From: Greg Kroah-Hartman Date: Tue, 5 Nov 2013 15:32:13 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.69~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e10e1073f51fd8a98ad67d061799c422fada9573;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch mac80211-correctly-close-cancelled-scans.patch mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch mac80211-update-sta-last_rx-on-acked-tx-frames.patch mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch x86-update-uv3-hub-revision-id.patch --- diff --git a/queue-3.10/bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch b/queue-3.10/bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch new file mode 100644 index 00000000000..ccf60426951 --- /dev/null +++ b/queue-3.10/bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch @@ -0,0 +1,28 @@ +From d4eddd42f592a0cf06818fae694a3d271f842e4d Mon Sep 17 00:00:00 2001 +From: Kent Overstreet +Date: Tue, 22 Oct 2013 15:35:50 -0700 +Subject: bcache: Fixed incorrect order of arguments to bio_alloc_bioset() + +From: Kent Overstreet + +commit d4eddd42f592a0cf06818fae694a3d271f842e4d upstream. + +Signed-off-by: Kent Overstreet +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/request.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -1059,7 +1059,7 @@ static void request_write(struct cached_ + + if (bio->bi_rw & REQ_FLUSH) { + /* Also need to send a flush to the backing device */ +- struct bio *flush = bio_alloc_bioset(0, GFP_NOIO, ++ struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0, + dc->disk.bio_split); + + flush->bi_rw = WRITE_FLUSH; diff --git a/queue-3.10/cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch b/queue-3.10/cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch new file mode 100644 index 00000000000..de819148eba --- /dev/null +++ b/queue-3.10/cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch @@ -0,0 +1,76 @@ +From ea84753c98a7ac6b74e530b64c444a912b3835ca Mon Sep 17 00:00:00 2001 +From: Anjana V Kumar +Date: Sat, 12 Oct 2013 10:59:17 +0800 +Subject: cgroup: fix to break the while loop in cgroup_attach_task() correctly + +From: Anjana V Kumar + +commit ea84753c98a7ac6b74e530b64c444a912b3835ca upstream. + +Both Anjana and Eunki reported a stall in the while_each_thread loop +in cgroup_attach_task(). + +It's because, when we attach a single thread to a cgroup, if the cgroup +is exiting or is already in that cgroup, we won't break the loop. + +If the task is already in the cgroup, the bug can lead to another thread +being attached to the cgroup unexpectedly: + + # echo 5207 > tasks + # cat tasks + 5207 + # echo 5207 > tasks + # cat tasks + 5207 + 5215 + +What's worse, if the task to be attached isn't the leader of the thread +group, we might never exit the loop, hence cpu stall. Thanks for Oleg's +analysis. + +This bug was introduced by commit 081aa458c38ba576bdd4265fc807fa95b48b9e79 +("cgroup: consolidate cgroup_attach_task() and cgroup_attach_proc()") + +[ lizf: - fixed the first continue, pointed out by Oleg, + - rewrote changelog. ] + +Reported-by: Eunki Kim +Reported-by: Anjana V Kumar +Signed-off-by: Anjana V Kumar +Signed-off-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -1995,7 +1995,7 @@ static int cgroup_attach_task(struct cgr + + /* @tsk either already exited or can't exit until the end */ + if (tsk->flags & PF_EXITING) +- continue; ++ goto next; + + /* as per above, nr_threads may decrease, but not increase. */ + BUG_ON(i >= group_size); +@@ -2003,7 +2003,7 @@ static int cgroup_attach_task(struct cgr + ent.cgrp = task_cgroup_from_root(tsk, root); + /* nothing to do if this task is already in the cgroup */ + if (ent.cgrp == cgrp) +- continue; ++ goto next; + /* + * saying GFP_ATOMIC has no effect here because we did prealloc + * earlier, but it's good form to communicate our expectations. +@@ -2011,7 +2011,7 @@ static int cgroup_attach_task(struct cgr + retval = flex_array_put(group, i, &ent, GFP_ATOMIC); + BUG_ON(retval != 0); + i++; +- ++ next: + if (!threadgroup) + break; + } while_each_thread(leader, tsk); diff --git