From: Greg Kroah-Hartman Date: Tue, 26 Mar 2013 18:08:57 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.71~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9d76e504caa9b8940a886358e3e324f0a0a4c94d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch drm-radeon-add-richland-pci-ids.patch drm-radeon-add-support-for-richland-apus.patch drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch --- diff --git a/queue-3.4/cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch b/queue-3.4/cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch new file mode 100644 index 00000000000..850099d0f1c --- /dev/null +++ b/queue-3.4/cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch @@ -0,0 +1,97 @@ +From f853c616883a8de966873a1dab283f1369e275a1 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Mon, 11 Mar 2013 09:52:19 -0400 +Subject: cifs: ignore everything in SPNEGO blob after mechTypes + +From: Jeff Layton + +commit f853c616883a8de966873a1dab283f1369e275a1 upstream. + +We've had several reports of people attempting to mount Windows 8 shares +and getting failures with a return code of -EINVAL. The default sec= +mode changed recently to sec=ntlmssp. With that, we expect and parse a +SPNEGO blob from the server in the NEGOTIATE reply. + +The current decode_negTokenInit function first parses all of the +mechTypes and then tries to parse the rest of the negTokenInit reply. +The parser however currently expects a mechListMIC or nothing to follow the +mechTypes, but Windows 8 puts a mechToken field there instead to carry +some info for the new NegoEx stuff. + +In practice, we don't do anything with the fields after the mechTypes +anyway so I don't see any real benefit in continuing to parse them. +This patch just has the kernel ignore the fields after the mechTypes. +We'll probably need to reinstate some of this if we ever want to support +NegoEx. + +Reported-by: Jason Burgess +Reported-by: Yan Li +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/asn1.c | 53 +++++------------------------------------------------ + 1 file changed, 5 insertions(+), 48 deletions(-) + +--- a/fs/cifs/asn1.c ++++ b/fs/cifs/asn1.c +@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *secur + } + } + +- /* mechlistMIC */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- /* Check if we have reached the end of the blob, but with +- no mechListMic (e.g. NTLMSSP instead of KRB5) */ +- if (ctx.error == ASN1_ERR_DEC_EMPTY) +- goto decode_negtoken_exit; +- cFYI(1, "Error decoding last part negTokenInit exit3"); +- return 0; +- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) { +- /* tag = 3 indicating mechListMIC */ +- cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- return 0; +- } +- +- /* sequence */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- cFYI(1, "Error decoding last part negTokenInit exit5"); +- return 0; +- } else if ((cls != ASN1_UNI) || (con != ASN1_CON) +- || (tag != ASN1_SEQ)) { +- cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- } +- +- /* sequence of */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- cFYI(1, "Error decoding last part negTokenInit exit 7"); +- return 0; +- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) { +- cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- return 0; +- } +- +- /* general string */ +- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) { +- cFYI(1, "Error decoding last part negTokenInit exit9"); +- return 0; +- } else if ((cls != ASN1_UNI) || (con != ASN1_PRI) +- || (tag != ASN1_GENSTR)) { +- cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)", +- cls, con, tag, end, *end); +- return 0; +- } +- cFYI(1, "Need to call asn1_octets_decode() function for %s", +- ctx.pointer); /* is this UTF-8 or ASCII? */ +-decode_negtoken_exit: ++ /* ++ * We currently ignore anything at the end of the SPNEGO blob after ++ * the mechTypes have been parsed, since none of that info is ++ * used at the moment. ++ */ + return 1; + } diff --git a/queue-3.4/drm-radeon-add-richland-pci-ids.patch b/queue-3.4/drm-radeon-add-richland-pci-ids.patch new file mode 100644 index 00000000000..77cd138a8a1 --- /dev/null +++ b/queue-3.4/drm-radeon-add-richland-pci-ids.patch @@ -0,0 +1,46 @@ +From b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 8 Mar 2013 13:36:54 -0500 +Subject: drm/radeon: add Richland pci ids + +From: Alex Deucher + +commit b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f upstream. + +Reviewed-by: Jerome Glisse +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -572,7 +572,11 @@ + {0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ +- {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ +@@ -583,6 +587,13 @@ + {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ diff --git a/queue-3.4/drm-radeon-add-support-for-richland-apus.patch b/queue-3.4/drm-radeon-add-support-for-richland-apus.patch new file mode 100644 index 00000000000..315dd3ce9be --- /dev/null +++ b/queue-3.4/drm-radeon-add-support-for-richland-apus.patch @@ -0,0 +1,53 @@ +From e4d170633fde379f39a90f8a5e7eb619b5d1144d Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 8 Mar 2013 13:44:15 -0500 +Subject: drm/radeon: add support for Richland APUs + +From: Alex Deucher + +commit e4d170633fde379f39a90f8a5e7eb619b5d1144d upstream. + +Richland APUs are a new version of the Trinity APUs +with performance and power management improvements. + +Reviewed-by: Jerome Glisse +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/ni.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -663,13 +663,19 @@ static void cayman_gpu_init(struct radeo + (rdev->pdev->device == 0x9907) || + (rdev->pdev->device == 0x9908) || + (rdev->pdev->device == 0x9909) || ++ (rdev->pdev->device == 0x990B) || ++ (rdev->pdev->device == 0x990C) || ++ (rdev->pdev->device == 0x990F) || + (rdev->pdev->device == 0x9910) || +- (rdev->pdev->device == 0x9917)) { ++ (rdev->pdev->device == 0x9917) || ++ (rdev->pdev->device == 0x9999)) { + rdev->config.cayman.max_simds_per_se = 6; + rdev->config.cayman.max_backends_per_se = 2; + } else if ((rdev->pdev->device == 0x9903) || + (rdev->pdev->device == 0x9904) || + (rdev->pdev->device == 0x990A) || ++ (rdev->pdev->device == 0x990D) || ++ (rdev->pdev->device == 0x990E) || + (rdev->pdev->device == 0x9913) || + (rdev->pdev->device == 0x9918)) { + rdev->config.cayman.max_simds_per_se = 4; +@@ -678,6 +684,9 @@ static void cayman_gpu_init(struct radeo + (rdev->pdev->device == 0x9990) || + (rdev->pdev->device == 0x9991) || + (rdev->pdev->device == 0x9994) || ++ (rdev->pdev->device == 0x9995) || ++ (rdev->pdev->device == 0x9996) || ++ (rdev->pdev->device == 0x999A) || + (rdev->pdev->device == 0x99A0)) { + rdev->config.cayman.max_simds_per_se = 3; + rdev->config.cayman.max_backends_per_se = 1; diff --git a/queue-3.4/drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch b/queue-3.4/drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch new file mode 100644 index 00000000000..0249c31a53d --- /dev/null +++ b/queue-3.4/drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch @@ -0,0 +1,47 @@ +From fa8d387dc3f62062a6b4afbbb2a3438094fd8584 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 12 Mar 2013 12:53:13 -0400 +Subject: drm/radeon/benchmark: make sure bo blit copy exists before using it + +From: Alex Deucher + +commit fa8d387dc3f62062a6b4afbbb2a3438094fd8584 upstream. + +Fixes a segfault on asics without a blit callback. + +Fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=62239 + +Reviewed-by: Michel Dänzer +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_benchmark.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_benchmark.c ++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c +@@ -141,13 +141,15 @@ static void radeon_benchmark_move(struct + sdomain, ddomain, "dma"); + } + +- time = radeon_benchmark_do_move(rdev, size, saddr, daddr, +- RADEON_BENCHMARK_COPY_BLIT, n); +- if (time < 0) +- goto out_cleanup; +- if (time > 0) +- radeon_benchmark_log_results(n, size, time, +- sdomain, ddomain, "blit"); ++ if (rdev->asic->copy.blit) { ++ time = radeon_benchmark_do_move(rdev, size, saddr, daddr, ++ RADEON_BENCHMARK_COPY_BLIT, n); ++ if (time < 0) ++ goto out_cleanup; ++ if (time > 0) ++ radeon_benchmark_log_results(n, size, time, ++ sdomain, ddomain, "blit"); ++ } + + out_cleanup: + if (sobj) { diff --git a/queue-3.4/ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch b/queue-3.4/ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch new file mode 100644 index 00000000000..2df0a062481 --- /dev/null +++ b/queue-3.4/ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch @@ -0,0 +1,74 @@ +From 3a2256702e47f68f921dfad41b1764d05c572329 Mon Sep 17 00:00:00 2001 +From: Zheng Liu +Date: Sun, 10 Mar 2013 21:20:23 -0400 +Subject: ext4: fix the wrong number of the allocated blocks in ext4_split_extent() + +From: Zheng Liu + +commit 3a2256702e47f68f921dfad41b1764d05c572329 upstream. + +This commit fixes a wrong return value of the number of the allocated +blocks in ext4_split_extent. When the length of blocks we want to +allocate is greater than the length of the current extent, we return a +wrong number. Let's see what happens in the following case when we +call ext4_split_extent(). + + map: [48, 72] + ex: [32, 64, u] + +'ex' will be split into two parts: + ex1: [32, 47, u] + ex2: [48, 64, w] + +'map->m_len' is returned from this function, and the value is 24. But +the real length is 16. So it should be fixed. + +Meanwhile in this commit we use right length of the allocated blocks +when get_reserved_cluster_alloc in ext4_ext_handle_uninitialized_extents +is called. + +Signed-off-by: Zheng Liu +Signed-off-by: "Theodore Ts'o" +Cc: Dmitry Monakhov +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/extents.