--- /dev/null
+From c6cc3d58b4042f5cadae653ff8d3df26af1a0169 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 8 Oct 2013 19:57:50 +0200
+Subject: ALSA: hda - Add fixup for ASUS N56VZ
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c6cc3d58b4042f5cadae653ff8d3df26af1a0169 upstream.
+
+ASUS N56VZ needs a fixup for the bass speaker pin, which was already
+provided via model=asus-mode4.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=841645
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4345,6 +4345,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
++ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
+ SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
+ SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
+ SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
--- /dev/null
+From 88cfcf86aa3ada84d97195bcad74f4dadb4ae23b Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 11 Oct 2013 10:18:45 +0200
+Subject: ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell
+ model)
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 88cfcf86aa3ada84d97195bcad74f4dadb4ae23b upstream.
+
+The external mic showed up with a precense detect of "always present",
+essentially disabling the internal mic. Therefore turn off presence
+detection for this pin.
+
+Note: The external mic seems not yet working, but an internal mic is
+certainly better than no mic at all.
+
+BugLink: https://bugs.launchpad.net/bugs/1227093
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3331,6 +3331,7 @@ enum {
+ ALC269_FIXUP_HP_GPIO_LED,
+ ALC269_FIXUP_INV_DMIC,
+ ALC269_FIXUP_LENOVO_DOCK,
++ ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
+ ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
+ ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
+@@ -3529,6 +3530,13 @@ static const struct hda_fixup alc269_fix
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode_no_hp_mic,
+ },
++ [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ },
+ [ALC269_FIXUP_ASUS_X101_FUNC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_x101_headset_mic,
+@@ -3651,6 +3659,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
++ SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
+ SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
--- /dev/null
+From 39edac70e9aedf451fccaa851b273ace9fcca0bd Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@iki.fi>
+Date: Mon, 7 Oct 2013 19:24:52 +0300
+Subject: ALSA: hda - hdmi: Fix channel map switch not taking effect
+
+From: Anssi Hannula <anssi.hannula@iki.fi>
+
+commit 39edac70e9aedf451fccaa851b273ace9fcca0bd upstream.
+
+Currently hdmi_setup_audio_infoframe() reprograms the HDA channel
+mapping only when the infoframe is not up-to-date or the non-PCM flag
+has changed.
+
+However, when just the channel map has been changed, the infoframe may
+still be up-to-date and non-PCM flag may not have changed, so the new
+channel map is not actually programmed into the HDA codec.
+
+Notably, this failing case is also always triggered when the device is
+already in a prepared state and a new channel map is configured while
+changing only the channel positions (for example, plain
+"speaker-test -c2 -m FR,FL").
+
+Fix that by always programming the channel map in
+hdmi_setup_audio_infoframe(). Tested on Intel HDMI.
+
+Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -930,6 +930,14 @@ static void hdmi_setup_audio_infoframe(s
+ }
+
+ /*
++ * always configure channel mapping, it may have been changed by the
++ * user in the meantime
++ */
++ hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
++ channels, per_pin->chmap,
++ per_pin->chmap_set);
++
++ /*
+ * sizeof(ai) is used instead of sizeof(*hdmi_ai) or
+ * sizeof(*dp_ai) to avoid partial match/update problems when
+ * the user switches between HDMI/DP monitors.
+@@ -940,20 +948,10 @@ static void hdmi_setup_audio_infoframe(s
+ "pin=%d channels=%d\n",
+ pin_nid,
+ channels);
+- hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
+- channels, per_pin->chmap,
+- per_pin->chmap_set);
+ hdmi_stop_infoframe_trans(codec, pin_nid);
+ hdmi_fill_audio_infoframe(codec, pin_nid,
+ ai.bytes, sizeof(ai));
+ hdmi_start_infoframe_trans(codec, pin_nid);
+- } else {
+- /* For non-pcm audio switch, setup new channel mapping
+- * accordingly */
+- if (per_pin->non_pcm != non_pcm)
+- hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
+- channels, per_pin->chmap,
+- per_pin->chmap_set);
+ }
+
+ per_pin->non_pcm = non_pcm;
--- /dev/null
+From a9d14bc0b188a822e42787d01e56c06fe9750162 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Wed, 2 Oct 2013 17:49:50 +0200
+Subject: ALSA: snd-usb-usx2y: remove bogus frame checks
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit a9d14bc0b188a822e42787d01e56c06fe9750162 upstream.
