From: Greg Kroah-Hartman Date: Tue, 26 Mar 2013 18:27:48 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.71~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4798944460ec0a13e4f056abda3f9fc4d350bdfd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: clockevents-don-t-allow-dummy-broadcast-timers.patch ext4-fix-data-journal-fast-mount-umount-hang.patch ipoib-fix-send-lockup-due-to-missed-tx-completion.patch usb-cdc-acm-fix-device-unregistration.patch usb-serial-fix-interface-refcounting.patch usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch usb-xhci-correctly-enable-interrupts.patch usb-xhci-fix-bit-definitions-for-iman-register.patch x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch --- diff --git a/queue-3.4/clockevents-don-t-allow-dummy-broadcast-timers.patch b/queue-3.4/clockevents-don-t-allow-dummy-broadcast-timers.patch new file mode 100644 index 00000000000..7a6e990bd4e --- /dev/null +++ b/queue-3.4/clockevents-don-t-allow-dummy-broadcast-timers.patch @@ -0,0 +1,41 @@ +From a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Thu, 7 Mar 2013 15:09:24 +0000 +Subject: clockevents: Don't allow dummy broadcast timers + +From: Mark Rutland + +commit a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a upstream. + +Currently tick_check_broadcast_device doesn't reject clock_event_devices +with CLOCK_EVT_FEAT_DUMMY, and may select them in preference to real +hardware if they have a higher rating value. In this situation, the +dummy timer is responsible for broadcasting to itself, and the core +clockevents code may attempt to call non-existent callbacks for +programming the dummy, eventually leading to a panic. + +This patch makes tick_check_broadcast_device always reject dummy timers, +preventing this problem. + +Signed-off-by: Mark Rutland +Cc: linux-arm-kernel@lists.infradead.org +Cc: Jon Medhurst (Tixy) +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/tick-broadcast.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodi + */ + int tick_check_broadcast_device(struct clock_event_device *dev) + { +- if ((tick_broadcast_device.evtdev && ++ if ((dev->features & CLOCK_EVT_FEAT_DUMMY) || ++ (tick_broadcast_device.evtdev && + tick_broadcast_device.evtdev->rating >= dev->rating) || + (dev->features & CLOCK_EVT_FEAT_C3STOP)) + return 0; diff --git a/queue-3.4/ext4-fix-data-journal-fast-mount-umount-hang.patch b/queue-3.4/ext4-fix-data-journal-fast-mount-umount-hang.patch new file mode 100644 index 00000000000..9429a9e2db7 --- /dev/null +++ b/queue-3.4/ext4-fix-data-journal-fast-mount-umount-hang.patch @@ -0,0 +1,75 @@ +From 2b405bfa84063bfa35621d2d6879f52693c614b0 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Wed, 20 Mar 2013 09:42:11 -0400 +Subject: ext4: fix data=journal fast mount/umount hang + +From: Theodore Ts'o + +commit 2b405bfa84063bfa35621d2d6879f52693c614b0 upstream. + +In data=journal mode, if we unmount the file system before a +transaction has a chance to complete, when the journal inode is being +evicted, we can end up calling into jbd2_log_wait_commit() for the +last transaction, after the journalling machinery has been shut down. + +Arguably we should adjust ext4_should_journal_data() to return FALSE +for the journal inode, but the only place it matters is +ext4_evict_inode(), and so to save a bit of CPU time, and to make the +patch much more obviously correct by inspection(tm), we'll fix it by +explicitly not trying to waiting for a journal commit when we are +evicting the journal inode, since it's guaranteed to never succeed in +this case. + +This can be easily replicated via: + + mount -t ext4 -o data=journal /dev/vdb /vdb ; umount /vdb + +------------[ cut here ]------------ +WARNING: at /usr/projects/linux/ext4/fs/jbd2/journal.c:542 __jbd2_log_start_commit+0xba/0xcd() +Hardware name: Bochs +JBD2: bad log_start_commit: 3005630206 3005630206 0 0 +Modules linked in: +Pid: 2909, comm: umount Not tainted 3.8.0-rc3 #1020 +Call Trace: + [] warn_slowpath_common+0x68/0x7d + [] ? __jbd2_log_start_commit+0xba/0xcd + [] warn_slowpath_fmt+0x2b/0x2f + [] __jbd2_log_start_commit+0xba/0xcd + [] jbd2_log_start_commit+0x24/0x34 + [] ext4_evict_inode+0x71/0x2e3 + [] evict+0x94/0x135 + [] iput+0x10a/0x110 + [] jbd2_journal_destroy+0x190/0x1ce + [] ? bit_waitqueue+0x50/0x50 + [] ext4_put_super+0x52/0x294 + [] generic_shutdown_super+0x48/0xb4 + [] kill_block_super+0x22/0x60 + [] deactivate_locked_super+0x22/0x49 + [] deactivate_super+0x30/0x33 + [] mntput_no_expire+0x107/0x10c + [] sys_umount+0x2cf/0x2e0 + [] sys_oldumount+0x12/0x14 + [] syscall_call+0x7/0xb +---[ end trace 6a954cc790501c1f ]--- +jbd2_log_wait_commit: error: j_commit_request=-1289337090, tid=0 + +Signed-off-by: "Theodore Ts'o" +Reviewed-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -144,7 +144,8 @@ void ext4_evict_inode(struct inode *inod + * don't use page cache. + */ + if (ext4_should_journal_data(inode) && +- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) { ++ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) && ++ inode->i_ino != EXT4_JOURNAL_INO) { + journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; + tid_t commit_tid = EXT4_I(inode)->i_datasync_tid; + diff --git a/queue-3.4/ipoib-fix-send-lockup-due-to-missed-tx-completion.patch b/queue-3.4/ipoib-fix-send-lockup-due-to-missed-tx-completion.patch new file mode 100644 index 00000000000..1691e810bfc --- /dev/null +++ b/queue-3.4/ipoib-fix-send-lockup-due-to-missed-tx-completion.patch @@ -0,0 +1,51 @@ +From 1ee9e2aa7b31427303466776f455d43e5e3c9275 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Tue, 26 Feb 2013 15:46:27 +0000 +Subject: IPoIB: Fix send lockup due to missed TX completion + +From: Mike Marciniszyn + +commit 1ee9e2aa7b31427303466776f455d43e5e3c9275 upstream. + +Commit f0dc117abdfa ("IPoIB: Fix TX queue lockup with mixed UD/CM +traffic") attempts to solve an issue where unprocessed UD send +completions can deadlock the netdev. + +The patch doesn't fully resolve the issue because if more than half +the tx_outstanding's were UD and all of the destinations are RC +reachable, arming the CQ doesn't solve the issue. + +This patch uses the IB_CQ_REPORT_MISSED_EVENTS on the +ib_req_notify_cq(). If the rc is above 0, the UD send cq completion +callback is called directly to re-arm the send completion timer. + +This issue is seen in very large parallel filesystem deployments +and the patch has been shown to correct the issue. + +Reviewed-by: Dean Luick +Signed-off-by: Mike Marciniszyn +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -755,9 +755,13 @@ void ipoib_cm_send(struct net_device *de + if (++priv->tx_outstanding == ipoib_sendq_size) { + ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n", + tx->qp->qp_num); +- if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP)) +- ipoib_warn(priv, "request notify on send CQ failed\n"); + netif_stop_queue(dev); ++ rc = ib_req_notify_cq(priv->send_cq, ++ IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS); ++ if (rc < 0) ++ ipoib_warn(priv, "request notify on send CQ failed\n"); ++ else if (rc) ++ ipoib_send_comp_handler(priv->send_cq, dev); + } + } + } diff --git a/queue-3.4/series b/queue-3.4/series index b71a0686ac9..61cc2a5af1c 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -49,3 +49,12 @@ drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch +usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch +ext4-fix-data-journal-fast-mount-umount-hang.patch +ipoib-fix-send-lockup-due-to-missed-tx-completion.patch +clockevents-don-t-allow-dummy-broadcast-timers.patch +x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch +usb-xhci-fix-bit-definitions-for-iman-register.patch +usb-xhci-correctly-enable-interrupts.patch +usb-cdc-acm-fix-device-unregistration.patch +usb-serial-fix-interface-refcounting.patch diff --git a/queue-3.4/usb-cdc-acm-fix-device-unregistration.patch b/queue-3.4/usb-cdc-acm-fix-device-unregistration.patch new file mode 100644 index 00000000000..87a488ae3f6 --- /dev/null +++ b/queue-3.4/usb-cdc-acm-fix-device-unregistration.patch @@ -0,0 +1,52 @@ +From cb25505fc604292c70fc02143fc102f54c8595f0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 19 Mar 2013 09:21:06 +0100 +Subject: USB: cdc-acm: fix device unregistration + +From: Johan Hovold + +commit cb25505fc604292c70fc02143fc102f54c8595f0 upstream. + +Unregister tty device in disconnect as is required by the USB stack. + +By deferring unregistration to when the last tty reference is dropped, +the parent interface device can get unregistered before the child +resulting in broken hotplug events being generated when the tty is +finally closed: + +KERNEL[2290.798128] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:3.1 (usb) +KERNEL[2290.804589] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1 (usb) +KERNEL[2294.554799] remove /2-1:3.1/tty/ttyACM0 (tty) + +The driver must deal with tty callbacks after disconnect by checking the +disconnected flag. Specifically, further opens must be prevented and +this is already implemented. + +Acked-by: Oliver Neukum +Cc: Oliver Neukum +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -601,7 +601,6 @@ static void acm_port_destruct(struct tty + + dev_dbg(&acm->control->dev, "%s\n", __func__); + +- tty_unregister_device(acm_tty_driver, acm->minor); + acm_release_minor(acm); + usb_put_intf(acm->control); + kfree(acm->country_codes); +@@ -1418,6 +1417,8 @@ static void acm_disconnect(struct usb_in + + stop_data_traffic(acm); + ++ tty_unregister_device(acm_tty_driver, acm->minor); ++ + usb_free_urb(acm->ctrlurb); + for (i = 0; i < ACM_NW; i++) + usb_free_urb(acm->wb[i].urb); diff --git a/queue-3.4/usb-serial-fix-interface-refcounting.patch b/queue-3.4/usb-serial-fix-interface-refcounting.patch new file mode 100644 index 00000000000..0d216cdc971 --- /dev/null +++ b/queue-3.4/usb-serial-fix-interface-refcounting.patch @@ -0,0 +1,41 @@ +From d7971051e4df825e0bc11b995e87bfe86355b8e5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 19 Mar 2013 09:21:09 +0100 +Subject: USB: serial: fix interface refcounting + +From: Johan Hovold + +commit d7971051e4df825e0bc11b995e87bfe86355b8e5 upstream. + +Make sure the interface is not released before our serial device. + +Note that drivers are still not allowed to access the interface in +any way that may interfere with another driver that may have gotten +bound to the same interface after disconnect returns. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -168,6 +168,7 @@ static void destroy_serial(struct kref * + } + } + ++ usb_put_intf(serial->interface); + usb_put_dev(serial->dev); + kfree(serial); + } +@@ -625,7 +626,7 @@ static struct usb_serial *create_serial( + } + serial->dev = usb_get_dev(dev); + serial->type = driver; +- serial->interface = interface; ++ serial->interface = usb_get_intf(interface); + kref_init(&serial->kref); + mutex_init(&serial->disc_mutex); + serial->minor = SERIAL_TTY_NO_MINOR; diff --git a/queue-3.4/usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch b/queue-3.4/usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch new file mode 100644 index 00000000000..6df05ee197a --- /dev/null +++ b/queue-3.4/usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch @@ -0,0 +1,37 @@ +From 29f86e66428ee083aec106cca1748dc63d98ce23 Mon Sep 17 00:00:00 2001 +From: Dmitry Artamonow +Date: Sat, 9 Mar 2013 20:30:58 +0400 +Subject: usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player + +From: Dmitry Artamonow + +commit 29f86e66428ee083aec106cca1748dc63d98ce23 upstream. + +Device stucks on filesystem writes, unless following quirk is passed: + echo 04e8:5136:m > /sys/module/usb_storage/parameters/quirks + +Add corresponding entry to unusual_devs.h + +Signed-off-by: Dmitry Artamonow +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -488,6 +488,13 @@ UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG), + ++/* Added by Dmitry Artamonow */ ++UNUSUAL_DEV( 0x04e8, 0x5136, 0x0000, 0x9999, ++ "Samsung", ++ "YP-Z3", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64), ++ + /* Entry and supporting patch by Theodore Kilgore . + * Device uses standards-violating 32-byte Bulk Command Block Wrappers and + * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011. diff --git a/queue-3.4/usb-xhci-correctly-enable-interrupts.patch b/queue-3.4/usb-xhci-correctly-enable-interrupts.patch new file mode 100644 index 00000000000..2890f603476 --- /dev/null +++ b/queue-3.4/usb-xhci-correctly-enable-interrupts.patch @@ -0,0 +1,99 @@ +From 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Mon, 4 Mar 2013 17:14:43 +0100 +Subject: USB: xhci: correctly enable interrupts + +From: Hannes Reinecke + +commit 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb upstream. + +xhci has its own interrupt enabling routine, which will try to +use MSI-X/MSI if present. So the usb core shouldn't try to enable +legacy interrupts; on some machines the xhci legacy IRQ setting +is invalid. + +v3: Be careful to not break XHCI_BROKEN_MSI workaround (by trenn) + +Cc: Bjorn Helgaas +Cc: Oliver Neukum +Cc: Thomas Renninger +Cc: Yinghai Lu +Cc: Frederik Himpe +Cc: David Haerdeman +Cc: Alan Stern +Acked-by: Sarah Sharp +Reviewed-by: Thomas Renninger +Signed-off-by: Hannes Reinecke +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd-pci.c | 23 ++++++++++++++--------- + drivers/usb/host/xhci.c | 3 ++- + 2 files changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *de + struct hc_driver *driver; + struct usb_hcd *hcd; + int retval; ++ int hcd_irq = 0; + + if (usb_disabled()) + return -ENODEV; +@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *de + return -ENODEV; + dev->current_state = PCI_D0; + +- /* The xHCI driver supports MSI and MSI-X, +- * so don't fail if the BIOS doesn't provide a legacy IRQ. ++ /* ++ * The xHCI driver has its own irq management ++ * make sure irq setup is not touched for xhci in generic hcd code + */ +- if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) { +- dev_err(&dev->dev, +- "Found HC with no IRQ. Check BIOS/PCI %s setup!