From: Greg Kroah-Hartman Date: Tue, 20 Nov 2012 00:18:15 +0000 (-0800) Subject: 3.6-stable patches X-Git-Tag: v3.0.53~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1df8150e7db8fd2f076053681d22f60d054618b1;p=thirdparty%2Fkernel%2Fstable-queue.git 3.6-stable patches added patches: arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch arm-imx-ehci-fix-host-power-mask-bit.patch bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch drm-radeon-fix-logic-error-in-atombios_encoders.c.patch i2c-mux-pinctrl-fix-probe-error-path.patch iwlwifi-handle-dma-mapping-failures.patch kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch m68k-fix-sigset_t-accessor-functions.patch memcg-fix-hotplugged-memory-zone-oops.patch memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch pstore-fix-null-pointer-dereference-in-console-writes.patch regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch revert-staging-android-alarm-ioctl-command-encoding-fix.patch s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch usb-keyspan-fix-typo-causing-gpf-on-open.patch usb-option-add-alcatel-x220-x500d-usb-ids.patch usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch usb-usb_wwan-fix-bulk-urb-allocation.patch wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch --- diff --git a/queue-3.6/arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch b/queue-3.6/arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch new file mode 100644 index 00000000000..59081e007cc --- /dev/null +++ b/queue-3.6/arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch @@ -0,0 +1,33 @@ +From 322337b8fbd8c392246529d5db924820fc0c7381 Mon Sep 17 00:00:00 2001 +From: Pritesh Raithatha +Date: Tue, 30 Oct 2012 15:37:09 +0530 +Subject: ARM: dt: tegra: fix length of pad control and mux registers + +From: Pritesh Raithatha + +commit 322337b8fbd8c392246529d5db924820fc0c7381 upstream. + +The reg property contains not . Fix +the length values to be length not last_offset. + +Signed-off-by: Pritesh Raithatha +Signed-off-by: Stephen Warren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/tegra30.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/tegra30.dtsi ++++ b/arch/arm/boot/dts/tegra30.dtsi +@@ -73,8 +73,8 @@ + + pinmux: pinmux { + compatible = "nvidia,tegra30-pinmux"; +- reg = <0x70000868 0xd0 /* Pad control registers */ +- 0x70003000 0x3e0>; /* Mux registers */ ++ reg = <0x70000868 0xd4 /* Pad control registers */ ++ 0x70003000 0x3e4>; /* Mux registers */ + }; + + serial@70006000 { diff --git a/queue-3.6/arm-imx-ehci-fix-host-power-mask-bit.patch b/queue-3.6/arm-imx-ehci-fix-host-power-mask-bit.patch new file mode 100644 index 00000000000..54966f547db --- /dev/null +++ b/queue-3.6/arm-imx-ehci-fix-host-power-mask-bit.patch @@ -0,0 +1,46 @@ +From 3d5e2abe6e265acc5e1fda810301243e9bac92b2 Mon Sep 17 00:00:00 2001 +From: Christoph Fritz +Date: Fri, 16 Nov 2012 15:39:24 +0100 +Subject: ARM: imx: ehci: fix host power mask bit + +From: Christoph Fritz + +commit 3d5e2abe6e265acc5e1fda810301243e9bac92b2 upstream. + +This patch sets HPM (Host power mask bit) to bit 16 according to i.MX +Reference Manual. Falsely it was set to bit 8, but this controls pull-up +Impedance. + +Reported-by: Michael Burkey +Signed-off-by: Christoph Fritz +Acked-by: Eric Bénard +Signed-off-by: Sascha Hauer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/ehci-imx25.c | 2 +- + arch/arm/mach-imx/ehci-imx35.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-imx/ehci-imx25.c ++++ b/arch/arm/mach-imx/ehci-imx25.c +@@ -30,7 +30,7 @@ + #define MX25_H1_SIC_SHIFT 21 + #define MX25_H1_SIC_MASK (0x3 << MX25_H1_SIC_SHIFT) + #define MX25_H1_PP_BIT (1 << 18) +-#define MX25_H1_PM_BIT (1 << 8) ++#define MX25_H1_PM_BIT (1 << 16) + #define MX25_H1_IPPUE_UP_BIT (1 << 7) + #define MX25_H1_IPPUE_DOWN_BIT (1 << 6) + #define MX25_H1_TLL_BIT (1 << 5) +--- a/arch/arm/mach-imx/ehci-imx35.c ++++ b/arch/arm/mach-imx/ehci-imx35.c +@@ -30,7 +30,7 @@ + #define MX35_H1_SIC_SHIFT 21 + #define MX35_H1_SIC_MASK (0x3 << MX35_H1_SIC_SHIFT) + #define MX35_H1_PP_BIT (1 << 18) +-#define MX35_H1_PM_BIT (1 << 8) ++#define MX35_H1_PM_BIT (1 << 16) + #define MX35_H1_IPPUE_UP_BIT (1 << 7) + #define MX35_H1_IPPUE_DOWN_BIT (1 << 6) + #define MX35_H1_TLL_BIT (1 << 5) diff --git a/queue-3.6/bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch b/queue-3.6/bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch new file mode 100644 index 00000000000..7246004068e --- /dev/null +++ b/queue-3.6/bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch @@ -0,0 +1,59 @@ +From 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 Mon Sep 17 00:00:00 2001 +From: Johan Hedberg +Date: Fri, 19 Oct 2012 20:10:46 +0300 +Subject: Bluetooth: Fix having bogus entries in mgmt_read_index_list reply + +From: Johan Hedberg + +commit 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 upstream. + +The mgmt_read_index_list uses one loop to calculate the max needed size +of its response with the help of an upper-bound of the controller count. +The second loop is more strict as it checks for HCI_SETUP (which might +have gotten set after the first loop) and could result in some indexes +being skipped. Because of this the function needs to readjust the event +length and index count after filling in the response array. + +Signed-off-by: Johan Hedberg +Acked-by: Marcel Holtmann +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -321,7 +321,7 @@ static int read_index_list(struct sock * + struct hci_dev *d; + size_t rp_len; + u16 count; +- int i, err; ++ int err; + + BT_DBG("sock %p", sk); + +@@ -339,17 +339,18 @@ static int read_index_list(struct sock * + return -ENOMEM; + } + +- rp->num_controllers = cpu_to_le16(count); +- +- i = 0; ++ count = 0; + list_for_each_entry(d, &hci_dev_list, list) { + if (test_bit(HCI_SETUP, &d->dev_flags)) + continue; + +- rp->index[i++] = cpu_to_le16(d->id); ++ rp->index[count++] = cpu_to_le16(d->id); + BT_DBG("Added