]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.0-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Oct 2012 18:13:11 +0000 (11:13 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Oct 2012 18:13:11 +0000 (11:13 -0700)
added patches:
can-mscan-mpc5xxx-fix-return-value-check-in-mpc512x_can_get_clock.patch
ib-srp-avoid-having-aborted-requests-hang.patch
ib-srp-fix-use-after-free-in-srp_reset_req.patch
ipoib-fix-use-after-free-of-multicast-object.patch
isci-fix-isci_pci_probe-generates-warning-on-efi-failure-path.patch
pci-honor-child-buses-add_size-in-hot-plug-configuration.patch
scsi-hpsa-use-lun-reset-instead-of-target-reset.patch
scsi-ibmvscsi-fix-host-config-length-field-overflow.patch
ubi-fix-autoresize-handling-in-r-o-mode.patch
x86-alternatives-fix-p6-nops-on-non-modular-kernels.patch

queue-3.0/can-mscan-mpc5xxx-fix-return-value-check-in-mpc512x_can_get_clock.patch [new file with mode: 0644]
queue-3.0/ib-srp-avoid-having-aborted-requests-hang.patch [new file with mode: 0644]
queue-3.0/ib-srp-fix-use-after-free-in-srp_reset_req.patch [new file with mode: 0644]
queue-3.0/ipoib-fix-use-after-free-of-multicast-object.patch [new file with mode: 0644]
queue-3.0/isci-fix-isci_pci_probe-generates-warning-on-efi-failure-path.patch [new file with mode: 0644]
queue-3.0/pci-honor-child-buses-add_size-in-hot-plug-configuration.patch [new file with mode: 0644]
queue-3.0/scsi-hpsa-use-lun-reset-instead-of-target-reset.patch [new file with mode: 0644]
queue-3.0/scsi-ibmvscsi-fix-host-config-length-field-overflow.patch [new file with mode: 0644]
queue-3.0/series
queue-3.0/ubi-fix-autoresize-handling-in-r-o-mode.patch [new file with mode: 0644]
queue-3.0/x86-alternatives-fix-p6-nops-on-non-modular-kernels.patch [new file with mode: 0644]

diff --git a/queue-3.0/can-mscan-mpc5xxx-fix-return-value-check-in-mpc512x_can_get_clock.patch b/queue-3.0/can-mscan-mpc5xxx-fix-return-value-check-in-mpc512x_can_get_clock.patch
new file mode 100644 (file)
index 0000000..811a165
--- /dev/null
@@ -0,0 +1,45 @@
+From f61bd0585dfc7d99db4936d7467de4ca8e2f7ea0 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Fri, 21 Sep 2012 15:09:47 +0800
+Subject: can: mscan-mpc5xxx: fix return value check in mpc512x_can_get_clock()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit f61bd0585dfc7d99db4936d7467de4ca8e2f7ea0 upstream.
+
+In case of error, the function clk_get() returns ERR_PTR()
+and never returns NULL pointer. The NULL test in the error
+handling should be replaced with IS_ERR().
+
+dpatch engine is used to auto generated this patch.
+(https://github.com/weiyj/dpatch)
+
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/mscan/mpc5xxx_can.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/mscan/mpc5xxx_can.c
++++ b/drivers/net/can/mscan/mpc5xxx_can.c
+@@ -181,7 +181,7 @@ static u32 __devinit mpc512x_can_get_clo
+               if (!clock_name || !strcmp(clock_name, "sys")) {
+                       sys_clk = clk_get(&ofdev->dev, "sys_clk");
+-                      if (!sys_clk) {
++                      if (IS_ERR(sys_clk)) {
+                               dev_err(&ofdev->dev, "couldn't get sys_clk\n");
+                               goto exit_unmap;
+                       }
+@@ -204,7 +204,7 @@ static u32 __devinit mpc512x_can_get_clo
+               if (clocksrc < 0) {
+                       ref_clk = clk_get(&ofdev->dev, "ref_clk");
+-                      if (!ref_clk) {
++                      if (IS_ERR(ref_clk)) {
+                               dev_err(&ofdev->dev, "couldn't get ref_clk\n");
+                               goto exit_unmap;
+                       }
diff --git a/queue-3.0/ib-srp-avoid-having-aborted-requests-hang.patch b/queue-3.0/ib-srp-avoid-having-aborted-requests-hang.patch
new file mode 100644 (file)
index 0000000..cd38d79
--- /dev/null
@@ -0,0 +1,30 @@
+From d8536670916a685df116b5c2cb256573fd25e4e3 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 24 Aug 2012 10:29:11 +0000
+Subject: IB/srp: Avoid having aborted requests hang
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit d8536670916a685df116b5c2cb256573fd25e4e3 upstream.
