From: Greg Kroah-Hartman Date: Fri, 18 May 2012 19:14:58 +0000 (-0700) Subject: 3.3-stable patches X-Git-Tag: v3.0.32~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=260faad429ae906b9703987a330da6c15fce454d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.3-stable patches added patches: arch-tile-apply-commit-74fca9da0-to-the-compat-signal-handling-as-well.patch arm-7417-1-vfp-ensure-preemption-is-disabled-when-enabling-vfp-access.patch arm-prevent-vm_growsdown-mmaps-extending-below-first_user_address.patch asoc-cs42l73-sync-digital-mixer-kcontrols-to-allow-for-0db.patch asoc-wm8994-fix-aif2adc-power-down.patch cdc_ether-add-novatel-usb551l-device-ids-for-flag_wwan.patch cdc_ether-ignore-bogus-union-descriptor-for-rndis-devices.patch crypto-mv_cesa-requires-on-crypto_hash-to-build.patch dm-mpath-check-if-scsi_dh-module-already-loaded-before-trying-to-load.patch e1000-prevent-reset-task-killing-itself.patch hugetlb-prevent-bug_on-in-hugetlb_fault-hugetlb_cow.patch init-don-t-try-mounting-device-as-nfs-root-unless-type-fully-matches.patch jffs2-fix-lock-acquisition-order-bug-in-gc-path.patch kmemleak-fix-the-kmemleak-tracking-of-the-percpu-areas-with-smp.patch md-add-del_timer_sync-to-mddev_suspend-fix-nasty-panic.patch media-dvb_frontend-fix-a-regression-with-dvb-s-zig-zag.patch media-marvell-cam-fix-an-arm-build-error.patch media-rc-postpone-isr-registration.patch media-s5p-fimc-fix-locking-in-subdev-set_crop-op.patch mm-nobootmem-fix-sign-extend-problem-in-__free_pages_memory.patch mtd-fix-oops-in-dataflash-driver.patch percpu-pcpu_embed_first_chunk-should-free-unused-parts-after-all-allocs-are-complete.patch target-drop-incorrect-se_lun_acl-release-for-dynamic-explict-acl-conversion.patch target-fix-bug-in-handling-of-fileio-block_device-resize-ops.patch target-fix-spc-2-release-bug-for-multi-session-iscsi-client-setups.patch tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oom-conditions.patch virtio-console-tell-host-of-open-ports-after-resume-from-s3-s4.patch --- diff --git a/queue-3.3/arch-tile-apply-commit-74fca9da0-to-the-compat-signal-handling-as-well.patch b/queue-3.3/arch-tile-apply-commit-74fca9da0-to-the-compat-signal-handling-as-well.patch new file mode 100644 index 00000000000..de74d9c6c53 --- /dev/null +++ b/queue-3.3/arch-tile-apply-commit-74fca9da0-to-the-compat-signal-handling-as-well.patch @@ -0,0 +1,46 @@ +From a134d228298c6aa9007205c6b81cae0cac0acb5d Mon Sep 17 00:00:00 2001 +From: Chris Metcalf +Date: Wed, 16 May 2012 14:54:20 -0400 +Subject: arch/tile: apply commit 74fca9da0 to the compat signal handling as well + +From: Chris Metcalf + +commit a134d228298c6aa9007205c6b81cae0cac0acb5d upstream. + +This passes siginfo and mcontext to tilegx32 signal handlers that +don't have SA_SIGINFO set just as we have been doing for tilegx64. + +Signed-off-by: Chris Metcalf +Signed-off-by: Greg Kroah-Hartman + +--- + arch/tile/kernel/compat_signal.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/arch/tile/kernel/compat_signal.c ++++ b/arch/tile/kernel/compat_signal.c +@@ -403,19 +403,17 @@ int compat_setup_rt_frame(int sig, struc + * Set up registers for signal handler. + * Registers that we don't modify keep the value they had from + * user-space at the time we took the signal. ++ * We always pass siginfo and mcontext, regardless of SA_SIGINFO, ++ * since some things rely on this (e.g. glibc's debug/segfault.c). + */ + regs->pc = ptr_to_compat_reg(ka->sa.sa_handler); + regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */ + regs->sp = ptr_to_compat_reg(frame); + regs->lr = restorer; + regs->regs[0] = (unsigned long) usig; +- +- if (ka->sa.sa_flags & SA_SIGINFO) { +- /* Need extra arguments, so mark to restore caller-saves. */ +- regs->regs[1] = ptr_to_compat_reg(&frame->info); +- regs->regs[2] = ptr_to_compat_reg(&frame->uc); +- regs->flags |= PT_FLAGS_CALLER_SAVES; +- } ++ regs->regs[1] = ptr_to_compat_reg(&frame->info); ++ regs->regs[2] = ptr_to_compat_reg(&frame->uc); ++ regs->flags |= PT_FLAGS_CALLER_SAVES; + + /* + * Notify any tracer that was single-stepping it. diff --git a/queue-3.3/arm-7417-1-vfp-ensure-preemption-is-disabled-when-enabling-vfp-access.patch b/queue-3.3/arm-7417-1-vfp-ensure-preemption-is-disabled-when-enabling-vfp-access.patch new file mode 100644 index 00000000000..7ef33b2d2c4 --- /dev/null +++ b/queue-3.3/arm-7417-1-vfp-ensure-preemption-is-disabled-when-enabling-vfp-access.patch @@ -0,0 +1,70 @@ +From 998de4acb2ba188d20768d1065658377a2e7d29b Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 11 May 2012 17:42:37 +0100 +Subject: ARM: 7417/1: vfp: ensure preemption is disabled when enabling VFP access + +From: Will Deacon + +commit 998de4acb2ba188d20768d1065658377a2e7d29b upstream. + +The vfp_enable function enables access to the VFP co-processor register +space (cp10 and cp11) on the current CPU and must be called with +preemption disabled. Unfortunately, the vfp_init late initcall does not +disable preemption and can lead to an oops during boot if thread +migration occurs at the wrong time and we end up attempting to access +the FPSID on a CPU with VFP access disabled. + +This patch fixes the initcall to call vfp_enable from a non-preemptible +context on each CPU and adds a BUG_ON(preemptible) to ensure that any +similar problems are easily spotted in the future. + +Reported-by: Hyungwoo Yang +Signed-off-by: Hyungwoo Yang +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/vfp/vfpmodule.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -428,7 +429,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, + + static void vfp_enable(void *unused) + { +- u32 access = get_copro_access(); ++ u32 access; ++ ++ BUG_ON(preemptible()); ++ access = get_copro_access(); + + /* + * Enable full access to VFP (cp10 and cp11) +@@ -556,7 +560,7 @@ static int __init vfp_init(void) + unsigned int cpu_arch = cpu_architecture(); + + if (cpu_arch >= CPU_ARCH_ARMv6) +- vfp_enable(NULL); ++ on_each_cpu(vfp_enable, NULL, 1); + + /* + * First check that there is a VFP that we can use. +@@ -577,8 +581,6 @@ static int __init vfp_init(void) + } else { + hotcpu_notifier(vfp_hotplug, 0); + +- smp_call_function(vfp_enable, NULL, 1); +- + VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT; /* Extract the architecture version */ + printk("implementor %02x architecture %d part %02x variant %x rev %x\n", + (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT, diff --git a/queue-3.3/arm-prevent-vm_growsdown-mmaps-extending-below-first_user_address.patch b/queue-3.3/arm-prevent-vm_growsdown-mmaps-extending-below-first_user_address.patch new file mode 100644 index 00000000000..663c040a45e --- /dev/null +++ b/queue-3.3/arm-prevent-vm_growsdown-mmaps-extending-below-first_user_address.patch @@ -0,0 +1,30 @@ +From 9b61a4d1b2064dbd0c9e61754305ac852170509f Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 16 May 2012 15:19:20 +0100 +Subject: ARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS + +From: Russell King + +commit 9b61a4d1b2064dbd0c9e61754305ac852170509f upstream. + +Reported-by: Al Viro +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/fault.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm/mm/fault.c ++++ b/arch/arm/mm/fault.c +@@ -245,7 +245,9 @@ good_area: + return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags); + + check_stack: +- if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr)) ++ /* Don't allow expansion below FIRST_USER_ADDRESS */ ++ if (vma->vm_flags & VM_GROWSDOWN && ++ addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr)) + goto good_area; + out: + return fault; diff --git a/queue-3.3/asoc-cs42l73-sync-digital-mixer-kcontrols-to-allow-for-0db.patch b/queue-3.3/asoc-cs42l73-sync-digital-mixer-kcontrols-to-allow-for-0db.patch new file mode 100644 index 00000000000..e08ef6d3e63 --- /dev/null +++ b/queue-3.3/asoc-cs42l73-sync-digital-mixer-kcontrols-to-allow-for-0db.patch @@ -0,0 +1,52 @@ +From 5807c3bf68eb489032ca8ff70b3d3c833fd8172b Mon Sep 17 00:00:00 2001 +From: Brian Austin +Date: Fri, 11 May 2012 12:54:45 -0500 +Subject: ASoC: cs42l73: Sync digital mixer kcontrols to allow for 0dB + +From: Brian Austin + +commit 5807c3bf68eb489032ca8ff70b3d3c833fd8172b upstream. + +Some of the Digital mixer kcontrol max values were off by 1 not allowing a max of 0dB. + +Signed-off-by: Brian Austin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/cs42l73.