]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.2-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 13 Feb 2012 20:17:15 +0000 (12:17 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 13 Feb 2012 20:17:15 +0000 (12:17 -0800)
added patches:
ath9k-fix-a-wep-crypto-related-regression.patch
ath9k-fix-kernel-panic-during-driver-initilization.patch
ath9k_hw-fix-a-rts-cts-timeout-regression.patch
hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch
lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch
mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch
net-enable-tc35815-for-mips-again.patch
relay-prevent-integer-overflow-in-relay_open.patch
writeback-fix-dereferencing-null-bdi-dev-on-trace_writeback_queue.patch
writeback-fix-null-bdi-dev-in-trace-writeback_single_inode.patch

queue-3.2/ath9k-fix-a-wep-crypto-related-regression.patch [new file with mode: 0644]
queue-3.2/ath9k-fix-kernel-panic-during-driver-initilization.patch [new file with mode: 0644]
queue-3.2/ath9k_hw-fix-a-rts-cts-timeout-regression.patch [new file with mode: 0644]
queue-3.2/hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch [new file with mode: 0644]
queue-3.2/lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch [new file with mode: 0644]
queue-3.2/mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch [new file with mode: 0644]
queue-3.2/net-enable-tc35815-for-mips-again.patch [new file with mode: 0644]
queue-3.2/relay-prevent-integer-overflow-in-relay_open.patch [new file with mode: 0644]
queue-3.2/series
queue-3.2/writeback-fix-dereferencing-null-bdi-dev-on-trace_writeback_queue.patch [new file with mode: 0644]
queue-3.2/writeback-fix-null-bdi-dev-in-trace-writeback_single_inode.patch [new file with mode: 0644]

diff --git a/queue-3.2/ath9k-fix-a-wep-crypto-related-regression.patch b/queue-3.2/ath9k-fix-a-wep-crypto-related-regression.patch
new file mode 100644 (file)
index 0000000..40fc01b
--- /dev/null
@@ -0,0 +1,43 @@
+From f88373fa47f3ce6590fdfaa742d0ddacc2ae017f Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 5 Feb 2012 21:15:17 +0100
+Subject: ath9k: fix a WEP crypto related regression
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit f88373fa47f3ce6590fdfaa742d0ddacc2ae017f upstream.
+
+commit b4a82a0 "ath9k_hw: fix interpretation of the rx KeyMiss flag"
+fixed the interpretation of the KeyMiss flag for keycache based lookups,
+however WEP encryption uses a static index, so KeyMiss is always asserted
+for it, even though frames are decrypted properly.
+Fix this by clearing the ATH9K_RXERR_KEYMISS flag if no keycache based
+lookup was performed.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Laurent Bonnans <bonnans.l@gmail.com>
+Reported-by: Jurica Vukadin <u.ra604@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/recv.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -824,6 +824,14 @@ static bool ath9k_rx_accept(struct ath_c
+               (ATH9K_RXERR_DECRYPT | ATH9K_RXERR_CRC | ATH9K_RXERR_MIC |
+                ATH9K_RXERR_KEYMISS));
++      /*
++       * Key miss events are only relevant for pairwise keys where the
++       * descriptor does contain a valid key index. This has been observed
++       * mostly with CCMP encryption.
++       */
++      if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
++              rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
++
+       if (!rx_stats->rs_datalen)
+               return false;
+         /*
diff --git a/queue-3.2/ath9k-fix-kernel-panic-during-driver-initilization.patch b/queue-3.2/ath9k-fix-kernel-panic-during-driver-initilization.patch
new file mode 100644 (file)
index 0000000..0557cec
--- /dev/null
@@ -0,0 +1,94 @@
+From 07445f688218a48bde72316aed9de4fdcc173131 Mon Sep 17 00:00:00 2001
+From: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
+Date: Thu, 2 Feb 2012 16:29:05 +0530
+Subject: ath9k: Fix kernel panic during driver initilization
+
+From: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
+
+commit 07445f688218a48bde72316aed9de4fdcc173131 upstream.
