From: Greg Kroah-Hartman Date: Tue, 10 Apr 2012 18:59:37 +0000 (-0700) Subject: 3.2-stable patches X-Git-Tag: v3.3.2~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e47ca850561edc4092173f40a4f3170733cff8d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.2-stable patches added patches: mmc-atmel-mci-correct-data-timeout-computation.patch mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch modpost-fix-modpost-license-checking-of-vmlinux.o.patch sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch --- diff --git a/queue-3.2/mmc-atmel-mci-correct-data-timeout-computation.patch b/queue-3.2/mmc-atmel-mci-correct-data-timeout-computation.patch new file mode 100644 index 00000000000..d1079e403fd --- /dev/null +++ b/queue-3.2/mmc-atmel-mci-correct-data-timeout-computation.patch @@ -0,0 +1,40 @@ +From 66292ad92c6d3f2f1c137a1c826b331ca8595dfd Mon Sep 17 00:00:00 2001 +From: Ludovic Desroches +Date: Wed, 28 Mar 2012 12:28:33 +0200 +Subject: mmc: atmel-mci: correct data timeout computation + +From: Ludovic Desroches + +commit 66292ad92c6d3f2f1c137a1c826b331ca8595dfd upstream. + +The HSMCI operates at a rate of up to Master Clock divided by two. +Moreover previous calculation can cause overflows and so wrong +timeouts. + +Signed-off-by: Ludovic Desroches +Acked-by: Nicolas Ferre +Signed-off-by: Chris Ball +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/atmel-mci.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -480,7 +480,14 @@ err: + static inline unsigned int atmci_ns_to_clocks(struct atmel_mci *host, + unsigned int ns) + { +- return (ns * (host->bus_hz / 1000000) + 999) / 1000; ++ /* ++ * It is easier here to use us instead of ns for the timeout, ++ * it prevents from overflows during calculation. ++ */ ++ unsigned int us = DIV_ROUND_UP(ns, 1000); ++ ++ /* Maximum clock frequency is host->bus_hz/2 */ ++ return us * (DIV_ROUND_UP(host->bus_hz, 2000000)); + } + + static void atmci_set_timeout(struct atmel_mci *host, diff --git a/queue-3.2/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch b/queue-3.2/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch new file mode 100644 index 00000000000..f7fb6ac428d --- /dev/null +++ b/queue-3.2/mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch @@ -0,0 +1,33 @@ +From 8c2fc8e413ecc2c96b696e28d4eb1bc6cee8dc84 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alf=20H=C3=B8gemark?= +Date: Wed, 4 Apr 2012 12:27:09 -0400 +Subject: mmc: sdhci-dove: Fix compile error by including module.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alf Høgemark + +commit 8c2fc8e413ecc2c96b696e28d4eb1bc6cee8dc84 upstream. + +This patch fixes a compile error in drivers/mmc/host/sdhci-dove.c +by including the linux/module.h file. + +Signed-off-by: Alf Høgemark +Signed-off-by: Chris Ball +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-dove.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/sdhci-dove.c ++++ b/drivers/mmc/host/sdhci-dove.c +@@ -20,6 +20,7 @@ + */ + + #include ++#include + #include + + #include "sdhci-pltfm.h" diff --git a/queue-3.2/modpost-fix-modpost-license-checking-of-vmlinux.o.patch b/queue-3.2/modpost-fix-modpost-license-checking-of-vmlinux.o.patch new file mode 100644 index 00000000000..2d6b688f554 --- /dev/null +++ b/queue-3.2/modpost-fix-modpost-license-checking-of-vmlinux.o.patch @@ -0,0 +1,70 @@ +From 258f742635360175564e9470eb060ff4d4b984e7 Mon Sep 17 00:00:00 2001 +From: Frank Rowand +Date: Mon, 9 Apr 2012 17:59:03 -0700 +Subject: modpost: Fix modpost license checking of vmlinux.o + +From: Frank Rowand + +commit 258f742635360175564e9470eb060ff4d4b984e7 upstream. + +Commit f02e8a6596b7 ("module: Sort exported symbols") sorts symbols +placing each of them in its own elf section. This sorting and merging +into the canonical sections are done by the linker. + +Unfortunately modpost to generate Module.symvers file parses vmlinux.o +(which is not linked yet) and all modules object files (which aren't +linked yet). These aren't sanitized by the linker yet. That breaks +modpost that can't detect license properly for modules. + +This patch makes modpost aware of the new exported symbols structure. + +[ This above is a slightly corrected version of the explanation of the + problem, copied from commit 62a2635610db ("modpost: Fix modpost's + license checking V3"). That commit fixed the problem for module + object files, but not for vmlinux.o. This patch fixes modpost for + vmlinux.o. ] + +Signed-off-by: Frank Rowand +Signed-off-by: Alessio Igor Bogani +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/mod/modpost.c | 7 +++++-- + scripts/mod/modpost.h | 1 + + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -132,8 +132,10 @@ static struct module *new_module(char *m + /* strip trailing .o */ + s = strrchr(p, '.'); + if (s != NULL) +- if (strcmp(s, ".o") == 0) ++ if (strcmp(s, ".o") == 0) { + *s = '\0'; ++ mod->is_dot_o = 1; ++ } + + /* add to list */ + mod->name = p; +@@ -587,7 +589,8 @@ static void handle_modversions(struct mo + unsigned int crc; + enum export export; + +- if (!is_vmlinux(mod->name) && strncmp(symname, "__ksymtab", 9) == 0) ++ if ((!is_vmlinux(mod->name) || mod->is_dot_o) && ++ strncmp(symname, "__ksymtab", 9) == 0) + export = export_from_secname(info, get_secindex(info, sym)); + else + export = export_from_sec(info, get_secindex(info, sym)); +--- a/scripts/mod/modpost.h ++++ b/scripts/mod/modpost.h +@@ -113,6 +113,7 @@ struct module { + int has_cleanup; + struct buffer dev_table_buf; + char srcversion[25]; ++ int is_dot_o; + }; + + struct elf_info { diff --git a/queue-3.2/series b/queue-3.2/series index 8c88027c4dd..1d92a0e83d0 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -37,3 +37,9 @@ kgdbts-2-of-2-fix-single-step-awareness-to-work-correctly-with-smp.patch x86-kgdb-fix-debug_rodata-limitation-using-text_poke.patch cifs-fix-vfs-lock-usage-for-oplocked-files.patch arm-tegra-remove-tegra30-errata-from-mach_tegra_dt.patch +mmc-sdhci-dove-fix-compile-error-by-including-module.h.patch +mmc-atmel-mci-correct-data-timeout-computation.patch +tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch +tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch +sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch +modpost-fix-modpost-license-checking-of-vmlinux.o.patch diff --git a/queue-3.2/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch b/queue-3.2/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch new file mode 100644 index 00000000000..274867ac40c --- /dev/null +++ b/queue-3.2/sysctl-fix-write-access-to-dmesg_restrict-kptr_restrict.patch @@ -0,0 +1,69 @@ +From 620f6e8e855d6d447688a5f67a4e176944a084e8 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 4 Apr 2012 11:40:19 -0700 +Subject: sysctl: fix write access to dmesg_restrict/kptr_restrict + +From: Kees Cook + +commit 620f6e8e855d6d447688a5f67a4e176944a084e8 upstream. + +Commit bfdc0b4 adds code to restrict access to dmesg_restrict, +however, it incorrectly alters kptr_restrict rather than +dmesg_restrict. + +The original patch from Richard Weinberger +(https://lkml.org/lkml/2011/3/14/362) alters dmesg_restrict as +expected, and so the patch seems to have been misapplied. + +This adds the CAP_SYS_ADMIN check to both dmesg_restrict and +kptr_restrict, since both are sensitive. + +Reported-by: Phillip Lougher +Signed-off-by: Kees Cook +Acked-by: Serge Hallyn +Acked-by: Richard Weinberger +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sysctl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -166,7 +166,7 @@ static int proc_taint(struct ctl_table * + #endif + + #ifdef CONFIG_PRINTK +-static int proc_dmesg_restrict(struct ctl_table *table, int write, ++static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); + #endif + +@@ -713,7 +713,7 @@ static struct ctl_table kern_table[] = { + .data = &dmesg_restrict, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec_minmax, ++ .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = &zero, + .extra2 = &one, + }, +@@ -722,7 +722,7 @@ static struct ctl_table kern_table[] = { + .data = &kptr_restrict, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dmesg_restrict, ++ .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = &zero, + .extra2 = &two, + }, +@@ -2422,7 +2422,7 @@ static int proc_taint(struct ctl_table * + } + + #ifdef CONFIG_PRINTK +-static int proc_dmesg_restrict(struct ctl_table *table, int write, ++static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { + if (write && !capable(CAP_SYS_ADMIN)) diff --git a/queue-3.2/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch b/queue-3.2/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch new file mode 100644 index 00000000000..ed4bbfc6b38 --- /dev/null +++ b/queue-3.2/tcm_fc-add-abort-flag-for-gracefully-handling-exchange-timeout.patch @@ -0,0 +1,95 @@ +From e1c4038282c7586c3544542b37872c434669d3ac Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Tue, 3 Apr 2012 10:24:41 -0700 +Subject: tcm_fc: Add abort flag for gracefully handling exchange timeout + +From: Mark Rustad + +commit e1c4038282c7586c3544542b37872c434669d3ac upstream. + +Add abort