From: Greg Kroah-Hartman Date: Mon, 27 Feb 2012 23:18:04 +0000 (-0800) Subject: 3.2-stable patches X-Git-Tag: v3.2.9~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b9a872d943d1434325e379223f139b672ae06a0c;p=thirdparty%2Fkernel%2Fstable-queue.git 3.2-stable patches added patches: builddeb-don-t-create-files-in-tmp-with-predictable-names.patch can-sja1000-fix-isr-hang-when-hw-is-unplugged-under-load.patch davinci_emac-do-not-free-all-rx-dma-descriptors-during-init.patch genirq-handle-pending-irqs-in-irq_startup.patch genirq-unmask-oneshot-irqs-when-thread-was-not-woken.patch hdpvr-fix-race-conditon-during-start-of-streaming.patch imon-don-t-wedge-hardware-after-early-callbacks.patch ipvs-fix-matching-of-fwmark-templates-during-scheduling.patch jme-fix-fifo-flush-issue.patch scsi_pm-fix-bug-in-the-scsi-power-management-handler.patch scsi_scan-fix-poison-overwritten-warning-caused-by-using-freed-shost.patch --- diff --git a/queue-3.2/builddeb-don-t-create-files-in-tmp-with-predictable-names.patch b/queue-3.2/builddeb-don-t-create-files-in-tmp-with-predictable-names.patch new file mode 100644 index 00000000000..c31e5b62a4f --- /dev/null +++ b/queue-3.2/builddeb-don-t-create-files-in-tmp-with-predictable-names.patch @@ -0,0 +1,44 @@ +From 6c635224602d760c1208ada337562f40d8ae93a5 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 15 Feb 2012 14:17:29 +0000 +Subject: builddeb: Don't create files in /tmp with predictable names + +From: Ben Hutchings + +commit 6c635224602d760c1208ada337562f40d8ae93a5 upstream. + +The current use of /tmp for file lists is insecure. Put them under +$objtree/debian instead. + +Signed-off-by: Ben Hutchings +Acked-by: maximilian attems +Signed-off-by: Michal Marek +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/package/builddeb | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/scripts/package/builddeb ++++ b/scripts/package/builddeb +@@ -238,14 +238,14 @@ EOF + fi + + # Build header package +-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$) +-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$) +-(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$) ++(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles") ++(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles") ++(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles") + destdir=$kernel_headers_dir/usr/src/linux-headers-$version + mkdir -p "$destdir" +-(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -) +-(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -) +-rm -f /tmp/files$$ /tmp/objfiles$$ ++(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -) ++(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -) ++rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles" + arch=$(dpkg --print-architecture) + + cat <> debian/control diff --git a/queue-3.2/can-sja1000-fix-isr-hang-when-hw-is-unplugged-under-load.patch b/queue-3.2/can-sja1000-fix-isr-hang-when-hw-is-unplugged-under-load.patch new file mode 100644 index 00000000000..0c23ece71dc --- /dev/null +++ b/queue-3.2/can-sja1000-fix-isr-hang-when-hw-is-unplugged-under-load.patch @@ -0,0 +1,64 @@ +From a7762b10c12a70c5dbf2253142764b728ac88c3a Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Wed, 15 Feb 2012 17:51:56 +0100 +Subject: can: sja1000: fix isr hang when hw is unplugged under load + +From: Oliver Hartkopp + +commit a7762b10c12a70c5dbf2253142764b728ac88c3a upstream. + +In the case of hotplug enabled devices (PCMCIA/PCIeC) the removal of the +hardware can cause an infinite loop in the common sja1000 isr. + +Use the already retrieved status register to indicate a possible hardware +removal and double check by reading the mode register in sja1000_is_absent. + +Signed-off-by: Oliver Hartkopp +Acked-by: Wolfgang Grandegger +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/sja1000/sja1000.