Linux 3.0.67

commit 98bbf3565e3147a40c583ff97e2b5a98370c21a5
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Feb 28 06:33:32 2013 -0800

    Linux 3.0.67

commit cfb2ddcace95399e4dcefebb62e16cd93c9d4ae7
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Thu Feb 14 09:39:09 2013 -0500

    USB: usb-storage: unusual_devs update for Super TOP SATA bridge

    commit 18e03310b5caa6d11c1a8c61b982c37047693fba upstream.

    The current entry in unusual_cypress.h for the Super TOP SATA bridge devices
    seems to be causing corruption on newer revisions of this device.  This has
    been reported in Arch Linux and Fedora.  The original patch was tested on
    devices with bcdDevice of 1.60, whereas the newer devices report bcdDevice
    as 2.20.  Limit the UNUSUAL_DEV entry to devices less than 2.20.

    This fixes https://bugzilla.redhat.com/show_bug.cgi?id=909591

    The Arch Forum post on this is here:
    	https://bbs.archlinux.org/viewtopic.php?id=152011

    Reported-by: Carsten S. <carsteniq@yahoo.com>
    Tested-by: Carsten S. <carsteniq@yahoo.com>
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ba18450b8528ed69d71b3cb8dbdecb08d9272c72
Author: fangxiaozhi <huananhu@huawei.com>
Date:   Thu Feb 7 15:32:07 2013 +0800

    USB: storage: properly handle the endian issues of idProduct

    commit cd060956c5e97931c3909e4a808508469c0bb9f6 upstream.

    1. The idProduct is little endian, so make sure its value to be
    compatible with the current CPU. Make no break on big endian processors.

    Signed-off-by: fangxiaozhi <huananhu@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e39d97f98e39ecb860d113ad75fa250bc52d247b
Author: Roger Quadros <rogerq@ti.com>
Date:   Thu Feb 14 17:08:09 2013 +0200

    USB: ehci-omap: Fix autoloading of module

    commit 04753523266629b1cd0518091da1658755787198 upstream.

    The module alias should be "ehci-omap" and not
    "omap-ehci" to match the platform device name.
    The omap-ehci module should now autoload correctly.

    Signed-off-by: Roger Quadros <rogerq@ti.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b3747d5aec3cc8a5a734bc384c3443d93a31b5e1
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Feb 13 23:41:34 2013 +0100

    USB: option: add Huawei "ACM" devices using protocol = vendor

    commit 1f3f687722fd9b29a0c2a85b4844e3b2a3585c63 upstream.

    The USB device descriptor of one identity presented by a few
    Huawei morphing devices have serial functions with class codes
    02/02/ff, indicating CDC ACM with a vendor specific protocol. This
    combination is often used for MSFT RNDIS functions, and the CDC
    ACM class driver will therefore ignore such functions.

    The CDC ACM class driver cannot support functions with only 2
    endpoints.  The underlying serial functions of these modems are
    also believed to be the same as for alternate device identities
    already supported by the option driver. Letting the same driver
    handle these functions independently of the current identity
    ensures consistent handling and user experience.

    There is no need to blacklist these devices in the rndis_host
    driver. Huawei serial functions will either have only 2 endpoints
    or a CDC ACM functional descriptor with bmCapabilities != 0, making
    them correctly ignored as "non RNDIS" by that driver.

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20fc803358fd0278dfbb5b82d947c3f9ea0164a3
Author: Bjørn Mork <bjorn@mork.no>
Date:   Tue Feb 12 13:42:24 2013 +0100

    USB: option: add Yota / Megafon M100-1 4g modem

    commit cd565279e51bedee1b2988e84f9b3bef485adeb6 upstream.

    Interface layout:

     00 CD-ROM
     01 debug COM port
     02 AP control port
     03 modem
     04 usb-ethernet

    Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#=  4 Spd=480  MxCh= 0
    D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
    P:  Vendor=0408 ProdID=ea42 Rev= 0.00
    S:  Manufacturer=Qualcomm, Incorporated
    S:  Product=Qualcomm CDMA Technologies MSM
    S:  SerialNumber=353568051xxxxxx
    C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
    I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=84(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
    E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
    I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=86(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
    E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2466f8620e8fb814f2d1c72584e1e4e95ca50ead
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Jan 23 10:44:36 2013 +0100

    USB: option: add and update Alcatel modems

    commit f8f0302bbcbd1b14655bef29f6996a2152be559d upstream.

