From: Greg Kroah-Hartman Date: Wed, 17 Jul 2013 20:04:06 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.9.11~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d8a3319cc263f96f49deefa58c0ada22bfc95d47;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: cgroup-fix-rcu-accesses-to-task-cgroups.patch cgroup-fix-umount-vs-cgroup_event_remove-race.patch cifs-fix-a-deadlock-when-a-file-is-reopened.patch drivers-hv-switch-to-use-mb-instead-of-smp_mb.patch ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch ext4-check-error-return-from-ext4_write_inline_data_end.patch ext4-fix-corruption-when-online-resizing-a-fs-with-1k-block-size.patch jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch jbd2-move-superblock-checksum-calculation-to-jbd2_write_superblock.patch pch_uart-add-uart_clk-selection-for-the-minnowboard.patch pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch rtlwifi-rtl8192cu-add-new-usb-id-for-tp-link-tl-wn8200nd.patch rtlwifi-rtl8192cu-fix-duplicate-if-test.patch rtlwifi-rtl8723ae-fix-typo-in-firmware-names.patch usb-ehci-omap-tweak-phy-initialization-sequence.patch usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch usb-host-xhci-plat-release-mem-region-while-removing-module.patch usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch xhci-check-for-failed-dma-pool-allocation.patch --- diff --git a/queue-3.10/cgroup-fix-rcu-accesses-to-task-cgroups.patch b/queue-3.10/cgroup-fix-rcu-accesses-to-task-cgroups.patch new file mode 100644 index 00000000000..397236208d5 --- /dev/null +++ b/queue-3.10/cgroup-fix-rcu-accesses-to-task-cgroups.patch @@ -0,0 +1,111 @@ +From 14611e51a57df10240817d8ada510842faf0ec51 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 25 Jun 2013 11:48:32 -0700 +Subject: cgroup: fix RCU accesses to task->cgroups + +From: Tejun Heo + +commit 14611e51a57df10240817d8ada510842faf0ec51 upstream. + +task->cgroups is a RCU pointer pointing to struct css_set. A task +switches to a different css_set on cgroup migration but a css_set +doesn't change once created and its pointers to cgroup_subsys_states +aren't RCU protected. + +task_subsys_state[_check]() is the macro to acquire css given a task +and subsys_id pair. It RCU-dereferences task->cgroups->subsys[] not +task->cgroups, so the RCU pointer task->cgroups ends up being +dereferenced without read_barrier_depends() after it. It's broken. + +Fix it by introducing task_css_set[_check]() which does +RCU-dereference on task->cgroups. task_subsys_state[_check]() is +reimplemented to directly dereference ->subsys[] of the css_set +returned from task_css_set[_check](). + +This removes some of sparse RCU warnings in cgroup. + +v2: Fixed unbalanced parenthsis and there's no need to use + rcu_dereference_raw() when !CONFIG_PROVE_RCU. Both spotted by Li. + +Signed-off-by: Tejun Heo +Reported-by: Fengguang Wu +Acked-by: Li Zefan +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/cgroup.h | 58 ++++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 48 insertions(+), 10 deletions(-) + +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -646,22 +646,60 @@ static inline struct cgroup_subsys_state + return cgrp->subsys[subsys_id]; + } + +-/* +- * function to get the cgroup_subsys_state which allows for extra +- * rcu_dereference_check() conditions, such as locks used during the +- * cgroup_subsys::attach() methods. ++/** ++ * task_css_set_check - obtain a task's css_set with extra access conditions ++ * @task: the task to obtain css_set for ++ * @__c: extra condition expression to be passed to rcu_dereference_check() ++ * ++ * A task's css_set is RCU protected, initialized and exited while holding ++ * task_lock(), and can only be modified while holding both cgroup_mutex ++ * and task_lock() while the task is alive. This macro verifies that the ++ * caller is inside proper critical section and returns @task's css_set. ++ * ++ * The caller can also specify additional allowed conditions via @__c, such ++ * as locks used during the cgroup_subsys::attach() methods. + */ + #ifdef CONFIG_PROVE_RCU + extern struct mutex cgroup_mutex; +-#define task_subsys_state_check(task, subsys_id, __c) \ +- rcu_dereference_check((task)->cgroups->subsys[(subsys_id)], \ +- lockdep_is_held(&(task)->alloc_lock) || \ +- lockdep_is_held(&cgroup_mutex) || (__c)) ++#define task_css_set_check(task, __c) \ ++ rcu_dereference_check((task)->cgroups, \ ++ lockdep_is_held(&(task)->alloc_lock) || \ ++ lockdep_is_held(&cgroup_mutex) || (__c)) + #else +-#define task_subsys_state_check(task, subsys_id, __c) \ +- rcu_dereference((task)->cgroups->subsys[(subsys_id)]) ++#define task_css_set_check(task, __c) \ ++ rcu_dereference((task)->cgroups) + #endif + ++/** ++ * task_subsys_state_check - obtain css for (task, subsys) w/ extra access conds ++ * @task: the target task ++ * @subsys_id: the target subsystem ID ++ * @__c: extra condition expression to be passed to rcu_dereference_check() ++ * ++ * Return the cgroup_subsys_state for the (@task, @subsys_id) pair. The ++ * synchronization rules are the same as task_css_set_check(). ++ */ ++#define task_subsys_state_check(task, subsys_id, __c) \ ++ task_css_set_check((task), (__c))->subsys[(subsys_id)] ++ ++/** ++ * task_css_set - obtain a task's css_set ++ * @task: the task to obtain css_set for ++ * ++ * See task_css_set_check(). ++ */ ++static inline struct css_set *task_css_set(struct task_struct *task) ++{ ++ return task_css_set_check(task, false); ++} ++ ++/** ++ * task_subsys_state - obtain css for (task, subsys) ++ * @task: the target task ++ * @subsys_id: the target subsystem ID ++ * ++ * See task_subsys_state_check(). ++ */ + static inline struct cgroup_subsys_state * + task_subsys_state(struct task_struct *task, int subsys_id) + { diff --git a/queue-3.10/cgroup-fix-umount-vs-cgroup_event_remove-race.patch b/queue-3.10/cgroup-fix-umount-vs-cgroup_event_remove-race.patch new file mode 100644 index 00000000000..38338d7f7da --- /dev/null +++ b/queue-3.10/cgroup-fix-umount-vs-cgroup_event_remove-race.patch @@ -0,0 +1,75 @@ +From 1c8158eeae0f37d0eee9f1fbe68080df6a408df2 Mon Sep 17 00:00:00 2001 +From: Li Zefan +Date: Tue, 18 Jun 2013 18:41:10 +0800 +Subject: cgroup: fix umount vs cgroup_event_remove() race + +From: Li Zefan + +commit 1c8158eeae0f37d0eee9f1fbe68080df6a408df2 upstream. + + commit 5db9a4d99b0157a513944e9a44d29c9cec2e91dc + Author: Tejun Heo + Date: Sat Jul 7 16:08:18 2012 -0700 + + cgroup: fix cgroup hierarchy umount race + +This commit fixed a race caused by the dput() in css_dput_fn(), but +the dput() in cgroup_event_remove() can also lead to the same BUG(). + +Signed-off-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -3727,6 +3727,23 @@ static int cgroup_write_notify_on_releas + } + + /* ++ * When dput() is called asynchronously, if umount has been done and ++ * then deactivate_super() in cgroup_free_fn() kills the superblock, ++ * there's a small window that vfs will see the root dentry with non-zero ++ * refcnt and trigger BUG(). ++ * ++ * That's why we hold a reference before dput() and drop it right after. ++ */ ++static void cgroup_dput(struct cgroup *cgrp) ++{ ++ struct super_block *sb = cgrp->root->sb; ++ ++ atomic_inc(&sb->s_active); ++ dput(cgrp->dentry); ++ deactivate_super(sb); ++} ++ ++/* + * Unregister event and free resources. + * + * Gets called from workqueue. +@@ -3746,7 +3763,7 @@ static void cgroup_event_remove(struct w + + eventfd_ctx_put(event->eventfd); + kfree(event); +- dput(cgrp->dentry); ++ cgroup_dput(cgrp); + } + + /* +@@ -4031,12 +4048,8 @@ static void css_dput_fn(struct work_stru + { + struct cgroup_subsys_state *css = + container_of(work, struct cgroup_subsys_state, dput_work); +- struct dentry *dentry = css->cgroup->dentry; +- struct super_block *sb = dentry->d_sb; + +- atomic_inc(&sb->s_active); +- dput(dentry); +- deactivate_super(sb); ++ cgroup_dput(css->cgroup); + } + + static void init_cgroup_css(struct cgroup_subsys_state *css, diff --git a/queue-3.10/cifs-fix-a-deadlock-when-a-file-is-reopened.patch b/queue-3.10/cifs-fix-a-deadlock-when-a-file-is-reopened.patch new file mode 100644 index 00000000000..62bb933460e --- /dev/null +++ b/queue-3.10/cifs-fix-a-deadlock-when-a-file-is-reopened.patch @@ -0,0 +1,51 @@ +From 689c3db4d57a73bee6c5ad7797fce7b54d32a87c Mon Sep 17 00:00:00 2001 +From: Pavel Shilovsky +Date: Thu, 11 Jul 2013 11:17:45 +0400 +Subject: CIFS: Fix a deadlock when a file is reopened + +From: Pavel Shilovsky + +commit 689c3db4d57a73bee6c5ad7797fce7b54d32a87c upstream. + +If we request reading or writing on a file that needs to be +reopened, it causes the deadlock: we are already holding rw +semaphore for reading and then we try to acquire it for writing +in cifs_relock_file. Fix this by acquiring the semaphore for +reading in cifs_relock_file due to we don't make any changes in +locks and don't need a write access. + +Signed-off-by: Pavel Shilovsky +Acked-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/file.