From: Greg Kroah-Hartman Date: Fri, 1 Jun 2012 08:54:45 +0000 (+0800) Subject: 3.4-stable patches X-Git-Tag: v3.0.34~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=53a333c39fe62ebab44a1ec5760f1941e0a2aff2;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: ath9k-fix-a-use-after-free-bug-when-ath_tx_setup_buffer-fails.patch hugetlb-fix-resv_map-leak-in-error-path.patch ixp4xx-fix-compilation-by-adding-gpiolib-support.patch mac80211-fix-addba-declined-after-suspend-with-wowlan.patch mips-bcm63xx-add-missing-include-for-bcm63xx_gpio.h.patch nfs-kmalloc-doesn-t-return-an-err_ptr.patch nfsv4-map-nfs4err_share_denied-into-an-eacces-error-instead-of-eio.patch parisc-fix-boot-failure-on-32-bit-systems-caused-by-branch-stubs-placed-before-.text.patch parisc-fix-tlb-fault-path-on-pa2.0-narrow-systems.patch solos-pci-fix-dma-support.patch x86-amd-xen-avoid-null-pointer-paravirt-references.patch --- diff --git a/queue-3.4/ath9k-fix-a-use-after-free-bug-when-ath_tx_setup_buffer-fails.patch b/queue-3.4/ath9k-fix-a-use-after-free-bug-when-ath_tx_setup_buffer-fails.patch new file mode 100644 index 00000000000..b395fcb7593 --- /dev/null +++ b/queue-3.4/ath9k-fix-a-use-after-free-bug-when-ath_tx_setup_buffer-fails.patch @@ -0,0 +1,89 @@ +From 81357a281dcc454841532c46b30e6f2ba12b73ea Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Thu, 24 May 2012 14:32:20 +0200 +Subject: ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails + +From: Felix Fietkau + +commit 81357a281dcc454841532c46b30e6f2ba12b73ea upstream. + +ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA +failed. In this case it frees the skb passed to it. +If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still +linked into the tid buffer list and must be dequeued before being released. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -64,7 +64,8 @@ static void ath_tx_update_baw(struct ath + static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc, + struct ath_txq *txq, + struct ath_atx_tid *tid, +- struct sk_buff *skb); ++ struct sk_buff *skb, ++ bool dequeue); + + enum { + MCS_HT20, +@@ -811,7 +812,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_ + fi = get_frame_info(skb); + bf = fi->bf; + if (!fi->bf) +- bf = ath_tx_setup_buffer(sc, txq, tid, skb); ++ bf = ath_tx_setup_buffer(sc, txq, tid, skb, true); + + if (!bf) + continue; +@@ -1726,7 +1727,7 @@ static void ath_tx_send_ampdu(struct ath + return; + } + +- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb); ++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false); + if (!bf) + return; + +@@ -1753,7 +1754,7 @@ static void ath_tx_send_normal(struct at + + bf = fi->bf; + if (!bf) +- bf = ath_tx_setup_buffer(sc, txq, tid, skb); ++ bf = ath_tx_setup_buffer(sc, txq, tid, skb, false); + + if (!bf) + return; +@@ -1814,7 +1815,8 @@ u8 ath_txchainmask_reduction(struct ath_ + static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc, + struct ath_txq *txq, + struct ath_atx_tid *tid, +- struct sk_buff *skb) ++ struct sk_buff *skb, ++ bool dequeue) + { + struct ath_common *common = ath9k_hw_common(sc->sc_ah); + struct ath_frame_info *fi = get_frame_info(skb); +@@ -1863,6 +1865,8 @@ static struct ath_buf *ath_tx_setup_buff + return bf; + + error: ++ if (dequeue) ++ __skb_unlink(skb, &tid->buf_q); + dev_kfree_skb_any(skb); + return NULL; + } +@@ -1893,7 +1897,7 @@ static void ath_tx_start_dma(struct ath_ + */ + ath_tx_send_ampdu(sc, tid, skb, txctl); + } else { +- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb); ++ bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb, false); + if (!bf) + return; + diff --git a/queue-3.4/hugetlb-fix-resv_map-leak-in-error-path.patch b/queue-3.4/hugetlb-fix-resv_map-leak-in-error-path.patch new file mode 100644 index 00000000000..0cd48ca037f --- /dev/null +++ b/queue-3.4/hugetlb-fix-resv_map-leak-in-error-path.patch @@ -0,0 +1,108 @@ +From c50ac050811d6485616a193eb0f37bfbd191cc89 Mon Sep 17 00:00:00 2001 +From: Dave Hansen +Date: Tue, 29 May 2012 15:06:46 -0700 +Subject: hugetlb: fix resv_map leak in error path + +From: Dave Hansen + +commit c50ac050811d6485616a193eb0f37bfbd191cc89 upstream. + +When called for anonymous (non-shared) mappings, hugetlb_reserve_pages() +does a resv_map_alloc(). It depends on code in hugetlbfs's +vm_ops->close() to release that allocation. + +However, in the mmap() failure path, we do a plain unmap_region() without +the remove_vma() which actually calls vm_ops->close(). + +This is a decent fix. This leak could get reintroduced if new code (say, +after hugetlb_reserve_pages() in hugetlbfs_file_mmap()) decides to return +an error. But, I think it would have to unroll the reservation anyway. + +Christoph's test case: + + http://marc.info/?l=linux-mm&m=133728900729735 + +This patch applies to 3.4 and later. A version for earlier kernels is at +https://lkml.org/lkml/2012/5/22/418. + +Signed-off-by: Dave Hansen +Acked-by: Mel Gorman +Acked-by: KOSAKI Motohiro +Reported-by: Christoph Lameter +Tested-by: Christoph Lameter +Cc: Andrea Arcangeli +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2157,6 +2157,15 @@ static void hugetlb_vm_op_open(struct vm + kref_get(&reservations->refs); + } + ++static void resv_map_put(struct vm_area_struct *vma) ++{ ++ struct resv_map *reservations = vma_resv_map(vma); ++ ++ if (!reservations) ++ return; ++ kref_put(&reservations->refs, resv_map_release); ++} ++ + static void hugetlb_vm_op_close(struct vm_area_struct *vma) + { + struct hstate *h = hstate_vma(vma); +@@ -2173,7 +2182,7 @@ static void hugetlb_vm_op_close(struct v + reserve = (end - start) - + region_count(&reservations->regions, start, end); + +- kref_put(&reservations->refs, resv_map_release); ++ resv_map_put(vma); + + if (reserve) { + hugetlb_acct_memory(h, -reserve); +@@ -2990,12 +2999,16 @@ int hugetlb_reserve_pages(struct inode * + set_vma_resv_flags(vma, HPAGE_RESV_OWNER); + } + +- if (chg < 0) +- return chg; ++ if (chg < 0) { ++ ret = chg; ++ goto out_err; ++ } + + /* There must be enough pages in the subpool for the mapping */ +- if (hugepage_subpool_get_pages(spool, chg)) +- return -ENOSPC; ++ if (hugepage_subpool_get_pages(spool, chg)) { ++ ret = -ENOSPC; ++ goto out_err; ++ } + + /* + * Check enough hugepages are available for the reservation. +@@ -3004,7 +3017,7 @@ int hugetlb_reserve_pages(struct inode * + ret = hugetlb_acct_memory(h, chg); + if (ret < 0) { + hugepage_subpool_put_pages(spool, chg); +- return ret; ++ goto out_err; + } + + /* +@@ -3021,6 +3034,9 @@ int hugetlb_reserve_pages(struct inode * + if (!vma || vma->vm_flags & VM_MAYSHARE) + region_add(&inode->i_mapping->private_list, from, to); + return 0; ++out_err: ++ resv_map_put(vma); ++ return ret; + } + + void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed) diff --git a/queue-3.4/ixp4xx-fix-compilation-by-adding-gpiolib-support.patch b/queue-3.4/ixp4xx-fix-compilation-by-adding-gpiolib-support.patch new file mode 100644 index 00000000000..fd7e853975a --- /dev/null +++ b/queue-3.4/ixp4xx-fix-compilation-by-adding-gpiolib-support.patch @@ -0,0 +1,204 @@ +From 9dde0ae3769875ec1370cb316e50c54b57d52c1a Mon Sep 17 00:00:00 2001 +From: Richard Cochran +Date: Wed, 23 May 2012 18:19:51 +0200 +Subject: ixp4xx: fix compilation by adding gpiolib support + +From: Richard Cochran + +commit 9dde0ae3769875ec1370cb316e50c54b57d52c1a upstream. + +Once again, ixp4xx no longer even compiles. This patch fixes the issue +by converting over to gpiolib. This patch was first made by Imre and +posted by Marc, and I added in Russell's suggestion to empty the gpio +header file. + +This fix should also go for 3.1, 3.2, 3.3, and 3.4. + +Signed-off-by: Richard Cochran +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/Kconfig | 2 + arch/arm/mach-ixp4xx/common.c | 48 ++++++++++++++++++ + arch/arm/mach-ixp4xx/include/mach/gpio.h | 79 ------------------------------- + 3 files changed, 48 insertions(+), 81 deletions(-) + +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -556,7 +556,7 @@ config ARCH_IXP4XX + select ARCH_HAS_DMA_SET_COHERENT_MASK + select CLKSRC_MMIO + select CPU_XSCALE +- select GENERIC_GPIO ++ select ARCH_REQUIRE_GPIOLIB + select GENERIC_CLOCKEVENTS + select MIGHT_HAVE_PCI + select NEED_MACH_IO_H +--- a/arch/arm/mach-ixp4xx/common.c ++++ b/arch/arm/mach-ixp4xx/common.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -107,7 +108,7 @@ static signed char irq2gpio[32] = { + 7, 8, 9, 10, 11, 12, -1, -1, + }; + +-int gpio_to_irq(int gpio) ++static int ixp4xx_gpio_to_irq(struct gpio_chip *chip, unsigned gpio) + { + int irq; + +@@ -117,7 +118,6 @@ int gpio_to_irq(int gpio) + } + return -EINVAL; + } +-EXPORT_SYMBOL(gpio_to_irq); + + int irq_to_gpio(unsigned int irq) + { +@@ -383,12 +383,56 @@ static struct platform_device *ixp46x_de + unsigned long ixp4xx_exp_bus_size; + EXPORT_SYMBOL(ixp4xx_exp_bus_size); + ++static int ixp4xx_gpio_direction_input(struct gpio_chip *chip, unsigned gpio) ++{ ++ gpio_line_config(gpio, IXP4XX_GPIO_IN); ++ ++ return 0; ++} ++ ++static int ixp4xx_gpio_direction_output(struct gpio_chip *chip, unsigned gpio, ++ int level) ++{ ++ gpio_line_set(gpio, level); ++ gpio_line_config(gpio, IXP4XX_GPIO_OUT); ++ ++ return 0; ++} ++ ++static int ixp4xx_gpio_get_value(struct gpio_chip *chip, unsigned gpio) ++{ ++ int value; ++ ++ gpio_line_get(gpio, &value); ++ ++ return value; ++} ++ ++static void ixp4xx_gpio_set_value(struct gpio_chip *chip, unsigned gpio, ++ int value) ++{ ++ gpio_line_set(gpio, value); ++} ++ ++static struct gpio_chip ixp4xx_gpio_chip = { ++ .label = "IXP4XX_GPIO_CHIP", ++ .direction_input = ixp4xx_gpio_direction_input, ++ .direction_output = ixp4xx_gpio_direction_output, ++ .get = ixp4xx_gpio_get_value, ++ .set = ixp4xx_gpio_set_value, ++ .to_irq = ixp4xx_gpio_to_irq, ++ .base = 0, ++ .ngpio = 16, ++}; ++ + void __init ixp4xx_sys_init(void) + { + ixp4xx_exp_bus_size = SZ_16M; + + platform_add_devices(ixp4xx_devices, ARRAY_SIZE(ixp4xx_devices)); + ++ gpiochip_add(&ixp4xx_gpio_chip); ++ + if (cpu_is_ixp46x()) { + int region; + +--- a/arch/arm/mach-ixp4xx/include/mach/gpio.h ++++ b/arch/arm/mach-ixp4xx/include/mach/gpio.h +@@ -1,79 +1,2 @@ +-/* +- * arch/arm/mach-ixp4xx/include/mach/gpio.h +- * +- * IXP4XX GPIO wrappers for arch-neutral GPIO calls +- * +- * Written by Milan Svoboda +- * Based on PXA implementation by Philipp Zabel +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or +- * (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +- * +- */ +- +-#ifndef __ASM_ARCH_IXP4XX_GPIO_H +-#define __ASM_ARCH_IXP4XX_GPIO_H +- +-#include +-#include +- +-#define __ARM_GPIOLIB_COMPLEX +- +-static inline int gpio_request(unsigned gpio, const char *label) +-{ +- return 0; +-} +- +-static inline void gpio_free(unsigned gpio) +-{ +- might_sleep(); +- +- return; +-} +- +-static inline int gpio_direction_input(unsigned gpio) +-{ +- gpio_line_config(gpio, IXP4XX_GPIO_IN); +- return 0; +-} +- +-static inline int gpio_direction_output(unsigned gpio, int level) +-{ +- gpio_line_set(gpio, level); +- gpio_line_config(gpio, IXP4XX_GPIO_OUT); +- return 0; +-} +- +-static inline int gpio_get_value(unsigned gpio) +-{ +- int value; +- +- gpio_line_get(gpio, &value); +- +- return value; +-} +- +-static inline void gpio_set_value(unsigned gpio, int value) +-{ +- gpio_line_set(gpio, value); +-} +- +-#include /* cansleep wrappers */ +- +-extern int gpio_to_irq(int gpio); +-#define gpio_to_irq gpio_to_irq +-extern int irq_to_gpio(unsigned int irq); +- +-#endif ++/* empty */ + diff --git a/queue-3.4/mac80211-fix-addba-declined-after-suspend-with-wowlan.patch b/queue-3.4/mac80211-fix-addba-declined-after-suspend-with-wowlan.patch new file mode 100644 index 00000000000..8046000a900 --- /dev/null +++ b/queue-3.4/mac80211-fix-addba-declined-after-suspend-with-wowlan.patch @@ -0,0 +1,51 @@ +From 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d Mon Sep 17 00:00:00 2001 +From: Eyal Shapira +Date: Tue, 29 May 2012 02:00:22 -0700 +Subject: mac80211: fix ADDBA declined after suspend with wowlan + +From: Eyal Shapira + +commit 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d upstream. + +WLAN_STA_BLOCK_BA is set while suspending but doesn't get cleared +when resuming in case of wowlan. This causes further ADDBA requests +received to be rejected. Fix it by clearing it in the wowlan path +as well. + +Signed-off-by: Eyal Shapira +Reviewed-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/util.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -1321,6 +1321,12 @@ int ieee80211_reconfig(struct ieee80211_ + } + } + ++ /* add back keys */ ++ list_for_each_entry(sdata, &local->interfaces, list) ++ if (ieee80211_sdata_running(sdata)) ++ ieee80211_enable_keys(sdata); ++ ++ wake_up: + /* + * Clear the WLAN_STA_BLOCK_BA flag so new aggregation + * sessions can be established after a resume. +@@ -1342,12 +1348,6 @@ int ieee80211_reconfig(struct ieee80211_ + mutex_unlock(&local->sta_mtx); + } + +- /* add back keys */ +- list_for_each_entry(sdata, &local->interfaces, list) +- if (ieee80211_sdata_running(sdata)) +- ieee80211_enable_keys(sdata); +- +- wake_up: + ieee80211_wake_queues_by_reason(hw, + IEEE80211_QUEUE_STOP_REASON_SUSPEND); + diff --git a/queue-3.4/mips-bcm63xx-add-missing-include-for-bcm63xx_gpio.h.patch b/queue-3.4/mips-bcm63xx-add-missing-include-for-bcm63xx_gpio.h.patch new file mode 100644 index 00000000000..cbaf13ca50c --- /dev/null +++ b/queue-3.4/mips-bcm63xx-add-missing-include-for-bcm63xx_gpio.h.patch @@ -0,0 +1,50 @@ +From 442209f31dafef9fde852858e1ce566b675b720d Mon Sep 17 00:00:00 2001 +From: Jonas Gorski +Date: Tue, 15 May 2012 17:47:52 +0200 +Subject: MIPS: BCM63XX: Add missing include for bcm63xx_gpio.h + +From: Jonas Gorski + +commit 442209f31dafef9fde852858e1ce566b675b720d upstream. + +bcm63xx_gpio.h uses macros defined in bcm63xx_cpu.h without including it, +leading to the following build failure: + + CC [M] drivers/mmc/core/cd-gpio.o +In file included from