From: Greg Kroah-Hartman Date: Fri, 21 Sep 2012 17:35:03 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.44~83 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ef246d7a3aa282490ed2a0afd60d859e2ffd12cc;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch cciss-fix-handling-of-protocol-error.patch cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch netconsole-remove-a-redundant-netconsole_target_put.patch staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch staging-speakup-fix-an-improperly-declared-variable.patch staging-vt6656-failed-connection-incorrect-endian.patch target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch vfs-make-o_path-file-descriptors-usable-for-fstat.patch workqueue-reimplement-work_on_cpu-using-system_wq.patch --- diff --git a/queue-3.0/alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch b/queue-3.0/alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch new file mode 100644 index 00000000000..70a6c4d179a --- /dev/null +++ b/queue-3.0/alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch @@ -0,0 +1,41 @@ +From 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 Mon Sep 17 00:00:00 2001 +From: Matteo Frigo +Date: Wed, 12 Sep 2012 10:12:06 -0400 +Subject: ALSA: ice1724: Use linear scale for AK4396 volume control. + +From: Matteo Frigo + +commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream. + +The AK4396 DAC has a linear-scale attentuator, but +sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is +not quite right. This patch restores the correct scale, borrowing +from the ak4396 code in sound/pci/oxygen/oxygen.c. + +Signed-off-by: Matteo Frigo +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/prodigy_hifi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/ice1712/prodigy_hifi.c ++++ b/sound/pci/ice1712/prodigy_hifi.c +@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd + } + + static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1); ++static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0); + + static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = { + { +@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h + .info = ak4396_dac_vol_info, + .get = ak4396_dac_vol_get, + .put = ak4396_dac_vol_put, +- .tlv = { .p = db_scale_wm_dac }, ++ .tlv = { .p = ak4396_db_scale }, + }, + }; + diff --git a/queue-3.0/cciss-fix-handling-of-protocol-error.patch b/queue-3.0/cciss-fix-handling-of-protocol-error.patch new file mode 100644 index 00000000000..23f9f5f2fc7 --- /dev/null +++ b/queue-3.0/cciss-fix-handling-of-protocol-error.patch @@ -0,0 +1,35 @@ +From 2453f5f992717251cfadab6184fbb3ec2f2e8b40 Mon Sep 17 00:00:00 2001 +From: "Stephen M. Cameron" +Date: Fri, 14 Sep 2012 16:35:10 -0500 +Subject: cciss: fix handling of protocol error + +From: "Stephen M. Cameron" + +commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream. + +If a command completes with a status of CMD_PROTOCOL_ERR, this +information should be conveyed to the SCSI mid layer, not dropped +on the floor. Unlike a similar bug in the hpsa driver, this bug +only affects tape drives and CD and DVD ROM drives in the cciss +driver, and to induce it, you have to disconnect (or damage) a +cable, so it is not a very likely scenario (which would explain +why the bug has gone undetected for the last 10 years.) + +Signed-off-by: Stephen M. Cameron +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cciss_scsi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/block/cciss_scsi.c ++++ b/drivers/block/cciss_scsi.c +@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman + } + break; + case CMD_PROTOCOL_ERR: ++ cmd->result = DID_ERROR << 16; + dev_warn(&h->pdev->dev, + "%p has protocol error\n", c); + break; diff --git a/queue-3.0/cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch b/queue-3.0/cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch new file mode 100644 index 00000000000..d810ef7ee65 --- /dev/null +++ b/queue-3.0/cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch @@ -0,0 +1,170 @@ +From 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 18 Sep 2012 14:24:59 -0700 +Subject: cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU + +From: Tejun Heo + +commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream. + +powernowk8_target() runs off a per-cpu work item and if the +cpufreq_policy->cpu is different from the current one, it migrates the +kworker to the target CPU by manipulating current->cpus_allowed. The +function migrates the kworker back to the original CPU but this is +still broken. Workqueue concurrency management requires the kworkers +to stay on the same CPU and powernowk8_target() ends up triggerring +BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on +fidvid_mutex and sleeps. + +It is unclear why this bug is being reported now. Duncan says it +appeared to be a regression of 3.6-rc1 and couldn't reproduce it on +3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool +instead of @gcwq or @cpu where applicable" which is an non-functional +change. Given that the reproduce case sometimes took upto days to +trigger, it's easy to be misled while bisecting. Maybe something made +contention on fidvid_mutex more likely? I don't know. + +This patch fixes the bug by using work_on_cpu() instead if @pol->cpu +isn't the same as the current one. The code assumes that +cpufreq_policy->cpu is kept online by the caller, which Rafael tells +me is the case. + +stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using + system_wq") should be applied before this; otherwise, the + behavior could be horrible. + +Signed-off-by: Tejun Heo +Reported-by: Duncan <1i5t5.duncan@cox.net> +Tested-by: Duncan <1i5t5.duncan@cox.net> +Cc: Rafael J. Wysocki +Cc: Andreas Herrmann +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301 +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/powernow-k8.c | 65 ++++++++++++++++++++++-------------------- + 1 file changed, 35 insertions(+), 30 deletions(-) + +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -32,7 +32,6 @@ + #include + #include + #include +-#include /* for current / set_cpus_allowed() */ + #include + #include + +@@ -1132,16 +1131,23 @@ static int transition_frequency_pstate(s + return res; + } + +-/* Driver entry point to switch to the target frequency */ +-static int powernowk8_target(struct cpufreq_policy *pol, +- unsigned targfreq, unsigned relation) +-{ +- cpumask_var_t oldmask; ++struct powernowk8_target_arg { ++ struct cpufreq_policy *pol; ++ unsigned targfreq; ++ unsigned relation; ++}; ++ ++static long powernowk8_target_fn(void *arg) ++{ ++ struct powernowk8_target_arg *pta = arg; ++ struct cpufreq_policy *pol = pta->pol; ++ unsigned targfreq = pta->targfreq; ++ unsigned relation = pta->relation; + struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu); + u32 checkfid; + u32 checkvid; + unsigned int newstate; +- int ret = -EIO; ++ int ret; + + if (!data) + return -EINVAL; +@@ -1149,29 +1155,16 @@ static int powernowk8_target(struct cpuf + checkfid = data->currfid; + checkvid = data->currvid; + +- /* only run on specific CPU from here on. */ +- /* This is poor form: use a workqueue or smp_call_function_single */ +- if (!alloc_cpumask_var(&oldmask, GFP_KERNEL)) +- return -ENOMEM; +- +- cpumask_copy(oldmask, tsk_cpus_allowed(current)); +- set_cpus_allowed_ptr(current, cpumask_of(pol->cpu)); +- +- if (smp_processor_id() != pol->cpu) { +- printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu); +- goto err_out; +- } +- + if (pending_bit_stuck()) { + printk(KERN_ERR PFX "failing targ, change pending bit set\n"); +- goto err_out; ++ return -EIO; + } + + pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n", + pol->cpu, targfreq, pol->min, pol->max, relation); + + if (query_current_values_with_pending_wait(data)) +- goto err_out; ++ return -EIO; + + if (cpu_family != CPU_HW_PSTATE) { + pr_debug("targ: curr fid 0x%x, vid 0x%x\n", +@@ -1189,7 +1182,7 @@ static int powernowk8_target(struct cpuf + + if (cpufreq_frequency_table_target(pol, data->powernow_table, + targfreq, relation, &newstate)) +- goto err_out; ++ return -EIO; + + mutex_lock(&fidvid_mutex); + +@@ -1202,9 +1195,8 @@ static int powernowk8_target(struct cpuf + ret = transition_frequency_fidvid(data, newstate); + if (ret) { + printk(KERN_ERR PFX "transition frequency failed\n"); +- ret = 1; + mutex_unlock(&fidvid_mutex); +- goto err_out; ++ return 1; + } + mutex_unlock(&fidvid_mutex); + +@@ -1213,12 +1205,25 @@ static int