--- /dev/null
+From 35f0399db6658f465b00893bdd13b992a0acfef0 Mon Sep 17 00:00:00 2001
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 28 Jun 2013 12:37:45 +0800
+Subject: Btrfs: fix crash regarding to ulist_add_merge
+
+From: Liu Bo <bo.li.liu@oracle.com>
+
+commit 35f0399db6658f465b00893bdd13b992a0acfef0 upstream.
+
+Several users reported this crash of NULL pointer or general protection,
+the story is that we add a rbtree for speedup ulist iteration, and we
+use krealloc() to address ulist growth, and krealloc() use memcpy to copy
+old data to new memory area, so it's OK for an array as it doesn't use
+pointers while it's not OK for a rbtree as it uses pointers.
+
+So krealloc() will mess up our rbtree and it ends up with crash.
+
+Reviewed-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com>
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: Josef Bacik <jbacik@fusionio.com>
+Cc: BJ Quinn <bj@placs.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/ulist.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/fs/btrfs/ulist.c
++++ b/fs/btrfs/ulist.c
+@@ -205,6 +205,10 @@ int ulist_add_merge(struct ulist *ulist,
+ u64 new_alloced = ulist->nodes_alloced + 128;
+ struct ulist_node *new_nodes;
+ void *old = NULL;
++ int i;
++
++ for (i = 0; i < ulist->nnodes; i++)
++ rb_erase(&ulist->nodes[i].rb_node, &ulist->root);
+
+ /*
+ * if nodes_alloced == ULIST_SIZE no memory has been allocated
+@@ -224,6 +228,17 @@ int ulist_add_merge(struct ulist *ulist,
+
+ ulist->nodes = new_nodes;
+ ulist->nodes_alloced = new_alloced;
++
++ /*
++ * krealloc actually uses memcpy, which does not copy rb_node
++ * pointers, so we have to do it ourselves. Otherwise we may
++ * be bitten by crashes.
++ */
++ for (i = 0; i < ulist->nnodes; i++) {
++ ret = ulist_rbtree_insert(ulist, &ulist->nodes[i]);
++ if (ret < 0)
++ return ret;
++ }
+ }
+ ulist->nodes[ulist->nnodes].val = val;
+ ulist->nodes[ulist->nnodes].aux = aux;
--- /dev/null
+From 09ede5414f0215461c933032630bf9c3a61a8ba3 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Tue, 30 Apr 2013 14:01:45 +0200
+Subject: drm/i915: make SDVO TV-out work for multifunction devices
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 09ede5414f0215461c933032630bf9c3a61a8ba3 upstream.
+
+We need to track this correctly. While at it shovel the boolean
+to track whether the sdvo is in tv mode or not into pipe_config.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=36997
+Tested-by: Pierre Assal <pierre.assal@verint.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=63609
+Tested-by: cancan,feng <cancan.feng@intel.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4333,7 +4333,8 @@ static void vlv_update_pll(struct intel_
+
+ static void i9xx_update_pll(struct intel_crtc *crtc,
+ intel_clock_t *reduced_clock,
+- int num_connectors)
++ int num_connectors,
++ bool needs_tv_clock)
+ {
+ struct drm_device *dev = crtc->base.dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -4391,7 +4392,7 @@ static void i9xx_update_pll(struct intel
+ if (INTEL_INFO(dev)->gen >= 4)
+ dpll |= (6 << PLL_LOAD_PULSE_PHASE_SHIFT);
+
+- if (is_sdvo && intel_pipe_has_type(&crtc->base, INTEL_OUTPUT_TVOUT))
++ if (is_sdvo && needs_tv_clock)
+ dpll |= PLL_REF_INPUT_TVCLKINBC;
+ else if (intel_pipe_has_type(&crtc->base, INTEL_OUTPUT_TVOUT))
+ /* XXX: just matching BIOS for now */
+@@ -4716,7 +4717,8 @@ static int i9xx_crtc_mode_set(struct drm
+ else
+ i9xx_update_pll(intel_crtc,
+ has_reduced_clock ? &reduced_clock : NULL,
+- num_connectors);
++ num_connectors,
++ is_sdvo && is_tv);
+
+ /* Set up the display plane register */
+ dspcntr = DISPPLANE_GAMMA_ENABLE;
--- /dev/null
+From 594712276e737961d30e11eae80d403b2b3815df Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Wed, 24 Jul 2013 10:35:33 +0200
+Subject: s390: add support for IBM zBC12 machine
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 594712276e737961d30e11eae80d403b2b3815df upstream.