    Adding three currently unsupported modems based on information
    from .inf driver files:

      Diag  VID_1BBB&PID_0052&MI_00
      AGPS  VID_1BBB&PID_0052&MI_01
      VOICE VID_1BBB&PID_0052&MI_02
      AT    VID_1BBB&PID_0052&MI_03
      Modem VID_1BBB&PID_0052&MI_05
      wwan  VID_1BBB&PID_0052&MI_06

      Diag  VID_1BBB&PID_00B6&MI_00
      AT    VID_1BBB&PID_00B6&MI_01
      Modem VID_1BBB&PID_00B6&MI_02
      wwan  VID_1BBB&PID_00B6&MI_03

      Diag  VID_1BBB&PID_00B7&MI_00
      AGPS  VID_1BBB&PID_00B7&MI_01
      VOICE VID_1BBB&PID_00B7&MI_02
      AT    VID_1BBB&PID_00B7&MI_03
      Modem VID_1BBB&PID_00B7&MI_04
      wwan  VID_1BBB&PID_00B7&MI_05

    Updating the blacklist info for the X060S_X200 and X220_X500D,
    reserving interfaces for a wwan driver, based on

      wwan VID_1BBB&PID_0000&MI_04
      wwan VID_1BBB&PID_0017&MI_06

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a9a20ea77e7508c795dead9ab2f6c98a617762d
Author: Maciej Sosnowski <maciej.sosnowski@intel.com>
Date:   Wed May 23 17:27:07 2012 +0200

    dca: check against empty dca_domains list before unregister provider

    commit c419fcfd071cf34ba00f9f65282583772d2655e7 upstream.

    When providers get blocked unregister_dca_providers() is called ending up
    with dca_providers and dca_domain lists emptied. Dca should be prevented from
    trying to unregister any provider if dca_domain list is found empty.

    Reported-by: Jiang Liu <jiang.liu@huawei.com>
    Tested-by: Gaohuai Han <hangaohuai@huawei.com>
    Signed-off-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
    Signed-off-by: Dan Williams <djbw@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae593067dbed83010fee8ad59bab7948f3d3601f
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Feb 21 12:18:52 2013 +0000

    ipv6: use a stronger hash for tcp

    [ Upstream commit 08dcdbf6a7b9d14c2302c5bd0c5390ddf122f664 ]

    It looks like its possible to open thousands of TCP IPv6
    sessions on a server, all landing in a single slot of TCP hash
    table. Incoming packets have to lookup sockets in a very
    long list.

    We should hash all bits from foreign IPv6 addresses, using
    a salt and hash mix, not a simple XOR.

    inet6_ehashfn() can also separately use the ports, instead
    of xoring them.

    Reported-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b18383129b00d2d6aac160f55e27c5ba1cf9d49b
Author: Li Wei <lw@cn.fujitsu.com>
Date:   Thu Feb 21 00:09:54 2013 +0000

    ipv4: fix a bug in ping_err().

    [ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ]

    We should get 'type' and 'code' from the outer ICMP header.

    Signed-off-by: Li Wei <lw@cn.fujitsu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd986521a6e35a301e45d2831501acc172fe2a8f
Author: David Vrabel <david.vrabel@citrix.com>
Date:   Thu Feb 14 03:18:58 2013 +0000

    xen-netback: cancel the credit timer when taking the vif down

    [ Upstream commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece ]

    If the credit timer is left armed after calling
    xen_netbk_remove_xenvif(), then it may fire and attempt to schedule
    the vif which will then oops as vif->netbk == NULL.

    This may happen both in the fatal error path and during normal
    disconnection from the front end.

    The sequencing during shutdown is critical to ensure that: a)
    vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif
    is not freed.

