--- /dev/null
+From 64cb927371cd2ec43758d8a094a003d27bc3d0dc Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Mon, 1 Jul 2013 08:12:38 -0400
+Subject: ext3,ext4: don't mess with dir_file->f_pos in htree_dirblock_to_tree()
+
+From: Al Viro <viro@ZenIV.linux.org.uk>
+
+commit 64cb927371cd2ec43758d8a094a003d27bc3d0dc upstream.
+
+Both ext3 and ext4 htree_dirblock_to_tree() is just filling the
+in-core rbtree for use by call_filldir(). All updates of ->f_pos are
+done by the latter; bumping it here (on error) is obviously wrong - we
+might very well have it nowhere near the block we'd found an error in.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext3/namei.c | 7 ++-----
+ fs/ext4/namei.c | 7 ++-----
+ 2 files changed, 4 insertions(+), 10 deletions(-)
+
+--- a/fs/ext3/namei.c
++++ b/fs/ext3/namei.c
+@@ -584,11 +584,8 @@ static int htree_dirblock_to_tree(struct
+ if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh,
+ (block<<EXT3_BLOCK_SIZE_BITS(dir->i_sb))
+ +((char *)de - bh->b_data))) {
+- /* On error, skip the f_pos to the next block. */
+- dir_file->f_pos = (dir_file->f_pos |
+- (dir->i_sb->s_blocksize - 1)) + 1;
+- brelse (bh);
+- return count;
++ /* silently ignore the rest of the block */
++ break;
+ }
+ ext3fs_dirhash(de->name, de->name_len, hinfo);
+ if ((hinfo->hash < start_hash) ||
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -585,11 +585,8 @@ static int htree_dirblock_to_tree(struct
+ if (ext4_check_dir_entry(dir, NULL, de, bh,
+ (block<<EXT4_BLOCK_SIZE_BITS(dir->i_sb))
+ + ((char *)de - bh->b_data))) {
+- /* On error, skip the f_pos to the next block. */
+- dir_file->f_pos = (dir_file->f_pos |
+- (dir->i_sb->s_blocksize - 1)) + 1;
+- brelse(bh);
+- return count;
++ /* silently ignore the rest of the block */
++ break;
+ }
+ ext4fs_dirhash(de->name, de->name_len, hinfo);
+ if ((hinfo->hash < start_hash) ||
--- /dev/null
+From 39c04153fda8c32e85b51c96eb5511a326ad7609 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Mon, 1 Jul 2013 08:12:40 -0400
+Subject: jbd2: fix theoretical race in jbd2__journal_restart
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 39c04153fda8c32e85b51c96eb5511a326ad7609 upstream.
+
+Once we decrement transaction->t_updates, if this is the last handle
+holding the transaction from closing, and once we release the
+t_handle_lock spinlock, it's possible for the transaction to commit
+and be released. In practice with normal kernels, this probably won't
+happen, since the commit happens in a separate kernel thread and it's
+unlikely this could all happen within the space of a few CPU cycles.
+
+On the other hand, with a real-time kernel, this could potentially
+happen, so save the tid found in transaction->t_tid before we release
+t_handle_lock. It would require an insane configuration, such as one
+where the jbd2 thread was set to a very high real-time priority,
+perhaps because a high priority real-time thread is trying to read or
+write to a file system. But some people who use real-time kernels
+have been known to do insane things, including controlling
+laser-wielding industrial robots. :-)
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -469,10 +469,10 @@ int jbd2__journal_restart(handle_t *hand
+ &transaction->t_outstanding_credits);
+ if (atomic_dec_and_test(&transaction->t_updates))
+ wake_up(&journal->j_wait_updates);
++ tid = transaction->t_tid;
+ spin_unlock(&transaction->t_handle_lock);
+
+ jbd_debug(2, "restarting handle %p\n", handle);
+- tid = transaction->t_tid;
+ need_to_start = !tid_geq(journal->j_commit_request, tid);
+ read_unlock(&journal->j_state_lock);
+ if (need_to_start)
--- /dev/null
+From e39506b466edcda2a7e9d0174d7987ae654137b7 Mon Sep 17 00:00:00 2001
+From: Joachim Eastwood <manabian@gmail.com>
+Date: Thu, 6 Jun 2013 10:24:14 +0200
+Subject: pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status
+
+From: Joachim Eastwood <manabian@gmail.com>
+
+commit e39506b466edcda2a7e9d0174d7987ae654137b7 upstream.
+
+Commit 80af9e6d (pcmcia at91_cf: fix raw gpio number usage) forgot
+to change the parameter in gpio_get_value after adding gpio
+validation.
+
+Signed-off-by: Joachim Eastwood <manabian@gmail.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pcmcia/at91_cf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pcmcia/at91_cf.c
++++ b/drivers/pcmcia/at91_cf.c
+@@ -99,9 +99,9 @@ static int at91_cf_get_status(struct pcm
+ int vcc = cf->board->vcc_pin;
+
+ *sp = SS_DETECT | SS_3VCARD;
+- if (!rdy || gpio_get_value(rdy))
++ if (!rdy || gpio_get_value(cf->board->irq_pin))
+ *sp |= SS_READY;
+- if (!vcc || gpio_get_value(vcc))
++ if (!vcc || gpio_get_value(cf->board->vcc_pin))
+ *sp |= SS_POWERON;
+ } else
+ *sp = 0;
--- /dev/null
+jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch
+ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch
+usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch
+usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch
+xhci-check-for-failed-dma-pool-allocation.patch
+pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch
--- /dev/null
+From d68c277b501889b3a50c179d1c3d704db7947b83 Mon Sep 17 00:00:00 2001
+From: UCHINO Satoshi <satoshi.uchino@toshiba.co.jp>
+Date: Thu, 23 May 2013 11:10:11 +0900
+Subject: usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed
+
+From: UCHINO Satoshi <satoshi.uchino@toshiba.co.jp>
+
+commit d68c277b501889b3a50c179d1c3d704db7947b83 upstream.
