--- /dev/null
+From d4eddd42f592a0cf06818fae694a3d271f842e4d Mon Sep 17 00:00:00 2001
+From: Kent Overstreet <kmo@daterainc.com>
+Date: Tue, 22 Oct 2013 15:35:50 -0700
+Subject: bcache: Fixed incorrect order of arguments to bio_alloc_bioset()
+
+From: Kent Overstreet <kmo@daterainc.com>
+
+commit d4eddd42f592a0cf06818fae694a3d271f842e4d upstream.
+
+Signed-off-by: Kent Overstreet <kmo@daterainc.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/request.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1059,7 +1059,7 @@ static void request_write(struct cached_
+
+ if (bio->bi_rw & REQ_FLUSH) {
+ /* Also need to send a flush to the backing device */
+- struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
++ struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
+ dc->disk.bio_split);
+
+ flush->bi_rw = WRITE_FLUSH;
--- /dev/null
+From ea84753c98a7ac6b74e530b64c444a912b3835ca Mon Sep 17 00:00:00 2001
+From: Anjana V Kumar <anjanavk12@gmail.com>
+Date: Sat, 12 Oct 2013 10:59:17 +0800
+Subject: cgroup: fix to break the while loop in cgroup_attach_task() correctly
+
+From: Anjana V Kumar <anjanavk12@gmail.com>
+
+commit ea84753c98a7ac6b74e530b64c444a912b3835ca upstream.
+
+Both Anjana and Eunki reported a stall in the while_each_thread loop
+in cgroup_attach_task().
+
+It's because, when we attach a single thread to a cgroup, if the cgroup
+is exiting or is already in that cgroup, we won't break the loop.
+
+If the task is already in the cgroup, the bug can lead to another thread
+being attached to the cgroup unexpectedly:
+
+ # echo 5207 > tasks
+ # cat tasks
+ 5207
+ # echo 5207 > tasks
+ # cat tasks
+ 5207
+ 5215
+
+What's worse, if the task to be attached isn't the leader of the thread
+group, we might never exit the loop, hence cpu stall. Thanks for Oleg's
+analysis.
+
+This bug was introduced by commit 081aa458c38ba576bdd4265fc807fa95b48b9e79
+("cgroup: consolidate cgroup_attach_task() and cgroup_attach_proc()")
+
+[ lizf: - fixed the first continue, pointed out by Oleg,
+ - rewrote changelog. ]
+
+Reported-by: Eunki Kim <eunki_kim@samsung.com>
+Reported-by: Anjana V Kumar <anjanavk12@gmail.com>
+Signed-off-by: Anjana V Kumar <anjanavk12@gmail.com>
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cgroup.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -1995,7 +1995,7 @@ static int cgroup_attach_task(struct cgr
+
+ /* @tsk either already exited or can't exit until the end */
+ if (tsk->flags & PF_EXITING)
+- continue;
++ goto next;
+
+ /* as per above, nr_threads may decrease, but not increase. */
+ BUG_ON(i >= group_size);
+@@ -2003,7 +2003,7 @@ static int cgroup_attach_task(struct cgr
+ ent.cgrp = task_cgroup_from_root(tsk, root);
+ /* nothing to do if this task is already in the cgroup */
+ if (ent.cgrp == cgrp)
+- continue;
++ goto next;
+ /*
+ * saying GFP_ATOMIC has no effect here because we did prealloc
+ * earlier, but it's good form to communicate our expectations.
+@@ -2011,7 +2011,7 @@ static int cgroup_attach_task(struct cgr
+ retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
+ BUG_ON(retval != 0);
+ i++;
+-
++ next:
+ if (!threadgroup)
+ break;
+ } while_each_thread(leader, tsk);
--- /dev/null
+From 52e0a509e5d6f902ec26bc2a8bb02b137dc453be Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Tue, 15 Oct 2013 11:06:14 -0700
+Subject: cpufreq / intel_pstate: Fix max_perf_pct on resume
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit 52e0a509e5d6f902ec26bc2a8bb02b137dc453be upstream.
+
+If the system is suspended while max_perf_pct is less than 100 percent
+or no_turbo set policy->{min,max} will be set incorrectly with scaled
+values which turn the scaled values into hard limits.