a/queue-3.10/cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch b/queue-3.10/cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch new file mode 100644 index 00000000000..2fb0329cfd4 --- /dev/null +++ b/queue-3.10/cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch @@ -0,0 +1,47 @@ +From 52e0a509e5d6f902ec26bc2a8bb02b137dc453be Mon Sep 17 00:00:00 2001 +From: Dirk Brandewie +Date: Tue, 15 Oct 2013 11:06:14 -0700 +Subject: cpufreq / intel_pstate: Fix max_perf_pct on resume + +From: Dirk Brandewie + +commit 52e0a509e5d6f902ec26bc2a8bb02b137dc453be upstream. + +If the system is suspended while max_perf_pct is less than 100 percent +or no_turbo set policy->{min,max} will be set incorrectly with scaled +values which turn the scaled values into hard limits. + +References: https://bugzilla.kernel.org/show_bug.cgi?id=61241 +Reported-by: Patrick Bartels +Signed-off-by: Dirk Brandewie +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -629,8 +629,8 @@ static int __cpuinit intel_pstate_cpu_ex + + static int __cpuinit intel_pstate_cpu_init(struct cpufreq_policy *policy) + { +- int rc, min_pstate, max_pstate; + struct cpudata *cpu; ++ int rc; + + rc = intel_pstate_init_cpu(policy->cpu); + if (rc) +@@ -644,9 +644,8 @@ static int __cpuinit intel_pstate_cpu_in + else + policy->policy = CPUFREQ_POLICY_POWERSAVE; + +- intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate); +- policy->min = min_pstate * 100000; +- policy->max = max_pstate * 100000; ++ policy->min = cpu->pstate.min_pstate * 100000; ++ policy->max = cpu->pstate.turbo_pstate * 100000; + + /* cpuinfo and default policy values */ + policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000; diff --git a/queue-3.10/mac80211-correctly-close-cancelled-scans.patch b/queue-3.10/mac80211-correctly-close-cancelled-scans.patch new file mode 100644 index 00000000000..d11834c8807 --- /dev/null +++ b/queue-3.10/mac80211-correctly-close-cancelled-scans.patch @@ -0,0 +1,88 @@ +From a754055a1296fcbe6f32de3a5eaca6efb2fd1865 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Mon, 16 Sep 2013 11:12:07 +0300 +Subject: mac80211: correctly close cancelled scans + +From: Emmanuel Grumbach + +commit a754055a1296fcbe6f32de3a5eaca6efb2fd1865 upstream. + +__ieee80211_scan_completed is called from a worker. This +means that the following flow is possible. + + * driver calls ieee80211_scan_completed + * mac80211 cancels the scan (that is already complete) + * __ieee80211_scan_completed runs + +When scan_work will finally run, it will see that the scan +hasn't been aborted and might even trigger another scan on +another band. This leads to a situation where cfg80211's +scan is not done and no further scan can be issued. + +Fix this by setting a new flag when a HW scan is being +cancelled so that no other scan will be triggered. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ieee80211_i.h | 3 +++ + net/mac80211/scan.c | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+) + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -842,6 +842,8 @@ struct tpt_led_trigger { + * that the scan completed. + * @SCAN_ABORTED: Set for our scan work function when the driver reported + * a scan complete for an aborted scan. ++ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being ++ * cancelled. + */ + enum { + SCAN_SW_SCANNING, +@@ -849,6 +851,7 @@ enum { + SCAN_ONCHANNEL_SCANNING, + SCAN_COMPLETED, + SCAN_ABORTED, ++ SCAN_HW_CANCELLED, + }; + + /** +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -202,6 +202,9 @@ static bool ieee80211_prep_hw_scan(struc + enum ieee80211_band band; + int i, ielen, n_chans; + ++ if (test_bit(SCAN_HW_CANCELLED, &local->scanning)) ++ return false; ++ + do { + if (local->hw_scan_band == IEEE80211_NUM_BANDS) + return false; +@@ -878,7 +881,23 @@ void ieee80211_scan_cancel(struct ieee80 + if (!local->scan_req) + goto out; + ++ /* ++ * We have a scan running and the driver already reported completion, ++ * but the worker hasn't run yet or is stuck on the mutex - mark it as ++ * cancelled. ++ */ ++ if (test_bit(SCAN_HW_SCANNING, &local->scanning) && ++ test_bit(SCAN_COMPLETED, &local->scanning)) { ++ set_bit(SCAN_HW_CANCELLED, &local->scanning); ++ goto out; ++ } ++ + if (test_bit(SCAN_HW_SCANNING, &local->scanning)) { ++ /* ++ * Make sure that __ieee80211_scan_completed doesn't trigger a ++ * scan on another band. ++ */ ++ set_bit(SCAN_HW_CANCELLED, &local->scanning); + if (local->ops->cancel_hw_scan) + drv_cancel_hw_scan(local, + rcu_dereference_protected(local->scan_sdata, diff --git a/queue-3.10/mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch b/queue-3.10/mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch new file mode 100644 index 00000000000..7d3dd0b30f8 --- /dev/null +++ b/queue-3.10/mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch @@ -0,0 +1,40 @@ +From 6329b8d917adc077caa60c2447385554130853a3 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 17 Sep 2013 11:15:43 +0200 +Subject: mac80211: drop spoofed packets in ad-hoc mode + +From: Felix Fietkau + +commit 6329b8d917adc077caa60c2447385554130853a3 upstream. + +If an Ad-Hoc node receives packets with the Cell ID or its own MAC +address as source address, it hits a WARN_ON in sta_info_insert_check() +With many packets, this can massively spam the logs. One way that this +can easily happen is through having Cisco APs in the area with rouge AP +detection and countermeasures enabled. +Such Cisco APs will regularly send fake beacons, disassoc and deauth +packets that trigger these warnings. + +To fix this issue, drop such spoofed packets early in the rx path. + +Reported-by: Thomas Huehn +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3002,6 +3002,9 @@ static int prepare_for_handlers(struct i + case NL80211_IFTYPE_ADHOC: + if (!bssid) + return 0; ++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || ++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) ++ return 0; + if (ieee80211_is_beacon(hdr->frame_control)) { + return 1; + } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) { diff --git a/queue-3.10/mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch b/queue-3.10/mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch new file mode 100644 index 00000000000..3e5e925486b --- /dev/null +++ b/queue-3.10/mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch @@ -0,0 +1,36 @@ +From d86aa4f8ca58898ec6a94c0635da20b948171ed7 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 11 Oct 2013 15:47:06 +0200 +Subject: mac80211: fix crash if bitrate calculation goes wrong + +From: Johannes Berg + +commit d86aa4f8ca58898ec6a94c0635da20b948171ed7 upstream. + +If a frame's timestamp is calculated, and the bitrate +calculation goes wrong and returns zero, the system +will attempt to divide by zero and crash. Catch this +case and print the rate information that the driver +reported when this happens. + +Reported-by: Thomas Lindroth +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/util.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2174,6 +2174,10 @@ u64 ieee80211_calculate_rx_timestamp(str + } + + rate = cfg80211_calculate_bitrate(&ri); ++ if (WARN_ONCE(!rate, ++ "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n", ++ status->flag, status->rate_idx, status->vht_nss)) ++ return 0; + + /* rewind from end of MPDU */ + if (status->flag & RX_FLAG_MACTIME_END) diff --git a/queue-3.10/mac80211-update-sta-last_rx-on-acked-tx-frames.patch b/queue-3.10/mac80211-update-sta-last_rx-on-acked-tx-frames.patch new file mode 100644 index 00000000000..e9d1900ff94 --- /dev/null +++ b/queue-3.10/mac80211-update-sta-last_rx-on-acked-tx-frames.patch @@ -0,0 +1,37 @@ +From 0c5b93290b2f3c7a376567c03ae8d385b0e99851 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sun, 29 Sep 2013 21:39:34 +0200 +Subject: mac80211: update sta->last_rx on acked tx frames + +From: Felix Fietkau + +commit 0c5b93290b2f3c7a376567c03ae8d385b0e99851 upstream. + +When clients are idle for too long, hostapd sends nullfunc frames for +probing. When those are acked by the client, the idle time needs to be +updated. + +To make this work (and to avoid unnecessary probing), update sta->last_rx +whenever an ACK was received for a tx packet. Only do this if the flag +IEEE80211_HW_REPORTS_TX_ACK_STATUS is set. + +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/status.