From: Greg Kroah-Hartman Date: Mon, 14 Oct 2013 21:02:30 +0000 (-0700) Subject: 3.11-stable patches X-Git-Tag: v3.10.17~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9ae184f03f1f8f1be144707503f41983e935ff7b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.11-stable patches added patches: alsa-hda-add-fixup-for-asus-n56vz.patch alsa-hda-fix-microphone-for-sony-vaio-pro-13-haswell.patch alsa-hda-hdmi-fix-channel-map-switch-not-taking-effect.patch alsa-snd-usb-usx2y-remove-bogus-frame-checks.patch btrfs-use-right-root-when-checking-for-hash-collision.patch ext4-fix-memory-leak-in-xattr.patch hwmon-applesmc-always-read-until-end-of-data.patch i2c-omap-clear-ardy-bit-twice.patch kvm-ppc-book3s-hv-fix-typo-in-saving-dscr.patch parisc-fix-interruption-handler-to-respect-pagefault_disable.patch random-run-random_int_secret_init-run-after-all-late_initcalls.patch vfs-allow-o_path-file-descriptors-for-fstatfs.patch --- diff --git a/queue-3.11/alsa-hda-add-fixup-for-asus-n56vz.patch b/queue-3.11/alsa-hda-add-fixup-for-asus-n56vz.patch new file mode 100644 index 00000000000..83f638db29e --- /dev/null +++ b/queue-3.11/alsa-hda-add-fixup-for-asus-n56vz.patch @@ -0,0 +1,30 @@ +From c6cc3d58b4042f5cadae653ff8d3df26af1a0169 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 8 Oct 2013 19:57:50 +0200 +Subject: ALSA: hda - Add fixup for ASUS N56VZ + +From: Takashi Iwai + +commit c6cc3d58b4042f5cadae653ff8d3df26af1a0169 upstream. + +ASUS N56VZ needs a fixup for the bass speaker pin, which was already +provided via model=asus-mode4. + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=841645 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4345,6 +4345,7 @@ static const struct snd_pci_quirk alc662 + SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), ++ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4), + SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT), + SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2), + SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD), diff --git a/queue-3.11/alsa-hda-fix-microphone-for-sony-vaio-pro-13-haswell.patch b/queue-3.11/alsa-hda-fix-microphone-for-sony-vaio-pro-13-haswell.patch new file mode 100644 index 00000000000..feba58c989b --- /dev/null +++ b/queue-3.11/alsa-hda-fix-microphone-for-sony-vaio-pro-13-haswell.patch @@ -0,0 +1,58 @@ +From 88cfcf86aa3ada84d97195bcad74f4dadb4ae23b Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Fri, 11 Oct 2013 10:18:45 +0200 +Subject: ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell + model) + +From: David Henningsson + +commit 88cfcf86aa3ada84d97195bcad74f4dadb4ae23b upstream. + +The external mic showed up with a precense detect of "always present", +essentially disabling the internal mic. Therefore turn off presence +detection for this pin. + +Note: The external mic seems not yet working, but an internal mic is +certainly better than no mic at all. + +BugLink: https://bugs.launchpad.net/bugs/1227093 +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3331,6 +3331,7 @@ enum { + ALC269_FIXUP_HP_GPIO_LED, + ALC269_FIXUP_INV_DMIC, + ALC269_FIXUP_LENOVO_DOCK, ++ ALC286_FIXUP_SONY_MIC_NO_PRESENCE, + ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT, + ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, +@@ -3529,6 +3530,13 @@ static const struct hda_fixup alc269_fix + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_headset_mode_no_hp_mic, + }, ++ [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_ASUS_X101_FUNC] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_x101_headset_mic, +@@ -3651,6 +3659,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101), ++ SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2), + SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), diff --git a/queue-3.11/alsa-hda-hdmi-fix-channel-map-switch-not-taking-effect.patch b/queue-3.11/alsa-hda-hdmi-fix-channel-map-switch-not-taking-effect.patch new file mode 100644 index 00000000000..c12b1e2b294 --- /dev/null +++ b/queue-3.11/alsa-hda-hdmi-fix-channel-map-switch-not-taking-effect.patch @@ -0,0 +1,71 @@ +From 39edac70e9aedf451fccaa851b273ace9fcca0bd Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Mon, 7 Oct 2013 19:24:52 +0300 +Subject: ALSA: hda - hdmi: Fix channel map switch not taking effect + +From: Anssi Hannula + +commit 39edac70e9aedf451fccaa851b273ace9fcca0bd upstream. + +Currently hdmi_setup_audio_infoframe() reprograms the HDA channel +mapping only when the infoframe is not up-to-date or the non-PCM flag +has changed. + +However, when just the channel map has been changed, the infoframe may +still be up-to-date and non-PCM flag may not have changed, so the new +channel map is not actually programmed into the HDA codec. + +Notably, this failing case is also always triggered when the device is +already in a prepared state and a new channel map is configured while +changing only the channel positions (for example, plain +"speaker-test -c2 -m FR,FL"). + +Fix that by always programming the channel map in +hdmi_setup_audio_infoframe(). Tested on Intel HDMI. + +Signed-off-by: Anssi Hannula +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -930,6 +930,14 @@ static void hdmi_setup_audio_infoframe(s + } + + /* ++ * always configure channel mapping, it may have been changed by the ++ * user in the meantime ++ */ ++ hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca, ++ channels, per_pin->chmap, ++ per_pin->chmap_set); ++ ++ /* + * sizeof(ai) is used instead of sizeof(*hdmi_ai) or + * sizeof(*dp_ai) to avoid partial match/update problems when + * the user switches between HDMI/DP monitors. +@@ -940,20 +948,10 @@ static void hdmi_setup_audio_infoframe(s + "pin=%d channels=%d\n", + pin_nid, + channels); +- hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca, +- channels, per_pin->chmap, +- per_pin->chmap_set); + hdmi_stop_infoframe_trans(codec, pin_nid); + hdmi_fill_audio_infoframe(codec, pin_nid, + ai.bytes, sizeof(ai)); + hdmi_start_infoframe_trans(codec, pin_nid); +- } else { +- /* For non-pcm audio switch, setup new channel mapping +- * accordingly */ +- if (per_pin->non_pcm != non_pcm) +- hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca, +- channels, per_pin->chmap, +- per_pin->chmap_set); + } + + per_pin->non_pcm = non_pcm; diff --git a/queue-3.11/alsa-snd-usb-usx2y-remove-bogus-frame-checks.patch b/queue-3.11/alsa-snd-usb-usx2y-remove-bogus-frame-checks.patch new file mode 100644 index 00000000000..985f3d2d8dd --- /dev/null +++ b/queue-3.11/alsa-snd-usb-usx2y-remove-bogus-frame-checks.patch @@ -0,0 +1,84 @@ +From a9d14bc0b188a822e42787d01e56c06fe9750162 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Wed, 2 Oct 2013 17:49:50 +0200 +Subject: ALSA: snd-usb-usx2y: remove bogus frame checks + +From: Daniel Mack + +commit a9d14bc0b188a822e42787d01e56c06fe9750162 upstream. + +The frame check in i_usX2Y_urb_complete() and +i_usX2Y_usbpcm_urb_complete() is bogus and produces false positives as +described in this LAU thread: + + http://linuxaudio.org/mailarchive/lau/2013/5/20/200177 + +This patch removes the check code entirely. + +Cc: fzu@wemgehoertderstaat.de +Reported-by: Dr Nicholas J Bailey +Suggested-by: Takashi Iwai +Signed-off-by: Daniel Mack +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usx2y/usbusx2yaudio.c | 22 +++------------------- + sound/usb/usx2y/usx2yhwdeppcm.c | 7 +------ + 2 files changed, 4 insertions(+), 25 deletions(-) + +--- a/sound/usb/usx2y/usbusx2yaudio.c ++++ b/sound/usb/usx2y/usbusx2yaudio.c +@@ -299,19 +299,6 @@ static void usX2Y_error_urb_status(struc + usX2Y_clients_stop(usX2Y); + } + +-static void usX2Y_error_sequence(struct usX2Ydev *usX2Y, +- struct snd_usX2Y_substream *subs, struct urb *urb) +-{ +- snd_printk(KERN_ERR +-"Sequence Error!(hcd_frame=%i ep=%i%s;wait=%i,frame=%i).\n" +-"Most probably some urb of usb-frame %i is still missing.\n" +-"Cause could be too long delays in usb-hcd interrupt handling.