--- /dev/null
+From 70945643722ffeac779d2529a348f99567fa5c33 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 14 Mar 2011 13:48:08 -0400
+Subject: cifs: always do is_path_accessible check in cifs_mount
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 70945643722ffeac779d2529a348f99567fa5c33 upstream.
+
+Currently, we skip doing the is_path_accessible check in cifs_mount if
+there is no prefixpath. I have a report of at least one server however
+that allows a TREE_CONNECT to a share that has a DFS referral at its
+root. The reporter in this case was using a UNC that had no prefixpath,
+so the is_path_accessible check was not triggered and the box later hit
+a BUG() because we were chasing a DFS referral on the root dentry for
+the mount.
+
+This patch fixes this by removing the check for a zero-length
+prefixpath. That should make the is_path_accessible check be done in
+this situation and should allow the client to chase the DFS referral at
+mount time instead.
+
+Reported-and-Tested-by: Yogesh Sharma <ysharma@cymer.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2826,7 +2826,7 @@ try_mount_again:
+
+ remote_path_check:
+ /* check if a whole path (including prepath) is not remote */
+- if (!rc && cifs_sb->prepathlen && tcon) {
++ if (!rc && tcon) {
+ /* build_path_to_root works only when we have a valid tcon */
+ full_path = cifs_build_path_to_root(cifs_sb, tcon);
+ if (full_path == NULL) {
--- /dev/null
+From 7797069305d13252fd66cf722aa8f2cbeb3c95cd Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 5 Apr 2011 16:23:47 -0700
+Subject: cifs: check for private_data before trying to put it
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 7797069305d13252fd66cf722aa8f2cbeb3c95cd upstream.
+
+cifs_close doesn't check that the filp->private_data is non-NULL before
+trying to put it. That can cause an oops in certain error conditions
+that can occur on open or lookup before the private_data is set.
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/file.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -575,8 +575,10 @@ reopen_error_exit:
+
+ int cifs_close(struct inode *inode, struct file *file)
+ {
+- cifsFileInfo_put(file->private_data);
+- file->private_data = NULL;
++ if (file->private_data != NULL) {
++ cifsFileInfo_put(file->private_data);
++ file->private_data = NULL;
++ }
+
+ /* return code from the ->release op is always ignored */
+ return 0;
--- /dev/null
+From 2b6c26a0a62cc0bab0ad487533d5581d7c293fef Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Fri, 25 Mar 2011 16:25:57 -0400
+Subject: cifs: set ra_pages in backing_dev_info
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 2b6c26a0a62cc0bab0ad487533d5581d7c293fef upstream.
+
+Commit 522440ed made cifs set backing_dev_info on the mapping attached
+to new inodes. This change caused a fairly significant read performance
+regression, as cifs started doing page-sized reads exclusively.
+
+By virtue of the fact that they're allocated as part of cifs_sb_info by
+kzalloc, the ra_pages on cifs BDIs get set to 0, which prevents any
+readahead. This forces the normal read codepaths to use readpage instead
+of readpages causing a four-fold increase in the number of read calls
+with the default rsize.
+
+Fix it by setting ra_pages in the BDI to the same value as that in the
+default_backing_dev_info.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=31662
+
+Reported-and-Tested-by: Till <till2.schaefer@uni-dortmund.de>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -127,6 +127,7 @@ cifs_read_super(struct super_block *sb,
+ kfree(cifs_sb);
+ return rc;
+ }
++ cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
+
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+ /* copy mount params to sb for use in submounts */
--- /dev/null
+From 157c249114508aa71daa308a426e15d81a4eed00 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Sat, 2 Apr 2011 07:34:30 -0400
+Subject: cifs: wrap received signature check in srv_mutex
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 157c249114508aa71daa308a426e15d81a4eed00 upstream.
+
+While testing my patchset to fix asynchronous writes, I hit a bunch
+of signature problems when testing with signing on. The problem seems
+to be that signature checks on receive can be running at the same
+time as a process that is sending, or even that multiple receives can
+be checking signatures at the same time, clobbering the same data
+structures.
+
+While we're at it, clean up the comments over cifs_calculate_signature
+and add a note that the srv_mutex should be held when calling this
+function.
+
+This patch seems to fix the problems for me, but I'm not clear on
+whether it's the best approach. If it is, then this should probably
+go to stable too.
+
+Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsencrypt.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -30,12 +30,13 @@
+ #include <linux/ctype.h>
+ #include <linux/random.h>
+
+-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */
+-/* the 16 byte signature must be allocated by the caller */
+-/* Note we only use the 1st eight bytes */
+-/* Note that the smb header signature field on input contains the
+- sequence number before this function is called */
+-
++/*
++ * Calculate and return the CIFS signature based on the mac key and SMB PDU.
