From: Greg Kroah-Hartman Date: Tue, 11 Sep 2012 17:11:46 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.5.4~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2f2e21fdd65ca0806893b4be9ac1e39778e89493;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: dccp-check-ccid-before-dereferencing.patch drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch x86-microcode-amd-fix-broken-ucode-patch-size-check.patch xen-pciback-fix-proper-flr-steps.patch xen-use-correct-masking-in-xen_swiotlb_alloc_coherent.patch --- diff --git a/queue-3.4/dccp-check-ccid-before-dereferencing.patch b/queue-3.4/dccp-check-ccid-before-dereferencing.patch new file mode 100644 index 00000000000..f7f1370f3c3 --- /dev/null +++ b/queue-3.4/dccp-check-ccid-before-dereferencing.patch @@ -0,0 +1,43 @@ +From 276bdb82dedb290511467a5a4fdbe9f0b52dce6f Mon Sep 17 00:00:00 2001 +From: Mathias Krause +Date: Wed, 15 Aug 2012 11:31:54 +0000 +Subject: dccp: check ccid before dereferencing + +From: Mathias Krause + +commit 276bdb82dedb290511467a5a4fdbe9f0b52dce6f upstream. + +ccid_hc_rx_getsockopt() and ccid_hc_tx_getsockopt() might be called with +a NULL ccid pointer leading to a NULL pointer dereference. This could +lead to a privilege escalation if the attacker is able to map page 0 and +prepare it with a fake ccid_ops pointer. + +Signed-off-by: Mathias Krause +Cc: Gerrit Renker +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/dccp/ccid.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/dccp/ccid.h ++++ b/net/dccp/ccid.h +@@ -246,7 +246,7 @@ static inline int ccid_hc_rx_getsockopt( + u32 __user *optval, int __user *optlen) + { + int rc = -ENOPROTOOPT; +- if (ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL) ++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_rx_getsockopt != NULL) + rc = ccid->ccid_ops->ccid_hc_rx_getsockopt(sk, optname, len, + optval, optlen); + return rc; +@@ -257,7 +257,7 @@ static inline int ccid_hc_tx_getsockopt( + u32 __user *optval, int __user *optlen) + { + int rc = -ENOPROTOOPT; +- if (ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL) ++ if (ccid != NULL && ccid->ccid_ops->ccid_hc_tx_getsockopt != NULL) + rc = ccid->ccid_ops->ccid_hc_tx_getsockopt(sk, optname, len, + optval, optlen); + return rc; diff --git a/queue-3.4/drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch b/queue-3.4/drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch new file mode 100644 index 00000000000..4fec4eba00a --- /dev/null +++ b/queue-3.4/drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch @@ -0,0 +1,30 @@ +From c4903429a92be60e6fe59868924a65eca4cd1a38 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Tue, 28 Aug 2012 21:40:51 -0400 +Subject: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot + +From: Dave Airlie + +commit c4903429a92be60e6fe59868924a65eca4cd1a38 upstream. + +This will cause udev to load vmwgfx instead of waiting for X +to do it. + +Reviewed-by: Jakob Bornecrantz +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -182,6 +182,7 @@ static struct pci_device_id vmw_pci_id_l + {0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII}, + {0, 0, 0} + }; ++MODULE_DEVICE_TABLE(pci, vmw_pci_id_list); + + static int enable_fbdev; + diff --git a/queue-3.4/hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch b/queue-3.4/hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch new file mode 100644 index 00000000000..6e4931297af --- /dev/null +++ b/queue-3.4/hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch @@ -0,0 +1,32 @@ +From 67ddbb3e6568fb1820b2cc45b00c50702b114801 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 23 Aug 2012 10:51:55 -0400 +Subject: HID: add NOGET quirk for Eaton Ellipse MAX UPS + +From: Alan Stern + +commit 67ddbb3e6568fb1820b2cc45b00c50702b114801 upstream. + +This patch (as1603) adds a NOGET quirk for the Eaton Ellipse MAX UPS +device. (The USB IDs were already present in hid-ids.h, apparently +under a different name.) + +Signed-off-by: Alan Stern +Reported-by: Laurent Bigonville +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hid-quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -70,6 +70,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET }, ++ { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS }, diff --git a/queue-3.4/hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch b/queue-3.4/hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch new file mode 100644 index 00000000000..caffaa6471a --- /dev/null +++ b/queue-3.4/hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch @@ -0,0 +1,41 @@ +From 43ca6cb28c871f2fbad10117b0648e5ae3b0f638 Mon Sep 17 00:00:00 2001 +From: Luca Tettamanti +Date: Tue, 21 Aug 2012 17:36:28 +0200 +Subject: hwmon: (asus_atk0110) Add quirk for Asus M5A78L +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luca Tettamanti + +commit 43ca6cb28c871f2fbad10117b0648e5ae3b0f638 upstream. + +The old interface is bugged and reads the wrong sensor when retrieving +the reading for the chassis fan (it reads the CPU sensor); the new +interface works fine. + +Reported-by: Göran Uddeborg +Tested-by: Göran Uddeborg +Signed-off-by: Luca Tettamanti +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/asus_atk0110.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hwmon/asus_atk0110.c ++++ b/drivers/hwmon/asus_atk0110.c +@@ -34,6 +34,12 @@ static const struct dmi_system_id __init + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "SABERTOOTH X58") + } ++ }, { ++ /* Old interface reads the same sensor for fan0 and fan1 */ ++ .ident = "Asus M5A78L", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "M5A78L") ++ } + }, + { } + }; diff --git a/queue-3.4/input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch b/queue-3.4/input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch new file mode 100644 index 00000000000..876a06420ac --- /dev/null +++ b/queue-3.4/input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch @@ -0,0 +1,44 @@ +From 7b125b94ca16b7e618c6241cb02c4c8060cea5e3 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Tue, 21 Aug 2012 21:57:15 -0700 +Subject: Input: i8042 - add Gigabyte T1005 series netbooks to noloop table + +From: Dmitry Torokhov + +commit 7b125b94ca16b7e618c6241cb02c4c8060cea5e3 upstream. + +They all define their chassis type as "Other" and therefore are not +categorized as "laptops" by the driver, which tries to perform AUX IRQ +delivery test which fails and causes touchpad not working. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42620 +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -177,6 +177,20 @@ static const struct dmi_system_id __init + }, + }, + { ++ /* Gigabyte T1005 - defines wrong chassis type ("Other") */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "T1005"), ++ }, ++ }, ++ { ++ /* Gigabyte T1005M/P - defines wrong chassis type ("Other") */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "T1005M/P"), ++ }, ++ }, ++ { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"), diff --git a/queue-3.4/parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch b/queue-3.4/parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch new file mode 100644 index 00000000000..a2811c0e4ca --- /dev/null +++ b/queue-3.4/parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch @@ -0,0 +1,59 @@ +From bba3d8c3b3c0f2123be5bc687d1cddc13437c923 Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Mon, 23 Jul 2012 12:16:19 +0100 +Subject: PARISC: Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts + +From: Mel Gorman + +commit bba3d8c3b3c0f2123be5bc687d1cddc13437c923 upstream. + +The following build error occured during a parisc build with +swap-over-NFS patches applied. + +net/core/sock.c:274:36: error: initializer element is not constant +net/core/sock.c:274:36: error: (near initialization for 'memalloc_socks') +net/core/sock.c:274:36: error: initializer element is not constant + +Dave Anglin says: +> Here is the line in sock.i: +> +> struct static_key memalloc_socks = ((struct static_key) { .enabled = +> ((atomic_t) { (0) }) }); + +The above line contains two compound literals. It also uses a designated +initializer to initialize the field enabled. A compound literal is not a +constant expression. + +The location of the above statement isn't fully clear, but if a compound +literal occurs outside the body of a function, the initializer list must +consist of constant expressions. + +Reported-by: Fengguang Wu +Signed-off-by: Mel Gorman +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/atomic.