+
+all works need to be initialized before ieee80211_register_hw
+to prevent mac80211 call backs such as drv_start, drv_config
+getting started. otherwise we would queue/cancel works before
+initializing them and it leads to kernel panic.
+this issue can be recreated with the following script
+in Chrome laptops with AR928X cards, with background scan
+running (or) Network manager is running
+
+while true
+do
+sudo modprobe -v ath9k
+sleep 3
+sudo modprobe -r ath9k
+sleep 3
+done
+
+        EIP: [<81040a47>] __cancel_work_timer+0xb8/0xe1 SS:ESP 0068:f6be9d70
+        ---[ end trace 4f86d6139a9900ef ]---
+        Registered led device: ath9k-phy0
+        ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xf88a0000,
+        irq=16
+        Kernel panic - not syncing: Fatal exception
+        Pid: 456, comm: wpa_supplicant Tainted: G      D
+        3.0.13 #1
+       Call Trace:
+        [<81379e21>] panic+0x53/0x14a
+        [<81004a30>] oops_end+0x73/0x81
+        [<81004b53>] die+0x4c/0x55
+        [<81002710>] do_trap+0x7c/0x83
+        [<81002855>] ? do_bounds+0x58/0x58
+        [<810028cc>] do_invalid_op+0x77/0x81
+        [<81040a47>] ? __cancel_work_timer+0xb8/0xe1
+        [<810489ec>] ? sched_clock_cpu+0x81/0x11f
+        [<8103f809>] ? wait_on_work+0xe2/0xf7
+        [<8137f807>] error_code+0x67/0x6c
+        [<810300d8>] ? wait_consider_task+0x4ba/0x84c
+        [<81040a47>] ? __cancel_work_timer+0xb8/0xe1
+        [<810380c9>] ? try_to_del_timer_sync+0x5f/0x67
+        [<81040a91>] cancel_work_sync+0xf/0x11
+        [<f88d7b7c>] ath_set_channel+0x62/0x25c [ath9k]
+        [<f88d67d1>] ? ath9k_tx_last_beacon+0x26a/0x85c [ath9k]
+        [<f88d8899>] ath_radio_disable+0x3f1/0x68e [ath9k]
+        [<f90d0edb>] ieee80211_hw_config+0x111/0x116 [mac80211]
+        [<f90dd95c>] __ieee80211_recalc_idle+0x919/0xa37 [mac80211]
+        [<f90dda76>] __ieee80211_recalc_idle+0xa33/0xa37 [mac80211]
+        [<812dbed8>] __dev_open+0x82/0xab
+
+Cc: Gary Morain <gmorain@google.com>
+Cc: Paul Stewart <pstew@google.com>
+Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
+Tested-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
+Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/init.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -775,6 +775,11 @@ int ath9k_init_device(u16 devid, struct
+               ARRAY_SIZE(ath9k_tpt_blink));
+ #endif
++      INIT_WORK(&sc->hw_reset_work, ath_reset_work);
++      INIT_WORK(&sc->hw_check_work, ath_hw_check);
++      INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
++      INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
++
+       /* Register with mac80211 */
+       error = ieee80211_register_hw(hw);
+       if (error)
+@@ -793,10 +798,6 @@ int ath9k_init_device(u16 devid, struct
+                       goto error_world;
+       }
+-      INIT_WORK(&sc->hw_reset_work, ath_reset_work);
+-      INIT_WORK(&sc->hw_check_work, ath_hw_check);
+-      INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
+-      INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
+       sc->last_rssi = ATH_RSSI_DUMMY_MARKER;
+       ath_init_leds(sc);
diff --git a/queue-3.2/ath9k_hw-fix-a-rts-cts-timeout-regression.patch b/queue-3.2/ath9k_hw-fix-a-rts-cts-timeout-regression.patch
new file mode 100644 (file)
index 0000000..7892e8f
--- /dev/null
@@ -0,0 +1,50 @@
+From 55a2bb4a6d5e8c7b324d003e130fd9aaf33be4e6 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 5 Feb 2012 21:15:18 +0100
+Subject: ath9k_hw: fix a RTS/CTS timeout regression
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 55a2bb4a6d5e8c7b324d003e130fd9aaf33be4e6 upstream.
