From: Greg Kroah-Hartman Date: Tue, 10 Jan 2012 00:35:20 +0000 (-0800) Subject: 3.1-stable patches X-Git-Tag: v3.2.1~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dd7bbeae19e4ef71543bcd67e2edcb6d0f349583;p=thirdparty%2Fkernel%2Fstable-queue.git 3.1-stable patches added patches: asix-new-device-id.patch atmel_serial-fix-spinlock-lockup-in-rs485-code.patch cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch ext3-don-t-warn-from-writepage-when-readonly-inode-is-spotted-after-error.patch ib-qib-fix-a-possible-data-corruption-when-receiving.patch perf-fix-parsing-of-__print_flags-in-tp_printk.patch reiserfs-fix-quota-mount-option-parsing.patch reiserfs-force-inode-evictions-before-umount-to-avoid-crash.patch udf-fix-deadlock-when-converting-file-from-in-icb-one-to-normal-one.patch usb-isight-fix-kernel-bug-when-loading-firmware.patch usb-update-documentation-for-usbmon.patch --- diff --git a/queue-3.1/asix-new-device-id.patch b/queue-3.1/asix-new-device-id.patch new file mode 100644 index 00000000000..2624ed272e6 --- /dev/null +++ b/queue-3.1/asix-new-device-id.patch @@ -0,0 +1,34 @@ +From e8303a3b2196272c3eb994d0fd1a189a958a2bdd Mon Sep 17 00:00:00 2001 +From: Aurelien Jacobs +Date: Fri, 16 Dec 2011 10:49:22 +0000 +Subject: asix: new device id + +From: Aurelien Jacobs + +commit e8303a3b2196272c3eb994d0fd1a189a958a2bdd upstream. + +Adds the device id needed for the USB Ethernet Adapter delivered by +ASUS with their Zenbook. + +Signed-off-by: Aurelien Jacobs +Acked-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/asix.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -1560,6 +1560,10 @@ static const struct usb_device_id produc + // ASIX 88772a + USB_DEVICE(0x0db0, 0xa877), + .driver_info = (unsigned long) &ax88772_info, ++}, { ++ // Asus USB Ethernet Adapter ++ USB_DEVICE (0x0b95, 0x7e2b), ++ .driver_info = (unsigned long) &ax88772_info, + }, + { }, // END + }; diff --git a/queue-3.1/atmel_serial-fix-spinlock-lockup-in-rs485-code.patch b/queue-3.1/atmel_serial-fix-spinlock-lockup-in-rs485-code.patch new file mode 100644 index 00000000000..11825d94d30 --- /dev/null +++ b/queue-3.1/atmel_serial-fix-spinlock-lockup-in-rs485-code.patch @@ -0,0 +1,45 @@ +From dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba Mon Sep 17 00:00:00 2001 +From: Claudio Scordino +Date: Fri, 16 Dec 2011 15:08:49 +0100 +Subject: atmel_serial: fix spinlock lockup in RS485 code + +From: Claudio Scordino + +commit dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba upstream. + +Patch to fix a spinlock lockup in the driver that sometimes happens when the +tasklet starts. + +Signed-off-by: Claudio Scordino +Signed-off-by: Dave Bender +Tested-by: Dave Bender +Acked-by: Nicolas Ferre +Acked-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -199,8 +199,9 @@ void atmel_config_rs485(struct uart_port + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + unsigned int mode; ++ unsigned long flags; + +- spin_lock(&port->lock); ++ spin_lock_irqsave(&port->lock, flags); + + /* Disable interrupts */ + UART_PUT_IDR(port, atmel_port->tx_done_mask); +@@ -231,7 +232,7 @@ void atmel_config_rs485(struct uart_port + /* Enable interrupts */ + UART_PUT_IER(port, atmel_port->tx_done_mask); + +- spin_unlock(&port->lock); ++ spin_unlock_irqrestore(&port->lock, flags); + + } + diff --git a/queue-3.1/cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch b/queue-3.1/cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch new file mode 100644 index 00000000000..2dd8280ad0f --- /dev/null +++ b/queue-3.1/cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch @@ -0,0 +1,48 @@ +From 0d19ea866562e46989412a0676412fa0983c9ce7 Mon Sep 17 00:00:00 2001 +From: Li Zefan +Date: Tue, 27 Dec 2011 14:25:55 +0800 +Subject: cgroup: fix to allow mounting a hierarchy by name + +From: Li Zefan + +commit 0d19ea866562e46989412a0676412fa0983c9ce7 upstream. + +If we mount a hierarchy with a specified name, the name is unique, +and we can use it to mount the hierarchy without specifying its +set of subsystem names. This feature is documented is +Documentation/cgroups/cgroups.txt section 2.3 + +Here's an example: + + # mount -t cgroup -o cpuset,name=myhier xxx /cgroup1 + # mount -t cgroup -o name=myhier xxx /cgroup2 + +But it was broken by commit 32a8cf235e2f192eb002755076994525cdbaa35a +(cgroup: make the mount options parsing more accurate) + +This fixes the regression. + +Signed-off-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char * + + /* + * If the 'all' option was specified select all the subsystems, +- * otherwise 'all, 'none' and a subsystem name options were not +- * specified, let's default to 'all' ++ * otherwise if 'none', 'name=' and a subsystem name options ++ * were not specified, let's default to 'all' + */ +- if (all_ss || (!all_ss && !one_ss && !opts->none)) { ++ if (all_ss || (!one_ss && !opts->none && !opts->name)) { + for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) { + struct cgroup_subsys *ss = subsys[i]; + if (ss == NULL) diff --git a/queue-3.1/drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch b/queue-3.1/drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch new file mode 100644 index 00000000000..cf23662567f --- /dev/null +++ b/queue-3.1/drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch @@ -0,0 +1,43 @@ +From e7c8e8605d0bafc705ff27f9da98a1668427cc0f Mon Sep 17 00:00:00 2001 +From: Julia Lawall +Date: Fri, 23 Dec 2011 14:02:55 +0100 +Subject: drivers/usb/class/cdc-acm.c: clear dangling pointer + +From: Julia Lawall + +commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream. + +On some failures, the country_code field of an acm structure is freed +without freeing the acm structure itself. Elsewhere, operations including +memcpy and kfree are performed on the country_code field. The patch sets +the country_code field to NULL when it is freed, and likewise sets the +country_code_size field to 0. + +Signed-off-by: Julia Lawall +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1183,6 +1183,8 @@ made_compressed_probe: + i = device_create_file(&intf->dev, &dev_attr_wCountryCodes); + if (i < 0) { + kfree(acm->country_codes); ++ acm->country_codes = NULL; ++ acm->country_code_size = 0; + goto skip_countries; + } + +@@ -1191,6 +1193,8 @@ made_compressed_probe: + if (i < 0) { + device_remove_file(&intf->dev, &dev_attr_wCountryCodes); + kfree(acm->country_codes); ++ acm->country_codes = NULL; ++ acm->country_code_size = 0; + goto skip_countries; + } + } diff --git a/queue-3.1/ext3-don-t-warn-from-writepage-when-readonly-inode-is-spotted-after-error.patch b/queue-3.1/ext3-don-t-warn-from-writepage-when-readonly-inode-is-spotted-after-error.patch new file mode 100644 index 00000000000..0eff4594201 --- /dev/null +++ b/queue-3.1/ext3-don-t-warn-from-writepage-when-readonly-inode-is-spotted-after-error.patch @@ -0,0 +1,70 @@ +From 33c104d415e92a51aaf638dc3d93920cfa601e5c Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 22 Dec 2011 16:49:05 +0100 +Subject: ext3: Don't warn from writepage when readonly inode is spotted after error + +From: Jan Kara + +commit 33c104d415e92a51aaf638dc3d93920cfa601e5c upstream. + +WARN_ON_ONCE(IS_RDONLY(inode)) tends to trip when filesystem hits error and is +remounted read-only. This unnecessarily scares users (well, they should be +scared because of filesystem error, but the stack trace distracts them from the +right source of their fear ;-). We could as well just remove the WARN_ON but +it's not hard to fix it to not trip on filesystem with errors and not use more +cycles in the common case so that's what we do. + +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/inode.