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -2959,6 +2959,7 @@ static int ext4_split_extent(handle_t *h + int err = 0; + int uninitialized; + int split_flag1, flags1; ++ int allocated = map->m_len; + + depth = ext_depth(inode); + ex = path[depth].p_ext; +@@ -2978,6 +2979,8 @@ static int ext4_split_extent(handle_t *h + map->m_lblk + map->m_len, split_flag1, flags1); + if (err) + goto out; ++ } else { ++ allocated = ee_len - (map->m_lblk - ee_block); + } + + ext4_ext_drop_refs(path); +@@ -3000,7 +3003,7 @@ static int ext4_split_extent(handle_t *h + + ext4_ext_show_leaf(inode, path); + out: +- return err ? err : map->m_len; ++ return err ? err : allocated; + } + + #define EXT4_EXT_ZERO_LEN 7 +@@ -3668,6 +3671,7 @@ out: + allocated - map->m_len); + allocated = map->m_len; + } ++ map->m_len = allocated; + + /* + * If we have done fallocate with the offset that is already diff --git a/queue-3.4/jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch b/queue-3.4/jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch new file mode 100644 index 00000000000..8d371a25c56 --- /dev/null +++ b/queue-3.4/jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch @@ -0,0 +1,76 @@ +From ad56edad089b56300fd13bb9eeb7d0424d978239 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 11 Mar 2013 13:24:56 -0400 +Subject: jbd2: fix use after free in jbd2_journal_dirty_metadata() + +From: Jan Kara + +commit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream. + +jbd2_journal_dirty_metadata() didn't get a reference to journal_head it +was working with. This is OK in most of the cases since the journal head +should be attached to a transaction but in rare occasions when we are +journalling data, __ext4_journalled_writepage() can race with +jbd2_journal_invalidatepage() stripping buffers from a page and thus +journal head can be freed under hands of jbd2_journal_dirty_metadata(). + +Fix the problem by getting own journal head reference in +jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers() +which can possibly have the same issue). + +Reported-by: Zheng Liu +Signed-off-by: Jan Kara +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/transaction.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1047,9 +1047,12 @@ out: + void jbd2_journal_set_triggers(struct buffer_head *bh, + struct jbd2_buffer_trigger_type *type) + { +- struct journal_head *jh = bh2jh(bh); ++ struct journal_head *jh = jbd2_journal_grab_journal_head(bh); + ++ if (WARN_ON(!jh)) ++ return; + jh->b_triggers = type; ++ jbd2_journal_put_journal_head(jh); + } + + void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data, +@@ -1101,17 +1104,18 @@ int jbd2_journal_dirty_metadata(handle_t + { + transaction_t *transaction = handle->h_transaction; + journal_t *journal = transaction->t_journal; +- struct journal_head *jh = bh2jh(bh); ++ struct journal_head *jh; + int ret = 0; + +- jbd_debug(5, "journal_head %p\n", jh); +- JBUFFER_TRACE(jh, "entry"); + if (is_handle_aborted(handle)) + goto out; +- if (!buffer_jbd(bh)) { ++ jh = jbd2_journal_grab_journal_head(bh); ++ if (!jh) { + ret = -EUCLEAN; + goto out; + } ++ jbd_debug(5, "journal_head %p\n", jh); ++ JBUFFER_TRACE(jh, "entry"); + + jbd_lock_bh_state(bh); + +@@ -1202,6 +1206,7 @@ int jbd2_journal_dirty_metadata(handle_t + spin_unlock(&journal->j_list_lock); + out_unlock_bh: + jbd_unlock_bh_state(bh); ++ jbd2_journal_put_journal_head(jh); + out: + JBUFFER_TRACE(jh, "exit"); + WARN_ON(ret); /* All errors are bugs, so dump the stack */ diff --git a/queue-3.4/series b/queue-3.4/series index 56bd4e9ff52..b71a0686ac9 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -43,3 +43,9 @@ kms-fix-edid-detailed-timing-vsync-parsing.patch kms-fix-edid-detailed-timing-frame-rate.patch mm-hugetlb-fix-total-hugetlbfs-pages-count-when-using-memory-overcommit-accouting.patch target-iscsi-fix-mutual-chap-auth-on-big-endian-arches.patch +drm-radeon-add-richland-pci-ids.patch +drm-radeon-add-support-for-richland-apus.patch +drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch +cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch +jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch +ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch