From a70d5138d1294fdf8e39f7e6483b19d1fd0e6ea3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 May 2013 16:45:48 -0700 Subject: [PATCH] 3.9-stable patches added patches: arm64-don-t-kill-the-kernel-on-a-bad-esr-from-el0.patch arm-samsung-export-mipi-csis-dsim-phy-control-functions.patch asoc-cs42l52-fix-default-value-for-mastera_vol.patch asoc-wm5110-correct-dsp4r-mixer-control-name.patch cifs-fix-potential-buffer-overrun-when-composing-a-new-options-string.patch crypto-caam-fix-inconsistent-assoc-dma-mapping-direction.patch drm-i915-adding-more-reserved-pci-ids-for-haswell.patch drm-radeon-fix-card_posted-check-for-newer-asics.patch drm-radeon-fix-typo-in-cu_per_sh-on-verde.patch sunrpc-prevent-an-rpc_task-wakeup-race.patch svcrpc-fix-failures-to-handle-1-uid-s-and-gid-s.patch xfs-kill-suid-sgid-through-the-truncate-path.patch --- ...mipi-csis-dsim-phy-control-functions.patch | 43 +++++++ ...ill-the-kernel-on-a-bad-esr-from-el0.patch | 48 ++++++++ ...52-fix-default-value-for-mastera_vol.patch | 32 ++++++ ...110-correct-dsp4r-mixer-control-name.patch | 28 +++++ ...-when-composing-a-new-options-string.patch | 42 +++++++ ...nsistent-assoc-dma-mapping-direction.patch | 41 +++++++ ...ng-more-reserved-pci-ids-for-haswell.patch | 107 ++++++++++++++++++ ...ix-card_posted-check-for-newer-asics.patch | 52 +++++++++ ...adeon-fix-typo-in-cu_per_sh-on-verde.patch | 31 +++++ queue-3.9/series | 12 ++ ...nrpc-prevent-an-rpc_task-wakeup-race.patch | 43 +++++++ ...failures-to-handle-1-uid-s-and-gid-s.patch | 57 ++++++++++ ...-suid-sgid-through-the-truncate-path.patch | 101 +++++++++++++++++ 13 files changed, 637 insertions(+) create mode 100644 queue-3.9/arm-samsung-export-mipi-csis-dsim-phy-control-functions.patch create mode 100644 queue-3.9/arm64-don-t-kill-the-kernel-on-a-bad-esr-from-el0.patch create mode 100644 queue-3.9/asoc-cs42l52-fix-default-value-for-mastera_vol.patch create mode 100644 queue-3.9/asoc-wm5110-correct-dsp4r-mixer-control-name.patch create mode 100644 queue-3.9/cifs-fix-potential-buffer-overrun-when-composing-a-new-options-string.patch create mode 100644 queue-3.9/crypto-caam-fix-inconsistent-assoc-dma-mapping-direction.patch create mode 100644 queue-3.9/drm-i915-adding-more-reserved-pci-ids-for-haswell.patch create mode 100644 queue-3.9/drm-radeon-fix-card_posted-check-for-newer-asics.patch create mode 100644 queue-3.9/drm-radeon-fix-typo-in-cu_per_sh-on-verde.patch create mode 100644 queue-3.9/sunrpc-prevent-an-rpc_task-wakeup-race.patch create mode 100644 queue-3.9/svcrpc-fix-failures-to-handle-1-uid-s-and-gid-s.patch create mode 100644 queue-3.9/xfs-kill-suid-sgid-through-the-truncate-path.patch diff --git a/queue-3.9/arm-samsung-export-mipi-csis-dsim-phy-control-functions.patch b/queue-3.9/arm-samsung-export-mipi-csis-dsim-phy-control-functions.patch new file mode 100644 index 00000000000..db2857accf5 --- /dev/null +++ b/queue-3.9/arm-samsung-export-mipi-csis-dsim-phy-control-functions.patch @@ -0,0 +1,43 @@ +From 30da66eafc015cd7e952829eaf8f86d8680f86d9 Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Wed, 9 Jan 2013 17:39:51 -0800 +Subject: ARM: SAMSUNG: Export MIPI CSIS/DSIM PHY control functions + +From: Sylwester Nawrocki + +commit 30da66eafc015cd7e952829eaf8f86d8680f86d9 upstream. + +The s5p_csis_phy_enable/s5p_dsim_phy_enable functions are now used +directly by corresponding drivers and thus need to be exported so +the drivers can be built as modules. + +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Kyungmin Park +Signed-off-by: Kukjin Kim +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/plat-samsung/setup-mipiphy.