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +--- a/fs/ext3/inode.c ++++ b/fs/ext3/inode.c +@@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct + int err; + + J_ASSERT(PageLocked(page)); +- WARN_ON_ONCE(IS_RDONLY(inode)); ++ /* ++ * We don't want to warn for emergency remount. The condition is ++ * ordered to avoid dereferencing inode->i_sb in non-error case to ++ * avoid slow-downs. ++ */ ++ WARN_ON_ONCE(IS_RDONLY(inode) && ++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS)); + + /* + * We give up here if we're reentered, because it might be for a +@@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(stru + int err; + + J_ASSERT(PageLocked(page)); +- WARN_ON_ONCE(IS_RDONLY(inode)); ++ /* ++ * We don't want to warn for emergency remount. The condition is ++ * ordered to avoid dereferencing inode->i_sb in non-error case to ++ * avoid slow-downs. ++ */ ++ WARN_ON_ONCE(IS_RDONLY(inode) && ++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS)); + + if (ext3_journal_current_handle()) + goto out_fail; +@@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(str + int err; + + J_ASSERT(PageLocked(page)); +- WARN_ON_ONCE(IS_RDONLY(inode)); ++ /* ++ * We don't want to warn for emergency remount. The condition is ++ * ordered to avoid dereferencing inode->i_sb in non-error case to ++ * avoid slow-downs. ++ */ ++ WARN_ON_ONCE(IS_RDONLY(inode) && ++ !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS)); + + if (ext3_journal_current_handle()) + goto no_write; diff --git a/queue-3.1/ib-qib-fix-a-possible-data-corruption-when-receiving.patch b/queue-3.1/ib-qib-fix-a-possible-data-corruption-when-receiving.patch new file mode 100644 index 00000000000..eee23ec001d --- /dev/null +++ b/queue-3.1/ib-qib-fix-a-possible-data-corruption-when-receiving.patch @@ -0,0 +1,72 @@ +From eddfb675256f49d14e8c5763098afe3eb2c93701 Mon Sep 17 00:00:00 2001 +From: Ram Vepa +Date: Fri, 23 Dec 2011 08:01:43 -0500 +Subject: IB/qib: Fix a possible data corruption when receiving + packets + +From: Ram Vepa + +commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream. + +Prevent a receive data corruption by ensuring that the write to update +the rcvhdrheadn register to generate an interrupt is at the very end +of the receive processing. + +Signed-off-by: Ramkrishna Vepa +Signed-off-by: Mike Marciniszyn +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/qib/qib_iba6120.c | 4 +++- + drivers/infiniband/hw/qib/qib_iba7220.c | 4 +++- + drivers/infiniband/hw/qib/qib_iba7322.c | 6 ++++-- + 3 files changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/hw/qib/qib_iba6120.c ++++ b/drivers/infiniband/hw/qib/qib_iba6120.c +@@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct + static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd, + u32 updegr, u32 egrhd, u32 npkts) + { +- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); + if (updegr) + qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt); ++ mmiowb(); ++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); ++ mmiowb(); + } + + static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd) +--- a/drivers/infiniband/hw/qib/qib_iba7220.c ++++ b/drivers/infiniband/hw/qib/qib_iba7220.c +@@ -2724,9 +2724,11 @@ static int qib_7220_set_loopback(struct + static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd, + u32 updegr, u32 egrhd, u32 npkts) + { +- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); + if (updegr) + qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt); ++ mmiowb(); ++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); ++ mmiowb(); + } + + static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd) +--- a/drivers/infiniband/hw/qib/qib_iba7322.c ++++ b/drivers/infiniband/hw/qib/qib_iba7322.c +@@ -4084,10 +4084,12 @@ static void qib_update_7322_usrhead(stru + */ + if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT) + adjust_rcv_timeout(rcd, npkts); +- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); +- qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); + if (updegr) + qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt); ++ mmiowb(); ++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); ++ qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt); ++ mmiowb(); + } + + static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd) diff --git a/queue-3.1/perf-fix-parsing-of-__print_flags-in-tp_printk.patch b/queue-3.1/perf-fix-parsing-of-__print_flags-in-tp_printk.patch new file mode 100644 index 00000000000..50a71b89f95 --- /dev/null +++ b/queue-3.1/perf-fix-parsing-of-__print_flags-in-tp_printk.patch @@ -0,0 +1,35 @@ +From 49908a1b25d448d68fd26faca260e1850201575f Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Fri, 4 Nov 2011 16:32:25 -0400 +Subject: perf: Fix parsing of __print_flags() in TP_printk() + +From: Steven Rostedt + +commit 49908a1b25d448d68fd26faca260e1850201575f upstream. + +A update is made to the sched:sched_switch event that adds some +logic to the first parameter of the __print_flags() that shows the +state of tasks. This change cause perf to fail parsing the flags. + +A simple fix is needed to have the parser be able to process ops +within the argument. + +Reported-by: Andrew Vagin +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/trace-event-parse.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/perf/util/trace-event-parse.c ++++ b/tools/perf/util/trace-event-parse.c +@@ -1582,6 +1582,8 @@ process_symbols(struct event *event, str + field = malloc_or_die(sizeof(*field)); + + type = process_arg(event, field, &token); ++ while (type == EVENT_OP) ++ type = process_op(event, field, &token); + if (test_type_token(type, token, EVENT_DELIM, ",")) + goto out_free; + diff --git a/queue-3.1/reiserfs-fix-quota-mount-option-parsing.patch b/queue-3.1/reiserfs-fix-quota-mount-option-parsing.patch new file mode 100644 index 00000000000..bdae507670d --- /dev/null +++ b/queue-3.1/reiserfs-fix-quota-mount-option-parsing.patch @@ -0,0 +1,32 @@ +From a06d789b424190e9f59da391681f908486db2554 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 21 Dec 2011 17:35:34 +0100 +Subject: reiserfs: Fix quota mount option parsing + +From: Jan Kara + +commit a06d789b424190e9f59da391681f908486db2554 upstream. + +When jqfmt mount option is not specified on remount, we mistakenly clear +s_jquota_fmt value stored in superblock. Fix the problem. + +CC: reiserfs-devel@vger.kernel.org +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/reiserfs/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -1164,7 +1164,8 @@ static void handle_quota_files(struct su + kfree(REISERFS_SB(s)->s_qf_names[i]); + REISERFS_SB(s)->s_qf_names[i] = qf_names[i]; + } +- REISERFS_SB(s)->s_jquota_fmt = *qfmt; ++ if (*qfmt) ++ REISERFS_SB(s)->s_jquota_fmt = *qfmt; + } + #endif + diff --git a/queue-3.1/reiserfs-force-inode-evictions-before-umount-to-avoid-crash.patch b/queue-3.1/reiserfs-force-inode-evictions-before-umount-to-avoid-crash.patch new file mode 100644 index 00000000000..dea6af2a823 --- /dev/null +++ b/queue-3.1/reiserfs-force-inode-evictions-before-umount-to-avoid-crash.patch @@ -0,0 +1,67 @@ +From a9e36da655e54545c3289b2a0700b5c443de0edd Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Wed, 21 Dec 2011 21:18:43 +0100 +Subject: reiserfs: Force inode evictions before umount to avoid crash + +From: Jeff Mahoney + +commit a9e36da655e54545c3289b2a0700b5c443de0edd upstream. + +This patch fixes a crash in reiserfs_delete_xattrs during umount. + +When shrink_dcache_for_umount clears the dcache from +generic_shutdown_super, delayed evictions are forced to disk. If an +evicted inode has extended attributes associated with it, it will +need to walk the xattr tree to locate and remove them. + +But since shrink_dcache_for_umount will BUG if it encounters active +dentries, the xattr tree must be released before it's called or it will +crash during every umount. + +This patch forces the evictions to occur before generic_shutdown_super +by calling shrink_dcache_sb first. The additional evictions caused +by the removal of each associated xattr file and dir will be automatically +handled as they're added to the LRU list. + +CC: reiserfs-devel@vger.kernel.org +Signed-off-by: Jeff Mahoney +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/reiserfs/super.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode + static void reiserfs_kill_sb(struct super_block *s) + { + if (REISERFS_SB(s)) { +- if (REISERFS_SB(s)->xattr_root) { +- d_invalidate(REISERFS_SB(s)->xattr_root); +- dput(REISERFS_SB(s)->xattr_root); +- REISERFS_SB(s)->xattr_root = NULL; +- } +- if (REISERFS_SB(s)->priv_root) { +- d_invalidate(REISERFS_SB(s)->priv_root); +- dput(REISERFS_SB(s)->priv_root); +- REISERFS_SB(s)->priv_root = NULL; +- } ++ /* ++ * Force any pending inode evictions to occur now. Any ++ * inodes to be removed that have extended attributes ++ * associated with them need to clean them up before ++ * we can release the extended attribute root dentries. ++ * shrink_dcache_for_umount will BUG if we don't release ++ * those before it's called so ->put_super is too late. ++ */ ++ shrink_dcache_sb(s); ++ ++ dput(REISERFS_SB(s)->xattr_root); ++ REISERFS_SB(s)->xattr_root = NULL; ++ dput(REISERFS_SB(s)->priv_root); ++ REISERFS_SB(s)->priv_root = NULL; + } + + kill_block_super(s); diff --git a/queue-3.1/series b/queue-3.1/series index f23efb70ea3..de1273f0efa 100644 --- a/queue-3.1/series +++ b/queue-3.1/series @@ -9,3 +9,15 @@ wl12xx-check-buffer-bound-when-processing-nvs-data.patch wl12xx-restore-testmode-abi.patch powerpc-time-handle-wrapping-of-decrementer.patch powerpc-fix-unpaired-probe_hcall_entry-and-probe_hcall_exit.patch +asix-new-device-id.patch +ib-qib-fix-a-possible-data-corruption-when-receiving.patch +perf-fix-parsing-of-__print_flags-in-tp_printk.patch +reiserfs-fix-quota-mount-option-parsing.patch +reiserfs-force-inode-evictions-before-umount-to-avoid-crash.patch +ext3-don-t-warn-from-writepage-when-readonly-inode-is-spotted-after-error.patch +usb-update-documentation-for-usbmon.patch +atmel_serial-fix-spinlock-lockup-in-rs485-code.patch +cgroup-fix-to-allow-mounting-a-hierarchy-by-name.patch +udf-fix-deadlock-when-converting-file-from-in-icb-one-to-normal-one.patch +drivers-usb-class-cdc-acm.c-clear-dangling-pointer.patch +usb-isight-fix-kernel-bug-when-loading-firmware.patch diff --git a/queue-3.1/udf-fix-deadlock-when-converting-file-from-in-icb-one-to-normal-one.patch b/queue-3.1/udf-fix-deadlock-when-converting-file-from-in-icb-one-to-normal-one.patch new file mode 100644 index 00000000000..895dff4dd38 --- /dev/null +++ b/queue-3.1/udf-fix-deadlock-when-converting-file-from-in-icb-one-to-normal-one.patch @@ -0,0 +1,125 @@ +From d2eb8c359309ec45d6bf5b147303ab8e13be86ea Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Sat, 10 Dec 2011 02:30:48 +0100 +Subject: udf: Fix deadlock when converting file from in-ICB one to normal one + +From: Jan Kara + +commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream. + +During