--- /dev/null
+From a3d63cadbad97671d740a9698acc2c95d1ca6e79 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 22 Feb 2013 21:09:17 +0100
+Subject: ath9k: fix RSSI dummy marker value
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit a3d63cadbad97671d740a9698acc2c95d1ca6e79 upstream.
+
+RSSI is being stored internally as s8 in several places. The indication
+of an unset RSSI value, ATH_RSSI_DUMMY_MARKER, was supposed to have been
+set to 127, but ended up being set to 0x127 because of a code cleanup
+mistake. This could lead to invalid signal strength values in a few
+places.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/common.h
++++ b/drivers/net/wireless/ath/ath9k/common.h
+@@ -27,7 +27,7 @@
+ #define WME_MAX_BA WME_BA_BMP_SIZE
+ #define ATH_TID_MAX_BUFS (2 * WME_MAX_BA)
+
+-#define ATH_RSSI_DUMMY_MARKER 0x127
++#define ATH_RSSI_DUMMY_MARKER 127
+ #define ATH_RSSI_LPF_LEN 10
+ #define RSSI_LPF_THRESHOLD -20
+ #define ATH_RSSI_EP_MULTIPLIER (1<<7)
--- /dev/null
+From 838f427955dcfd16858b0108ce29029da0d56a4e Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Fri, 22 Feb 2013 21:37:25 +0100
+Subject: ath9k_htc: fix signal strength handling issues
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 838f427955dcfd16858b0108ce29029da0d56a4e upstream.
+
+The ath9k commit 2ef167557c0a26c88162ecffb017bfcc51eb7b29
+(ath9k: fix signal strength reporting issues) fixed an issue where the
+reported per-frame signal strength reported to mac80211 was being
+overwritten with an internal average. The same issue is also present
+in ath9k_htc.
+In addition to preventing the driver from overwriting the value, this
+commit also ensures that the internal average (which is used for ANI)
+only tracks beacons of the AP that we're connected to.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/htc.h | 1 +
+ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 18 +++++++++++-------
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -22,6 +22,7 @@
+ #include <linux/firmware.h>
+ #include <linux/skbuff.h>
+ #include <linux/netdevice.h>
++#include <linux/etherdevice.h>
+ #include <linux/leds.h>
+ #include <linux/slab.h>
+ #include <net/mac80211.h>
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -1067,15 +1067,19 @@ static bool ath9k_rx_prepare(struct ath9
+
+ last_rssi = priv->rx.last_rssi;
+
+- if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+- rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
+- ATH_RSSI_EP_MULTIPLIER);
++ if (ieee80211_is_beacon(hdr->frame_control) &&
++ !is_zero_ether_addr(common->curbssid) &&
++ ether_addr_equal(hdr->addr3, common->curbssid)) {
++ s8 rssi = rxbuf->rxstatus.rs_rssi;
+
+- if (rxbuf->rxstatus.rs_rssi < 0)
+- rxbuf->rxstatus.rs_rssi = 0;
++ if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
++ rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
+
+- if (ieee80211_is_beacon(fc))
+- priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
++ if (rssi < 0)
++ rssi = 0;
++
++ priv->ah->stats.avgbrssi = rssi;
++ }
+
+ rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
+ rx_status->band = hw->conf.channel->band;
--- /dev/null
+From 3412f2f086ea7531378fabe756bd4a1109994ae6 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Mon, 25 Feb 2013 20:51:07 +0100
+Subject: ath9k_hw: improve reset reliability after errors
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 3412f2f086ea7531378fabe756bd4a1109994ae6 upstream.
+
+On many different chips, important aspects of the MAC state are not
+fully cleared by a warm reset. This can show up as tx/rx hangs, those
+annoying "DMA failed to stop in 10 ms..." messages or other quirks.
+
+On AR933x, the chip can occasionally get stuck in a way that only a
+driver unload/reload or a reboot would bring it back to life.