    1. Mark as unschedulable (netif_carrier_off()).
    2. Synchronously cancel the timer.
    3. Remove the vif from the schedule list.
    4. Remove it from it netback thread group.
    5. Wait for vif->refcnt to become 0.

    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Reported-by: Christopher S. Aker <caker@theshore.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 436d1b8ff7eb7ac9e2569ad780c33bd4287d0526
Author: David Vrabel <david.vrabel@citrix.com>
Date:   Thu Feb 14 03:18:57 2013 +0000

    xen-netback: correctly return errors from netbk_count_requests()

    [ Upstream commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0 ]

    netbk_count_requests() could detect an error, call
    netbk_fatal_tx_error() but return 0.  The vif may then be used
    afterwards (e.g., in a call to netbk_tx_error().

    Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may
    be freed immediately after the call to netbk_fatal_tx_error() (e.g.,
    if the vif is also removed).

    Netback thread              Xenwatch thread
    -------------------------------------------
    netbk_fatal_tx_err()        netback_remove()
                                  xenvif_disconnect()
                                    ...
                                    free_netdev()
    netbk_tx_err() Oops!

    Signed-off-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Jan Beulich <JBeulich@suse.com>
    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Reported-by: Christopher S. Aker <caker@theshore.net>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aa1bada15c8ce41ea5b3b9392a85e6e2e07849ff
Author: Stephen Hemminger <stephen@networkplumber.org>
Date:   Mon Feb 11 08:22:22 2013 +0000

    bridge: set priority of STP packets

    [ Upstream commit 547b4e718115eea74087e28d7fa70aec619200db ]

    Spanning Tree Protocol packets should have always been marked as
    control packets, this causes them to get queued in the high prirority
    FIFO. As Radia Perlman mentioned in her LCA talk, STP dies if bridge
    gets overloaded and can't communicate. This is a long-standing bug back
    to the first versions of Linux bridge.

    Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49a656f8337670ffc66f28235f371767f5d25f42
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Jan 25 10:28:18 2013 +1000

    fb: Yet another band-aid for fixing lockdep mess

    commit e93a9a868792ad71cdd09d75e5a02d8067473c4e upstream.

    I've still got lockdep warnings even after Alan's patch, and it seems that
    yet more band aids are required to paper over similar paths for
    unbind_con_driver() and unregister_con_driver().  After this hack, lockdep
    warnings are finally gone.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Cc: Alan Cox <alan@linux.intel.com>
    Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Cc: Jiri Kosina <jkosina@suse.cz>
    Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit abd9120040d5f427b950561277f2846b0a80be44
Author: Alan Cox <alan@linux.intel.com>
Date:   Fri Jan 25 10:28:15 2013 +1000

    fb: rework locking to fix lock ordering on takeover

    commit 50e244cc793d511b86adea24972f3a7264cae114 upstream.

    Adjust the console layer to allow a take over call where the caller
    already holds the locks.  Make the fb layer lock in order.

    This is partly a band aid, the fb layer is terminally confused about the
    locking rules it uses for its notifiers it seems.

    [akpm@linux-foundation.org: remove stray non-ascii char, tidy comment]
    [akpm@linux-foundation.org: export do_take_over_console()]
    [airlied: cleanup another non-ascii char]
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Cc: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: Jiri Kosina <jkosina@suse.cz>
    Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 90523879cdf0051a208a660a6ce475ed7ac51e99
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Jan 24 16:12:41 2013 +1000

    fbcon: don't lose the console font across generic->chip driver switch

    commit ae1287865f5361fa138d4d3b1b6277908b54eac9 upstream.

    If grub2 loads efifb/vesafb, then when systemd starts it can set the console
    font on that framebuffer device, however when we then load the native KMS
    driver, the first thing it does is tear down the generic framebuffer driver.

    The thing is the generic code is doing the right thing, it frees the font
    because otherwise it would leak memory. However we can assume that if you
    are removing the generic firmware driver (vesa/efi/offb), that a new driver
    *should* be loading soon after, so we effectively leak the font.