BKL removal in 2.6.38, conversion of files from in-ICB format to normal +format got broken. We call ->writepage with i_data_sem held but udf_get_block() +also acquires i_data_sem thus creating A-A deadlock. + +We fix the problem by dropping i_data_sem before calling ->writepage() which is +safe since i_mutex still protects us against any changes in the file. Also fix +pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping +i_data_sem before calling find_or_create_page(). + +Reported-by: Matthias Matiak +Tested-by: Matthias Matiak +Reviewed-by: Namjae Jeon +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/file.c | 6 +++--- + fs/udf/inode.c | 21 ++++++++++++++++++--- + 2 files changed, 21 insertions(+), 6 deletions(-) + +--- a/fs/udf/file.c ++++ b/fs/udf/file.c +@@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct + err = udf_expand_file_adinicb(inode); + if (err) { + udf_debug("udf_expand_adinicb: err=%d\n", err); +- up_write(&iinfo->i_data_sem); + return err; + } + } else { +@@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct + iinfo->i_lenAlloc = pos + count; + else + iinfo->i_lenAlloc = inode->i_size; ++ up_write(&iinfo->i_data_sem); + } +- } +- up_write(&iinfo->i_data_sem); ++ } else ++ up_write(&iinfo->i_data_sem); + + retval = generic_file_aio_write(iocb, iov, nr_segs, ppos); + if (retval > 0) +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -145,6 +145,12 @@ const struct address_space_operations ud + .bmap = udf_bmap, + }; + ++/* ++ * Expand file stored in ICB to a normal one-block-file ++ * ++ * This function requires i_data_sem for writing and releases it. ++ * This function requires i_mutex held ++ */ + int udf_expand_file_adinicb(struct inode *inode) + { + struct page *page; +@@ -163,9 +169,15 @@ int udf_expand_file_adinicb(struct inode + iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; + /* from now on we have normal address_space methods */ + inode->i_data.a_ops = &udf_aops; ++ up_write(&iinfo->i_data_sem); + mark_inode_dirty(inode); + return 0; + } ++ /* ++ * Release i_data_sem so that we can lock a page - page lock ranks ++ * above i_data_sem. i_mutex still protects us against file changes. ++ */ ++ up_write(&iinfo->i_data_sem); + + page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS); + if (!page) +@@ -181,6 +193,7 @@ int udf_expand_file_adinicb(struct inode + SetPageUptodate(page); + kunmap(page); + } ++ down_write(&iinfo->i_data_sem); + memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00, + iinfo->i_lenAlloc); + iinfo->i_lenAlloc = 0; +@@ -190,17 +203,20 @@ int udf_expand_file_adinicb(struct inode + iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG; + /* from now on we have normal address_space methods */ + inode->i_data.a_ops = &udf_aops; ++ up_write(&iinfo->i_data_sem); + err = inode->i_data.a_ops->writepage(page, &udf_wbc); + if (err) { + /* Restore everything back so that we don't lose data... */ + lock_page(page); + kaddr = kmap(page); ++ down_write(&iinfo->i_data_sem); + memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr, + inode->i_size); + kunmap(page); + unlock_page(page); + iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB; + inode->i_data.a_ops = &udf_adinicb_aops; ++ up_write(&iinfo->i_data_sem); + } + page_cache_release(page); + mark_inode_dirty(inode); +@@ -1105,10 +1121,9 @@ int udf_setsize(struct inode *inode, lof + if (bsize < + (udf_file_entry_alloc_offset(inode) + newsize)) { + err = udf_expand_file_adinicb(inode); +- if (err) { +- up_write(&iinfo->i_data_sem); ++ if (err) + return err; +- } ++ down_write(&iinfo->i_data_sem); + } else + iinfo->i_lenAlloc = newsize; + } diff --git a/queue-3.1/usb-isight-fix-kernel-bug-when-loading-firmware.patch