hci%u", d->id); + } + ++ rp->num_controllers = cpu_to_le16(count); ++ rp_len = sizeof(*rp) + (2 * count); ++ + read_unlock(&hci_dev_list_lock); + + err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp, diff --git a/queue-3.6/drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch b/queue-3.6/drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch new file mode 100644 index 00000000000..c7270f73e48 --- /dev/null +++ b/queue-3.6/drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch @@ -0,0 +1,83 @@ +From d0ddfbd3d1346c1f481ec2289eef350cdba64b42 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Mon, 12 Nov 2012 18:31:35 +0200 +Subject: drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures + +From: Jani Nikula + +commit d0ddfbd3d1346c1f481ec2289eef350cdba64b42 upstream. + +Any failures in intel_sdvo_init() after the intel_sdvo_setup_output() call +left behind ghost connectors, attached (with a dangling pointer) to the +sdvo that has been cleaned up and freed. Properly destroy any connectors +attached to the encoder. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46381 +CC: Chris Wilson +Signed-off-by: Jani Nikula +Tested-by: bjo@nord-west.org +[danvet: added a comment to explain why we need to clean up connectors +even when sdvo_output_setup fails.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_sdvo.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_sdvo.c ++++ b/drivers/gpu/drm/i915/intel_sdvo.c +@@ -2287,6 +2287,18 @@ intel_sdvo_output_setup(struct intel_sdv + return true; + } + ++static void intel_sdvo_output_cleanup(struct intel_sdvo *intel_sdvo) ++{ ++ struct drm_device *dev = intel_sdvo->base.base.dev; ++ struct drm_connector *connector, *tmp; ++ ++ list_for_each_entry_safe(connector, tmp, ++ &dev->mode_config.connector_list, head) { ++ if (intel_attached_encoder(connector) == &intel_sdvo->base) ++ intel_sdvo_destroy(connector); ++ } ++} ++ + static bool intel_sdvo_tv_create_property(struct intel_sdvo *intel_sdvo, + struct intel_sdvo_connector *intel_sdvo_connector, + int type) +@@ -2606,7 +2618,8 @@ bool intel_sdvo_init(struct drm_device * + intel_sdvo->caps.output_flags) != true) { + DRM_DEBUG_KMS("SDVO output failed to setup on %s\n", + SDVO_NAME(intel_sdvo)); +- goto err; ++ /* Output_setup can leave behind connectors! */ ++ goto err_output; + } + + /* Only enable the hotplug irq if we need it, to work around noisy +@@ -2619,12 +2632,12 @@ bool intel_sdvo_init(struct drm_device * + + /* Set the input timing to the screen. Assume always input 0. */ + if (!intel_sdvo_set_target_input(intel_sdvo)) +- goto err; ++ goto err_output; + + if (!intel_sdvo_get_input_pixel_clock_range(intel_sdvo, + &intel_sdvo->pixel_clock_min, + &intel_sdvo->pixel_clock_max)) +- goto err; ++ goto err_output; + + DRM_DEBUG_KMS("%s device VID/DID: %02X:%02X.%02X, " + "clock range %dMHz - %dMHz, " +@@ -2644,6 +2657,9 @@ bool intel_sdvo_init(struct drm_device * + (SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N'); + return true; + ++err_output: ++ intel_sdvo_output_cleanup(intel_sdvo); ++ + err: + drm_encoder_cleanup(&intel_encoder->base); + i2c_del_adapter(&intel_sdvo->ddc); diff --git a/queue-3.6/drm-radeon-fix-logic-error-in-atombios_encoders.c.patch b/queue-3.6/drm-radeon-fix-logic-error-in-atombios_encoders.c.patch new file mode 100644 index 00000000000..0a97d54df59 --- /dev/null +++ b/queue-3.6/drm-radeon-fix-logic-error-in-atombios_encoders.c.patch @@ -0,0 +1,32 @@ +From b9196395c905edec512dfd6690428084228c16ec Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 14 Nov 2012 09:10:39 -0500 +Subject: drm/radeon: fix logic error in atombios_encoders.c + +From: Alex Deucher + +commit b9196395c905edec512dfd6690428084228c16ec upstream. + +Fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=50431 + +Reported-by: David Binderman +Signed-off-by: Alex Deucher +Reviewed-by: Michel Dänzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_encoders.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1421,7 +1421,7 @@ radeon_atom_encoder_dpms_dig(struct drm_ + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0); + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0); + /* some early dce3.2 boards have a bug in their transmitter control table */ +- if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730)) ++ if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730)) + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0); + } + if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) { diff --git a/queue-3.6/i2c-mux-pinctrl-fix-probe-error-path.patch b/queue-3.6/i2c-mux-pinctrl-fix-probe-error-path.patch new file mode 100644 index 00000000000..58cf2b42c09 --- /dev/null +++ b/queue-3.6/i2c-mux-pinctrl-fix-probe-error-path.patch @@ -0,0 +1,31 @@ +From aa1e3e81e75ceb3d977c3292cefafcd5179eb8b8 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 13 Nov 2012 22:27:19 +0100 +Subject: i2c-mux-pinctrl: Fix probe error path + +From: Guenter Roeck + +commit aa1e3e81e75ceb3d977c3292cefafcd5179eb8b8 upstream. + +When allocating the memory for i2c busses, the code checked the wrong +variable and thus never detected if there was a memory error. + +Signed-off-by: Guenter Roeck +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c +@@ -169,7 +169,7 @@ static int __devinit i2c_mux_pinctrl_pro + mux->busses = devm_kzalloc(&pdev->dev, + sizeof(mux->busses) * mux->pdata->bus_count, + GFP_KERNEL); +- if (!mux->states) { ++ if (!mux->busses) { + dev_err(&pdev->dev, "Cannot allocate busses\n"); + ret = -ENOMEM; + goto err; diff --git a/queue-3.6/iwlwifi-handle-dma-mapping-failures.patch b/queue-3.6/iwlwifi-handle-dma-mapping-failures.patch new file mode 100644 index 00000000000..d4e8bf4a916 --- /dev/null +++ b/queue-3.6/iwlwifi-handle-dma-mapping-failures.patch @@ -0,0 +1,62 @@ +From 7c34158231b2eda8dcbd297be2bb1559e69cb433 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Sun, 4 Nov 2012 09:29:17 +0100 +Subject: iwlwifi: handle DMA mapping failures + +From: Johannes Berg + +commit 7c34158231b2eda8dcbd297be2bb1559e69cb433 upstream. + +The RX replenish code doesn't handle DMA mapping failures, +which will cause issues if there actually is a failure. This +was reported by Shuah Khan who found a DMA mapping framework +warning ("device driver failed to check map error"). + +Reported-by: Shuah Khan +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/rx.