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct + spin_unlock_irqrestore(&priv->cmdreg_lock, flags); + } + ++static int sja1000_is_absent(struct sja1000_priv *priv) ++{ ++ return (priv->read_reg(priv, REG_MOD) == 0xFF); ++} ++ + static int sja1000_probe_chip(struct net_device *dev) + { + struct sja1000_priv *priv = netdev_priv(dev); + +- if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) { ++ if (priv->reg_base && sja1000_is_absent(priv)) { + printk(KERN_INFO "%s: probing @0x%lX failed\n", + DRV_NAME, dev->base_addr); + return 0; +@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, v + while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) { + n++; + status = priv->read_reg(priv, REG_SR); ++ /* check for absent controller due to hw unplug */ ++ if (status == 0xFF && sja1000_is_absent(priv)) ++ return IRQ_NONE; + + if (isrc & IRQ_WUI) + dev_warn(dev->dev.parent, "wakeup interrupt\n"); +@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, v + while (status & SR_RBS) { + sja1000_rx(dev); + status = priv->read_reg(priv, REG_SR); ++ /* check for absent controller */ ++ if (status == 0xFF && sja1000_is_absent(priv)) ++ return IRQ_NONE; + } + } + if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) { diff --git a/queue-3.2/davinci_emac-do-not-free-all-rx-dma-descriptors-during-init.patch b/queue-3.2/davinci_emac-do-not-free-all-rx-dma-descriptors-during-init.patch new file mode 100644 index 00000000000..ada5bd819fb --- /dev/null +++ b/queue-3.2/davinci_emac-do-not-free-all-rx-dma-descriptors-during-init.patch @@ -0,0 +1,71 @@ +From 5d69703263d588dbb03f4e57091afd8942d96e6d Mon Sep 17 00:00:00 2001 +From: Christian Riesch +Date: Thu, 23 Feb 2012 01:14:17 +0000 +Subject: davinci_emac: Do not free all rx dma descriptors during init + +From: Christian Riesch + +commit 5d69703263d588dbb03f4e57091afd8942d96e6d upstream. + +This patch fixes a regression that was introduced by + +commit 0a5f38467765ee15478db90d81e40c269c8dda20 +davinci_emac: Add Carrier Link OK check in Davinci RX Handler + +Said commit adds a check whether the carrier link is ok. If the link is +not ok, the skb is freed and no new dma descriptor added to the rx dma +channel. This causes trouble during initialization when the carrier +status has not yet been updated. If a lot of packets are received while +netif_carrier_ok returns false, all dma descriptors are freed and the +rx dma transfer is stopped. + +The bug occurs when the board is connected to a network with lots of +traffic and the ifconfig down/up is done, e.g., when reconfiguring +the interface with DHCP. + +The bug can be reproduced by flood pinging the davinci board while doing +ifconfig eth0 down +ifconfig eth0 up +on the board. + +After that, the rx path stops working and the overrun value reported +by ifconfig is counting up. + +This patch reverts commit 0a5f38467765ee15478db90d81e40c269c8dda20 +and instead issues warnings only if cpdma_chan_submit returns -ENOMEM. + +Signed-off-by: Christian Riesch +Cc: +Cc: Hegde, Vinay +Cc: Cyril Chemparathy +Cc: Sascha Hauer +Tested-by: Rajashekhara, Sudhakar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/ti/davinci_emac.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1007,7 +1007,7 @@ static void emac_rx_handler(void *token, + int ret; + + /* free and bail if we are shutting down */ +- if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) { ++ if (unlikely(!netif_running(ndev))) { + dev_kfree_skb_any(skb); + return; + } +@@ -1036,7 +1036,9 @@ static void emac_rx_handler(void *token, + recycle: + ret = cpdma_chan_submit(priv->rxchan, skb, skb->data, + skb_tailroom(skb), GFP_KERNEL); +- if (WARN_ON(ret < 0)) ++ ++ WARN_ON(ret == -ENOMEM); ++ if (unlikely(ret < 0)) + dev_kfree_skb_any(skb); + } + diff --git a/queue-3.2/genirq-handle-pending-irqs-in-irq_startup.patch