b/queue-3.1/usb-isight-fix-kernel-bug-when-loading-firmware.patch new file mode 100644 index 00000000000..57ad593033c --- /dev/null +++ b/queue-3.1/usb-isight-fix-kernel-bug-when-loading-firmware.patch @@ -0,0 +1,45 @@ +From 59bf5cf94f0fa3b08fb1258b52649077b7d0914d Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 5 Dec 2011 14:02:59 -0800 +Subject: USB: isight: fix kernel bug when loading firmware + +From: Greg Kroah-Hartman + +commit 59bf5cf94f0fa3b08fb1258b52649077b7d0914d upstream. + +We were sending data on the stack when uploading firmware, which causes +some machines fits, and is not allowed. Fix this by using the buffer we +already had around for this very purpose. + +Reported-by: Wouter M. Koolen +Tested-by: Wouter M. Koolen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/isight_firmware.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/isight_firmware.c ++++ b/drivers/usb/misc/isight_firmware.c +@@ -55,8 +55,9 @@ static int isight_firmware_load(struct u + + ptr = firmware->data; + ++ buf[0] = 0x01; + if (usb_control_msg +- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1, ++ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1, + 300) != 1) { + printk(KERN_ERR + "Failed to initialise isight firmware loader\n"); +@@ -100,8 +101,9 @@ static int isight_firmware_load(struct u + } + } + ++ buf[0] = 0x00; + if (usb_control_msg +- (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1, ++ (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1, + 300) != 1) { + printk(KERN_ERR "isight firmware loading completion failed\n"); + ret = -ENODEV; diff --git a/queue-3.1/usb-update-documentation-for-usbmon.patch b/queue-3.1/usb-update-documentation-for-usbmon.patch new file mode 100644 index 00000000000..d7cdebbe610 --- /dev/null +++ b/queue-3.1/usb-update-documentation-for-usbmon.patch @@ -0,0 +1,52 @@ +From d8cae98cddd286e38db1724dda1b0e7b467f9237 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 4 Jan 2012 16:36:35 -0500 +Subject: USB: update documentation for usbmon + +From: Alan Stern + +commit d8cae98cddd286e38db1724dda1b0e7b467f9237 upstream. + +The documentation for usbmon is out of date; the usbfs "devices" file +now exists in /sys/kernel/debug/usb rather than /proc/bus/usb. This +patch (as1505) updates the documentation accordingly, and also +mentions that the necessary information can be found by running lsusb. + +Signed-off-by: Alan Stern +CC: Pete Zaitcev +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/usb/usbmon.txt | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/Documentation/usb/usbmon.txt ++++ b/Documentation/usb/usbmon.txt +@@ -47,10 +47,11 @@ This allows to filter away annoying devi + + 2. Find which bus connects to the desired device + +-Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to +-the device. Usually you do it by looking for the vendor string. If you have +-many similar devices, unplug one and compare two /proc/bus/usb/devices outputs. +-The T-line will have a bus number. Example: ++Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds ++to the device. Usually you do it by looking for the vendor string. If you have ++many similar devices, unplug one and compare the two ++/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number. ++Example: + + T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 + D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 +@@ -58,7 +59,10 @@ P: Vendor=0557 ProdID=2004 Rev= 1.00 + S: Manufacturer=ATEN + S: Product=UC100KM V2.00 + +-Bus=03 means it's bus 3. ++"Bus=03" means it's bus 3. Alternatively, you can look at the output from ++"lsusb" and get the bus number from the appropriate line. Example: ++ ++Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00 + + 3. Start 'cat' +