+
+Without this memory barrier, the file-storage thread may fail to
+escape from the following while loop, because it may observe new
+common->thread_wakeup_needed and old bh->state which are updated by
+the callback functions.
+
+ /* Wait for the CBW to arrive */
+ while (bh->state != BUF_STATE_FULL) {
+ rc = sleep_thread(common);
+ if (rc)
+ return rc;
+ }
+
+Signed-off-by: UCHINO Satoshi <satoshi.uchino@toshiba.co.jp>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/f_mass_storage.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/f_mass_storage.c
++++ b/drivers/usb/gadget/f_mass_storage.c
+@@ -513,6 +513,7 @@ static int fsg_set_halt(struct fsg_dev *
+ /* Caller must hold fsg->lock */
+ static void wakeup_thread(struct fsg_common *common)
+ {
++ smp_wmb(); /* ensure the write of bh->state is complete */
+ /* Tell the main thread that something has happened */
+ common->thread_wakeup_needed = 1;
+ if (common->thread_task)
+@@ -730,6 +731,7 @@ static int sleep_thread(struct fsg_commo
+ }
+ __set_current_state(TASK_RUNNING);
+ common->thread_wakeup_needed = 0;
++ smp_rmb(); /* ensure the latest bh->state is visible */
+ return rc;
+ }
+
--- /dev/null
+From a254810a86aaaac4ac6ba44fa934558b042a17a7 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Thu, 20 Jun 2013 16:07:40 -0500
+Subject: USB: option,qcserial: move Novatel Gobi1K IDs to qcserial
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit a254810a86aaaac4ac6ba44fa934558b042a17a7 upstream.
+
+These devices are all Gobi1K devices (according to the Windows INF
+files) and should be handled by qcserial instead of option. Their
+network port is handled by qmi_wwan.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ----
+ drivers/usb/serial/qcserial.c | 8 +++++++-
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -159,8 +159,6 @@ static void option_instat_callback(struc
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
+ #define NOVATELWIRELESS_PRODUCT_E362 0x9010
+-#define NOVATELWIRELESS_PRODUCT_G1 0xA001
+-#define NOVATELWIRELESS_PRODUCT_G1_M 0xA002
+ #define NOVATELWIRELESS_PRODUCT_G2 0xA010
+ #define NOVATELWIRELESS_PRODUCT_MC551 0xB001
+
+@@ -744,8 +742,6 @@ static const struct usb_device_id option
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC547) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) },
+- { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) },
+- { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+ /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -36,7 +36,13 @@ static const struct usb_device_id id_tab
+ {DEVICE_G1K(0x04da, 0x250c)}, /* Panasonic Gobi QDL device */
+ {DEVICE_G1K(0x413c, 0x8172)}, /* Dell Gobi Modem device */
+ {DEVICE_G1K(0x413c, 0x8171)}, /* Dell Gobi QDL device */
+- {DEVICE_G1K(0x1410, 0xa001)}, /* Novatel Gobi Modem device */
++ {DEVICE_G1K(0x1410, 0xa001)}, /* Novatel/Verizon USB-1000 */
++ {DEVICE_G1K(0x1410, 0xa002)}, /* Novatel Gobi Modem device */
++ {DEVICE_G1K(0x1410, 0xa003)}, /* Novatel Gobi Modem device */
++ {DEVICE_G1K(0x1410, 0xa004)}, /* Novatel Gobi Modem device */
++ {DEVICE_G1K(0x1410, 0xa005)}, /* Novatel Gobi Modem device */
++ {DEVICE_G1K(0x1410, 0xa006)}, /* Novatel Gobi Modem device */
++ {DEVICE_G1K(0x1410, 0xa007)}, /* Novatel Gobi Modem device */
+ {DEVICE_G1K(0x1410, 0xa008)}, /* Novatel Gobi QDL device */
+ {DEVICE_G1K(0x0b05, 0x1776)}, /* Asus Gobi Modem device */
+ {DEVICE_G1K(0x0b05, 0x1774)}, /* Asus Gobi QDL device */
--- /dev/null
+From 025f880cb2e4d7218d0422d4b07bea1a68959c38 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Mon, 17 Jun 2013 09:56:33 -0700
+Subject: xhci: check for failed dma pool allocation
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 025f880cb2e4d7218d0422d4b07bea1a68959c38 upstream.
+
+Fail and free the container context in case dma_pool_alloc() can't allocate
+the raw context data part of it
+
+This patch should be backported to kernels as old as 2.6.31, that
+contain the commit d115b04818e57bdbc7ccde4d0660b15e33013dc8 "USB: xhci:
+Support for 64-byte contexts".
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Cc: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -273,6 +273,10 @@ static struct xhci_container_ctx *xhci_a
+ ctx->size += CTX_SIZE(xhci->hcc_params);
+
+ ctx->bytes = dma_pool_alloc(xhci->device_pool, flags, &ctx->dma);
++ if (!ctx->bytes) {
++ kfree(ctx);
++ return NULL;
++ }
+ memset(ctx->bytes, 0, ctx->size);
+ return ctx;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