+
+commit adb5066 "ath9k_hw: do not apply the 2.4 ghz ack timeout
+workaround to cts" reduced the hardware CTS timeout to the normal
+values specified by the standard, but it turns out while it doesn't
+need the same extra time that it needs for the ACK timeout, it
+does need more than the value specified in the standard, but only
+for 2.4 GHz.
+
+This patch brings the CTS timeout value in sync with the initialization
+values, while still allowing adjustment for bigger distances.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Seth Forshee <seth.forshee@canonical.com>
+Reported-by: Marek Lindner <lindner_marek@yahoo.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1034,13 +1034,16 @@ void ath9k_hw_init_global_settings(struc
+       /*
+        * Workaround for early ACK timeouts, add an offset to match the
+-       * initval's 64us ack timeout value.
++       * initval's 64us ack timeout value. Use 48us for the CTS timeout.
+        * This was initially only meant to work around an issue with delayed
+        * BA frames in some implementations, but it has been found to fix ACK
+        * timeout issues in other cases as well.
+        */
+-      if (conf->channel && conf->channel->band == IEEE80211_BAND_2GHZ)
++      if (conf->channel && conf->channel->band == IEEE80211_BAND_2GHZ) {
+               acktimeout += 64 - sifstime - ah->slottime;
++              ctstimeout += 48 - sifstime - ah->slottime;
++      }
++
+       ath9k_hw_set_sifs_time(ah, sifstime);
+       ath9k_hw_setslottime(ah, slottime);
diff --git a/queue-3.2/hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch b/queue-3.2/hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch
new file mode 100644 (file)
index 0000000..55139f7
--- /dev/null
@@ -0,0 +1,31 @@
+From eb2f255b2d360df3f500042a2258dcf2fcbe89a2 Mon Sep 17 00:00:00 2001
+From: Nikolaus Schulz <schulz@macnetix.de>
+Date: Wed, 8 Feb 2012 18:56:10 +0100
+Subject: hwmon: (f75375s) Fix bit shifting in f75375_write16
+
+From: Nikolaus Schulz <schulz@macnetix.de>
+
+commit eb2f255b2d360df3f500042a2258dcf2fcbe89a2 upstream.
+
+In order to extract the high byte of the 16-bit word, shift the word to
+the right, not to the left.
+
+Signed-off-by: Nikolaus Schulz <mail@microschulz.de>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/f75375s.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/f75375s.c
++++ b/drivers/hwmon/f75375s.c
+@@ -159,7 +159,7 @@ static inline void f75375_write8(struct
+ static inline void f75375_write16(struct i2c_client *client, u8 reg,
+               u16 value)
+ {
+-      int err = i2c_smbus_write_byte_data(client, reg, (value << 8));
++      int err = i2c_smbus_write_byte_data(client, reg, (value >> 8));
+       if (err)
+               return;
+       i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
diff --git a/queue-3.2/lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch b/queue-3.2/lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch
new file mode 100644 (file)
index 0000000..1d31ace
--- /dev/null
@@ -0,0 +1,45 @@
+From 3310225dfc71a35a2cc9340c15c0e08b14b3c754 Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Mon, 9 Jan 2012 11:53:50 -0600
+Subject: lib: proportion: lower PROP_MAX_SHIFT to 32 on 64-bit kernel
+
+From: Wu Fengguang <fengguang.wu@intel.com>
+
+commit 3310225dfc71a35a2cc9340c15c0e08b14b3c754 upstream.
