From: Greg Kroah-Hartman Date: Fri, 3 Oct 2014 18:47:16 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.16.4~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4675ccb93569700d14b9e420f13c08f3d526f0f9;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: ata_piix-add-device-ids-for-intel-9-series-pch.patch block-fix-dev_t-minor-allocation-lifetime.patch dm-crypt-fix-access-beyond-the-end-of-allocated-space.patch input-atkbd-do-not-try-deactivate-keyboard-on-any-lg-laptops.patch input-elantech-fix-detection-of-touchpad-on-asus-s301l.patch input-i8042-add-fujitsu-u574-to-no_timeout-dmi-table.patch input-i8042-add-nomux-quirk-for-avatar-aviu-145a6.patch input-serport-add-compat-handling-for-spiocstype-ioctl.patch input-synaptics-add-support-for-forcepads.patch lockd-fix-rpcbind-crash-on-lockd-startup-failure.patch percpu-fix-pcpu_alloc_pages-failure-path.patch percpu-free-percpu-allocation-info-for-uniprocessor-system.patch percpu-perform-tlb-flush-after-pcpu_map_pages-failure.patch rtlwifi-rtl8192cu-add-new-id.patch --- diff --git a/queue-3.10/ata_piix-add-device-ids-for-intel-9-series-pch.patch b/queue-3.10/ata_piix-add-device-ids-for-intel-9-series-pch.patch new file mode 100644 index 00000000000..7fc7c4573e8 --- /dev/null +++ b/queue-3.10/ata_piix-add-device-ids-for-intel-9-series-pch.patch @@ -0,0 +1,36 @@ +From 6cad1376954e591c3c41500c4e586e183e7ffe6d Mon Sep 17 00:00:00 2001 +From: James Ralston +Date: Wed, 27 Aug 2014 14:31:58 -0700 +Subject: ata_piix: Add Device IDs for Intel 9 Series PCH + +From: James Ralston + +commit 6cad1376954e591c3c41500c4e586e183e7ffe6d upstream. + +This patch adds the IDE mode SATA Device IDs for the Intel 9 Series PCH. + +Signed-off-by: James Ralston +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ata_piix.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/ata/ata_piix.c ++++ b/drivers/ata/ata_piix.c +@@ -340,6 +340,14 @@ static const struct pci_device_id piix_p + { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt }, + /* SATA Controller IDE (Coleto Creek) */ + { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, ++ /* SATA Controller IDE (9 Series) */ ++ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb }, + + { } /* terminate list */ + }; diff --git a/queue-3.10/block-fix-dev_t-minor-allocation-lifetime.patch b/queue-3.10/block-fix-dev_t-minor-allocation-lifetime.patch new file mode 100644 index 00000000000..a5faba00572 --- /dev/null +++ b/queue-3.10/block-fix-dev_t-minor-allocation-lifetime.patch @@ -0,0 +1,119 @@ +From 2da78092dda13f1efd26edbbf99a567776913750 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Tue, 26 Aug 2014 09:05:36 -0600 +Subject: block: Fix dev_t minor allocation lifetime + +From: Keith Busch + +commit 2da78092dda13f1efd26edbbf99a567776913750 upstream. + +Releases the dev_t minor when all references are closed to prevent +another device from acquiring the same major/minor. + +Since the partition's release may be invoked from call_rcu's soft-irq +context, the ext_dev_idr's mutex had to be replaced with a spinlock so +as not so sleep. + +Signed-off-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/genhd.c | 24 ++++++++++++++---------- + block/partition-generic.c | 2 +- + 2 files changed, 15 insertions(+), 11 deletions(-) + +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -28,10 +28,10 @@ struct kobject *block_depr; + /* for extended dynamic devt allocation, currently only one major is used */ + #define NR_EXT_DEVT (1 << MINORBITS) + +-/* For extended devt allocation. ext_devt_mutex prevents look up ++/* For extended devt allocation. ext_devt_lock prevents look up + * results from going away underneath its user. + */ +-static DEFINE_MUTEX(ext_devt_mutex); ++static DEFINE_SPINLOCK(ext_devt_lock); + static DEFINE_IDR(ext_devt_idr); + + static struct device_type disk_type; +@@ -420,9 +420,13 @@ int blk_alloc_devt(struct hd_struct *par + } + + /* allocate ext devt */ +- mutex_lock(&ext_devt_mutex); +- idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_KERNEL); +- mutex_unlock(&ext_devt_mutex); ++ idr_preload(GFP_KERNEL); ++ ++ spin_lock(&ext_devt_lock); ++ idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT); ++ spin_unlock(&ext_devt_lock); ++ ++ idr_preload_end(); + if (idx < 0) + return idx == -ENOSPC ? -EBUSY : idx; + +@@ -447,9 +451,9 @@ void blk_free_devt(dev_t devt) + return; + + if (MAJOR(devt) == BLOCK_EXT_MAJOR) { +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } + } + +@@ -665,7 +669,6 @@ void del_gendisk(struct gendisk *disk) + sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); + pm_runtime_set_memalloc_noio(disk_to_dev(disk), false); + device_del(disk_to_dev(disk)); +- blk_free_devt(disk_to_dev(disk)->devt); + } + EXPORT_SYMBOL(del_gendisk); + +@@ -690,13 +693,13 @@ struct gendisk *get_gendisk(dev_t devt, + } else { + struct hd_struct *part; + +- mutex_lock(&ext_devt_mutex); ++ spin_lock(&ext_devt_lock); + part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); + if (part && get_disk(part_to_disk(part))) { + *partno = part->partno; + disk = part_to_disk(part); + } +- mutex_unlock(&ext_devt_mutex); ++ spin_unlock(&ext_devt_lock); + } + + return disk; +@@ -1098,6 +1101,7 @@ static void disk_release(struct device * + { + struct gendisk *disk = dev_to_disk(dev); + ++ blk_free_devt(dev->devt); + disk_release_events(disk); + kfree(disk->random); + disk_replace_part_tbl(disk, NULL); +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -211,6 +211,7 @@ static const struct attribute_group *par + static void part_release(struct device *dev) + { + struct hd_struct *p = dev_to_part(dev); ++ blk_free_devt(dev->devt); + free_part_stats(p); + free_part_info(p); + kfree(p); +@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *di + rcu_assign_pointer(ptbl->last_lookup, NULL); + kobject_put(part->holder_dir); + device_del(part_to_dev(part)); +- blk_free_devt(part_devt(part)); + + hd_struct_put(part); + } diff --git a/queue-3.10/dm-crypt-fix-access-beyond-the-end-of-allocated-space.patch b/queue-3.10/dm-crypt-fix-access-beyond-the-end-of-allocated-space.patch new file mode 100644 index 00000000000..a1022e3fac3 --- /dev/null +++ b/queue-3.10/dm-crypt-fix-access-beyond-the-end-of-allocated-space.patch @@ -0,0 +1,98 @@ +From d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 28 Aug 2014 11:09:31 -0400 +Subject: dm crypt: fix access beyond the end of allocated space + +From: Mikulas Patocka + +commit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream. + +The DM crypt target accesses memory beyond allocated space resulting in +a crash on 32 bit x86 systems. + +This bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 "dm +crypt: use async crypto"). However, this bug was masked by the fact +that kmalloc rounds the size up to the next power of two. This bug +wasn't exposed until 3.17-rc1 commit 298a9fa08a ("dm crypt: use per-bio +data"). By switching to using per-bio data there was no longer any +padding beyond the end of a dm-crypt allocated memory block. + +To minimize allocation overhead dm-crypt puts several structures into one +block allocated with kmalloc. The block holds struct ablkcipher_request, +cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))), +struct dm_crypt_request and an initialization vector. + +The variable dmreq_start is set to offset of struct dm_crypt_request +within this memory block. dm-crypt allocates the block with this size: +cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size. + +When accessing the initialization vector, dm-crypt uses the function +iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq ++ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1). + +dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request +structure. However, when dm-crypt accesses the initialization vector, it +takes a pointer to the end of dm_crypt_request, aligns it, and then uses +it as the initialization vector. If the end of dm_crypt_request is not +aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the +alignment causes the initialization vector to point beyond the allocated +space. + +Fix this bug by calculating the variable iv_size_padding and adding it +to the allocated size. + +Also correct the alignment of dm_crypt_request. struct dm_crypt_request +is specific to dm-crypt (it isn't used by the crypto subsystem at all), +so it is aligned on __alignof__(struct dm_crypt_request). + +Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is +aligned as if the block was allocated with kmalloc. + +Reported-by: Krzysztof Kolasa +Tested-by: Milan Broz +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1506,6 +1506,7 @@ static int crypt_ctr(struct dm_target *t + unsigned int key_size, opt_params; + unsigned long long tmpll; + int ret; ++ size_t iv_size_padding; + struct dm_arg_set as; + const char *opt_string; + char dummy; +@@ -1542,12 +1543,23 @@ static int crypt_ctr(struct dm_target *t + + cc->dmreq_start = sizeof(struct ablkcipher_request); + cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc)); +- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment()); +- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) & +- ~(crypto_tfm_ctx_alignment() - 1); ++ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request)); ++ ++ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) { ++ /* Allocate the padding exactly */ ++ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request)) ++ & crypto_ablkcipher_alignmask(any_tfm(cc)); ++ } else { ++ /* ++ * If the cipher requires greater alignment than kmalloc ++ * alignment, we don't know the exact position of the ++ * initialization vector. We must assume worst case. ++ */ ++ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc)); ++ } + + cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start + +- sizeof(struct dm_crypt_request) + cc->iv_size); ++ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size); + if (!cc->req_pool) { + ti->error = "Cannot allocate crypt request mempool"; + goto bad; diff --git a/queue-3.10/input-atkbd-do-not-try-deactivate-keyboard-on-any-lg-laptops.patch b/queue-3.10/input-atkbd-do-not-try-deactivate-keyboard-on-any-lg-laptops.patch new file mode 100644 index 00000000000..f449e758925 --- /dev/null +++ b/queue-3.10/input-atkbd-do-not-try-deactivate-keyboard-on-any-lg-laptops.patch @@ -0,0 +1,47 @@ +From c01206796139e2b1feb7539bc72174fef1c6dc6e Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Wed, 10 Sep 2014 13:50:37 -0700 +Subject: Input: atkbd - do not try 'deactivate' keyboard on any LG laptops + +From: Dmitry Torokhov + +commit c01206796139e2b1feb7539bc72174fef1c6dc6e upstream. + +We are getting more and more reports about LG laptops not having +functioning keyboard if we try to deactivate keyboard during probe. +Given that having keyboard deactivated is merely "nice to have" +instead of a hard requirement for probing, let's disable it on all +LG boxes instead of trying to hunt down particular models. + +This change is prompted by patches trying to add "LG Electronics"/"ROCKY" +and "LG Electronics"/"LW60-F27B" to the DMI list. + +https://bugzilla.kernel.org/show_bug.cgi?id=77051 + +Reported-by: Jaime Velasco Juan +Reported-by: Georgios Tsalikis +Tested-by: Jaime Velasco Juan +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/atkbd.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -1791,14 +1791,6 @@ static const struct dmi_system_id atkbd_ + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), +- DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"), +- }, +- .callback = atkbd_deactivate_fixup, +- }, +- { +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"), +- DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"), + }, + .callback = atkbd_deactivate_fixup, + }, diff --git a/queue-3.10/input-elantech-fix-detection-of-touchpad-on-asus-s301l.patch b/queue-3.10/input-elantech-fix-detection-of-touchpad-on-asus-s301l.patch new file mode 100644 index 00000000000..a27fabe460c --- /dev/null +++ b/queue-3.10/input-elantech-fix-detection-of-touchpad-on-asus-s301l.patch @@ -0,0 +1,40 @@ +From 271329b3c798b2102120f5df829071c211ef00ed Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 8 Sep 2014 14:39:52 -0700 +Subject: Input: elantech - fix detection of touchpad on ASUS s301l +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +commit 271329b3c798b2102120f5df829071c211ef00ed upstream. + +Adjust Elantech signature validation to account fo rnewer models of +touchpads. + +Reported-and-tested-by: Màrius Monton +Signed-off-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/elantech.