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/iwlwifi/pcie/rx.c +@@ -314,6 +314,14 @@ static void iwlagn_rx_allocate(struct iw + dma_map_page(trans->dev, page, 0, + PAGE_SIZE << trans_pcie->rx_page_order, + DMA_FROM_DEVICE); ++ if (dma_mapping_error(trans->dev, rxb->page_dma)) { ++ rxb->page = NULL; ++ spin_lock_irqsave(&rxq->lock, flags); ++ list_add(&rxb->list, &rxq->rx_used); ++ spin_unlock_irqrestore(&rxq->lock, flags); ++ __free_pages(page, trans_pcie->rx_page_order); ++ return; ++ } + /* dma address must be no more than 36 bits */ + BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36)); + /* and also 256 byte aligned! */ +@@ -463,8 +471,19 @@ static void iwl_rx_handle_rxbuf(struct i + dma_map_page(trans->dev, rxb->page, 0, + PAGE_SIZE << trans_pcie->rx_page_order, + DMA_FROM_DEVICE); +- list_add_tail(&rxb->list, &rxq->rx_free); +- rxq->free_count++; ++ if (dma_mapping_error(trans->dev, rxb->page_dma)) { ++ /* ++ * free the page(s) as well to not break ++ * the invariant that the items on the used ++ * list have no page(s) ++ */ ++ __free_pages(rxb->page, trans_pcie->rx_page_order); ++ rxb->page = NULL; ++ list_add_tail(&rxb->list, &rxq->rx_used); ++ } else { ++ list_add_tail(&rxb->list, &rxq->rx_free); ++ rxq->free_count++; ++ } + } else + list_add_tail(&rxb->list, &rxq->rx_used); + spin_unlock_irqrestore(&rxq->lock, flags); diff --git a/queue-3.6/kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch b/queue-3.6/kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch new file mode 100644 index 00000000000..eef804b63d4 --- /dev/null +++ b/queue-3.6/kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch @@ -0,0 +1,74 @@ +From 29282fde80d44e587f8c152b10049a56e61659f0 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 9 Nov 2012 15:20:17 +0100 +Subject: KVM: x86: Fix invalid secondary exec controls in vmx_cpuid_update() + +From: Takashi Iwai + +commit 29282fde80d44e587f8c152b10049a56e61659f0 upstream. + +The commit [ad756a16: KVM: VMX: Implement PCID/INVPCID for guests with +EPT] introduced the unconditional access to SECONDARY_VM_EXEC_CONTROL, +and this triggers kernel warnings like below on old CPUs: + + vmwrite error: reg 401e value a0568000 (err 12) + Pid: 13649, comm: qemu-kvm Not tainted 3.7.0-rc4-test2+ #154 + Call Trace: + [] vmwrite_error+0x27/0x29 [kvm_intel] + [] vmcs_writel+0x1b/0x20 [kvm_intel] + [] vmx_cpuid_update+0x74/0x170 [kvm_intel] + [] kvm_vcpu_ioctl_set_cpuid2+0x76/0x90 [kvm] + [] kvm_arch_vcpu_ioctl+0xc37/0xed0 [kvm] + [] ? __vunmap+0x9c/0x110 + [] ? vmx_vcpu_load+0x39/0x1a0 [kvm_intel] + [] ? kvm_arch_vcpu_load+0x52/0x1a0 [kvm] + [] ? vcpu_load+0x74/0xd0 [kvm] + [] kvm_vcpu_ioctl+0x110/0x5e0 [kvm] + [] ? kvm_dev_ioctl+0x4d/0x4a0 [kvm] + [] do_vfs_ioctl+0x8f/0x530 + [] ? remove_vma+0x56/0x60 + [] ? do_munmap+0x328/0x400 + [] ? fget_light+0x4c/0x100 + [] sys_ioctl+0x91/0xb0 + [] system_call_fastpath+0x1a/0x1f + +This patch adds a check for the availability of secondary exec +control to avoid these warnings. + +Signed-off-by: Takashi Iwai +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6584,19 +6584,22 @@ static void vmx_cpuid_update(struct kvm_ + } + } + +- exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL); + /* Exposing INVPCID only when PCID is exposed */ + best = kvm_find_cpuid_entry(vcpu, 0x7, 0); + if (vmx_invpcid_supported() && + best && (best->ebx & bit(X86_FEATURE_INVPCID)) && + guest_cpuid_has_pcid(vcpu)) { ++ exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL); + exec_control |= SECONDARY_EXEC_ENABLE_INVPCID; + vmcs_write32(SECONDARY_VM_EXEC_CONTROL, + exec_control); + } else { +- exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID; +- vmcs_write32(SECONDARY_VM_EXEC_CONTROL, +- exec_control); ++ if (cpu_has_secondary_exec_ctrls()) { ++ exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL); ++ exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID; ++ vmcs_write32(SECONDARY_VM_EXEC_CONTROL, ++ exec_control); ++ } + if (best) + best->ebx &= ~bit(X86_FEATURE_INVPCID); + } diff --git a/queue-3.6/m68k-fix-sigset_t-accessor-functions.patch b/queue-3.6/m68k-fix-sigset_t-accessor-functions.patch new file mode 100644 index 00000000000..7312549202a --- /dev/null +++ b/queue-3.6/m68k-fix-sigset_t-accessor-functions.patch @@ -0,0 +1,54 @@ +From 34fa78b59c52d1db3513db4c1a999db26b2e9ac2 Mon Sep 17 00:00:00 2001 +From: Andreas Schwab +Date: Sat, 17 Nov 2012 22:27:04 +0100 +Subject: m68k: fix sigset_t accessor functions + +From: Andreas Schwab + +commit 34fa78b59c52d1db3513db4c1a999db26b2e9ac2 upstream. + +The sigaddset/sigdelset/sigismember functions that are implemented with +bitfield insn cannot allow the sigset argument to be placed in a data +register since the sigset is wider than 32 bits. Remove the "d" +constraint from the asm statements. + +The effect of the bug is that sending RT signals does not work, the signal +number is truncated modulo 32. + +Signed-off-by: Andreas Schwab +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + arch/m68k/include/asm/signal.