Linux 3.0.83

commit 937d4f9ee2fe18a6ab012a343fc3b620756b954e
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Jun 20 11:28:30 2013 -0700

    Linux 3.0.83

commit 088d9d4d782d66941fc9e29ff4eb0dd72f84493b
Author: Sage Weil <sage@inktank.com>
Date:   Fri Feb 22 15:31:00 2013 -0800

    ceph: fix statvfs fr_size

    commit 92a49fb0f79f3300e6e50ddf56238e70678e4202 upstream.

    Different versions of glibc are broken in different ways, but the short of
    it is that for the time being, frsize should == bsize, and be used as the
    multiple for the blocks, free, and available fields.  This mirrors what is
    done for NFS.  The previous reporting of the page size for frsize meant
    that newer glibc and df would report a very small value for the fs size.

    Fixes http://tracker.ceph.com/issues/3793.

    Signed-off-by: Sage Weil <sage@inktank.com>
    Reviewed-by: Greg Farnum <greg@inktank.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ffdfdbe55c84906dd65627f069619bec54e5422
Author: Kees Cook <keescook@chromium.org>
Date:   Wed Jun 5 11:47:18 2013 -0700

    x86: Fix typo in kexec register clearing

    commit c8a22d19dd238ede87aa0ac4f7dbea8da039b9c1 upstream.

    Fixes a typo in register clearing code. Thanks to PaX Team for fixing
    this originally, and James Troup for pointing it out.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Link: http://lkml.kernel.org/r/20130605184718.GA8396@www.outflux.net
    Cc: PaX Team <pageexec@freemail.hu>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 79848ba66d91e0c171ff203363e0c96629279c15
Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Date:   Wed Jun 12 14:05:04 2013 -0700

    mm: migration: add migrate_entry_wait_huge()

    commit 30dad30922ccc733cfdbfe232090cf674dc374dc upstream.

    When we have a page fault for the address which is backed by a hugepage
    under migration, the kernel can't wait correctly and do busy looping on
    hugepage fault until the migration finishes.  As a result, users who try
    to kick hugepage migration (via soft offlining, for example) occasionally
    experience long delay or soft lockup.

    This is because pte_offset_map_lock() can't get a correct migration entry
    or a correct page table lock for hugepage.  This patch introduces
    migration_entry_wait_huge() to solve this.

    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Reviewed-by: Rik van Riel <riel@redhat.com>
    Reviewed-by: Wanpeng Li <liwanp@linux.vnet.ibm.com>
    Reviewed-by: Michal Hocko <mhocko@suse.cz>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78ef884ebb6c02d45abefc95350f428be7390a26
Author: Rafael Aquini <aquini@redhat.com>
Date:   Wed Jun 12 14:04:49 2013 -0700

    swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion

    commit cbab0e4eec299e9059199ebe6daf48730be46d2b upstream.

    read_swap_cache_async() can race against get_swap_page(), and stumble
    across a SWAP_HAS_CACHE entry in the swap map whose page wasn't brought
    into the swapcache yet.

    This transient swap_map state is expected to be transitory, but the
    actual placement of discard at scan_swap_map() inserts a wait for I/O
    completion thus making the thread at read_swap_cache_async() to loop
    around its -EEXIST case, while the other end at get_swap_page() is
    scheduled away at scan_swap_map().  This can leave the system deadlocked
    if the I/O completion happens to be waiting on the CPU waitqueue where
    read_swap_cache_async() is busy looping and !CONFIG_PREEMPT.

    This patch introduces a cond_resched() call to make the aforementioned
    read_swap_cache_async() busy loop condition to bail out when necessary,
    thus avoiding the subtle race window.

    Signed-off-by: Rafael Aquini <aquini@redhat.com>
    Acked-by: Johannes Weiner <hannes@cmpxchg.org>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Acked-by: Hugh Dickins <hughd@google.com>
    Cc: Shaohua Li <shli@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bac5719cdfb081dd68b0eeef7d9796c15fc29811
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Jun 10 09:47:58 2013 +0200

    drm/i915: prefer VBT modes for SVDO-LVDS over EDID

    commit c3456fb3e4712d0448592af3c5d644c9472cd3c1 upstream.

    In

    commit 53d3b4d7778daf15900867336c85d3f8dd70600c
    Author: Egbert Eich <eich@suse.de>
    Date:   Tue Jun 4 17:13:21 2013 +0200

        drm/i915/sdvo: Use &intel_sdvo->ddc instead of intel_sdvo->i2c for DDC

    Egbert Eich fixed a long-standing bug where we simply used a
    non-working i2c controller to read the EDID for SDVO-LVDS panels.
    Unfortunately some machines seem to not be able to cope with the mode
    provided in the EDID. Specifically they seem to not be able to cope
    with a 4x pixel mutliplier instead of a 2x one, which seems to have
    been worked around by slightly changing the panels native mode in the
    VBT so that the dotclock is just barely above 50MHz.

    Since it took forever to notice the breakage it's fairly safe to
    assume that at least for SDVO-LVDS panels the VBT contains fairly sane
    data. So just switch around the order and use VBT modes first.

    v2: Also add EDID modes just in case, and spell Egbert correctly.

    v3: Elaborate a bit more about what's going on on Chris' machine.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65524
    Reported-and-tested-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Egbert Eich <eich@suse.de>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 319d630e7f0778c8999f6ef503998a4d99cee5f1
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Sat Jun 1 07:08:09 2013 +0530

    ath9k: Disable PowerSave by default

    commit 531671cb17af07281e6f28c1425f754346e65c41 upstream.

    Almost all the DMA issues which have plagued ath9k (in station mode)
    for years are related to PS. Disabling PS usually "fixes" the user's
    connection stablility. Reports of DMA problems are still trickling in
    and are sitting in the kernel bugzilla. Until the PS code in ath9k is
    given a thorough review, disbale it by default. The slight increase
    in chip power consumption is a small price to pay for improved link
    stability.

    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 720083f1dc15ac6b6fb85b323d0eae1a151e20ce
Author: Kees Cook <keescook@chromium.org>
Date:   Fri May 10 14:48:21 2013 -0700

    b43: stop format string leaking into error msgs

    commit e0e29b683d6784ef59bbc914eac85a04b650e63c upstream.

    The module parameter "fwpostfix" is userspace controllable, unfiltered,
    and is used to define the firmware filename. b43_do_request_fw() populates
    ctx->errors[] on error, containing the firmware filename. b43err()
    parses its arguments as a format string. For systems with b43 hardware,
    this could lead to a uid-0 to ring-0 escalation.

    CVE-2013-2852

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>