    However the old code left a dangling pointer in vc->vc_font.data and we
    can now reuse that dangling pointer to load the font into the new
    driver, now that we aren't freeing it.

    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=892340

    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Cc: Kay Sievers <kay.sievers@vrfy.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9c3f628b6004454a3867b4c0dad9c9738405dd75
Author: Jean Delvare <khali@linux-fr.org>
Date:   Sun Dec 16 22:00:50 2012 +0100

    pcmcia/vrc4171: Add missing spinlock init

    commit 811af9723859884f2f771f3174f3ddedab7c53b5 upstream.

    It doesn't seem this spinlock was properly initialized. This bug was
    introduced by commit 7a410e8d4d97457c8c381e2de9cdc7bd3306badc.

    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ef96576ef50b8bbd4c63b9cebab372cb7cf4ba67
Author: John David Anglin <dave.anglin@bell.net>
Date:   Mon Jan 14 19:45:00 2013 -0500

    Purge existing TLB entries in set_pte_at and ptep_set_wrprotect

    commit 7139bc1579901b53db7e898789e916ee2fb52d78 upstream.

    This patch goes a long way toward fixing the minifail bug, and
    it  significantly improves the stability of SMP machines such as
    the rp3440.  When write  protecting a page for COW, we need to
    purge the existing translation.  Otherwise, the COW break
    doesn't occur as expected because the TLB may still have a stale entry
    which allows writes.

    [jejb: fix up checkpatch errors]
    Signed-off-by: John David Anglin <dave.anglin@bell.net>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 534aaed9080ba82974e8d2a71e43a362918138f8
Author: Phileas Fogg <phileas-fogg@mail.ru>
Date:   Sat Feb 23 00:32:19 2013 +0100

    powerpc/kexec: Disable hard IRQ before kexec

    commit 8520e443aa56cc157b015205ea53e7b9fc831291 upstream.

    Disable hard IRQ before kexec a new kernel image.
    Not doing it can result in corrupted data in the memory segments
    reserved for the new kernel.

    Signed-off-by: Phileas Fogg <phileas-fogg@mail.ru>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 928de5bcadf8540f58ba6b12c6b7547d33dcde89
Author: Igor Grinberg <grinberg@compulab.co.il>
Date:   Sun Jan 13 13:49:47 2013 +0200

    ARM: PXA3xx: program the CSMSADRCFG register

    commit d107a204154ddd79339203c2deeb7433f0cf6777 upstream.

    The Chip Select Configuration Register must be programmed to 0x2 in
    order to achieve the correct behavior of the Static Memory Controller.

    Without this patch devices wired to DFI and accessed through SMC cannot
    be accessed after resume from S2.

    Do not rely on the boot loader to program the CSMSADRCFG register by
    programming it in the kernel smemc module.

    Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
    Acked-by: Eric Miao <eric.y.miao@gmail.com>
    Signed-off-by: Haojian Zhuang <haojian.zhuang@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 02424a5539959f519256b3a1a9e046f4caed6e65
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Wed Jan 30 20:07:29 2013 +0000

    staging: vt6656: Fix URB submitted while active warning.

    commit ae5943de8c8c4438cbac5cda599ff0b88c224468 upstream.

    This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the
    spin lock for delay, letting in another thread.

    The patch moves the current MP_SET_FLAG to before filling
    of sUsbCtlRequest for pControlURB and clears it in event of failing.

    Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES
    flags set will return STATUS_FAILURE.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1646fff8a00d797cbaa0d711f29d3102cc7c022f
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Mon Jan 28 16:14:31 2013 +0000

    staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors

    commit 754ab5c0e55dd118273ca2c217c4d95e9fbc8259 upstream.

    Comedi has two sorts of minor devices:
    (a) normal board minor devices in the range 0 to
    COMEDI_NUM_BOARD_MINORS-1 inclusive; and
    (b) special subdevice minor devices in the range COMEDI_NUM_BOARD_MINORS
    upwards that are used to open the same underlying comedi device as the
    normal board minor devices, but with non-default read and write
    subdevices for asynchronous commands.