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/sound/soc/codecs/cs42l73.c ++++ b/sound/soc/codecs/cs42l73.c +@@ -568,22 +568,22 @@ static const struct snd_kcontrol_new cs4 + attn_tlv), + + SOC_SINGLE_TLV("SPK-IP Mono Volume", +- CS42L73_SPKMIPMA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_SPKMIPMA, 0, 0x3F, 1, attn_tlv), + SOC_SINGLE_TLV("SPK-XSP Mono Volume", +- CS42L73_SPKMXSPA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_SPKMXSPA, 0, 0x3F, 1, attn_tlv), + SOC_SINGLE_TLV("SPK-ASP Mono Volume", +- CS42L73_SPKMASPA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_SPKMASPA, 0, 0x3F, 1, attn_tlv), + SOC_SINGLE_TLV("SPK-VSP Mono Volume", +- CS42L73_SPKMVSPMA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_SPKMVSPMA, 0, 0x3F, 1, attn_tlv), + + SOC_SINGLE_TLV("ESL-IP Mono Volume", +- CS42L73_ESLMIPMA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_ESLMIPMA, 0, 0x3F, 1, attn_tlv), + SOC_SINGLE_TLV("ESL-XSP Mono Volume", +- CS42L73_ESLMXSPA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_ESLMXSPA, 0, 0x3F, 1, attn_tlv), + SOC_SINGLE_TLV("ESL-ASP Mono Volume", +- CS42L73_ESLMASPA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_ESLMASPA, 0, 0x3F, 1, attn_tlv), + SOC_SINGLE_TLV("ESL-VSP Mono Volume", +- CS42L73_ESLMVSPMA, 0, 0x3E, 1, attn_tlv), ++ CS42L73_ESLMVSPMA, 0, 0x3F, 1, attn_tlv), + + SOC_ENUM("IP Digital Swap/Mono Select", ip_swap_enum), + diff --git a/queue-3.3/asoc-wm8994-fix-aif2adc-power-down.patch b/queue-3.3/asoc-wm8994-fix-aif2adc-power-down.patch new file mode 100644 index 00000000000..3ef93ae43f7 --- /dev/null +++ b/queue-3.3/asoc-wm8994-fix-aif2adc-power-down.patch @@ -0,0 +1,27 @@ +From c7f5f2389377b66028bc129890aa653deafe8d39 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Tue, 15 May 2012 18:13:00 +0100 +Subject: ASoC: wm8994: Fix AIF2ADC power down + +From: Mark Brown + +commit c7f5f2389377b66028bc129890aa653deafe8d39 upstream. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8994.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -1073,7 +1073,7 @@ static int aif2clk_ev(struct snd_soc_dap + snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, + WM8994_AIF2DACL_ENA | + WM8994_AIF2DACR_ENA, 0); +- snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, ++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, + WM8994_AIF2ADCL_ENA | + WM8994_AIF2ADCR_ENA, 0); + diff --git a/queue-3.3/cdc_ether-add-novatel-usb551l-device-ids-for-flag_wwan.patch b/queue-3.3/cdc_ether-add-novatel-usb551l-device-ids-for-flag_wwan.patch new file mode 100644 index 00000000000..6942278816c --- /dev/null +++ b/queue-3.3/cdc_ether-add-novatel-usb551l-device-ids-for-flag_wwan.patch @@ -0,0 +1,56 @@ +From 4e6304b8420aba5311ba21fd68dab2924ae4d91a Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Mon, 7 May 2012 04:24:51 +0000 +Subject: cdc_ether: add Novatel USB551L device IDs for FLAG_WWAN + +From: Dan Williams + +commit 4e6304b8420aba5311ba21fd68dab2924ae4d91a upstream. + +Needs to be tagged with FLAG_WWAN, which since it has generic +descriptors, won't happen if we don't override the generic +driver info. + +Cc: Oliver Neukum +Cc: stable@vger.kernel.org +Signed-off-by: Dan Williams +Acked-by: Oliver Neukum +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ether.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -485,6 +485,7 @@ static const struct driver_info wwan_inf + /*-------------------------------------------------------------------------*/ + + #define HUAWEI_VENDOR_ID 0x12D1 ++#define NOVATEL_VENDOR_ID 0x1410 + + static const struct usb_device_id products [] = { + /* +@@ -602,6 +603,21 @@ static const struct usb_device_id produc + * because of bugs/quirks in a given product (like Zaurus, above). + */ + { ++ /* Novatel USB551L */ ++ /* This match must come *before* the generic CDC-ETHER match so that ++ * we get FLAG_WWAN set on the device, since it's descriptors are ++ * generic CDC-ETHER. ++ */ ++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = NOVATEL_VENDOR_ID, ++ .idProduct = 0xB001, ++ .bInterfaceClass = USB_CLASS_COMM, ++ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, ++ .bInterfaceProtocol = USB_CDC_PROTO_NONE, ++ .driver_info = (unsigned long)&wwan_info, ++}, { + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long) &cdc_info, diff --git a/queue-3.3/cdc_ether-ignore-bogus-union-descriptor-for-rndis-devices.patch b/queue-3.3/cdc_ether-ignore-bogus-union-descriptor-for-rndis-devices.patch new file mode 100644 index 00000000000..af7f0a325ba --- /dev/null +++ b/queue-3.3/cdc_ether-ignore-bogus-union-descriptor-for-rndis-devices.patch @@ -0,0 +1,72 @@ +From 6eddcb4c82883451aec3be1240f17793370fa62f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Thu, 26 Apr 2012 02:35:10 +0000 +Subject: cdc_ether: Ignore bogus union descriptor for RNDIS devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit 6eddcb4c82883451aec3be1240f17793370fa62f upstream. + +Some RNDIS devices include a bogus CDC Union descriptor pointing +to non-existing interfaces. The RNDIS code is already prepared +to handle devices without a CDC Union descriptor by hardwiring +the driver to use interfaces 0 and 1, which is correct for the +devices with the bogus descriptor as well. So we can reuse the +existing workaround. + +Cc: Markus Kolb +Cc: Iker Salmón San Millán +Cc: Jonathan Nieder +Cc: Oliver Neukum +Cc: 655387@bugs.debian.org +Signed-off-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ether.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbne + struct cdc_state *info = (void *) &dev->data; + int status; + int rndis; ++ bool android_rndis_quirk = false; + struct usb_driver *driver = driver_of(intf); + struct usb_cdc_mdlm_desc *desc = NULL; + struct usb_cdc_mdlm_detail_desc *detail = NULL; +@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbne + info->control, + info->u->bSlaveInterface0, + info->data); ++ /* fall back to hard-wiring for RNDIS */ ++ if (rndis) { ++ android_rndis_quirk = true; ++ goto next_desc; ++ } + goto bad_desc; + } + if (info->control != intf) { +@@ -271,11 +277,15 @@ next_desc: + /* Microsoft ActiveSync based and some regular RNDIS devices lack the + * CDC descriptors, so we'll hard-wire the interfaces and not check + * for descriptors. ++ * ++ * Some Android RNDIS devices have a CDC Union descriptor pointing ++ * to non-existing interfaces. Ignore that and attempt the same ++ * hard-wired 0 and 1 interfaces. + */ +- if (rndis && !info->u) { ++ if (rndis && (!info->u || android_rndis_quirk)) { + info->control = usb_ifnum_to_if(dev->udev, 0); + info->data = usb_ifnum_to_if(dev->udev, 1); +- if (!info->control || !info->data) { ++ if (!info->control || !info->data || info->control != intf) { + dev_dbg(&intf->dev, + "rndis: master #0/%p slave #1/%p\n", + info->control, diff --git a/queue-3.3/crypto-mv_cesa-requires-on-crypto_hash-to-build.patch b/queue-3.3/crypto-mv_cesa-requires-on-crypto_hash-to-build.patch new file mode 100644 index 00000000000..e2756656951 --- /dev/null +++ b/queue-3.3/crypto-mv_cesa-requires-on-crypto_hash-to-build.patch @@ -0,0 +1,49 @@ +From 1ebfefcf37a6e308266a8d786e8cfea0a454058c Mon Sep 17 00:00:00 2001 +From: Alexander Clouter +Date: Sat, 12 May 2012 09:45:08 +0100 +Subject: crypto: mv_cesa requires on CRYPTO_HASH to build + +From: Alexander Clouter + +commit 1ebfefcf37a6e308266a8d786e8cfea0a454058c upstream. + +Without CRYPTO_HASH being selected, mv_cesa has a lot of hooks +into undefined exports. +---- + MODPOST 81 modules + Kernel: arch/arm/boot/Image is ready + AS arch/arm/boot/compressed/head.o + GZIP arch/arm/boot/compressed/piggy.gzip + CC arch/arm/boot/compressed/misc.o + CC arch/arm/boot/compressed/decompress.o +ERROR: "crypto_ahash_type" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_shash_final" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_register_ahash" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_unregister_ahash" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_shash_update" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_shash_digest" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_shash_setkey" [drivers/crypto/mv_cesa.ko] undefined! +ERROR: "crypto_alloc_shash" [drivers/crypto/mv_cesa.ko] undefined! +make[1]: *** [__modpost] Error 1 +make: *** [modules] Error 2 +make: *** Waiting for unfinished jobs.... +---- + +Signed-off-by: Alexander Clouter +Signed-off-by: Jason Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/Kconfig ++++ b/drivers/crypto/Kconfig +@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA + select CRYPTO_ALGAPI + select CRYPTO_AES + select CRYPTO_BLKCIPHER2 ++ select CRYPTO_HASH + help + This driver allows you to utilize the Cryptographic Engines and + Security Accelerator (CESA) which can be found on the Marvell Orion diff --git a/queue-3.3/dm-mpath-check-if-scsi_dh-module-already-loaded-before-trying-to-load.patch b/queue-3.3/dm-mpath-check-if-scsi_dh-module-already-loaded-before-trying-to-load.patch new file mode 100644 index 00000000000..e25946d44d5 --- /dev/null +++ b/queue-3.3/dm-mpath-check-if-scsi_dh-module-already-loaded-before-trying-to-load.patch @@ -0,0 +1,36 @@ +From 510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8 Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Sat, 12 May 2012 01:43:21 +0100 +Subject: dm mpath: check if scsi_dh module already loaded before trying to load + +From: Mike Snitzer + +commit 510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8 upstream. + +If the requested scsi_dh module is already loaded then skip +request_module(). + +Multipath table loads can hang in an unnecessary __request_module. + +Reported-by: Ben Marzinski +Signed-off-by: Mike Snitzer +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -698,8 +698,8 @@ static int parse_hw_handler(struct dm_ar + return 0; + + m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL); +- request_module("scsi_dh_%s", m->hw_handler_name); +- if (scsi_dh_handler_exist(m->hw_handler_name) == 0) { ++ if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name), ++ "scsi_dh_%s", m->hw_handler_name)) { + ti->error = "unknown hardware handler type"; + ret = -EINVAL; + goto fail; diff --git a/queue-3.3/e1000-prevent-reset-task-killing-itself.patch b/queue-3.3/e1000-prevent-reset-task-killing-itself.patch new file mode 100644 index 00000000000..19d002f8fcd --- /dev/null +++ b/queue-3.3/e1000-prevent-reset-task-killing-itself.patch @@ -0,0 +1,38 @@ +From 8ce6909f77ba1b7bcdea65cc2388fd1742b6d669 Mon Sep 17 00:00:00 2001 +From: Tushar Dave +Date: Thu, 17 May 2012 01:04:50 +0000 +Subject: e1000: Prevent reset task killing itself. + +From: Tushar Dave + +commit 8ce6909f77ba1b7bcdea65cc2388fd1742b6d669 upstream. + +Killing reset task while adapter is resetting causes deadlock. +Only kill reset task if adapter is not resetting. +Ref bug #43132 on bugzilla.kernel.org + +Signed-off-by: Tushar Dave +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/e1000/e1000_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -492,7 +492,11 @@ out: + static void e1000_down_and_stop(struct e1000_adapter *adapter) + { + set_bit(__E1000_DOWN, &adapter->flags); +- cancel_work_sync(&adapter->reset_task); ++ ++ /* Only kill reset task if adapter is not resetting */ ++ if (!test_bit(__E1000_RESETTING, &adapter->flags)) ++ cancel_work_sync(&adapter->reset_task); ++ + cancel_delayed_work_sync(&adapter->watchdog_task); + cancel_delayed_work_sync(&adapter->phy_info_task); + cancel_delayed_work_sync(&adapter->fifo_stall_task); diff --git a/queue-3.3/hugetlb-prevent-bug_on-in-hugetlb_fault-hugetlb_cow.patch b/queue-3.3/hugetlb-prevent-bug_on-in-hugetlb_fault-hugetlb_cow.patch new file mode 100644 index 00000000000..4d84cc52a0d --- /dev/null +++ b/queue-3.3/hugetlb-prevent-bug_on-in-hugetlb_fault-hugetlb_cow.patch @@ -0,0 +1,43 @@ +From 4998a6c0edce7fae9c0a5463f6ec3fa585258ee7 Mon Sep 17 00:00:00 2001 +From: Chris Metcalf +Date: Thu, 10 May 2012 13:01:44 -0700 +Subject: hugetlb: prevent BUG_ON in hugetlb_fault() -> hugetlb_cow() + +From: Chris Metcalf + +commit 4998a6c0edce7fae9c0a5463f6ec3fa585258ee7 upstream. + +Commit 66aebce747eaf ("hugetlb: fix race condition in hugetlb_fault()") +added code to avoid a race condition by elevating the page refcount in +hugetlb_fault() while calling hugetlb_cow(). + +However, one code path in hugetlb_cow() includes an assertion that the +page count is 1, whereas it may now also have the value 2 in this path. + +The consensus is that this BUG_ON has served its purpose, so rather than +extending it to cover both cases, we just remove it. + +Signed-off-by: Chris Metcalf +Acked-by: Mel Gorman +Acked-by: Hillf Danton +Acked-by: Hugh Dickins +Cc: Michal Hocko +Cc: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2486,7 +2486,6 @@ retry_avoidcopy: + if (outside_reserve) { + BUG_ON(huge_pte_none(pte)); + if (unmap_ref_private(mm, vma, old_page, address)) { +- BUG_ON(page_count(old_page) != 1); + BUG_ON(huge_pte_none(pte)); + spin_lock(&mm->page_table_lock); + ptep = huge_pte_offset(mm, address & huge_page_mask(h)); diff --git a/queue-3.3/init-don-t-try-mounting-device-as-nfs-root-unless-type-fully-matches.patch b/queue-3.3/init-don-t-try-mounting-device-as-nfs-root-unless-type-fully-matches.patch new file mode 100644 index 00000000000..1c78156bd63 --- /dev/null +++ b/queue-3.3/init-don-t-try-mounting-device-as-nfs-root-unless-type-fully-matches.patch @@ -0,0 +1,51 @@ +From 377485f6244af255b04d662cf19cddbbc4ae4310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 May 2012 17:06:35 +0200 +Subject: init: don't try mounting device as nfs root unless type fully matches + +From: Sasha Levin + +commit 377485f6244af255b04d662cf19cddbbc4ae4310 upstream. + +Currently, we'll try mounting any device who's major device number is +UNNAMED_MAJOR as NFS root. This would happen for non-NFS devices as +well (such as 9p devices) but it wouldn't cause any issues since +mounting the device as NFS would fail quickly and the code proceeded to +doing the proper mount: + + [ 101.522716] VFS: Unable to mount root fs via NFS, trying floppy. + [ 101.534499] VFS: Mounted root (9p filesystem) on device 0:18. + +Commit 6829a048102a ("NFS: Retry mounting NFSROOT") introduced retries +when mounting NFS root, which means that now we don't immediately fail +and instead it takes an additional 90+ seconds until we stop retrying, +which has revealed the issue this patch fixes. + +This meant that it would take an additional 90 seconds to boot when +we're not using a device type which gets detected in order before NFS. + +This patch modifies the NFS type check to require device type to be +'Root_NFS' instead of requiring the device to have an UNNAMED_MAJOR +major. This makes boot process cleaner since we now won't go through +the NFS mounting code at all when the device isn't an NFS root +("/dev/nfs"). + +Signed-off-by: Sasha Levin +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + init/do_mounts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/init/do_mounts.c ++++ b/init/do_mounts.c +@@ -472,7 +472,7 @@ void __init change_floppy(char *fmt, ... + void __init mount_root(void) + { + #ifdef CONFIG_ROOT_NFS +- if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) { ++ if (ROOT_DEV == Root_NFS) { + if (mount_nfs_root()) + return; + diff --git a/queue-3.3/jffs2-fix-lock-acquisition-order-bug-in-gc-path.patch b/queue-3.3/jffs2-fix-lock-acquisition-order-bug-in-gc-path.patch new file mode 100644 index 00000000000..1ea1822b92b --- /dev/null +++ b/queue-3.3/jffs2-fix-lock-acquisition-order-bug-in-gc-path.patch @@ -0,0 +1,100 @@ +From 226bb7df3d22bcf4a1c0fe8206c80cc427498eae Mon Sep 17 00:00:00 2001 +From: Josh Cartwright +Date: Thu, 29 Mar 2012 19:34:53 -0400 +Subject: jffs2: Fix lock acquisition order bug in gc path + +From: Josh Cartwright + +commit 226bb7df3d22bcf4a1c0fe8206c80cc427498eae upstream. + +The locking policy is such that the erase_complete_block spinlock is +nested within the alloc_sem mutex. This fixes a case in which the +acquisition order was erroneously reversed. This issue was caught by +the following lockdep splat: + + ======================================================= + [ INFO: possible circular locking dependency detected ] + 3.0.5 #1 + ------------------------------------------------------- + jffs2_gcd_mtd6/299 is trying to acquire lock: + (&c->alloc_sem){+.+.+.}, at: [] jffs2_garbage_collect_pass+0x314/0x890 + + but task is already holding lock: + (&(&c->erase_completion_lock)->rlock){+.+...}, at: [] jffs2_garbage_collect_pass+0x308/0x890 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #1 (&(&c->erase_completion_lock)->rlock){+.+...}: + [] validate_chain+0xe6c/0x10bc + [] __lock_acquire+0x54c/0xba4 + [] lock_acquire+0xa4/0x114 + [] _raw_spin_lock+0x3c/0x4c + [] jffs2_garbage_collect_pass+0x4c/0x890 + [] jffs2_garbage_collect_thread+0x1b4/0x1cc + [] kthread+0x98/0xa0 + [] kernel_thread_exit+0x0/0x8 + + -> #0 (&c->alloc_sem){+.+.+.}: + [] print_circular_bug+0x70/0x2c4 + [] validate_chain+0x1034/0x10bc + [] __lock_acquire+0x54c/0xba4 + [] lock_acquire+0xa4/0x114 + [] mutex_lock_nested+0x74/0x33c + [] jffs2_garbage_collect_pass+0x314/0x890 + [] jffs2_garbage_collect_thread+0x1b4/0x1cc + [] kthread+0x98/0xa0 + [] kernel_thread_exit+0x0/0x8 + + other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&(&c->erase_completion_lock)->rlock); + lock(&c->alloc_sem); + lock(&(&c->erase_completion_lock)->rlock); + lock(&c->alloc_sem); + + *** DEADLOCK *** + + 1 lock held by jffs2_gcd_mtd6/299: + #0: (&(&c->erase_completion_lock)->rlock){+.+...}, at: [] jffs2_garbage_collect_pass+0x308/0x890 + + stack backtrace: + [] (unwind_backtrace+0x0/0x100) from [] (dump_stack+0x20/0x24) + [] (dump_stack+0x20/0x24) from [] (print_circular_bug+0x1c8/0x2c4) + [] (print_circular_bug+0x1c8/0x2c4) from [] (validate_chain+0x1034/0x10bc) + [] (validate_chain+0x1034/0x10bc) from [] (__lock_acquire+0x54c/0xba4) + [] (__lock_acquire+0x54c/0xba4) from [] (lock_acquire+0xa4/0x114) + [] (lock_acquire+0xa4/0x114) from [] (mutex_lock_nested+0x74/0x33c) + [] (mutex_lock_nested+0x74/0x33c) from [] (jffs2_garbage_collect_pass+0x314/0x890) + [] (jffs2_garbage_collect_pass+0x314/0x890) from [] (jffs2_garbage_collect_thread+0x1b4/0x1cc) + [] (jffs2_garbage_collect_thread+0x1b4/0x1cc) from [] (kthread+0x98/0xa0) + [] (kthread+0x98/0xa0) from [] (kernel_thread_exit+0x0/0x8) + +This was introduce in '81cfc9f jffs2: Fix serious write stall due to erase'. + +Signed-off-by: Josh Cartwright +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/gc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/jffs2/gc.c ++++ b/fs/jffs2/gc.c +@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jf + return 0; + + D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n")); +- spin_lock(&c->erase_completion_lock); + mutex_lock(&c->alloc_sem); ++ spin_lock(&c->erase_completion_lock); + } + + /* First, work out which block we're garbage-collecting */ diff --git a/queue-3.3/kmemleak-fix-the-kmemleak-tracking-of-the-percpu-areas-with-smp.patch b/queue-3.3/kmemleak-fix-the-kmemleak-tracking-of-the-percpu-areas-with-smp.patch new file mode 100644 index 00000000000..124517cd058 --- /dev/null +++ b/queue-3.3/kmemleak-fix-the-kmemleak-tracking-of-the-percpu-areas-with-smp.patch @@ -0,0 +1,35 @@ +From 100d13c3b5b9410f604b86f5e0a34da64b8cf659 Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Wed, 9 May 2012 16:55:19 +0100 +Subject: kmemleak: Fix the kmemleak tracking of the percpu areas with !SMP + +From: Catalin Marinas + +commit 100d13c3b5b9410f604b86f5e0a34da64b8cf659 upstream. + +Kmemleak tracks the percpu allocations via a specific API and the +originally allocated areas must be removed from kmemleak (via +kmemleak_free). The code was already doing this for SMP systems. + +Reported-by: Sami Liedes +Cc: Tejun Heo +Cc: Christoph Lameter +Signed-off-by: Catalin Marinas +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + mm/percpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1895,6 +1895,8 @@ void __init setup_per_cpu_areas(void) + fc = __alloc_bootmem(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS)); + if (!ai || !fc) + panic("Failed to allocate memory for percpu areas."); ++ /* kmemleak tracks the percpu allocations separately */ ++ kmemleak_free(fc); + + ai->dyn_size = unit_size; + ai->unit_size = unit_size; diff --git a/queue-3.3/md-add-del_timer_sync-to-mddev_suspend-fix-nasty-panic.patch b/queue-3.3/md-add-del_timer_sync-to-mddev_suspend-fix-nasty-panic.patch new file mode 100644 index 00000000000..a6c590f85f4 --- /dev/null +++ b/queue-3.3/md-add-del_timer_sync-to-mddev_suspend-fix-nasty-panic.patch @@ -0,0 +1,35 @@ +From 0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9 Mon Sep 17 00:00:00 2001 +From: Jonathan Brassow +Date: Wed, 16 May 2012 04:06:14 -0500 +Subject: MD: Add del_timer_sync to mddev_suspend (fix nasty panic) + +From: Jonathan Brassow + +commit 0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9 upstream. + +Use del_timer_sync to remove timer before mddev_suspend finishes. + +We don't want a timer going off after an mddev_suspend is called. This is +especially true with device-mapper, since it can call the destructor function +immediately following a suspend. This results in the removal (kfree) of the +structures upon which the timer depends - resulting in a very ugly panic. +Therefore, we add a del_timer_sync to mddev_suspend to prevent this. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -391,6 +391,8 @@ void mddev_suspend(struct mddev *mddev) + synchronize_rcu(); + wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0); + mddev->pers->quiesce(mddev, 1); ++ ++ del_timer_sync(&mddev->safemode_timer); + } + EXPORT_SYMBOL_GPL(mddev_suspend); + diff --git a/queue-3.3/media-dvb_frontend-fix-a-regression-with-dvb-s-zig-zag.patch b/queue-3.3/media-dvb_frontend-fix-a-regression-with-dvb-s-zig-zag.patch new file mode 100644 index 00000000000..b6b471fa744 --- /dev/null +++ b/queue-3.3/media-dvb_frontend-fix-a-regression-with-dvb-s-zig-zag.patch @@ -0,0 +1,40 @@ +From 910a5f2e9642d5be373beae3d29e1c4a3bc7d83b Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Mon, 7 May 2012 15:01:37 -0300 +Subject: media: dvb_frontend: fix a regression with DVB-S zig-zag + +From: Mauro Carvalho Chehab + +commit 910a5f2e9642d5be373beae3d29e1c4a3bc7d83b upstream. + +Changeset 5bfaadde broke zig-zag for DVB-S drivers that don't +implement get_tune_settings() callback. + +Fix the code, in order to allow it to work as before, otherwise +some channels may not be tuned anymore. + +Fix Fedora Bugzilla: + https://bugzilla.redhat.com/show_bug.cgi?id=814404 + +Reported-by: Michael Heijenga +Tested-by: Michael Heijenga +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-core/dvb_frontend.