From: Greg Kroah-Hartman Date: Tue, 17 Jul 2012 21:12:54 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.38~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=250aa069f25bf40cee675deccb70b6f76f6a5814;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: arm-samsung-fix-race-in-s3c_adc_start-for-adc.patch block-fix-infinite-loop-in-__getblk_slow.patch cfg80211-check-iface-combinations-only-when-iface-is-running.patch e1000e-correct-link-check-logic-for-82571-serdes.patch fifo-do-not-restart-open-if-it-already-found-a-partner.patch input-xpad-add-andamiro-pump-it-up-pad.patch intel_ips-blacklist-hp-probook-laptops.patch media-dvb-core-release-semaphore-on-error-path-dvb_register_device.patch mtd-nandsim-don-t-open-code-a-do_div-helper.patch rt2x00usb-fix-indexes-ordering-on-rx-queue-kick.patch tcp-drop-syn-fin-messages.patch --- diff --git a/queue-3.0/arm-samsung-fix-race-in-s3c_adc_start-for-adc.patch b/queue-3.0/arm-samsung-fix-race-in-s3c_adc_start-for-adc.patch new file mode 100644 index 00000000000..87a22a09636 --- /dev/null +++ b/queue-3.0/arm-samsung-fix-race-in-s3c_adc_start-for-adc.patch @@ -0,0 +1,40 @@ +From 8265981bb439f3ecc5356fb877a6c2a6636ac88a Mon Sep 17 00:00:00 2001 +From: Todd Poynor +Date: Fri, 13 Jul 2012 15:30:48 +0900 +Subject: ARM: SAMSUNG: fix race in s3c_adc_start for ADC + +From: Todd Poynor + +commit 8265981bb439f3ecc5356fb877a6c2a6636ac88a upstream. + +Checking for adc->ts_pend already claimed should be done with the +lock held. + +Signed-off-by: Todd Poynor +Acked-by: Ben Dooks +Signed-off-by: Kukjin Kim +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/plat-samsung/adc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/arm/plat-samsung/adc.c ++++ b/arch/arm/plat-samsung/adc.c +@@ -143,11 +143,13 @@ int s3c_adc_start(struct s3c_adc_client + return -EINVAL; + } + +- if (client->is_ts && adc->ts_pend) +- return -EAGAIN; +- + spin_lock_irqsave(&adc->lock, flags); + ++ if (client->is_ts && adc->ts_pend) { ++ spin_unlock_irqrestore(&adc->lock, flags); ++ return -EAGAIN; ++ } ++ + client->channel = channel; + client->nr_samples = nr_samples; + diff --git a/queue-3.0/block-fix-infinite-loop-in-__getblk_slow.patch b/queue-3.0/block-fix-infinite-loop-in-__getblk_slow.patch new file mode 100644 index 00000000000..e1e29f06a92 --- /dev/null +++ b/queue-3.0/block-fix-infinite-loop-in-__getblk_slow.patch @@ -0,0 +1,112 @@ +From 91f68c89d8f35fe98ea04159b9a3b42d0149478f Mon Sep 17 00:00:00 2001 +From: Jeff Moyer +Date: Thu, 12 Jul 2012 09:43:14 -0400 +Subject: block: fix infinite loop in __getblk_slow + +From: Jeff Moyer + +commit 91f68c89d8f35fe98ea04159b9a3b42d0149478f upstream. + +Commit 080399aaaf35 ("block: don't mark buffers beyond end of disk as +mapped") exposed a bug in __getblk_slow that causes mount to hang as it +loops infinitely waiting for a buffer that lies beyond the end of the +disk to become uptodate. + +The problem was initially reported by Torsten Hilbrich here: + + https://lkml.org/lkml/2012/6/18/54 + +and also reported independently here: + + http://www.sysresccd.org/forums/viewtopic.php?f=13&t=4511 + +and then Richard W.M. Jones and Marcos Mello noted a few separate +bugzillas also associated with the same issue. This patch has been +confirmed to fix: + + https://bugzilla.redhat.com/show_bug.cgi?id=835019 + +The main problem is here, in __getblk_slow: + + for (;;) { + struct buffer_head * bh; + int ret; + + bh = __find_get_block(bdev, block, size); + if (bh) + return bh; + + ret = grow_buffers(bdev, block, size); + if (ret < 0) + return NULL; + if (ret == 0) + free_more_memory(); + } + +__find_get_block does not find the block, since it will not be marked as +mapped, and so grow_buffers is called to fill in the buffers for the +associated page. I believe the for (;;) loop is there primarily to +retry in the case of memory pressure keeping grow_buffers from +succeeding. However, we also continue to loop for other cases, like the +block lying beond the end of the disk. So, the fix I came up with is to +only loop when grow_buffers fails due to memory allocation issues +(return value of 0). + +The attached patch was tested by myself, Torsten, and Rich, and was +found to resolve the problem in call cases. + +Signed-off-by: Jeff Moyer +Reported-and-Tested-by: Torsten Hilbrich +Tested-by: Richard W.M. Jones +Reviewed-by: Josh Boyer +[ Jens is on vacation, taking this directly - Linus ] +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/buffer.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -1084,6 +1084,9 @@ grow_buffers(struct block_device *bdev, + static struct buffer_head * + __getblk_slow(struct block_device *bdev, sector_t block, int size) + { ++ int ret; ++ struct buffer_head *bh; ++ + /* Size must be multiple of hard sectorsize */ + if (unlikely(size & (bdev_logical_block_size(bdev)-1) || + (size < 512 || size > PAGE_SIZE))) { +@@ -1096,20 +1099,21 @@ __getblk_slow(struct block_device *bdev, + return NULL; + } + +- for (;;) { +- struct buffer_head * bh; +- int ret; ++retry: ++ bh = __find_get_block(bdev, block, size); ++ if (bh) ++ return bh; + ++ ret = grow_buffers(bdev, block, size); ++ if (ret == 0) { ++ free_more_memory(); ++ goto retry; ++ } else if (ret > 0) { + bh = __find_get_block(bdev, block, size); + if (bh) + return bh; +- +- ret = grow_buffers(bdev, block, size); +- if (ret < 0) +- return NULL; +- if (ret == 0) +- free_more_memory(); + } ++ return NULL; + } + + /* diff --git a/queue-3.0/cfg80211-check-iface-combinations-only-when-iface-is-running.patch b/queue-3.0/cfg80211-check-iface-combinations-only-when-iface-is-running.patch new file mode 100644 index 00000000000..c4f6aac5e7f --- /dev/null +++ b/queue-3.0/cfg80211-check-iface-combinations-only-when-iface-is-running.patch @@ -0,0 +1,38 @@ +From f8cdddb8d61d16a156229f0910f7ecfc7a82c003 Mon Sep 17 00:00:00 2001 +From: Michal Kazior +Date: Fri, 8 Jun 2012 10:55:44 +0200 +Subject: cfg80211: check iface combinations only when iface is running + +From: Michal Kazior + +commit f8cdddb8d61d16a156229f0910f7ecfc7a82c003 upstream. + +Don't validate interface combinations on a stopped +interface. Otherwise we might end up being able to +create a new interface with a certain type, but +won't be able to change an existing interface +into that type. + +This also skips some other functions when +interface is stopped and changing interface type. + +Signed-off-by: Michal Kazior +Signed-off-by: Johannes Berg +[Fixes regression introduced by cherry pick of 463454b5dbd8] +Signed-off-by: Paul Gortmaker + +--- + net/wireless/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -807,7 +807,7 @@ int cfg80211_change_iface(struct cfg8021 + ntype == NL80211_IFTYPE_P2P_CLIENT)) + return -EBUSY; + +- if (ntype != otype) { ++ if (ntype != otype && netif_running(dev)) { + err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr, + ntype); + if (err) diff --git a/queue-3.0/e1000e-correct-link-check-logic-for-82571-serdes.patch b/queue-3.0/e1000e-correct-link-check-logic-for-82571-serdes.patch new file mode 100644 index 00000000000..384387b4420 --- /dev/null +++ b/queue-3.0/e1000e-correct-link-check-logic-for-82571-serdes.patch @@ -0,0 +1,37 @@ +From d0efa8f23a644f7cb7d1f8e78dd9a223efa412a3 Mon Sep 17 00:00:00 2001 +From: Tushar Dave +Date: Thu, 12 Jul 2012 08:56:56 +0000 +Subject: e1000e: Correct link check logic for 82571 serdes + +From: Tushar Dave + +commit d0efa8f23a644f7cb7d1f8e78dd9a223efa412a3 upstream. + +SYNCH bit and IV bit of RXCW register are sticky. Before examining these bits, +RXCW should be read twice to filter out one-time false events and have correct +values for these bits. Incorrect values of these bits in link check logic can +cause weird link stability issues if auto-negotiation fails. + +Reported-by: Dean Nelson +Signed-off-by: Tushar Dave +Reviewed-by: Bruce Allan +Tested-by: Jeff Pieper +Signed-off-by: Jeff Kirsher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000e/82571.