\n", +- pci_name(dev)); +- retval = -ENODEV; +- goto disable_pci; ++ if ((driver->flags & HCD_MASK) != HCD_USB3) { ++ if (!dev->irq) { ++ dev_err(&dev->dev, ++ "Found HC with no IRQ. Check BIOS/PCI %s setup!\n", ++ pci_name(dev)); ++ retval = -ENODEV; ++ goto disable_pci; ++ } ++ hcd_irq = dev->irq; + } + + hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev)); +@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *de + + pci_set_master(dev); + +- retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED); ++ retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED); + if (retval != 0) + goto unmap_registers; + set_hs_companion(dev, hcd); +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct us + * generate interrupts. Don't even try to enable MSI. + */ + if (xhci->quirks & XHCI_BROKEN_MSI) +- return 0; ++ goto legacy_irq; + + /* unregister the legacy interrupt */ + if (hcd->irq) +@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct us + return -EINVAL; + } + ++ legacy_irq: + /* fall back to legacy interrupt*/ + ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED, + hcd->irq_descr, hcd); diff --git a/queue-3.4/usb-xhci-fix-bit-definitions-for-iman-register.patch b/queue-3.4/usb-xhci-fix-bit-definitions-for-iman-register.patch new file mode 100644 index 00000000000..1257725e830 --- /dev/null +++ b/queue-3.4/usb-xhci-fix-bit-definitions-for-iman-register.patch @@ -0,0 +1,42 @@ +From f8264340e694604863255cc0276491d17c402390 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 25 Feb 2013 10:56:01 -0800 +Subject: USB: xhci - fix bit definitions for IMAN register + +From: Dmitry Torokhov + +commit f8264340e694604863255cc0276491d17c402390 upstream. + +According to XHCI specification (5.5.2.1) the IP is bit 0 and IE is bit 1 +of IMAN register. Previously their definitions were reversed. + +Even though there are no ill effects being observed from the swapped +definitions (because IMAN_IP is RW1C and in legacy PCI case we come in +with it already set to 1 so it was clearing itself even though we were +setting IMAN_IE instead of IMAN_IP), we should still correct the values. + +This patch should be backported to kernels as old as 2.6.36, that +contain the commit 4e833c0b87a30798e67f06120cecebef6ee9644c "xhci: don't +re-enable IE constantly". + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -206,8 +206,8 @@ struct xhci_op_regs { + /* bits 12:31 are reserved (and should be preserved on writes). */ + + /* IMAN - Interrupt Management Register */ +-#define IMAN_IP (1 << 1) +-#define IMAN_IE (1 << 0) ++#define IMAN_IE (1 << 1) ++#define IMAN_IP (1 << 0) + + /* USBSTS - USB status - status bitmasks */ + /* HC not running - set to 1 when run/stop bit is cleared. */ diff --git a/queue-3.4/x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch b/queue-3.4/x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch new file mode 100644 index 00000000000..3b3d1ff9703 --- /dev/null +++ b/queue-3.4/x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch @@ -0,0 +1,40 @@ +From 66db3feb486c01349f767b98ebb10b0c3d2d021b Mon Sep 17 00:00:00 2001 +From: CQ Tang +Date: Mon, 18 Mar 2013 11:02:21 -0400 +Subject: x86-64: Fix the failure case in copy_user_handle_tail() + +From: CQ Tang + +commit 66db3feb486c01349f767b98ebb10b0c3d2d021b upstream. + +The increment of "to" in copy_user_handle_tail() will have incremented +before a failure has been noted. This causes us to skip a byte in the +failure case. + +Only do the increment when assured there is no failure. + +Signed-off-by: CQ Tang +Link: http://lkml.kernel.org/r/20130318150221.8439.993.stgit@phlsvslse11.ph.intel.com +Signed-off-by: Mike Marciniszyn +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/lib/usercopy_64.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/lib/usercopy_64.c ++++ b/arch/x86/lib/usercopy_64.c +@@ -120,10 +120,10 @@ copy_user_handle_tail(char *to, char *fr + char c; + unsigned zero_len; + +- for (; len; --len) { ++ for (; len; --len, to++) { + if (__get_user_nocheck(c, from++, sizeof(char))) + break; +- if (__put_user_nocheck(c, to++, sizeof(char))) ++ if (__put_user_nocheck(c, to, sizeof(char))) + break; + } +