+
+Just add the new model number where appropiate.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/Kconfig | 7 ++++---
+ arch/s390/kernel/setup.c | 1 +
+ arch/s390/mm/init.c | 1 +
+ arch/s390/oprofile/init.c | 2 +-
+ 4 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -227,11 +227,12 @@ config MARCH_Z196
+ not work on older machines.
+
+ config MARCH_ZEC12
+- bool "IBM zEC12"
++ bool "IBM zBC12 and zEC12"
+ select HAVE_MARCH_ZEC12_FEATURES if 64BIT
+ help
+- Select this to enable optimizations for IBM zEC12 (2827 series). The
+- kernel will be slightly faster but will not work on older machines.
++ Select this to enable optimizations for IBM zBC12 and zEC12 (2828 and
++ 2827 series). The kernel will be slightly faster but will not work on
++ older machines.
+
+ endchoice
+
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -998,6 +998,7 @@ static void __init setup_hwcaps(void)
+ strcpy(elf_platform, "z196");
+ break;
+ case 0x2827:
++ case 0x2828:
+ strcpy(elf_platform, "zEC12");
+ break;
+ }
+--- a/arch/s390/mm/init.c
++++ b/arch/s390/mm/init.c
+@@ -69,6 +69,7 @@ static void __init setup_zero_pages(void
+ order = 2;
+ break;
+ case 0x2827: /* zEC12 */
++ case 0x2828: /* zEC12 */
+ default:
+ order = 5;
+ break;
+--- a/arch/s390/oprofile/init.c
++++ b/arch/s390/oprofile/init.c
+@@ -440,7 +440,7 @@ static int oprofile_hwsampler_init(struc
+ switch (id.machine) {
+ case 0x2097: case 0x2098: ops->cpu_type = "s390/z10"; break;
+ case 0x2817: case 0x2818: ops->cpu_type = "s390/z196"; break;
+- case 0x2827: ops->cpu_type = "s390/zEC12"; break;
++ case 0x2827: case 0x2828: ops->cpu_type = "s390/zEC12"; break;
+ default: return -ENODEV;
+ }
+ }
--- /dev/null
+From 3b0040a47ad63f7147e9e7d2febb61a3b564bb90 Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Thu, 25 Jul 2013 10:18:17 +0200
+Subject: s390/bitops: fix find_next_bit_left
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 3b0040a47ad63f7147e9e7d2febb61a3b564bb90 upstream.
+
+The find_next_bit_left function is broken if used with an offset which
+is not a multiple of 64. The shift to mask the bits of a 64-bit word
+not to search is in the wrong direction, the result can be either a
+bit found smaller than the offset or failure to find a set bit.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/include/asm/bitops.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/include/asm/bitops.h
++++ b/arch/s390/include/asm/bitops.h
+@@ -693,7 +693,7 @@ static inline int find_next_bit_left(con
+ size -= offset;
+ p = addr + offset / BITS_PER_LONG;
+ if (bit) {
+- set = __flo_word(0, *p & (~0UL << bit));
++ set = __flo_word(0, *p & (~0UL >> bit));
+ if (set >= size)
+ return size + offset;
+ if (set < BITS_PER_LONG)
fanotify-info-leak-in-copy_event_to_user.patch
cgroup-fix-umount-vs-cgroup_cfts_commit-race.patch
drm-radeon-never-unpin-uvd-bo-v3.patch
+x86-fpu-correct-the-asm-constraints-for-fxsave-unbreak-mxcsr.daz.patch
+btrfs-fix-crash-regarding-to-ulist_add_merge.patch
+drm-i915-make-sdvo-tv-out-work-for-multifunction-devices.patch
+s390-add-support-for-ibm-zbc12-machine.patch
+s390-bitops-fix-find_next_bit_left.patch
+workqueue-copy-workqueue_attrs-with-all-fields.patch
+userns-unshare_userns-cred-should-not-populate-cred-on-failure.patch
+x86-iommu-vt-d-expand-interrupt-remapping-quirk-to-cover-x58-chipset.patch
+spi-spi-davinci-fix-direction-in-dma_map_single.patch
--- /dev/null
+From 89c66ee890af18500fa4598db300cc07c267f900 Mon Sep 17 00:00:00 2001
+From: Christian Eggers <ceggers@gmx.de>
+Date: Mon, 29 Jul 2013 20:54:09 +0200
+Subject: spi: spi-davinci: Fix direction in dma_map_single()
+
+From: Christian Eggers <ceggers@gmx.de>
+
+commit 89c66ee890af18500fa4598db300cc07c267f900 upstream.