powernowk8_target(struct cpuf + data->powernow_table[newstate].index); + else + pol->cur = find_khz_freq_from_fid(data->currfid); +- ret = 0; + +-err_out: +- set_cpus_allowed_ptr(current, oldmask); +- free_cpumask_var(oldmask); +- return ret; ++ return 0; ++} ++ ++/* Driver entry point to switch to the target frequency */ ++static int powernowk8_target(struct cpufreq_policy *pol, ++ unsigned targfreq, unsigned relation) ++{ ++ struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq, ++ .relation = relation }; ++ ++ /* ++ * Must run on @pol->cpu. cpufreq core is responsible for ensuring ++ * that we're bound to the current CPU and pol->cpu stays online. ++ */ ++ if (smp_processor_id() == pol->cpu) ++ return powernowk8_target_fn(&pta); ++ else ++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta); + } + + /* Driver entry point to verify the policy and range of frequencies */ diff --git a/queue-3.0/ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch b/queue-3.0/ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch new file mode 100644 index 00000000000..dd6b2a7526c --- /dev/null +++ b/queue-3.0/ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch @@ -0,0 +1,62 @@ +From 8335eafc2859e1a26282bef7c3d19f3d68868b8a Mon Sep 17 00:00:00 2001 +From: Tyler Hicks +Date: Thu, 13 Sep 2012 12:00:56 -0700 +Subject: eCryptfs: Copy up attributes of the lower target inode after rename + +From: Tyler Hicks + +commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream. + +After calling into the lower filesystem to do a rename, the lower target +inode's attributes were not copied up to the eCryptfs target inode. This +resulted in the eCryptfs target inode staying around, rather than being +evicted, because i_nlink was not updated for the eCryptfs inode. This +also meant that eCryptfs didn't do the final iput() on the lower target +inode so it stayed around, as well. This would result in a failure to +free up space occupied by the target file in the rename() operation. +Both target inodes would eventually be evicted when the eCryptfs +filesystem was unmounted. + +This patch calls fsstack_copy_attr_all() after the lower filesystem +does its ->rename() so that important inode attributes, such as i_nlink, +are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called +and eCryptfs can drop its final reference on the lower inode. + +http://launchpad.net/bugs/561129 + +Signed-off-by: Tyler Hicks +Tested-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/inode.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -653,6 +653,7 @@ ecryptfs_rename(struct inode *old_dir, s + struct dentry *lower_old_dir_dentry; + struct dentry *lower_new_dir_dentry; + struct dentry *trap = NULL; ++ struct inode *target_inode; + + lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); + lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); +@@ -660,6 +661,7 @@ ecryptfs_rename(struct inode *old_dir, s + dget(lower_new_dentry); + lower_old_dir_dentry = dget_parent(lower_old_dentry); + lower_new_dir_dentry = dget_parent(lower_new_dentry); ++ target_inode = new_dentry->d_inode; + trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry); + /* source should not be ancestor of target */ + if (trap == lower_old_dentry) { +@@ -675,6 +677,9 @@ ecryptfs_rename(struct inode *old_dir, s + lower_new_dir_dentry->d_inode, lower_new_dentry); + if (rc) + goto out_lock; ++ if (target_inode) ++ fsstack_copy_attr_all(target_inode, ++ ecryptfs_inode_to_lower(target_inode)); + fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode); + if (new_dir != old_dir) + fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode); diff --git a/queue-3.0/netconsole-remove-a-redundant-netconsole_target_put.patch b/queue-3.0/netconsole-remove-a-redundant-netconsole_target_put.patch new file mode 100644 index 00000000000..a712f193c78 --- /dev/null +++ b/queue-3.0/netconsole-remove-a-redundant-netconsole_target_put.patch @@ -0,0 +1,39 @@ +From 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa Mon Sep 17 00:00:00 2001 +From: Amerigo Wang +Date: Sat, 18 Aug 2012 07:02:20 +0000 +Subject: netconsole: remove a redundant netconsole_target_put() + +From: Amerigo Wang + +commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream. + +This netconsole_target_put() is obviously redundant, and it +causes a kernel segfault when removing a bridge device which has +netconsole running on it. + +This is caused by: + + commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093 + Author: Amerigo Wang + Date: Thu May 19 21:39:10 2011 +0000 + + netpoll: disable netpoll when enslave a device + +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netconsole.