From 8dee14832aa1f595956e7572f784720d863f69d2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 17 Jul 2013 13:05:37 -0700 Subject: [PATCH] 3.0-stable patches added patches: ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch xhci-check-for-failed-dma-pool-allocation.patch --- ...file-f_pos-in-htree_dirblock_to_tree.patch | 55 ++++++++++++++++++ ...etical-race-in-jbd2__journal_restart.patch | 46 +++++++++++++++ ...gpio_get_value-in-at91_cf_get_status.patch | 36 ++++++++++++ queue-3.0/series | 6 ++ ...ory-barrier-for-thread_wakeup_needed.patch | 48 +++++++++++++++ ...-move-novatel-gobi1k-ids-to-qcserial.patch | 58 +++++++++++++++++++ ...check-for-failed-dma-pool-allocation.patch | 38 ++++++++++++ 7 files changed, 287 insertions(+) create mode 100644 queue-3.0/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch create mode 100644 queue-3.0/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch create mode 100644 queue-3.0/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch create mode 100644 queue-3.0/series create mode 100644 queue-3.0/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch create mode 100644 queue-3.0/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch create mode 100644 queue-3.0/xhci-check-for-failed-dma-pool-allocation.patch diff --git a/queue-3.0/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch b/queue-3.0/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch new file mode 100644 index 00000000000..c89f52182bb --- /dev/null +++ b/queue-3.0/ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch @@ -0,0 +1,55 @@ +From 64cb927371cd2ec43758d8a094a003d27bc3d0dc Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Mon, 1 Jul 2013 08:12:38 -0400 +Subject: ext3,ext4: don't mess with dir_file->f_pos in htree_dirblock_to_tree() + +From: Al Viro + +commit 64cb927371cd2ec43758d8a094a003d27bc3d0dc upstream. + +Both ext3 and ext4 htree_dirblock_to_tree() is just filling the +in-core rbtree for use by call_filldir(). All updates of ->f_pos are +done by the latter; bumping it here (on error) is obviously wrong - we +might very well have it nowhere near the block we'd found an error in. + +Signed-off-by: Al Viro +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/namei.c | 7 ++----- + fs/ext4/namei.c | 7 ++----- + 2 files changed, 4 insertions(+), 10 deletions(-) + +--- a/fs/ext3/namei.c ++++ b/fs/ext3/namei.c +@@ -584,11 +584,8 @@ static int htree_dirblock_to_tree(struct + if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh, + (block<i_sb)) + +((char *)de - bh->b_data))) { +- /* On error, skip the f_pos to the next block. */ +- dir_file->f_pos = (dir_file->f_pos | +- (dir->i_sb->s_blocksize - 1)) + 1; +- brelse (bh); +- return count; ++ /* silently ignore the rest of the block */ ++ break; + } + ext3fs_dirhash(de->name, de->name_len, hinfo); + if ((hinfo->hash < start_hash) || +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -585,11 +585,8 @@ static int htree_dirblock_to_tree(struct + if (ext4_check_dir_entry(dir, NULL, de, bh, + (block<i_sb)) + + ((char *)de - bh->b_data))) { +- /* On error, skip the f_pos to the next block. */ +- dir_file->f_pos = (dir_file->f_pos | +- (dir->i_sb->s_blocksize - 1)) + 1; +- brelse(bh); +- return count; ++ /* silently ignore the rest of the block */ ++ break; + } + ext4fs_dirhash(de->name, de->name_len, hinfo); + if ((hinfo->hash < start_hash) || diff --git a/queue-3.0/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch b/queue-3.0/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch new file mode 100644 index 00000000000..821c72a0ad2 --- /dev/null +++ b/queue-3.0/jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch @@ -0,0 +1,46 @@ +From 39c04153fda8c32e85b51c96eb5511a326ad7609 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Mon, 1 Jul 2013 08:12:40 -0400 +Subject: jbd2: fix theoretical race in jbd2__journal_restart + +From: Theodore Ts'o + +commit 39c04153fda8c32e85b51c96eb5511a326ad7609 upstream. + +Once we decrement transaction->t_updates, if this is the last handle +holding the transaction from closing, and once we release the +t_handle_lock spinlock, it's possible for the transaction to commit +and be released. In practice with normal kernels, this probably won't +happen, since the commit happens in a separate kernel thread and it's +unlikely this could all happen within the space of a few CPU cycles. + +On the other hand, with a real-time kernel, this could potentially +happen, so save the tid found in transaction->t_tid before we release +t_handle_lock. It would require an insane configuration, such as one +where the jbd2 thread was set to a very high real-time priority, +perhaps because a high priority real-time thread is trying to read or +write to a file system. But some people who use real-time kernels +have been known to do insane things, including controlling +laser-wielding industrial robots. :-) + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/transaction.