+
+The frame check in i_usX2Y_urb_complete() and
+i_usX2Y_usbpcm_urb_complete() is bogus and produces false positives as
+described in this LAU thread:
+
+ http://linuxaudio.org/mailarchive/lau/2013/5/20/200177
+
+This patch removes the check code entirely.
+
+Cc: fzu@wemgehoertderstaat.de
+Reported-by: Dr Nicholas J Bailey <nicholas.bailey@glasgow.ac.uk>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/usx2y/usbusx2yaudio.c | 22 +++-------------------
+ sound/usb/usx2y/usx2yhwdeppcm.c | 7 +------
+ 2 files changed, 4 insertions(+), 25 deletions(-)
+
+--- a/sound/usb/usx2y/usbusx2yaudio.c
++++ b/sound/usb/usx2y/usbusx2yaudio.c
+@@ -299,19 +299,6 @@ static void usX2Y_error_urb_status(struc
+ usX2Y_clients_stop(usX2Y);
+ }
+
+-static void usX2Y_error_sequence(struct usX2Ydev *usX2Y,
+- struct snd_usX2Y_substream *subs, struct urb *urb)
+-{
+- snd_printk(KERN_ERR
+-"Sequence Error!(hcd_frame=%i ep=%i%s;wait=%i,frame=%i).\n"
+-"Most probably some urb of usb-frame %i is still missing.\n"
+-"Cause could be too long delays in usb-hcd interrupt handling.\n",
+- usb_get_current_frame_number(usX2Y->dev),
+- subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
+- usX2Y->wait_iso_frame, urb->start_frame, usX2Y->wait_iso_frame);
+- usX2Y_clients_stop(usX2Y);
+-}
+-
+ static void i_usX2Y_urb_complete(struct urb *urb)
+ {
+ struct snd_usX2Y_substream *subs = urb->context;
+@@ -328,12 +315,9 @@ static void i_usX2Y_urb_complete(struct
+ usX2Y_error_urb_status(usX2Y, subs, urb);
+ return;
+ }
+- if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
+- subs->completed_urb = urb;
+- else {
+- usX2Y_error_sequence(usX2Y, subs, urb);
+- return;
+- }
++
++ subs->completed_urb = urb;
++
+ {
+ struct snd_usX2Y_substream *capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE],
+ *playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK];
+--- a/sound/usb/usx2y/usx2yhwdeppcm.c
++++ b/sound/usb/usx2y/usx2yhwdeppcm.c
+@@ -244,13 +244,8 @@ static void i_usX2Y_usbpcm_urb_complete(
+ usX2Y_error_urb_status(usX2Y, subs, urb);
+ return;
+ }
+- if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
+- subs->completed_urb = urb;
+- else {
+- usX2Y_error_sequence(usX2Y, subs, urb);
+- return;
+- }
+
++ subs->completed_urb = urb;
+ capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE];
+ capsubs2 = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE + 2];
+ playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK];
--- /dev/null
+From 4871c1588f92c6c13f4713a7009f25f217055807 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <jbacik@fusionio.com>
+Date: Wed, 9 Oct 2013 12:24:04 -0400
+Subject: Btrfs: use right root when checking for hash collision
+
+From: Josef Bacik <jbacik@fusionio.com>
+
+commit 4871c1588f92c6c13f4713a7009f25f217055807 upstream.
+
+btrfs_rename was using the root of the old dir instead of the root of the new
+dir when checking for a hash collision, so if you tried to move a file into a
+subvol it would freak out because it would see the file you are trying to move
+in its current root. This fixes the bug where this would fail
+
+btrfs subvol create test1
+btrfs subvol create test2
+mv test1 test2.
