--- /dev/null
+From 5b917a1420d3d1a9c8da49fb0090692dc9aaee86 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Sun, 17 Oct 2010 18:41:24 +0400
+Subject: pcmcia: synclink_cs: fix information leak to userland
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+commit 5b917a1420d3d1a9c8da49fb0090692dc9aaee86 upstream.
+
+Structure new_line is copied to userland with some padding fields unitialized.
+It leads to leaking of stack memory.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/pcmcia/synclink_cs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/pcmcia/synclink_cs.c
++++ b/drivers/char/pcmcia/synclink_cs.c
+@@ -4132,6 +4132,8 @@ static int hdlcdev_ioctl(struct net_devi
+ if (cmd != SIOCWANDEV)
+ return hdlc_ioctl(dev, ifr, cmd);
+
++ memset(&new_line, 0, size);
++
+ switch(ifr->ifr_settings.type) {
+ case IF_GET_IFACE: /* return current sync_serial_settings */
+
--- /dev/null
+From ba0cef3d149ce4db293c572bf36ed352b11ce7b9 Mon Sep 17 00:00:00 2001
+From: Stephane Eranian <eranian@google.com>
+Date: Fri, 15 Oct 2010 15:15:01 +0200
+Subject: perf_events: Fix bogus AMD64 generic TLB events
+
+From: Stephane Eranian <eranian@google.com>
+
+commit ba0cef3d149ce4db293c572bf36ed352b11ce7b9 upstream.
+
+PERF_COUNT_HW_CACHE_DTLB:READ:MISS had a bogus umask value of 0 which
+counts nothing. Needed to be 0x7 (to count all possibilities).
+
+PERF_COUNT_HW_CACHE_ITLB:READ:MISS had a bogus umask value of 0 which
+counts nothing. Needed to be 0x3 (to count all possibilities).
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Robert Richter <robert.richter@amd.com>
+LKML-Reference: <4cb85478.41e9d80a.44e2.3f00@mx.google.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/perf_event_amd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_amd.c
++++ b/arch/x86/kernel/cpu/perf_event_amd.c
+@@ -52,7 +52,7 @@ static __initconst const u64 amd_hw_cach
+ [ C(DTLB) ] = {
+ [ C(OP_READ) ] = {
+ [ C(RESULT_ACCESS) ] = 0x0040, /* Data Cache Accesses */
+- [ C(RESULT_MISS) ] = 0x0046, /* L1 DTLB and L2 DLTB Miss */
++ [ C(RESULT_MISS) ] = 0x0746, /* L1_DTLB_AND_L2_DLTB_MISS.ALL */
+ },
+ [ C(OP_WRITE) ] = {
+ [ C(RESULT_ACCESS) ] = 0,
+@@ -66,7 +66,7 @@ static __initconst const u64 amd_hw_cach
+ [ C(ITLB) ] = {
+ [ C(OP_READ) ] = {
+ [ C(RESULT_ACCESS) ] = 0x0080, /* Instruction fecthes */
+- [ C(RESULT_MISS) ] = 0x0085, /* Instr. fetch ITLB misses */
++ [ C(RESULT_MISS) ] = 0x0385, /* L1_ITLB_AND_L2_ITLB_MISS.ALL */
+ },
+ [ C(OP_WRITE) ] = {
+ [ C(RESULT_ACCESS) ] = -1,
--- /dev/null
+From c530ccd9a1864a44a7ff35826681229ce9f2357a Mon Sep 17 00:00:00 2001
+From: Stephane Eranian <eranian@google.com>
+Date: Fri, 15 Oct 2010 15:26:01 +0200
+Subject: perf_events: Fix bogus context time tracking
+
+From: Stephane Eranian <eranian@google.com>
+
+commit c530ccd9a1864a44a7ff35826681229ce9f2357a upstream.
+
+You can only call update_context_time() when the context
+is active, i.e., the thread it is attached to is still running.