+
+PROP_MAX_SHIFT should be set to <=32 on 64-bit box. This fixes two bugs
+in the below lines of bdi_dirty_limit():
+
+       bdi_dirty *= numerator;
+       do_div(bdi_dirty, denominator);
+
+1) divide error: do_div() only uses the lower 32 bit of the denominator,
+   which may trimmed to be 0 when PROP_MAX_SHIFT > 32.
+
+2) overflow: (bdi_dirty * numerator) could easily overflow if numerator
+   used up to 48 bits, leaving only 16 bits to bdi_dirty
+
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Reported-by: Ilya Tumaykin <librarian_rus@yahoo.com>
+Tested-by: Ilya Tumaykin <librarian_rus@yahoo.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/proportions.h |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/linux/proportions.h
++++ b/include/linux/proportions.h
+@@ -81,7 +81,11 @@ void prop_inc_percpu(struct prop_descrip
+  * Limit the time part in order to ensure there are some bits left for the
+  * cycle counter and fraction multiply.
+  */
++#if BITS_PER_LONG == 32
+ #define PROP_MAX_SHIFT (3*BITS_PER_LONG/4)
++#else
++#define PROP_MAX_SHIFT (BITS_PER_LONG/2)
++#endif
+ #define PROP_FRAC_SHIFT               (BITS_PER_LONG - PROP_MAX_SHIFT - 1)
+ #define PROP_FRAC_BASE                (1UL << PROP_FRAC_SHIFT)
diff --git a/queue-3.2/mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch b/queue-3.2/mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch
new file mode 100644 (file)
index 0000000..1ef6832
--- /dev/null
@@ -0,0 +1,33 @@
+From 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad@wizery.com>
+Date: Wed, 1 Feb 2012 18:48:09 +0200
+Subject: mac80211: timeout a single frame in the rx reorder buffer
+
+From: Eliad Peller <eliad@wizery.com>
+
+commit 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 upstream.
+
+The current code checks for stored_mpdu_num > 1, causing
+the reorder_timer to be triggered indefinitely, but the
+frame is never timed-out (until the next packet is received)
+
+Signed-off-by: Eliad Peller <eliad@wizery.com>
+Acked-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -616,7 +616,7 @@ static void ieee80211_sta_reorder_releas
+       index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                               tid_agg_rx->buf_size;
+       if (!tid_agg_rx->reorder_buf[index] &&
+-          tid_agg_rx->stored_mpdu_num > 1) {
++          tid_agg_rx->stored_mpdu_num) {
+               /*
+                * No buffers ready to be released, but check whether any
+                * frames in the reorder buffer have timed out.
diff --git a/queue-3.2/net-enable-tc35815-for-mips-again.patch b/queue-3.2/net-enable-tc35815-for-mips-again.patch
new file mode 100644 (file)
index 0000000..88857cb
--- /dev/null
@@ -0,0 +1,39 @@
+From a1728800bed3b93b231d99e97c756f622b9991c2 Mon Sep 17 00:00:00 2001
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Date: Mon, 6 Feb 2012 14:51:03 +0000
+Subject: net: enable TC35815 for MIPS again
+
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+
+commit a1728800bed3b93b231d99e97c756f622b9991c2 upstream.
+
+8<----------------------------------------------------------------------
+From: Ralf Roesch <ralf.roesch@rw-gmbh.de>
+Date: Wed, 16 Nov 2011 09:33:50 +0100
+Subject: net: enable TC35815 for MIPS again
+
+TX493[8,9] MIPS SoCs support 2 Ethernet channels of type TC35815
+which are connected to the internal PCI controller.
+And JMR3927 MIPS board has a TC35815 chip on board.
+These dependencies were lost on movement to drivers/net/ethernet/toshiba.