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/m68k/include/asm/signal.h ++++ b/arch/m68k/include/asm/signal.h +@@ -156,7 +156,7 @@ typedef struct sigaltstack { + static inline void sigaddset(sigset_t *set, int _sig) + { + asm ("bfset %0{%1,#1}" +- : "+od" (*set) ++ : "+o" (*set) + : "id" ((_sig - 1) ^ 31) + : "cc"); + } +@@ -164,7 +164,7 @@ static inline void sigaddset(sigset_t *s + static inline void sigdelset(sigset_t *set, int _sig) + { + asm ("bfclr %0{%1,#1}" +- : "+od" (*set) ++ : "+o" (*set) + : "id" ((_sig - 1) ^ 31) + : "cc"); + } +@@ -180,7 +180,7 @@ static inline int __gen_sigismember(sigs + int ret; + asm ("bfextu %1{%2,#1},%0" + : "=d" (ret) +- : "od" (*set), "id" ((_sig-1) ^ 31) ++ : "o" (*set), "id" ((_sig-1) ^ 31) + : "cc"); + return ret; + } diff --git a/queue-3.6/memcg-fix-hotplugged-memory-zone-oops.patch b/queue-3.6/memcg-fix-hotplugged-memory-zone-oops.patch new file mode 100644 index 00000000000..61d95442340 --- /dev/null +++ b/queue-3.6/memcg-fix-hotplugged-memory-zone-oops.patch @@ -0,0 +1,205 @@ +From bea8c150a7efbc0f204e709b7274fe273f55e0d3 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 16 Nov 2012 14:14:54 -0800 +Subject: memcg: fix hotplugged memory zone oops + +From: Hugh Dickins + +commit bea8c150a7efbc0f204e709b7274fe273f55e0d3 upstream. + +When MEMCG is configured on (even when it's disabled by boot option), +when adding or removing a page to/from its lru list, the zone pointer +used for stats updates is nowadays taken from the struct lruvec. (On +many configurations, calculating zone from page is slower.) + +But we have no code to update all the lruvecs (per zone, per memcg) when +a memory node is hotadded. Here's an extract from the oops which +results when running numactl to bind a program to a newly onlined node: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000f60 + IP: __mod_zone_page_state+0x9/0x60 + Pid: 1219, comm: numactl Not tainted 3.6.0-rc5+ #180 Bochs Bochs + Process numactl (pid: 1219, threadinfo ffff880039abc000, task ffff8800383c4ce0) + Call Trace: + __pagevec_lru_add_fn+0xdf/0x140 + pagevec_lru_move_fn+0xb1/0x100 + __pagevec_lru_add+0x1c/0x30 + lru_add_drain_cpu+0xa3/0x130 + lru_add_drain+0x2f/0x40 + ... + +The natural solution might be to use a memcg callback whenever memory is +hotadded; but that solution has not been scoped out, and it happens that +we do have an easy location at which to update lruvec->zone. The lruvec +pointer is discovered either by mem_cgroup_zone_lruvec() or by +mem_cgroup_page_lruvec(), and both of those do know the right zone. + +So check and set lruvec->zone in those; and remove the inadequate +attempt to set lruvec->zone from lruvec_init(), which is called before +NODE_DATA(node) has been allocated in such cases. + +Ah, there was one exceptionr. For no particularly good reason, +mem_cgroup_force_empty_list() has its own code for deciding lruvec. +Change it to use the standard mem_cgroup_zone_lruvec() and +mem_cgroup_get_lru_size() too. In fact it was already safe against such +an oops (the lru lists in danger could only be empty), but we're better +proofed against future changes this way. + +I've marked this for stable (3.6) since we introduced the problem in 3.5 +(now closed to stable); but I have no idea if this is the only fix +needed to get memory hotadd working with memcg in 3.6, and received no +answer when I enquired twice before. + +Reported-by: Tang Chen +Signed-off-by: Hugh Dickins +Acked-by: Johannes Weiner +Acked-by: KAMEZAWA Hiroyuki +Cc: Konstantin Khlebnikov +Cc: Wen Congyang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/mmzone.h | 2 +- + mm/memcontrol.c | 46 +++++++++++++++++++++++++++++++++++----------- + mm/mmzone.c | 6 +----- + mm/page_alloc.c | 2 +- + 4 files changed, 38 insertions(+), 18 deletions(-) + +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -744,7 +744,7 @@ extern int init_currently_empty_zone(str + unsigned long size, + enum memmap_context context); + +-extern void lruvec_init(struct lruvec *lruvec, struct zone *zone); ++extern void lruvec_init(struct lruvec *lruvec); + + static inline struct zone *lruvec_zone(struct lruvec *lruvec) + { +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1061,12 +1061,24 @@ struct lruvec *mem_cgroup_zone_lruvec(st + struct mem_cgroup *memcg) + { + struct mem_cgroup_per_zone *mz; ++ struct lruvec *lruvec; + +- if (mem_cgroup_disabled()) +- return &zone->lruvec; ++ if (mem_cgroup_disabled()) { ++ lruvec = &zone->lruvec; ++ goto out; ++ } + + mz = mem_cgroup_zoneinfo(memcg, zone_to_nid(zone), zone_idx(zone)); +- return &mz->lruvec; ++ lruvec = &mz->lruvec; ++out: ++ /* ++ * Since a node can be onlined after the mem_cgroup was created, ++ * we have to be prepared to initialize lruvec->zone here; ++ * and if offlined then reonlined, we need to reinitialize it. ++ */ ++ if (unlikely(lruvec->zone != zone)) ++ lruvec->zone = zone; ++ return lruvec; + } + + /* +@@ -1093,9 +1105,12 @@ struct lruvec *mem_cgroup_page_lruvec(st + struct mem_cgroup_per_zone *mz; + struct mem_cgroup *memcg; + struct page_cgroup *pc; ++ struct lruvec *lruvec; + +- if (mem_cgroup_disabled()) +- return &zone->lruvec; ++ if (mem_cgroup_disabled()) { ++ lruvec = &zone->lruvec; ++ goto out; ++ } + + pc = lookup_page_cgroup(page); + memcg = pc->mem_cgroup; +@@ -1113,7 +1128,16 @@ struct lruvec *mem_cgroup_page_lruvec(st + pc->mem_cgroup = memcg = root_mem_cgroup; + + mz = page_cgroup_zoneinfo(memcg, page); +- return &mz->lruvec; ++ lruvec = &mz->lruvec; ++out: ++ /* ++ * Since a node can be onlined after the mem_cgroup was created, ++ * we have to be prepared to initialize lruvec->zone here; ++ * and if offlined then reonlined, we need to reinitialize it. ++ */ ++ if (unlikely(lruvec->zone != zone)) ++ lruvec->zone = zone; ++ return lruvec; + } + + /** +@@ -3703,17 +3727,17 @@ unsigned long mem_cgroup_soft_limit_recl + static bool mem_cgroup_force_empty_list(struct mem_cgroup *memcg, + int node, int zid, enum lru_list lru) + { +- struct mem_cgroup_per_zone *mz; ++ struct lruvec *lruvec; + unsigned long flags, loop; + struct list_head *list; + struct page *busy; + struct zone *zone; + + zone = &NODE_DATA(node)->node_zones[zid]; +- mz = mem_cgroup_zoneinfo(memcg, node, zid); +- list = &mz->lruvec.lists[lru]; ++ lruvec = mem_cgroup_zone_lruvec(zone, memcg); ++ list = &lruvec->lists[lru]; + +- loop = mz->lru_size[lru]; ++ loop = mem_cgroup_get_lru_size(lruvec, lru); + /* give some margin against EBUSY etc...