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/netconsole.c ++++ b/drivers/net/netconsole.c +@@ -652,7 +652,6 @@ static int netconsole_netdev_event(struc + flags); + dev_put(nt->np.dev); + nt->np.dev = NULL; +- netconsole_target_put(nt); + } + nt->enabled = 0; + stopped = true; diff --git a/queue-3.0/series b/queue-3.0/series index 90fba4c9ab9..eaab630a870 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -21,3 +21,17 @@ net-fix-info-leak-in-compat-dev_ifconf.patch netlink-fix-possible-spoofing-from-non-root-processes.patch l2tp-avoid-to-use-synchronize_rcu-in-tunnel-free-function.patch net-ipv4-ipmr_expire_timer-causes-crash-when-removing-net-namespace.patch +workqueue-reimplement-work_on_cpu-using-system_wq.patch +cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch +cciss-fix-handling-of-protocol-error.patch +vfs-make-o_path-file-descriptors-usable-for-fstat.patch +vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch +netconsole-remove-a-redundant-netconsole_target_put.patch +ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch +target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch +alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch +staging-speakup-fix-an-improperly-declared-variable.patch +staging-vt6656-failed-connection-incorrect-endian.patch +staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch +staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch +usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch diff --git a/queue-3.0/staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch b/queue-3.0/staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch new file mode 100644 index 00000000000..b7023177882 --- /dev/null +++ b/queue-3.0/staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch @@ -0,0 +1,31 @@ +From 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 31 Aug 2012 20:41:30 +0100 +Subject: staging: comedi: das08: Correct AO output for das08jr-16-ao + +From: Ian Abbott + +commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream. + +Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as +that knobbles the upper three-quarters of the output range for the +'das08jr-16-ao' board. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/das08.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/das08.c ++++ b/drivers/staging/comedi/drivers/das08.c +@@ -655,7 +655,7 @@ static int das08jr_ao_winsn(struct comed + int chan; + + lsb = data[0] & 0xff; +- msb = (data[0] >> 8) & 0xf; ++ msb = (data[0] >> 8) & 0xff; + + chan = CR_CHAN(insn->chanspec); + diff --git a/queue-3.0/staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch b/queue-3.0/staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch new file mode 100644 index 00000000000..8c6c6543482 --- /dev/null +++ b/queue-3.0/staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch @@ -0,0 +1,42 @@ +From abf02cfc179bb4bd30d05f582d61b3b8f429b813 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 10 Sep 2012 21:22:11 +0200 +Subject: staging: r8712u: fix bug in r8712_recv_indicatepkt() + +From: Eric Dumazet + +commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream. + +64bit arches have a buggy r8712u driver, let's fix it. + +skb->tail must be set properly or network stack behavior is undefined. + +Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525 +Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071 + +Signed-off-by: Eric Dumazet +Cc: Dave Jones +Acked-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/recv_linux.