+
+Signed-off-by: Ralf Roesch <ralf.roesch@rw-gmbh.de>
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/toshiba/Kconfig |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/toshiba/Kconfig
++++ b/drivers/net/ethernet/toshiba/Kconfig
+@@ -5,7 +5,7 @@
+ config NET_VENDOR_TOSHIBA
+       bool "Toshiba devices"
+       default y
+-      depends on PCI && (PPC_IBM_CELL_BLADE || PPC_CELLEB) || PPC_PS3
++      depends on PCI && (PPC_IBM_CELL_BLADE || PPC_CELLEB || MIPS) || PPC_PS3
+       ---help---
+         If you have a network (Ethernet) card belonging to this class, say Y
+         and read the Ethernet-HOWTO, available from
diff --git a/queue-3.2/relay-prevent-integer-overflow-in-relay_open.patch b/queue-3.2/relay-prevent-integer-overflow-in-relay_open.patch
new file mode 100644 (file)
index 0000000..cb25b3d
--- /dev/null
@@ -0,0 +1,48 @@
+From f6302f1bcd75a042df69866d98b8d775a668f8f1 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 10 Feb 2012 09:03:58 +0100
+Subject: relay: prevent integer overflow in relay_open()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f6302f1bcd75a042df69866d98b8d775a668f8f1 upstream.
+
+"subbuf_size" and "n_subbufs" come from the user and they need to be
+capped to prevent an integer overflow.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/relay.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -164,10 +164,14 @@ depopulate:
+  */
+ static struct rchan_buf *relay_create_buf(struct rchan *chan)
+ {
+-      struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
+-      if (!buf)
++      struct rchan_buf *buf;
++
++      if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
+               return NULL;
++      buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
++      if (!buf)
++              return NULL;
+       buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
+       if (!buf->padding)
+               goto free_buf;
+@@ -574,6 +578,8 @@ struct rchan *relay_open(const char *bas
+       if (!(subbuf_size && n_subbufs))
+               return NULL;
++      if (subbuf_size > UINT_MAX / n_subbufs)
++              return NULL;
+       chan = kzalloc(sizeof(struct rchan), GFP_KERNEL);
+       if (!chan)
index c6bcb0626e03c70a929b8f99b4b934e910ae38ff..d07a350550a6494c72ba11eb08a714672cc0ac9a 100644 (file)
@@ -4,3 +4,13 @@ perf-evsel-fix-an-issue-where-perf-report-fails-to-show-the-proper-percentage.pa
 perf-tools-fix-perf-stack-to-non-executable-on-x86_64.patch
 drm-i915-force-explicit-bpp-selection-for-intel_dp_link_required.patch
 drm-i915-no-lvds-quirk-for-aopen-mp45.patch
+ath9k-fix-kernel-panic-during-driver-initilization.patch
+ath9k-fix-a-wep-crypto-related-regression.patch
+ath9k_hw-fix-a-rts-cts-timeout-regression.patch
+hwmon-f75375s-fix-bit-shifting-in-f75375_write16.patch
+net-enable-tc35815-for-mips-again.patch
+lib-proportion-lower-prop_max_shift-to-32-on-64-bit-kernel.patch
+relay-prevent-integer-overflow-in-relay_open.patch
+mac80211-timeout-a-single-frame-in-the-rx-reorder-buffer.patch
+writeback-fix-null-bdi-dev-in-trace-writeback_single_inode.patch
+writeback-fix-dereferencing-null-bdi-dev-on-trace_writeback_queue.patch
diff --git a/queue-3.2/writeback-fix-dereferencing-null-bdi-dev-on-trace_writeback_queue.patch b/queue-3.2/writeback-fix-dereferencing-null-bdi-dev-on-trace_writeback_queue.patch
new file mode 100644 (file)
index 0000000..49ce0a2
--- /dev/null
@@ -0,0 +1,41 @@
+From 977b7e3a52a7421ad33a393a38ece59f3d41c2fa Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Sat, 4 Feb 2012 20:54:03 -0600
+Subject: writeback: fix dereferencing NULL bdi->dev on trace_writeback_queue
+
+From: Wu Fengguang <fengguang.wu@intel.com>
+
+commit 977b7e3a52a7421ad33a393a38ece59f3d41c2fa upstream.