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/plat-samsung/setup-mipiphy.c ++++ b/arch/arm/plat-samsung/setup-mipiphy.c +@@ -8,6 +8,7 @@ + * published by the Free Software Foundation. + */ + ++#include + #include + #include + #include +@@ -50,8 +51,10 @@ int s5p_csis_phy_enable(int id, bool on) + { + return __s5p_mipi_phy_control(id, on, S5P_MIPI_DPHY_SRESETN); + } ++EXPORT_SYMBOL(s5p_csis_phy_enable); + + int s5p_dsim_phy_enable(struct platform_device *pdev, bool on) + { + return __s5p_mipi_phy_control(pdev->id, on, S5P_MIPI_DPHY_MRESETN); + } ++EXPORT_SYMBOL(s5p_dsim_phy_enable); diff --git a/queue-3.9/arm64-don-t-kill-the-kernel-on-a-bad-esr-from-el0.patch b/queue-3.9/arm64-don-t-kill-the-kernel-on-a-bad-esr-from-el0.patch new file mode 100644 index 00000000000..fcce989311e --- /dev/null +++ b/queue-3.9/arm64-don-t-kill-the-kernel-on-a-bad-esr-from-el0.patch @@ -0,0 +1,48 @@ +From 9955ac47f4ba1c95ecb6092aeaefb40a22e99268 Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Tue, 28 May 2013 15:54:15 +0100 +Subject: arm64: don't kill the kernel on a bad esr from el0 + +From: Mark Rutland + +commit 9955ac47f4ba1c95ecb6092aeaefb40a22e99268 upstream. + +Rather than completely killing the kernel if we receive an esr value we +can't deal with in the el0 handlers, send the process a SIGILL and log +the esr value in the hope that we can debug it. If we receive a bad esr +from el1, we'll die() as before. + +Signed-off-by: Mark Rutland +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/traps.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -317,14 +317,20 @@ asmlinkage long do_ni_syscall(struct pt_ + */ + asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr) + { ++ siginfo_t info; ++ void __user *pc = (void __user *)instruction_pointer(regs); + console_verbose(); + + pr_crit("Bad mode in %s handler detected, code 0x%08x\n", + handler[reason], esr); ++ __show_regs(regs); + +- die("Oops - bad mode", regs, 0); +- local_irq_disable(); +- panic("bad mode"); ++ info.si_signo = SIGILL; ++ info.si_errno = 0; ++ info.si_code = ILL_ILLOPC; ++ info.si_addr = pc; ++ ++ arm64_notify_die("Oops - bad mode", regs, &info, 0); + } + + void __pte_error(const char *file, int line, unsigned long val) diff --git a/queue-3.9/asoc-cs42l52-fix-default-value-for-mastera_vol.patch b/queue-3.9/asoc-cs42l52-fix-default-value-for-mastera_vol.patch new file mode 100644 index 00000000000..7857edb2e3d --- /dev/null +++ b/queue-3.9/asoc-cs42l52-fix-default-value-for-mastera_vol.patch @@ -0,0 +1,32 @@ +From 04d245b7899c020559402841d2f70ddd740a7704 Mon Sep 17 00:00:00 2001 +From: Nicolas Schichan +Date: Thu, 23 May 2013 16:53:02 +0200 +Subject: ASoC: cs42l52: fix default value for MASTERA_VOL. + +From: Nicolas Schichan + +commit 04d245b7899c020559402841d2f70ddd740a7704 upstream. + +The default register value for MASTERA_VOL is 0x00, the same as +MASTERB_VOL. + +Signed-off-by: Nicolas Schichan +Acked-by: Brian Austin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/cs42l52.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/cs42l52.c ++++ b/sound/soc/codecs/cs42l52.c +@@ -86,7 +86,7 @@ static const struct reg_default cs42l52_ + { CS42L52_BEEP_VOL, 0x00 }, /* r1D Beep Volume off Time */ + { CS42L52_BEEP_TONE_CTL, 0x00 }, /* r1E Beep Tone Cfg. */ + { CS42L52_TONE_CTL, 0x00 }, /* r1F Tone Ctl */ +- { CS42L52_MASTERA_VOL, 0x88 }, /* r20 Master A Volume */ ++ { CS42L52_MASTERA_VOL, 0x00 }, /* r20 Master A Volume */ + { CS42L52_MASTERB_VOL, 0x00 }, /* r21 Master B Volume */ + { CS42L52_HPA_VOL, 0x00 }, /* r22 Headphone A Volume */ + { CS42L52_HPB_VOL, 0x00 }, /* r23 Headphone B Volume */ diff --git a/queue-3.9/asoc-wm5110-correct-dsp4r-mixer-control-name.patch b/queue-3.9/asoc-wm5110-correct-dsp4r-mixer-control-name.patch new file mode 100644 index 00000000000..7220027c94e --- /dev/null +++ b/queue-3.9/asoc-wm5110-correct-dsp4r-mixer-control-name.patch @@ -0,0 +1,28 @@ +From 39d4ecdb711ba44e0aa0b2f3db74ed5ac97abe21 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Fri, 24 May 2013 11:38:24 +0100 +Subject: ASoC: wm5110: Correct DSP4R Mixer control name + +From: Charles Keepax + +commit 39d4ecdb711ba44e0aa0b2f3db74ed5ac97abe21 upstream. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm5110.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm5110.c ++++ b/sound/soc/codecs/wm5110.c +@@ -190,7 +190,7 @@ ARIZONA_MIXER_CONTROLS("DSP2R", ARIZONA_ + ARIZONA_MIXER_CONTROLS("DSP3L", ARIZONA_DSP3LMIX_INPUT_1_SOURCE), + ARIZONA_MIXER_CONTROLS("DSP3R", ARIZONA_DSP3RMIX_INPUT_1_SOURCE), + ARIZONA_MIXER_CONTROLS("DSP4L", ARIZONA_DSP4LMIX_INPUT_1_SOURCE), +-ARIZONA_MIXER_CONTROLS("DSP5R", ARIZONA_DSP4RMIX_INPUT_1_SOURCE), ++ARIZONA_MIXER_CONTROLS("DSP4R", ARIZONA_DSP4RMIX_INPUT_1_SOURCE), + + ARIZONA_MIXER_CONTROLS("Mic", ARIZONA_MICMIX_INPUT_1_SOURCE), + ARIZONA_MIXER_CONTROLS("Noise", ARIZONA_NOISEMIX_INPUT_1_SOURCE), diff --git a/queue-3.9/cifs-fix-potential-buffer-overrun-when-composing-a-new-options-string.patch b/queue-3.9/cifs-fix-potential-buffer-overrun-when-composing-a-new-options-string.patch new file mode 100644 index 00000000000..e774793f61b --- /dev/null +++ b/queue-3.9/cifs-fix-potential-buffer-overrun-when-composing-a-new-options-string.patch @@ -0,0 +1,42 @@ +From 166faf21bd14bc5c5295a44874bf7f3930c30b20 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Fri, 24 May 2013 07:40:04 -0400 +Subject: cifs: fix potential buffer overrun when composing a new options string + +From: Jeff Layton + +commit 166faf21bd14bc5c5295a44874bf7f3930c30b20 upstream. + +Consider the case where we have a very short ip= string in the original +mount options, and when we chase a referral we end up with a very long +IPv6 address. Be sure to allow for that possibility when estimating the +size of the string to allocate. + +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifs_dfs_ref.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/cifs/cifs_dfs_ref.c ++++ b/fs/cifs/cifs_dfs_ref.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include "cifsglob.h" + #include "cifsproto.h" + #include "cifsfs.h" +@@ -150,7 +151,8 @@ char *cifs_compose_mount_options(const c + * assuming that we have 'unc=' and 'ip=' in + * the original sb_mountdata + */ +- md_len = strlen(sb_mountdata) + rc + strlen(ref->node_name) + 12; ++ md_len = strlen(sb_mountdata) + rc + strlen(ref->node_name) + 12 + ++ INET6_ADDRSTRLEN; + mountdata = kzalloc(md_len+1, GFP_KERNEL); + if (mountdata == NULL) { + rc = -ENOMEM; diff --git a/queue-3.9/crypto-caam-fix-inconsistent-assoc-dma-mapping-direction.patch b/queue-3.9/crypto-caam-fix-inconsistent-assoc-dma-mapping-direction.patch new file mode 100644 index 00000000000..0805ecafa3a --- /dev/null +++ b/queue-3.9/crypto-caam-fix-inconsistent-assoc-dma-mapping-direction.patch @@ -0,0 +1,41 @@ +From 286233e604d79f0c7fa04abec2180d5d89a74749 Mon Sep 17 00:00:00 2001 +From: Horia Geanta +Date: Fri, 10 May 2013 15:08:39 +0300 +Subject: crypto: caam - fix inconsistent assoc dma mapping direction + +From: Horia Geanta + +commit 286233e604d79f0c7fa04abec2180d5d89a74749 upstream. + +req->assoc is dma mapped BIDIRECTIONAL and unmapped TO_DEVICE. +Since it is read-only for the device, use TO_DEVICE both for mapping +and unmapping. + +Signed-off-by: Horia Geanta +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/caam/caamalg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -1154,7 +1154,7 @@ static struct aead_edesc *aead_edesc_all + dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained); + + sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1, +- DMA_BIDIRECTIONAL, assoc_chained); ++ DMA_TO_DEVICE, assoc_chained); + if (likely(req->src == req->dst)) { + sgc = dma_map_sg_chained(jrdev, req->src, src_nents ? : 1, + DMA_BIDIRECTIONAL, src_chained); +@@ -1336,7 +1336,7 @@ static struct aead_edesc *aead_giv_edesc + dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained); + + sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1, +- DMA_BIDIRECTIONAL, assoc_chained); ++ DMA_TO_DEVICE, assoc_chained); + if (likely(req->src == req->dst)) { + sgc = dma_map_sg_chained(jrdev, req->src, src_nents ? : 1, + DMA_BIDIRECTIONAL, src_chained); diff --git a/queue-3.9/drm-i915-adding-more-reserved-pci-ids-for-haswell.patch b/queue-3.9/drm-i915-adding-more-reserved-pci-ids-for-haswell.patch new file mode 100644 index 00000000000..5b42d11c692 --- /dev/null +++ b/queue-3.9/drm-i915-adding-more-reserved-pci-ids-for-haswell.patch @@ -0,0 +1,107 @@ +From 1c98b4871cca4b7ce07e19f92f934d47cf7210b0 Mon Sep 17 00:00:00 2001 +From: Rodrigo Vivi +Date: Mon, 13 May 2013 18:12:25 -0300 +Subject: drm/i915: Adding more reserved PCI IDs for Haswell. + +From: Rodrigo Vivi + +commit 1c98b4871cca4b7ce07e19f92f934d47cf7210b0 upstream. + +At DDX commit Chris mentioned the tendency we have of finding out more +PCI IDs only when users report. So Let's add all new reserved Haswell IDs. + +This patch also fix GT3 names. I'no not sending in separated patche because +names are only in few comments and not in variable names. + +v2: Fix some mobile ids (by Paulo) + +References: http://bugs.freedesktop.org/show_bug.cgi?id=63701 +Cc: Chris Wilson +Cc: Paulo Zanoni +Signed-off-by: Rodrigo Vivi +Reviewed-by: Paulo Zanoni +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 46 ++++++++++++++++++++++++++++++---------- + 1 file changed, 35 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -359,40 +359,64 @@ static const struct pci_device_id pciidl + INTEL_VGA_DEVICE(0x016a, &intel_ivybridge_d_info), /* GT2 server */ + INTEL_VGA_DEVICE(0x0402, &intel_haswell_d_info), /* GT1 desktop */ + INTEL_VGA_DEVICE(0x0412, &intel_haswell_d_info), /* GT2 desktop */ +- INTEL_VGA_DEVICE(0x0422, &intel_haswell_d_info), /* GT2 desktop */ ++ INTEL_VGA_DEVICE(0x0422, &intel_haswell_d_info), /* GT3 desktop */ + INTEL_VGA_DEVICE(0x040a, &intel_haswell_d_info), /* GT1 server */ + INTEL_VGA_DEVICE(0x041a, &intel_haswell_d_info), /* GT2 server */ +- INTEL_VGA_DEVICE(0x042a, &intel_haswell_d_info), /* GT2 server */ ++ INTEL_VGA_DEVICE(0x042a, &intel_haswell_d_info), /* GT3 server */ + INTEL_VGA_DEVICE(0x0406, &intel_haswell_m_info), /* GT1 mobile */ + INTEL_VGA_DEVICE(0x0416, &intel_haswell_m_info), /* GT2 mobile */ + INTEL_VGA_DEVICE(0x0426, &intel_haswell_m_info), /* GT2 mobile */ ++ INTEL_VGA_DEVICE(0x040B, &intel_haswell_d_info), /* GT1 reserved */ ++ INTEL_VGA_DEVICE(0x041B, &intel_haswell_d_info), /* GT2 reserved */ ++ INTEL_VGA_DEVICE(0x042B, &intel_haswell_d_info), /* GT3 reserved */ ++ INTEL_VGA_DEVICE(0x040E, &intel_haswell_d_info), /* GT1 reserved */ ++ INTEL_VGA_DEVICE(0x041E, &intel_haswell_d_info), /* GT2 reserved */ ++ INTEL_VGA_DEVICE(0x042E, &intel_haswell_d_info), /* GT3 reserved */ + INTEL_VGA_DEVICE(0x0C02, &intel_haswell_d_info), /* SDV GT1 desktop */ + INTEL_VGA_DEVICE(0x0C12, &intel_haswell_d_info), /* SDV GT2 desktop */ +- INTEL_VGA_DEVICE(0x0C22, &intel_haswell_d_info), /* SDV GT2 desktop */ ++ INTEL_VGA_DEVICE(0x0C22, &intel_haswell_d_info), /* SDV GT3 desktop */ + INTEL_VGA_DEVICE(0x0C0A, &intel_haswell_d_info), /* SDV GT1 server */ + INTEL_VGA_DEVICE(0x0C1A, &intel_haswell_d_info), /* SDV GT2 server */ +- INTEL_VGA_DEVICE(0x0C2A, &intel_haswell_d_info), /* SDV