*/ + loop += 256; + busy = NULL; +@@ -4751,7 +4775,7 @@ static int alloc_mem_cgroup_per_zone_inf + + for (zone = 0; zone < MAX_NR_ZONES; zone++) { + mz = &pn->zoneinfo[zone]; +- lruvec_init(&mz->lruvec, &NODE_DATA(node)->node_zones[zone]); ++ lruvec_init(&mz->lruvec); + mz->usage_in_excess = 0; + mz->on_tree = false; + mz->memcg = memcg; +--- a/mm/mmzone.c ++++ b/mm/mmzone.c +@@ -87,7 +87,7 @@ int memmap_valid_within(unsigned long pf + } + #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */ + +-void lruvec_init(struct lruvec *lruvec, struct zone *zone) ++void lruvec_init(struct lruvec *lruvec) + { + enum lru_list lru; + +@@ -95,8 +95,4 @@ void lruvec_init(struct lruvec *lruvec, + + for_each_lru(lru) + INIT_LIST_HEAD(&lruvec->lists[lru]); +- +-#ifdef CONFIG_MEMCG +- lruvec->zone = zone; +-#endif + } +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -4456,7 +4456,7 @@ static void __paginginit free_area_init_ + zone->zone_pgdat = pgdat; + + zone_pcp_init(zone); +- lruvec_init(&zone->lruvec, zone); ++ lruvec_init(&zone->lruvec); + if (!size) + continue; + diff --git a/queue-3.6/memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch b/queue-3.6/memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch new file mode 100644 index 00000000000..5ebf53c910f --- /dev/null +++ b/queue-3.6/memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch @@ -0,0 +1,88 @@ +From 9a5a8f19b43430752067ecaee62fc59e11e88fa6 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Fri, 16 Nov 2012 14:14:49 -0800 +Subject: memcg: oom: fix totalpages calculation for memory.swappiness==0 + +From: Michal Hocko + +commit 9a5a8f19b43430752067ecaee62fc59e11e88fa6 upstream. + +oom_badness() takes a totalpages argument which says how many pages are +available and it uses it as a base for the score calculation. The value +is calculated by mem_cgroup_get_limit which considers both limit and +total_swap_pages (resp. memsw portion of it). + +This is usually correct but since fe35004fbf9e ("mm: avoid swapping out +with swappiness==0") we do not swap when swappiness is 0 which means +that we cannot really use up all the totalpages pages. This in turn +confuses oom score calculation if the memcg limit is much smaller than +the available swap because the used memory (capped by the limit) is +negligible comparing to totalpages so the resulting score is too small +if adj!=0 (typically task with CAP_SYS_ADMIN or non zero oom_score_adj). +A wrong process might be selected as result. + +The problem can be worked around by checking mem_cgroup_swappiness==0 +and not considering swap at all in such a case. + +Signed-off-by: Michal Hocko +Acked-by: David Rientjes +Acked-by: Johannes Weiner +Acked-by: KOSAKI Motohiro +Acked-by: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/cgroups/memory.txt | 4 ++++ + mm/memcontrol.c | 21 +++++++++++++++------ + 2 files changed, 19 insertions(+), 6 deletions(-) + +--- a/Documentation/cgroups/memory.txt ++++ b/Documentation/cgroups/memory.txt +@@ -466,6 +466,10 @@ Note: + 5.3 swappiness + + Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only. ++Please note that unlike the global swappiness, memcg knob set to 0 ++really prevents from any swapping even if there is a swap storage ++available. This might lead to memcg OOM killer if there are no file ++pages to reclaim. + + Following cgroups' swappiness can't be changed. + - root cgroup (uses /proc/sys/vm/swappiness). +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1458,17 +1458,26 @@ static int mem_cgroup_count_children(str + static u64 mem_cgroup_get_limit(struct mem_cgroup *memcg) + { + u64 limit; +- u64 memsw; + + limit = res_counter_read_u64(&memcg->res, RES_LIMIT); +- limit += total_swap_pages << PAGE_SHIFT; + +- memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT); + /* +- * If memsw is finite and limits the amount of swap space available +- * to this memcg, return that limit. ++ * Do not consider swap space if we cannot swap due to swappiness + */ +- return min(limit, memsw); ++ if (mem_cgroup_swappiness(memcg)) { ++ u64 memsw; ++ ++ limit += total_swap_pages << PAGE_SHIFT; ++ memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT); ++ ++ /* ++ * If memsw is finite and limits the amount of swap space ++ * available to this memcg, return that limit. ++ */ ++ limit = min(limit, memsw); ++ } ++ ++ return limit; + } + + void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, diff --git a/queue-3.6/pstore-fix-null-pointer-dereference-in-console-writes.patch b/queue-3.6/pstore-fix-null-pointer-dereference-in-console-writes.patch new file mode 100644 index 00000000000..2db6eaf216b --- /dev/null +++ b/queue-3.6/pstore-fix-null-pointer-dereference-in-console-writes.patch @@ -0,0 +1,43 @@ +From 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 14 Nov 2012 11:49:53 +0000 +Subject: pstore: Fix NULL pointer dereference in console writes + +From: Colin Ian King + +commit 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef upstream. + +Passing a NULL id causes a NULL pointer deference in writers such as +erst_writer and efi_pstore_write because they expect to update this id. +Pass a dummy id instead. + +This avoids a cascade of oopses caused when the initial +pstore_console_write passes a null which in turn causes writes to the +console causing further oopses in subsequent pstore_console_write calls. + +Signed-off-by: Colin Ian King +Acked-by: Kees Cook +Signed-off-by: Anton Vorontsov +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pstore/platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -161,12 +161,13 @@ static void pstore_console_write(struct + + while (s < e) { + unsigned long flags; ++ u64 id; + + if (c > psinfo->bufsize) + c = psinfo->bufsize; + spin_lock_irqsave(&psinfo->buf_lock, flags); + memcpy(psinfo->buf, s, c); +- psinfo->write(PSTORE_TYPE_CONSOLE, 