+
+When a SD card is hot removed without umount, del_gendisk() will call
+bdi_unregister() without destroying/freeing it. This leaves the bdi in
+the bdi->dev = NULL, bdi->wb.task = NULL, bdi->bdi_list removed state.
+
+When sync(2) gets the bdi before bdi_unregister() and calls
+bdi_queue_work() after the unregister, trace_writeback_queue will be
+dereferencing the NULL bdi->dev. Fix it with a simple test for NULL.
+
+LKML-reference: http://lkml.org/lkml/2012/1/18/346
+Reported-by: Rabin Vincent <rabin@rab.in>
+Tested-by: Namjae Jeon <linkinjeon@gmail.com>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/trace/events/writeback.h |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -47,7 +47,10 @@ DECLARE_EVENT_CLASS(writeback_work_class
+               __field(int, reason)
+       ),
+       TP_fast_assign(
+-              strncpy(__entry->name, dev_name(bdi->dev), 32);
++              struct device *dev = bdi->dev;
++              if (!dev)
++                      dev = default_backing_dev_info.dev;
++              strncpy(__entry->name, dev_name(dev), 32);
+               __entry->nr_pages = work->nr_pages;
+               __entry->sb_dev = work->sb ? work->sb->s_dev : 0;
+               __entry->sync_mode = work->sync_mode;
diff --git a/queue-3.2/writeback-fix-null-bdi-dev-in-trace-writeback_single_inode.patch b/queue-3.2/writeback-fix-null-bdi-dev-in-trace-writeback_single_inode.patch
new file mode 100644 (file)
index 0000000..3a97a3c
--- /dev/null
@@ -0,0 +1,67 @@
+From 15eb77a07c714ac80201abd0a9568888bcee6276 Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu@intel.com>
+Date: Tue, 17 Jan 2012 11:18:56 -0600
+Subject: writeback: fix NULL bdi->dev in trace writeback_single_inode
+
+From: Wu Fengguang <fengguang.wu@intel.com>
+
+commit 15eb77a07c714ac80201abd0a9568888bcee6276 upstream.
+
+bdi_prune_sb() resets sb->s_bdi to default_backing_dev_info when the
+tearing down the original bdi. Fix trace_writeback_single_inode to
+use sb->s_bdi=default_backing_dev_info rather than bdi->dev=NULL for a
+teared down bdi.
+
+Reported-by: Rabin Vincent <rabin@rab.in>
+Tested-by: Rabin Vincent <rabin@rab.in>
+Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fs-writeback.c                |   16 ++++++++--------
+ include/trace/events/writeback.h |    2 +-
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -48,14 +48,6 @@ struct wb_writeback_work {
+ };
+ /*
+- * Include the creation of the trace points after defining the
+- * wb_writeback_work structure so that the definition remains local to this
+- * file.
+- */
+-#define CREATE_TRACE_POINTS
+-#include <trace/events/writeback.h>
+-
+-/*
+  * We don't actually have pdflush, but this one is exported though /proc...
+  */
+ int nr_pdflush_threads;
+@@ -87,6 +79,14 @@ static inline struct inode *wb_inode(str
+       return list_entry(head, struct inode, i_wb_list);
+ }
++/*
++ * Include the creation of the trace points after defining the
++ * wb_writeback_work structure and inline functions so that the definition
++ * remains local to this file.
++ */
++#define CREATE_TRACE_POINTS
++#include <trace/events/writeback.h>
++
+ /* Wakeup flusher thread or forker thread to fork it. Requires bdi->wb_lock. */
+ static void bdi_wakeup_flusher(struct backing_dev_info *bdi)
+ {
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -418,7 +418,7 @@ DECLARE_EVENT_CLASS(writeback_single_ino
+       TP_fast_assign(
+               strncpy(__entry->name,
+-                      dev_name(inode->i_mapping->backing_dev_info->dev), 32);
++                      dev_name(inode_to_bdi(inode)->dev), 32);
+               __entry->ino            = inode->i_ino;
+               __entry->state          = inode->i_state;
+               __entry->dirtied_when   = inode->dirtied_when;