GT2 server */ ++ INTEL_VGA_DEVICE(0x0C2A, &intel_haswell_d_info), /* SDV GT3 server */ + INTEL_VGA_DEVICE(0x0C06, &intel_haswell_m_info), /* SDV GT1 mobile */ + INTEL_VGA_DEVICE(0x0C16, &intel_haswell_m_info), /* SDV GT2 mobile */ +- INTEL_VGA_DEVICE(0x0C26, &intel_haswell_m_info), /* SDV GT2 mobile */ ++ INTEL_VGA_DEVICE(0x0C26, &intel_haswell_m_info), /* SDV GT3 mobile */ ++ INTEL_VGA_DEVICE(0x0C0B, &intel_haswell_d_info), /* SDV GT1 reserved */ ++ INTEL_VGA_DEVICE(0x0C1B, &intel_haswell_d_info), /* SDV GT2 reserved */ ++ INTEL_VGA_DEVICE(0x0C2B, &intel_haswell_d_info), /* SDV GT3 reserved */ ++ INTEL_VGA_DEVICE(0x0C0E, &intel_haswell_d_info), /* SDV GT1 reserved */ ++ INTEL_VGA_DEVICE(0x0C1E, &intel_haswell_d_info), /* SDV GT2 reserved */ ++ INTEL_VGA_DEVICE(0x0C2E, &intel_haswell_d_info), /* SDV GT3 reserved */ + INTEL_VGA_DEVICE(0x0A02, &intel_haswell_d_info), /* ULT GT1 desktop */ + INTEL_VGA_DEVICE(0x0A12, &intel_haswell_d_info), /* ULT GT2 desktop */ +- INTEL_VGA_DEVICE(0x0A22, &intel_haswell_d_info), /* ULT GT2 desktop */ ++ INTEL_VGA_DEVICE(0x0A22, &intel_haswell_d_info), /* ULT GT3 desktop */ + INTEL_VGA_DEVICE(0x0A0A, &intel_haswell_d_info), /* ULT GT1 server */ + INTEL_VGA_DEVICE(0x0A1A, &intel_haswell_d_info), /* ULT GT2 server */ +- INTEL_VGA_DEVICE(0x0A2A, &intel_haswell_d_info), /* ULT GT2 server */ ++ INTEL_VGA_DEVICE(0x0A2A, &intel_haswell_d_info), /* ULT GT3 server */ + INTEL_VGA_DEVICE(0x0A06, &intel_haswell_m_info), /* ULT GT1 mobile */ + INTEL_VGA_DEVICE(0x0A16, &intel_haswell_m_info), /* ULT GT2 mobile */ +- INTEL_VGA_DEVICE(0x0A26, &intel_haswell_m_info), /* ULT GT2 mobile */ ++ INTEL_VGA_DEVICE(0x0A26, &intel_haswell_m_info), /* ULT GT3 mobile */ ++ INTEL_VGA_DEVICE(0x0A0B, &intel_haswell_d_info), /* ULT GT1 reserved */ ++ INTEL_VGA_DEVICE(0x0A1B, &intel_haswell_d_info), /* ULT GT2 reserved */ ++ INTEL_VGA_DEVICE(0x0A2B, &intel_haswell_d_info), /* ULT GT3 reserved */ ++ INTEL_VGA_DEVICE(0x0A0E, &intel_haswell_m_info), /* ULT GT1 reserved */ ++ INTEL_VGA_DEVICE(0x0A1E, &intel_haswell_m_info), /* ULT GT2 reserved */ ++ INTEL_VGA_DEVICE(0x0A2E, &intel_haswell_m_info), /* ULT GT3 reserved */ + INTEL_VGA_DEVICE(0x0D02, &intel_haswell_d_info), /* CRW GT1 desktop */ + INTEL_VGA_DEVICE(0x0D12, &intel_haswell_d_info), /* CRW GT2 desktop */ +- INTEL_VGA_DEVICE(0x0D22, &intel_haswell_d_info), /* CRW GT2 desktop */ ++ INTEL_VGA_DEVICE(0x0D22, &intel_haswell_d_info), /* CRW GT3 desktop */ + INTEL_VGA_DEVICE(0x0D0A, &intel_haswell_d_info), /* CRW GT1 server */ + INTEL_VGA_DEVICE(0x0D1A, &intel_haswell_d_info), /* CRW GT2 server */ +- INTEL_VGA_DEVICE(0x0D2A, &intel_haswell_d_info), /* CRW GT2 server */ ++ INTEL_VGA_DEVICE(0x0D2A, &intel_haswell_d_info), /* CRW GT3 server */ + INTEL_VGA_DEVICE(0x0D06, &intel_haswell_m_info), /* CRW GT1 mobile */ + INTEL_VGA_DEVICE(0x0D16, &intel_haswell_m_info), /* CRW GT2 mobile */ +- INTEL_VGA_DEVICE(0x0D26, &intel_haswell_m_info), /* CRW GT2 mobile */ ++ INTEL_VGA_DEVICE(0x0D26, &intel_haswell_m_info), /* CRW GT3 mobile */ ++ INTEL_VGA_DEVICE(0x0D0B, &intel_haswell_d_info), /* CRW GT1 reserved */ ++ INTEL_VGA_DEVICE(0x0D1B, &intel_haswell_d_info), /* CRW GT2 reserved */ ++ INTEL_VGA_DEVICE(0x0D2B, &intel_haswell_d_info), /* CRW GT3 reserved */ ++ INTEL_VGA_DEVICE(0x0D0E, &intel_haswell_d_info), /* CRW GT1 reserved */ ++ INTEL_VGA_DEVICE(0x0D1E, &intel_haswell_d_info), /* CRW GT2 reserved */ ++ INTEL_VGA_DEVICE(0x0D2E, &intel_haswell_d_info), /* CRW GT3 reserved */ + INTEL_VGA_DEVICE(0x0f30, &intel_valleyview_m_info), + INTEL_VGA_DEVICE(0x0157, &intel_valleyview_m_info), + INTEL_VGA_DEVICE(0x0155, &intel_valleyview_d_info), diff --git a/queue-3.9/drm-radeon-fix-card_posted-check-for-newer-asics.patch