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=61241
+Reported-by: Patrick Bartels <petzicus@googlemail.com>
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -629,8 +629,8 @@ static int __cpuinit intel_pstate_cpu_ex
+
+ static int __cpuinit intel_pstate_cpu_init(struct cpufreq_policy *policy)
+ {
+- int rc, min_pstate, max_pstate;
+ struct cpudata *cpu;
++ int rc;
+
+ rc = intel_pstate_init_cpu(policy->cpu);
+ if (rc)
+@@ -644,9 +644,8 @@ static int __cpuinit intel_pstate_cpu_in
+ else
+ policy->policy = CPUFREQ_POLICY_POWERSAVE;
+
+- intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+- policy->min = min_pstate * 100000;
+- policy->max = max_pstate * 100000;
++ policy->min = cpu->pstate.min_pstate * 100000;
++ policy->max = cpu->pstate.turbo_pstate * 100000;
+
+ /* cpuinfo and default policy values */
+ policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
--- /dev/null
+From a754055a1296fcbe6f32de3a5eaca6efb2fd1865 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 16 Sep 2013 11:12:07 +0300
+Subject: mac80211: correctly close cancelled scans
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit a754055a1296fcbe6f32de3a5eaca6efb2fd1865 upstream.
+
+__ieee80211_scan_completed is called from a worker. This
+means that the following flow is possible.
+
+ * driver calls ieee80211_scan_completed
+ * mac80211 cancels the scan (that is already complete)
+ * __ieee80211_scan_completed runs
+
+When scan_work will finally run, it will see that the scan
+hasn't been aborted and might even trigger another scan on
+another band. This leads to a situation where cfg80211's
+scan is not done and no further scan can be issued.
+
+Fix this by setting a new flag when a HW scan is being
+cancelled so that no other scan will be triggered.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ieee80211_i.h | 3 +++
+ net/mac80211/scan.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -842,6 +842,8 @@ struct tpt_led_trigger {
+ * that the scan completed.
+ * @SCAN_ABORTED: Set for our scan work function when the driver reported
+ * a scan complete for an aborted scan.
++ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
++ * cancelled.
+ */
+ enum {
+ SCAN_SW_SCANNING,
+@@ -849,6 +851,7 @@ enum {
+ SCAN_ONCHANNEL_SCANNING,
+ SCAN_COMPLETED,
+ SCAN_ABORTED,
++ SCAN_HW_CANCELLED,
+ };
+
+ /**
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -202,6 +202,9 @@ static bool ieee80211_prep_hw_scan(struc
+ enum ieee80211_band band;
+ int i, ielen, n_chans;
+
++ if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
++ return false;
++
+ do {
+ if (local->hw_scan_band == IEEE80211_NUM_BANDS)
+ return false;
+@@ -878,7 +881,23 @@ void ieee80211_scan_cancel(struct ieee80
+ if (!local->scan_req)
+ goto out;
+
++ /*
++ * We have a scan running and the driver already reported completion,
++ * but the worker hasn't run yet or is stuck on the mutex - mark it as
++ * cancelled.
++ */
++ if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
++ test_bit(SCAN_COMPLETED, &local->scanning)) {
++ set_bit(SCAN_HW_CANCELLED, &local->scanning);
++ goto out;
++ }
++
+ if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
++ /*
++ * Make sure that __ieee80211_scan_completed doesn't trigger a
++ * scan on another band.
++ */
++ set_bit(SCAN_HW_CANCELLED, &local->scanning);
+ if (local->ops->cancel_hw_scan)
+ drv_cancel_hw_scan(local,
+ rcu_dereference_protected(local->scan_sdata,
--- /dev/null
+From 6329b8d917adc077caa60c2447385554130853a3 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 17 Sep 2013 11:15:43 +0200
+Subject: mac80211: drop spoofed packets in ad-hoc mode
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 6329b8d917adc077caa60c2447385554130853a3 upstream.
+
+If an Ad-Hoc node receives packets with the Cell ID or its own MAC
+address as source address, it hits a WARN_ON in sta_info_insert_check()
+With many packets, this can massively spam the logs. One way that this
+can easily happen is through having Cisco APs in the area with rouge AP
+detection and countermeasures enabled.
+Such Cisco APs will regularly send fake beacons, disassoc and deauth
+packets that trigger these warnings.
+
+To fix this issue, drop such spoofed packets early in the rx path.
+
+Reported-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3002,6 +3002,9 @@ static int prepare_for_handlers(struct i
+ case NL80211_IFTYPE_ADHOC:
+ if (!bssid)
+ return 0;
++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
++ return 0;
+ if (ieee80211_is_beacon(hdr->frame_control)) {
+ return 1;
+ } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
--- /dev/null
+From d86aa4f8ca58898ec6a94c0635da20b948171ed7 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 11 Oct 2013 15:47:06 +0200
+Subject: mac80211: fix crash if bitrate calculation goes wrong
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit d86aa4f8ca58898ec6a94c0635da20b948171ed7 upstream.