+
+With this patch, a full reset is issued when bringing the chip out of
+FULL-SLEEP state (after idle), or if either Rx or Tx was not shut down
+properly. This makes the DMA related error messages disappear completely
+in my tests on AR933x, and the chip does not get stuck anymore.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1480,7 +1480,9 @@ static bool ath9k_hw_chip_reset(struct a
+ reset_type = ATH9K_RESET_POWER_ON;
+ else
+ reset_type = ATH9K_RESET_COLD;
+- }
++ } else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
++ (REG_READ(ah, AR_CR) & AR_CR_RXE))
++ reset_type = ATH9K_RESET_COLD;
+
+ if (!ath9k_hw_set_reset_reg(ah, reset_type))
+ return false;
--- /dev/null
+From a64685399181780998281fe07309a94b25dd24c3 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 21 Feb 2013 14:33:17 +1100
+Subject: md: fix two bugs when attempting to resize RAID0 array.
+
+From: NeilBrown <neilb@suse.de>
+
+commit a64685399181780998281fe07309a94b25dd24c3 upstream.
+
+You cannot resize a RAID0 array (in terms of making the devices
+bigger), but the code doesn't entirely stop you.
+So:
+
+ disable setting of the available size on each device for
+ RAID0 and Linear devices. This must not change as doing so
+ can change the effective layout of data.
+
+ Make sure that the size that raid0_size() reports is accurate,
+ but rounding devices sizes to chunk sizes. As the device sizes
+ cannot change now, this isn't so important, but it is best to be
+ safe.
+
+Without this change:
+ mdadm --grow /dev/md0 -z max
+ mdadm --grow /dev/md0 -Z max
+ then read to the end of the array
+
+can cause a BUG in a RAID0 array.
+
+These bugs have been present ever since it became possible
+to resize any device, which is a long time. So the fix is
+suitable for any -stable kerenl.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 3 +++
+ drivers/md/raid0.c | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2998,6 +2998,9 @@ rdev_size_store(struct md_rdev *rdev, co
+ } else if (!sectors)
+ sectors = (i_size_read(rdev->bdev->bd_inode) >> 9) -
+ rdev->data_offset;
++ if (!my_mddev->pers->resize)
++ /* Cannot change size for RAID0 or Linear etc */
++ return -EINVAL;
+ }
+ if (sectors < my_mddev->dev_sectors)
+ return -EINVAL; /* component must fit device */
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -411,7 +411,8 @@ static sector_t raid0_size(struct mddev
+ "%s does not support generic reshape\n", __func__);
+
+ rdev_for_each(rdev, mddev)
+- array_sectors += rdev->sectors;
++ array_sectors += (rdev->sectors &
++ ~(sector_t)(mddev->chunk_sectors-1));
+
+ return array_sectors;
+ }
--- /dev/null
+From bbfa57c0f2243a7c31fd248d22e9861a2802cad5 Mon Sep 17 00:00:00 2001
+From: Sebastian Riemer <sebastian.riemer@profitbricks.com>
+Date: Thu, 21 Feb 2013 13:28:09 +1100
+Subject: md: protect against crash upon fsync on ro array
+
+From: Sebastian Riemer <sebastian.riemer@profitbricks.com>
+
+commit bbfa57c0f2243a7c31fd248d22e9861a2802cad5 upstream.
+
+If an fsync occurs on a read-only array, we need to send a
+completion for the IO and may not increment the active IO count.
+Otherwise, we hit a bug trace and can't stop the MD array anymore.
+
+By advice of Christoph Hellwig we return success upon a flush
+request but we return -EROFS for other writes.
+We detect flush requests by checking if the bio has zero sectors.
+
+This patch is suitable to any -stable kernel to which it applies.