+
+We need to call scsi_done() for commands after we abort them.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: David Dillow <dillowda@ornl.gov>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1669,6 +1669,7 @@ static int srp_abort(struct scsi_cmnd *s
+                         SRP_TSK_ABORT_TASK);
+       srp_free_req(target, req, scmnd, 0);
+       scmnd->result = DID_ABORT << 16;
++      scmnd->scsi_done(scmnd);
+       return SUCCESS;
+ }
diff --git a/queue-3.0/ib-srp-fix-use-after-free-in-srp_reset_req.patch b/queue-3.0/ib-srp-fix-use-after-free-in-srp_reset_req.patch
new file mode 100644 (file)
index 0000000..20e9600
--- /dev/null
@@ -0,0 +1,35 @@
+From 9b796d06d5d1b1e85ae2316a283ea11dd739ef96 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 24 Aug 2012 10:27:54 +0000
+Subject: IB/srp: Fix use-after-free in srp_reset_req()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 9b796d06d5d1b1e85ae2316a283ea11dd739ef96 upstream.
+
+srp_free_req() uses the scsi_cmnd structure contents to unmap
+buffers, so we must invoke srp_free_req() before we release
+ownership of that structure.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: David Dillow <dillowda@ornl.gov>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -620,9 +620,9 @@ static void srp_reset_req(struct srp_tar
+       struct scsi_cmnd *scmnd = srp_claim_req(target, req, NULL);
+       if (scmnd) {
++              srp_free_req(target, req, scmnd, 0);
+               scmnd->result = DID_RESET << 16;
+               scmnd->scsi_done(scmnd);
+-              srp_free_req(target, req, scmnd, 0);
+       }
+ }
diff --git a/queue-3.0/ipoib-fix-use-after-free-of-multicast-object.patch b/queue-3.0/ipoib-fix-use-after-free-of-multicast-object.patch
new file mode 100644 (file)
index 0000000..d3702dc
--- /dev/null
@@ -0,0 +1,92 @@
+From bea1e22df494a729978e7f2c54f7bda328f74bc3 Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Thu, 30 Aug 2012 07:01:30 +0000
+Subject: IPoIB: Fix use-after-free of multicast object
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit bea1e22df494a729978e7f2c54f7bda328f74bc3 upstream.
+
+Fix a crash in ipoib_mcast_join_task().  (with help from Or Gerlitz)
+
+Commit c8c2afe360b7 ("IPoIB: Use rtnl lock/unlock when changing device
+flags") added a call to rtnl_lock() in ipoib_mcast_join_task(), which
+is run from the ipoib_workqueue, and hence the workqueue can't be
+flushed from the context of ipoib_stop().
+
+In the current code, ipoib_stop() (which doesn't flush the workqueue)
+calls ipoib_mcast_dev_flush(), which goes and deletes all the
+multicast entries.  This takes place without any synchronization with
+a possible running instance of ipoib_mcast_join_task() for the same
+ipoib device, leading to a crash due to NULL pointer dereference.
+
+Fix this by making sure that the workqueue is flushed before
+ipoib_mcast_dev_flush() is called.  To make that possible, we move the
+RTNL-lock wrapped code to ipoib_mcast_join_finish().