+
+If a frame's timestamp is calculated, and the bitrate
+calculation goes wrong and returns zero, the system
+will attempt to divide by zero and crash. Catch this
+case and print the rate information that the driver
+reported when this happens.
+
+Reported-by: Thomas Lindroth <thomas.lindroth@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/util.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -2174,6 +2174,10 @@ u64 ieee80211_calculate_rx_timestamp(str
+ }
+
+ rate = cfg80211_calculate_bitrate(&ri);
++ if (WARN_ONCE(!rate,
++ "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
++ status->flag, status->rate_idx, status->vht_nss))
++ return 0;
+
+ /* rewind from end of MPDU */
+ if (status->flag & RX_FLAG_MACTIME_END)
--- /dev/null
+From 0c5b93290b2f3c7a376567c03ae8d385b0e99851 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 29 Sep 2013 21:39:34 +0200
+Subject: mac80211: update sta->last_rx on acked tx frames
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 0c5b93290b2f3c7a376567c03ae8d385b0e99851 upstream.
+
+When clients are idle for too long, hostapd sends nullfunc frames for
+probing. When those are acked by the client, the idle time needs to be
+updated.
+
+To make this work (and to avoid unnecessary probing), update sta->last_rx
+whenever an ACK was received for a tx packet. Only do this if the flag
+IEEE80211_HW_REPORTS_TX_ACK_STATUS is set.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/status.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct
+ struct ieee80211_local *local = sta->local;
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+
++ if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
++ sta->last_rx = jiffies;
++
+ if (ieee80211_is_data_qos(mgmt->frame_control)) {
+ struct ieee80211_hdr *hdr = (void *) skb->data;
+ u8 *qc = ieee80211_get_qos_ctl(hdr);
--- /dev/null
+From 03bb7f42765ce596604f03d179f3137d7df05bba Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 29 Sep 2013 21:39:33 +0200
+Subject: mac80211: use sta_info_get_bss() for nl80211 tx and client probing
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 03bb7f42765ce596604f03d179f3137d7df05bba upstream.
+
+This allows calls for clients in AP_VLANs (e.g. for 4-addr) to succeed
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/cfg.c | 2 +-
+ net/mac80211/tx.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3315,7 +3315,7 @@ static int ieee80211_probe_client(struct
+ return -EINVAL;
+ }
+ band = chanctx_conf->def.chan->band;
+- sta = sta_info_get(sdata, peer);
++ sta = sta_info_get_bss(sdata, peer);
+ if (sta) {
+ qos = test_sta_flag(sta, WLAN_STA_WME);
+ } else {
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1100,7 +1100,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+ tx->sta = rcu_dereference(sdata->u.vlan.sta);
+ if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
+ return TX_DROP;
+- } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
++ } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
++ IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
+ tx->sdata->control_port_protocol == tx->skb->protocol) {
+ tx->sta = sta_info_get_bss(sdata, hdr->addr1);
+ }
usb-quirks.c-add-one-device-that-cannot-deal-with-suspension.patch
usb-quirks-add-touchscreen-that-is-dazzeled-by-remote-wakeup.patch
usb-serial-ftdi_sio-add-id-for-z3x-box-device.patch
+x86-update-uv3-hub-revision-id.patch
+cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch
+bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch
+cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch
+mac80211-correctly-close-cancelled-scans.patch
+mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch
+mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch
+mac80211-update-sta-last_rx-on-acked-tx-frames.patch
+mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch
--- /dev/null
+From dd3c9c4b603c664fedc12facf180db0f1794aafe Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja@sgi.com>
+Date: Mon, 14 Oct 2013 11:17:34 -0500
+Subject: x86: Update UV3 hub revision ID
+
+From: Russ Anderson <rja@sgi.com>
+
+commit dd3c9c4b603c664fedc12facf180db0f1794aafe upstream.
+
+The UV3 hub revision ID is different than expected. The first
+revision was supposed to start at 1 but instead will start at 0.
+
+Signed-off-by: Russ Anderson <rja@sgi.com>
+Link: http://lkml.kernel.org/r/20131014161733.GA6274@sgi.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -98,7 +98,7 @@ static int __init early_get_pnodeid(void
+ break;
+ case UV3_HUB_PART_NUMBER:
+ case UV3_HUB_PART_NUMBER_X:
+- uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
++ uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
+ break;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