+
+Thanks to Chris Murphy for catching this,
+
+Reported-by: Chris Murphy <lists@colorremedies.com>
+Signed-off-by: Josef Bacik <jbacik@fusionio.com>
+Signed-off-by: Chris Mason <chris.mason@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -8036,7 +8036,7 @@ static int btrfs_rename(struct inode *ol
+
+
+ /* check for collisions, even if the name isn't there */
+- ret = btrfs_check_dir_item_collision(root, new_dir->i_ino,
++ ret = btrfs_check_dir_item_collision(dest, new_dir->i_ino,
+ new_dentry->d_name.name,
+ new_dentry->d_name.len);
+
--- /dev/null
+From 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc Mon Sep 17 00:00:00 2001
+From: Dave Jones <davej@redhat.com>
+Date: Thu, 10 Oct 2013 20:05:35 -0400
+Subject: ext4: fix memory leak in xattr
+
+From: Dave Jones <davej@redhat.com>
+
+commit 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc upstream.
+
+If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
+potentionally return from the function without having freed these
+allocations. If we don't do the return, we over-write the previous
+allocation pointers, so we leak either way.
+
+Spotted with Coverity.
+
+[ Fixed by tytso to set is and bs to NULL after freeing these
+ pointers, in case in the retry loop we later end up triggering an
+ error causing a jump to cleanup, at which point we could have a double
+ free bug. -- Ted ]
+
+Signed-off-by: Dave Jones <davej@fedoraproject.org>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/xattr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1350,6 +1350,8 @@ retry:
+ s_min_extra_isize) {
+ tried_min_extra_isize++;
+ new_extra_isize = s_min_extra_isize;
++ kfree(is); is = NULL;
++ kfree(bs); bs = NULL;
+ goto retry;
+ }
+ error = -1;
--- /dev/null
+From 25f2bd7f5add608c1d1405938f39c96927b275ca Mon Sep 17 00:00:00 2001
+From: Henrik Rydberg <rydberg@euromail.se>
+Date: Wed, 2 Oct 2013 19:15:03 +0200
+Subject: hwmon: (applesmc) Always read until end of data
+
+From: Henrik Rydberg <rydberg@euromail.se>
+
+commit 25f2bd7f5add608c1d1405938f39c96927b275ca upstream.
+
+The crash reported and investigated in commit 5f4513 turned out to be
+caused by a change to the read interface on newer (2012) SMCs.
+
+Tests by Chris show that simply reading the data valid line is enough
+for the problem to go away. Additional tests show that the newer SMCs
+no longer wait for the number of requested bytes, but start sending
+data right away. Apparently the number of bytes to read is no longer
+specified as before, but instead found out by reading until end of
+data. Failure to read until end of data confuses the state machine,
+which eventually causes the crash.
+
+As a remedy, assuming bit0 is the read valid line, make sure there is
+nothing more to read before leaving the read function.
+
+Tested to resolve the original problem, and runtested on MBA3,1,
+MBP4,1, MBP8,2, MBP10,1, MBP10,2. The patch seems to have no effect on
+machines before 2012.
+
+Tested-by: Chris Murphy <chris@cmurf.com>
+Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/applesmc.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -230,6 +230,7 @@ static int send_argument(const char *key
+
+ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
+ {
++ u8 status, data = 0;
+ int i;
+
+ if (send_command(cmd) || send_argument(key)) {
+@@ -237,6 +238,7 @@ static int read_smc(u8 cmd, const char *
+ return -EIO;
+ }
+
++ /* This has no effect on newer (2012) SMCs */
+ if (send_byte(len, APPLESMC_DATA_PORT)) {
+ pr_warn("%.4s: read len fail\n", key);
+ return -EIO;
+@@ -250,6 +252,17 @@ static int read_smc(u8 cmd, const char *
+ buffer[i] = inb(APPLESMC_DATA_PORT);
+ }
+
++ /* Read the data port until bit0 is cleared */
++ for (i = 0; i < 16; i++) {
++ udelay(APPLESMC_MIN_WAIT);
++ status = inb(APPLESMC_CMD_PORT);
++ if (!(status & 0x01))
++ break;
++ data = inb(APPLESMC_DATA_PORT);
++ }
++ if (i)
++ pr_warn("flushed %d bytes, last value is: %d\n", i, data);
++
+ return 0;
+ }
+
--- /dev/null
+From 4cdbf7d346e7461c3b93a26707c852e2c9db3753 Mon Sep 17 00:00:00 2001
+From: Taras Kondratiuk <taras.kondratiuk@linaro.org>
+Date: Mon, 7 Oct 2013 13:41:59 +0300
+Subject: i2c: omap: Clear ARDY bit twice
+
+From: Taras Kondratiuk <taras.kondratiuk@linaro.org>
+
+commit 4cdbf7d346e7461c3b93a26707c852e2c9db3753 upstream.
