--- /dev/null
+From 811a2407a3cf7bbd027fbe92d73416f17485a3d8 Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+Date: Fri, 25 Jul 2014 09:17:12 +0100
+Subject: ARM: 8115/1: LPAE: reduce damage caused by idmap to virtual memory layout
+
+From: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+
+commit 811a2407a3cf7bbd027fbe92d73416f17485a3d8 upstream.
+
+On LPAE, each level 1 (pgd) page table entry maps 1GiB, and the level 2
+(pmd) entries map 2MiB.
+
+When the identity mapping is created on LPAE, the pgd pointers are copied
+from the swapper_pg_dir. If we find that we need to modify the contents
+of a pmd, we allocate a new empty pmd table and insert it into the
+appropriate 1GB slot, before then filling it with the identity mapping.
+
+However, if the 1GB slot covers the kernel lowmem mappings, we obliterate
+those mappings.
+
+When replacing a PMD, first copy the old PMD contents to the new PMD, so
+that we preserve the existing mappings, particularly the mappings of the
+kernel itself.
+
+[rewrote commit message and added code comment -- rmk]
+
+Fixes: ae2de101739c ("ARM: LPAE: Add identity mapping support for the 3-level page table format")
+Signed-off-by: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/idmap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/mm/idmap.c
++++ b/arch/arm/mm/idmap.c
+@@ -25,6 +25,13 @@ static void idmap_add_pmd(pud_t *pud, un
+ pr_warning("Failed to allocate identity pmd.\n");
+ return;
+ }
++ /*
++ * Copy the original PMD to ensure that the PMD entries for
++ * the kernel image are preserved.
++ */
++ if (!pud_none(*pud))
++ memcpy(pmd, pmd_offset(pud, 0),
++ PTRS_PER_PMD * sizeof(pmd_t));
+ pud_populate(&init_mm, pud, pmd);
+ pmd += pmd_index(addr);
+ } else
--- /dev/null
+From 28c9770bcbd2b6dbab99669825a2f8fa69e6d35b Mon Sep 17 00:00:00 2001
+From: Haojian Zhuang <haojian.zhuang@linaro.org>
+Date: Wed, 2 Apr 2014 21:31:50 +0800
+Subject: ARM: dts: fix L2 address in Hi3620
+
+From: Haojian Zhuang <haojian.zhuang@linaro.org>
+
+commit 28c9770bcbd2b6dbab99669825a2f8fa69e6d35b upstream.
+
+Fix the address of L2 controler register in hi3620 SoC.
+This has been wrong from the point that the file was merged
+in v3.14.
+
+Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
+Acked-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/hi3620.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/hi3620.dtsi
++++ b/arch/arm/boot/dts/hi3620.dtsi
+@@ -73,7 +73,7 @@
+
+ L2: l2-cache {
+ compatible = "arm,pl310-cache";
+- reg = <0xfc10000 0x100000>;
++ reg = <0x100000 0x100000>;
+ interrupts = <0 15 4>;
+ cache-unified;
+ cache-level = <2>;
--- /dev/null
+From 823a19cd3b91b0729d7417f1848413846be61712 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Tue, 29 Jul 2014 09:24:47 +0100
+Subject: ARM: fix alignment of keystone page table fixup
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 823a19cd3b91b0729d7417f1848413846be61712 upstream.
+
+If init_mm.brk is not section aligned, the LPAE fixup code will miss
+updating the final PMD. Fix this by aligning map_end.
+
+Fixes: a77e0c7b2774 ("ARM: mm: Recreate kernel mappings in early_paging_init()")
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/mmu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1436,8 +1436,8 @@ void __init early_paging_init(const stru
+ return;
+
+ /* remap kernel code and data */
+- map_start = init_mm.start_code;
+- map_end = init_mm.brk;
++ map_start = init_mm.start_code & PMD_MASK;
++ map_end = ALIGN(init_mm.brk, PMD_SIZE);
+
+ /* get a handle on things... */
+ pgd0 = pgd_offset_k(0);
+@@ -1472,7 +1472,7 @@ void __init early_paging_init(const stru
+ }
+
+ /* remap pmds for kernel mapping */
+- phys = __pa(map_start) & PMD_MASK;
++ phys = __pa(map_start);
+ do {
+ *pmdk++ = __pmd(phys | pmdprot);
+ phys += PMD_SIZE;
--- /dev/null
+From c01fac1c77a00227f706a1654317023e3f4ac7f0 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 23 Jul 2014 15:40:54 +0200
+Subject: ath9k: fix aggregation session lockup
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit c01fac1c77a00227f706a1654317023e3f4ac7f0 upstream.
+
+If an aggregation session fails, frames still end up in the driver queue
+with IEEE80211_TX_CTL_AMPDU set.