+
+Commit 048177ce3b3962852fd34a7e04938959271c7e70 (spi: spi-davinci:
+convert to DMA engine API) introduced a regression: dma_map_single()
+is called with direction DMA_FROM_DEVICE for rx and for tx.
+
+Signed-off-by: Christian Eggers <ceggers@gmx.de>
+Acked-by: Matt Porter <mporter@ti.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-davinci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -610,7 +610,7 @@ static int davinci_spi_bufs(struct spi_d
+ else
+ buf = (void *)t->tx_buf;
+ t->tx_dma = dma_map_single(&spi->dev, buf,
+- t->len, DMA_FROM_DEVICE);
++ t->len, DMA_TO_DEVICE);
+ if (!t->tx_dma) {
+ ret = -EFAULT;
+ goto err_tx_map;
--- /dev/null
+From 6160968cee8b90a5dd95318d716e31d7775c4ef3 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Tue, 6 Aug 2013 19:38:55 +0200
+Subject: userns: unshare_userns(&cred) should not populate cred on failure
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 6160968cee8b90a5dd95318d716e31d7775c4ef3 upstream.
+
+unshare_userns(new_cred) does *new_cred = prepare_creds() before
+create_user_ns() which can fail. However, the caller expects that
+it doesn't need to take care of new_cred if unshare_userns() fails.
+
+We could change the single caller, sys_unshare(), but I think it
+would be more clean to avoid the side effects on failure, so with
+this patch unshare_userns() does put_cred() itself and initializes
+*new_cred only if create_user_ns() succeeeds.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/user_namespace.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -105,16 +105,21 @@ int create_user_ns(struct cred *new)
+ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
+ {
+ struct cred *cred;
++ int err = -ENOMEM;
+
+ if (!(unshare_flags & CLONE_NEWUSER))
+ return 0;
+
+ cred = prepare_creds();
+- if (!cred)
+- return -ENOMEM;
++ if (cred) {
++ err = create_user_ns(cred);
++ if (err)
++ put_cred(cred);
++ else
++ *new_cred = cred;
++ }
+
+- *new_cred = cred;
+- return create_user_ns(cred);
++ return err;
+ }
+
+ void free_user_ns(struct user_namespace *ns)
--- /dev/null
+From 2865a8fb44cc32420407362cbda80c10fa09c6b2 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Thu, 1 Aug 2013 09:56:36 +0800
+Subject: workqueue: copy workqueue_attrs with all fields
+
+From: Shaohua Li <shli@kernel.org>
+
+commit 2865a8fb44cc32420407362cbda80c10fa09c6b2 upstream.
+
+ $echo '0' > /sys/bus/workqueue/devices/xxx/numa
+ $cat /sys/bus/workqueue/devices/xxx/numa
+
+I got 1. It should be 0, the reason is copy_workqueue_attrs() called
+in apply_workqueue_attrs() doesn't copy no_numa field.
+
+Fix it by making copy_workqueue_attrs() copy ->no_numa too. This
+would also make get_unbound_pool() set a pool's ->no_numa attribute
+according to the workqueue attributes used when the pool was created.
+While harmelss, as ->no_numa isn't a pool attribute, this is a bit
+confusing. Clear it explicitly.
+
+tj: Updated description and comments a bit.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3398,6 +3398,12 @@ static void copy_workqueue_attrs(struct
+ {
+ to->nice = from->nice;
+ cpumask_copy(to->cpumask, from->cpumask);
++ /*
++ * Unlike hash and equality test, this function doesn't ignore
++ * ->no_numa as it is used for both pool and wq attrs. Instead,
++ * get_unbound_pool() explicitly clears ->no_numa after copying.
++ */
++ to->no_numa = from->no_numa;
+ }
+
+ /* hash value of the content of @attr */
+@@ -3565,6 +3571,12 @@ static struct worker_pool *get_unbound_p
+ lockdep_set_subclass(&pool->lock, 1); /* see put_pwq() */
+ copy_workqueue_attrs(pool->attrs, attrs);
+
++ /*
++ * no_numa isn't a worker_pool attribute, always clear it. See
++ * 'struct workqueue_attrs' comments for detail.