arch/mips/include/asm/mach-bcm63xx/gpio.h:4:0, + from arch/mips/include/asm/gpio.h:4, + from include/linux/gpio.h:30, + from drivers/mmc/core/cd-gpio.c:12: + +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h: In function 'bcm63xx_gpio_count': +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:10:2: error: implicit declaration of function 'bcm63xx_get_cpu_id' +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:11:7: error: 'BCM6358_CPU_ID' undeclared (first use in this function) +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:11:7: note: each undeclared identifier is reported only once for each function it appears in +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:13:7: error: 'BCM6338_CPU_ID' undeclared (first use in this function) +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:15:7: error: 'BCM6345_CPU_ID' undeclared (first use in this function) +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:17:7: error: 'BCM6368_CPU_ID' undeclared (first use in this function) +arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:19:7: error: 'BCM6348_CPU_ID' undeclared (first use in this function) + +make[7]: *** [drivers/mmc/core/cd-gpio.o] Error 1 + +Signed-off-by: Jonas Gorski +Cc: linux-mips@linux-mips.org +Cc: Maxime Bizon +Cc: Florian Fainelli +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h ++++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h +@@ -2,6 +2,7 @@ + #define BCM63XX_GPIO_H + + #include ++#include + + int __init bcm63xx_gpio_init(void); + diff --git a/queue-3.4/nfs-kmalloc-doesn-t-return-an-err_ptr.patch b/queue-3.4/nfs-kmalloc-doesn-t-return-an-err_ptr.patch new file mode 100644 index 00000000000..81ea0d070c5 --- /dev/null +++ b/queue-3.4/nfs-kmalloc-doesn-t-return-an-err_ptr.patch @@ -0,0 +1,45 @@ +From 5abc03cd919535c61b813f2319cb38326a41e810 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 14 May 2012 22:45:28 +0300 +Subject: NFS: kmalloc() doesn't return an ERR_PTR() + +From: Dan Carpenter + +commit 5abc03cd919535c61b813f2319cb38326a41e810 upstream. + +Obviously we should check for NULL here instead of IS_ERR(). + +Signed-off-by: Dan Carpenter +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/idmap.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/fs/nfs/idmap.c ++++ b/fs/nfs/idmap.c +@@ -640,20 +640,16 @@ static int nfs_idmap_legacy_upcall(struc + struct idmap_msg *im; + struct idmap *idmap = (struct idmap *)aux; + struct key *key = cons->key; +- int ret; ++ int ret = -ENOMEM; + + /* msg and im are freed in idmap_pipe_destroy_msg */ + msg = kmalloc(sizeof(*msg), GFP_KERNEL); +- if (IS_ERR(msg)) { +- ret = PTR_ERR(msg); ++ if (!msg) + goto out0; +- } + + im = kmalloc(sizeof(*im), GFP_KERNEL); +- if (IS_ERR(im)) { +- ret = PTR_ERR(im); ++ if (!im) + goto out1; +- } + + ret = nfs_idmap_prepare_message(key->description, im, msg); + if (ret < 0) diff --git a/queue-3.4/nfsv4-map-nfs4err_share_denied-into-an-eacces-error-instead-of-eio.patch b/queue-3.4/nfsv4-map-nfs4err_share_denied-into-an-eacces-error-instead-of-eio.patch new file mode 100644 index 00000000000..f70dbde9656 --- /dev/null +++ b/queue-3.4/nfsv4-map-nfs4err_share_denied-into-an-eacces-error-instead-of-eio.patch @@ -0,0 +1,34 @@ +From fb13bfa7e1bcfdcfdece47c24b62f1a1cad957e9 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 28 May 2012 11:36:28 -0400 +Subject: NFSv4: Map NFS4ERR_SHARE_DENIED into an EACCES error instead of EIO + +From: Trond Myklebust + +commit fb13bfa7e1bcfdcfdece47c24b62f1a1cad957e9 