--- /dev/null
+From b4df463678fb9c6dae9548dbb7545993779fd416 Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Mon, 15 Dec 2014 16:01:29 +0800
+Subject: ACPI / video: update the skip case for acpi_video_device_in_dod()
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+commit b4df463678fb9c6dae9548dbb7545993779fd416 upstream.
+
+If the firmware has declared more than 8 video output devices, and the
+one that control the internal panel's backlight is listed after the
+first 8 output devices, the _DOD will not include it due to the current
+i915 operation region implementation. As a result, we will not create a
+backlight device for it while we should. Solve this problem by special
+case the firmware that has 8+ output devices in that if we see such a
+firmware, we do not test if the device is in _DOD list. The creation of
+the backlight device will also enable the firmware to emit events on
+backlight hotkey press when the acpi_osi= cmdline option is specified on
+those affected ASUS laptops.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=70241
+Reported-and-tested-by: Oleksij Rempel <linux@rempel-privat.de>
+Reported-and-tested-by: Dmitry Tunin <hanipouspilot@gmail.com>
+Reported-and-tested-by: Jimbo <jaime.91@hotmail.es>
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -155,6 +155,7 @@ struct acpi_video_bus {
+ u8 dos_setting;
+ struct acpi_video_enumerated_device *attached_array;
+ u8 attached_count;
++ u8 child_count;
+ struct acpi_video_bus_cap cap;
+ struct acpi_video_bus_flags flags;
+ struct list_head video_device_list;
+@@ -1159,8 +1160,12 @@ static bool acpi_video_device_in_dod(str
+ struct acpi_video_bus *video = device->video;
+ int i;
+
+- /* If we have a broken _DOD, no need to test */
+- if (!video->attached_count)
++ /*
++ * If we have a broken _DOD or we have more than 8 output devices
++ * under the graphics controller node that we can't proper deal with
++ * in the operation region code currently, no need to test.
++ */
++ if (!video->attached_count || video->child_count > 8)
+ return true;
+
+ for (i = 0; i < video->attached_count; i++) {
+@@ -1413,6 +1418,7 @@ acpi_video_bus_get_devices(struct acpi_v
+ dev_err(&dev->dev, "Can't attach device\n");
+ break;
+ }
++ video->child_count++;
+ }
+ return status;
+ }
--- /dev/null
+From ef17af2a817db97d42dd2ec0a425231748e23dbc Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Fri, 5 Dec 2014 16:40:07 +0100
+Subject: fs: nfsd: Fix signedness bug in compare_blob
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+commit ef17af2a817db97d42dd2ec0a425231748e23dbc upstream.
+
+Bugs similar to the one in acbbe6fbb240 (kcmp: fix standard comparison
+bug) are in rich supply.
+
+In this variant, the problem is that struct xdr_netobj::len has type
+unsigned int, so the expression o1->len - o2->len _also_ has type
+unsigned int; it has completely well-defined semantics, and the result
+is some non-negative integer, which is always representable in a long
+long. But this means that if the conditional triggers, we are
+guaranteed to return a positive value from compare_blob.
+
+In this case it could be fixed by
+
+- res = o1->len - o2->len;
++ res = (long long)o1->len - (long long)o2->len;
+
+but I'd rather eliminate the usually broken 'return a - b;' idiom.