+This causes tx for the affected station/tid to stall, since
+ath_tx_get_tid_subframe returning packets to send.
+
+Fix this by clearing IEEE80211_TX_CTL_AMPDU as long as no aggregation
+session is running.
+
+Reported-by: Antonio Quartulli <antonio@open-mesh.com>
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -890,6 +890,15 @@ ath_tx_get_tid_subframe(struct ath_softc
+
+ tx_info = IEEE80211_SKB_CB(skb);
+ tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
++
++ /*
++ * No aggregation session is running, but there may be frames
++ * from a previous session or a failed attempt in the queue.
++ * Send them out as normal data frames
++ */
++ if (!tid->active)
++ tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
++
+ if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
+ bf->bf_state.bf_type = 0;
+ return bf;
--- /dev/null
+From 8c26d458394be44e135d1c6bd4557e1c4e1a0535 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad@wizery.com>
+Date: Thu, 17 Jul 2014 15:00:56 +0300
+Subject: cfg80211: fix mic_failure tracing
+
+From: Eliad Peller <eliad@wizery.com>
+
+commit 8c26d458394be44e135d1c6bd4557e1c4e1a0535 upstream.
+
+tsc can be NULL (mac80211 currently always passes NULL),
+resulting in NULL-dereference. check before copying it.
+
+Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/trace.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -2068,7 +2068,8 @@ TRACE_EVENT(cfg80211_michael_mic_failure
+ MAC_ASSIGN(addr, addr);
+ __entry->key_type = key_type;
+ __entry->key_id = key_id;
+- memcpy(__entry->tsc, tsc, 6);
++ if (tsc)
++ memcpy(__entry->tsc, tsc, 6);
+ ),
+ TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT ", key type: %d, key id: %d, tsc: %pm",
+ NETDEV_PR_ARG, MAC_PR_ARG(addr), __entry->key_type,
--- /dev/null
+From 4c63f83c2c2e16a13ce274ee678e28246bd33645 Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Tue, 29 Jul 2014 18:41:09 +0000
+Subject: crypto: af_alg - properly label AF_ALG socket
+
+From: Milan Broz <gmazyland@gmail.com>
+
+commit 4c63f83c2c2e16a13ce274ee678e28246bd33645 upstream.
+
+Th AF_ALG socket was missing a security label (e.g. SELinux)
+which means that socket was in "unlabeled" state.
+
+This was recently demonstrated in the cryptsetup package
+(cryptsetup v1.6.5 and later.)
+See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
+
+This patch clones the sock's label from the parent sock
+and resolves the issue (similar to AF_BLUETOOTH protocol family).
+
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/af_alg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -21,6 +21,7 @@
+ #include <linux/module.h>
+ #include <linux/net.h>
+ #include <linux/rwsem.h>
++#include <linux/security.h>
+
+ struct alg_type_list {
+ const struct af_alg_type *type;
+@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struc
+
+ sock_init_data(newsock, sk2);
+ sock_graft(sk2, newsock);
++ security_sk_clone(sk, sk2);
+
+ err = type->accept(ask->private, sk2);
+ if (err) {
--- /dev/null
+From f3c400ef473e00c680ea713a66196b05870b3710 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 25 Jul 2014 19:42:30 -0400
+Subject: crypto: arm-aes - fix encryption of unaligned data
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit f3c400ef473e00c680ea713a66196b05870b3710 upstream.