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/dvb/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb/dvb-core/dvb_frontend.c +@@ -1921,6 +1921,10 @@ static int dtv_set_frontend(struct dvb_f + } else { + /* default values */ + switch (c->delivery_system) { ++ case SYS_DVBS: ++ case SYS_DVBS2: ++ case SYS_ISDBS: ++ case SYS_TURBO: + case SYS_DVBC_ANNEX_A: + case SYS_DVBC_ANNEX_C: + fepriv->min_delay = HZ / 20; diff --git a/queue-3.3/media-marvell-cam-fix-an-arm-build-error.patch b/queue-3.3/media-marvell-cam-fix-an-arm-build-error.patch new file mode 100644 index 00000000000..367305f7c28 --- /dev/null +++ b/queue-3.3/media-marvell-cam-fix-an-arm-build-error.patch @@ -0,0 +1,32 @@ +From 9967232f1be5bab10c7b7a8dcf51ff5c3c1a6d77 Mon Sep 17 00:00:00 2001 +From: Jonathan Corbet +Date: Fri, 20 Apr 2012 12:22:50 -0300 +Subject: media: marvell-cam: fix an ARM build error + +From: Jonathan Corbet + +commit 9967232f1be5bab10c7b7a8dcf51ff5c3c1a6d77 upstream. + +One of the OLPC changes lost a little in its translation to mainline, +leading to build errors on the ARM architecture. Remove the offending +line, and all will be well. + +Reported-by: Mathieu Poirier +Signed-off-by: Jonathan Corbet +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/marvell-ccic/mmp-driver.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/media/video/marvell-ccic/mmp-driver.c ++++ b/drivers/media/video/marvell-ccic/mmp-driver.c +@@ -176,7 +176,6 @@ static int mmpcam_probe(struct platform_ + INIT_LIST_HEAD(&cam->devlist); + + mcam = &cam->mcam; +- mcam->platform = MHP_Armada610; + mcam->plat_power_up = mmpcam_power_up; + mcam->plat_power_down = mmpcam_power_down; + mcam->dev = &pdev->dev; diff --git a/queue-3.3/media-rc-postpone-isr-registration.patch b/queue-3.3/media-rc-postpone-isr-registration.patch new file mode 100644 index 00000000000..e203aadd0a2 --- /dev/null +++ b/queue-3.3/media-rc-postpone-isr-registration.patch @@ -0,0 +1,315 @@ +From 9ef449c6b31bb6a8e6dedc24de475a3b8c79be20 Mon Sep 17 00:00:00 2001 +From: Luis Henriques +Date: Sat, 21 Apr 2012 12:25:21 -0300 +Subject: media: rc: Postpone ISR registration + +From: Luis Henriques + +commit 9ef449c6b31bb6a8e6dedc24de475a3b8c79be20 upstream. + +An early registration of an ISR was causing a crash to several users (for +example, with the ite-cir driver: http://bugs.launchpad.net/bugs/972723). +The reason was that IRQs were being triggered before a driver +initialisation was completed. + +This patch fixes this by moving the invocation to request_irq() and to +request_region() to a later stage on the driver probe function. + +Signed-off-by: Luis Henriques +Acked-by: Jarod Wilson +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/ene_ir.c | 32 ++++++++-------- + drivers/media/rc/fintek-cir.c | 20 +++++----- + drivers/media/rc/ite-cir.c | 20 +++++----- + drivers/media/rc/nuvoton-cir.c | 36 +++++++++--------- + drivers/media/rc/winbond-cir.c | 78 ++++++++++++++++++++--------------------- + 5 files changed, 93 insertions(+), 93 deletions(-) + +--- a/drivers/media/rc/ene_ir.c ++++ b/drivers/media/rc/ene_ir.c +@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp + + spin_lock_init(&dev->hw_lock); + +- /* claim the resources */ +- error = -EBUSY; +- dev->hw_io = pnp_port_start(pnp_dev, 0); +- if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) { +- dev->hw_io = -1; +- dev->irq = -1; +- goto error; +- } +- +- dev->irq = pnp_irq(pnp_dev, 0); +- if (request_irq(dev->irq, ene_isr, +- IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) { +- dev->irq = -1; +- goto error; +- } +- + pnp_set_drvdata(pnp_dev, dev); + dev->pnp_dev = pnp_dev; + +@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp + device_set_wakeup_capable(&pnp_dev->dev, true); + device_set_wakeup_enable(&pnp_dev->dev, true); + ++ /* claim the resources */ ++ error = -EBUSY; ++ dev->hw_io = pnp_port_start(pnp_dev, 0); ++ if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) { ++ dev->hw_io = -1; ++ dev->irq = -1; ++ goto error; ++ } ++ ++ dev->irq = pnp_irq(pnp_dev, 0); ++ if (request_irq(dev->irq, ene_isr, ++ IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) { ++ dev->irq = -1; ++ goto error; ++ } ++ + error = rc_register_device(rdev); + if (error < 0) + goto error; +--- a/drivers/media/rc/fintek-cir.c ++++ b/drivers/media/rc/fintek-cir.c +@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev * + + spin_lock_init(&fintek->fintek_lock); + +- ret = -EBUSY; +- /* now claim resources */ +- if (!request_region(fintek->cir_addr, +- fintek->cir_port_len, FINTEK_DRIVER_NAME)) +- goto failure; +- +- if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, +- FINTEK_DRIVER_NAME, (void *)fintek)) +- goto failure; +- + pnp_set_drvdata(pdev, fintek); + fintek->pdev = pdev; + +@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev * + /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */ + rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD); + ++ ret = -EBUSY; ++ /* now claim resources */ ++ if (!request_region(fintek->cir_addr, ++ fintek->cir_port_len, FINTEK_DRIVER_NAME)) ++ goto failure; ++ ++ if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, ++ FINTEK_DRIVER_NAME, (void *)fintek)) ++ goto failure; ++ + ret = rc_register_device(rdev); + if (ret) + goto failure; +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pde + /* initialize raw event */ + init_ir_raw_event(&itdev->rawir); + +- ret = -EBUSY; +- /* now claim resources */ +- if (!request_region(itdev->cir_addr, +- dev_desc->io_region_size, ITE_DRIVER_NAME)) +- goto failure; +- +- if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, +- ITE_DRIVER_NAME, (void *)itdev)) +- goto failure; +- + /* set driver data into the pnp device */ + pnp_set_drvdata(pdev, itdev); + itdev->pdev = pdev; +@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pde + rdev->driver_name = ITE_DRIVER_NAME; + rdev->map_name = RC_MAP_RC6_MCE; + ++ ret = -EBUSY; ++ /* now claim resources */ ++ if (!request_region(itdev->cir_addr, ++ dev_desc->io_region_size, ITE_DRIVER_NAME)) ++ goto failure; ++ ++ if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, ++ ITE_DRIVER_NAME, (void *)itdev)) ++ goto failure; ++ + ret = rc_register_device(rdev); + if (ret) + goto failure; +--- a/drivers/media/rc/nuvoton-cir.c ++++ b/drivers/media/rc/nuvoton-cir.c +@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pde + spin_lock_init(&nvt->nvt_lock); + spin_lock_init(&nvt->tx.lock); + +- ret = -EBUSY; +- /* now claim resources */ +- if (!request_region(nvt->cir_addr, +- CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) +- goto failure; +- +- if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, +- NVT_DRIVER_NAME, (void *)nvt)) +- goto failure; +- +- if (!request_region(nvt->cir_wake_addr, +- CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) +- goto failure; +- +- if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, +- NVT_DRIVER_NAME, (void *)nvt)) +- goto failure; +- + pnp_set_drvdata(pdev, nvt); + nvt->pdev = pdev; + +@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pde + rdev->tx_resolution = XYZ; + #endif + ++ ret = -EBUSY; ++ /* now claim resources */ ++ if (!request_region(nvt->cir_addr, ++ CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) ++ goto failure; ++ ++ if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, ++ NVT_DRIVER_NAME, (void *)nvt)) ++ goto failure; ++ ++ if (!request_region(nvt->cir_wake_addr, ++ CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) ++ goto failure; ++ ++ if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, ++ NVT_DRIVER_NAME, (void *)nvt)) ++ goto failure; ++ + ret = rc_register_device(rdev); + if (ret) + goto failure; +--- a/drivers/media/rc/winbond-cir.c ++++ b/drivers/media/rc/winbond-cir.c +@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, cons + "(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n", + data->wbase, data->ebase, data->sbase, data->irq); + +- if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) { +- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", +- data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1); +- err = -EBUSY; +- goto exit_free_data; +- } +- +- if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) { +- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", +- data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1); +- err = -EBUSY; +- goto exit_release_wbase; +- } +- +- if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) { +- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", +- data->sbase, data->sbase + SP_IOMEM_LEN - 1); +- err = -EBUSY; +- goto exit_release_ebase; +- } +- +- err = request_irq(data->irq, wbcir_irq_handler, +- IRQF_DISABLED, DRVNAME, device); +- if (err) { +- dev_err(dev, "Failed to claim IRQ %u\n", data->irq); +- err = -EBUSY; +- goto exit_release_sbase; +- } +- + led_trigger_register_simple("cir-tx", &data->txtrigger); + if (!data->txtrigger) { + err = -ENOMEM; +- goto exit_free_irq; ++ goto exit_free_data; + } + + led_trigger_register_simple("cir-rx", &data->rxtrigger); +@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, cons + data->dev->priv = data; + data->dev->dev.parent = &device->dev; + ++ if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) { ++ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", ++ data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1); ++ err = -EBUSY; ++ goto exit_free_rc; ++ } ++ ++ if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) { ++ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", ++ data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1); ++ err = -EBUSY; ++ goto exit_release_wbase; ++ } ++ ++ if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) { ++ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n", ++ data->sbase, data->sbase + SP_IOMEM_LEN - 1); ++ err = -EBUSY; ++ goto exit_release_ebase; ++ } ++ ++ err = request_irq(data->irq, wbcir_irq_handler, ++ IRQF_DISABLED, DRVNAME, device); ++ if (err) { ++ dev_err(dev, "Failed to claim IRQ %u\n", data->irq); ++ err = -EBUSY; ++ goto exit_release_sbase; ++ } ++ + err = rc_register_device(data->dev); + if (err) +- goto exit_free_rc; ++ goto exit_free_irq; + + device_init_wakeup(&device->dev, 1); + +@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, cons + + return 0; + +-exit_free_rc: +- rc_free_device(data->dev); +-exit_unregister_led: +- led_classdev_unregister(&data->led); +-exit_unregister_rxtrigger: +- led_trigger_unregister_simple(data->rxtrigger); +-exit_unregister_txtrigger: +- led_trigger_unregister_simple(data->txtrigger); + exit_free_irq: + free_irq(data->irq, device); + exit_release_sbase: +@@ -1088,6 +1080,14 @@ exit_release_ebase: + release_region(data->ebase, EHFUNC_IOMEM_LEN); + exit_release_wbase: + release_region(data->wbase, WAKEUP_IOMEM_LEN); ++exit_free_rc: ++ rc_free_device(data->dev); ++exit_unregister_led: ++ led_classdev_unregister(&data->led); ++exit_unregister_rxtrigger: ++ led_trigger_unregister_simple(data->rxtrigger); ++exit_unregister_txtrigger: ++ led_trigger_unregister_simple(data->txtrigger); + exit_free_data: + kfree(data); + pnp_set_drvdata(device, NULL); diff --git a/queue-3.3/media-s5p-fimc-fix-locking-in-subdev-set_crop-op.patch b/queue-3.3/media-s5p-fimc-fix-locking-in-subdev-set_crop-op.patch new file mode 100644 index 00000000000..1ac645f9ce6 --- /dev/null +++ b/queue-3.3/media-s5p-fimc-fix-locking-in-subdev-set_crop-op.patch @@ -0,0 +1,33 @@ +From e985dbf7d93e2a3e114b4525413e50f83613e0cb Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Sat, 21 Apr 2012 18:46:30 -0300 +Subject: media: s5p-fimc: Fix locking in subdev set_crop op + +From: Sylwester Nawrocki + +commit e985dbf7d93e2a3e114b4525413e50f83613e0cb upstream. + +When setting TRY crop on the sub-device the mutex was erroneously acquired +rather than released on exit path. This bug is present in kernels starting +from v3.2. + +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Kyungmin Park +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/s5p-fimc/fimc-capture.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/s5p-fimc/fimc-capture.c ++++ b/drivers/media/video/s5p-fimc/fimc-capture.c +@@ -1316,7 +1316,7 @@ static int fimc_subdev_set_crop(struct v + fimc_capture_try_crop(ctx, r, crop->pad); + + if (crop->which == V4L2_SUBDEV_FORMAT_TRY) { +- mutex_lock(&fimc->lock); ++ mutex_unlock(&fimc->lock); + *v4l2_subdev_get_try_crop(fh, crop->pad) = *r; + return 0; + } diff --git a/queue-3.3/mm-nobootmem-fix-sign-extend-problem-in-__free_pages_memory.patch b/queue-3.3/mm-nobootmem-fix-sign-extend-problem-in-__free_pages_memory.patch new file mode 100644 index 00000000000..a97e9fa4328 --- /dev/null +++ b/queue-3.3/mm-nobootmem-fix-sign-extend-problem-in-__free_pages_memory.patch @@ -0,0 +1,46 @@ +From 6bc2e853c6b46a6041980d58200ad9b0a73a60ff Mon Sep 17 00:00:00 2001 +From: Russ Anderson +Date: Thu, 10 May 2012 13:01:46 -0700 +Subject: mm: nobootmem: fix sign extend problem in __free_pages_memory() + +From: Russ Anderson + +commit 6bc2e853c6b46a6041980d58200ad9b0a73a60ff upstream. + +Systems with 8 TBytes of memory or greater can hit a problem where only +the the first 8 TB of memory shows up. This is due to "int i" being +smaller than "unsigned long start_aligned", causing the high bits to be +dropped. + +The fix is to change `i' to unsigned long to match start_aligned +and end_aligned. + +Thanks to Jack Steiner for assistance tracking this down. + +Signed-off-by: Russ Anderson +Cc: Jack Steiner +Cc: Johannes Weiner +Cc: Tejun Heo +Cc: David S. Miller +Cc: Yinghai Lu +Cc: Gavin Shan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/nobootmem.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/mm/nobootmem.c ++++ b/mm/nobootmem.c +@@ -82,8 +82,7 @@ void __init free_bootmem_late(unsigned l + + static void __init __free_pages_memory(unsigned long start, unsigned long end) + { +- int i; +- unsigned long start_aligned, end_aligned; ++ unsigned long i, start_aligned, end_aligned; + int order = ilog2(BITS_PER_LONG); + + start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1); diff --git a/queue-3.3/mtd-fix-oops-in-dataflash-driver.patch b/queue-3.3/mtd-fix-oops-in-dataflash-driver.patch new file mode 100644 index 00000000000..0a008a9a380 --- /dev/null +++ b/queue-3.3/mtd-fix-oops-in-dataflash-driver.patch @@ -0,0 +1,38 @@ +From 7a84477c4acebf6299b6a8bd6a1d5894eb838ffa Mon Sep 17 00:00:00 2001 +From: Will Newton +Date: Fri, 30 Mar 2012 11:51:02 +0100 +Subject: mtd: fix oops in dataflash driver + +From: Will Newton + +commit 7a84477c4acebf6299b6a8bd6a1d5894eb838ffa upstream. + +I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to +be happening is that otp_select_filemode calls mtd_read_fact_prot_reg +with -1 for offset and length and a NULL buffer to test if OTP +operations are supported. This finds its way down to otp_read in +mtd_dataflash.c and causes an oops when memcpying the returned data +into the NULL buf. + +None of the checks in otp_read catches the negative length and offset. +Changing the length of the dummy read to 0 prevents the oops. + +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtdchar.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -369,7 +369,7 @@ static int otp_select_filemode(struct mt + * Make a fake call to mtd_read_fact_prot_reg() to check if OTP + * operations are supported. + */ +- if (mtd_read_fact_prot_reg(mtd, -1, -1, &retlen, NULL) == -EOPNOTSUPP) ++ if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == -EOPNOTSUPP) + return -EOPNOTSUPP; + + switch (mode) { diff --git a/queue-3.3/percpu-pcpu_embed_first_chunk-should-free-unused-parts-after-all-allocs-are-complete.patch b/queue-3.3/percpu-pcpu_embed_first_chunk-should-free-unused-parts-after-all-allocs-are-complete.patch new file mode 100644 index 00000000000..132e998c24d --- /dev/null +++ b/queue-3.3/percpu-pcpu_embed_first_chunk-should-free-unused-parts-after-all-allocs-are-complete.patch @@ -0,0 +1,54 @@ +From 42b64281453249dac52861f9b97d18552a7ec62b Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 27 Apr 2012 08:42:53 -0700 +Subject: percpu: pcpu_embed_first_chunk() should free unused parts after all allocs are complete + +From: Tejun Heo + +commit 42b64281453249dac52861f9b97d18552a7ec62b upstream. + +pcpu_embed_first_chunk() allocates memory for each node, copies percpu +data and frees unused portions of it before proceeding to the next +group. This assumes that allocations for different nodes doesn't +overlap; however, depending on memory topology, the bootmem allocator +may end up allocating memory from a different node than the requested +one which may overlap with the portion freed from one of the previous +percpu areas. This leads to percpu groups for different nodes +overlapping which is a serious bug. + +This patch separates out copy & partial free from the allocation loop +such that all allocations are complete before partial frees happen. + +This also fixes overlapping frees which could happen on allocation +failure path - out_free_areas path frees whole groups but the groups +could have portions freed at that point. + +Signed-off-by: Tejun Heo +Reported-by: "Pavel V. Panteleev" +Tested-by: "Pavel V. Panteleev" +LKML-Reference: +Signed-off-by: Greg Kroah-Hartman + +--- + mm/percpu.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1650,6 +1650,16 @@ int __init pcpu_embed_first_chunk(size_t + areas[group] = ptr; + + base = min(ptr, base); ++ } ++ ++ /* ++ * Copy data and free unused parts. This should happen after all ++ * allocations are complete; otherwise, we may end up with ++ * overlapping groups. ++ */ ++ for (group = 0; group < ai->nr_groups; group++) { ++ struct pcpu_group_info *gi = &ai->groups[group]; ++ void *ptr = areas[group]; + + for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) { + if (gi->cpu_map[i] == NR_CPUS) { diff --git a/queue-3.3/series b/queue-3.3/series index 6afb1ac0885..6a87365fae6 100644 --- a/queue-3.3/series +++ b/queue-3.3/series @@ -5,3 +5,30 @@ alsa-hda-idt-fix-power-map-for-speaker-pins-with-some-hp-laptops.patch usbnet-fix-skb-traversing-races-during-unlink-v2.patch namespaces-pid_ns-fix-leakage-on-fork-failure.patch sparc64-do-not-clobber-g2-in-xcall_fetch_glob_regs.patch +media-marvell-cam-fix-an-arm-build-error.patch +arm-7417-1-vfp-ensure-preemption-is-disabled-when-enabling-vfp-access.patch +arm-prevent-vm_growsdown-mmaps-extending-below-first_user_address.patch +media-s5p-fimc-fix-locking-in-subdev-set_crop-op.patch +media-rc-postpone-isr-registration.patch +media-dvb_frontend-fix-a-regression-with-dvb-s-zig-zag.patch +asoc-cs42l73-sync-digital-mixer-kcontrols-to-allow-for-0db.patch +asoc-wm8994-fix-aif2adc-power-down.patch +cdc_ether-ignore-bogus-union-descriptor-for-rndis-devices.patch +cdc_ether-add-novatel-usb551l-device-ids-for-flag_wwan.patch +percpu-pcpu_embed_first_chunk-should-free-unused-parts-after-all-allocs-are-complete.patch +kmemleak-fix-the-kmemleak-tracking-of-the-percpu-areas-with-smp.patch +mtd-fix-oops-in-dataflash-driver.patch +hugetlb-prevent-bug_on-in-hugetlb_fault-hugetlb_cow.patch +mm-nobootmem-fix-sign-extend-problem-in-__free_pages_memory.patch +jffs2-fix-lock-acquisition-order-bug-in-gc-path.patch +arch-tile-apply-commit-74fca9da0-to-the-compat-signal-handling-as-well.patch +crypto-mv_cesa-requires-on-crypto_hash-to-build.patch +target-drop-incorrect-se_lun_acl-release-for-dynamic-explict-acl-conversion.patch +target-fix-spc-2-release-bug-for-multi-session-iscsi-client-setups.patch +target-fix-bug-in-handling-of-fileio-block_device-resize-ops.patch +virtio-console-tell-host-of-open-ports-after-resume-from-s3-s4.patch +dm-mpath-check-if-scsi_dh-module-already-loaded-before-trying-to-load.patch +e1000-prevent-reset-task-killing-itself.patch +md-add-del_timer_sync-to-mddev_suspend-fix-nasty-panic.patch +tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oom-conditions.patch +init-don-t-try-mounting-device-as-nfs-root-unless-type-fully-matches.patch diff --git a/queue-3.3/target-drop-incorrect-se_lun_acl-release-for-dynamic-explict-acl-conversion.patch b/queue-3.3/target-drop-incorrect-se_lun_acl-release-for-dynamic-explict-acl-conversion.patch new file mode 100644 index 00000000000..9e1669a8981 --- /dev/null +++ b/queue-3.3/target-drop-incorrect-se_lun_acl-release-for-dynamic-explict-acl-conversion.patch @@ -0,0 +1,67 @@ +From cfebf8f42f47327fa54cf05c19b98f4bd5236a26 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 10 May 2012 22:05:49 -0700 +Subject: target: Drop incorrect se_lun_acl release for dynamic -> explict ACL conversion + +From: Nicholas Bellinger + +commit cfebf8f42f47327fa54cf05c19b98f4bd5236a26 upstream. + +This patch removes some potentially problematic legacy code within +core_clear_initiator_node_from_tpg() that was originally intended to +release left over se_lun_acl setup during dynamic NodeACL+MappedLUN +generate when running with TPG demo-mode operation. + +Since we now only ever expect to allocate and release se_lun_acl from +within target_core_fabric_configfs.c:target_fabric_make_mappedlun() and +target_fabric_drop_mappedlun() context respectively, this code for +demo-mode release is incorrect and needs to be removed. + +Cc: Christoph Hellwig +Cc: Andy Grover +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_tpg.c | 22 ---------------------- + 1 file changed, 22 deletions(-) + +--- a/drivers/target/target_core_tpg.c ++++ b/drivers/target/target_core_tpg.c +@@ -60,7 +60,6 @@ static void core_clear_initiator_node_fr + int i; + struct se_dev_entry *deve; + struct se_lun *lun; +- struct se_lun_acl *acl, *acl_tmp; + + spin_lock_irq(&nacl->device_list_lock); + for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) { +@@ -81,28 +80,7 @@ static void core_clear_initiator_node_fr + core_update_device_list_for_node(lun, NULL, deve->mapped_lun, + TRANSPORT_LUNFLAGS_NO_ACCESS, nacl, tpg, 0); + +- spin_lock(&lun->lun_acl_lock); +- list_for_each_entry_safe(acl, acl_tmp, +- &lun->lun_acl_list, lacl_list) { +- if (!strcmp(acl->initiatorname, nacl->initiatorname) && +- (acl->mapped_lun == deve->mapped_lun)) +- break; +- } +- +- if (!acl) { +- pr_err("Unable to locate struct se_lun_acl for %s," +- " mapped_lun: %u\n", nacl->initiatorname, +- deve->mapped_lun); +- spin_unlock(&lun->lun_acl_lock); +- spin_lock_irq(&nacl->device_list_lock); +- continue; +- } +- +- list_del(&acl->lacl_list); +- spin_unlock(&lun->lun_acl_lock); +- + spin_lock_irq(&nacl->device_list_lock); +- kfree(acl); + } + spin_unlock_irq(&nacl->device_list_lock); + } diff --git a/queue-3.3/target-fix-bug-in-handling-of-fileio-block_device-resize-ops.patch b/queue-3.3/target-fix-bug-in-handling-of-fileio-block_device-resize-ops.patch new file mode 100644 index 00000000000..57e5fd57d5d --- /dev/null +++ b/queue-3.3/target-fix-bug-in-handling-of-fileio-block_device-resize-ops.patch @@ -0,0 +1,75 @@ +From cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Wed, 16 May 2012 16:05:26 -0700 +Subject: target: Fix bug in handling of FILEIO + block_device resize ops + +From: Nicholas Bellinger + +commit cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 upstream. + +This patch fixes a bug in the handling of FILEIO w/ underlying block_device +resize operations where the original fd_dev->fd_dev_size was incorrectly being +used in fd_get_blocks() for READ_CAPACITY response payloads. + +This patch avoids using fd_dev->fd_dev_size for FILEIO devices with +an underlying block_device, and instead changes fd_get_blocks() to +get the sector count directly from i_size_read() as recommended by hch. + +Reported-by: Christoph Hellwig +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_file.