    The special subdevice minor devices get created when a board supporting
    asynchronous commands is attached to a normal board minor device, and
    destroyed when the board is detached from the normal board minor device.
    One way to attach or detach a board is by using the COMEDI_DEVCONFIG
    ioctl.  This should only be used on normal board minors as the special
    subdevice minors are too ephemeral.  In particular, the change
    introduced in commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c ("staging:
    comedi: prevent auto-unconfig of manually configured devices") breaks
    horribly for special subdevice minor devices.

    Since there's no legitimate use for the COMEDI_DEVCONFIG ioctl on a
    special subdevice minor device node, disallow it and return -ENOTTY.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2fb8324e4a70aef032d156ce26b979c7de59303f
Author: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Date:   Fri Feb 8 16:35:37 2013 +0200

    drm/i915: disable shared panel fitter for pipe

    commit 24a1f16de97c4cf0029d9acd04be06db32208726 upstream.

    If encoder is switched off by BIOS, but the panel fitter is left on,
    we never try to turn off the panel fitter and leave it still attached
    to the pipe - which can cause blurry output elsewhere.

    Based on work by Chris Wilson <chris@chris-wilson.co.uk>

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58867
    Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
    Tested-by: Andreas Sturmlechner <andreas.sturmlechner@gmail.com>
    [danvet: Remove the redundant HAS_PCH_SPLIT check and add a tiny
    comment.]
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8eac4364548b8f53476602969a2fba65d029d8b7
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu Nov 17 16:42:19 2011 -0500

    NLS: improve UTF8 -> UTF16 string conversion routine

    commit 0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd upstream.

    The utf8s_to_utf16s conversion routine needs to be improved.  Unlike
    its utf16s_to_utf8s sibling, it doesn't accept arguments specifying
    the maximum length of the output buffer or the endianness of its
    16-bit output.

    This patch (as1501) adds the two missing arguments, and adjusts the
    only two places in the kernel where the function is called.  A
    follow-on patch will add a third caller that does utilize the new
    capabilities.

    The two conversion routines are still annoyingly inconsistent in the
    way they handle invalid byte combinations.  But that's a subject for a
    different patch.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    CC: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b5784741fdfdb5fa91edc6ea8fc5eeeed0b4a6a
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Feb 7 10:10:04 2013 +1000

    drm/usb: bind driver to correct device

    commit 9f23de52b64f7fb801fd76f3dd8651a0dc89187b upstream.

    While looking at plymouth on udl I noticed that plymouth was trying
    to use its fb plugin not its drm one, it was trying to drmOpen a driver called
    usb not udl, noticed that we actually had out driver pointing at the wrong
    device.

    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ddab81f4d0998efd4d3e288a26379fb4957cb5f7
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Feb 14 11:49:01 2013 -0800

    sunvdc: Fix off-by-one in generic_request().

    [ Upstream commit f4d9605434c0fd4cc8639bf25cfc043418c52362 ]

    The 'operations' bitmap corresponds one-for-one with the operation
    codes, no adjustment is necessary.

    Reported-by: Mark Kettenis <mark.kettenis@xs4all.nl>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 131fb7cce88c8c953429ecee478477db81727273
Author: Dan Carpenter <error27@gmail.com>
Date:   Sat Jul 30 12:58:41 2011 -0400

    ext4: add missing kfree() on error return path in add_new_gdb()

    commit c49bafa3842751b8955a962859f42d307673d75d upstream.

    We added some more error handling in b40971426a "ext4: add error
    checking to calls to ext4_handle_dirty_metadata()".  But we need to
    call kfree() as well to avoid a memory leak.

    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f1d8678b90aeaf7a3c5c30cea8a838f54cd5a8bc
Author: Tao Ma <boyu.mt@taobao.com>
Date:   Thu Oct 6 12:10:11 2011 -0400

    ext4: Free resources in some error path in ext4_fill_super

    commit dcf2d804ed6ffe5e942b909ed5e5b74628be6ee4 upstream.

    Some of the error path in ext4_fill_super don't release the
    resouces properly. So this patch just try to release them
    in the right way.

