /*
+- * If we gave the user some bytes, update the access time.
+- */
+- if (count)
+- file_accessed(file);
+-
+ return (count ? count : retval);
+ }
+
+@@ -1116,8 +1110,6 @@ static ssize_t random_write(struct file
+ if (ret)
+ return ret;
+
+- inode->i_mtime = current_fs_time(inode->i_sb);
+- mark_inode_dirty(inode);
+ return (ssize_t)count;
+ }
+
--- /dev/null
+From cd1510cb5f892907fe1a662f90b41fb3a42954e0 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Mon, 1 Feb 2010 21:48:28 +1100
+Subject: random: Remove unused inode variable
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit cd1510cb5f892907fe1a662f90b41fb3a42954e0 upstream.
+
+The previous changeset left behind an unused inode variable.
+This patch removes it.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1101,7 +1101,6 @@ static ssize_t random_write(struct file *file, const char __user *buffer,
+ size_t count, loff_t *ppos)
+ {
+ size_t ret;
+- struct inode *inode = file->f_path.dentry->d_inode;
+
+ ret = write_pool(&blocking_pool, buffer, count);
+ if (ret)
mm-percpu-vmap-fix-rcu-list-walking.patch
mm-purge-fragmented-percpu-vmap-blocks.patch
block-fix-bio_add_page-for-non-trivial-merge_bvec_fn-case.patch
+fix-flush_old_exec-setup_new_exec-split.patch
+random-drop-weird-m_time-a_time-manipulation.patch
+random-remove-unused-inode-variable.patch
+block-fix-bugs-in-bio-integrity-mempool-usage.patch
+usb-r8a66597-hdc-disable-interrupts-fix.patch
--- /dev/null
+From e5ff15bec96ba18698dae5de0bbf7e6a0653ca65 Mon Sep 17 00:00:00 2001
+From: Magnus Damm <damm@opensource.se>
+Date: Wed, 27 Jan 2010 07:41:19 +0000
+Subject: usb: r8a66597-hdc disable interrupts fix
+
+From: Magnus Damm <damm@opensource.se>
+
+commit e5ff15bec96ba18698dae5de0bbf7e6a0653ca65 upstream.
+
+This patch improves disable_controller() in the r8a66597-hdc
+driver to disable all interrupts and clear status flags. It
+also makes sure that disable_controller() is called during
+probe(). This fixes the relatively rare case of unexpected
+pending interrupts after kexec reboot.
+
+Signed-off-by: Magnus Damm <damm@opensource.se>
+Acked-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/r8a66597-hcd.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -216,8 +216,17 @@ static void disable_controller(struct r8
+ {
+ int port;
+
++ /* disable interrupts */
+ r8a66597_write(r8a66597, 0, INTENB0);
+- r8a66597_write(r8a66597, 0, INTSTS0);
++ r8a66597_write(r8a66597, 0, INTENB1);
++ r8a66597_write(r8a66597, 0, BRDYENB);
++ r8a66597_write(r8a66597, 0, BEMPENB);
++ r8a66597_write(r8a66597, 0, NRDYENB);
++
++ /* clear status */
++ r8a66597_write(r8a66597, 0, BRDYSTS);
++ r8a66597_write(r8a66597, 0, NRDYSTS);
++ r8a66597_write(r8a66597, 0, BEMPSTS);
+
+ for (port = 0; port < r8a66597->max_root_hub; port++)
+ r8a66597_disable_port(r8a66597, port);
+@@ -2470,6 +2479,12 @@ static int __devinit r8a66597_probe(stru
+ r8a66597->rh_timer.data = (unsigned long)r8a66597;
+ r8a66597->reg = (unsigned long)reg;
+
++ /* make sure no interrupts are pending */
++ ret = r8a66597_clock_enable(r8a66597);
++ if (ret < 0)
++ goto clean_up3;
++ disable_controller(r8a66597);
++
+ for (i = 0; i < R8A66597_MAX_NUM_PIPE; i++) {
+ INIT_LIST_HEAD(&r8a66597->pipe_queue[i]);
+ init_timer(&r8a66597->td_timer[i]);
projects / thirdparty / kernel / stable-queue.git / commitdiff