b/queue-3.2/genirq-handle-pending-irqs-in-irq_startup.patch new file mode 100644 index 00000000000..bdefefa6678 --- /dev/null +++ b/queue-3.2/genirq-handle-pending-irqs-in-irq_startup.patch @@ -0,0 +1,109 @@ +From b4bc724e82e80478cba5fe9825b62e71ddf78757 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 8 Feb 2012 11:57:52 +0100 +Subject: genirq: Handle pending irqs in irq_startup() + +From: Thomas Gleixner + +commit b4bc724e82e80478cba5fe9825b62e71ddf78757 upstream. + +An interrupt might be pending when irq_startup() is called, but the +startup code does not invoke the resend logic. In some cases this +prevents the device from issuing another interrupt which renders the +device non functional. + +Call the resend function in irq_startup() to keep things going. + +Reported-and-tested-by: Russell King +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/autoprobe.c | 4 ++-- + kernel/irq/chip.c | 17 ++++++++++------- + kernel/irq/internals.h | 2 +- + kernel/irq/manage.c | 2 +- + 4 files changed, 14 insertions(+), 11 deletions(-) + +--- a/kernel/irq/autoprobe.c ++++ b/kernel/irq/autoprobe.c +@@ -53,7 +53,7 @@ unsigned long probe_irq_on(void) + if (desc->irq_data.chip->irq_set_type) + desc->irq_data.chip->irq_set_type(&desc->irq_data, + IRQ_TYPE_PROBE); +- irq_startup(desc); ++ irq_startup(desc, false); + } + raw_spin_unlock_irq(&desc->lock); + } +@@ -70,7 +70,7 @@ unsigned long probe_irq_on(void) + raw_spin_lock_irq(&desc->lock); + if (!desc->action && irq_settings_can_probe(desc)) { + desc->istate |= IRQS_AUTODETECT | IRQS_WAITING; +- if (irq_startup(desc)) ++ if (irq_startup(desc, false)) + desc->istate |= IRQS_PENDING; + } + raw_spin_unlock_irq(&desc->lock); +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -157,19 +157,22 @@ static void irq_state_set_masked(struct + irqd_set(&desc->irq_data, IRQD_IRQ_MASKED); + } + +-int irq_startup(struct irq_desc *desc) ++int irq_startup(struct irq_desc *desc, bool resend) + { ++ int ret = 0; ++ + irq_state_clr_disabled(desc); + desc->depth = 0; + + if (desc->irq_data.chip->irq_startup) { +- int ret = desc->irq_data.chip->irq_startup(&desc->irq_data); ++ ret = desc->irq_data.chip->irq_startup(&desc->irq_data); + irq_state_clr_masked(desc); +- return ret; ++ } else { ++ irq_enable(desc); + } +- +- irq_enable(desc); +- return 0; ++ if (resend) ++ check_irq_resend(desc, desc->irq_data.irq); ++ return ret; + } + + void irq_shutdown(struct irq_desc *desc) +@@ -646,7 +649,7 @@ __irq_set_handler(unsigned int irq, irq_ + irq_settings_set_noprobe(desc); + irq_settings_set_norequest(desc); + irq_settings_set_nothread(desc); +- irq_startup(desc); ++ irq_startup(desc, true); + } + out: + irq_put_desc_busunlock(desc, flags); +--- a/kernel/irq/internals.h ++++ b/kernel/irq/internals.h +@@ -67,7 +67,7 @@ extern int __irq_set_trigger(struct irq_ + extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp); + extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume); + +-extern int irq_startup(struct irq_desc *desc); ++extern int irq_startup(struct irq_desc *desc, bool resend); + extern void irq_shutdown(struct irq_desc *desc); + extern void irq_enable(struct irq_desc *desc); + extern void irq_disable(struct irq_desc *desc); +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1027,7 +1027,7 @@ __setup_irq(unsigned int irq, struct irq + desc->istate |= IRQS_ONESHOT; + + if (irq_settings_can_autoenable(desc)) +- irq_startup(desc); ++ irq_startup(desc, true); + else + /* Undo nested disables: */ + desc->depth = 1; diff --git a/queue-3.2/genirq-unmask-oneshot-irqs-when-thread-was-not-woken.patch b/queue-3.2/genirq-unmask-oneshot-irqs-when-thread-was-not-woken.patch new file mode 100644 index 00000000000..b1be081c948 --- /dev/null +++ b/queue-3.2/genirq-unmask-oneshot-irqs-when-thread-was-not-woken.patch @@ -0,0 +1,79 @@ +From ac5637611150281f398bb7a47e3fcb69a09e7803 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 7 Feb 2012 17:58:03 +0100 +Subject: genirq: Unmask oneshot irqs when thread was not woken + +From: Thomas Gleixner + +commit ac5637611150281f398bb7a47e3fcb69a09e7803 upstream. + +When the primary handler of an interrupt which is marked IRQ_ONESHOT +returns IRQ_HANDLED or IRQ_NONE, then the interrupt thread is not +woken and the unmask logic of the interrupt line is never +invoked. This keeps the interrupt masked forever. + +This was not noticed as most IRQ_ONESHOT users wake the thread +unconditionally (usually because they cannot access the underlying +device from hard interrupt context). Though this behaviour was nowhere +documented and not necessarily intentional. Some drivers can avoid the +thread wakeup in certain cases and run into the situation where the +interrupt line s kept masked. + +Handle it gracefully. + +Reported-and-tested-by: Lothar Wassmann +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/chip.c | 25 +++++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -330,6 +330,24 @@ out_unlock: + } + EXPORT_SYMBOL_GPL(handle_simple_irq); + ++/* ++ * Called unconditionally from handle_level_irq() and only for oneshot ++ * interrupts from handle_fasteoi_irq() ++ */ ++static void cond_unmask_irq(struct irq_desc *desc) ++{ ++ /* ++ * We need to unmask in the following cases: ++ * - Standard level irq (IRQF_ONESHOT is not set) ++ * - Oneshot irq which did not wake the thread (caused by a ++ * spurious interrupt or a primary handler handling it ++ * completely). ++ */ ++ if (!irqd_irq_disabled(&desc->irq_data) && ++ irqd_irq_masked(&desc->irq_data) && !desc->threads_oneshot) ++ unmask_irq(desc); ++} ++ + /** + * handle_level_irq - Level type irq handler + * @irq: the interrupt number +@@ -362,8 +380,8 @@ handle_level_irq(unsigned int irq, struc + + handle_irq_event(desc); + +- if (!irqd_irq_disabled(&desc->irq_data) && !(desc->istate & IRQS_ONESHOT)) +- unmask_irq(desc); ++ cond_unmask_irq(desc); ++ + out_unlock: + raw_spin_unlock(&desc->lock); + } +@@ -417,6 +435,9 @@ handle_fasteoi_irq(unsigned int irq, str + preflow_handler(desc); + handle_irq_event(desc); + ++ if (desc->istate & IRQS_ONESHOT) ++ cond_unmask_irq(desc); ++ + out_eoi: + desc->irq_data.chip->irq_eoi(&desc->irq_data); + out_unlock: diff --git a/queue-3.2/hdpvr-fix-race-conditon-during-start-of-streaming.patch b/queue-3.2/hdpvr-fix-race-conditon-during-start-of-streaming.patch new file mode 100644 index 00000000000..fc301b3b085 --- /dev/null +++ b/queue-3.2/hdpvr-fix-race-conditon-during-start-of-streaming.patch @@ -0,0 +1,37 @@ +From afa159538af61f1a65d48927f4e949fe514fb4fc Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Thu, 2 Feb 2012 13:35:21 -0300 +Subject: [media] hdpvr: fix race conditon during start of streaming + +From: Janne Grunau + +commit afa159538af61f1a65d48927f4e949fe514fb4fc upstream. + +status has to be set to STREAMING before the streaming worker is +queued. hdpvr_transmit_buffers() will exit immediately otherwise. + +Reported-by: Joerg Desch +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/hdpvr/hdpvr-video.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/video/hdpvr/hdpvr-video.c ++++ b/drivers/media/video/hdpvr/hdpvr-video.c +@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(struct + + hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00); + ++ dev->status = STATUS_STREAMING; ++ + INIT_WORK(&dev->worker, hdpvr_transmit_buffers); + queue_work(dev->workqueue, &dev->worker); + + v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev, + "streaming started\n"); +- dev->status = STATUS_STREAMING; + + return 0; + } diff --git a/queue-3.2/imon-don-t-wedge-hardware-after-early-callbacks.patch b/queue-3.2/imon-don-t-wedge-hardware-after-early-callbacks.patch