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c      |    2 +-
+ drivers/infiniband/ulp/ipoib/ipoib_multicast.c |   19 ++++++++++---------
+ 2 files changed, 11 insertions(+), 10 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -148,7 +148,7 @@ static int ipoib_stop(struct net_device
+       netif_stop_queue(dev);
+-      ipoib_ib_dev_down(dev, 0);
++      ipoib_ib_dev_down(dev, 1);
+       ipoib_ib_dev_stop(dev, 0);
+       if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -189,7 +189,9 @@ static int ipoib_mcast_join_finish(struc
+       mcast->mcmember = *mcmember;
+-      /* Set the cached Q_Key before we attach if it's the broadcast group */
++      /* Set the multicast MTU and cached Q_Key before we attach if it's
++       * the broadcast group.
++       */
+       if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
+                   sizeof (union ib_gid))) {
+               spin_lock_irq(&priv->lock);
+@@ -197,10 +199,17 @@ static int ipoib_mcast_join_finish(struc
+                       spin_unlock_irq(&priv->lock);
+                       return -EAGAIN;
+               }
++              priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
+               priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
+               spin_unlock_irq(&priv->lock);
+               priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
+               set_qkey = 1;
++
++              if (!ipoib_cm_admin_enabled(dev)) {
++                      rtnl_lock();
++                      dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
++                      rtnl_unlock();
++              }
+       }
+       if (!test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) {
+@@ -586,14 +595,6 @@ void ipoib_mcast_join_task(struct work_s
+               return;
+       }
+-      priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
+-
+-      if (!ipoib_cm_admin_enabled(dev)) {
+-              rtnl_lock();
+-              dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
+-              rtnl_unlock();
+-      }
+-
+       ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
+       clear_bit(IPOIB_MCAST_RUN, &priv->flags);
diff --git a/queue-3.0/isci-fix-isci_pci_probe-generates-warning-on-efi-failure-path.patch b/queue-3.0/isci-fix-isci_pci_probe-generates-warning-on-efi-failure-path.patch
new file mode 100644 (file)
index 0000000..45da17b
--- /dev/null
@@ -0,0 +1,46 @@
+From 6d70a74ffd616073a68ae0974d98819bfa8e6da6 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 22 Jun 2012 11:31:14 -0700
+Subject: isci: fix isci_pci_probe() generates warning on efi failure path
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 6d70a74ffd616073a68ae0974d98819bfa8e6da6 upstream.
+
+The oem parameter image embedded in the efi variable is at an offset
+from the start of the variable.  However, in the failure path we try to
+free the 'orom' pointer which is only valid when the paramaters are
+being read from the legacy option-rom space.
+
+Since failure to load the oem parameters is unlikely and we keep the
+memory around in the success case just defer all de-allocation to devm.
+
+Reported-by: Don Morris <don.morris@hp.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/isci/init.c       |    1 -
+ drivers/scsi/isci/probe_roms.c |    1 -
+ 2 files changed, 2 deletions(-)
+
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -458,7 +458,6 @@ static int __devinit isci_pci_probe(stru
+               if (sci_oem_parameters_validate(&orom->ctrl[i])) {
+                       dev_warn(&pdev->dev,
+                                "[%d]: invalid oem parameters detected, falling back to firmware\n", i);
+-                      devm_kfree(&pdev->dev, orom);
+                       orom = NULL;
+                       break;
+               }
+--- a/drivers/scsi/isci/probe_roms.c
++++ b/drivers/scsi/isci/probe_roms.c
+@@ -104,7 +104,6 @@ struct isci_orom *isci_request_oprom(str
+       if (i >= len) {
+               dev_err(&pdev->dev, "oprom parse error\n");
+-              devm_kfree(&pdev->dev, rom);
+               rom = NULL;
+       }
+       pci_unmap_biosrom(oprom);
diff --git a/queue-3.0/pci-honor-child-buses-add_size-in-hot-plug-configuration.patch b/queue-3.0/pci-honor-child-buses-add_size-in-hot-plug-configuration.patch
new file mode 100644 (file)
index 0000000..210f7bf
--- /dev/null
@@ -0,0 +1,107 @@
+From be768912a49b10b68e96fbd8fa3cab0adfbd3091 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Mon, 25 Jul 2011 13:08:38 -0700
+Subject: PCI: honor child buses add_size in hot plug configuration
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit be768912a49b10b68e96fbd8fa3cab0adfbd3091 upstream.