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1223,6 +1223,13 @@ static bool elantech_is_signature_valid( + if (param[1] == 0) + return true; + ++ /* ++ * Some models have a revision higher then 20. Meaning param[2] may ++ * be 10 or 20, skip the rates check for these. ++ */ ++ if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) ++ return true; ++ + for (i = 0; i < ARRAY_SIZE(rates); i++) + if (param[2] == rates[i]) + return false; diff --git a/queue-3.10/input-i8042-add-fujitsu-u574-to-no_timeout-dmi-table.patch b/queue-3.10/input-i8042-add-fujitsu-u574-to-no_timeout-dmi-table.patch new file mode 100644 index 00000000000..683c299de61 --- /dev/null +++ b/queue-3.10/input-i8042-add-fujitsu-u574-to-no_timeout-dmi-table.patch @@ -0,0 +1,37 @@ +From cc18a69c92d0972bc2fc5a047ee3be1e8398171b Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 10 Sep 2014 13:53:37 -0700 +Subject: Input: i8042 - add Fujitsu U574 to no_timeout dmi table + +From: Hans de Goede + +commit cc18a69c92d0972bc2fc5a047ee3be1e8398171b upstream. + +https://bugzilla.kernel.org/show_bug.cgi?id=69731 + +Reported-by: Jason Robinson +Signed-off-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -601,6 +601,14 @@ static const struct dmi_system_id __init + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), + }, + }, ++ { ++ /* Fujitsu U574 laptop */ ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), ++ }, ++ }, + { } + }; + diff --git a/queue-3.10/input-i8042-add-nomux-quirk-for-avatar-aviu-145a6.patch b/queue-3.10/input-i8042-add-nomux-quirk-for-avatar-aviu-145a6.patch new file mode 100644 index 00000000000..9ce3bd0aeb2 --- /dev/null +++ b/queue-3.10/input-i8042-add-nomux-quirk-for-avatar-aviu-145a6.patch @@ -0,0 +1,40 @@ +From d2682118f4bb3ceb835f91c1a694407a31bb7378 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 11 Sep 2014 10:10:26 -0700 +Subject: Input: i8042 - add nomux quirk for Avatar AVIU-145A6 + +From: Hans de Goede + +commit d2682118f4bb3ceb835f91c1a694407a31bb7378 upstream. + +The sys_vendor / product_name are somewhat generic unfortunately, so this +may lead to some false positives. But nomux usually does no harm, where as +not having it clearly is causing problems on the Avatar AVIU-145A6. + +https://bugzilla.kernel.org/show_bug.cgi?id=77391 + +Reported-by: Hugo P +Signed-off-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -458,6 +458,13 @@ static const struct dmi_system_id __init + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"), + }, + }, ++ { ++ /* Avatar AVIU-145A6 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), ++ }, ++ }, + { } + }; + diff --git a/queue-3.10/input-serport-add-compat-handling-for-spiocstype-ioctl.patch b/queue-3.10/input-serport-add-compat-handling-for-spiocstype-ioctl.patch new file mode 100644 index 00000000000..f83e2650b6c --- /dev/null +++ b/queue-3.10/input-serport-add-compat-handling-for-spiocstype-ioctl.patch @@ -0,0 +1,105 @@ +From a80d8b02751060a178bb1f7a6b7a93645a7a308b Mon Sep 17 00:00:00 2001 +From: John Sung +Date: Tue, 9 Sep 2014 10:06:51 -0700 +Subject: Input: serport - add compat handling for SPIOCSTYPE ioctl + +From: John Sung + +commit a80d8b02751060a178bb1f7a6b7a93645a7a308b upstream. + +When running a 32-bit inputattach utility in a 64-bit system, there will be +error code "inputattach: can't set device type". This is caused by the +serport device driver not supporting compat_ioctl, so that SPIOCSTYPE ioctl +fails. + +Signed-off-by: John Sung +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/serport.c | 45 +++++++++++++++++++++++++++++++++++------- + 1 file changed, 38 insertions(+), 7 deletions(-) + +--- a/drivers/input/serio/serport.c ++++ b/drivers/input/serio/serport.