    Signed-off-by: Tao Ma <boyu.mt@taobao.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d631d0d60c31bed15002ac656cbbfba3d6ce99b5
Author: Pawel Moll <mail@pawelmoll.com>
Date:   Thu Feb 21 01:55:50 2013 +0000

    ALSA: usb: Fix Processing Unit Descriptor parsers

    commit b531f81b0d70ffbe8d70500512483227cc532608 upstream.

    Commit 99fc86450c439039d2ef88d06b222fd51a779176 "ALSA: usb-mixer:
    parse descriptors with structs" introduced a set of useful parsers
    for descriptors. Unfortunately the parses for the Processing Unit
    Descriptor came with a very subtle bug...

    Functions uac_processing_unit_iProcessing() and
    uac_processing_unit_specific() were indexing the baSourceID array
    forgetting the fields before the iProcessing and process-specific
    descriptors.

    The problem was observed with Sound Blaster Extigy mixer,
    where nNrModes in Up/Down-mix Processing Unit Descriptor
    was accessed at offset 10 of the descriptor (value 0)
    instead of offset 15 (value 7). In result the resulting
    control had interesting limit values:

    Simple mixer control 'Channel Routing Mode Select',0
      Capabilities: volume volume-joined penum
      Playback channels: Mono
      Capture channels: Mono
      Limits: 0 - -1
      Mono: -1 [100%]

    Fixed by starting from the bmControls, which was calculated
    correctly, instead of baSourceID.

    Now the mentioned control is fine:

    Simple mixer control 'Channel Routing Mode Select',0
      Capabilities: volume volume-joined penum
      Playback channels: Mono
      Capture channels: Mono
      Limits: 0 - 6
      Mono: 0 [0%]

    Signed-off-by: Pawel Moll <mail@pawelmoll.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8eab86c3483569160b2aef56cf9db6ce1274b4f6
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Thu Jan 31 21:14:33 2013 +0100

    ALSA: usb-audio: fix Roland A-PRO support

    commit 7da58046482fceb17c4a0d4afefd9507ec56de7f upstream.

    The quirk for the Roland/Cakewalk A-PRO keyboards accidentally used the
    wrong interface number, which prevented the driver from attaching to the
    device.

    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e487015297fca084180281fbc0ecdbf757ddbebe
Author: Tomasz Guszkowski <tsg@o2.pl>
Date:   Tue Feb 5 22:10:31 2013 +0100

    p54usb: corrected USB ID for T-Com Sinus 154 data II

    commit 008e33f733ca51acb2dd9d88ea878693b04d1d2a upstream.

    Corrected USB ID for T-Com Sinus 154 data II. ISL3887-based. The
    device was tested in managed mode with no security, WEP 128
    bit and WPA-PSK (TKIP) with firmware 2.13.1.0.lm87.arm (md5sum:
    7d676323ac60d6e1a3b6d61e8c528248). It works.

    Signed-off-by: Tomasz Guszkowski <tsg@o2.pl>
    Acked-By: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f0b9cb82a2d156297664de6e6df14afa39c5b7f
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Tue Feb 19 12:04:42 2013 -0500

    NLM: Ensure that we resend all pending blocking locks after a reclaim

    commit 666b3d803a511fbc9bc5e5ea8ce66010cf03ea13 upstream.

    Currently, nlmclnt_lock will break out of the for(;;) loop when
    the reclaimer wakes up the blocking lock thread by setting
    nlm_lck_denied_grace_period. This causes the lock request to fail
    with an ENOLCK error.
    The intention was always to ensure that we resend the lock request
    after the grace period has expired.

    Reported-by: Wangyuan Zhang <Wangyuan.Zhang@netapp.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78e47dce08b0dd37a001ee540cdb94fbeba89850
Author: Mel Gorman <mgorman@suse.de>
Date:   Fri Feb 22 16:35:59 2013 -0800

    mm/fadvise.c: drain all pagevecs if POSIX_FADV_DONTNEED fails to discard all pages

    commit 67d46b296a1ba1477c0df8ff3bc5e0167a0b0732 upstream.

