--- /dev/null
+From f853c616883a8de966873a1dab283f1369e275a1 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 11 Mar 2013 09:52:19 -0400
+Subject: cifs: ignore everything in SPNEGO blob after mechTypes
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit f853c616883a8de966873a1dab283f1369e275a1 upstream.
+
+We've had several reports of people attempting to mount Windows 8 shares
+and getting failures with a return code of -EINVAL. The default sec=
+mode changed recently to sec=ntlmssp. With that, we expect and parse a
+SPNEGO blob from the server in the NEGOTIATE reply.
+
+The current decode_negTokenInit function first parses all of the
+mechTypes and then tries to parse the rest of the negTokenInit reply.
+The parser however currently expects a mechListMIC or nothing to follow the
+mechTypes, but Windows 8 puts a mechToken field there instead to carry
+some info for the new NegoEx stuff.
+
+In practice, we don't do anything with the fields after the mechTypes
+anyway so I don't see any real benefit in continuing to parse them.
+This patch just has the kernel ignore the fields after the mechTypes.
+We'll probably need to reinstate some of this if we ever want to support
+NegoEx.
+
+Reported-by: Jason Burgess <jason@jacknife2.dns2go.com>
+Reported-by: Yan Li <elliot.li.tech@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/asn1.c | 53 +++++------------------------------------------------
+ 1 file changed, 5 insertions(+), 48 deletions(-)
+
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *secur
+ }
+ }
+
+- /* mechlistMIC */
+- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+- /* Check if we have reached the end of the blob, but with
+- no mechListMic (e.g. NTLMSSP instead of KRB5) */
+- if (ctx.error == ASN1_ERR_DEC_EMPTY)
+- goto decode_negtoken_exit;
+- cFYI(1, "Error decoding last part negTokenInit exit3");
+- return 0;
+- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+- /* tag = 3 indicating mechListMIC */
+- cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
+- cls, con, tag, end, *end);
+- return 0;
+- }
+-
+- /* sequence */
+- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+- cFYI(1, "Error decoding last part negTokenInit exit5");
+- return 0;
+- } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+- || (tag != ASN1_SEQ)) {
+- cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
+- cls, con, tag, end, *end);
+- }
+-
+- /* sequence of */
+- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+- cFYI(1, "Error decoding last part negTokenInit exit 7");
+- return 0;
+- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+- cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
+- cls, con, tag, end, *end);
+- return 0;
+- }
+-
+- /* general string */
+- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+- cFYI(1, "Error decoding last part negTokenInit exit9");
+- return 0;
+- } else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+- || (tag != ASN1_GENSTR)) {
+- cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
+- cls, con, tag, end, *end);
+- return 0;
+- }
+- cFYI(1, "Need to call asn1_octets_decode() function for %s",
+- ctx.pointer); /* is this UTF-8 or ASCII? */
+-decode_negtoken_exit:
++ /*
++ * We currently ignore anything at the end of the SPNEGO blob after
++ * the mechTypes have been parsed, since none of that info is
++ * used at the moment.
++ */
+ return 1;
+ }
--- /dev/null
+From b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 8 Mar 2013 13:36:54 -0500
+Subject: drm/radeon: add Richland pci ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f upstream.
+
+Reviewed-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_pciids.h | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -572,7 +572,11 @@
+ {0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+- {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+@@ -583,6 +587,13 @@
+ {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
--- /dev/null
+From e4d170633fde379f39a90f8a5e7eb619b5d1144d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 8 Mar 2013 13:44:15 -0500
+Subject: drm/radeon: add support for Richland APUs
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e4d170633fde379f39a90f8a5e7eb619b5d1144d upstream.
+
+Richland APUs are a new version of the Trinity APUs
+with performance and power management improvements.