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -553,11 +553,10 @@ cifs_relock_file(struct cifsFileInfo *cf + struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); + int rc = 0; + +- /* we are going to update can_cache_brlcks here - need a write access */ +- down_write(&cinode->lock_sem); ++ down_read(&cinode->lock_sem); + if (cinode->can_cache_brlcks) { +- /* can cache locks - no need to push them */ +- up_write(&cinode->lock_sem); ++ /* can cache locks - no need to relock */ ++ up_read(&cinode->lock_sem); + return rc; + } + +@@ -568,7 +567,7 @@ cifs_relock_file(struct cifsFileInfo *cf + else + rc = tcon->ses->server->ops->push_mand_locks(cfile); + +- up_write(&cinode->lock_sem); ++ up_read(&cinode->lock_sem); + return rc; + } + diff --git a/queue-3.10/drivers-hv-switch-to-use-mb-instead-of-smp_mb.patch b/queue-3.10/drivers-hv-switch-to-use-mb-instead-of-smp_mb.patch new file mode 100644 index 00000000000..6f1944d8c45 --- /dev/null +++ b/queue-3.10/drivers-hv-switch-to-use-mb-instead-of-smp_mb.patch @@ -0,0 +1,81 @@ +From 35848f68b07df3f917cb13fc3c134718669f569b Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Tue, 18 Jun 2013 13:04:23 +0800 +Subject: drivers: hv: switch to use mb() instead of smp_mb() + +From: Jason Wang + +commit 35848f68b07df3f917cb13fc3c134718669f569b upstream. + +Even if guest were compiled without SMP support, it could not assume that host +wasn't. So switch to use mb() instead of smp_mb() to force memory barriers for +UP guest. + +Signed-off-by: Jason Wang +Cc: Haiyang Zhang +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/ring_buffer.c | 10 +++++----- + drivers/hv/vmbus_drv.c | 2 +- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/hv/ring_buffer.c ++++ b/drivers/hv/ring_buffer.c +@@ -32,7 +32,7 @@ + void hv_begin_read(struct hv_ring_buffer_info *rbi) + { + rbi->ring_buffer->interrupt_mask = 1; +- smp_mb(); ++ mb(); + } + + u32 hv_end_read(struct hv_ring_buffer_info *rbi) +@@ -41,7 +41,7 @@ u32 hv_end_read(struct hv_ring_buffer_in + u32 write; + + rbi->ring_buffer->interrupt_mask = 0; +- smp_mb(); ++ mb(); + + /* + * Now check to see if the ring buffer is still empty. +@@ -71,7 +71,7 @@ u32 hv_end_read(struct hv_ring_buffer_in + + static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi) + { +- smp_mb(); ++ mb(); + if (rbi->ring_buffer->interrupt_mask) + return false; + +@@ -442,7 +442,7 @@ int hv_ringbuffer_write(struct hv_ring_b + sizeof(u64)); + + /* Issue a full memory barrier before updating the write index */ +- smp_mb(); ++ mb(); + + /* Now, update the write location */ + hv_set_next_write_location(outring_info, next_write_location); +@@ -549,7 +549,7 @@ int hv_ringbuffer_read(struct hv_ring_bu + /* Make sure all reads are done before we update the read index since */ + /* the writer may start writing to the read area once the read index */ + /*is updated */ +- smp_mb(); ++ mb(); + + /* Update the read index */ + hv_set_next_read_location(inring_info, next_read_location); +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -434,7 +434,7 @@ static void vmbus_on_msg_dpc(unsigned lo + * will not deliver any more messages since there is + * no empty slot + */ +- smp_mb(); ++ mb(); + + if (msg->header.message_flags.msg_pending) { + /* diff --git a/queue-3.10/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch b/queue-3.10/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch new file mode 100644 index 00000000000..1b148b82b84 --- /dev/null +++ b/queue-3.10/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch @@ -0,0 +1,55 @@ +From 64cb927371cd2ec43758d8a094a003d27bc3d0dc Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Mon, 1 Jul 2013 08:12:38 -0400 +Subject: ext3,ext4: don't mess with dir_file->f_pos in htree_dirblock_to_tree() + +From: Al Viro + +commit 64cb927371cd2ec43758d8a094a003d27bc3d0dc upstream. + +Both ext3 and ext4 htree_dirblock_to_tree() is just filling the +in-core rbtree for use by call_filldir(). All updates of ->f_pos are +done by the latter; bumping it here (on error) is obviously wrong - we +might very well have it nowhere near the block we'd found an error in. + +Signed-off-by: Al Viro +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/namei.c | 7 ++----- + fs/ext4/namei.c | 7 ++----- + 2 files changed, 4 insertions(+), 10 deletions(-) + +--- a/fs/ext3/namei.c ++++ b/fs/ext3/namei.c +@@ -576,11 +576,8 @@ static int htree_dirblock_to_tree(struct + if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh, + (block<i_sb)) + +((char *)de - bh->b_data))) { +- /* On error, skip the f_pos to the next block. */ +- dir_file->f_pos = (dir_file->f_pos | +- (dir->i_sb->s_blocksize - 1)) + 1; +- brelse (bh); +- return count; ++ /* silently ignore the rest of the block */ ++ break; + } + ext3fs_dirhash(de->name, de->name_len, hinfo); + if ((hinfo->hash < start_hash) || +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -918,11 +918,8 @@ static int htree_dirblock_to_tree(struct + bh->b_data, bh->b_size, + (block<i_sb)) + + ((char *)de - bh->b_data))) { +- /* On error, skip the f_pos to the next block. */ +- dir_file->f_pos = (dir_file->f_pos | +- (dir->i_sb->s_blocksize - 1)) + 1; +- brelse(bh); +- return count; ++ /* silently ignore the rest of the block */ ++ break; + } + ext4fs_dirhash(de->name, de->name_len, hinfo); + if ((hinfo->hash < start_hash) || diff --git a/queue-3.10/ext4-check-error-return-from-ext4_write_inline_data_end.patch