new file mode 100644 index 00000000000..2a348b4f893 --- /dev/null +++ b/queue-3.2/imon-don-t-wedge-hardware-after-early-callbacks.patch @@ -0,0 +1,105 @@ +From 8791d63af0cf113725ae4cb8cba9492814c59a93 Mon Sep 17 00:00:00 2001 +From: Jarod Wilson +Date: Thu, 26 Jan 2012 12:04:11 -0300 +Subject: [media] imon: don't wedge hardware after early callbacks + +From: Jarod Wilson + +commit 8791d63af0cf113725ae4cb8cba9492814c59a93 upstream. + +This patch is just a minor update to one titled "imon: Input from ffdc +device type ignored" from Corinna Vinschen. An earlier patch to prevent +an oops when we got early callbacks also has the nasty side-effect of +wedging imon hardware, as we don't acknowledge the urb. Rework the check +slightly here to bypass processing the packet, as the driver isn't yet +fully initialized, but still acknowlege the urb and submit a new rx_urb. +Do this for both interfaces -- irrelevant for ffdc hardware, but +relevant for newer hardware, though newer hardware doesn't spew the +constant stream of data as soon as the hardware is initialized like the +older ffdc devices, so they'd be less likely to trigger this anyway... + +Tested with both an ffdc device and an 0042 device. + +Reported-by: Corinna Vinschen +Signed-off-by: Jarod Wilson +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/imon.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -47,7 +47,7 @@ + #define MOD_AUTHOR "Jarod Wilson " + #define MOD_DESC "Driver for SoundGraph iMON MultiMedia IR/Display" + #define MOD_NAME "imon" +-#define MOD_VERSION "0.9.3" ++#define MOD_VERSION "0.9.4" + + #define DISPLAY_MINOR_BASE 144 + #define DEVICE_NAME "lcd%d" +@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(struct + return; + + ictx = (struct imon_context *)urb->context; +- if (!ictx || !ictx->dev_present_intf0) ++ if (!ictx) + return; + ++ /* ++ * if we get a callback before we're done configuring the hardware, we ++ * can't yet process the data, as there's nowhere to send it, but we ++ * still need to submit a new rx URB to avoid wedging the hardware ++ */ ++ if (!ictx->dev_present_intf0) ++ goto out; ++ + switch (urb->status) { + case -ENOENT: /* usbcore unlink successful! */ + return; +@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(struct + break; + } + ++out: + usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC); + } + +@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(struct + return; + + ictx = (struct imon_context *)urb->context; +- if (!ictx || !ictx->dev_present_intf1) ++ if (!ictx) + return; + ++ /* ++ * if we get a callback before we're done configuring the hardware, we ++ * can't yet process the data, as there's nowhere to send it, but we ++ * still need to submit a new rx URB to avoid wedging the hardware ++ */ ++ if (!ictx->dev_present_intf1) ++ goto out; ++ + switch (urb->status) { + case -ENOENT: /* usbcore unlink successful! */ + return; +@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(struct + break; + } + ++out: + usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC); + } + +@@ -2242,7 +2260,7 @@ find_endpoint_failed: + mutex_unlock(&ictx->lock); + usb_free_urb(rx_urb); + rx_urb_alloc_failed: +- dev_err(ictx->dev, "unable to initialize intf0, err %d\n", ret); ++ dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret); + + return NULL; + } diff --git a/queue-3.2/ipvs-fix-matching-of-fwmark-templates-during-scheduling.patch b/queue-3.2/ipvs-fix-matching-of-fwmark-templates-during-scheduling.patch new file mode 100644 index 00000000000..75c17c3b668 --- /dev/null +++ b/queue-3.2/ipvs-fix-matching-of-fwmark-templates-during-scheduling.patch @@ -0,0 +1,44 @@ +From e0aac52e17a3db68fe2ceae281780a70fc69957f Mon Sep 17 00:00:00 2001 +From: Simon Horman +Date: Fri, 27 Jan 2012 10:45:27 +0900 +Subject: ipvs: fix matching of fwmark