flag and use it to terminate processing when an exchange +is timed out or is reset. The abort flag is used in place of the +transport_generic_free_cmd function call in the reset and timeout +cases, because calling that function in that context would free +memory that was in use. The aborted flag allows the lifetime to +be managed in a more normal way, while truncating the processing. + +This change eliminates a source of memory corruption which +manifested in a variety of ugly ways. + +(nab: Drop unused struct fc_exch *ep in ft_recv_seq) + +Signed-off-by: Mark Rustad +Acked-by: Kiran Patil +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/tcm_fc/tcm_fc.h | 1 + + drivers/target/tcm_fc/tfc_cmd.c | 10 ++++++++-- + drivers/target/tcm_fc/tfc_io.c | 2 ++ + 3 files changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/target/tcm_fc/tcm_fc.h ++++ b/drivers/target/tcm_fc/tcm_fc.h +@@ -124,6 +124,7 @@ struct ft_cmd { + /* Local sense buffer */ + unsigned char ft_sense_buffer[TRANSPORT_SENSE_BUFFER]; + u32 was_ddp_setup:1; /* Set only if ddp is setup */ ++ u32 aborted:1; /* Set if aborted by reset or timeout */ + struct scatterlist *sg; /* Set only if DDP is setup */ + u32 sg_cnt; /* No. of item in scatterlist */ + }; +--- a/drivers/target/tcm_fc/tfc_cmd.c ++++ b/drivers/target/tcm_fc/tfc_cmd.c +@@ -130,6 +130,8 @@ int ft_queue_status(struct se_cmd *se_cm + struct fc_exch *ep; + size_t len; + ++ if (cmd->aborted) ++ return 0; + ft_dump_cmd(cmd, __func__); + ep = fc_seq_exch(cmd->seq); + lport = ep->lp; +@@ -196,6 +198,8 @@ int ft_write_pending(struct se_cmd *se_c + + ft_dump_cmd(cmd, __func__); + ++ if (cmd->aborted) ++ return 0; + ep = fc_seq_exch(cmd->seq); + lport = ep->lp; + fp = fc_frame_alloc(lport, sizeof(*txrdy)); +@@ -266,10 +270,10 @@ static void ft_recv_seq(struct fc_seq *s + struct ft_cmd *cmd = arg; + struct fc_frame_header *fh; + +- if (IS_ERR(fp)) { ++ if (unlikely(IS_ERR(fp))) { + /* XXX need to find cmd if queued */ + cmd->seq = NULL; +- transport_generic_free_cmd(&cmd->se_cmd, 0); ++ cmd->aborted = true; + return; + } + +@@ -447,6 +451,8 @@ int ft_queue_tm_resp(struct se_cmd *se_c + struct se_tmr_req *tmr = se_cmd->se_tmr_req; + enum fcp_resp_rsp_codes code; + ++ if (cmd->aborted) ++ return 0; + switch (tmr->response) { + case TMR_FUNCTION_COMPLETE: + code = FCP_TMF_CMPL; +--- a/drivers/target/tcm_fc/tfc_io.c ++++ b/drivers/target/tcm_fc/tfc_io.c +@@ -84,6 +84,8 @@ int ft_queue_data_in(struct se_cmd *se_c + void *from; + void *to = NULL; + ++ if (cmd->aborted) ++ return 0; + ep = fc_seq_exch(cmd->seq); + lport = ep->lp; + cmd->seq = lport->tt.seq_start_next(cmd->seq); diff --git a/queue-3.2/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch b/queue-3.2/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch new file mode 100644 index 00000000000..d4db3f2b9cb --- /dev/null +++ b/queue-3.2/tcm_fc-do-not-free-tpg-structure-during-wq-allocation-failure.patch @@ -0,0 +1,58 @@ +From 06383f10c49f507220594a455c6491ca6f8c94ab Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Tue, 3 Apr 2012 10:24:52 -0700 +Subject: tcm_fc: Do not free tpg structure during wq allocation failure + +From: Mark Rustad + +commit 06383f10c49f507220594a455c6491ca6f8c94ab upstream. + +Avoid freeing a registered tpg structure if an alloc_workqueue call +fails. This fixes a bug where the failure was leaking memory associated +with se_portal_group setup during the original core_tpg_register() call. + +Signed-off-by: Mark Rustad +Acked-by: Kiran Patil +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/tcm_fc/tfc_conf.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/target/tcm_fc/tfc_conf.c ++++ b/drivers/target/tcm_fc/tfc_conf.c +@@ -304,6 +304,7 @@ static struct se_portal_group *ft_add_tp + { + struct ft_lport_acl *lacl; + struct ft_tpg *tpg; ++ struct workqueue_struct *wq; + unsigned long index; + int ret; + +@@ -325,18 +326,20 @@ static struct se_portal_group *ft_add_tp + tpg->lport_acl = lacl; + INIT_LIST_HEAD(&tpg->lun_list); + +- ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg, +- tpg, TRANSPORT_TPG_TYPE_NORMAL); +- if (ret < 0) { ++ wq = alloc_workqueue("tcm_fc", 0, 1); ++ if (!wq) { + kfree(tpg); + return NULL; + } + +- tpg->workqueue = alloc_workqueue("tcm_fc", 0, 1); +- if (!tpg->workqueue) { ++ ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg, ++ tpg, TRANSPORT_TPG_TYPE_NORMAL); ++ if (ret < 0) { ++ destroy_workqueue(wq); + kfree(tpg); + return NULL; + } ++ tpg->workqueue = wq; + + mutex_lock(&ft_lport_lock); + list_add_tail(&tpg->list, &lacl->tpg_list);