+
+Reviewed-by: Jeff Layton <jlayton@primarydata.com>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4state.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1711,15 +1711,14 @@ static int copy_cred(struct svc_cred *ta
+ return 0;
+ }
+
+-static long long
++static int
+ compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
+ {
+- long long res;
+-
+- res = o1->len - o2->len;
+- if (res)
+- return res;
+- return (long long)memcmp(o1->data, o2->data, o1->len);
++ if (o1->len < o2->len)
++ return -1;
++ if (o1->len > o2->len)
++ return 1;
++ return memcmp(o1->data, o2->data, o1->len);
+ }
+
+ static int same_name(const char *n1, const char *n2)
+@@ -1907,7 +1906,7 @@ add_clp_to_name_tree(struct nfs4_client
+ static struct nfs4_client *
+ find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
+ {
+- long long cmp;
++ int cmp;
+ struct rb_node *node = root->rb_node;
+ struct nfs4_client *clp;
+
--- /dev/null
+From 94ae1db226a5bcbb48372d81161f084c9e283fd8 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@primarydata.com>
+Date: Sat, 13 Dec 2014 09:11:39 -0500
+Subject: nfsd: fix fi_delegees leak when fi_had_conflict returns true
+
+From: Jeff Layton <jlayton@primarydata.com>
+
+commit 94ae1db226a5bcbb48372d81161f084c9e283fd8 upstream.
+
+Currently, nfs4_set_delegation takes a reference to an existing
+delegation and then checks to see if there is a conflict. If there is
+one, then it doesn't release that reference.
+
+Change the code to take the reference after the check and only if there
+is no conflict.
+
+Signed-off-by: Jeff Layton <jlayton@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3890,11 +3890,11 @@ nfs4_set_delegation(struct nfs4_client *
+ status = nfs4_setlease(dp);
+ goto out;
+ }
+- atomic_inc(&fp->fi_delegees);
+ if (fp->fi_had_conflict) {
+ status = -EAGAIN;
+ goto out_unlock;
+ }
++ atomic_inc(&fp->fi_delegees);
+ hash_delegation_locked(dp, fp);
+ status = 0;
+ out_unlock:
--- /dev/null
+From bf7491f1be5e125eece2ec67e0f79d513caa6c7e Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Sun, 7 Dec 2014 16:05:48 -0500
+Subject: nfsd4: fix xdr4 count of server in fs_location4
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+commit bf7491f1be5e125eece2ec67e0f79d513caa6c7e upstream.
+
+Fix a bug where nfsd4_encode_components_esc() incorrectly calculates the
+length of server array in fs_location4--note that it is a count of the
+number of array elements, not a length in bytes.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Fixes: 082d4bd72a45 (nfsd4: "backfill" using write_bytes_to_xdr_buf)
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1800,7 +1800,7 @@ static __be32 nfsd4_encode_components_es
+
+ str = end;
+ }
+- pathlen = htonl(xdr->buf->len - pathlen_offset);
++ pathlen = htonl(count);
+ write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4);
+ return 0;
+ }
--- /dev/null
+From 5a64e56976f1ba98743e1678c0029a98e9034c81 Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Sun, 7 Dec 2014 16:05:47 -0500
+Subject: nfsd4: fix xdr4 inclusion of escaped char
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+commit 5a64e56976f1ba98743e1678c0029a98e9034c81 upstream.
+
+Fix a bug where nfsd4_encode_components_esc() includes the esc_end char as
+an additional string encoding.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Fixes: e7a0444aef4a "nfsd: add IPv6 addr escaping to fs_location hosts"
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -1795,6 +1795,9 @@ static __be32 nfsd4_encode_components_es
+ }
+ else
+ end++;
++ if (found_esc)
++ end = next;
++
+ str = end;
+ }
+ pathlen = htonl(xdr->buf->len - pathlen_offset);
n_tty-fix-read_buf-race-condition-increment-read_head-after-pushing-data.patch
drivers-hv-vmbus-fix-a-race-condition-when-unregistering-a-device.patch
drivers-hv-util-make-struct-hv_do_fcopy-match-hyper-v-host-messages.patch
+fs-nfsd-fix-signedness-bug-in-compare_blob.patch
+nfsd4-fix-xdr4-inclusion-of-escaped-char.patch
+nfsd4-fix-xdr4-count-of-server-in-fs_location4.patch
+nfsd-fix-fi_delegees-leak-when-fi_had_conflict-returns-true.patch
+acpi-video-update-the-skip-case-for-acpi_video_device_in_dod.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