+
+However, perf_event_read() can be called even when the context
+is inactive, e.g., user read() the counters. The call to
+update_context_time() must be conditioned on the status of
+the context, otherwise, bogus time_enabled, time_running may
+be returned. Here is an example on AMD64. The task program
+is an example from libpfm4. The -p prints deltas every 1s.
+
+$ task -p -e cpu_clk_unhalted sleep 5
+ 2,266,610 cpu_clk_unhalted (0.00% scaling, ena=2,158,982, run=2,158,982)
+ 0 cpu_clk_unhalted (0.00% scaling, ena=2,158,982, run=2,158,982)
+ 0 cpu_clk_unhalted (0.00% scaling, ena=2,158,982, run=2,158,982)
+ 0 cpu_clk_unhalted (0.00% scaling, ena=2,158,982, run=2,158,982)
+ 0 cpu_clk_unhalted (0.00% scaling, ena=2,158,982, run=2,158,982)
+5,242,358,071 cpu_clk_unhalted (99.95% scaling, ena=5,000,359,984, run=2,319,270)
+
+Whereas if you don't read deltas, e.g., no call to perf_event_read() until
+the process terminates:
+
+$ task -e cpu_clk_unhalted sleep 5
+ 2,497,783 cpu_clk_unhalted (0.00% scaling, ena=2,376,899, run=2,376,899)
+
+Notice that time_enable, time_running are bogus in the first example
+causing bogus scaling.
+
+This patch fixes the problem, by conditionally calling update_context_time()
+in perf_event_read().
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <4cb856dc.51edd80a.5ae0.38fb@mx.google.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -1757,7 +1757,13 @@ static u64 perf_event_read(struct perf_e
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&ctx->lock, flags);
+- update_context_time(ctx);
++ /*
++ * may read while context is not active
++ * (e.g., thread is blocked), in that case
++ * we cannot update context time
++ */
++ if (ctx->is_active)
++ update_context_time(ctx);
+ update_event_times(event);
+ raw_spin_unlock_irqrestore(&ctx->lock, flags);
+ }
--- /dev/null
+From 9f5f9ffe50e90ed73040d2100db8bfc341cee352 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Thu, 9 Sep 2010 19:02:40 +0000
+Subject: powerpc/perf: Fix sampling enable for PPC970
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 9f5f9ffe50e90ed73040d2100db8bfc341cee352 upstream.
+
+The logic to distinguish marked instruction events from ordinary events
+on PPC970 and derivatives was flawed. The result is that instruction
+sampling didn't get enabled in the PMU for some marked instruction
+events, so they would never trigger. This fixes it by adding the
+appropriate break statements in the switch statement.
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/ppc970-pmu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/kernel/ppc970-pmu.c
++++ b/arch/powerpc/kernel/ppc970-pmu.c
+@@ -169,9 +169,11 @@ static int p970_marked_instr_event(u64 e
+ switch (unit) {
+ case PM_VPU:
+ mask = 0x4c; /* byte 0 bits 2,3,6 */
++ break;
+ case PM_LSU0:
+ /* byte 2 bits 0,2,3,4,6; all of byte 1 */
+ mask = 0x085dff00;
++ break;
+ case PM_LSU1L:
+ mask = 0x50 << 24; /* byte 3 bits 4,6 */
+ break;
--- /dev/null
+From 17bdcf949d03306b308c5fb694849cd35f119807 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@stericsson.com>
+Date: Mon, 11 Oct 2010 16:36:51 +0200
+Subject: sched: Drop all load weight manipulation for RT tasks
+
+From: Linus Walleij <linus.walleij@stericsson.com>
+
+commit 17bdcf949d03306b308c5fb694849cd35f119807 upstream.
+
+Load weights are for the CFS, they do not belong in the RT task. This makes all
+RT scheduling classes leave the CFS weights alone.
+
+This fixes a real bug as well: I noticed the following phonomena: a process
+elevated to SCHED_RR forks with SCHED_RESET_ON_FORK set, and the child is
+indeed SCHED_OTHER, and the niceval is indeed reset to 0. However the weight
+inserted by set_load_weight() remains at 0, giving the task insignificat
+priority.