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct + struct ieee80211_local *local = sta->local; + struct ieee80211_sub_if_data *sdata = sta->sdata; + ++ if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) ++ sta->last_rx = jiffies; ++ + if (ieee80211_is_data_qos(mgmt->frame_control)) { + struct ieee80211_hdr *hdr = (void *) skb->data; + u8 *qc = ieee80211_get_qos_ctl(hdr); diff --git a/queue-3.10/mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch b/queue-3.10/mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch new file mode 100644 index 00000000000..0a5ed4121e9 --- /dev/null +++ b/queue-3.10/mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch @@ -0,0 +1,43 @@ +From 03bb7f42765ce596604f03d179f3137d7df05bba Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sun, 29 Sep 2013 21:39:33 +0200 +Subject: mac80211: use sta_info_get_bss() for nl80211 tx and client probing + +From: Felix Fietkau + +commit 03bb7f42765ce596604f03d179f3137d7df05bba upstream. + +This allows calls for clients in AP_VLANs (e.g. for 4-addr) to succeed + +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/cfg.c | 2 +- + net/mac80211/tx.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -3315,7 +3315,7 @@ static int ieee80211_probe_client(struct + return -EINVAL; + } + band = chanctx_conf->def.chan->band; +- sta = sta_info_get(sdata, peer); ++ sta = sta_info_get_bss(sdata, peer); + if (sta) { + qos = test_sta_flag(sta, WLAN_STA_WME); + } else { +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1100,7 +1100,8 @@ ieee80211_tx_prepare(struct ieee80211_su + tx->sta = rcu_dereference(sdata->u.vlan.sta); + if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr) + return TX_DROP; +- } else if (info->flags & IEEE80211_TX_CTL_INJECTED || ++ } else if (info->flags & (IEEE80211_TX_CTL_INJECTED | ++ IEEE80211_TX_INTFL_NL80211_FRAME_TX) || + tx->sdata->control_port_protocol == tx->skb->protocol) { + tx->sta = sta_info_get_bss(sdata, hdr->addr1); + } diff --git a/queue-3.10/series b/queue-3.10/series index 55fad124885..bbd21482354 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -3,3 +3,12 @@ usb-support-new-huawei-devices-in-option.c.patch usb-quirks.c-add-one-device-that-cannot-deal-with-suspension.patch usb-quirks-add-touchscreen-that-is-dazzeled-by-remote-wakeup.patch usb-serial-ftdi_sio-add-id-for-z3x-box-device.patch +x86-update-uv3-hub-revision-id.patch +cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch +bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch +cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch +mac80211-correctly-close-cancelled-scans.patch +mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch +mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch +mac80211-update-sta-last_rx-on-acked-tx-frames.patch +mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch diff --git a/queue-3.10/x86-update-uv3-hub-revision-id.patch b/queue-3.10/x86-update-uv3-hub-revision-id.patch new file mode 100644 index 00000000000..d2f5cb8d977 --- /dev/null +++ b/queue-3.10/x86-update-uv3-hub-revision-id.patch @@ -0,0 +1,32 @@ +From dd3c9c4b603c664fedc12facf180db0f1794aafe Mon Sep 17 00:00:00 2001 +From: Russ Anderson +Date: Mon, 14 Oct 2013 11:17:34 -0500 +Subject: x86: Update UV3 hub revision ID + +From: Russ Anderson + +commit dd3c9c4b603c664fedc12facf180db0f1794aafe upstream. + +The UV3 hub revision ID is different than expected. The first +revision was supposed to start at 1 but instead will start at 0. + +Signed-off-by: Russ Anderson +Link: http://lkml.kernel.org/r/20131014161733.GA6274@sgi.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -98,7 +98,7 @@ static int __init early_get_pnodeid(void + break; + case UV3_HUB_PART_NUMBER: + case UV3_HUB_PART_NUMBER_X: +- uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1; ++ uv_min_hub_revision_id += UV3_HUB_REVISION_BASE; + break; + } +