b/queue-3.10/ext4-check-error-return-from-ext4_write_inline_data_end.patch new file mode 100644 index 00000000000..d1f5c5f597f --- /dev/null +++ b/queue-3.10/ext4-check-error-return-from-ext4_write_inline_data_end.patch @@ -0,0 +1,41 @@ +From 42c832debbbf819f6c4ad8601baa559c44105ba4 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Mon, 1 Jul 2013 08:12:39 -0400 +Subject: ext4: check error return from ext4_write_inline_data_end() + +From: Theodore Ts'o + +commit 42c832debbbf819f6c4ad8601baa559c44105ba4 upstream. + +The function ext4_write_inline_data_end() can return an error. So we +need to assign it to a signed integer variable to check for an error +return (since copied is an unsigned int). + +Signed-off-by: "Theodore Ts'o" +Cc: Zheng Liu +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1118,10 +1118,13 @@ static int ext4_write_end(struct file *f + } + } + +- if (ext4_has_inline_data(inode)) +- copied = ext4_write_inline_data_end(inode, pos, len, +- copied, page); +- else ++ if (ext4_has_inline_data(inode)) { ++ ret = ext4_write_inline_data_end(inode, pos, len, ++ copied, page); ++ if (ret < 0) ++ goto errout; ++ copied = ret; ++ } else + copied = block_write_end(file, mapping, pos, + len, copied, page, fsdata); + diff --git a/queue-3.10/ext4-fix-corruption-when-online-resizing-a-fs-with-1k-block-size.patch b/queue-3.10/ext4-fix-corruption-when-online-resizing-a-fs-with-1k-block-size.patch new file mode 100644 index 00000000000..b89b141f883 --- /dev/null +++ b/queue-3.10/ext4-fix-corruption-when-online-resizing-a-fs-with-1k-block-size.patch @@ -0,0 +1,39 @@ +From 6ca792edc13c409e8d4eb9001e048264c6a2eb64 Mon Sep 17 00:00:00 2001 +From: Maarten ter Huurne +Date: Mon, 1 Jul 2013 08:12:08 -0400 +Subject: ext4: fix corruption when online resizing a fs with 1K block size + +From: Maarten ter Huurne + +commit 6ca792edc13c409e8d4eb9001e048264c6a2eb64 upstream. + +Subtracting the number of the first data block places the superblock +backups one block too early, corrupting the file system. When the block +size is larger than 1K, the first data block is 0, so the subtraction +has no effect and no corruption occurs. + +Signed-off-by: Maarten ter Huurne +Signed-off-by: "Theodore Ts'o" +Reviewed-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/resize.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1656,12 +1656,10 @@ errout: + err = err2; + + if (!err) { +- ext4_fsblk_t first_block; +- first_block = ext4_group_first_block_no(sb, 0); + if (test_opt(sb, DEBUG)) + printk(KERN_DEBUG "EXT4-fs: extended group to %llu " + "blocks\n", ext4_blocks_count(es)); +- update_backups(sb, EXT4_SB(sb)->s_sbh->b_blocknr - first_block, ++ update_backups(sb, EXT4_SB(sb)->s_sbh->b_blocknr, + (char *)es, sizeof(struct ext4_super_block), 0); + } + return err; diff --git a/queue-3.10/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch b/queue-3.10/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch new file mode 100644 index 00000000000..8cc208108f2 --- /dev/null +++ b/queue-3.10/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch @@ -0,0 +1,46 @@ +From 39c04153fda8c32e85b51c96eb5511a326ad7609 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Mon, 1 Jul 2013 08:12:40 -0400 +Subject: jbd2: fix theoretical race in jbd2__journal_restart + +From: Theodore Ts'o + +commit 39c04153fda8c32e85b51c96eb5511a326ad7609 upstream. + +Once we decrement transaction->t_updates, if this is the last handle +holding the transaction from closing, and once we release the +t_handle_lock spinlock, it's possible for the transaction to commit +and be released. In practice with normal kernels, this probably won't +happen, since the commit happens in a separate kernel thread and it's +unlikely this could all happen within the space of a few CPU cycles. + +On the other hand, with a real-time kernel, this could potentially +happen, so save the tid found in transaction->t_tid before we release +t_handle_lock. It would require an insane configuration, such as one +where the jbd2 thread was set to a very high real-time priority, +perhaps because a high priority real-time thread is trying to read or +write to a file system. But some people who use real-time kernels +have been known to do insane things, including controlling +laser-wielding industrial robots. :-) + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/transaction.