+
+With this fix, the weight is reset to what the task had before being elevated
+to SCHED_RR/SCHED_FIFO.
+
+Cc: Lennart Poettering <lennart@poettering.net>
+Signed-off-by: Linus Walleij <linus.walleij@stericsson.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <1286807811-10568-1-git-send-email-linus.walleij@stericsson.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -1830,12 +1830,6 @@ static void dec_nr_running(struct rq *rq
+
+ static void set_load_weight(struct task_struct *p)
+ {
+- if (task_has_rt_policy(p)) {
+- p->se.load.weight = 0;
+- p->se.load.inv_weight = WMULT_CONST;
+- return;
+- }
+-
+ /*
+ * SCHED_IDLE tasks get minimal weight:
+ */
--- /dev/null
+From 7740191cd909b75d75685fb08a5d1f54b8a9d28b Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Mon, 13 Sep 2010 17:47:00 -0400
+Subject: sched: Fix string comparison in /proc/sched_features
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit 7740191cd909b75d75685fb08a5d1f54b8a9d28b upstream.
+
+Fix incorrect handling of the following case:
+
+ INTERACTIVE
+ INTERACTIVE_SOMETHING_ELSE
+
+The comparison only checks up to each element's length.
+
+Changelog since v1:
+ - Embellish using some Rostedtisms.
+ [ mingo: ^^ == smaller and cleaner ]
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Tony Lindgren <tony@atomide.com>
+LKML-Reference: <20100913214700.GB16118@Krystal>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -721,7 +721,7 @@ sched_feat_write(struct file *filp, cons
+ size_t cnt, loff_t *ppos)
+ {
+ char buf[64];
+- char *cmp = buf;
++ char *cmp;
+ int neg = 0;
+ int i;
+
+@@ -732,6 +732,7 @@ sched_feat_write(struct file *filp, cons
+ return -EFAULT;
+
+ buf[cnt] = 0;
++ cmp = strstrip(buf);
+
+ if (strncmp(buf, "NO_", 3) == 0) {
+ neg = 1;
+@@ -739,9 +740,7 @@ sched_feat_write(struct file *filp, cons
+ }
+
+ for (i = 0; sched_feat_names[i]; i++) {
+- int len = strlen(sched_feat_names[i]);
+-
+- if (strncmp(cmp, sched_feat_names[i], len) == 0) {
++ if (strcmp(cmp, sched_feat_names[i]) == 0) {
+ if (neg)
+ sysctl_sched_features &= ~(1UL << i);
+ else
--- /dev/null
+From cf10700bf8047f0668dd874b607f89516612e6c7 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Sat, 9 Oct 2010 13:26:12 -0700
+Subject: Staging: phison: fix problem caused by libata change
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit cf10700bf8047f0668dd874b607f89516612e6c7 upstream.
+
+The libata core changed this function so it needed to call a different
+one.
+
+See https://bugzilla.kernel.org/show_bug.cgi?id=19872 for details.
+
+Reported-by: Heinz Wiesinger <HMWiesinger@gmx.at>
+Tested-by: Heinz Wiesinger <HMWiesinger@gmx.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/phison/phison.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/phison/phison.c
++++ b/drivers/staging/phison/phison.c
+@@ -62,7 +62,7 @@ static int phison_init_one(struct pci_de
+ };
+ const struct ata_port_info *ppi[] = { &info, NULL };
+
+- ret = ata_pci_sff_init_one(pdev, ppi, &phison_sht, NULL, 0);
++ ret = ata_pci_bmdma_init_one(pdev, ppi, &phison_sht, NULL, 0);
+
+ dev_dbg(&pdev->dev, "phison_init_one(), ret = %x\n", ret);
+
--- /dev/null
+From 0c9a32f0192e656daa2ff3c9149f6d71b4a1b873 Mon Sep 17 00:00:00 2001
+From: Max Vozeler <mvz@vozeler.com>
+Date: Tue, 21 Sep 2010 17:31:40 +0200
+Subject: staging: usbip: Notify usb core of port status changes
+
+From: Max Vozeler <mvz@vozeler.com>
+
+commit 0c9a32f0192e656daa2ff3c9149f6d71b4a1b873 upstream.