+
+git commit c8adf9a3e873eddaaec11ac410a99ef6b9656938
+    "PCI: pre-allocate additional resources to devices only after
+       successful allocation of essential resources."
+
+fails to take into consideration the optional-resources needed by children
+devices while calculating the optional-resource needed by the bridge.
+
+This can be a problem on some setup. For example, if a hotplug bridge has 8
+children hotplug bridges, the bridge should have enough resources to accomodate
+the hotplug requirements for each of its children hotplug bridges.  Currently
+this is not the case.
+
+This patch fixes the problem.
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Reviewed-by: Ram Pai <linuxram@us.ibm.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Andrew Worsley <amworsley@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/setup-bus.c |   26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -543,6 +543,20 @@ static resource_size_t calculate_memsize
+       return size;
+ }
++static resource_size_t get_res_add_size(struct resource_list_x *add_head,
++                                      struct resource *res)
++{
++      struct resource_list_x *list;
++
++      /* check if it is in add_head list */
++      for (list = add_head->next; list && list->res != res;
++                      list = list->next);
++      if (list)
++              return list->add_size;
++
++      return 0;
++}
++
+ /**
+  * pbus_size_io() - size the io window of a given bus
+  *
+@@ -562,6 +576,7 @@ static void pbus_size_io(struct pci_bus
+       struct pci_dev *dev;
+       struct resource *b_res = find_free_bus_resource(bus, IORESOURCE_IO);
+       unsigned long size = 0, size0 = 0, size1 = 0;
++      resource_size_t children_add_size = 0;
+       if (!b_res)
+               return;
+@@ -582,10 +597,15 @@ static void pbus_size_io(struct pci_bus
+                               size += r_size;
+                       else
+                               size1 += r_size;
++
++                      if (add_head)
++                              children_add_size += get_res_add_size(add_head, r);
+               }
+       }
+       size0 = calculate_iosize(size, min_size, size1,
+                       resource_size(b_res), 4096);
++      if (children_add_size > add_size)
++              add_size = children_add_size;
+       size1 = (!add_head || (add_head && !add_size)) ? size0 :
+               calculate_iosize(size, min_size+add_size, size1,
+                       resource_size(b_res), 4096);
+@@ -627,6 +647,7 @@ static int pbus_size_mem(struct pci_bus
+       int order, max_order;
+       struct resource *b_res = find_free_bus_resource(bus, type);
+       unsigned int mem64_mask = 0;
++      resource_size_t children_add_size = 0;
+       if (!b_res)
+               return 0;
+@@ -668,6 +689,9 @@ static int pbus_size_mem(struct pci_bus
+                       if (order > max_order)
+                               max_order = order;
+                       mem64_mask &= r->flags & IORESOURCE_MEM_64;
++
++                      if (add_head)
++                              children_add_size += get_res_add_size(add_head, r);
+               }
+       }
+       align = 0;
+@@ -684,6 +708,8 @@ static int pbus_size_mem(struct pci_bus
+               align += aligns[order];
+       }
+       size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), min_align);
++      if (children_add_size > add_size)
++              add_size = children_add_size;
+       size1 = (!add_head || (add_head && !add_size)) ? size0 :
+               calculate_memsize(size, min_size+add_size, 0,
+                               resource_size(b_res), min_align);
diff --git a/queue-3.0/scsi-hpsa-use-lun-reset-instead-of-target-reset.patch b/queue-3.0/scsi-hpsa-use-lun-reset-instead-of-target-reset.patch
new file mode 100644 (file)
index 0000000..7df9068
--- /dev/null
@@ -0,0 +1,53 @@
+From 21e89afd325849eb38adccf382df16cc895911f9 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Thu, 26 Jul 2012 11:34:10 -0500
+Subject: SCSI: hpsa: Use LUN reset instead of target reset
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit 21e89afd325849eb38adccf382df16cc895911f9 upstream.