+
+Signed-off-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Cc: NeilBrown <neilb@suse.de>
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -307,6 +307,10 @@ static void md_make_request(struct reque
+ bio_io_error(bio);
+ return;
+ }
++ if (mddev->ro == 1 && unlikely(rw == WRITE)) {
++ bio_endio(bio, bio_sectors(bio) == 0 ? 0 : -EROFS);
++ return;
++ }
+ smp_rmb(); /* Ensure implications of 'active' are visible */
+ rcu_read_lock();
+ if (mddev->suspended) {
--- /dev/null
+From 58ebb34c49fcfcaa029e4b1c1453d92583900f9a Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 21 Feb 2013 15:36:38 +1100
+Subject: md: raid0: fix error return from create_stripe_zones.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 58ebb34c49fcfcaa029e4b1c1453d92583900f9a upstream.
+
+Create_stripe_zones returns an error slightly differently to
+raid0_run and to raid0_takeover_*.
+
+The error returned used by the second was wrong and an error would
+result in mddev->private being set to NULL and sooner or later a
+crash.
+
+So never return NULL, return ERR_PTR(err), not NULL from
+create_stripe_zones.
+
+This bug has been present since 2.6.35 so the fix is suitable
+for any kernel since then.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -289,7 +289,7 @@ abort:
+ kfree(conf->strip_zone);
+ kfree(conf->devlist);
+ kfree(conf);
+- *private_conf = NULL;
++ *private_conf = ERR_PTR(err);
+ return err;
+ }
+
--- /dev/null
+From ee0b0244030434cdda26777bfb98962447e080cd Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 25 Feb 2013 12:38:29 +1100
+Subject: md/raid1,raid10: fix deadlock with freeze_array()
+
+From: NeilBrown <neilb@suse.de>
+
+commit ee0b0244030434cdda26777bfb98962447e080cd upstream.
+
+When raid1/raid10 needs to fix a read error, it first drains
+all pending requests by calling freeze_array().
+This calls flush_pending_writes() if it needs to sleep,
+but some writes may be pending in a per-process plug rather
+than in the per-array request queue.
+
+When raid1{,0}_unplug() moves the request from the per-process
+plug to the per-array request queue (from which
+flush_pending_writes() can flush them), it needs to wake up
+freeze_array(), or freeze_array() will never flush them and so
+it will block forever.
+
+So add the requires wake_up() calls.
+
+This bug was introduced by commit
+ f54a9d0e59c4bea3db733921ca9147612a6f292c
+for raid1 and a similar commit for RAID10, and so has been present
+since linux-3.6. As the bug causes a deadlock I believe this fix is
+suitable for -stable.
+
+Reported-by: Tregaron Bayly <tbayly@bluehost.com>
+Tested-by: Tregaron Bayly <tbayly@bluehost.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid1.c | 1 +
+ drivers/md/raid10.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -967,6 +967,7 @@ static void raid1_unplug(struct blk_plug
+ bio_list_merge(&conf->pending_bio_list, &plug->pending);
+ conf->pending_count += plug->pending_cnt;
+ spin_unlock_irq(&conf->device_lock);
++ wake_up(&conf->wait_barrier);
+ md_wakeup_thread(mddev->thread);
+ kfree(plug);
+ return;
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1073,6 +1073,7 @@ static void raid10_unplug(struct blk_plu
+ bio_list_merge(&conf->pending_bio_list, &plug->pending);
+ conf->pending_count += plug->pending_cnt;
+ spin_unlock_irq(&conf->device_lock);
++ wake_up(&conf->wait_barrier);
+ md_wakeup_thread(mddev->thread);
+ kfree(plug);
+ return;
--- /dev/null
+From e5ab012c3271990e8457055c25cafddc1ae8aa6b Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Wed, 20 Feb 2013 16:15:36 +0100
+Subject: nohz: Make tick_nohz_irq_exit() irq safe
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit e5ab012c3271990e8457055c25cafddc1ae8aa6b upstream.
+
+As it stands, irq_exit() may or may not be called with
+irqs disabled, depending on __ARCH_IRQ_EXIT_IRQS_DISABLED
+that the arch can define.