templates during scheduling + +From: Simon Horman + +commit e0aac52e17a3db68fe2ceae281780a70fc69957f upstream. + + Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37) +moved the fwmark variable in subcontext that is invalidated before +reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer +in the param structure make sure the fwmark variable is in +same context. As the fwmark templates can not be matched, +more and more template connections are created and the +controlled connections can not go to single real server. + +Signed-off-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/ipvs/ip_vs_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service + __be16 dport = 0; /* destination port to forward */ + unsigned int flags; + struct ip_vs_conn_param param; ++ const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) }; + union nf_inet_addr snet; /* source network of the client, + after masking */ + +@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service + { + int protocol = iph.protocol; + const union nf_inet_addr *vaddr = &iph.daddr; +- const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) }; + __be16 vport = 0; + + if (dst_port == svc->port) { diff --git a/queue-3.2/jme-fix-fifo-flush-issue.patch b/queue-3.2/jme-fix-fifo-flush-issue.patch new file mode 100644 index 00000000000..f407c8a258d --- /dev/null +++ b/queue-3.2/jme-fix-fifo-flush-issue.patch @@ -0,0 +1,59 @@ +From ba9adbe67e288823ac1deb7f11576ab5653f833e Mon Sep 17 00:00:00 2001 +From: Guo-Fu Tseng +Date: Wed, 22 Feb 2012 08:58:10 +0000 +Subject: jme: Fix FIFO flush issue + +From: Guo-Fu Tseng + +commit ba9adbe67e288823ac1deb7f11576ab5653f833e upstream. + +Set the RX FIFO flush watermark lower. +According to Federico and JMicron's reply, +setting it to 16QW would be stable on most platforms. +Otherwise, user might experience packet drop issue. + +Reported-by: Federico Quagliata +Fixed-by: Federico Quagliata +Signed-off-by: Guo-Fu Tseng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/jme.c | 10 +--------- + drivers/net/ethernet/jme.h | 2 +- + 2 files changed, 2 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev + ((new_mtu) < IPV6_MIN_MTU)) + return -EINVAL; + +- if (new_mtu > 4000) { +- jme->reg_rxcs &= ~RXCS_FIFOTHNP; +- jme->reg_rxcs |= RXCS_FIFOTHNP_64QW; +- jme_restart_rx_engine(jme); +- } else { +- jme->reg_rxcs &= ~RXCS_FIFOTHNP; +- jme->reg_rxcs |= RXCS_FIFOTHNP_128QW; +- jme_restart_rx_engine(jme); +- } + + netdev->mtu = new_mtu; + netdev_update_features(netdev); + ++ jme_restart_rx_engine(jme); + jme_reset_link(jme); + + return 0; +--- a/drivers/net/ethernet/jme.h ++++ b/drivers/net/ethernet/jme.h +@@ -730,7 +730,7 @@ enum jme_rxcs_values { + RXCS_RETRYCNT_60 = 0x00000F00, + + RXCS_DEFAULT = RXCS_FIFOTHTP_128T | +- RXCS_FIFOTHNP_128QW | ++ RXCS_FIFOTHNP_16QW | + RXCS_DMAREQSZ_128B | + RXCS_RETRYGAP_256ns | + RXCS_RETRYCNT_32, diff --git a/queue-3.2/scsi_pm-fix-bug-in-the-scsi-power-management-handler.patch b/queue-3.2/scsi_pm-fix-bug-in-the-scsi-power-management-handler.patch new file mode 100644 index 00000000000..f6c5049235d --- /dev/null +++ b/queue-3.2/scsi_pm-fix-bug-in-the-scsi-power-management-handler.patch @@ -0,0 +1,102 @@ +From fea6d607e154cf96ab22254ccb48addfd43d4cb5 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 17 Feb 2012 16:25:08 -0500 +Subject: [SCSI] scsi_pm: Fix bug in the SCSI power management handler + +From: Alan Stern + +commit fea6d607e154cf96ab22254ccb48addfd43d4cb5 upstream. + +This patch (as1520) fixes a bug in the SCSI layer's power management +implementation. + +LUN scanning can be carried out asynchronously in do_scan_async(), and +sd uses an asynchronous thread for the time-consuming parts of disk +probing in sd_probe_async(). Currently nothing coordinates these +async threads with system sleep transitions; they can and