+
+It turns out Smart Array logical drives do not support target
+reset and when the target reset fails, the logical drive will
+be taken off line.  Symptoms look like this:
+
+hpsa 0000:03:00.0: Abort request on C1:B0:T0:L0
+hpsa 0000:03:00.0: resetting device 1:0:0:0
+hpsa 0000:03:00.0: cp ffff880037c56000 is reported invalid (probably means target device no longer present)
+hpsa 0000:03:00.0: resetting device failed.
+sd 1:0:0:0: Device offlined - not ready after error recovery
+sd 1:0:0:0: rejecting I/O to offline device
+EXT3-fs error (device sdb1): read_block_bitmap:
+
+LUN reset is supported though, and is what we should be using.
+Target reset is also disruptive in shared SAS situations,
+for example, an external MSA1210m which does support target
+reset attached to Smart Arrays in multiple hosts -- a target
+reset from one host is disruptive to other hosts as all LUNs
+on the target will be reset and will abort all outstanding i/os
+back to all the attached hosts.  So we should use LUN reset,
+not target reset.
+
+Tested this with Smart Array logical drives and with tape drives.
+Not sure how this bug survived since 2009, except it must be very
+rare for a Smart Array to require more than 30s to complete a request.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hpsa.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -2893,7 +2893,7 @@ static void fill_cmd(struct CommandList
+                       c->Request.Timeout = 0; /* Don't time out */
+                       memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
+                       c->Request.CDB[0] =  cmd;
+-                      c->Request.CDB[1] = 0x03;  /* Reset target above */
++                      c->Request.CDB[1] = HPSA_RESET_TYPE_LUN;
+                       /* If bytes 4-7 are zero, it means reset the */
+                       /* LunID device */
+                       c->Request.CDB[4] = 0x00;
diff --git a/queue-3.0/scsi-ibmvscsi-fix-host-config-length-field-overflow.patch b/queue-3.0/scsi-ibmvscsi-fix-host-config-length-field-overflow.patch
new file mode 100644 (file)
index 0000000..fbc76c0
--- /dev/null
@@ -0,0 +1,34 @@
+From 225c56960fcafeccc2b6304f96cd3f0dbf42a16a Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Mon, 30 Jul 2012 11:33:05 +1000
+Subject: SCSI: ibmvscsi: Fix host config length field overflow
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 225c56960fcafeccc2b6304f96cd3f0dbf42a16a upstream.