    Rob van der Heij reported the following (paraphrased) on private mail.

    	The scenario is that I want to avoid backups to fill up the page
    	cache and purge stuff that is more likely to be used again (this is
    	with s390x Linux on z/VM, so I don't give it as much memory that
    	we don't care anymore). So I have something with LD_PRELOAD that
    	intercepts the close() call (from tar, in this case) and issues
    	a posix_fadvise() just before closing the file.

    	This mostly works, except for small files (less than 14 pages)
    	that remains in page cache after the face.

    Unfortunately Rob has not had a chance to test this exact patch but the
    test program below should be reproducing the problem he described.

    The issue is the per-cpu pagevecs for LRU additions.  If the pages are
    added by one CPU but fadvise() is called on another then the pages
    remain resident as the invalidate_mapping_pages() only drains the local
    pagevecs via its call to pagevec_release().  The user-visible effect is
    that a program that uses fadvise() properly is not obeyed.

    A possible fix for this is to put the necessary smarts into
    invalidate_mapping_pages() to globally drain the LRU pagevecs if a
    pagevec page could not be discarded.  The downside with this is that an
    inode cache shrink would send a global IPI and memory pressure
    potentially causing global IPI storms is very undesirable.

    Instead, this patch adds a check during fadvise(POSIX_FADV_DONTNEED) to
    check if invalidate_mapping_pages() discarded all the requested pages.
    If a subset of pages are discarded it drains the LRU pagevecs and tries
    again.  If the second attempt fails, it assumes it is due to the pages
    being mapped, locked or dirty and does not care.  With this patch, an
    application using fadvise() correctly will be obeyed but there is a
    downside that a malicious application can force the kernel to send
    global IPIs and increase overhead.

    If accepted, I would like this to be considered as a -stable candidate.
    It's not an urgent issue but it's a system call that is not working as
    advertised which is weak.

    The following test program demonstrates the problem.  It should never
    report that pages are still resident but will without this patch.  It
    assumes that CPU 0 and 1 exist.

    int main() {
    	int fd;
    	int pagesize = getpagesize();
    	ssize_t written = 0, expected;
    	char *buf;
    	unsigned char *vec;
    	int resident, i;
    	cpu_set_t set;

    	/* Prepare a buffer for writing */
    	expected = FILESIZE_PAGES * pagesize;
    	buf = malloc(expected + 1);
    	if (buf == NULL) {
    		printf("ENOMEM\n");
    		exit(EXIT_FAILURE);
    	}
    	buf[expected] = 0;
    	memset(buf, 'a', expected);

    	/* Prepare the mincore vec */
    	vec = malloc(FILESIZE_PAGES);
    	if (vec == NULL) {
    		printf("ENOMEM\n");
    		exit(EXIT_FAILURE);
    	}

    	/* Bind ourselves to CPU 0 */
    	CPU_ZERO(&set);
    	CPU_SET(0, &set);
    	if (sched_setaffinity(getpid(), sizeof(set), &set) == -1) {
    		perror("sched_setaffinity");
    		exit(EXIT_FAILURE);
    	}

    	/* open file, unlink and write buffer */
    	fd = open("fadvise-test-file", O_CREAT|O_EXCL|O_RDWR);
    	if (fd == -1) {
    		perror("open");
    		exit(EXIT_FAILURE);
    	}
    	unlink("fadvise-test-file");
    	while (written < expected) {
    		ssize_t this_write;
    		this_write = write(fd, buf + written, expected - written);

    		if (this_write == -1) {
    			perror("write");
    			exit(EXIT_FAILURE);
    		}

    		written += this_write;
    	}
    	free(buf);

    	/*
    	 * Force ourselves to another CPU. If fadvise only flushes the local
    	 * CPUs pagevecs then the fadvise will fail to discard all file pages
    	 */
    	CPU_ZERO(&set);
    	CPU_SET(1, &set);
    	if (sched_setaffinity(getpid(), sizeof(set), &set) == -1) {
    		perror("sched_setaffinity");
    		exit(EXIT_FAILURE);
    	}