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/staging/rtl8712/recv_linux.c ++++ b/drivers/staging/rtl8712/recv_linux.c +@@ -113,13 +113,8 @@ void r8712_recv_indicatepkt(struct _adap + if (skb == NULL) + goto _recv_indicatepkt_drop; + skb->data = precv_frame->u.hdr.rx_data; +-#ifdef NET_SKBUFF_DATA_USES_OFFSET +- skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail - +- precv_frame->u.hdr.rx_head); +-#else +- skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail; +-#endif + skb->len = precv_frame->u.hdr.len; ++ skb_set_tail_pointer(skb, skb->len); + if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1)) + skb->ip_summed = CHECKSUM_UNNECESSARY; + else diff --git a/queue-3.0/staging-speakup-fix-an-improperly-declared-variable.patch b/queue-3.0/staging-speakup-fix-an-improperly-declared-variable.patch new file mode 100644 index 00000000000..ea948545e7a --- /dev/null +++ b/queue-3.0/staging-speakup-fix-an-improperly-declared-variable.patch @@ -0,0 +1,31 @@ +From 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b Mon Sep 17 00:00:00 2001 +From: Christopher Brannon +Date: Sat, 16 Jun 2012 16:55:20 -0500 +Subject: Staging: speakup: fix an improperly-declared variable. + +From: Christopher Brannon + +commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream. + +A local static variable was declared as a pointer to a string +constant. We're assigning to the underlying memory, so it +needs to be an array instead. + +Signed-off-by: Christopher Brannon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/speakup/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/speakup/main.c ++++ b/drivers/staging/speakup/main.c +@@ -1855,7 +1855,7 @@ static void speakup_bits(struct vc_data + + static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key) + { +- static u_char *goto_buf = "\0\0\0\0\0\0"; ++ static u_char goto_buf[8]; + static int num; + int maxlen, go_pos; + char *cp; diff --git a/queue-3.0/staging-vt6656-failed-connection-incorrect-endian.patch b/queue-3.0/staging-vt6656-failed-connection-incorrect-endian.patch new file mode 100644 index 00000000000..8d79214c12f --- /dev/null +++ b/queue-3.0/staging-vt6656-failed-connection-incorrect-endian.patch @@ -0,0 +1,110 @@ +From aa209eef3ce8419ff2926c2fa944dfbfb5afbacb Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 29 Aug 2012 23:08:21 +0100 +Subject: staging: vt6656: [BUG] - Failed connection, incorrect endian. + +From: Malcolm Priestley + +commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream. + +Hi, + +This patch fixes a bug with driver failing to negotiate a connection. + +The bug was traced to commit +203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90 +staging: vt6656: removed custom definitions of Ethernet packet types + +In that patch, definitions in include/linux/if_ether.h replaced ones +in tether.h which had both big and little endian definitions. + +include/linux/if_ether.h only refers to big endian values, cpu_to_be16 +should be used for the correct endian architectures. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/dpc.c | 2 +- + drivers/staging/vt6656/rxtx.c | 38 +++++++++++++++++++------------------- + 2 files changed, 20 insertions(+), 20 deletions(-) + +--- a/drivers/staging/vt6656/dpc.c ++++ b/drivers/staging/vt6656/dpc.c +@@ -200,7 +200,7 @@ s_vProcessRxMACHeader ( + } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) { + cbHeaderSize += 6; + pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize); +- if ((*pwType == cpu_to_le16(ETH_P_IPX)) || ++ if ((*pwType == cpu_to_be16(ETH_P_IPX)) || + (*pwType == cpu_to_le16(0xF380))) { + cbHeaderSize -= 8; + pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize); +--- a/drivers/staging/vt6656/rxtx.c ++++ b/drivers/staging/vt6656/rxtx.c +@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb( + // 802.1H + if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) { + if (pDevice->dwDiagRefCount == 0) { +- if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) || ++ if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) || + (psEthHeader->wType == cpu_to_le16(0xF380))) { + memcpy((PBYTE) (pbyPayloadHead), + abySNAP_Bridgetunnel, 6); +@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un + Packet_Type = skb->data[ETH_HLEN+1]; + Descriptor_type = skb->data[ETH_HLEN+1+1+2]; + Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]); +- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) { +- /* 802.1x OR eapol-key challenge frame transfer */ +- if (((Protocol_Version == 1) || (Protocol_Version == 2)) && +- (Packet_Type == 3)) { ++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) { ++ /* 802.1x OR eapol-key challenge frame transfer */ ++ if (((Protocol_Version == 1) || (Protocol_Version == 2)) && ++ (Packet_Type == 3)) { + bTxeapol_key = TRUE; + if(!