+
+The length field in the host config packet is only 16-bit long, so
+passing it 0x10000 (64K which is our standard PAGE_SIZE) doesn't
+work and result in an empty config from the server.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Robert Jennings <rcj@linux.vnet.ibm.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/ibmvscsi/ibmvscsi.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -1547,6 +1547,9 @@ static int ibmvscsi_do_host_config(struc
+       host_config = &evt_struct->iu.mad.host_config;
++      /* The transport length field is only 16-bit */
++      length = min(0xffff, length);
++
+       /* Set up a lun reset SRP command */
+       memset(host_config, 0x00, sizeof(*host_config));
+       host_config->common.type = VIOSRP_HOST_CONFIG_TYPE;
index 73cf168b4f4487776290efce760d8dc41850296f..3b230888327dd02459ba5039bbc986bcdbdcd81a 100644 (file)
@@ -19,3 +19,13 @@ n_gsm-added-interlocking-for-gsm_data_lock-for-certain-code-paths.patch
 coredump-prevent-double-free-on-an-error-path-in-core.patch
 increase-xhci-suspend-timeout-to-16ms.patch
 n_gsm-memory-leak-in-uplink-error-path.patch
+ubi-fix-autoresize-handling-in-r-o-mode.patch
+scsi-ibmvscsi-fix-host-config-length-field-overflow.patch
+scsi-hpsa-use-lun-reset-instead-of-target-reset.patch
+can-mscan-mpc5xxx-fix-return-value-check-in-mpc512x_can_get_clock.patch
+ipoib-fix-use-after-free-of-multicast-object.patch
+ib-srp-fix-use-after-free-in-srp_reset_req.patch
+ib-srp-avoid-having-aborted-requests-hang.patch
+isci-fix-isci_pci_probe-generates-warning-on-efi-failure-path.patch
+x86-alternatives-fix-p6-nops-on-non-modular-kernels.patch
+pci-honor-child-buses-add_size-in-hot-plug-configuration.patch
diff --git a/queue-3.0/ubi-fix-autoresize-handling-in-r-o-mode.patch b/queue-3.0/ubi-fix-autoresize-handling-in-r-o-mode.patch
new file mode 100644 (file)
index 0000000..7023388
--- /dev/null
@@ -0,0 +1,35 @@
+From abb3e01103eb4e2ea5c15e6fedbc74e08bd4cc2b Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Sat, 18 Aug 2012 14:11:42 +0200
+Subject: UBI: fix autoresize handling in R/O mode
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit abb3e01103eb4e2ea5c15e6fedbc74e08bd4cc2b upstream.
+
+Currently UBI fails in autoresize when it is in R/O mode (e.g., because the
+underlying MTD device is R/O). This patch fixes the issue - we just skip
+autoresize and print a warning.
+
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/build.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -816,6 +816,11 @@ static int autoresize(struct ubi_device
+       struct ubi_volume *vol = ubi->volumes[vol_id];
+       int err, old_reserved_pebs = vol->reserved_pebs;
++      if (ubi->ro_mode) {
++              ubi_warn("skip auto-resize because of R/O mode");
++              return 0;
++      }
++
+       /*
+        * Clear the auto-resize flag in the volume in-memory copy of the
+        * volume table, and 'ubi_resize_volume()' will propagate this change
diff --git a/queue-3.0/x86-alternatives-fix-p6-nops-on-non-modular-kernels.patch b/queue-3.0/x86-alternatives-fix-p6-nops-on-non-modular-kernels.patch
new file mode 100644 (file)
index 0000000..3590812
--- /dev/null
@@ -0,0 +1,44 @@
+From cb09cad44f07044d9810f18f6f9a6a6f3771f979 Mon Sep 17 00:00:00 2001
+From: Avi Kivity <avi@redhat.com>
+Date: Wed, 22 Aug 2012 13:03:48 +0300
+Subject: x86/alternatives: Fix p6 nops on non-modular kernels
+
+From: Avi Kivity <avi@redhat.com>
+
+commit cb09cad44f07044d9810f18f6f9a6a6f3771f979 upstream.
+
+Probably a leftover from the early days of self-patching, p6nops
+are marked __initconst_or_module, which causes them to be
+discarded in a non-modular kernel.  If something later triggers
+patching, it will overwrite kernel code with garbage.
+
+Reported-by: Tomas Racek <tracek@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Cc: Michael Tokarev <mjt@tls.msk.ru>
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: Marcelo Tosatti <mtosatti@redhat.com>
+Cc: qemu-devel@nongnu.org
+Cc: Anthony Liguori <anthony@codemonkey.ws>
+Cc: H. Peter Anvin <hpa@linux.intel.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Alan Cox <alan@linux.intel.com>
+Link: http://lkml.kernel.org/r/5034AE84.90708@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Ben Jencks <ben@bjencks.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/alternative.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -161,7 +161,7 @@ static const unsigned char * const k7_no
+ #endif
+ #ifdef P6_NOP1
+-static const unsigned char  __initconst_or_module p6nops[] =
++static const unsigned char p6nops[] =
+ {
+       P6_NOP1,
+       P6_NOP2,