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -517,10 +517,10 @@ int jbd2__journal_restart(handle_t *hand + &transaction->t_outstanding_credits); + if (atomic_dec_and_test(&transaction->t_updates)) + wake_up(&journal->j_wait_updates); ++ tid = transaction->t_tid; + spin_unlock(&transaction->t_handle_lock); + + jbd_debug(2, "restarting handle %p\n", handle); +- tid = transaction->t_tid; + need_to_start = !tid_geq(journal->j_commit_request, tid); + read_unlock(&journal->j_state_lock); + if (need_to_start) diff --git a/queue-3.10/jbd2-move-superblock-checksum-calculation-to-jbd2_write_superblock.patch b/queue-3.10/jbd2-move-superblock-checksum-calculation-to-jbd2_write_superblock.patch new file mode 100644 index 00000000000..41f4929af36 --- /dev/null +++ b/queue-3.10/jbd2-move-superblock-checksum-calculation-to-jbd2_write_superblock.patch @@ -0,0 +1,48 @@ +From fe52d17cdd343ac43c85cf72940a58865b9d3bfb Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Mon, 1 Jul 2013 08:12:38 -0400 +Subject: jbd2: move superblock checksum calculation to jbd2_write_superblock() + +From: Theodore Ts'o + +commit fe52d17cdd343ac43c85cf72940a58865b9d3bfb upstream. + +Some of the functions which modify the jbd2 superblock were not +updating the checksum before calling jbd2_write_superblock(). Move +the call to jbd2_superblock_csum_set() to jbd2_write_superblock(), so +that the checksum is calculated consistently. + +Signed-off-by: "Theodore Ts'o" +Cc: Darrick J. Wong +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1318,6 +1318,7 @@ static int journal_reset(journal_t *jour + static void jbd2_write_superblock(journal_t *journal, int write_op) + { + struct buffer_head *bh = journal->j_sb_buffer; ++ journal_superblock_t *sb = journal->j_superblock; + int ret; + + trace_jbd2_write_superblock(journal, write_op); +@@ -1339,6 +1340,7 @@ static void jbd2_write_superblock(journa + clear_buffer_write_io_error(bh); + set_buffer_uptodate(bh); + } ++ jbd2_superblock_csum_set(journal, sb); + get_bh(bh); + bh->b_end_io = end_buffer_write_sync; + ret = submit_bh(write_op, bh); +@@ -1435,7 +1437,6 @@ void jbd2_journal_update_sb_errno(journa + jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", + journal->j_errno); + sb->s_errno = cpu_to_be32(journal->j_errno); +- jbd2_superblock_csum_set(journal, sb); + read_unlock(&journal->j_state_lock); + + jbd2_write_superblock(journal, WRITE_SYNC); diff --git a/queue-3.10/pch_uart-add-uart_clk-selection-for-the-minnowboard.patch b/queue-3.10/pch_uart-add-uart_clk-selection-for-the-minnowboard.patch new file mode 100644 index 00000000000..806b9aee9ba --- /dev/null +++ b/queue-3.10/pch_uart-add-uart_clk-selection-for-the-minnowboard.patch @@ -0,0 +1,45 @@ +From 29692d05647cb7ecea56242241f77291d5624b95 Mon Sep 17 00:00:00 2001 +From: Darren Hart +Date: Tue, 25 Jun 2013 18:53:22 -0700 +Subject: pch_uart: Add uart_clk selection for the MinnowBoard + +From: Darren Hart + +commit 29692d05647cb7ecea56242241f77291d5624b95 upstream. + +Use DMI_BOARD_NAME to determine if we are running on a MinnowBoard and +set the uart clock to 50MHz if so. This removes the need to pass the +user_uartclk to the kernel at boot time. + +Signed-off-by: Darren Hart +Cc: Jiri Slaby +Cc: "H. Peter Anvin" +Cc: Peter Waskiewicz +Cc: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/pch_uart.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -217,6 +217,7 @@ enum { + #define FRI2_64_UARTCLK 64000000 /* 64.0000 MHz */ + #define FRI2_48_UARTCLK 48000000 /* 48.0000 MHz */ + #define NTC1_UARTCLK 64000000 /* 64.0000 MHz */ ++#define MINNOW_UARTCLK 50000000 /* 50.0000 MHz */ + + struct pch_uart_buffer { + unsigned char *buf; +@@ -398,6 +399,10 @@ static int pch_uart_get_uartclk(void) + strstr(cmp, "nanoETXexpress-TT"))) + return NTC1_UARTCLK; + ++ cmp = dmi_get_system_info(DMI_BOARD_NAME); ++ if (cmp && strstr(cmp, "MinnowBoard")) ++ return MINNOW_UARTCLK; ++ + return DEFAULT_UARTCLK; + } + diff --git a/queue-3.10/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch b/queue-3.10/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch new file mode 100644 index 00000000000..3fb40a3fe86 --- /dev/null +++ b/queue-3.10/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch @@ -0,0 +1,36 @@ +From e39506b466edcda2a7e9d0174d7987ae654137b7 Mon Sep 17 00:00:00 2001 +From: Joachim Eastwood +Date: Thu, 6 Jun 2013 10:24:14 +0200 +Subject: pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status + +From: Joachim Eastwood + +commit e39506b466edcda2a7e9d0174d7987ae654137b7 upstream. + +Commit 80af9e6d (pcmcia at91_cf: fix raw gpio number usage) forgot +to change the parameter in gpio_get_value after adding gpio +validation. + +Signed-off-by: Joachim Eastwood +Signed-off-by: Nicolas Ferre +Acked-by: Jean-Christophe PLAGNIOL-VILLARD +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/at91_cf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pcmcia/at91_cf.c ++++ b/drivers/pcmcia/at91_cf.c +@@ -100,9 +100,9 @@ static int at91_cf_get_status(struct pcm + int vcc = gpio_is_valid(cf->board->vcc_pin); + + *sp = SS_DETECT | SS_3VCARD; +- if (!rdy || gpio_get_value(rdy)) ++ if (!rdy || gpio_get_value(cf->board->irq_pin)) + *sp |= SS_READY; +- if (!vcc || gpio_get_value(vcc)) ++ if (!vcc || gpio_get_value(cf->board->vcc_pin)) + *sp |= SS_POWERON; + } else + *sp = 0; diff --git a/queue-3.10/rtlwifi-rtl8192cu-add-new-usb-id-for-tp-link-tl-wn8200nd.patch b/queue-3.10/rtlwifi-rtl8192cu-add-new-usb-id-for-tp-link-tl-wn8200nd.patch new file mode 100644 index 00000000000..a9cfd080155 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-add-new-usb-id-for-tp-link-tl-wn8200nd.patch @@ -0,0 +1,31 @@ +From c4d827c5ccc3a49227dbf9d4b248a2e86f388023 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 17 Jun 2013 13:25:49 -0500 +Subject: rtlwifi: rtl8192cu: Add new USB ID for TP-Link TL-WN8200ND + +From: Larry Finger + +commit c4d827c5ccc3a49227dbf9d4b248a2e86f388023 upstream. + +This is a new device for this driver. + +Reported-by: Tobias Kluge +Signed-off-by: Larry Finger +Cc: Tobias Kluge +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +@@ -359,6 +359,7 @@ static struct usb_device_id rtl8192c_usb + {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ + {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ + {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ ++ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ + {RTL_USB_DEVICE(0x7392, 0x7822, rtl92cu_hal_cfg)}, /*Edimax -Edimax*/ + {} + }; diff --git a/queue-3.10/rtlwifi-rtl8192cu-fix-duplicate-if-test.patch b/queue-3.10/rtlwifi-rtl8192cu-fix-duplicate-if-test.patch new file mode 100644 index 00000000000..339a2e7debf --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8192cu-fix-duplicate-if-test.patch @@ -0,0 +1,37 @@ +From 10d0b9030a3f86e1e26c710c7580524d7787d688 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 18 Jun 2013 13:25:05 -0500 +Subject: rtlwifi: rtl8192cu: Fix duplicate if test + +From: Larry Finger + +commit 10d0b9030a3f86e1e26c710c7580524d7787d688 upstream. + +A typo causes routine rtl92cu_phy_rf6052_set_cck_txpower() to test the +same condition twice. The problem was found using cppcheck-1.49, and the +proper fix was verified against the pre-mac80211 version of the code. + +This patch was originally included as commit 1288aa4, but was accidentally +reverted in a later patch. + +Reported-by: David Binderman [original report] +Reported-by: Andrea Morello [report of accidental reversion] +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c +@@ -104,7 +104,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower( + tx_agc[RF90_PATH_A] = 0x10101010; + tx_agc[RF90_PATH_B] = 0x10101010; + } else if (rtlpriv->dm.dynamic_txhighpower_lvl == +- TXHIGHPWRLEVEL_LEVEL1) { ++ TXHIGHPWRLEVEL_LEVEL2) { + tx_agc[RF90_PATH_A] = 0x00000000; + tx_agc[RF90_PATH_B] = 0x00000000; + } else{ diff --git a/queue-3.10/rtlwifi-rtl8723ae-fix-typo-in-firmware-names.patch b/queue-3.10/rtlwifi-rtl8723ae-fix-typo-in-firmware-names.patch new file mode 100644 index 00000000000..d6234ea19a3 --- /dev/null +++ b/queue-3.10/rtlwifi-rtl8723ae-fix-typo-in-firmware-names.patch @@ -0,0 +1,43 @@ +From 73e088ed17c2880a963cc760a78af8a06d4a4d9d Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 23 Jun 2013 18:14:43 -0500 +Subject: rtlwifi: rtl8723ae: Fix typo in firmware names + +From: Larry Finger + +commit 73e088ed17c2880a963cc760a78af8a06d4a4d9d upstream. + +The driver loads its firmware from files rtlwifi/rtl8723fw*.bin, but the +MODULE_FIRMWARE macros refer to rtlwifi/RTL8723aefw*.bin. + +Signed-off-by: Larry Finger +Reported-by: Axel Köllhofer +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8723ae/sw.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c +@@ -251,7 +251,7 @@ static struct rtl_hal_cfg rtl8723ae_hal_ + .bar_id = 2, + .write_readback = true, + .name = "rtl8723ae_pci", +- .fw_name = "rtlwifi/rtl8723aefw.bin", ++ .fw_name = "rtlwifi/rtl8723fw.bin", + .ops = &rtl8723ae_hal_ops, + .mod_params = &rtl8723ae_mod_params, + .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL, +@@ -353,8 +353,8 @@ MODULE_AUTHOR("Realtek WlanFAE "); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Realtek 8723E 802.11n PCI wireless"); +-MODULE_FIRMWARE("rtlwifi/rtl8723aefw.bin"); +-MODULE_FIRMWARE("rtlwifi/rtl8723aefw_B.bin"); ++MODULE_FIRMWARE("rtlwifi/rtl8723fw.bin"); ++MODULE_FIRMWARE("rtlwifi/rtl8723fw_B.bin"); + + module_param_named(swenc, rtl8723ae_mod_params.sw_crypto, bool, 0444); + module_param_named(debug, rtl8723ae_mod_params.debug, int, 0444); diff --git a/queue-3.10/series b/queue-3.10/series index f1c5d1dfa7b..063b6ee9983 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -1 +1,20 @@ cifs-use-sensible-file-nlink-values-if-unprovided.patch +cifs-fix-a-deadlock-when-a-file-is-reopened.patch +rtlwifi-rtl8192cu-add-new-usb-id-for-tp-link-tl-wn8200nd.patch +rtlwifi-rtl8723ae-fix-typo-in-firmware-names.patch +rtlwifi-rtl8192cu-fix-duplicate-if-test.patch +jbd2-move-superblock-checksum-calculation-to-jbd2_write_superblock.patch +jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch +ext4-fix-corruption-when-online-resizing-a-fs-with-1k-block-size.patch +ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch +ext4-check-error-return-from-ext4_write_inline_data_end.patch +pch_uart-add-uart_clk-selection-for-the-minnowboard.patch +usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch +usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch +usb-ehci-omap-tweak-phy-initialization-sequence.patch +xhci-check-for-failed-dma-pool-allocation.patch +usb-host-xhci-plat-release-mem-region-while-removing-module.patch +drivers-hv-switch-to-use-mb-instead-of-smp_mb.patch +pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch +cgroup-fix-umount-vs-cgroup_event_remove-race.patch +cgroup-fix-rcu-accesses-to-task-cgroups.patch diff --git a/queue-3.10/usb-ehci-omap-tweak-phy-initialization-sequence.patch b/queue-3.10/usb-ehci-omap-tweak-phy-initialization-sequence.patch new file mode 100644 index 00000000000..817cafea895 --- /dev/null +++ b/queue-3.10/usb-ehci-omap-tweak-phy-initialization-sequence.patch @@ -0,0 +1,61 @@ +From 4e5c9e6fa2d232a0686d5fe45cd1508484048936 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Fri, 14 Jun 2013 16:52:07 +0300 +Subject: USB: ehci-omap: Tweak PHY initialization sequence + +From: Roger Quadros + +commit 4e5c9e6fa2d232a0686d5fe45cd1508484048936 upstream. + +For PHY mode, the PHYs must be brought out of reset +before the EHCI controller is started. + +This patch fixes the issue where USB devices are not found +on Beagleboard/Beagle-xm if USB has been started previously +by the bootloader. (e.g. by "usb start" command in u-boot) + +Tested on Beagleboard, Beagleboard-xm and Pandaboard. + +Issue present on 3.10 onwards. + +Reported-by: Tomi Valkeinen +Tested-by: Tomi Valkeinen +Signed-off-by: Roger Quadros +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-omap.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ehci-omap.c ++++ b/drivers/usb/host/ehci-omap.c +@@ -187,6 +187,12 @@ static int ehci_hcd_omap_probe(struct pl + } + + omap->phy[i] = phy; ++ ++ if (pdata->port_mode[i] == OMAP_EHCI_PORT_MODE_PHY) { ++ usb_phy_init(omap->phy[i]); ++ /* bring PHY out of suspend */ ++ usb_phy_set_suspend(omap->phy[i], 0); ++ } + } + + pm_runtime_enable(dev); +@@ -211,13 +217,14 @@ static int ehci_hcd_omap_probe(struct pl + } + + /* +- * Bring PHYs out of reset. ++ * Bring PHYs out of reset for non PHY modes. + * Even though HSIC mode is a PHY-less mode, the reset + * line exists between the chips and can be modelled + * as a PHY device for reset control. + */ + for (i = 0; i < omap->nports; i++) { +- if (!omap->phy[i]) ++ if (!omap->phy[i] || ++ pdata->port_mode[i] == OMAP_EHCI_PORT_MODE_PHY) + continue; + + usb_phy_init(omap->phy[i]); diff --git a/queue-3.10/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch b/queue-3.10/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch new file mode 100644 index 00000000000..335d2d3ca85 --- /dev/null +++ b/queue-3.10/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch @@ -0,0 +1,48 @@ +From d68c277b501889b3a50c179d1c3d704db7947b83 Mon Sep 17 00:00:00 2001 +From: UCHINO Satoshi +Date: Thu, 23 May 2013 11:10:11 +0900 +Subject: usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed + +From: UCHINO Satoshi + +commit d68c277b501889b3a50c179d1c3d704db7947b83 upstream. + +Without this memory barrier, the file-storage thread may fail to +escape from the following while loop, because it may observe new +common->thread_wakeup_needed and old bh->state which are updated by +the callback functions. + + /* Wait for the CBW to arrive */ + while (bh->state != BUF_STATE_FULL) { + rc = sleep_thread(common); + if (rc) + return rc; + } + +Signed-off-by: UCHINO Satoshi +Acked-by: Michal Nazarewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/f_mass_storage.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/f_mass_storage.c ++++ b/drivers/usb/gadget/f_mass_storage.c +@@ -413,6 +413,7 @@ static int fsg_set_halt(struct fsg_dev * + /* Caller must hold fsg->lock */ + static void wakeup_thread(struct fsg_common *common) + { ++ smp_wmb(); /* ensure the write of bh->state is complete */ + /* Tell the main thread that something has happened */ + common->thread_wakeup_needed = 1; + if (common->thread_task) +@@ -632,6 +633,7 @@ static int sleep_thread(struct fsg_commo + } + __set_current_state(TASK_RUNNING); + common->thread_wakeup_needed = 0; ++ smp_rmb(); /* ensure the latest bh->state is visible */ + return rc; + } + diff --git a/queue-3.10/usb-host-xhci-plat-release-mem-region-while-removing-module.patch b/queue-3.10/usb-host-xhci-plat-release-mem-region-while-removing-module.patch new file mode 100644 index 00000000000..1a0cebcca0e --- /dev/null +++ b/queue-3.10/usb-host-xhci-plat-release-mem-region-while-removing-module.patch @@ -0,0 +1,30 @@ +From 5388a3a5faba8dfa69e5f06c3a415d373c1a4316 Mon Sep 17 00:00:00 2001 +From: George Cherian +Date: Fri, 21 Jun 2013 13:59:08 +0530 +Subject: usb: host: xhci-plat: release mem region while removing module + +From: George Cherian + +commit 5388a3a5faba8dfa69e5f06c3a415d373c1a4316 upstream. + +Do a release_mem_region of the hcd resource. Without this the +subsequent insertion of module fails in request_mem_region. + +Signed-off-by: George Cherian +Acked-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-plat.