3.10-stable patches

added patches:
	staging-r8712u-fix-case-where-ethtype-was-never-obtained-and-always-be-checked-against-0.patch
	xfs-fix-directory-hash-ordering-bug.patch

diff --git a/queue-3.10/series b/queue-3.10/series
index ae2702216a83f00e172eaab27449baf2fbd6db5b..962952473c95338ef99b9e645057f132758fb12d 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -31,3 +31,5 @@ mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch
 mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch
 w1-fix-w1_send_slave-dropping-a-slave-id.patch
 staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch
+staging-r8712u-fix-case-where-ethtype-was-never-obtained-and-always-be-checked-against-0.patch
+xfs-fix-directory-hash-ordering-bug.patch

diff --git a/queue-3.10/staging-r8712u-fix-case-where-ethtype-was-never-obtained-and-always-be-checked-against-0.patch b/queue-3.10/staging-r8712u-fix-case-where-ethtype-was-never-obtained-and-always-be-checked-against-0.patch
new file mode 100644 (file)
index 0000000..95c238d
--- /dev/null
+++ b/queue-3.10/staging-r8712u-fix-case-where-ethtype-was-never-obtained-and-always-be-checked-against-0.patch
@@ -0,0 +1,53 @@
+From f764cd68d9036498f08fe8834deb6a367b5c2542 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 16 Apr 2014 14:49:33 -0500
+Subject: staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.
+
+Zero-initializing ether_type masked that the ether type would never be
+obtained for 8021x packets and the comparison against eapol_type
+would always fail.
+
+Reported-by: Jes Sorensen <Jes.Sorensen@redhat.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/rtl871x_recv.c |   13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/rtl8712/rtl871x_recv.c
++++ b/drivers/staging/rtl8712/rtl871x_recv.c
+@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct
+       struct sta_info *psta;
+       struct  sta_priv *pstapriv;
+       union recv_frame *prtnframe;
+-      u16 ether_type = 0;
++      u16 ether_type;
+ 
+       pstapriv = &adapter->stapriv;
+       ptr = get_recvframe_data(precv_frame);
+@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct
+       psta = r8712_get_stainfo(pstapriv, psta_addr);
+       auth_alg = adapter->securitypriv.AuthAlgrthm;
+       if (auth_alg == 2) {
++              /* get ether_type */
++              ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
++              memcpy(&ether_type, ptr, 2);
++              ether_type = ntohs((unsigned short)ether_type);
++
+               if ((psta != NULL) && (psta->ieee8021x_blocked)) {
+                       /* blocked
+                        * only accept EAPOL frame */
+-                      prtnframe = precv_frame;
+-                      /*get ether_type */
+-                      ptr = ptr + pfhdr->attrib.hdrlen +
+-                            pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
+-                      memcpy(&ether_type, ptr, 2);
+-                      ether_type = ntohs((unsigned short)ether_type);
+                       if (ether_type == 0x888e)
+                               prtnframe = precv_frame;
+                       else {

diff --git a/queue-3.10/xfs-fix-directory-hash-ordering-bug.patch b/queue-3.10/xfs-fix-directory-hash-ordering-bug.patch
new file mode 100644 (file)
index 0000000..4e301c5
--- /dev/null
+++ b/queue-3.10/xfs-fix-directory-hash-ordering-bug.patch
@@ -0,0 +1,55 @@
+From c88547a8119e3b581318ab65e9b72f27f23e641d Mon Sep 17 00:00:00 2001
+From: Mark Tinguely <tinguely@sgi.com>
+Date: Fri, 4 Apr 2014 07:10:49 +1100
+Subject: xfs: fix directory hash ordering bug
+
+From: Mark Tinguely <tinguely@sgi.com>
+
+commit c88547a8119e3b581318ab65e9b72f27f23e641d upstream.
+
+Commit f5ea1100 ("xfs: add CRCs to dir2/da node blocks") introduced
+in 3.10 incorrectly converted the btree hash index array pointer in
+xfs_da3_fixhashpath(). It resulted in the the current hash always
+being compared against the first entry in the btree rather than the
+current block index into the btree block's hash entry array. As a
+result, it was comparing the wrong hashes, and so could misorder the
+entries in the btree.
+
+For most cases, this doesn't cause any problems as it requires hash
+collisions to expose the ordering problem. However, when there are
+hash collisions within a directory there is a very good probability
+that the entries will be ordered incorrectly and that actually
+matters when duplicate hashes are placed into or removed from the
+btree block hash entry array.
+
+This bug results in an on-disk directory corruption and that results
+in directory verifier functions throwing corruption warnings into
+the logs. While no data or directory entries are lost, access to
+them may be compromised, and attempts to remove entries from a
+directory that has suffered from this corruption may result in a
+filesystem shutdown.  xfs_repair will fix the directory hash
+ordering without data loss occuring.
+
+[dchinner: wrote useful a commit message]
+
+Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: Mark Tinguely <tinguely@sgi.com>
+Reviewed-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_da_btree.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_da_btree.c
++++ b/fs/xfs/xfs_da_btree.c
+@@ -1334,7 +1334,7 @@ xfs_da3_fixhashpath(
+               node = blk->bp->b_addr;
+               xfs_da3_node_hdr_from_disk(&nodehdr, node);
+               btree = xfs_da3_node_tree_p(node);
+-              if (be32_to_cpu(btree->hashval) == lasthash)
++              if (be32_to_cpu(btree[blk->index].hashval) == lasthash)
+                       break;
+               blk->hashval = lasthash;
+               btree[blk->index].hashval = cpu_to_be32(lasthash);