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/e1000e/82571.c ++++ b/drivers/net/e1000e/82571.c +@@ -1573,6 +1573,9 @@ static s32 e1000_check_for_serdes_link_8 + ctrl = er32(CTRL); + status = er32(STATUS); + rxcw = er32(RXCW); ++ /* SYNCH bit and IV bit are sticky */ ++ udelay(10); ++ rxcw = er32(RXCW); + + if ((rxcw & E1000_RXCW_SYNCH) && !(rxcw & E1000_RXCW_IV)) { + diff --git a/queue-3.0/fifo-do-not-restart-open-if-it-already-found-a-partner.patch b/queue-3.0/fifo-do-not-restart-open-if-it-already-found-a-partner.patch new file mode 100644 index 00000000000..2152491d957 --- /dev/null +++ b/queue-3.0/fifo-do-not-restart-open-if-it-already-found-a-partner.patch @@ -0,0 +1,109 @@ +From 05d290d66be6ef77a0b962ebecf01911bd984a78 Mon Sep 17 00:00:00 2001 +From: Anders Kaseorg +Date: Sun, 15 Jul 2012 17:14:25 -0400 +Subject: fifo: Do not restart open() if it already found a partner + +From: Anders Kaseorg + +commit 05d290d66be6ef77a0b962ebecf01911bd984a78 upstream. + +If a parent and child process open the two ends of a fifo, and the +child immediately exits, the parent may receive a SIGCHLD before its +open() returns. In that case, we need to make sure that open() will +return successfully after the SIGCHLD handler returns, instead of +throwing EINTR or being restarted. Otherwise, the restarted open() +would incorrectly wait for a second partner on the other end. + +The following test demonstrates the EINTR that was wrongly thrown from +the parent’s open(). Change .sa_flags = 0 to .sa_flags = SA_RESTART +to see a deadlock instead, in which the restarted open() waits for a +second reader that will never come. (On my systems, this happens +pretty reliably within about 5 to 500 iterations. Others report that +it manages to loop ~forever sometimes; YMMV.) + + #include + #include + #include + #include + #include + #include + #include + #include + + #define CHECK(x) do if ((x) == -1) {perror(#x); abort();} while(0) + + void handler(int signum) {} + + int main() + { + struct sigaction act = {.sa_handler = handler, .sa_flags = 0}; + CHECK(sigaction(SIGCHLD, &act, NULL)); + CHECK(mknod("fifo", S_IFIFO | S_IRWXU, 0)); + for (;;) { + int fd; + pid_t pid; + putc('.', stderr); + CHECK(pid = fork()); + if (pid == 0) { + CHECK(fd = open("fifo", O_RDONLY)); + _exit(0); + } + CHECK(fd = open("fifo", O_WRONLY)); + CHECK(close(fd)); + CHECK(waitpid(pid, NULL, 0)); + } + } + +This is what I suspect was causing the Git test suite to fail in +t9010-svn-fe.sh: + + http://bugs.debian.org/678852 + +Signed-off-by: Anders Kaseorg +Reviewed-by: Jonathan Nieder +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fifo.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/fs/fifo.c ++++ b/fs/fifo.c +@@ -14,7 +14,7 @@ + #include + #include + +-static void wait_for_partner(struct inode* inode, unsigned int *cnt) ++static int wait_for_partner(struct inode* inode, unsigned int *cnt) + { + int cur = *cnt; + +@@ -23,6 +23,7 @@ static void wait_for_partner(struct inod + if (signal_pending(current)) + break; + } ++ return cur == *cnt ? -ERESTARTSYS : 0; + } + + static void wake_up_partner(struct inode* inode) +@@ -67,8 +68,7 @@ static int fifo_open(struct inode *inode + * seen a writer */ + filp->f_version = pipe->w_counter; + } else { +- wait_for_partner(inode, &pipe->w_counter); +- if(signal_pending(current)) ++ if (wait_for_partner(inode, &pipe->w_counter)) + goto err_rd; + } + } +@@ -90,8 +90,7 @@ static int fifo_open(struct inode *inode + wake_up_partner(inode); + + if (!pipe->readers) { +- wait_for_partner(inode, &pipe->r_counter); +- if (signal_pending(current)) ++ if (wait_for_partner(inode, &pipe->r_counter)) + goto err_wr; + } + break; diff --git