+
+Initially commit cb527ede1bf6ff2008a025606f25344b8ed7b4ac
+"i2c-omap: Double clear of ARDY status in IRQ handler"
+added a workaround for undocumented errata ProDB0017052.
+But then commit 1d7afc95946487945cc7f5019b41255b72224b70
+"i2c: omap: ack IRQ in parts" refactored code and missed
+one of ARDY clearings. So current code violates errata.
+It causes often i2c bus timeouts on my Pandaboard.
+
+This patch adds a second clearing in place.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Taras Kondratiuk <taras.kondratiuk@linaro.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-omap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -944,6 +944,9 @@ omap_i2c_isr_thread(int this_irq, void *
+ /*
+ * ProDB0017052: Clear ARDY bit twice
+ */
++ if (stat & OMAP_I2C_STAT_ARDY)
++ omap_i2c_ack_stat(dev, OMAP_I2C_STAT_ARDY);
++
+ if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
+ OMAP_I2C_STAT_AL)) {
+ omap_i2c_ack_stat(dev, (OMAP_I2C_STAT_RRDY |
--- /dev/null
+From cfc860253abd73e1681696c08ea268d33285a2c4 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Sat, 21 Sep 2013 09:53:28 +1000
+Subject: KVM: PPC: Book3S HV: Fix typo in saving DSCR
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit cfc860253abd73e1681696c08ea268d33285a2c4 upstream.
+
+This fixes a typo in the code that saves the guest DSCR (Data Stream
+Control Register) into the kvm_vcpu_arch struct on guest exit. The
+effect of the typo was that the DSCR value was saved in the wrong place,
+so changes to the DSCR by the guest didn't persist across guest exit
+and entry, and some host kernel memory got corrupted.
+
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Acked-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -1054,7 +1054,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
+ BEGIN_FTR_SECTION
+ mfspr r8, SPRN_DSCR
+ ld r7, HSTATE_DSCR(r13)
+- std r8, VCPU_DSCR(r7)
++ std r8, VCPU_DSCR(r9)
+ mtspr SPRN_DSCR, r7
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
+
--- /dev/null
+From 59b33f148cc08fb33cbe823fca1e34f7f023765e Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 1 Oct 2013 21:54:46 +0200
+Subject: parisc: fix interruption handler to respect pagefault_disable()
+
+From: Helge Deller <deller@gmx.de>
+
+commit 59b33f148cc08fb33cbe823fca1e34f7f023765e upstream.
+
+Running an "echo t > /proc/sysrq-trigger" crashes the parisc kernel. The
+problem is, that in print_worker_info() we try to read the workqueue info via
+the probe_kernel_read() functions which use pagefault_disable() to avoid
+crashes like this:
+ probe_kernel_read(&pwq, &worker->current_pwq, sizeof(pwq));
+ probe_kernel_read(&wq, &pwq->wq, sizeof(wq));
+ probe_kernel_read(name, wq->name, sizeof(name) - 1);
+
+The problem here is, that the first probe_kernel_read(&pwq) might return zero
+in pwq and as such the following probe_kernel_reads() try to access contents of
+the page zero which is read protected and generate a kernel segfault.
+
+With this patch we fix the interruption handler to call parisc_terminate()
+directly only if pagefault_disable() was not called (in which case
+preempt_count()==0). Otherwise we hand over to the pagefault handler which
+will try to look up the faulting address in the fixup tables.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/traps.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -805,14 +805,14 @@ void notrace handle_interruption(int cod
+ else {
+
+ /*
+- * The kernel should never fault on its own address space.
++ * The kernel should never fault on its own address space,
++ * unless pagefault_disable() was called before.