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/atomic.h ++++ b/arch/parisc/include/asm/atomic.h +@@ -141,7 +141,7 @@ static __inline__ int __atomic_add_unles + + #define atomic_sub_and_test(i,v) (atomic_sub_return((i),(v)) == 0) + +-#define ATOMIC_INIT(i) ((atomic_t) { (i) }) ++#define ATOMIC_INIT(i) { (i) } + + #define smp_mb__before_atomic_dec() smp_mb() + #define smp_mb__after_atomic_dec() smp_mb() +@@ -150,7 +150,7 @@ static __inline__ int __atomic_add_unles + + #ifdef CONFIG_64BIT + +-#define ATOMIC64_INIT(i) ((atomic64_t) { (i) }) ++#define ATOMIC64_INIT(i) { (i) } + + static __inline__ s64 + __atomic64_add_return(s64 i, atomic64_t *v) diff --git a/queue-3.4/series b/queue-3.4/series index 2746510ab53..3593eb5c6a9 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -74,3 +74,12 @@ ext3-fix-fdatasync-for-files-with-only-i_size-changes.patch fuse-fix-retrieve-length.patch i2c-designware-fix-build-error-if-config_i2c_designware_platform-y-config_i2c_designware_pci-y.patch i2c-i801-add-device-ids-for-intel-lynx-point-lp-pch.patch +hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch +input-i8042-add-gigabyte-t1005-series-netbooks-to-noloop-table.patch +drm-vmwgfx-add-module_device_table-so-vmwgfx-loads-at-boot.patch +parisc-redefine-atomic_init-and-atomic64_init-to-drop-the-casts.patch +xen-use-correct-masking-in-xen_swiotlb_alloc_coherent.patch +xen-pciback-fix-proper-flr-steps.patch +x86-microcode-amd-fix-broken-ucode-patch-size-check.patch +dccp-check-ccid-before-dereferencing.patch +hwmon-asus_atk0110-add-quirk-for-asus-m5a78l.patch diff --git a/queue-3.4/x86-microcode-amd-fix-broken-ucode-patch-size-check.patch b/queue-3.4/x86-microcode-amd-fix-broken-ucode-patch-size-check.patch new file mode 100644 index 00000000000..c6f4564383a --- /dev/null +++ b/queue-3.4/x86-microcode-amd-fix-broken-ucode-patch-size-check.patch @@ -0,0 +1,54 @@ +From 36bf50d7697be18c6bfd0401e037df10bff1e573 Mon Sep 17 00:00:00 2001 +From: Andreas Herrmann +Date: Tue, 31 Jul 2012 15:41:45 +0200 +Subject: x86, microcode, AMD: Fix broken ucode patch size check + +From: Andreas Herrmann + +commit 36bf50d7697be18c6bfd0401e037df10bff1e573 upstream. + +This issue was recently observed on an AMD C-50 CPU where a patch of +maximum size was applied. + +Commit be62adb49294 ("x86, microcode, AMD: Simplify ucode verification") +added current_size in get_matching_microcode(). This is calculated as +size of the ucode patch + 8 (ie. size of the header). Later this is +compared against the maximum possible ucode patch size for a CPU family. +And of course this fails if the patch has already maximum size. + +Signed-off-by: Andreas Herrmann +Signed-off-by: Borislav Petkov +Link: http://lkml.kernel.org/r/1344361461-10076-1-git-send-email-bp@amd64.org +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/microcode_amd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/microcode_amd.c ++++ b/arch/x86/kernel/microcode_amd.c +@@ -143,11 +143,12 @@ static int get_matching_microcode(int cp + unsigned int *current_size) + { + struct microcode_header_amd *mc_hdr; +- unsigned int actual_size; ++ unsigned int actual_size, patch_size; + u16 equiv_cpu_id; + + /* size of the current patch we're staring at */ +- *current_size = *(u32 *)(ucode_ptr + 4) + SECTION_HDR_SIZE; ++ patch_size = *(u32 *)(ucode_ptr + 4); ++ *current_size = patch_size + SECTION_HDR_SIZE; + + equiv_cpu_id = find_equiv_id(); + if (!equiv_cpu_id) +@@ -174,7 +175,7 @@ static int get_matching_microcode(int cp + /* + * now that the header looks sane, verify its size + */ +- actual_size = verify_ucode_size(cpu, *current_size, leftover_size); ++ actual_size = verify_ucode_size(cpu, patch_size, leftover_size); + if (!actual_size) + return 0; + diff --git a/queue-3.4/xen-pciback-fix-proper-flr-steps.patch b/queue-3.4/xen-pciback-fix-proper-flr-steps.patch new file mode 100644 index 00000000000..7090515be29 --- /dev/null +++ b/queue-3.4/xen-pciback-fix-proper-flr-steps.patch @@ -0,0 +1,63 @@ +From 80ba77dfbce85f2d1be54847de3c866de1b18a9a Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Wed, 5 Sep 2012 16:35:20 -0400 +Subject: xen/pciback: Fix proper FLR steps. + +From: Konrad Rzeszutek Wilk + +commit 80ba77dfbce85f2d1be54847de3c866de1b18a9a