do attempt +to continue scanning/probing SCSI devices even after the host adapter +has been suspended. As one might expect, the outcome is not ideal. + +This is what the "prepare" stage of system suspend was created for. +After the prepare callback has been called for a host, target, or +device, drivers are not allowed to register any children underneath +them. Currently the SCSI prepare callback is not implemented; this +patch rectifies that omission. + +For SCSI hosts, the prepare routine calls scsi_complete_async_scans() +to wait until async scanning is finished. It might be slightly more +efficient to wait only until the host in question has been scanned, +but there's currently no way to do that. Besides, during a sleep +transition we will ultimately have to wait until all the host scanning +has finished anyway. + +For SCSI devices, the prepare routine calls async_synchronize_full() +to wait until sd probing is finished. The routine does nothing for +SCSI targets, because asynchronous target scanning is done only as +part of host scanning. + +Signed-off-by: Alan Stern +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_pm.c | 16 ++++++++++++++++ + drivers/scsi/scsi_priv.h | 1 + + 2 files changed, 17 insertions(+) + +--- a/drivers/scsi/scsi_pm.c ++++ b/drivers/scsi/scsi_pm.c +@@ -7,6 +7,7 @@ + + #include + #include ++#include + + #include + #include +@@ -69,6 +70,19 @@ static int scsi_bus_resume_common(struct + return err; + } + ++static int scsi_bus_prepare(struct device *dev) ++{ ++ if (scsi_is_sdev_device(dev)) { ++ /* sd probing uses async_schedule. Wait until it finishes. */ ++ async_synchronize_full(); ++ ++ } else if (scsi_is_host_device(dev)) { ++ /* Wait until async scanning is finished */ ++ scsi_complete_async_scans(); ++ } ++ return 0; ++} ++ + static int scsi_bus_suspend(struct device *dev) + { + return scsi_bus_suspend_common(dev, PMSG_SUSPEND); +@@ -87,6 +101,7 @@ static int scsi_bus_poweroff(struct devi + #else /* CONFIG_PM_SLEEP */ + + #define scsi_bus_resume_common NULL ++#define scsi_bus_prepare NULL + #define scsi_bus_suspend NULL + #define scsi_bus_freeze NULL + #define scsi_bus_poweroff NULL +@@ -195,6 +210,7 @@ void scsi_autopm_put_host(struct Scsi_Ho + #endif /* CONFIG_PM_RUNTIME */ + + const struct dev_pm_ops scsi_bus_pm_ops = { ++ .prepare = scsi_bus_prepare, + .suspend = scsi_bus_suspend, + .resume = scsi_bus_resume_common, + .freeze = scsi_bus_freeze, +--- a/drivers/scsi/scsi_priv.h ++++ b/drivers/scsi/scsi_priv.h +@@ -110,6 +110,7 @@ extern void scsi_exit_procfs(void); + #endif /* CONFIG_PROC_FS */ + + /* scsi_scan.c */ ++extern int scsi_complete_async_scans(void); + extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int, + unsigned int, unsigned int, int); + extern void scsi_forget_host(struct Scsi_Host *); diff --git a/queue-3.2/scsi_scan-fix-poison-overwritten-warning-caused-by-using-freed-shost.patch b/queue-3.2/scsi_scan-fix-poison-overwritten-warning-caused-by-using-freed-shost.patch new file mode 100644 index 00000000000..eb533358a95 --- /dev/null +++ b/queue-3.2/scsi_scan-fix-poison-overwritten-warning-caused-by-using-freed-shost.patch @@ -0,0 +1,101 @@ +From 267a6ad4aefaafbde607804c60945bcf97f91c1b Mon Sep 17 00:00:00 2001 +From: Huajun Li +Date: Sun, 12 Feb 2012 19:59:14 +0800 +Subject: [SCSI] scsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost' + +From: Huajun Li + +commit 267a6ad4aefaafbde607804c60945bcf97f91c1b upstream. + +In do_scan_async(), calling scsi_autopm_put_host(shost) may reference +freed shost, and cause Posison overwitten warning. +Yes, this case can happen, for example, an USB is disconnected just +when do_scan_async() thread starts to run, then scsi_host_put() called +in scsi_finish_async_scan() will lead to shost be freed(because the +refcount of shost->shost_gendev decreases to 1 after