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -169,6 +169,7 @@ static struct se_device *fd_create_virtd + inode = file->f_mapping->host; + if (S_ISBLK(inode->i_mode)) { + struct request_queue *q; ++ unsigned long long dev_size; + /* + * Setup the local scope queue_limits from struct request_queue->limits + * to pass into transport_add_device_to_core_hba() as struct se_dev_limits. +@@ -183,13 +184,12 @@ static struct se_device *fd_create_virtd + * one (1) logical sector from underlying struct block_device + */ + fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev); +- fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) - ++ dev_size = (i_size_read(file->f_mapping->host) - + fd_dev->fd_block_size); + + pr_debug("FILEIO: Using size: %llu bytes from struct" + " block_device blocks: %llu logical_block_size: %d\n", +- fd_dev->fd_dev_size, +- div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size), ++ dev_size, div_u64(dev_size, fd_dev->fd_block_size), + fd_dev->fd_block_size); + } else { + if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) { +@@ -605,10 +605,20 @@ static u32 fd_get_device_type(struct se_ + static sector_t fd_get_blocks(struct se_device *dev) + { + struct fd_dev *fd_dev = dev->dev_ptr; +- unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size, +- dev->se_sub_dev->se_dev_attrib.block_size); ++ struct file *f = fd_dev->fd_file; ++ struct inode *i = f->f_mapping->host; ++ unsigned long long dev_size; ++ /* ++ * When using a file that references an underlying struct block_device, ++ * ensure dev_size is always based on the current inode size in order ++ * to handle underlying block_device resize operations. ++ */ ++ if (S_ISBLK(i->i_mode)) ++ dev_size = (i_size_read(i) - fd_dev->fd_block_size); ++ else ++ dev_size = fd_dev->fd_dev_size; + +- return blocks_long; ++ return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size); + } + + static struct se_subsystem_api fileio_template = { diff --git a/queue-3.3/target-fix-spc-2-release-bug-for-multi-session-iscsi-client-setups.patch b/queue-3.3/target-fix-spc-2-release-bug-for-multi-session-iscsi-client-setups.patch new file mode 100644 index 00000000000..46938426d67 --- /dev/null +++ b/queue-3.3/target-fix-spc-2-release-bug-for-multi-session-iscsi-client-setups.patch @@ -0,0 +1,39 @@ +From edc318d9fea6854df752ec8c645b960b0d5a1d23 Mon Sep 17 00:00:00 2001 +From: Bernhard Kohl +Date: Sun, 13 May 2012 23:39:37 +0200 +Subject: target: Fix SPC-2 RELEASE bug for multi-session iSCSI client setups + +From: Bernhard Kohl + +commit edc318d9fea6854df752ec8c645b960b0d5a1d23 upstream. + +This patch addresses a bug in a special case for target core SPC-2 RELEASE +logic where the same physical client (eg: iSCSI InitiatorName) with +differing iSCSI session identifiers (ISID) is allowed to incorrectly release +the same client's SPC-2 reservation from the non reservation holding path. + +Note this bug is specific to iscsi-target w/ SPC-2 reservations, and +with the default enforce_pr_isids=1 device attr setting in target-core +controls if a InitiatorName + different ISID reservations are handled +the same as a single iSCSI client entity. + +Signed-off-by: Bernhard Kohl +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_pr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -220,6 +220,9 @@ int target_scsi2_reservation_release(str + if (dev->dev_reserved_node_acl != sess->se_node_acl) + goto out_unlock; + ++ if (dev->dev_res_bin_isid != sess->sess_bin_isid) ++ goto out_unlock; ++ + dev->dev_reserved_node_acl = NULL; + dev->dev_flags &= ~DF_SPC2_RESERVATIONS; + if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) { diff --git a/queue-3.3/tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oom-conditions.patch b/queue-3.3/tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oom-conditions.patch new file mode 100644 index 00000000000..a6bc2d0705d --- /dev/null +++ b/queue-3.3/tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oom-conditions.patch @@ -0,0 +1,54 @@ +From bad115cfe5b509043b684d3a007ab54b80090aa1 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Thu, 17 May 2012 11:14:14 +0000 +Subject: tcp: do_tcp_sendpages() must try to push data out on oom conditions + +From: Willy Tarreau + +commit bad115cfe5b509043b684d3a007ab54b80090aa1 upstream. + +Since recent changes on TCP splicing (starting with commits 2f533844 +"tcp: allow splice() to build full TSO packets" and 35f9c09f "tcp: +tcp_sendpages() should call tcp_push() once"), I started seeing +massive stalls when forwarding traffic between two sockets using +splice() when pipe buffers were larger than socket buffers. + +Latest changes (net: netdev_alloc_skb() use build_skb()) made the +problem even more apparent. + +The reason seems to be that if do_tcp_sendpages() fails on out of memory +condition without being able to send at least one byte, tcp_push() is not +called and the buffers cannot be flushed. + +After applying the attached patch, I cannot reproduce the stalls at all +and the data rate it perfectly stable and steady under any condition +which previously caused the problem to be permanent. + +The issue seems to have been there since before the kernel migrated to +git, which makes me think that the stalls I occasionally experienced +with tux during stress-tests years ago were probably related to the +same issue. + +This issue was first encountered on 3.0.31 and 3.2.17, so please backport +to -stable. + +Signed-off-by: Willy Tarreau +Acked-by: Eric Dumazet +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -849,8 +849,7 @@ new_segment: + wait_for_sndbuf: + set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + wait_for_memory: +- if (copied) +- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH); ++ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH); + + if ((err = sk_stream_wait_memory(sk, &timeo)) != 0) + goto do_error; diff --git a/queue-3.3/virtio-console-tell-host-of-open-ports-after-resume-from-s3-s4.patch b/queue-3.3/virtio-console-tell-host-of-open-ports-after-resume-from-s3-s4.patch new file mode 100644 index 00000000000..c7bb580acda --- /dev/null +++ b/queue-3.3/virtio-console-tell-host-of-open-ports-after-resume-from-s3-s4.patch @@ -0,0 +1,41 @@ +From fa8b66ccd2d200b64496cfedcce90bf54fe7d6e9 Mon Sep 17 00:00:00 2001 +From: Amit Shah +Date: Wed, 25 Apr 2012 14:40:39 +0530 +Subject: virtio: console: tell host of open ports after resume from s3/s4 + +From: Amit Shah + +commit fa8b66ccd2d200b64496cfedcce90bf54fe7d6e9 upstream. + +If a port was open before going into one of the sleep states, the port +can continue normal operation after restore. However, the host has to +be told that the guest side of the connection is open to restore +pre-suspend state. + +This wasn't noticed so far due to a bug in qemu that was fixed recently +(which marked the guest-side connection as always open). + +Signed-off-by: Amit Shah +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/virtio_console.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -1901,6 +1901,13 @@ static int virtcons_restore(struct virti + + /* Get port open/close status on the host */ + send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 1); ++ ++ /* ++ * If a port was open at the time of suspending, we ++ * have to let the host know that it's still open. ++ */ ++ if (port->guest_connected) ++ send_control_msg(port, VIRTIO_CONSOLE_PORT_OPEN, 1); + } + return 0; + }