upstream. + +When we do FLR and save PCI config we did it in the wrong order. +The end result was that if a PCI device was unbind from +its driver, then binded to xen-pciback, and then back to its +driver we would get: + +> lspci -s 04:00.0 +04:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection +13:42:12 # 4 :~/ +> echo "0000:04:00.0" > /sys/bus/pci/drivers/pciback/unbind +> modprobe e1000e +e1000e: Intel(R) PRO/1000 Network Driver - 2.0.0-k +e1000e: Copyright(c) 1999 - 2012 Intel Corporation. +e1000e 0000:04:00.0: Disabling ASPM L0s L1 +e1000e 0000:04:00.0: enabling device (0000 -> 0002) +xen: registering gsi 48 triggering 0 polarity 1 +Already setup the GSI :48 +e1000e 0000:04:00.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode +e1000e: probe of 0000:04:00.0 failed with error -2 + +This fixes it by first saving the PCI configuration space, then +doing the FLR. + +Reported-by: Ren, Yongjie +Reported-and-Tested-by: Tobias Geiger +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/xen-pciback/pci_stub.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/xen/xen-pciback/pci_stub.c ++++ b/drivers/xen/xen-pciback/pci_stub.c +@@ -353,16 +353,16 @@ static int __devinit pcistub_init_device + if (err) + goto config_release; + +- dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n"); +- __pci_reset_function_locked(dev); +- + /* We need the device active to save the state. */ + dev_dbg(&dev->dev, "save state of device\n"); + pci_save_state(dev); + dev_data->pci_saved_state = pci_store_saved_state(dev); + if (!dev_data->pci_saved_state) + dev_err(&dev->dev, "Could not store PCI conf saved state!\n"); +- ++ else { ++ dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n"); ++ __pci_reset_function_locked(dev); ++ } + /* Now disable the device (this also ensures some private device + * data is setup before we export) + */ diff --git a/queue-3.4/xen-use-correct-masking-in-xen_swiotlb_alloc_coherent.patch b/queue-3.4/xen-use-correct-masking-in-xen_swiotlb_alloc_coherent.patch new file mode 100644 index 00000000000..af67c023909 --- /dev/null +++ b/queue-3.4/xen-use-correct-masking-in-xen_swiotlb_alloc_coherent.patch @@ -0,0 +1,56 @@ +From b5031ed1be0aa419250557123633453753181643 Mon Sep 17 00:00:00 2001 +From: Ronny Hegewald +Date: Fri, 31 Aug 2012 09:57:52 +0000 +Subject: xen: Use correct masking in xen_swiotlb_alloc_coherent. + +From: Ronny Hegewald + +commit b5031ed1be0aa419250557123633453753181643 upstream. + +When running 32-bit pvops-dom0 and a driver tries to allocate a coherent +DMA-memory the xen swiotlb-implementation returned memory beyond 4GB. + +The underlaying reason is that if the supplied driver passes in a +DMA_BIT_MASK(64) ( hwdev->coherent_dma_mask is set to 0xffffffffffffffff) +our dma_mask will be u64 set to 0xffffffffffffffff even if we set it to +DMA_BIT_MASK(32) previously. Meaning we do not reset the upper bits. +By using the dma_alloc_coherent_mask function - it does the proper casting +and we get 0xfffffffff. + +This caused not working sound on a system with 4 GB and a 64-bit +compatible sound-card with sets the DMA-mask to 64bit. + +On bare-metal and the forward-ported xen-dom0 patches from OpenSuse a coherent +DMA-memory is always allocated inside the 32-bit address-range by calling +dma_alloc_coherent_mask. + +This patch adds the same functionality to xen swiotlb and is a rebase of the +original patch from Ronny Hegewald which never got upstream b/c the +underlaying reason was not understood until now. + +The original email with the original patch is in: +http://old-list-archives.xen.org/archives/html/xen-devel/2010-02/msg00038.html +the original thread from where the discussion started is in: +http://old-list-archives.xen.org/archives/html/xen-devel/2010-01/msg00928.html + +Signed-off-by: Ronny Hegewald +Signed-off-by: Stefano Panella +Acked-By: David Vrabel +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/swiotlb-xen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -232,7 +232,7 @@ xen_swiotlb_alloc_coherent(struct device + return ret; + + if (hwdev && hwdev->coherent_dma_mask) +- dma_mask = hwdev->coherent_dma_mask; ++ dma_mask = dma_alloc_coherent_mask(hwdev, flags); + + phys = virt_to_phys(ret); + dev_addr = xen_phys_to_bus(phys);