+
+Reviewed-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -663,13 +663,19 @@ static void cayman_gpu_init(struct radeo
+ (rdev->pdev->device == 0x9907) ||
+ (rdev->pdev->device == 0x9908) ||
+ (rdev->pdev->device == 0x9909) ||
++ (rdev->pdev->device == 0x990B) ||
++ (rdev->pdev->device == 0x990C) ||
++ (rdev->pdev->device == 0x990F) ||
+ (rdev->pdev->device == 0x9910) ||
+- (rdev->pdev->device == 0x9917)) {
++ (rdev->pdev->device == 0x9917) ||
++ (rdev->pdev->device == 0x9999)) {
+ rdev->config.cayman.max_simds_per_se = 6;
+ rdev->config.cayman.max_backends_per_se = 2;
+ } else if ((rdev->pdev->device == 0x9903) ||
+ (rdev->pdev->device == 0x9904) ||
+ (rdev->pdev->device == 0x990A) ||
++ (rdev->pdev->device == 0x990D) ||
++ (rdev->pdev->device == 0x990E) ||
+ (rdev->pdev->device == 0x9913) ||
+ (rdev->pdev->device == 0x9918)) {
+ rdev->config.cayman.max_simds_per_se = 4;
+@@ -678,6 +684,9 @@ static void cayman_gpu_init(struct radeo
+ (rdev->pdev->device == 0x9990) ||
+ (rdev->pdev->device == 0x9991) ||
+ (rdev->pdev->device == 0x9994) ||
++ (rdev->pdev->device == 0x9995) ||
++ (rdev->pdev->device == 0x9996) ||
++ (rdev->pdev->device == 0x999A) ||
+ (rdev->pdev->device == 0x99A0)) {
+ rdev->config.cayman.max_simds_per_se = 3;
+ rdev->config.cayman.max_backends_per_se = 1;
--- /dev/null
+From fa8d387dc3f62062a6b4afbbb2a3438094fd8584 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 12 Mar 2013 12:53:13 -0400
+Subject: drm/radeon/benchmark: make sure bo blit copy exists before using it
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fa8d387dc3f62062a6b4afbbb2a3438094fd8584 upstream.
+
+Fixes a segfault on asics without a blit callback.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=62239
+
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_benchmark.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
+@@ -141,13 +141,15 @@ static void radeon_benchmark_move(struct
+ sdomain, ddomain, "dma");
+ }
+
+- time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+- RADEON_BENCHMARK_COPY_BLIT, n);
+- if (time < 0)
+- goto out_cleanup;
+- if (time > 0)
+- radeon_benchmark_log_results(n, size, time,
+- sdomain, ddomain, "blit");
++ if (rdev->asic->copy.blit) {
++ time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
++ RADEON_BENCHMARK_COPY_BLIT, n);
++ if (time < 0)
++ goto out_cleanup;
++ if (time > 0)
++ radeon_benchmark_log_results(n, size, time,
++ sdomain, ddomain, "blit");
++ }
+
+ out_cleanup:
+ if (sobj) {
--- /dev/null
+From 3a2256702e47f68f921dfad41b1764d05c572329 Mon Sep 17 00:00:00 2001
+From: Zheng Liu <wenqing.lz@taobao.com>
+Date: Sun, 10 Mar 2013 21:20:23 -0400
+Subject: ext4: fix the wrong number of the allocated blocks in ext4_split_extent()
+
+From: Zheng Liu <wenqing.lz@taobao.com>
+
+commit 3a2256702e47f68f921dfad41b1764d05c572329 upstream.
+
+This commit fixes a wrong return value of the number of the allocated
+blocks in ext4_split_extent. When the length of blocks we want to
+allocate is greater than the length of the current extent, we return a
+wrong number. Let's see what happens in the following case when we
+call ext4_split_extent().
+
+ map: [48, 72]
+ ex: [32, 64, u]
+
+'ex' will be split into two parts:
+ ex1: [32, 47, u]
+ ex2: [48, 64, w]
+
+'map->m_len' is returned from this function, and the value is 24. But
+the real length is 16. So it should be fixed.
+
+Meanwhile in this commit we use right length of the allocated blocks
+when get_reserved_cluster_alloc in ext4_ext_handle_uninitialized_extents
+is called.
+
+Signed-off-by: Zheng Liu <wenqing.lz@taobao.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Cc: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2959,6 +2959,7 @@ static int ext4_split_extent(handle_t *h
+ int err = 0;
+ int uninitialized;
+ int split_flag1, flags1;
++ int allocated = map->m_len;
+
+ depth = ext_depth(inode);
+ ex = path[depth].p_ext;
+@@ -2978,6 +2979,8 @@ static int ext4_split_extent(handle_t *h
+ map->m_lblk + map->m_len, split_flag1, flags1);
+ if (err)
+ goto out;
++ } else {
++ allocated = ee_len - (map->m_lblk - ee_block);
+ }
+
+ ext4_ext_drop_refs(path);
+@@ -3000,7 +3003,7 @@ static int ext4_split_extent(handle_t *h
+
+ ext4_ext_show_leaf(inode, path);
+ out:
+- return err ? err : map->m_len;
++ return err ? err : allocated;
+ }
+
+ #define EXT4_EXT_ZERO_LEN 7
+@@ -3668,6 +3671,7 @@ out:
+ allocated - map->m_len);
+ allocated = map->m_len;
+ }
++ map->m_len = allocated;
+
+ /*
+ * If we have done fallocate with the offset that is already
--- /dev/null
+From ad56edad089b56300fd13bb9eeb7d0424d978239 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 11 Mar 2013 13:24:56 -0400
+Subject: jbd2: fix use after free in jbd2_journal_dirty_metadata()
+
+From: Jan Kara <jack@suse.cz>
+
+commit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream.
+
+jbd2_journal_dirty_metadata() didn't get a reference to journal_head it
+was working with. This is OK in most of the cases since the journal head
+should be attached to a transaction but in rare occasions when we are
+journalling data, __ext4_journalled_writepage() can race with
+jbd2_journal_invalidatepage() stripping buffers from a page and thus
+journal head can be freed under hands of jbd2_journal_dirty_metadata().
+
+Fix the problem by getting own journal head reference in
+jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()
+which can possibly have the same issue).
+
+Reported-by: Zheng Liu <gnehzuil.liu@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1047,9 +1047,12 @@ out:
+ void jbd2_journal_set_triggers(struct buffer_head *bh,
+ struct jbd2_buffer_trigger_type *type)
+ {
+- struct journal_head *jh = bh2jh(bh);
++ struct journal_head *jh = jbd2_journal_grab_journal_head(bh);
+
++ if (WARN_ON(!jh))
++ return;
+ jh->b_triggers = type;
++ jbd2_journal_put_journal_head(jh);
+ }
+
+ void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
+@@ -1101,17 +1104,18 @@ int jbd2_journal_dirty_metadata(handle_t
+ {
+ transaction_t *transaction = handle->h_transaction;
+ journal_t *journal = transaction->t_journal;
+- struct journal_head *jh = bh2jh(bh);
++ struct journal_head *jh;
+ int ret = 0;
+
+- jbd_debug(5, "journal_head %p\n", jh);
+- JBUFFER_TRACE(jh, "entry");
+ if (is_handle_aborted(handle))
+ goto out;
+- if (!buffer_jbd(bh)) {
++ jh = jbd2_journal_grab_journal_head(bh);
++ if (!jh) {
+ ret = -EUCLEAN;
+ goto out;
+ }
++ jbd_debug(5, "journal_head %p\n", jh);
++ JBUFFER_TRACE(jh, "entry");
+
+ jbd_lock_bh_state(bh);
+
+@@ -1202,6 +1206,7 @@ int jbd2_journal_dirty_metadata(handle_t
+ spin_unlock(&journal->j_list_lock);
+ out_unlock_bh:
+ jbd_unlock_bh_state(bh);
++ jbd2_journal_put_journal_head(jh);
+ out:
+ JBUFFER_TRACE(jh, "exit");
+ WARN_ON(ret); /* All errors are bugs, so dump the stack */
kms-fix-edid-detailed-timing-frame-rate.patch
mm-hugetlb-fix-total-hugetlbfs-pages-count-when-using-memory-overcommit-accouting.patch
target-iscsi-fix-mutual-chap-auth-on-big-endian-arches.patch
+drm-radeon-add-richland-pci-ids.patch
+drm-radeon-add-support-for-richland-apus.patch
+drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch
+cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch
+jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch
+ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