\n", +- usb_get_current_frame_number(usX2Y->dev), +- subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out", +- usX2Y->wait_iso_frame, urb->start_frame, usX2Y->wait_iso_frame); +- usX2Y_clients_stop(usX2Y); +-} +- + static void i_usX2Y_urb_complete(struct urb *urb) + { + struct snd_usX2Y_substream *subs = urb->context; +@@ -328,12 +315,9 @@ static void i_usX2Y_urb_complete(struct + usX2Y_error_urb_status(usX2Y, subs, urb); + return; + } +- if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF))) +- subs->completed_urb = urb; +- else { +- usX2Y_error_sequence(usX2Y, subs, urb); +- return; +- } ++ ++ subs->completed_urb = urb; ++ + { + struct snd_usX2Y_substream *capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE], + *playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK]; +--- a/sound/usb/usx2y/usx2yhwdeppcm.c ++++ b/sound/usb/usx2y/usx2yhwdeppcm.c +@@ -244,13 +244,8 @@ static void i_usX2Y_usbpcm_urb_complete( + usX2Y_error_urb_status(usX2Y, subs, urb); + return; + } +- if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF))) +- subs->completed_urb = urb; +- else { +- usX2Y_error_sequence(usX2Y, subs, urb); +- return; +- } + ++ subs->completed_urb = urb; + capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE]; + capsubs2 = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE + 2]; + playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK]; diff --git a/queue-3.11/btrfs-use-right-root-when-checking-for-hash-collision.patch b/queue-3.11/btrfs-use-right-root-when-checking-for-hash-collision.patch new file mode 100644 index 00000000000..e3f5455d7e9 --- /dev/null +++ b/queue-3.11/btrfs-use-right-root-when-checking-for-hash-collision.patch @@ -0,0 +1,40 @@ +From 4871c1588f92c6c13f4713a7009f25f217055807 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Wed, 9 Oct 2013 12:24:04 -0400 +Subject: Btrfs: use right root when checking for hash collision + +From: Josef Bacik + +commit 4871c1588f92c6c13f4713a7009f25f217055807 upstream. + +btrfs_rename was using the root of the old dir instead of the root of the new +dir when checking for a hash collision, so if you tried to move a file into a +subvol it would freak out because it would see the file you are trying to move +in its current root. This fixes the bug where this would fail + +btrfs subvol create test1 +btrfs subvol create test2 +mv test1 test2. + +Thanks to Chris Murphy for catching this, + +Reported-by: Chris Murphy +Signed-off-by: Josef Bacik +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -8036,7 +8036,7 @@ static int btrfs_rename(struct inode *ol + + + /* check for collisions, even if the name isn't there */ +- ret = btrfs_check_dir_item_collision(root, new_dir->i_ino, ++ ret = btrfs_check_dir_item_collision(dest, new_dir->i_ino, + new_dentry->d_name.name, + new_dentry->d_name.len); + diff --git a/queue-3.11/ext4-fix-memory-leak-in-xattr.patch b/queue-3.11/ext4-fix-memory-leak-in-xattr.patch new file mode 100644 index 00000000000..74da2f1152f --- /dev/null +++ b/queue-3.11/ext4-fix-memory-leak-in-xattr.patch @@ -0,0 +1,41 @@ +From 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc Mon Sep 17 00:00:00 2001 +From: Dave Jones +Date: Thu, 10 Oct 2013 20:05:35 -0400 +Subject: ext4: fix memory leak in xattr + +From: Dave Jones + +commit 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc upstream. + +If we take the 2nd retry path in ext4_expand_extra_isize_ea, we +potentionally return from the function without having freed these +allocations. If we don't do the return, we over-write the previous +allocation pointers, so we leak either way. + +Spotted with Coverity. + +[ Fixed by tytso to set is and bs to NULL after freeing these + pointers, in case in the retry loop we later end up triggering an + error causing a jump to cleanup, at which point we could have a double + free bug. -- Ted ] + +Signed-off-by: Dave Jones +Signed-off-by: "Theodore Ts'o" +Reviewed-by: Eric Sandeen +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/xattr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1350,6 +1350,8 @@ retry: + s_min_extra_isize) { + tried_min_extra_isize++; + new_extra_isize = s_min_extra_isize; ++ kfree(is); is = NULL; ++ kfree(bs); bs = NULL; + goto retry; + } + error = -1; diff --git a/queue-3.11/hwmon-applesmc-always-read-until-end-of-data.patch b/queue-3.11/hwmon-applesmc-always-read-until-end-of-data.patch new file mode 100644 index 00000000000..56f040c6325 --- /dev/null +++ b/queue-3.11/hwmon-applesmc-always-read-until-end-of-data.patch @@ -0,0 +1,72 @@ +From 25f2bd7f5add608c1d1405938f39c96927b275ca Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg +Date: Wed, 2 Oct 2013 19:15:03 +0200 +Subject: hwmon: (applesmc) Always read until end of data + +From: Henrik Rydberg + +commit 25f2bd7f5add608c1d1405938f39c96927b275ca upstream. + +The crash reported and investigated in commit 5f4513 turned out to be +caused by a change to the read interface on newer (2012) SMCs. + +Tests by Chris show that simply reading the data valid line is enough +for the problem to go away. Additional tests show that the newer SMCs +no longer wait for the number of requested bytes, but start sending +data right away. Apparently the number of bytes to read is no longer +specified as before, but instead found out by reading until end of +data. Failure to read until end of data confuses the state machine, +which eventually causes the crash. + +As a remedy, assuming bit0 is the read valid line, make sure there is +nothing more to read before leaving the read function. + +Tested to resolve the original problem, and runtested on MBA3,1, +MBP4,1, MBP8,2, MBP10,1, MBP10,2. The patch seems to have no effect on +machines before 2012. + +Tested-by: Chris Murphy +Signed-off-by: Henrik Rydberg +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/applesmc.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -230,6 +230,7 @@ static int send_argument(const char *key + + static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) + { ++ u8 status, data = 0; + int i; + + if (send_command(cmd) || send_argument(key)) { +@@ -237,6 +238,7 @@ static int read_smc(u8 cmd, const char * + return -EIO; + } + ++ /* This has no effect on newer (2012) SMCs */ + if (send_byte(len, APPLESMC_DATA_PORT)) { + pr_warn("%.4s: read len fail\n", key); + return -EIO; +@@ -250,6 +252,17 @@ static int read_smc(u8 cmd, const char * + buffer[i] = inb(APPLESMC_DATA_PORT); + } + ++ /* Read the data port until bit0 is cleared */ ++ for (i = 0; i < 16; i++) { ++ udelay(APPLESMC_MIN_WAIT); ++ status = inb(APPLESMC_CMD_PORT); ++ if (!(status & 0x01)) ++ break; ++ data = inb(APPLESMC_DATA_PORT); ++ } ++ if (i) ++ pr_warn("flushed %d bytes, last value is: %d\n", i, data); ++ + return 0; + } + diff --git a/queue-3.11/i2c-omap-clear-ardy-bit-twice.patch b/queue-3.11/i2c-omap-clear-ardy-bit-twice.patch new file mode 100644 index 00000000000..a6c16ef2c14 --- /dev/null +++ b/queue-3.11/i2c-omap-clear-ardy-bit-twice.patch @@ -0,0 +1,40 @@ +From 4cdbf7d346e7461c3b93a26707c852e2c9db3753 Mon Sep 17 00:00:00 2001 +From: Taras Kondratiuk +Date: Mon, 7 Oct 2013 13:41:59 +0300 +Subject: i2c: omap: Clear ARDY bit twice + +From: Taras Kondratiuk + +commit 4cdbf7d346e7461c3b93a26707c852e2c9db3753 upstream. + +Initially commit cb527ede1bf6ff2008a025606f25344b8ed7b4ac +"i2c-omap: Double clear of ARDY status in IRQ handler" +added a workaround for undocumented errata ProDB0017052. +But then commit 1d7afc95946487945cc7f5019b41255b72224b70 +"i2c: omap: ack IRQ in parts" refactored code and missed +one of ARDY clearings. So current code violates errata. +It causes often i2c bus timeouts on my Pandaboard. + +This patch adds a second clearing in place. + +Signed-off-by: Grygorii Strashko +Signed-off-by: Taras Kondratiuk +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-omap.