+
+It makes tick_nohz_irq_exit() unsafe. For example two
+interrupts can race in tick_nohz_stop_sched_tick(): the inner
+most one computes the expiring time on top of the timer list,
+then it's interrupted right before reprogramming the
+clock. The new interrupt enqueues a new timer list timer,
+it reprogram the clock to take it into account and it exits.
+The CPUs resumes the inner most interrupt and performs the clock
+reprogramming without considering the new timer list timer.
+
+This regression has been introduced by:
+ 280f06774afedf849f0b34248ed6aff57d0f6908
+ ("nohz: Separate out irq exit and idle loop dyntick logic")
+
+Let's fix it right now with the appropriate protections.
+
+A saner long term solution will be to remove
+__ARCH_IRQ_EXIT_IRQS_DISABLED and mandate that irq_exit() is called
+with interrupts disabled.
+
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linuxfoundation.org>
+Link: http://lkml.kernel.org/r/1361373336-11337-1-git-send-email-fweisbec@gmail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/tick-sched.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -564,14 +564,19 @@ void tick_nohz_idle_enter(void)
+ */
+ void tick_nohz_irq_exit(void)
+ {
++ unsigned long flags;
+ struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+
+ if (!ts->inidle)
+ return;
+
+- /* Cancel the timer because CPU already waken up from the C-states*/
++ local_irq_save(flags);
++
++ /* Cancel the timer because CPU already waken up from the C-states */
+ menu_hrtimer_cancel();
+ __tick_nohz_idle_enter(ts);
++
++ local_irq_restore(flags);
+ }
+
+ /**
--- /dev/null
+From e70ab977991964a5a7ad1182799451d067e62669 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Mon, 25 Feb 2013 21:32:25 +0000
+Subject: proc connector: reject unprivileged listener bumps
+
+From: Kees Cook <keescook@chromium.org>
+
+commit e70ab977991964a5a7ad1182799451d067e62669 upstream.
+
+While PROC_CN_MCAST_LISTEN/IGNORE is entirely advisory, it was possible
+for an unprivileged user to turn off notifications for all listeners by
+sending PROC_CN_MCAST_IGNORE. Instead, require the same privileges as
+required for a multicast bind.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: Evgeniy Polyakov <zbr@ioremap.net>
+Cc: Matt Helsley <matthltc@us.ibm.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Acked-by: Matt Helsley <matthltc@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/connector/cn_proc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/connector/cn_proc.c
++++ b/drivers/connector/cn_proc.c
+@@ -313,6 +313,12 @@ static void cn_proc_mcast_ctl(struct cn_
+ (task_active_pid_ns(current) != &init_pid_ns))
+ return;
+
++ /* Can only change if privileged. */
++ if (!capable(CAP_NET_ADMIN)) {
++ err = EPERM;
++ goto out;
++ }
++
+ mc_op = (enum proc_cn_mcast_op *)msg->data;
+ switch (*mc_op) {
+ case PROC_CN_MCAST_LISTEN:
+@@ -325,6 +331,8 @@ static void cn_proc_mcast_ctl(struct cn_
+ err = EINVAL;
+ break;
+ }
++
++out:
+ cn_proc_ack(err, msg->seq, msg->ack);
+ }
+
iwlwifi-always-copy-first-16-bytes-of-commands.patch
mwifiex-correct-sleep-delay-counter.patch
libertas-fix-crash-for-sd8688.patch
+ath9k-fix-rssi-dummy-marker-value.patch
+ath9k_htc-fix-signal-strength-handling-issues.patch
+ath9k_hw-improve-reset-reliability-after-errors.patch
+proc-connector-reject-unprivileged-listener-bumps.patch
+nohz-make-tick_nohz_irq_exit-irq-safe.patch
+md-protect-against-crash-upon-fsync-on-ro-array.patch
+md-fix-two-bugs-when-attempting-to-resize-raid0-array.patch
+md-raid0-fix-error-return-from-create_stripe_zones.patch
+md-raid1-raid10-fix-deadlock-with-freeze_array.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