a/queue-3.0/input-xpad-add-andamiro-pump-it-up-pad.patch b/queue-3.0/input-xpad-add-andamiro-pump-it-up-pad.patch new file mode 100644 index 00000000000..36cf4af74c2 --- /dev/null +++ b/queue-3.0/input-xpad-add-andamiro-pump-it-up-pad.patch @@ -0,0 +1,31 @@ +From e76b8ee25e034ab601b525abb95cea14aa167ed3 Mon Sep 17 00:00:00 2001 +From: Yuri Khan +Date: Wed, 11 Jul 2012 22:12:31 -0700 +Subject: Input: xpad - add Andamiro Pump It Up pad + +From: Yuri Khan + +commit e76b8ee25e034ab601b525abb95cea14aa167ed3 upstream. + +I couldn't find the vendor ID in any of the online databases, but this +mat has a Pump It Up logo on the top side of the controller compartment, +and a disclaimer stating that Andamiro will not be liable on the bottom. + +Signed-off-by: Yuri Khan +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -142,6 +142,7 @@ static const struct xpad_device { + { 0x0c12, 0x880a, "Pelican Eclipse PL-2023", 0, XTYPE_XBOX }, + { 0x0c12, 0x8810, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, + { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX }, ++ { 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, + { 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX }, + { 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX }, + { 0x0e6f, 0x0003, "Logic3 Freebird wireless Controller", 0, XTYPE_XBOX }, diff --git a/queue-3.0/intel_ips-blacklist-hp-probook-laptops.patch b/queue-3.0/intel_ips-blacklist-hp-probook-laptops.patch new file mode 100644 index 00000000000..ed7378b83c9 --- /dev/null +++ b/queue-3.0/intel_ips-blacklist-hp-probook-laptops.patch @@ -0,0 +1,68 @@ +From 88ca518b0bb4161e5f20f8a1d9cc477cae294e54 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 25 Jun 2012 15:07:17 +0200 +Subject: intel_ips: blacklist HP ProBook laptops + +From: Takashi Iwai + +commit 88ca518b0bb4161e5f20f8a1d9cc477cae294e54 upstream. + +intel_ips driver spews the warning message + "ME failed to update for more than 1s, likely hung" +at each second endlessly on HP ProBook laptops with IronLake. + +As this has never worked, better to blacklist the driver for now. + +Signed-off-by: Takashi Iwai +Signed-off-by: Matthew Garrett +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/intel_ips.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/platform/x86/intel_ips.c ++++ b/drivers/platform/x86/intel_ips.c +@@ -72,6 +72,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1505,6 +1506,24 @@ static DEFINE_PCI_DEVICE_TABLE(ips_id_ta + + MODULE_DEVICE_TABLE(pci, ips_id_table); + ++static int ips_blacklist_callback(const struct dmi_system_id *id) ++{ ++ pr_info("Blacklisted intel_ips for %s\n", id->ident); ++ return 1; ++} ++ ++static const struct dmi_system_id ips_blacklist[] = { ++ { ++ .callback = ips_blacklist_callback, ++ .ident = "HP ProBook", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook"), ++ }, ++ }, ++ { } /* terminating entry */ ++}; ++ + static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id) + { + u64 platform_info; +@@ -1514,6 +1533,9 @@ static int ips_probe(struct pci_dev *dev + u16 htshi, trc, trc_required_mask; + u8 tse; + ++ if (dmi_check_system(ips_blacklist)) ++ return -ENODEV; ++ + ips = kzalloc(sizeof(struct ips_driver), GFP_KERNEL); + if (!ips) + return -ENOMEM; diff --git a/queue-3.0/media-dvb-core-release-semaphore-on-error-path-dvb_register_device.patch b/queue-3.0/media-dvb-core-release-semaphore-on-error-path-dvb_register_device.patch new file mode 100644 index 00000000000..c1e2f5691e3 --- /dev/null +++ b/queue-3.0/media-dvb-core-release-semaphore-on-error-path-dvb_register_device.patch @@ -0,0 +1,30 @@ +From 82163edcdfa4eb3d74516cc8e9f38dd3d039b67d Mon Sep 17 00:00:00 2001 +From: Santosh Nayak +Date: Sat, 23 Jun 2012 07:59:54 -0300 +Subject: media: dvb-core: Release semaphore on error path dvb_register_device() + +From: Santosh Nayak + +commit 82163edcdfa4eb3d74516cc8e9f38dd3d039b67d