b/queue-3.9/drm-radeon-fix-card_posted-check-for-newer-asics.patch new file mode 100644 index 00000000000..472eba87e4e --- /dev/null +++ b/queue-3.9/drm-radeon-fix-card_posted-check-for-newer-asics.patch @@ -0,0 +1,52 @@ +From 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 22 May 2013 11:22:51 -0400 +Subject: drm/radeon: fix card_posted check for newer asics + +From: Alex Deucher + +commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream. + +Newer asics have variable numbers of crtcs. Use that +rather than the asic family to determine which crtcs +to check. This avoids checking non-existent crtcs or +missing crtcs on certain asics. + +Reviewed-by: Michel Dänzer +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_device.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -435,18 +435,17 @@ bool radeon_card_posted(struct radeon_de + return false; + + /* first check CRTCs */ +- if (ASIC_IS_DCE41(rdev)) { ++ if (ASIC_IS_DCE4(rdev)) { + reg = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET) | + RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET); +- if (reg & EVERGREEN_CRTC_MASTER_EN) +- return true; +- } else if (ASIC_IS_DCE4(rdev)) { +- reg = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET) | +- RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET) | +- RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET) | +- RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET) | +- RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET) | +- RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET); ++ if (rdev->num_crtc >= 4) { ++ reg |= RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET) | ++ RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET); ++ } ++ if (rdev->num_crtc >= 6) { ++ reg |= RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET) | ++ RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET); ++ } + if (reg & EVERGREEN_CRTC_MASTER_EN) + return true; + } else if (ASIC_IS_AVIVO(rdev)) { diff --git a/queue-3.9/drm-radeon-fix-typo-in-cu_per_sh-on-verde.patch b/queue-3.9/drm-radeon-fix-typo-in-cu_per_sh-on-verde.patch new file mode 100644 index 00000000000..1638ba5c329 --- /dev/null +++ b/queue-3.9/drm-radeon-fix-typo-in-cu_per_sh-on-verde.patch @@ -0,0 +1,31 @@ +From 468ef1a58c9268ac9709350bf95eaf1c22a69f29 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 21 May 2013 13:35:19 -0400 +Subject: drm/radeon: fix typo in cu_per_sh on verde + +From: Alex Deucher + +commit 468ef1a58c9268ac9709350bf95eaf1c22a69f29 upstream. + +Should be 5 rather than 2. + +Noticed by sroland and glisse on IRC. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -1645,7 +1645,7 @@ static void si_gpu_init(struct radeon_de + default: + rdev->config.si.max_shader_engines = 1; + rdev->config.si.max_tile_pipes = 4; +- rdev->config.si.max_cu_per_sh = 2; ++ rdev->config.si.max_cu_per_sh = 5; + rdev->config.si.max_sh_per_se = 2; + rdev->config.si.max_backends_per_se = 4; + rdev->config.si.max_texture_channel_caches = 4; diff --git a/queue-3.9/series b/queue-3.9/series index 3fb334aac83..8d29b907d71 100644 --- a/queue-3.9/series +++ b/queue-3.9/series @@ -59,3 +59,15 @@ x86-64-init-fix-a-possible-wraparound-bug-in-switchover-in-head_64.s.patch x86-range-fix-missing-merge-during-add-range.patch x86-crc32-pclmul-fix-build-with-older-binutils.patch module-don-t-unlink-the-module-until-we-ve-removed-all-exposure.patch +xfs-kill-suid-sgid-through-the-truncate-path.patch +arm64-don-t-kill-the-kernel-on-a-bad-esr-from-el0.patch +arm-samsung-export-mipi-csis-dsim-phy-control-functions.patch +sunrpc-prevent-an-rpc_task-wakeup-race.patch +svcrpc-fix-failures-to-handle-1-uid-s-and-gid-s.patch +asoc-cs42l52-fix-default-value-for-mastera_vol.patch +asoc-wm5110-correct-dsp4r-mixer-control-name.patch +drm-i915-adding-more-reserved-pci-ids-for-haswell.patch +drm-radeon-fix-typo-in-cu_per_sh-on-verde.patch +drm-radeon-fix-card_posted-check-for-newer-asics.patch +crypto-caam-fix-inconsistent-assoc-dma-mapping-direction.patch +cifs-fix-potential-buffer-overrun-when-composing-a-new-options-string.patch diff --git a/queue-3.9/sunrpc-prevent-an-rpc_task-wakeup-race.patch b/queue-3.9/sunrpc-prevent-an-rpc_task-wakeup-race.patch new file mode 100644 index 00000000000..a4d72cc8600 --- /dev/null +++ b/queue-3.9/sunrpc-prevent-an-rpc_task-wakeup-race.patch @@ -0,0 +1,43 @@ +From a3c3cac5d31879cd9ae2de7874dc6544ca704aec Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 22 May 2013 12:57:24 -0400 +Subject: SUNRPC: Prevent an rpc_task wakeup race + +From: Trond Myklebust + +commit a3c3cac5d31879cd9ae2de7874dc6544ca704aec upstream. + +The lockless RPC_IS_QUEUED() test in __rpc_execute means that we need to +be careful about ordering the calls to rpc_test_and_set_running(task) and +rpc_clear_queued(task). If we get the order wrong, then we may end up +testing the RPC_TASK_RUNNING flag after __rpc_execute() has looped +and changed the state of the rpc_task. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/sched.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -324,11 +324,17 @@ EXPORT_SYMBOL_GPL(__rpc_wait_for_complet + * Note: If the task is ASYNC, and is being made runnable after sitting on an + * rpc_wait_queue, this must be called with the queue spinlock held to protect + * the wait queue operation. ++ * Note the ordering of rpc_test_and_set_running() and rpc_clear_queued(), ++ * which is needed to ensure that __rpc_execute() doesn't loop (due to the ++ * lockless RPC_IS_QUEUED() test) before we've had a chance to test ++ * the RPC_TASK_RUNNING flag. + */ + static void rpc_make_runnable(struct rpc_task *task) + { ++ bool need_wakeup = !rpc_test_and_set_running(task); ++ + rpc_clear_queued(task); +- if (rpc_test_and_set_running(task)) ++ if (!need_wakeup) + return; + if (RPC_IS_ASYNC(task)) { + INIT_WORK(&task->u.tk_work, rpc_async_schedule); diff --git a/queue-3.9/svcrpc-fix-failures-to-handle-1-uid-s-and-gid-s.patch b/queue-3.9/svcrpc-fix-failures-to-handle-1-uid-s-and-gid-s.patch new file mode 100644 index 00000000000..103f65d9ec3 --- /dev/null +++ b/queue-3.9/svcrpc-fix-failures-to-handle-1-uid-s-and-gid-s.patch @@ -0,0 +1,57 @@ +From afe3c3fd5392b2f0066930abc5dbd3f4b14a0f13 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Fri, 24 May 2013 17:24:34 -0400 +Subject: svcrpc: fix failures to handle -1 uid's and gid's + +From: "J. Bruce Fields" + +commit afe3c3fd5392b2f0066930abc5dbd3f4b14a0f13 upstream. + +As of f025adf191924e3a75ce80e130afcd2485b53bb8 "sunrpc: Properly decode +kuids and kgids in RPC_AUTH_UNIX credentials" any rpc containing a -1 +(0xffff) uid or gid would fail with a badcred error. + +Reported symptoms were xmbc clients failing on upgrade of the NFS +server; examination of the network trace showed them sending -1 as the +gid. + +Reported-by: Julian Sikorski +Tested-by: Julian Sikorski +Cc: "Eric W. Biederman" +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/svcauth_unix.