++ * The 16 byte signature must be allocated by the caller. Note we only use the
++ * 1st eight bytes and that the smb header signature field on input contains
++ * the sequence number before this function is called. Also, this function
++ * should be called with the server->srv_mutex held.
++ */
+ static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
+ struct TCP_Server_Info *server, char *signature)
+ {
+@@ -209,8 +210,10 @@ int cifs_verify_signature(struct smb_hdr
+ cpu_to_le32(expected_sequence_number);
+ cifs_pdu->Signature.Sequence.Reserved = 0;
+
++ mutex_lock(&server->srv_mutex);
+ rc = cifs_calculate_signature(cifs_pdu, server,
+ what_we_think_sig_should_be);
++ mutex_unlock(&server->srv_mutex);
+
+ if (rc)
+ return rc;
--- /dev/null
+From 71e16bfbd2b1c63d4d97cc5059694c9346aee340 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 12 Apr 2011 13:33:27 -0400
+Subject: drm/radeon/kms: fix suspend on rv530 asics
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 71e16bfbd2b1c63d4d97cc5059694c9346aee340 upstream.
+
+Apparently only rv515 asics need the workaround
+added in f24d86f1a49505cdea56728b853a5d0a3f8e3d11
+(drm/radeon/kms: fix resume regression for some r5xx laptops).
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=34709
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atom.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -32,6 +32,7 @@
+ #include "atom.h"
+ #include "atom-names.h"
+ #include "atom-bits.h"
++#include "radeon.h"
+
+ #define ATOM_COND_ABOVE 0
+ #define ATOM_COND_ABOVEOREQUAL 1
+@@ -101,7 +102,9 @@ static void debug_print_spaces(int n)
+ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
+ uint32_t index, uint32_t data)
+ {
++ struct radeon_device *rdev = ctx->card->dev->dev_private;
+ uint32_t temp = 0xCDCDCDCD;
++
+ while (1)
+ switch (CU8(base)) {
+ case ATOM_IIO_NOP:
+@@ -112,7 +115,8 @@ static uint32_t atom_iio_execute(struct
+ base += 3;
+ break;
+ case ATOM_IIO_WRITE:
+- (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
++ if (rdev->family == CHIP_RV515)
++ (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+ ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
+ base += 3;
+ break;
--- /dev/null
+From 9bb09fa1b5b07459279301ac6220d575f307597b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 7 Apr 2011 10:31:25 -0400
+Subject: drm/radeon/kms: pll tweaks for rv6xx
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 9bb09fa1b5b07459279301ac6220d575f307597b upstream.
+
+Prefer minm over maxp.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=35994
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -531,6 +531,12 @@ static u32 atombios_adjust_pll(struct dr
+ pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
+ else
+ pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
++
++ if ((rdev->family == CHIP_R600) ||
++ (rdev->family == CHIP_RV610) ||
++ (rdev->family == CHIP_RV630) ||
++ (rdev->family == CHIP_RV670))
++ pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ } else {
+ pll->flags |= RADEON_PLL_LEGACY;
+
--- /dev/null
+vm-fix-vm_pgoff-wrap-in-stack-expansion.patch
+drm-radeon-kms-pll-tweaks-for-rv6xx.patch
+drm-radeon-kms-fix-suspend-on-rv530-asics.patch
+cifs-always-do-is_path_accessible-check-in-cifs_mount.patch
+cifs-check-for-private_data-before-trying-to-put-it.patch
+cifs-set-ra_pages-in-backing_dev_info.patch
+cifs-wrap-received-signature-check-in-srv_mutex.patch
--- /dev/null
+From a626ca6a656450e9f4df91d0dda238fff23285f4 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 13 Apr 2011 08:07:28 -0700
+Subject: vm: fix vm_pgoff wrap in stack expansion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream.
+
+Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed
+the case of a expanding mapping causing vm_pgoff wrapping when you used
+mremap. But there was another case where we expand mappings hiding in
+plain sight: the automatic stack expansion.
+
+This fixes that case too.
+
+This one also found by Robert Święcki, using his nasty system call
+fuzzer tool. Good job.
+
+Reported-and-tested-by: Robert Święcki <robert@swiecki.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mmap.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_ar
+ size = vma->vm_end - address;
+ grow = (vma->vm_start - address) >> PAGE_SHIFT;
+
+- error = acct_stack_growth(vma, size, grow);
+- if (!error) {
+- vma->vm_start = address;
+- vma->vm_pgoff -= grow;
+- perf_event_mmap(vma);
++ error = -ENOMEM;
++ if (grow <= vma->vm_pgoff) {
++ error = acct_stack_growth(vma, size, grow);
++ if (!error) {
++ vma->vm_start = address;
++ vma->vm_pgoff -= grow;
++ perf_event_mmap(vma);
++ }
+ }
+ }
+ vma_unlock_anon_vma(vma);
projects / thirdparty / kernel / stable-queue.git / commitdiff