+ */
+
+- if (fault_space == 0)
++ if (fault_space == 0 && !in_atomic())
+ {
+ pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
+ parisc_terminate("Kernel Fault", regs, code, fault_address);
+-
+ }
+ }
+
--- /dev/null
+From 47d06e532e95b71c0db3839ebdef3fe8812fca2c Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Tue, 10 Sep 2013 10:52:35 -0400
+Subject: random: run random_int_secret_init() run after all late_initcalls
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 47d06e532e95b71c0db3839ebdef3fe8812fca2c upstream.
+
+The some platforms (e.g., ARM) initializes their clocks as
+late_initcalls for some unknown reason. So make sure
+random_int_secret_init() is run after all of the late_initcalls are
+run.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/random.c | 3 +--
+ include/linux/random.h | 1 +
+ init/main.c | 2 ++
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1462,12 +1462,11 @@ struct ctl_table random_table[] = {
+
+ static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+
+-static int __init random_int_secret_init(void)
++int random_int_secret_init(void)
+ {
+ get_random_bytes(random_int_secret, sizeof(random_int_secret));
+ return 0;
+ }
+-late_initcall(random_int_secret_init);
+
+ /*
+ * Get a random word for internal kernel use only. Similar to urandom but
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -17,6 +17,7 @@ extern void add_interrupt_randomness(int
+ extern void get_random_bytes(void *buf, int nbytes);
+ extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
++extern int random_int_secret_init(void);
+
+ #ifndef MODULE
+ extern const struct file_operations random_fops, urandom_fops;
+--- a/init/main.c
++++ b/init/main.c
+@@ -75,6 +75,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/elevator.h>
+ #include <linux/sched_clock.h>
++#include <linux/random.h>
+
+ #include <asm/io.h>
+ #include <asm/bugs.h>
+@@ -778,6 +779,7 @@ static void __init do_basic_setup(void)
+ do_ctors();
+ usermodehelper_enable();
+ do_initcalls();
++ random_int_secret_init();
+ }
+
+ static void __init do_pre_smp_initcalls(void)
--- /dev/null
+alsa-snd-usb-usx2y-remove-bogus-frame-checks.patch
+alsa-hda-hdmi-fix-channel-map-switch-not-taking-effect.patch
+alsa-hda-add-fixup-for-asus-n56vz.patch
+alsa-hda-fix-microphone-for-sony-vaio-pro-13-haswell.patch
+random-run-random_int_secret_init-run-after-all-late_initcalls.patch
+vfs-allow-o_path-file-descriptors-for-fstatfs.patch
+i2c-omap-clear-ardy-bit-twice.patch
+hwmon-applesmc-always-read-until-end-of-data.patch
+btrfs-use-right-root-when-checking-for-hash-collision.patch
+ext4-fix-memory-leak-in-xattr.patch
+kvm-ppc-book3s-hv-fix-typo-in-saving-dscr.patch
+parisc-fix-interruption-handler-to-respect-pagefault_disable.patch
--- /dev/null
+From 9d05746e7b16d8565dddbe3200faa1e669d23bbf Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 30 Sep 2013 08:35:10 -0700
+Subject: vfs: allow O_PATH file descriptors for fstatfs()
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 9d05746e7b16d8565dddbe3200faa1e669d23bbf upstream.
+
+Olga reported that file descriptors opened with O_PATH do not work with
+fstatfs(), found during further development of ksh93's thread support.
+
+There is no reason to not allow O_PATH file descriptors here (fstatfs is
+very much a path operation), so use "fdget_raw()". See commit
+55815f70147d ("vfs: make O_PATH file descriptors usable for 'fstat()'")
+for a very similar issue reported for fstat() by the same team.
+
+Reported-and-tested-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/statfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/statfs.c
++++ b/fs/statfs.c
+@@ -94,7 +94,7 @@ retry:
+
+ int fd_statfs(int fd, struct kstatfs *st)
+ {
+- struct fd f = fdget(fd);
++ struct fd f = fdget_raw(fd);
+ int error = -EBADF;
+ if (f.file) {
+ error = vfs_statfs(&f.file->f_path, st);
projects / thirdparty / kernel / stable-queue.git / commitdiff