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -944,6 +944,9 @@ omap_i2c_isr_thread(int this_irq, void * + /* + * ProDB0017052: Clear ARDY bit twice + */ ++ if (stat & OMAP_I2C_STAT_ARDY) ++ omap_i2c_ack_stat(dev, OMAP_I2C_STAT_ARDY); ++ + if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK | + OMAP_I2C_STAT_AL)) { + omap_i2c_ack_stat(dev, (OMAP_I2C_STAT_RRDY | diff --git a/queue-3.11/kvm-ppc-book3s-hv-fix-typo-in-saving-dscr.patch b/queue-3.11/kvm-ppc-book3s-hv-fix-typo-in-saving-dscr.patch new file mode 100644 index 00000000000..a18490879aa --- /dev/null +++ b/queue-3.11/kvm-ppc-book3s-hv-fix-typo-in-saving-dscr.patch @@ -0,0 +1,35 @@ +From cfc860253abd73e1681696c08ea268d33285a2c4 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Sat, 21 Sep 2013 09:53:28 +1000 +Subject: KVM: PPC: Book3S HV: Fix typo in saving DSCR + +From: Paul Mackerras + +commit cfc860253abd73e1681696c08ea268d33285a2c4 upstream. + +This fixes a typo in the code that saves the guest DSCR (Data Stream +Control Register) into the kvm_vcpu_arch struct on guest exit. The +effect of the typo was that the DSCR value was saved in the wrong place, +so changes to the DSCR by the guest didn't persist across guest exit +and entry, and some host kernel memory got corrupted. + +Signed-off-by: Paul Mackerras +Acked-by: Alexander Graf +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -1054,7 +1054,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206) + BEGIN_FTR_SECTION + mfspr r8, SPRN_DSCR + ld r7, HSTATE_DSCR(r13) +- std r8, VCPU_DSCR(r7) ++ std r8, VCPU_DSCR(r9) + mtspr SPRN_DSCR, r7 + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206) + diff --git a/queue-3.11/parisc-fix-interruption-handler-to-respect-pagefault_disable.patch b/queue-3.11/parisc-fix-interruption-handler-to-respect-pagefault_disable.patch new file mode 100644 index 00000000000..c145eb1493e --- /dev/null +++ b/queue-3.11/parisc-fix-interruption-handler-to-respect-pagefault_disable.patch @@ -0,0 +1,55 @@ +From 59b33f148cc08fb33cbe823fca1e34f7f023765e Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Tue, 1 Oct 2013 21:54:46 +0200 +Subject: parisc: fix interruption handler to respect pagefault_disable() + +From: Helge Deller + +commit 59b33f148cc08fb33cbe823fca1e34f7f023765e upstream. + +Running an "echo t > /proc/sysrq-trigger" crashes the parisc kernel. The +problem is, that in print_worker_info() we try to read the workqueue info via +the probe_kernel_read() functions which use pagefault_disable() to avoid +crashes like this: + probe_kernel_read(&pwq, &worker->current_pwq, sizeof(pwq)); + probe_kernel_read(&wq, &pwq->wq, sizeof(wq)); + probe_kernel_read(name, wq->name, sizeof(name) - 1); + +The problem here is, that the first probe_kernel_read(&pwq) might return zero +in pwq and as such the following probe_kernel_reads() try to access contents of +the page zero which is read protected and generate a kernel segfault. + +With this patch we fix the interruption handler to call parisc_terminate() +directly only if pagefault_disable() was not called (in which case +preempt_count()==0). Otherwise we hand over to the pagefault handler which +will try to look up the faulting address in the fixup tables. + +Signed-off-by: Helge Deller +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/traps.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -805,14 +805,14 @@ void notrace handle_interruption(int cod + else { + + /* +- * The kernel should never fault on its own address space. ++ * The kernel should never fault on its own address space, ++ * unless pagefault_disable() was called before. + */ + +- if (fault_space == 0) ++ if (fault_space == 0 && !in_atomic()) + { + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); + parisc_terminate("Kernel Fault", regs, code, fault_address); +- + } + } + diff --git a/queue-3.11/random-run-random_int_secret_init-run-after-all-late_initcalls.patch b/queue-3.11/random-run-random_int_secret_init-run-after-all-late_initcalls.patch new file mode 100644 index 00000000000..2115de5831b --- /dev/null +++ b/queue-3.11/random-run-random_int_secret_init-run-after-all-late_initcalls.patch @@ -0,0 +1,67 @@ +From 