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + MODULE_AUTHOR("Vojtech Pavlik "); + MODULE_DESCRIPTION("Input device TTY line discipline"); +@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct + return 0; + } + ++static void serport_set_type(struct tty_struct *tty, unsigned long type) ++{ ++ struct serport *serport = tty->disc_data; ++ ++ serport->id.proto = type & 0x000000ff; ++ serport->id.id = (type & 0x0000ff00) >> 8; ++ serport->id.extra = (type & 0x00ff0000) >> 16; ++} ++ + /* + * serport_ldisc_ioctl() allows to set the port protocol, and device ID + */ + +-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg) ++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file, ++ unsigned int cmd, unsigned long arg) + { +- struct serport *serport = (struct serport*) tty->disc_data; +- unsigned long type; +- + if (cmd == SPIOCSTYPE) { ++ unsigned long type; ++ + if (get_user(type, (unsigned long __user *) arg)) + return -EFAULT; + +- serport->id.proto = type & 0x000000ff; +- serport->id.id = (type & 0x0000ff00) >> 8; +- serport->id.extra = (type & 0x00ff0000) >> 16; ++ serport_set_type(tty, type); ++ return 0; ++ } ++ ++ return -EINVAL; ++} ++ ++#ifdef CONFIG_COMPAT ++#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t) ++static long serport_ldisc_compat_ioctl(struct tty_struct *tty, ++ struct file *file, ++ unsigned int cmd, unsigned long arg) ++{ ++ if (cmd == COMPAT_SPIOCSTYPE) { ++ void __user *uarg = compat_ptr(arg); ++ compat_ulong_t compat_type; ++ ++ if (get_user(compat_type, (compat_ulong_t __user *)uarg)) ++ return -EFAULT; + ++ serport_set_type(tty, compat_type); + return 0; + } + + return -EINVAL; + } ++#endif + + static void serport_ldisc_write_wakeup(struct tty_struct * tty) + { +@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldis + .close = serport_ldisc_close, + .read = serport_ldisc_read, + .ioctl = serport_ldisc_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = serport_ldisc_compat_ioctl, ++#endif + .receive_buf = serport_ldisc_receive, + .write_wakeup = serport_ldisc_write_wakeup + }; diff --git a/queue-3.10/input-synaptics-add-support-for-forcepads.patch b/queue-3.10/input-synaptics-add-support-for-forcepads.patch new file mode 100644 index 00000000000..6cde8b9d207 --- /dev/null +++ b/queue-3.10/input-synaptics-add-support-for-forcepads.patch @@ -0,0 +1,148 @@ +From 5715fc764f7753d464dbe094b5ef9cffa6e479a4 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sat, 30 Aug 2014 13:51:06 -0700 +Subject: Input: synaptics - add support for ForcePads + +From: Dmitry Torokhov + +commit 5715fc764f7753d464dbe094b5ef9cffa6e479a4 upstream. + +ForcePads are found on HP EliteBook 1040 laptops. They lack any kind of +physical buttons, instead they generate primary button click when user +presses somewhat hard on the surface of the touchpad. Unfortunately they +also report primary button click whenever there are 2 or more contacts +on the pad, messing up all multi-finger gestures (2-finger scrolling, +multi-finger tapping, etc). To cope with this behavior we introduce a +delay (currently 50 msecs) in reporting primary press in case more +contacts appear. + +Reviewed-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 68 ++++++++++++++++++++++++++++++---------- + drivers/input/mouse/synaptics.h | 11 ++++++ + 2 files changed, 63 insertions(+), 16 deletions(-) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -549,10 +549,61 @@ static int synaptics_parse_hw_state(cons + ((buf[0] & 0x04) >> 1) | + ((buf[3] & 0x04) >> 2)); + ++ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) || ++ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) && ++ hw->w == 2) { ++ synaptics_parse_agm(buf, priv, hw); ++ return 1; ++ } ++ ++ hw->x = (((buf[3] & 0x10) << 8) | ++ ((buf[1] & 0x0f) << 8) | ++ buf[4]); ++ hw->y = (((buf[3] & 0x20) << 7) | ++ ((buf[1] & 0xf0) << 4) | ++ buf[5]); ++ hw->z = buf[2]; ++ + hw->left = (buf[0] & 0x01) ? 1 : 0; + hw->right = (buf[0] & 0x02) ? 1 : 0; + +- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { ++ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) { ++ /* ++ * ForcePads, like Clickpads, use middle button ++ * bits to report primary button clicks. ++ * Unfortunately they report primary button not ++ * only when user presses on the pad above certain ++ * threshold, but also when there are more than one ++ * finger on the touchpad, which interferes with ++ * out multi-finger gestures. ++ */ ++ if (hw->z == 0) { ++ /* No contacts */ ++ priv->press = priv->report_press = false; ++ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) { ++ /* ++ * Single-finger touch with pressure above ++ * the threshold. If pressure stays long ++ * enough, we'll start reporting primary ++ * button. We rely on the device continuing ++ * sending data even if finger does not ++ * move. ++ */ ++ if (!priv->press) { ++ priv->press_start = jiffies; ++ priv->press = true; ++ } else if (time_after(jiffies, ++ priv->press_start + ++ msecs_to_jiffies(50))) { ++ priv->report_press = true; ++ } ++ } else { ++ priv->press = false; ++ } ++ ++ hw->left = priv->report_press; ++ ++ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { + /* + * Clickpad's button is transmitted as middle button, + * however, since it is primary button, we will report +@@ -571,21 +622,6 @@ static int synaptics_parse_hw_state(cons + hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0; + } + +- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) || +- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) && +- hw->w == 2) { +- synaptics_parse_agm(buf, priv, hw); +- return 1; +- } +- +- hw->x = (((buf[3] & 0x10) << 8) | +- ((buf[1] & 0x0f) << 8) | +- buf[4]); +- hw->y = (((buf[3] & 0x20) << 7) | +- ((buf[1] & 0xf0) << 4) | +- buf[5]); +- hw->z = buf[2]; +- + if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) && + ((buf[0] ^ buf[3]) & 0x02)) { + switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) { +--- a/drivers/input/mouse/synaptics.h ++++ b/drivers/input/mouse/synaptics.h +@@ -78,6 +78,11 @@ + * 2 0x08 image sensor image sensor tracks 5 fingers, but only + * reports 2. + * 2 0x20 report min query 0x0f gives min coord reported ++ * 2 0x80 forcepad forcepad is a variant of clickpad that ++ * does not have physical buttons but rather ++ * uses pressure above certain threshold to ++ * report primary clicks. Forcepads also have ++ * clickpad bit set. + */ + #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */ + #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */ +@@ -86,6 +91,7 @@ + #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000) + #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400) + #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800) ++#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000) + + /* synaptics modes query bits */ + #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7)) +@@ -177,6 +183,11 @@ struct synaptics_data { + */ + struct synaptics_hw_state agm; + bool agm_pending; /* new AGM packet received */ ++ ++ /* ForcePad handling */ ++ unsigned long press_start; ++ bool press; ++ bool report_press; + }; + + void synaptics_module_init(void); diff --git a/queue-3.10/lockd-fix-rpcbind-crash-on-lockd-startup-failure.patch b/queue-3.10/lockd-fix-rpcbind-crash-on-lockd-startup-failure.patch new file mode 100644 index 00000000000..46a4af5f2cf --- /dev/null +++ b/queue-3.10/lockd-fix-rpcbind-crash-on-lockd-startup-failure.patch @@ -0,0 +1,90 @@ +From 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Fri, 29 Aug 2014 16:25:50 -0400 +Subject: lockd: fix rpcbind crash on lockd startup failure + +From: "J. Bruce Fields" + +commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream. + +Nikita Yuschenko reported that booting a kernel with init=/bin/sh and +then nfs mounting without portmap or rpcbind running using a busybox +mount resulted in: + + # mount -t nfs 10.30.130.21:/opt /mnt + svc: failed to register lockdv1 RPC service (errno 111). + lockd_up: makesock failed, error=-111 + Unable to handle kernel paging request for data at address 0x00000030 + Faulting instruction address: 0xc055e65c + Oops: Kernel access of bad area, sig: 11 [#1] + MPC85xx CDS + Modules linked in: + CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117 + task: cf29cea0 ti: cf35c000 task.ti: cf35c000 + NIP: c055e65c LR: c0566490 CTR: c055e648 + REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge) + MSR: 00029000 CR: 22442488 XER: 20000000 + DEAR: 00000030, ESR: 00000000 + + GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086 + 00000000 + GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000 + 10090ae8 + GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000 + bfa46ef0 + GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000 + cf0ded80 + NIP [c055e65c] call_start+0x14/0x34 + LR [c0566490] __rpc_execute+0x70/0x250 + Call Trace: + [cf35db80] [00000080] 0x80 (unreliable) + [cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4 + [cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8 + [cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84 + [cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c + [cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108 + [cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30 + [cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0 + [cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8 + [cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec + [cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4 + [cf35dd90] [c0171590] nfs3_create_server+0x10/0x44 + [cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4 + [cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8 + [cf35de70] [c00cd3bc] mount_fs+0x20/0xbc + [cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104 + [cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0 + [cf35df10] [c00e75ac] SyS_mount+0x90/0xd0 + [cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c + +The addition of svc_shutdown_net() resulted in two calls to +svc_rpcb_cleanup(); the second is no longer necessary and crashes when +it calls rpcb_register_call with clnt=NULL. + +Reported-by: Nikita Yushchenko +Fixes: 679b033df484 "lockd: ensure we tear down any live sockets when socket creation fails during lockd_up" +Acked-by: Jeff Layton +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/lockd/svc.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv + + error = make_socks(serv, net); + if (error < 0) +- goto err_socks; ++ goto err_bind; + set_grace_period(net); + dprintk("lockd_up_net: per-net data created; net=%p\n", net); + return 0; + +-err_socks: +- svc_rpcb_cleanup(serv, net); + err_bind: + ln->nlmsvc_users--; + return error; diff --git a/queue-3.10/percpu-fix-pcpu_alloc_pages-failure-path.patch b/queue-3.10/percpu-fix-pcpu_alloc_pages-failure-path.patch new file mode 100644 index 00000000000..cc251652e3b --- /dev/null +++ b/queue-3.10/percpu-fix-pcpu_alloc_pages-failure-path.patch @@ -0,0 +1,68 @@ +From f0d279654dea22b7a6ad34b9334aee80cda62cde Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 15 Aug 2014 16:06:06 -0400 +Subject: percpu: fix pcpu_alloc_pages() failure path + +From: Tejun Heo + +commit f0d279654dea22b7a6ad34b9334aee80cda62cde upstream. + +When pcpu_alloc_pages() fails midway, pcpu_free_pages() is invoked to +free what has already been allocated. The invocation is across the +whole requested range and pcpu_free_pages() will try to free all +non-NULL pages; unfortunately, this is incorrect as +pcpu_get_pages_and_bitmap(), unlike what its comment suggests, doesn't +clear the pages array and thus the array may have entries from the +previous invocations making the partial failure path free incorrect +pages. + +Fix it by open-coding the partial freeing of the already allocated +pages. + +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + mm/percpu-vm.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/mm/percpu-vm.c ++++ b/mm/percpu-vm.c +@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_ + int page_start, int page_end) + { + const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; +- unsigned int cpu; ++ unsigned int cpu, tcpu; + int i; + + for_each_possible_cpu(cpu) { +@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_ + struct page **pagep = &pages[pcpu_page_idx(cpu, i)]; + + *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0); +- if (!*pagep) { +- pcpu_free_pages(chunk, pages, populated, +- page_start, page_end); +- return -ENOMEM; +- } ++ if (!*pagep) ++ goto err; + } + } + return 0; ++ ++err: ++ while (--i >= page_start) ++ __free_page(pages[pcpu_page_idx(cpu, i)]); ++ ++ for_each_possible_cpu(tcpu) { ++ if (tcpu == cpu) ++ break; ++ for (i = page_start; i < page_end; i++) ++ __free_page(pages[pcpu_page_idx(tcpu, i)]); ++ } ++ return -ENOMEM; + } + + /** diff --git a/queue-3.10/percpu-free-percpu-allocation-info-for-uniprocessor-system.patch b/queue-3.10/percpu-free-percpu-allocation-info-for-uniprocessor-system.patch new file mode 100644 index 00000000000..1befb904510 --- /dev/null +++ b/queue-3.10/percpu-free-percpu-allocation-info-for-uniprocessor-system.patch @@ -0,0 +1,32 @@ +From 3189eddbcafcc4d827f7f19facbeddec4424eba8 Mon Sep 17 00:00:00 2001 +From: Honggang Li +Date: Tue, 12 Aug 2014 21:36:15 +0800 +Subject: percpu: free percpu allocation info