From: Greg Kroah-Hartman Date: Tue, 26 Mar 2013 18:25:11 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.71~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=95396c4066287f66c15cb63c1d363a134c127b97;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: clockevents-don-t-allow-dummy-broadcast-timers.patch ipoib-fix-send-lockup-due-to-missed-tx-completion.patch usb-serial-fix-interface-refcounting.patch usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch usb-xhci-fix-bit-definitions-for-iman-register.patch x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch --- diff --git a/queue-3.0/clockevents-don-t-allow-dummy-broadcast-timers.patch b/queue-3.0/clockevents-don-t-allow-dummy-broadcast-timers.patch new file mode 100644 index 00000000000..7a6e990bd4e --- /dev/null +++ b/queue-3.0/clockevents-don-t-allow-dummy-broadcast-timers.patch @@ -0,0 +1,41 @@ +From a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Thu, 7 Mar 2013 15:09:24 +0000 +Subject: clockevents: Don't allow dummy broadcast timers + +From: Mark Rutland + +commit a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a upstream. + +Currently tick_check_broadcast_device doesn't reject clock_event_devices +with CLOCK_EVT_FEAT_DUMMY, and may select them in preference to real +hardware if they have a higher rating value. In this situation, the +dummy timer is responsible for broadcasting to itself, and the core +clockevents code may attempt to call non-existent callbacks for +programming the dummy, eventually leading to a panic. + +This patch makes tick_check_broadcast_device always reject dummy timers, +preventing this problem. + +Signed-off-by: Mark Rutland +Cc: linux-arm-kernel@lists.infradead.org +Cc: Jon Medhurst (Tixy) +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/tick-broadcast.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodi + */ + int tick_check_broadcast_device(struct clock_event_device *dev) + { +- if ((tick_broadcast_device.evtdev && ++ if ((dev->features & CLOCK_EVT_FEAT_DUMMY) || ++ (tick_broadcast_device.evtdev && + tick_broadcast_device.evtdev->rating >= dev->rating) || + (dev->features & CLOCK_EVT_FEAT_C3STOP)) + return 0; diff --git a/queue-3.0/ipoib-fix-send-lockup-due-to-missed-tx-completion.patch b/queue-3.0/ipoib-fix-send-lockup-due-to-missed-tx-completion.patch new file mode 100644 index 00000000000..6189f186518 --- /dev/null +++ b/queue-3.0/ipoib-fix-send-lockup-due-to-missed-tx-completion.patch @@ -0,0 +1,51 @@ +From 1ee9e2aa7b31427303466776f455d43e5e3c9275 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Tue, 26 Feb 2013 15:46:27 +0000 +Subject: IPoIB: Fix send lockup due to missed TX completion + +From: Mike Marciniszyn + +commit 1ee9e2aa7b31427303466776f455d43e5e3c9275 upstream. + +Commit f0dc117abdfa ("IPoIB: Fix TX queue lockup with mixed UD/CM +traffic") attempts to solve an issue where unprocessed UD send +completions can deadlock the netdev. + +The patch doesn't fully resolve the issue because if more than half +the tx_outstanding's were UD and all of the destinations are RC +reachable, arming the CQ doesn't solve the issue. + +This patch uses the IB_CQ_REPORT_MISSED_EVENTS on the +ib_req_notify_cq(). If the rc is above 0, the UD send cq completion +callback is called directly to re-arm the send completion timer. + +This issue is seen in very large parallel filesystem deployments +and the patch has been shown to correct the issue. + +Reviewed-by: Dean Luick +Signed-off-by: Mike Marciniszyn +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -753,9 +753,13 @@ void ipoib_cm_send(struct net_device *de + if (++priv->tx_outstanding == ipoib_sendq_size) { + ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n", + tx->qp->qp_num); +- if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP)) +- ipoib_warn(priv, "request notify on send CQ failed\n"); + netif_stop_queue(dev); ++ rc = ib_req_notify_cq(priv->send_cq, ++ IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS); ++ if (rc < 0) ++ ipoib_warn(priv, "request notify on send CQ failed\n"); ++ else if (rc) ++ ipoib_send_comp_handler(priv->send_cq, dev); + } + } + } diff --git a/queue-3.0/series b/queue-3.0/series index 3ea5cf3822c..52e9bd2d93e 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -30,3 +30,9 @@ kms-fix-edid-detailed-timing-vsync-parsing.patch mm-hugetlb-fix-total-hugetlbfs-pages-count-when-using-memory-overcommit-accouting.patch cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch +usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch +ipoib-fix-send-lockup-due-to-missed-tx-completion.patch +clockevents-don-t-allow-dummy-broadcast-timers.patch +x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch +usb-xhci-fix-bit-definitions-for-iman-register.patch +usb-serial-fix-interface-refcounting.patch diff --git a/queue-3.0/usb-serial-fix-interface-refcounting.patch b/queue-3.0/usb-serial-fix-interface-refcounting.patch new file mode 100644 index 00000000000..4bab19f98bd --- /dev/null +++ b/queue-3.0/usb-serial-fix-interface-refcounting.patch @@ -0,0 +1,41 @@ +From d7971051e4df825e0bc11b995e87bfe86355b8e5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 19 Mar 2013 09:21:09 +0100 +Subject: USB: serial: fix interface refcounting + +From: Johan Hovold + +commit d7971051e4df825e0bc11b995e87bfe86355b8e5 upstream. + +Make sure the interface is not released before our serial device. + +Note that drivers are still not allowed to access the interface in +any way that may interfere with another driver that may have gotten +bound to the same interface after disconnect returns. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -168,6 +168,7 @@ static void destroy_serial(struct kref * + } + } + ++ usb_put_intf(serial->interface); + usb_put_dev(serial->dev); + kfree(serial); + } +@@ -624,7 +625,7 @@ static struct usb_serial *create_serial( + } + serial->dev = usb_get_dev(dev); + serial->type = driver; +- serial->interface = interface; ++ serial->interface = usb_get_intf(interface); + kref_init(&serial->kref); + mutex_init(&serial->disc_mutex); + serial->minor = SERIAL_TTY_NO_MINOR; diff --git a/queue-3.0/usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch b/queue-3.0/usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch new file mode 100644 index 00000000000..6df05ee197a --- /dev/null +++ b/queue-3.0/usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch @@ -0,0 +1,37 @@ +From 29f86e66428ee083aec106cca1748dc63d98ce23 Mon Sep 17 00:00:00 2001 +From: Dmitry Artamonow +Date: Sat, 9 Mar 2013 20:30:58 +0400 +Subject: usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player + +From: Dmitry Artamonow + +commit 29f86e66428ee083aec106cca1748dc63d98ce23 upstream. + +Device stucks on filesystem writes, unless following quirk is passed: + echo 04e8:5136:m > /sys/module/usb_storage/parameters/quirks + +Add corresponding entry to unusual_devs.h + +Signed-off-by: Dmitry Artamonow +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -488,6 +488,13 @@ UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG), + ++/* Added by Dmitry Artamonow */ ++UNUSUAL_DEV( 0x04e8, 0x5136, 0x0000, 0x9999, ++ "Samsung", ++ "YP-Z3", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_MAX_SECTORS_64), ++ + /* Entry and supporting patch by Theodore Kilgore . + * Device uses standards-violating 32-byte Bulk Command Block Wrappers and + * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011. diff --git a/queue-3.0/usb-xhci-fix-bit-definitions-for-iman-register.patch b/queue-3.0/usb-xhci-fix-bit-definitions-for-iman-register.patch new file mode 100644 index 00000000000..1257725e830 --- /dev/null +++ b/queue-3.0/usb-xhci-fix-bit-definitions-for-iman-register.patch @@ -0,0 +1,42 @@ +From f8264340e694604863255cc0276491d17c402390 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 25 Feb 2013 10:56:01 -0800 +Subject: USB: xhci - fix bit definitions for IMAN register + +From: Dmitry Torokhov + +commit f8264340e694604863255cc0276491d17c402390 upstream. + +According to XHCI specification (5.5.2.1) the IP is bit 0 and IE is bit 1 +of IMAN register. Previously their definitions were reversed. + +Even though there are no ill effects being observed from the swapped +definitions (because IMAN_IP is RW1C and in legacy PCI case we come in +with it already set to 1 so it was clearing itself even though we were +setting IMAN_IE instead of IMAN_IP), we should still correct the values. + +This patch should be backported to kernels as old as 2.6.36, that +contain the commit 4e833c0b87a30798e67f06120cecebef6ee9644c "xhci: don't +re-enable IE constantly". + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -206,8 +206,8 @@ struct xhci_op_regs { + /* bits 12:31 are reserved (and should be preserved on writes). */ + + /* IMAN - Interrupt Management Register */ +-#define IMAN_IP (1 << 1) +-#define IMAN_IE (1 << 0) ++#define IMAN_IE (1 << 1) ++#define IMAN_IP (1 << 0) + + /* USBSTS - USB status - status bitmasks */ + /* HC not running - set to 1 when run/stop bit is cleared. */ diff --git a/queue-3.0/x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch b/queue-3.0/x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch new file mode 100644 index 00000000000..47b5c0a7071 --- /dev/null +++ b/queue-3.0/x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch @@ -0,0 +1,40 @@ +From 66db3feb486c01349f767b98ebb10b0c3d2d021b Mon Sep 17 00:00:00 2001 +From: CQ Tang +Date: Mon, 18 Mar 2013 11:02:21 -0400 +Subject: x86-64: Fix the failure case in copy_user_handle_tail() + +From: CQ Tang + +commit 66db3feb486c01349f767b98ebb10b0c3d2d021b upstream. + +The increment of "to" in copy_user_handle_tail() will have incremented +before a failure has been noted. This causes us to skip a byte in the +failure case. + +Only do the increment when assured there is no failure. + +Signed-off-by: CQ Tang +Link: http://lkml.kernel.org/r/20130318150221.8439.993.stgit@phlsvslse11.ph.intel.com +Signed-off-by: Mike Marciniszyn +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/lib/usercopy_64.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/lib/usercopy_64.c ++++ b/arch/x86/lib/usercopy_64.c +@@ -169,10 +169,10 @@ copy_user_handle_tail(char *to, char *fr + char c; + unsigned zero_len; + +- for (; len; --len) { ++ for (; len; --len, to++) { + if (__get_user_nocheck(c, from++, sizeof(char))) + break; +- if (__put_user_nocheck(c, to++, sizeof(char))) ++ if (__put_user_nocheck(c, to, sizeof(char))) + break; + } +