+
+This patch changes vhci to behave like dummy and
+other hcds when disconnecting a device.
+
+Previously detaching a device from the root hub
+did not notify the usb core of the disconnect and
+left the device visible.
+
+Signed-off-by: Max Vozeler <mvz@vozeler.com>
+Reported-by: Marco Lancione <marco@optikam.com>
+Tested-by: Luc Jalbert <ljalbert@optikam.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/vhci_hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -164,6 +164,8 @@ void rh_port_disconnect(int rhport)
+ * spin_unlock(&vdev->ud.lock); */
+
+ spin_unlock_irqrestore(&the_controller->lock, flags);
++
++ usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
+ }
+
+
--- /dev/null
+From 584c5b7cf06194464240280483ee0376cdddbbae Mon Sep 17 00:00:00 2001
+From: Max Vozeler <mvz@vozeler.com>
+Date: Tue, 21 Sep 2010 17:43:30 +0200
+Subject: staging: usbip: Process event flags without delay
+
+From: Max Vozeler <mvz@vozeler.com>
+
+commit 584c5b7cf06194464240280483ee0376cdddbbae upstream.
+
+The way the event handler works can cause it to delay
+events until eventual wakeup for another event.
+
+For example, on device detach (vhci):
+
+ - Write to sysfs detach file
+ -> usbip_event_add(VDEV_EVENT_DOWN)
+ -> wakeup()
+
+#define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET).
+
+ - Event thread wakes up and passes the event to
+ event_handler() to process.
+
+ - It processes and clears the USBIP_EH_SHUTDOWN
+ flag then returns.
+
+ - The outer event loop (event_handler_loop()) calls
+ wait_event_interruptible().
+
+The processing of the second flag which is part of
+VDEV_EVENT_DOWN (USBIP_EH_RESET) did not happen yet.
+It is delayed until the next event.
+
+This means the ->reset callback may not happen for
+a long time (if ever), leaving the usbip port in a
+weird state which prevents its reuse.
+
+This patch changes the handler to process all flags
+before waiting for another wakeup.
+
+I have verified this change to fix a problem which
+prevented reattach of a usbip device. It also helps
+for socket errors which missed the RESET as well.
+
+The delayed event processing also affects the stub
+side of usbip and the error handling there.
+
+Signed-off-by: Max Vozeler <mvz@vozeler.com>
+Reported-by: Marco Lancione <marco@optikam.com>
+Tested-by: Luc Jalbert <ljalbert@optikam.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/usbip_event.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+--- a/drivers/staging/usbip/usbip_event.c
++++ b/drivers/staging/usbip/usbip_event.c
+@@ -38,21 +38,13 @@ static int event_handler(struct usbip_de
+ ud->eh_ops.shutdown(ud);
+
+ ud->event &= ~USBIP_EH_SHUTDOWN;
+-
+- break;
+ }
+
+- /* Stop the error handler. */
+- if (ud->event & USBIP_EH_BYE)
+- return -1;
+-
+ /* Reset the device. */
+ if (ud->event & USBIP_EH_RESET) {
+ ud->eh_ops.reset(ud);
+
+ ud->event &= ~USBIP_EH_RESET;
+-
+- break;
+ }
+
+ /* Mark the device as unusable. */
+@@ -60,13 +52,11 @@ static int event_handler(struct usbip_de
+ ud->eh_ops.unusable(ud);
+
+ ud->event &= ~USBIP_EH_UNUSABLE;
+-
+- break;
+ }
+
+- /* NOTREACHED */
+- printk(KERN_ERR "%s: unknown event\n", __func__);
+- return -1;
++ /* Stop the error handler. */
++ if (ud->event & USBIP_EH_BYE)
++ return -1;
+ }
+
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