upstream. + +If a file OPEN is denied due to a share lock, the resulting +NFS4ERR_SHARE_DENIED is currently mapped to the default EIO. +This patch adds a more appropriate mapping, and brings Linux +into line with what Solaris 10 does. + +See https://bugzilla.kernel.org/show_bug.cgi?id=43286 + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -101,6 +101,8 @@ static int nfs4_map_errors(int err) + case -NFS4ERR_BADOWNER: + case -NFS4ERR_BADNAME: + return -EINVAL; ++ case -NFS4ERR_SHARE_DENIED: ++ return -EACCES; + default: + dprintk("%s could not handle NFSv4 error %d\n", + __func__, -err); diff --git a/queue-3.4/parisc-fix-boot-failure-on-32-bit-systems-caused-by-branch-stubs-placed-before-.text.patch b/queue-3.4/parisc-fix-boot-failure-on-32-bit-systems-caused-by-branch-stubs-placed-before-.text.patch new file mode 100644 index 00000000000..21ae2b2f3d4 --- /dev/null +++ b/queue-3.4/parisc-fix-boot-failure-on-32-bit-systems-caused-by-branch-stubs-placed-before-.text.patch @@ -0,0 +1,46 @@ +From ed5fb2471b7060767957fb964eb1aaec71533ab1 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Thu, 17 May 2012 10:34:34 -0400 +Subject: PARISC: fix boot failure on 32-bit systems caused by branch stubs placed before .text + +From: John David Anglin + +commit ed5fb2471b7060767957fb964eb1aaec71533ab1 upstream. + +In certain configurations, the resulting kernel becomes too large to boot +because the linker places the long branch stubs for the merged .text section +at the very start of the image. As a result, the initial transfer of control +jumps to an unexpected location. Fix this by placing the head text in a +separate section so the stubs for .text are not at the start of the image. + +Signed-off-by: John David Anglin +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/vmlinux.lds.S | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/parisc/kernel/vmlinux.lds.S ++++ b/arch/parisc/kernel/vmlinux.lds.S +@@ -50,8 +50,10 @@ SECTIONS + . = KERNEL_BINARY_TEXT_START; + + _text = .; /* Text and read-only data */ +- .text ALIGN(16) : { ++ .head ALIGN(16) : { + HEAD_TEXT ++ } = 0 ++ .text ALIGN(16) : { + TEXT_TEXT + SCHED_TEXT + LOCK_TEXT +@@ -65,7 +67,7 @@ SECTIONS + *(.fixup) + *(.lock.text) /* out-of-line lock text */ + *(.gnu.warning) +- } = 0 ++ } + /* End of text section */ + _etext = .; + diff --git a/queue-3.4/parisc-fix-tlb-fault-path-on-pa2.0-narrow-systems.patch b/queue-3.4/parisc-fix-tlb-fault-path-on-pa2.0-narrow-systems.patch new file mode 100644 index 00000000000..1796382bbb7 --- /dev/null +++ b/queue-3.4/parisc-fix-tlb-fault-path-on-pa2.0-narrow-systems.patch @@ -0,0 +1,140 @@ +From 2f649c1f6f0fef445ce79a19b79e5ce8fe9d7f19 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Mon, 21 May 2012 07:49:01 +0100 +Subject: PARISC: fix TLB fault path on PA2.0 narrow systems + +From: James Bottomley + +commit 2f649c1f6f0fef445ce79a19b79e5ce8fe9d7f19 upstream. + +commit 5e185581d7c46ddd33cd9c01106d1fc86efb9376 +Author: James Bottomley + + [PARISC] fix PA1.1 oops on boot + +Didn't quite fix the crash on boot. It moved it from PA1.1 processors to +PA2.0 narrow kernels. The final fix is to make sure the [id]tlb_miss_20 paths +also work. Even on narrow systems, these paths require using the wide +instructions becuase the tlb insertion format is wide. Fix this by +conditioning the dep[wd],z on whether we're being called from _11 or _20[w] +paths. + +Tested-by: Helge Deller +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/entry.S | 30 +++++++++++++++++------------- + 1 file changed, 17 insertions(+), 13 deletions(-) + +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -552,7 +552,7 @@ + * entry (identifying the physical page) and %r23 up with + * the from tlb entry (or nothing if only a to entry---for + * clear_user_page_asm) */ +- .macro do_alias spc,tmp,tmp1,va,pte,prot,fault ++ .macro do_alias spc,tmp,tmp1,va,pte,prot,fault,patype + cmpib,COND(<>),n 0,\spc,\fault + ldil L%(TMPALIAS_MAP_START),\tmp + #if defined(CONFIG_64BIT) && (TMPALIAS_MAP_START >= 0x80000000) +@@ -581,11 +581,15 @@ + */ + cmpiclr,= 0x01,\tmp,%r0 + ldi (_PAGE_DIRTY|_PAGE_READ|_PAGE_WRITE),\prot +-#ifdef CONFIG_64BIT ++.ifc \patype,20 + depd,z \prot,8,7,\prot +-#else ++.else ++.ifc \patype,11 + depw,z \prot,8,7,\prot +-#endif ++.else ++ .error "undefined PA type to do_alias" ++.endif ++.endif + /* + * OK, it is in the temp alias region, check whether "from" or "to". + * Check "subtle" note in pacache.S re: r23/r26. +@@ -1189,7 +1193,7 @@ dtlb_miss_20w: + nop + + dtlb_check_alias_20w: +- do_alias spc,t0,t1,va,pte,prot,dtlb_fault ++ do_alias spc,t0,t1,va,pte,prot,dtlb_fault,20 + + idtlbt pte,prot + +@@ -1213,7 +1217,7 @@ nadtlb_miss_20w: + nop + + nadtlb_check_alias_20w: +- do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate ++ do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate,20 + + idtlbt pte,prot + +@@ -1245,7 +1249,7 @@ dtlb_miss_11: + nop + + dtlb_check_alias_11: +- do_alias spc,t0,t1,va,pte,prot,dtlb_fault ++ do_alias spc,t0,t1,va,pte,prot,dtlb_fault,11 + + idtlba pte,(va) + idtlbp prot,(va) +@@ -1277,7 +1281,7 @@ nadtlb_miss_11: + nop + + nadtlb_check_alias_11: +- do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate ++ do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate,11 + + idtlba pte,(va) + idtlbp prot,(va) +@@ -1304,7 +1308,7 @@ dtlb_miss_20: + nop + + dtlb_check_alias_20: +- do_alias spc,t0,t1,va,pte,prot,dtlb_fault ++ do_alias spc,t0,t1,va,pte,prot,dtlb_fault,20 + + idtlbt pte,prot + +@@ -1330,7 +1334,7 @@ nadtlb_miss_20: + nop + + nadtlb_check_alias_20: +- do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate ++ do_alias spc,t0,t1,va,pte,prot,nadtlb_emulate,20 + + idtlbt pte,prot + +@@ -1457,7 +1461,7 @@ naitlb_miss_20w: + nop + + naitlb_check_alias_20w: +- do_alias spc,t0,t1,va,pte,prot,naitlb_fault ++ do_alias spc,t0,t1,va,pte,prot,naitlb_fault,20 + + iitlbt pte,prot + +@@ -1511,7 +1515,7 @@ naitlb_miss_11: + nop + + naitlb_check_alias_11: +- do_alias spc,t0,t1,va,pte,prot,itlb_fault ++ do_alias spc,t0,t1,va,pte,prot,itlb_fault,11 + + iitlba pte,(%sr0, va) + iitlbp prot,(%sr0, va) +@@ -1557,7 +1561,7 @@ naitlb_miss_20: + nop + + naitlb_check_alias_20: +- do_alias spc,t0,t1,va,pte,prot,naitlb_fault ++ do_alias spc,t0,t1,va,pte,prot,naitlb_fault,20 + + iitlbt pte,prot + diff --git a/queue-3.4/series b/queue-3.4/series index e8c64910f51..2f459f94356 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -11,3 +11,14 @@ iwlwifi-update-bt-traffic-load-states-correctly.patch iwlwifi-do-not-use-shadow-registers-by-default.patch cifs-include-backup-intent-search-flags-during-searches-try-2.patch cifs-fix-oops-while-traversing-open-file-list-try-4.patch +parisc-fix-boot-failure-on-32-bit-systems-caused-by-branch-stubs-placed-before-.text.patch +parisc-fix-tlb-fault-path-on-pa2.0-narrow-systems.patch +solos-pci-fix-dma-support.patch +mips-bcm63xx-add-missing-include-for-bcm63xx_gpio.h.patch +mac80211-fix-addba-declined-after-suspend-with-wowlan.patch +ixp4xx-fix-compilation-by-adding-gpiolib-support.patch +ath9k-fix-a-use-after-free-bug-when-ath_tx_setup_buffer-fails.patch +x86-amd-xen-avoid-null-pointer-paravirt-references.patch +nfs-kmalloc-doesn-t-return-an-err_ptr.patch +nfsv4-map-nfs4err_share_denied-into-an-eacces-error-instead-of-eio.patch +hugetlb-fix-resv_map-leak-in-error-path.patch diff --git a/queue-3.4/solos-pci-fix-dma-support.patch b/queue-3.4/solos-pci-fix-dma-support.patch new file mode 100644 index 00000000000..e8cdbb7b212 --- /dev/null +++ b/queue-3.4/solos-pci-fix-dma-support.patch @@ -0,0 +1,49 @@ +From b4bd8ad9bb311e8536f726f7a633620ccd358cde Mon Sep 17 00:00:00 2001 +From: David Woodhouse +Date: Thu, 24 May 2012 04:58:27 +0000 +Subject: solos-pci: Fix DMA support + +From: David Woodhouse + +commit b4bd8ad9bb311e8536f726f7a633620ccd358cde upstream. + +DMA support has finally made its way to the top of the TODO list, having +realised that a Geode using MMIO can't keep up with two ADSL2+ lines +each running at 21Mb/s. + +This patch fixes a couple of bugs in the DMA support in the driver, so +once the corresponding FPGA update is complete and tested everything +should work properly. + +We weren't storing the currently-transmitting skb, so we were never +unmapping it and never freeing/popping it when the TX was done. +And the addition of pci_set_master() is fairly self-explanatory. + +Signed-off-by: David Woodhouse +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/atm/solos-pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/atm/solos-pci.c ++++ b/drivers/atm/solos-pci.c +@@ -984,6 +984,7 @@ static uint32_t fpga_tx(struct solos_car + } else if (skb && card->using_dma) { + SKB_CB(skb)->dma_addr = pci_map_single(card->dev, skb->data, + skb->len, PCI_DMA_TODEVICE); ++ card->tx_skb[port] = skb; + iowrite32(SKB_CB(skb)->dma_addr, + card->config_regs + TX_DMA_ADDR(port)); + } +@@ -1152,7 +1153,8 @@ static int fpga_probe(struct pci_dev *de + db_fpga_upgrade = db_firmware_upgrade = 0; + } + +- if (card->fpga_version >= DMA_SUPPORTED){ ++ if (card->fpga_version >= DMA_SUPPORTED) { ++ pci_set_master(dev); + card->using_dma = 1; + } else { + card->using_dma = 0; diff --git a/queue-3.4/x86-amd-xen-avoid-null-pointer-paravirt-references.patch b/queue-3.4/x86-amd-xen-avoid-null-pointer-paravirt-references.patch new file mode 100644 index 00000000000..705af007ad8 --- /dev/null +++ b/queue-3.4/x86-amd-xen-avoid-null-pointer-paravirt-references.patch @@ -0,0 +1,36 @@ +From 1ab46fd319bcf1fcd9fb6311727d532b580e4eba Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Wed, 30 May 2012 18:23:56 -0400 +Subject: x86, amd, xen: Avoid NULL pointer paravirt references + +From: Konrad Rzeszutek Wilk + +commit 1ab46fd319bcf1fcd9fb6311727d532b580e4eba upstream. + +Stub out MSR methods that aren't actually needed. This fixes a crash +as Xen Dom0 on AMD Trinity systems. A bigger patch should be added to +remove the paravirt machinery completely for the methods which +apparently have no users! + +Reported-by: Andre Przywara +Link: http://lkml.kernel.org/r/20120530222356.GA28417@andromeda.dapyr.net +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1106,7 +1106,10 @@ static const struct pv_cpu_ops xen_cpu_o + .wbinvd = native_wbinvd, + + .read_msr = native_read_msr_safe, ++ .rdmsr_regs = native_rdmsr_safe_regs, + .write_msr = xen_write_msr_safe, ++ .wrmsr_regs = native_wrmsr_safe_regs, ++ + .read_tsc = native_read_tsc, + .read_pmc = native_read_pmc, +