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -469,10 +469,10 @@ int jbd2__journal_restart(handle_t *hand + &transaction->t_outstanding_credits); + if (atomic_dec_and_test(&transaction->t_updates)) + wake_up(&journal->j_wait_updates); ++ tid = transaction->t_tid; + spin_unlock(&transaction->t_handle_lock); + + jbd_debug(2, "restarting handle %p\n", handle); +- tid = transaction->t_tid; + need_to_start = !tid_geq(journal->j_commit_request, tid); + read_unlock(&journal->j_state_lock); + if (need_to_start) diff --git a/queue-3.0/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch b/queue-3.0/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch new file mode 100644 index 00000000000..7bdb1e101d7 --- /dev/null +++ b/queue-3.0/pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch @@ -0,0 +1,36 @@ +From e39506b466edcda2a7e9d0174d7987ae654137b7 Mon Sep 17 00:00:00 2001 +From: Joachim Eastwood +Date: Thu, 6 Jun 2013 10:24:14 +0200 +Subject: pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status + +From: Joachim Eastwood + +commit e39506b466edcda2a7e9d0174d7987ae654137b7 upstream. + +Commit 80af9e6d (pcmcia at91_cf: fix raw gpio number usage) forgot +to change the parameter in gpio_get_value after adding gpio +validation. + +Signed-off-by: Joachim Eastwood +Signed-off-by: Nicolas Ferre +Acked-by: Jean-Christophe PLAGNIOL-VILLARD +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/at91_cf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pcmcia/at91_cf.c ++++ b/drivers/pcmcia/at91_cf.c +@@ -99,9 +99,9 @@ static int at91_cf_get_status(struct pcm + int vcc = cf->board->vcc_pin; + + *sp = SS_DETECT | SS_3VCARD; +- if (!rdy || gpio_get_value(rdy)) ++ if (!rdy || gpio_get_value(cf->board->irq_pin)) + *sp |= SS_READY; +- if (!vcc || gpio_get_value(vcc)) ++ if (!vcc || gpio_get_value(cf->board->vcc_pin)) + *sp |= SS_POWERON; + } else + *sp = 0; diff --git a/queue-3.0/series b/queue-3.0/series new file mode 100644 index 00000000000..3b7d8f42d58 --- /dev/null +++ b/queue-3.0/series @@ -0,0 +1,6 @@ +jbd2-fix-theoretical-race-in-jbd2__journal_restart.patch +ext3-ext4-don-t-mess-with-dir_file-f_pos-in-htree_dirblock_to_tree.patch +usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch +usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch +xhci-check-for-failed-dma-pool-allocation.patch +pcmcia-at91_cf-fix-gpio_get_value-in-at91_cf_get_status.patch diff --git a/queue-3.0/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch b/queue-3.0/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch new file mode 100644 index 00000000000..3cd39fc7eba --- /dev/null +++ b/queue-3.0/usb-gadget-f_mass_storage-add-missing-memory-barrier-for-thread_wakeup_needed.patch @@ -0,0 +1,48 @@ +From d68c277b501889b3a50c179d1c3d704db7947b83 Mon Sep 17 00:00:00 2001 +From: UCHINO Satoshi +Date: Thu, 23 May 2013 11:10:11 +0900 +Subject: usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed + +From: UCHINO Satoshi + +commit d68c277b501889b3a50c179d1c3d704db7947b83 upstream. + +Without this memory barrier, the file-storage thread may fail to +escape from the following while loop, because it may observe new +common->thread_wakeup_needed and old bh->state which are updated by +the callback functions. + + /* Wait for the CBW to arrive */ + while (bh->state != BUF_STATE_FULL) { + rc = sleep_thread(common); + if (rc) + return rc; + } + +Signed-off-by: UCHINO Satoshi +Acked-by: Michal Nazarewicz +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/f_mass_storage.