upstream. + +There is a missing "up_write()" here. Semaphore should be released +before returning error value. + +Signed-off-by: Santosh Nayak +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-core/dvbdev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/dvb/dvb-core/dvbdev.c ++++ b/drivers/media/dvb/dvb-core/dvbdev.c +@@ -243,6 +243,7 @@ int dvb_register_device(struct dvb_adapt + if (minor == MAX_DVB_MINORS) { + kfree(dvbdevfops); + kfree(dvbdev); ++ up_write(&minor_rwsem); + mutex_unlock(&dvbdev_register_lock); + return -EINVAL; + } diff --git a/queue-3.0/mtd-nandsim-don-t-open-code-a-do_div-helper.patch b/queue-3.0/mtd-nandsim-don-t-open-code-a-do_div-helper.patch new file mode 100644 index 00000000000..1b1edb42050 --- /dev/null +++ b/queue-3.0/mtd-nandsim-don-t-open-code-a-do_div-helper.patch @@ -0,0 +1,92 @@ +From 596fd46268634082314b3af1ded4612e1b7f3f03 Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski +Date: Wed, 16 May 2012 16:21:52 -0300 +Subject: mtd: nandsim: don't open code a do_div helper + +From: Herton Ronaldo Krzesinski + +commit 596fd46268634082314b3af1ded4612e1b7f3f03 upstream. + +We don't need to open code the divide function, just use div_u64 that +already exists and do the same job. While this is a straightforward +clean up, there is more to that, the real motivation for this. + +While building on a cross compiling environment in armel, using gcc +4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5), I was getting the following build +error: + +ERROR: "__aeabi_uldivmod" [drivers/mtd/nand/nandsim.ko] undefined! + +After investigating with objdump and hand built assembly version +generated with the compiler, I narrowed __aeabi_uldivmod as being +generated from the divide function. When nandsim.c is built with +-fno-inline-functions-called-once, that happens when +CONFIG_DEBUG_SECTION_MISMATCH is enabled, the do_div optimization in +arch/arm/include/asm/div64.h doesn't work as expected with the open +coded divide function: even if the do_div we are using doesn't have a +constant divisor, the compiler still includes the else parts of the +optimized do_div macro, and translates the divisions there to use +__aeabi_uldivmod, instead of only calling __do_div_asm -> __do_div64 and +optimizing/removing everything else out. + +So to reproduce, gcc 4.6 plus CONFIG_DEBUG_SECTION_MISMATCH=y and +CONFIG_MTD_NAND_NANDSIM=m should do it, building on armel. + +After this change, the compiler does the intended thing even with +-fno-inline-functions-called-once, and optimizes out as expected the +constant handling in the optimized do_div on arm. As this also avoids a +build issue, I'm marking for Stable, as I think is applicable for this +case. + +Signed-off-by: Herton Ronaldo Krzesinski +Acked-by: Nicolas Pitre +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nandsim.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +--- a/drivers/mtd/nand/nandsim.c ++++ b/drivers/mtd/nand/nandsim.c +@@ -28,7 +28,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include +@@ -547,12 +547,6 @@ static char *get_partition_name(int i) + return kstrdup(buf, GFP_KERNEL); + } + +-static uint64_t divide(uint64_t n, uint32_t d) +-{ +- do_div(n, d); +- return n; +-} +- + /* + * Initialize the nandsim structure. + * +@@ -581,7 +575,7 @@ static int init_nandsim(struct mtd_info + ns->geom.oobsz = mtd->oobsize; + ns->geom.secsz = mtd->erasesize; + ns->geom.pgszoob = ns->geom.pgsz + ns->geom.oobsz; +- ns->geom.pgnum = divide(ns->geom.totsz, ns->geom.pgsz); ++ ns->geom.pgnum = div_u64(ns->geom.totsz, ns->geom.pgsz); + ns->geom.totszoob = ns->geom.totsz + (uint64_t)ns->geom.pgnum * ns->geom.oobsz; + ns->geom.secshift = ffs(ns->geom.secsz) - 1; + ns->geom.pgshift = chip->page_shift; +@@ -924,7 +918,7 @@ static int setup_wear_reporting(struct m + + if (!rptwear) + return 0; +- wear_eb_count = divide(mtd->size, mtd->erasesize); ++ wear_eb_count = div_u64(mtd->size, mtd->erasesize); + mem = wear_eb_count * sizeof(unsigned long); + if (mem / sizeof(unsigned long) != wear_eb_count) { + NS_ERR("Too many erase blocks for wear reporting\n"); diff --git a/queue-3.0/rt2x00usb-fix-indexes-ordering-on-rx-queue-kick.patch b/queue-3.0/rt2x00usb-fix-indexes-ordering-on-rx-queue-kick.patch new file mode 100644 index 00000000000..799cc4e913a --- /dev/null +++ b/queue-3.0/rt2x00usb-fix-indexes-ordering-on-rx-queue-kick.patch @@ -0,0 +1,49 @@ +From efd821182cec8c92babef6e00a95066d3252fda4 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 4 Jul 2012 13:10:02 +0200 +Subject: rt2x00usb: fix indexes ordering on RX queue kick + +From: Stanislaw Gruszka + +commit efd821182cec8c92babef6e00a95066d3252fda4 upstream. + +On rt2x00_dmastart() we increase index specified by Q_INDEX and on +rt2x00_dmadone() we increase index specified by Q_INDEX_DONE. So entries +between Q_INDEX_DONE and Q_INDEX are those we currently process in the +hardware. Entries between Q_INDEX and Q_INDEX_DONE are those we can +submit to the hardware. + +According to that fix rt2x00usb_kick_queue(), as we need to submit RX +entries that are not processed by the hardware. It worked before only +for empty queue, otherwise was broken. + +Note that for TX queues indexes ordering are ok. We need to kick entries +that have filled skb, but was not submitted to the hardware, i.e. +started from Q_INDEX_DONE and have ENTRY_DATA_PENDING bit set. + +From practical standpoint this fixes RX queue stall, usually reproducible +in AP mode, like for example reported here: +https://bugzilla.redhat.com/show_bug.cgi?id=828824 + +Reported-and-tested-by: Franco Miceli +Reported-and-tested-by: Tom Horsley +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rt2x00/rt2x00usb.c ++++ b/drivers/net/wireless/rt2x00/rt2x00usb.c +@@ -426,8 +426,8 @@ void rt2x00usb_kick_queue(struct data_qu + case QID_RX: + if (!rt2x00queue_full(queue)) + rt2x00queue_for_each_entry(queue, +- Q_INDEX_DONE, + Q_INDEX, ++ Q_INDEX_DONE, + NULL, + rt2x00usb_kick_rx_entry); + break; diff --git a/queue-3.0/series b/queue-3.0/series index eac4511065e..a20004a28c5 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -1 +1,12 @@ hwmon-it87-preserve-configuration-register-bits-on-init.patch +block-fix-infinite-loop-in-__getblk_slow.patch +media-dvb-core-release-semaphore-on-error-path-dvb_register_device.patch +mtd-nandsim-don-t-open-code-a-do_div-helper.patch +arm-samsung-fix-race-in-s3c_adc_start-for-adc.patch +intel_ips-blacklist-hp-probook-laptops.patch +fifo-do-not-restart-open-if-it-already-found-a-partner.patch +rt2x00usb-fix-indexes-ordering-on-rx-queue-kick.patch +e1000e-correct-link-check-logic-for-82571-serdes.patch +input-xpad-add-andamiro-pump-it-up-pad.patch +tcp-drop-syn-fin-messages.patch +cfg80211-check-iface-combinations-only-when-iface-is-running.patch diff --git a/queue-3.0/tcp-drop-syn-fin-messages.patch b/queue-3.0/tcp-drop-syn-fin-messages.patch new file mode 100644 index 00000000000..b5ccc21c199 --- /dev/null +++ b/queue-3.0/tcp-drop-syn-fin-messages.patch @@ -0,0 +1,35 @@ +From fdf5af0daf8019cec2396cdef8fb042d80fe71fa Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 2 Dec 2011 23:41:42 +0000 +Subject: tcp: drop SYN+FIN messages + +From: Eric Dumazet + +commit fdf5af0daf8019cec2396cdef8fb042d80fe71fa upstream. + +Denys Fedoryshchenko reported that SYN+FIN attacks were bringing his +linux machines to their limits. + +Dont call conn_request() if the TCP flags includes SYN flag + +Reported-by: Denys Fedoryshchenko +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_input.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5761,6 +5761,8 @@ int tcp_rcv_state_process(struct sock *s + goto discard; + + if (th->syn) { ++ if (th->fin) ++ goto discard; + if (icsk->icsk_af_ops->conn_request(sk, skb) < 0) + return 1; +