47d06e532e95b71c0db3839ebdef3fe8812fca2c Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Tue, 10 Sep 2013 10:52:35 -0400 +Subject: random: run random_int_secret_init() run after all late_initcalls + +From: Theodore Ts'o + +commit 47d06e532e95b71c0db3839ebdef3fe8812fca2c upstream. + +The some platforms (e.g., ARM) initializes their clocks as +late_initcalls for some unknown reason. So make sure +random_int_secret_init() is run after all of the late_initcalls are +run. + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/random.c | 3 +-- + include/linux/random.h | 1 + + init/main.c | 2 ++ + 3 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1462,12 +1462,11 @@ struct ctl_table random_table[] = { + + static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned; + +-static int __init random_int_secret_init(void) ++int random_int_secret_init(void) + { + get_random_bytes(random_int_secret, sizeof(random_int_secret)); + return 0; + } +-late_initcall(random_int_secret_init); + + /* + * Get a random word for internal kernel use only. Similar to urandom but +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -17,6 +17,7 @@ extern void add_interrupt_randomness(int + extern void get_random_bytes(void *buf, int nbytes); + extern void get_random_bytes_arch(void *buf, int nbytes); + void generate_random_uuid(unsigned char uuid_out[16]); ++extern int random_int_secret_init(void); + + #ifndef MODULE + extern const struct file_operations random_fops, urandom_fops; +--- a/init/main.c ++++ b/init/main.c +@@ -75,6 +75,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -778,6 +779,7 @@ static void __init do_basic_setup(void) + do_ctors(); + usermodehelper_enable(); + do_initcalls(); ++ random_int_secret_init(); + } + + static void __init do_pre_smp_initcalls(void) diff --git a/queue-3.11/series b/queue-3.11/series new file mode 100644 index 00000000000..abe1daf6c8d --- /dev/null +++ b/queue-3.11/series @@ -0,0 +1,12 @@ +alsa-snd-usb-usx2y-remove-bogus-frame-checks.patch +alsa-hda-hdmi-fix-channel-map-switch-not-taking-effect.patch +alsa-hda-add-fixup-for-asus-n56vz.patch +alsa-hda-fix-microphone-for-sony-vaio-pro-13-haswell.patch +random-run-random_int_secret_init-run-after-all-late_initcalls.patch +vfs-allow-o_path-file-descriptors-for-fstatfs.patch +i2c-omap-clear-ardy-bit-twice.patch +hwmon-applesmc-always-read-until-end-of-data.patch +btrfs-use-right-root-when-checking-for-hash-collision.patch +ext4-fix-memory-leak-in-xattr.patch +kvm-ppc-book3s-hv-fix-typo-in-saving-dscr.patch +parisc-fix-interruption-handler-to-respect-pagefault_disable.patch diff --git a/queue-3.11/vfs-allow-o_path-file-descriptors-for-fstatfs.patch b/queue-3.11/vfs-allow-o_path-file-descriptors-for-fstatfs.patch new file mode 100644 index 00000000000..70e8a6431a1 --- /dev/null +++ b/queue-3.11/vfs-allow-o_path-file-descriptors-for-fstatfs.patch @@ -0,0 +1,37 @@ +From 9d05746e7b16d8565dddbe3200faa1e669d23bbf Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Mon, 30 Sep 2013 08:35:10 -0700 +Subject: vfs: allow O_PATH file descriptors for fstatfs() + +From: Linus Torvalds + +commit 9d05746e7b16d8565dddbe3200faa1e669d23bbf upstream. + +Olga reported that file descriptors opened with O_PATH do not work with +fstatfs(), found during further development of ksh93's thread support. + +There is no reason to not allow O_PATH file descriptors here (fstatfs is +very much a path operation), so use "fdget_raw()". See commit +55815f70147d ("vfs: make O_PATH file descriptors usable for 'fstat()'") +for a very similar issue reported for fstat() by the same team. + +Reported-and-tested-by: ольга крыжановская +Acked-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/statfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/statfs.c ++++ b/fs/statfs.c +@@ -94,7 +94,7 @@ retry: + + int fd_statfs(int fd, struct kstatfs *st) + { +- struct fd f = fdget(fd); ++ struct fd f = fdget_raw(fd); + int error = -EBADF; + if (f.file) { + error = vfs_statfs(&f.file->f_path, st);