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/f_mass_storage.c ++++ b/drivers/usb/gadget/f_mass_storage.c +@@ -513,6 +513,7 @@ static int fsg_set_halt(struct fsg_dev * + /* Caller must hold fsg->lock */ + static void wakeup_thread(struct fsg_common *common) + { ++ smp_wmb(); /* ensure the write of bh->state is complete */ + /* Tell the main thread that something has happened */ + common->thread_wakeup_needed = 1; + if (common->thread_task) +@@ -730,6 +731,7 @@ static int sleep_thread(struct fsg_commo + } + __set_current_state(TASK_RUNNING); + common->thread_wakeup_needed = 0; ++ smp_rmb(); /* ensure the latest bh->state is visible */ + return rc; + } + diff --git a/queue-3.0/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch b/queue-3.0/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch new file mode 100644 index 00000000000..21c071e30b9 --- /dev/null +++ b/queue-3.0/usb-option-qcserial-move-novatel-gobi1k-ids-to-qcserial.patch @@ -0,0 +1,58 @@ +From a254810a86aaaac4ac6ba44fa934558b042a17a7 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 20 Jun 2013 16:07:40 -0500 +Subject: USB: option,qcserial: move Novatel Gobi1K IDs to qcserial + +From: Dan Williams + +commit a254810a86aaaac4ac6ba44fa934558b042a17a7 upstream. + +These devices are all Gobi1K devices (according to the Windows INF +files) and should be handled by qcserial instead of option. Their +network port is handled by qmi_wwan. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ---- + drivers/usb/serial/qcserial.c | 8 +++++++- + 2 files changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -159,8 +159,6 @@ static void option_instat_callback(struc + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000 + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001 + #define NOVATELWIRELESS_PRODUCT_E362 0x9010 +-#define NOVATELWIRELESS_PRODUCT_G1 0xA001 +-#define NOVATELWIRELESS_PRODUCT_G1_M 0xA002 + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 + #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 + +@@ -744,8 +742,6 @@ static const struct usb_device_id option + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC547) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) }, +- { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) }, +- { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) }, + /* Novatel Ovation MC551 a.k.a. Verizon USB551L */ + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -36,7 +36,13 @@ static const struct usb_device_id id_tab + {DEVICE_G1K(0x04da, 0x250c)}, /* Panasonic Gobi QDL device */ + {DEVICE_G1K(0x413c, 0x8172)}, /* Dell Gobi Modem device */ + {DEVICE_G1K(0x413c, 0x8171)}, /* Dell Gobi QDL device */ +- {DEVICE_G1K(0x1410, 0xa001)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa001)}, /* Novatel/Verizon USB-1000 */ ++ {DEVICE_G1K(0x1410, 0xa002)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa003)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa004)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa005)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa006)}, /* Novatel Gobi Modem device */ ++ {DEVICE_G1K(0x1410, 0xa007)}, /* Novatel Gobi Modem device */ + {DEVICE_G1K(0x1410, 0xa008)}, /* Novatel Gobi QDL device */ + {DEVICE_G1K(0x0b05, 0x1776)}, /* Asus Gobi Modem device */ + {DEVICE_G1K(0x0b05, 0x1774)}, /* Asus Gobi QDL device */ diff --git a/queue-3.0/xhci-check-for-failed-dma-pool-allocation.patch b/queue-3.0/xhci-check-for-failed-dma-pool-allocation.patch new file mode 100644 index 00000000000..4aa51096648 --- /dev/null +++ b/queue-3.0/xhci-check-for-failed-dma-pool-allocation.patch @@ -0,0 +1,38 @@ +From 025f880cb2e4d7218d0422d4b07bea1a68959c38 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 17 Jun 2013 09:56:33 -0700 +Subject: xhci: check for failed dma pool allocation + +From: Mathias Nyman + +commit 025f880cb2e4d7218d0422d4b07bea1a68959c38 upstream. + +Fail and free the container context in case dma_pool_alloc() can't allocate +the raw context data part of it + +This patch should be backported to kernels as old as 2.6.31, that +contain the commit d115b04818e57bdbc7ccde4d0660b15e33013dc8 "USB: xhci: +Support for 64-byte contexts". + +Signed-off-by: Mathias Nyman +Signed-off-by: Sarah Sharp +Cc: John Youn +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -273,6 +273,10 @@ static struct xhci_container_ctx *xhci_a + ctx->size += CTX_SIZE(xhci->hcc_params); + + ctx->bytes = dma_pool_alloc(xhci->device_pool, flags, &ctx->dma); ++ if (!ctx->bytes) { ++ kfree(ctx); ++ return NULL; ++ } + memset(ctx->bytes, 0, ctx->size); + return ctx; + } -- 2.47.3