+
+Fix the same alignment bug as in arm64 - we need to pass residue
+unprocessed bytes as the last argument to blkcipher_walk_done.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/crypto/aesbs-glue.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/crypto/aesbs-glue.c
++++ b/arch/arm/crypto/aesbs-glue.c
+@@ -137,7 +137,7 @@ static int aesbs_cbc_encrypt(struct blkc
+ dst += AES_BLOCK_SIZE;
+ } while (--blocks);
+ }
+- err = blkcipher_walk_done(desc, &walk, 0);
++ err = blkcipher_walk_done(desc, &walk, walk.nbytes % AES_BLOCK_SIZE);
+ }
+ return err;
+ }
+@@ -158,7 +158,7 @@ static int aesbs_cbc_decrypt(struct blkc
+ bsaes_cbc_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ walk.nbytes, &ctx->dec, walk.iv);
+ kernel_neon_end();
+- err = blkcipher_walk_done(desc, &walk, 0);
++ err = blkcipher_walk_done(desc, &walk, walk.nbytes % AES_BLOCK_SIZE);
+ }
+ while (walk.nbytes) {
+ u32 blocks = walk.nbytes / AES_BLOCK_SIZE;
+@@ -182,7 +182,7 @@ static int aesbs_cbc_decrypt(struct blkc
+ dst += AES_BLOCK_SIZE;
+ src += AES_BLOCK_SIZE;
+ } while (--blocks);
+- err = blkcipher_walk_done(desc, &walk, 0);
++ err = blkcipher_walk_done(desc, &walk, walk.nbytes % AES_BLOCK_SIZE);
+ }
+ return err;
+ }
+@@ -268,7 +268,7 @@ static int aesbs_xts_encrypt(struct blkc
+ bsaes_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ walk.nbytes, &ctx->enc, walk.iv);
+ kernel_neon_end();
+- err = blkcipher_walk_done(desc, &walk, 0);
++ err = blkcipher_walk_done(desc, &walk, walk.nbytes % AES_BLOCK_SIZE);
+ }
+ return err;
+ }
+@@ -292,7 +292,7 @@ static int aesbs_xts_decrypt(struct blkc
+ bsaes_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ walk.nbytes, &ctx->dec, walk.iv);
+ kernel_neon_end();
+- err = blkcipher_walk_done(desc, &walk, 0);
++ err = blkcipher_walk_done(desc, &walk, walk.nbytes % AES_BLOCK_SIZE);
+ }
+ return err;
+ }
--- /dev/null
+From 0193ed8225e1a79ed64632106ec3cc81798cb13c Mon Sep 17 00:00:00 2001
+From: Alexandre Bounine <alexandre.bounine@idt.com>
+Date: Wed, 30 Jul 2014 16:08:26 -0700
+Subject: rapidio/tsi721_dma: fix failure to obtain transaction descriptor
+
+From: Alexandre Bounine <alexandre.bounine@idt.com>
+
+commit 0193ed8225e1a79ed64632106ec3cc81798cb13c upstream.
+
+This is a bug fix for the situation when function tsi721_desc_get() fails
+to obtain a free transaction descriptor.
+
+The bug usually results in a memory access crash dump when data transfer
+scatter-gather list has more entries than size of hardware buffer
+descriptors ring. This fix ensures that error is properly returned to a
+caller instead of an invalid entry.
+
+This patch is applicable to kernel versions starting from v3.5.
+
+Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Andre van Herk <andre.van.herk@prodrive-technologies.com>
+Cc: Stef van Os <stef.van.os@prodrive-technologies.com>
+Cc: Vinod Koul <vinod.koul@intel.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rapidio/devices/tsi721_dma.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/rapidio/devices/tsi721_dma.c
++++ b/drivers/rapidio/devices/tsi721_dma.c
+@@ -287,6 +287,12 @@ struct tsi721_tx_desc *tsi721_desc_get(s
+ "desc %p not ACKed\n", tx_desc);
+ }
+
++ if (ret == NULL) {
++ dev_dbg(bdma_chan->dchan.device->dev,
++ "%s: unable to obtain tx descriptor\n", __func__);
++ goto err_out;
++ }
++
+ i = bdma_chan->wr_count_next % bdma_chan->bd_num;
+ if (i == bdma_chan->bd_num - 1) {
+ i = 0;
+@@ -297,7 +303,7 @@ struct tsi721_tx_desc *tsi721_desc_get(s
+ tx_desc->txd.phys = bdma_chan->bd_phys +
+ i * sizeof(struct tsi721_dma_desc);
+ tx_desc->hw_desc = &((struct tsi721_dma_desc *)bdma_chan->bd_base)[i];
+-
++err_out:
+ spin_unlock_bh(&bdma_chan->lock);
+
+ return ret;
--- /dev/null
+From 89fb4cd1f717a871ef79fa7debbe840e3225cd54 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Thu, 3 Jul 2014 19:17:34 +0200
+Subject: scsi: handle flush errors properly
+
+From: James Bottomley <JBottomley@Parallels.com>
+
+commit 89fb4cd1f717a871ef79fa7debbe840e3225cd54 upstream.
+
+Flush commands don't transfer data and thus need to be special cased
+in the I/O completion handler so that we can propagate errors to
+the block layer and filesystem.
+
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Reported-by: Steven Haber <steven@qumulo.com>
+Tested-by: Steven Haber <steven@qumulo.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_lib.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -831,6 +831,14 @@ void scsi_io_completion(struct scsi_cmnd
+ scsi_next_command(cmd);
+ return;
+ }
++ } else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
++ /*
++ * Certain non BLOCK_PC requests are commands that don't
++ * actually transfer anything (FLUSH), so cannot use
++ * good_bytes != blk_rq_bytes(req) as the signal for an error.
++ * This sets the error explicitly for the problem case.
++ */
++ error = __scsi_error_from_host_byte(cmd, result);
+ }
+
+ /* no bidi support for !REQ_TYPE_BLOCK_PC yet */
projects / thirdparty / kernel / stable-queue.git / commitdiff