for uniprocessor system + +From: Honggang Li + +commit 3189eddbcafcc4d827f7f19facbeddec4424eba8 upstream. + +Currently, only SMP system free the percpu allocation info. +Uniprocessor system should free it too. For example, one x86 UML +virtual machine with 256MB memory, UML kernel wastes one page memory. + +Signed-off-by: Honggang Li +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + mm/percpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -1910,6 +1910,8 @@ void __init setup_per_cpu_areas(void) + + if (pcpu_setup_first_chunk(ai, fc) < 0) + panic("Failed to initialize percpu areas."); ++ ++ pcpu_free_alloc_info(ai); + } + + #endif /* CONFIG_SMP */ diff --git a/queue-3.10/percpu-perform-tlb-flush-after-pcpu_map_pages-failure.patch b/queue-3.10/percpu-perform-tlb-flush-after-pcpu_map_pages-failure.patch new file mode 100644 index 00000000000..d9139a0d6d1 --- /dev/null +++ b/queue-3.10/percpu-perform-tlb-flush-after-pcpu_map_pages-failure.patch @@ -0,0 +1,34 @@ +From 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 15 Aug 2014 16:06:10 -0400 +Subject: percpu: perform tlb flush after pcpu_map_pages() failure + +From: Tejun Heo + +commit 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd upstream. + +If pcpu_map_pages() fails midway, it unmaps the already mapped pages. +Currently, it doesn't flush tlb after the partial unmapping. This may +be okay in most cases as the established mapping hasn't been used at +that point but it can go wrong and when it goes wrong it'd be +extremely difficult to track down. + +Flush tlb after the partial unmapping. + +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + mm/percpu-vm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/percpu-vm.c ++++ b/mm/percpu-vm.c +@@ -272,6 +272,7 @@ err: + __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start), + page_end - page_start); + } ++ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end); + return err; + } + diff --git a/queue-3.10/rtlwifi-rtl8192cu-add-new-id.patch b/queue-3.10/rtlwifi-rtl8192cu-add-new-id.patch new file mode 100644 index 00000000000..17aa6f802b0 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-add-new-id.patch @@ -0,0 +1,31 @@ +From c66517165610b911e4c6d268f28d8c640832dbd1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 24 Aug 2014 17:49:43 -0500 +Subject: rtlwifi: rtl8192cu: Add new ID + +From: Larry Finger + +commit c66517165610b911e4c6d268f28d8c640832dbd1 upstream. + +The Sitecom WLA-2102 adapter uses this driver. + +Reported-by: Nico Baggus +Signed-off-by: Larry Finger +Cc: Nico Baggus +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb + {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ + {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ + {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ ++ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */ + {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/ + {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/ + {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/ diff --git a/queue-3.10/series b/queue-3.10/series index 8aec9103acb..c0d7fc16181 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -91,3 +91,17 @@ nfc-microread-potential-overflows-in-microread_target_discovered.patch scsi-libiscsi-fix-potential-buffer-overrun-in-__iscsi_conn_send_pdu.patch revert-iwlwifi-dvm-don-t-enable-cts-to-self.patch workqueue-apply-__wq_ordered-to-create_singlethread_workqueue.patch +block-fix-dev_t-minor-allocation-lifetime.patch +dm-crypt-fix-access-beyond-the-end-of-allocated-space.patch +input-serport-add-compat-handling-for-spiocstype-ioctl.patch +input-synaptics-add-support-for-forcepads.patch +input-elantech-fix-detection-of-touchpad-on-asus-s301l.patch +input-atkbd-do-not-try-deactivate-keyboard-on-any-lg-laptops.patch +input-i8042-add-fujitsu-u574-to-no_timeout-dmi-table.patch +input-i8042-add-nomux-quirk-for-avatar-aviu-145a6.patch +ata_piix-add-device-ids-for-intel-9-series-pch.patch +percpu-free-percpu-allocation-info-for-uniprocessor-system.patch +percpu-fix-pcpu_alloc_pages-failure-path.patch +percpu-perform-tlb-flush-after-pcpu_map_pages-failure.patch +rtlwifi-rtl8192cu-add-new-id.patch +lockd-fix-rpcbind-crash-on-lockd-startup-failure.patch