USB disconnects), +at this point, if references shost again, system will show following +warning msg. + +To make scsi_autopm_put_host(shost) always reference a valid shost, +put it just before scsi_host_put() in function +scsi_finish_async_scan(). + +[ 299.281565] ============================================================================= +[ 299.281634] BUG kmalloc-4096 (Tainted: G I ): Poison overwritten +[ 299.281682] ----------------------------------------------------------------------------- +[ 299.281684] +[ 299.281752] INFO: 0xffff880056c305d0-0xffff880056c305d0. First byte +0x6a instead of 0x6b +[ 299.281816] INFO: Allocated in scsi_host_alloc+0x4a/0x490 age=1688 +cpu=1 pid=2004 +[ 299.281870] __slab_alloc+0x617/0x6c1 +[ 299.281901] __kmalloc+0x28c/0x2e0 +[ 299.281931] scsi_host_alloc+0x4a/0x490 +[ 299.281966] usb_stor_probe1+0x5b/0xc40 [usb_storage] +[ 299.282010] storage_probe+0xa4/0xe0 [usb_storage] +[ 299.282062] usb_probe_interface+0x172/0x330 [usbcore] +[ 299.282105] driver_probe_device+0x257/0x3b0 +[ 299.282138] __driver_attach+0x103/0x110 +[ 299.282171] bus_for_each_dev+0x8e/0xe0 +[ 299.282201] driver_attach+0x26/0x30 +[ 299.282230] bus_add_driver+0x1c4/0x430 +[ 299.282260] driver_register+0xb6/0x230 +[ 299.282298] usb_register_driver+0xe5/0x270 [usbcore] +[ 299.282337] 0xffffffffa04ab03d +[ 299.282364] do_one_initcall+0x47/0x230 +[ 299.282396] sys_init_module+0xa0f/0x1fe0 +[ 299.282429] INFO: Freed in scsi_host_dev_release+0x18a/0x1d0 age=85 +cpu=0 pid=2008 +[ 299.282482] __slab_free+0x3c/0x2a1 +[ 299.282510] kfree+0x296/0x310 +[ 299.282536] scsi_host_dev_release+0x18a/0x1d0 +[ 299.282574] device_release+0x74/0x100 +[ 299.282606] kobject_release+0xc7/0x2a0 +[ 299.282637] kobject_put+0x54/0xa0 +[ 299.282668] put_device+0x27/0x40 +[ 299.282694] scsi_host_put+0x1d/0x30 +[ 299.282723] do_scan_async+0x1fc/0x2b0 +[ 299.282753] kthread+0xdf/0xf0 +[ 299.282782] kernel_thread_helper+0x4/0x10 +[ 299.282817] INFO: Slab 0xffffea00015b0c00 objects=7 used=7 fp=0x + (null) flags=0x100000000004080 +[ 299.282882] INFO: Object 0xffff880056c30000 @offset=0 fp=0x (null) +[ 299.282884] +... + +Signed-off-by: Huajun Li +Acked-by: Alan Stern +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_scan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struc + } + spin_unlock(&async_scan_lock); + ++ scsi_autopm_put_host(shost); + scsi_host_put(shost); + kfree(data); + } +@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data) + + do_scsi_scan_host(shost); + scsi_finish_async_scan(data); +- scsi_autopm_put_host(shost); + return 0; + } + +@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *sh + p = kthread_run(do_scan_async, data, "scsi_scan_%d", shost->host_no); + if (IS_ERR(p)) + do_scan_async(data); +- /* scsi_autopm_put_host(shost) is called in do_scan_async() */ ++ /* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */ + } + EXPORT_SYMBOL(scsi_scan_host); + diff --git a/queue-3.2/series b/queue-3.2/series index 98477738193..fc9267e3705 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -54,3 +54,14 @@ arm-omap-fix-oops-in-drivers-video-omap2-dss-dpi.c.patch arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch +genirq-unmask-oneshot-irqs-when-thread-was-not-woken.patch +genirq-handle-pending-irqs-in-irq_startup.patch +scsi_scan-fix-poison-overwritten-warning-caused-by-using-freed-shost.patch +scsi_pm-fix-bug-in-the-scsi-power-management-handler.patch +ipvs-fix-matching-of-fwmark-templates-during-scheduling.patch +jme-fix-fifo-flush-issue.patch +davinci_emac-do-not-free-all-rx-dma-descriptors-during-init.patch +builddeb-don-t-create-files-in-tmp-with-predictable-names.patch +can-sja1000-fix-isr-hang-when-hw-is-unplugged-under-load.patch +hdpvr-fix-race-conditon-during-start-of-streaming.patch +imon-don-t-wedge-hardware-after-early-callbacks.patch