0, NULL, 0, c, psinfo); ++ psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, c, psinfo); + spin_unlock_irqrestore(&psinfo->buf_lock, flags); + s += c; + c = e - s; diff --git a/queue-3.6/regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch b/queue-3.6/regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch new file mode 100644 index 00000000000..ecd7691ba64 --- /dev/null +++ b/queue-3.6/regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch @@ -0,0 +1,31 @@ +From f0f98b19e23d4426ca185e3d4ca80e6aff5ef51b Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Tue, 13 Nov 2012 09:48:51 +0100 +Subject: regulator: fix voltage check in regulator_is_supported_voltage() + +From: Marek Szyprowski + +commit f0f98b19e23d4426ca185e3d4ca80e6aff5ef51b upstream. + +regulator_is_supported_voltage() should return true only if the voltage +of fixed/constant regulator is between min_uV and max_uV. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1942,7 +1942,7 @@ int regulator_is_supported_voltage(struc + if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) { + ret = regulator_get_voltage(regulator); + if (ret >= 0) +- return (min_uV >= ret && ret <= max_uV); ++ return (min_uV <= ret && ret <= max_uV); + else + return ret; + } diff --git a/queue-3.6/revert-staging-android-alarm-ioctl-command-encoding-fix.patch b/queue-3.6/revert-staging-android-alarm-ioctl-command-encoding-fix.patch new file mode 100644 index 00000000000..9e9a19e1bdf --- /dev/null +++ b/queue-3.6/revert-staging-android-alarm-ioctl-command-encoding-fix.patch @@ -0,0 +1,39 @@ +From d38e0e3fed4f58bcddef4dc93a591dfe2f651cb0 Mon Sep 17 00:00:00 2001 +From: Colin Cross +Date: Wed, 7 Nov 2012 18:21:51 -0800 +Subject: Revert "Staging: Android alarm: IOCTL command encoding fix" + +From: Colin Cross + +commit d38e0e3fed4f58bcddef4dc93a591dfe2f651cb0 upstream. + +Commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 changed the +ANDROID_ALARM_GET_TIME ioctls from IOW to IOR. While technically +correct, the _IOC_DIR bits are ignored by alarm_ioctl, so the +commit breaks a userspace ABI used by all existing Android devices +for a purely cosmetic reason. Revert it. + +Cc: Dae S. Kim +Signed-off-by: Colin Cross +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/android_alarm.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/staging/android/android_alarm.h ++++ b/drivers/staging/android/android_alarm.h +@@ -51,12 +51,10 @@ enum android_alarm_return_flags { + #define ANDROID_ALARM_WAIT _IO('a', 1) + + #define ALARM_IOW(c, type, size) _IOW('a', (c) | ((type) << 4), size) +-#define ALARM_IOR(c, type, size) _IOR('a', (c) | ((type) << 4), size) +- + /* Set alarm */ + #define ANDROID_ALARM_SET(type) ALARM_IOW(2, type, struct timespec) + #define ANDROID_ALARM_SET_AND_WAIT(type) ALARM_IOW(3, type, struct timespec) +-#define ANDROID_ALARM_GET_TIME(type) ALARM_IOR(4, type, struct timespec) ++#define ANDROID_ALARM_GET_TIME(type) ALARM_IOW(4, type, struct timespec) + #define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec) + #define ANDROID_ALARM_BASE_CMD(cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0))) + #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd) (_IOC_NR(cmd) >> 4) diff --git a/queue-3.6/s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch b/queue-3.6/s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch new file mode 100644 index 00000000000..fabcfc76f25 --- /dev/null +++ b/queue-3.6/s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch @@ -0,0 +1,36 @@ +From d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 22 Oct 2012 15:49:02 +0200 +Subject: s390/gup: add missing TASK_SIZE check to get_user_pages_fast() + +From: Heiko Carstens + +commit d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4 upstream. + +When walking page tables we need to make sure that everything +is within bounds of the ASCE limit of the task's address space. +Otherwise we might calculate e.g. a pud pointer which is not +within a pud and dereference it. +So check against TASK_SIZE (which is the ASCE limit) before +walking page tables. + +Reviewed-by: Gerald Schaefer +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/mm/gup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/mm/gup.c ++++ b/arch/s390/mm/gup.c +@@ -183,7 +183,7 @@ int get_user_pages_fast(unsigned long st + addr = start; + len = (unsigned long) nr_pages << PAGE_SHIFT; + end = start + len; +- if (end < start) ++ if ((end < start) || (end > TASK_SIZE)) + goto slow_irqon; + + /* diff --git a/queue-3.6/series b/queue-3.6/series index 135519fc1c8..f66bbe953c4 100644 --- a/queue-3.6/series +++ b/queue-3.6/series @@ -29,3 +29,25 @@ asoc-dapm-use-card_list-during-dapm-shutdown.patch asoc-core-double-control-update-err-for-snd_soc_put_volsw_sx.patch ubifs-fix-mounting-problems-after-power-cuts.patch ubifs-introduce-categorized-lprops-counter.patch +pstore-fix-null-pointer-dereference-in-console-writes.patch +regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch +i2c-mux-pinctrl-fix-probe-error-path.patch +arm-imx-ehci-fix-host-power-mask-bit.patch +arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch +revert-staging-android-alarm-ioctl-command-encoding-fix.patch +s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch +usb-keyspan-fix-typo-causing-gpf-on-open.patch +usb-usb_wwan-fix-bulk-urb-allocation.patch +usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch +usb-option-add-alcatel-x220-x500d-usb-ids.patch +drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch +drm-radeon-fix-logic-error-in-atombios_encoders.c.patch +tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch +kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch +ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch +memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch +memcg-fix-hotplugged-memory-zone-oops.patch +iwlwifi-handle-dma-mapping-failures.patch +wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch +bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch +m68k-fix-sigset_t-accessor-functions.patch diff --git a/queue-3.6/tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch b/queue-3.6/tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch new file mode 100644 index 00000000000..722ac1276b4 --- /dev/null +++ b/queue-3.6/tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch @@ -0,0 +1,70 @@ +From 215c02bc33bbd5ff4d7379a909462d11f0103218 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 16 Nov 2012 14:15:03 -0800 +Subject: tmpfs: fix shmem_getpage_gfp() VM_BUG_ON + +From: Hugh Dickins + +commit 215c02bc33bbd5ff4d7379a909462d11f0103218 upstream. + +Fuzzing with trinity hit the "impossible" VM_BUG_ON(error) (which Fedora +has converted to WARNING) in shmem_getpage_gfp(): + + WARNING: at mm/shmem.c:1151 shmem_getpage_gfp+0xa5c/0xa70() + Pid: 29795, comm: trinity-child4 Not tainted 3.7.0-rc2+ #49 + Call Trace: + warn_slowpath_common+0x7f/0xc0 + warn_slowpath_null+0x1a/0x20 + shmem_getpage_gfp+0xa5c/0xa70 + shmem_fault+0x4f/0xa0 + __do_fault+0x71/0x5c0 + handle_pte_fault+0x97/0xae0 + handle_mm_fault+0x289/0x350 + __do_page_fault+0x18e/0x530 + do_page_fault+0x2b/0x50 + page_fault+0x28/0x30 + tracesys+0xe1/0xe6 + +Thanks to Johannes for pointing to truncation: free_swap_and_cache() +only does a trylock on the page, so the page lock we've held since +before confirming swap is not enough to protect against truncation. + +What cleanup is needed in this case? Just delete_from_swap_cache(), +which takes care of the memcg uncharge. + +Signed-off-by: Hugh Dickins +Reported-by: Dave Jones +Cc: Johannes Weiner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/shmem.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1156,8 +1156,20 @@ repeat: + if (!error) { + error = shmem_add_to_page_cache(page, mapping, index, + gfp, swp_to_radix_entry(swap)); +- /* We already confirmed swap, and make no allocation */ +- VM_BUG_ON(error); ++ /* ++ * We already confirmed swap under page lock, and make ++ * no memory allocation here, so usually no possibility ++ * of error; but free_swap_and_cache() only trylocks a ++ * page, so it is just possible that the entry has been ++ * truncated or holepunched since swap was confirmed. ++ * shmem_undo_range() will have done some of the ++ * unaccounting, now delete_from_swap_cache() will do ++ * the rest (including mem_cgroup_uncharge_swapcache). ++ * Reset swap.val? No, leave it so "failed" goes back to ++ * "repeat": reading a hole and writing should succeed. ++ */ ++ if (error) ++ delete_from_swap_cache(page); + } + if (error) + goto failed; diff --git a/queue-3.6/ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch b/queue-3.6/ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch new file mode 100644 index 00000000000..0c968c1720a --- /dev/null +++ b/queue-3.6/ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch @@ -0,0 +1,38 @@ +From ac207ed2471150e06af0afc76e4becc701fa2733 Mon Sep 17 00:00:00 2001 +From: Zhao Yakui +Date: Tue, 13 Nov 2012 18:31:55 +0000 +Subject: ttm: Clear the ttm page allocated from high memory zone correctly + +From: Zhao Yakui + +commit ac207ed2471150e06af0afc76e4becc701fa2733 upstream. + +The TTM page can be allocated from high memory. In such case it is +wrong to use the page_address(page) as the virtual address for the high memory +page. + +bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50241 + +Signed-off-by: Zhao Yakui +Reviewed-by: Thomas Hellstrom +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ttm/ttm_page_alloc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -749,7 +749,10 @@ static int ttm_get_pages(struct page **p + /* clear the pages coming from the pool if requested */ + if (flags & TTM_PAGE_FLAG_ZERO_ALLOC) { + list_for_each_entry(p, &plist, lru) { +- clear_page(page_address(p)); ++ if (PageHighMem(p)) ++ clear_highpage(p); ++ else ++ clear_page(page_address(p)); + } + } + diff --git a/queue-3.6/usb-keyspan-fix-typo-causing-gpf-on-open.patch b/queue-3.6/usb-keyspan-fix-typo-causing-gpf-on-open.patch new file mode 100644 index 00000000000..e9f3773a772 --- /dev/null +++ b/queue-3.6/usb-keyspan-fix-typo-causing-gpf-on-open.patch @@ -0,0 +1,42 @@ +From f0e3e35c9049087172c65302b42da8fe7ebb63a8 Mon Sep 17 00:00:00 2001 +From: Bjørn Mork +Date: Sat, 10 Nov 2012 10:13:42 +0100 +Subject: USB: keyspan: fix typo causing GPF on open + +From: Bjørn Mork + +commit f0e3e35c9049087172c65302b42da8fe7ebb63a8 upstream. + +Commit f79b2d0f (USB: keyspan: fix NULL-pointer dereferences and +memory leaks) had a small typo which made the driver use wrong +offsets when mapping serial port private data. This results in +in a GPF when the port is opened. + +Reported-by: Richard +Signed-off-by: Bjørn Mork +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2448,7 +2448,7 @@ static void keyspan_release(struct usb_s + static int keyspan_port_probe(struct usb_serial_port *port) + { + struct usb_serial *serial = port->serial; +- struct keyspan_port_private *s_priv; ++ struct keyspan_serial_private *s_priv; + struct keyspan_port_private *p_priv; + const struct keyspan_device_details *d_details; + struct callbacks *cback; +@@ -2463,7 +2463,6 @@ static int keyspan_port_probe(struct usb + if (!p_priv) + return -ENOMEM; + +- s_priv = usb_get_serial_data(port->serial); + p_priv->device_details = d_details; + + /* Setup values for the various callback routines */ diff --git a/queue-3.6/usb-option-add-alcatel-x220-x500d-usb-ids.patch b/queue-3.6/usb-option-add-alcatel-x220-x500d-usb-ids.patch new file mode 100644 index 00000000000..7a17a3639b8 --- /dev/null +++ b/queue-3.6/usb-option-add-alcatel-x220-x500d-usb-ids.patch @@ -0,0 +1,34 @@ +From c0bc3098871dd9b964f6b45ec1e4d70d87811744 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 8 Nov 2012 11:56:53 -0600 +Subject: USB: option: add Alcatel X220/X500D USB IDs + +From: Dan Williams + +commit c0bc3098871dd9b964f6b45ec1e4d70d87811744 upstream. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -287,6 +287,7 @@ static void option_instat_callback(struc + /* ALCATEL PRODUCTS */ + #define ALCATEL_VENDOR_ID 0x1bbb + #define ALCATEL_PRODUCT_X060S_X200 0x0000 ++#define ALCATEL_PRODUCT_X220_X500D 0x0017 + + #define PIRELLI_VENDOR_ID 0x1266 + #define PIRELLI_PRODUCT_C100_1 0x1002 +@@ -1164,6 +1165,7 @@ static const struct usb_device_id option + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), + .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist + }, ++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), diff --git a/queue-3.6/usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch b/queue-3.6/usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch new file mode 100644 index 00000000000..461a1ee8ff4 --- /dev/null +++ b/queue-3.6/usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch @@ -0,0 +1,55 @@ +From fcb21645f1bd86d2be29baf48aa1b298de52ccc7 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 8 Nov 2012 11:56:42 -0600 +Subject: USB: option: add Novatel E362 and Dell Wireless 5800 USB IDs + +From: Dan Williams + +commit fcb21645f1bd86d2be29baf48aa1b298de52ccc7 upstream. + +The Dell 5800 appears to be a simple rebrand of the Novatel E362. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -158,6 +158,7 @@ static void option_instat_callback(struc + #define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED 0x8001 + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000 + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001 ++#define NOVATELWIRELESS_PRODUCT_E362 0x9010 + #define NOVATELWIRELESS_PRODUCT_G1 0xA001 + #define NOVATELWIRELESS_PRODUCT_G1_M 0xA002 + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 +@@ -193,6 +194,9 @@ static void option_instat_callback(struc + #define DELL_PRODUCT_5730_MINICARD_TELUS 0x8181 + #define DELL_PRODUCT_5730_MINICARD_VZW 0x8182 + ++#define DELL_PRODUCT_5800_MINICARD_VZW 0x8195 /* Novatel E362 */ ++#define DELL_PRODUCT_5800_V2_MINICARD_VZW 0x8196 /* Novatel E362 */ ++ + #define KYOCERA_VENDOR_ID 0x0c88 + #define KYOCERA_PRODUCT_KPC650 0x17da + #define KYOCERA_PRODUCT_KPC680 0x180a +@@ -706,6 +710,7 @@ static const struct usb_device_id option + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) }, + /* Novatel Ovation MC551 a.k.a. Verizon USB551L */ + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) }, + + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) }, +@@ -728,6 +733,8 @@ static const struct usb_device_id option + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */ + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */ + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */ ++ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, diff --git a/queue-3.6/usb-usb_wwan-fix-bulk-urb-allocation.patch b/queue-3.6/usb-usb_wwan-fix-bulk-urb-allocation.patch new file mode 100644 index 00000000000..397c37d793a --- /dev/null +++ b/queue-3.6/usb-usb_wwan-fix-bulk-urb-allocation.patch @@ -0,0 +1,54 @@ +From 8e493ca1767d4951ed1322abaa74d6edbca29918 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 26 Oct 2012 18:44:20 +0200 +Subject: USB: usb_wwan: fix bulk-urb allocation + +From: Johan Hovold + +commit 8e493ca1767d4951ed1322abaa74d6edbca29918 upstream. + +Make sure we do not allocate urbs if we do not have a bulk endpoint. + +Legacy code used incorrect assumption to test for bulk endpoints. + +Reported-by: Dan Carpenter +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb_wwan.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -455,9 +455,6 @@ static struct urb *usb_wwan_setup_urb(st + struct usb_serial *serial = port->serial; + struct urb *urb; + +- if (endpoint == -1) +- return NULL; /* endpoint not needed */ +- + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ + if (urb == NULL) { + dbg("%s: alloc for endpoint %d failed.", __func__, endpoint); +@@ -487,6 +484,9 @@ int usb_wwan_port_probe(struct usb_seria + init_usb_anchor(&portdata->delayed); + + for (i = 0; i < N_IN_URB; i++) { ++ if (!port->bulk_in_size) ++ break; ++ + buffer = (u8 *)__get_free_page(GFP_KERNEL); + if (!buffer) + goto bail_out_error; +@@ -499,8 +499,8 @@ int usb_wwan_port_probe(struct usb_seria + portdata->in_urbs[i] = urb; + } + for (i = 0; i < N_OUT_URB; i++) { +- if (port->bulk_out_endpointAddress == -1) +- continue; ++ if (!port->bulk_out_size) ++ break; + + buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL); + if (!buffer) diff --git a/queue-3.6/wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch b/queue-3.6/wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch new file mode 100644 index 00000000000..d60770669fe --- /dev/null +++ b/queue-3.6/wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch @@ -0,0 +1,37 @@ +From 43c771a1963ab461a2f194e3c97fded1d5fe262f Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 12 Nov 2012 10:51:34 +0100 +Subject: wireless: allow 40 MHz on world roaming channels 12/13 + +From: Johannes Berg + +commit 43c771a1963ab461a2f194e3c97fded1d5fe262f upstream. + +When in world roaming mode, allow 40 MHz to be used +on channels 12 and 13 so that an AP that is, e.g., +using HT40+ on channel 9 (in the UK) can be used. + +Reported-by: Eddie Chapman +Tested-by: Eddie Chapman +Acked-by: Luis R. Rodriguez +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/reg.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -141,9 +141,8 @@ static const struct ieee80211_regdomain + .reg_rules = { + /* IEEE 802.11b/g, channels 1..11 */ + REG_RULE(2412-10, 2462+10, 40, 6, 20, 0), +- /* IEEE 802.11b/g, channels 12..13. No HT40 +- * channel fits here. */ +- REG_RULE(2467-10, 2472+10, 20, 6, 20, ++ /* IEEE 802.11b/g, channels 12..13. */ ++ REG_RULE(2467-10, 2472+10, 40, 6, 20, + NL80211_RRF_PASSIVE_SCAN | + NL80211_RRF_NO_IBSS), + /* IEEE 802.11 channel 14 - Only JP enables