++ */
++ pool->attrs->no_numa = false;
++
+ /* if cpumask is contained inside a NUMA node, we belong to that node */
+ if (wq_numa_enabled) {
+ for_each_node(node) {
--- /dev/null
+From eaa5a990191d204ba0f9d35dbe5505ec2cdd1460 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Fri, 26 Jul 2013 09:11:56 -0700
+Subject: x86, fpu: correct the asm constraints for fxsave, unbreak mxcsr.daz
+
+From: "H.J. Lu" <hjl.tools@gmail.com>
+
+commit eaa5a990191d204ba0f9d35dbe5505ec2cdd1460 upstream.
+
+GCC will optimize mxcsr_feature_mask_init in arch/x86/kernel/i387.c:
+
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+ asm volatile("fxsave %0" : : "m" (fx_scratch));
+ mask = fx_scratch.mxcsr_mask;
+ if (mask == 0)
+ mask = 0x0000ffbf;
+
+to
+
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+ asm volatile("fxsave %0" : : "m" (fx_scratch));
+ mask = 0x0000ffbf;
+
+since asm statement doesn’t say it will update fx_scratch. As the
+result, the DAZ bit will be cleared. This patch fixes it. This bug
+dates back to at least kernel 2.6.12.
+
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/i387.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -116,7 +116,7 @@ static void __cpuinit mxcsr_feature_mask
+
+ if (cpu_has_fxsr) {
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+- asm volatile("fxsave %0" : : "m" (fx_scratch));
++ asm volatile("fxsave %0" : "+m" (fx_scratch));
+ mask = fx_scratch.mxcsr_mask;
+ if (mask == 0)
+ mask = 0x0000ffbf;
--- /dev/null
+From 803075dba31c17af110e1d9a915fe7262165b213 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Wed, 17 Jul 2013 07:13:59 -0400
+Subject: x86/iommu/vt-d: Expand interrupt remapping quirk to cover x58 chipset
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+commit 803075dba31c17af110e1d9a915fe7262165b213 upstream.
+
+Recently we added an early quirk to detect 5500/5520 chipsets
+with early revisions that had problems with irq draining with
+interrupt remapping enabled:
+
+ commit 03bbcb2e7e292838bb0244f5a7816d194c911d62
+ Author: Neil Horman <nhorman@tuxdriver.com>
+ Date: Tue Apr 16 16:38:32 2013 -0400
+
+ iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets
+
+It turns out this same problem is present in the intel X58
+chipset as well. See errata 69 here:
+
+ http://www.intel.com/content/www/us/en/chipsets/x58-express-specification-update.html
+
+This patch extends the pci early quirk so that the chip
+devices/revisions specified in the above update are also covered
+in the same way:
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Donald Dutile <ddutile@redhat.com>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: Malcolm Crossley <malcolm.crossley@citrix.com>
+Cc: Prarit Bhargava <prarit@redhat.com>
+Cc: Don Zickus <dzickus@redhat.com>
+Link: http://lkml.kernel.org/r/1374059639-8631-1-git-send-email-nhorman@tuxdriver.com
+[ Small edits. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/early-quirks.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -196,15 +196,23 @@ static void __init ati_bugs_contd(int nu
+ static void __init intel_remapping_check(int num, int slot, int func)
+ {
+ u8 revision;
++ u16 device;
+
++ device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
+ revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID);
+
+ /*
+- * Revision 0x13 of this chipset supports irq remapping
+- * but has an erratum that breaks its behavior, flag it as such
++ * Revision 13 of all triggering devices id in this quirk have
++ * a problem draining interrupts when irq remapping is enabled,
++ * and should be flagged as broken. Additionally revisions 0x12
++ * and 0x22 of device id 0x3405 has this problem.
+ */
+ if (revision == 0x13)
+ set_irq_remapping_broken();
++ else if ((device == 0x3405) &&
++ ((revision == 0x12) ||
++ (revision == 0x22)))
++ set_irq_remapping_broken();
+
+ }
+
+@@ -239,6 +247,8 @@ static struct chipset early_qrk[] __init
+ PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
+ { PCI_VENDOR_ID_INTEL, 0x3403, PCI_CLASS_BRIDGE_HOST,
+ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
++ { PCI_VENDOR_ID_INTEL, 0x3405, PCI_CLASS_BRIDGE_HOST,
++ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
+ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ {}
projects / thirdparty / kernel / stable-queue.git / commitdiff