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -179,6 +179,7 @@ static int xhci_plat_remove(struct platf + + usb_remove_hcd(hcd); + iounmap(hcd->regs); ++ release_mem_region(hcd->rsrc_start, hcd->rsrc_len); + usb_put_hcd(hcd); + kfree(xhci); + diff --git a/queue-3.10/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch b/queue-3.10/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch new file mode 100644 index 00000000000..b96c8bd3a26 --- /dev/null +++ b/queue-3.10/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch @@ -0,0 +1,58 @@ +From a254810a86aaaac4ac6ba44fa934558b042a17a7 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 20 Jun 2013 16:07:40 -0500 +Subject: USB: option,qcserial: move Novatel Gobi1K IDs to qcserial + +From: Dan Williams + +commit a254810a86aaaac4ac6ba44fa934558b042a17a7 upstream. + +These devices are all Gobi1K devices (according to the Windows INF +files) and should be handled by qcserial instead of option. Their +network port is handled by qmi_wwan. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ---- + drivers/usb/serial/qcserial.c | 8 +++++++- + 2 files changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -159,8 +159,6 @@ static void option_instat_callback(struc + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000 + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001 + #define NOVATELWIRELESS_PRODUCT_E362 0x9010 +-#define NOVATELWIRELESS_PRODUCT_G1 0xA001 +-#define NOVATELWIRELESS_PRODUCT_G1_M 0xA002 + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 + #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 + +@@ -730,8 +728,6 @@ static const struct usb_device_id option + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC547) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) }, +- { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) }, +- { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) }, + /* Novatel Ovation MC551 a.k.a. Verizon USB551L */ + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -35,7 +35,13 @@ static const struct usb_device_id id_tab + {DEVICE_G1K(0x04da, 0x250c)}, /* Panasonic Gobi QDL device */ + {DEVICE_G1K(0x413c, 0x8172)}, /* Dell Gobi Modem device */ + {DEVICE_G1K(0x413c, 0x8171)}, /* Dell Gobi QDL device */ +- {DEVICE_G1K(0x1410, 0xa001)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa001)}, /* Novatel/Verizon USB-1000 */ ++ {DEVICE_G1K(0x1410, 0xa002)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa003)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa004)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa005)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa006)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa007)}, /* Novatel Gobi Modem device */ + {DEVICE_G1K(0x1410, 0xa008)}, /* Novatel Gobi QDL device */ + {DEVICE_G1K(0x0b05, 0x1776)}, /* Asus Gobi Modem device */ + {DEVICE_G1K(0x0b05, 0x1774)}, /* Asus Gobi QDL device */ diff --git a/queue-3.10/xhci-check-for-failed-dma-pool-allocation.patch b/queue-3.10/xhci-check-for-failed-dma-pool-allocation.patch new file mode 100644 index 00000000000..0111b5715b7 --- /dev/null +++ b/queue-3.10/xhci-check-for-failed-dma-pool-allocation.patch @@ -0,0 +1,38 @@ +From 025f880cb2e4d7218d0422d4b07bea1a68959c38 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 17 Jun 2013 09:56:33 -0700 +Subject: xhci: check for failed dma pool allocation + +From: Mathias Nyman + +commit 025f880cb2e4d7218d0422d4b07bea1a68959c38 upstream. + +Fail and free the container context in case dma_pool_alloc() can't allocate +the raw context data part of it + +This patch should be backported to kernels as old as 2.6.31, that +contain the commit d115b04818e57bdbc7ccde4d0660b15e33013dc8 "USB: xhci: +Support for 64-byte contexts". + +Signed-off-by: Mathias Nyman +Signed-off-by: Sarah Sharp +Cc: John Youn +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -369,6 +369,10 @@ static struct xhci_container_ctx *xhci_a + ctx->size += CTX_SIZE(xhci->hcc_params); + + ctx->bytes = dma_pool_alloc(xhci->device_pool, flags, &ctx->dma); ++ if (!ctx->bytes) { ++ kfree(ctx); ++ return NULL; ++ } + memset(ctx->bytes, 0, ctx->size); + return ctx; + }