(Key_info & BIT3) && //WPA or RSN group-key challenge + (Key_info & BIT8) && (Key_info & BIT9)) { //send 2/2 key +@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un + } + } + +- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) { +- if (pDevice->byBBType != BB_TYPE_11A) { +- pDevice->wCurrentRate = RATE_1M; +- pDevice->byACKRate = RATE_1M; +- pDevice->byTopCCKBasicRate = RATE_1M; +- pDevice->byTopOFDMBasicRate = RATE_6M; +- } else { +- pDevice->wCurrentRate = RATE_6M; +- pDevice->byACKRate = RATE_6M; +- pDevice->byTopCCKBasicRate = RATE_1M; +- pDevice->byTopOFDMBasicRate = RATE_6M; +- } +- } ++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) { ++ if (pDevice->byBBType != BB_TYPE_11A) { ++ pDevice->wCurrentRate = RATE_1M; ++ pDevice->byACKRate = RATE_1M; ++ pDevice->byTopCCKBasicRate = RATE_1M; ++ pDevice->byTopOFDMBasicRate = RATE_6M; ++ } else { ++ pDevice->wCurrentRate = RATE_6M; ++ pDevice->byACKRate = RATE_6M; ++ pDevice->byTopCCKBasicRate = RATE_1M; ++ pDevice->byTopOFDMBasicRate = RATE_6M; ++ } ++ } + + DBG_PRT(MSG_LEVEL_DEBUG, + KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n", +@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, un + + if (bNeedEncryption == TRUE) { + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType)); +- if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) { ++ if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) { + bNeedEncryption = FALSE; + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType)); + if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) { diff --git a/queue-3.0/target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch b/queue-3.0/target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch new file mode 100644 index 00000000000..1c58a4462ea --- /dev/null +++ b/queue-3.0/target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch @@ -0,0 +1,71 @@ +From 4c054ba63ad47ef244cfcfa1cea38134620a5bae Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 16 Aug 2012 15:33:10 -0700 +Subject: target: Fix ->data_length re-assignment bug with SCSI overflow + +From: Nicholas Bellinger + +commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream. + +This patch fixes a long-standing bug with SCSI overflow handling +where se_cmd->data_length was incorrectly being re-assigned to +the larger CDB extracted allocation length, resulting in a number +of fabric level errors that would end up causing a session reset +in most cases. So instead now: + + - Only re-assign se_cmd->data_length durining UNDERFLOW (to use the + smaller value) + - Use existing se_cmd->data_length for OVERFLOW (to use the smaller + value) + +This fix has been tested with the following CDB to generate an +SCSI overflow: + + sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0 + +Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric +ports. Here is a bit more detail on each case: + + - iscsi-target: Bug with open-iscsi with overflow, sg_raw returns + -3584 bytes of data. + - tcm_qla2xxx: Working as expected, returnins 512 bytes of data + - loopback: sg_raw returns CHECK_CONDITION, from overflow rejection + in transport_generic_map_mem_to_cmd() + - tcm_vhost: Same as loopback + +Reported-by: Roland Dreier +Cc: Roland Dreier +Cc: Christoph Hellwig +Cc: Boaz Harrosh +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_transport.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -3672,15 +3672,20 @@ static int transport_generic_cmd_sequenc + /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */ + goto out_invalid_cdb_field; + } +- ++ /* ++ * For the overflow case keep the existing fabric provided ++ * ->data_length. Otherwise for the underflow case, reset ++ * ->data_length to the smaller SCSI expected data transfer ++ * length. ++ */ + if (size > cmd->data_length) { + cmd->se_cmd_flags |= SCF_OVERFLOW_BIT; + cmd->residual_count = (size - cmd->data_length); + } else { + cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT; + cmd->residual_count = (cmd->data_length - size); ++ cmd->data_length = size; + } +- cmd->data_length = size; + } + + transport_set_supported_SAM_opcode(cmd); diff --git a/queue-3.0/usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch b/queue-3.0/usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch new file mode 100644 index 00000000000..eb37cb7b377 --- /dev/null +++ b/queue-3.0/usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch @@ -0,0 +1,81 @@ +From ba9edaa468869a8cea242a411066b0f490751798 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Tue, 11 Sep 2012 09:40:31 +0200 +Subject: USB: option: replace ZTE K5006-Z entry with vendor class rule +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= + +commit ba9edaa468869a8cea242a411066b0f490751798 upstream. + +Fix the ZTE K5006-Z entry so that it actually matches anything + + commit f1b5c997 USB: option: add ZTE K5006-Z + +added a device specific entry assuming that the device would use +class/subclass/proto == ff/ff/ff like other ZTE devices. It +turns out that ZTE has started using vendor specific subclass +and protocol codes: + +T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=1018 Rev= 0.00 +S: Manufacturer=ZTE,Incorporated +S: Product=ZTE LTE Technologies MSM +S: SerialNumber=MF821Vxxxxxxx +C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none) +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +We do not have any information on how ZTE intend to use these +codes, but let us assume for now that the 3 sets matching +serial functions in the K5006-Z always will identify a serial +function in a ZTE device. + +Cc: Thomas Schäfer +Signed-off-by: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -882,8 +882,6 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) }, +@@ -1088,6 +1086,10 @@ static const struct usb_device_id option + .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, ++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, ++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, ++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, ++ + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, + { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, + { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */ diff --git a/queue-3.0/vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch b/queue-3.0/vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch new file mode 100644 index 00000000000..c6cd96c7abc --- /dev/null +++ b/queue-3.0/vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch @@ -0,0 +1,64 @@ +From b161dfa6937ae46d50adce8a7c6b12233e96e7bd Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 17 Sep 2012 22:31:38 +0200 +Subject: vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill() + +From: Miklos Szeredi + +commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream. + +IBM reported a soft lockup after applying the fix for the rename_lock +deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression +in kernel 2.6.38") was found to be the culprit. + +The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the +dentry was killed. This flag can be set on non-killed dentries too, +which results in infinite retries when trying to traverse the dentry +tree. + +This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is +only set in d_kill() and makes try_to_ascend() test only this flag. + +IBM reported successful test results with this patch. + +Signed-off-by: Miklos Szeredi +Cc: Trond Myklebust +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/dcache.c | 4 ++-- + include/linux/dcache.h | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -290,7 +290,7 @@ static struct dentry *d_kill(struct dent + * Inform try_to_ascend() that we are no longer attached to the + * dentry tree + */ +- dentry->d_flags |= DCACHE_DISCONNECTED; ++ dentry->d_flags |= DCACHE_DENTRY_KILLED; + if (parent) + spin_unlock(&parent->d_lock); + dentry_iput(dentry); +@@ -1015,7 +1015,7 @@ static struct dentry *try_to_ascend(stru + * or deletion + */ + if (new != old->d_parent || +- (old->d_flags & DCACHE_DISCONNECTED) || ++ (old->d_flags & DCACHE_DENTRY_KILLED) || + (!locked && read_seqretry(&rename_lock, seq))) { + spin_unlock(&new->d_lock); + new = NULL; +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -220,6 +220,8 @@ struct dentry_operations { + #define DCACHE_MANAGED_DENTRY \ + (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT) + ++#define DCACHE_DENTRY_KILLED 0x100000 ++ + extern seqlock_t rename_lock; + + static inline int dname_external(struct dentry *dentry) diff --git a/queue-3.0/vfs-make-o_path-file-descriptors-usable-for-fstat.patch b/queue-3.0/vfs-make-o_path-file-descriptors-usable-for-fstat.patch new file mode 100644 index 00000000000..c51aa904fc0 --- /dev/null +++ b/queue-3.0/vfs-make-o_path-file-descriptors-usable-for-fstat.patch @@ -0,0 +1,43 @@ +From 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Fri, 14 Sep 2012 14:48:21 -0700 +Subject: vfs: make O_PATH file descriptors usable for 'fstat()' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream. + +We already use them for openat() and friends, but fstat() also wants to +be able to use O_PATH file descriptors. This should make it more +directly comparable to the O_SEARCH of Solaris. + +Note that you could already do the same thing with "fstatat()" and an +empty path, but just doing "fstat()" directly is simpler and faster, so +there is no reason not to just allow it directly. + +See also commit 332a2e1244bd, which did the same thing for fchdir, for +the same reasons. + +Reported-by: ольга крыжановская +Cc: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/stat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -57,7 +57,7 @@ EXPORT_SYMBOL(vfs_getattr); + + int vfs_fstat(unsigned int fd, struct kstat *stat) + { +- struct file *f = fget(fd); ++ struct file *f = fget_raw(fd); + int error = -EBADF; + + if (f) { diff --git a/queue-3.0/workqueue-reimplement-work_on_cpu-using-system_wq.patch b/queue-3.0/workqueue-reimplement-work_on_cpu-using-system_wq.patch new file mode 100644 index 00000000000..276850f112f --- /dev/null +++ b/queue-3.0/workqueue-reimplement-work_on_cpu-using-system_wq.patch @@ -0,0 +1,82 @@ +From ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 18 Sep 2012 12:48:43 -0700 +Subject: workqueue: reimplement work_on_cpu() using system_wq + +From: Tejun Heo + +commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream. + +The existing work_on_cpu() implementation is hugely inefficient. It +creates a new kthread, execute that single function and then let the +kthread die on each invocation. + +Now that system_wq can handle concurrent executions, there's no +advantage of doing this. Reimplement work_on_cpu() using system_wq +which makes it simpler and way more efficient. + +stable: While this isn't a fix in itself, it's needed to fix a + workqueue related bug in cpufreq/powernow-k8. AFAICS, this + shouldn't break other existing users. + +Signed-off-by: Tejun Heo +Acked-by: Jiri Kosina +Cc: Linus Torvalds +Cc: Bjorn Helgaas +Cc: Len Brown +Cc: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 25 ++++++++----------------- + 1 file changed, 8 insertions(+), 17 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3599,18 +3599,17 @@ static int __devinit workqueue_cpu_down_ + #ifdef CONFIG_SMP + + struct work_for_cpu { +- struct completion completion; ++ struct work_struct work; + long (*fn)(void *); + void *arg; + long ret; + }; + +-static int do_work_for_cpu(void *_wfc) ++static void work_for_cpu_fn(struct work_struct *work) + { +- struct work_for_cpu *wfc = _wfc; ++ struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work); ++ + wfc->ret = wfc->fn(wfc->arg); +- complete(&wfc->completion); +- return 0; + } + + /** +@@ -3625,19 +3624,11 @@ static int do_work_for_cpu(void *_wfc) + */ + long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg) + { +- struct task_struct *sub_thread; +- struct work_for_cpu wfc = { +- .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion), +- .fn = fn, +- .arg = arg, +- }; ++ struct work_for_cpu wfc = { .fn = fn, .arg = arg }; + +- sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu"); +- if (IS_ERR(sub_thread)) +- return PTR_ERR(sub_thread); +- kthread_bind(sub_thread, cpu); +- wake_up_process(sub_thread); +- wait_for_completion(&wfc.completion); ++ INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn); ++ schedule_work_on(cpu, &wfc.work); ++ flush_work(&wfc.work); + return wfc.ret; + } + EXPORT_SYMBOL_GPL(work_on_cpu);