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/sunrpc/svcauth_unix.c ++++ b/net/sunrpc/svcauth_unix.c +@@ -810,11 +810,15 @@ svcauth_unix_accept(struct svc_rqst *rqs + goto badcred; + argv->iov_base = (void*)((__be32*)argv->iov_base + slen); /* skip machname */ + argv->iov_len -= slen*4; +- ++ /* ++ * Note: we skip uid_valid()/gid_valid() checks here for ++ * backwards compatibility with clients that use -1 id's. ++ * Instead, -1 uid or gid is later mapped to the ++ * (export-specific) anonymous id by nfsd_setuser. ++ * Supplementary gid's will be left alone. ++ */ + cred->cr_uid = make_kuid(&init_user_ns, svc_getnl(argv)); /* uid */ + cred->cr_gid = make_kgid(&init_user_ns, svc_getnl(argv)); /* gid */ +- if (!uid_valid(cred->cr_uid) || !gid_valid(cred->cr_gid)) +- goto badcred; + slen = svc_getnl(argv); /* gids length */ + if (slen > 16 || (len -= (slen + 2)*4) < 0) + goto badcred; +@@ -823,8 +827,6 @@ svcauth_unix_accept(struct svc_rqst *rqs + return SVC_CLOSE; + for (i = 0; i < slen; i++) { + kgid_t kgid = make_kgid(&init_user_ns, svc_getnl(argv)); +- if (!gid_valid(kgid)) +- goto badcred; + GROUP_AT(cred->cr_group_info, i) = kgid; + } + if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) { diff --git a/queue-3.9/xfs-kill-suid-sgid-through-the-truncate-path.patch b/queue-3.9/xfs-kill-suid-sgid-through-the-truncate-path.patch new file mode 100644 index 00000000000..18b1320549d --- /dev/null +++ b/queue-3.9/xfs-kill-suid-sgid-through-the-truncate-path.patch @@ -0,0 +1,101 @@ +From 2962f5a5dcc56f69cbf62121a7be67cc15d6940b Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Mon, 27 May 2013 16:38:25 +1000 +Subject: xfs: kill suid/sgid through the truncate path. + +From: Dave Chinner + +commit 2962f5a5dcc56f69cbf62121a7be67cc15d6940b upstream. + +XFS has failed to kill suid/sgid bits correctly when truncating +files of non-zero size since commit c4ed4243 ("xfs: split +xfs_setattr") introduced in the 3.1 kernel. Fix it. + +Fix it. + +Signed-off-by: Dave Chinner +Reviewed-by: Brian Foster +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_iops.c | 47 ++++++++++++++++++++++++++++++++--------------- + 1 file changed, 32 insertions(+), 15 deletions(-) + +--- a/fs/xfs/xfs_iops.c ++++ b/fs/xfs/xfs_iops.c +@@ -455,6 +455,28 @@ xfs_vn_getattr( + return 0; + } + ++static void ++xfs_setattr_mode( ++ struct xfs_trans *tp, ++ struct xfs_inode *ip, ++ struct iattr *iattr) ++{ ++ struct inode *inode = VFS_I(ip); ++ umode_t mode = iattr->ia_mode; ++ ++ ASSERT(tp); ++ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); ++ ++ if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID)) ++ mode &= ~S_ISGID; ++ ++ ip->i_d.di_mode &= S_IFMT; ++ ip->i_d.di_mode |= mode & ~S_IFMT; ++ ++ inode->i_mode &= S_IFMT; ++ inode->i_mode |= mode & ~S_IFMT; ++} ++ + int + xfs_setattr_nonsize( + struct xfs_inode *ip, +@@ -606,18 +628,8 @@ xfs_setattr_nonsize( + /* + * Change file access modes. + */ +- if (mask & ATTR_MODE) { +- umode_t mode = iattr->ia_mode; +- +- if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID)) +- mode &= ~S_ISGID; +- +- ip->i_d.di_mode &= S_IFMT; +- ip->i_d.di_mode |= mode & ~S_IFMT; +- +- inode->i_mode &= S_IFMT; +- inode->i_mode |= mode & ~S_IFMT; +- } ++ if (mask & ATTR_MODE) ++ xfs_setattr_mode(tp, ip, iattr); + + /* + * Change file access or modified times. +@@ -714,9 +726,8 @@ xfs_setattr_size( + return XFS_ERROR(error); + + ASSERT(S_ISREG(ip->i_d.di_mode)); +- ASSERT((mask & (ATTR_MODE|ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET| +- ATTR_MTIME_SET|ATTR_KILL_SUID|ATTR_KILL_SGID| +- ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0); ++ ASSERT((mask & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET| ++ ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0); + + if (!(flags & XFS_ATTR_NOLOCK)) { + lock_flags |= XFS_IOLOCK_EXCL; +@@ -860,6 +871,12 @@ xfs_setattr_size( + xfs_inode_clear_eofblocks_tag(ip); + } + ++ /* ++ * Change file access modes. ++ */ ++ if (mask & ATTR_MODE) ++ xfs_setattr_mode(tp, ip, iattr); ++ + if (mask & ATTR_CTIME) { + inode->i_ctime = iattr->ia_ctime; + ip->i_d.di_ctime.t_sec = iattr->ia_ctime.tv_sec; -- 2.47.3