    	/* sync and fadvise to discard the page cache */
    	fsync(fd);
    	if (posix_fadvise(fd, 0, expected, POSIX_FADV_DONTNEED) == -1) {
    		perror("posix_fadvise");
    		exit(EXIT_FAILURE);
    	}

    	/* map the file and use mincore to see which parts of it are resident */
    	buf = mmap(NULL, expected, PROT_READ, MAP_SHARED, fd, 0);
    	if (buf == NULL) {
    		perror("mmap");
    		exit(EXIT_FAILURE);
    	}
    	if (mincore(buf, expected, vec) == -1) {
    		perror("mincore");
    		exit(EXIT_FAILURE);
    	}

    	/* Check residency */
    	for (i = 0, resident = 0; i < FILESIZE_PAGES; i++) {
    		if (vec[i])
    			resident++;
    	}
    	if (resident != 0) {
    		printf("Nr unexpected pages resident: %d\n", resident);
    		exit(EXIT_FAILURE);
    	}

    	munmap(buf, expected);
    	close(fd);
    	free(vec);
    	exit(EXIT_SUCCESS);
    }

    Signed-off-by: Mel Gorman <mgorman@suse.de>
    Reported-by: Rob van der Heij <rvdheij@gmail.com>
    Tested-by: Rob van der Heij <rvdheij@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a95f23a87f048318db586d087725b574f40002ce
Author: Greg Thelen <gthelen@google.com>
Date:   Fri Feb 22 16:36:01 2013 -0800

    tmpfs: fix use-after-free of mempolicy object

    commit 5f00110f7273f9ff04ac69a5f85bb535a4fd0987 upstream.

    The tmpfs remount logic preserves filesystem mempolicy if the mpol=M
    option is not specified in the remount request.  A new policy can be
    specified if mpol=M is given.

    Before this patch remounting an mpol bound tmpfs without specifying
    mpol= mount option in the remount request would set the filesystem's
    mempolicy object to a freed mempolicy object.

    To reproduce the problem boot a DEBUG_PAGEALLOC kernel and run:
        # mkdir /tmp/x

        # mount -t tmpfs -o size=100M,mpol=interleave nodev /tmp/x

        # grep /tmp/x /proc/mounts
        nodev /tmp/x tmpfs rw,relatime,size=102400k,mpol=interleave:0-3 0 0

        # mount -o remount,size=200M nodev /tmp/x

        # grep /tmp/x /proc/mounts
        nodev /tmp/x tmpfs rw,relatime,size=204800k,mpol=??? 0 0
            # note ? garbage in mpol=... output above

        # dd if=/dev/zero of=/tmp/x/f count=1
            # panic here

    Panic:
        BUG: unable to handle kernel NULL pointer dereference at           (null)
        IP: [<          (null)>]           (null)
        [...]
        Oops: 0010 [#1] SMP DEBUG_PAGEALLOC
        Call Trace:
          mpol_shared_policy_init+0xa5/0x160
          shmem_get_inode+0x209/0x270
          shmem_mknod+0x3e/0xf0
          shmem_create+0x18/0x20
          vfs_create+0xb5/0x130
          do_last+0x9a1/0xea0
          path_openat+0xb3/0x4d0
          do_filp_open+0x42/0xa0
          do_sys_open+0xfe/0x1e0
          compat_sys_open+0x1b/0x20
          cstar_dispatch+0x7/0x1f

    Non-debug kernels will not crash immediately because referencing the
    dangling mpol will not cause a fault.  Instead the filesystem will
    reference a freed mempolicy object, which will cause unpredictable
    behavior.

    The problem boils down to a dropped mpol reference below if
    shmem_parse_options() does not allocate a new mpol:

        config = *sbinfo
        shmem_parse_options(data, &config, true)
        mpol_put(sbinfo->mpol)
        sbinfo->mpol = config.mpol  /* BUG: saves unreferenced mpol */

    This patch avoids the crash by not releasing the mempolicy if
    shmem_parse_options() doesn't create a new mpol.

    How far back does this issue go? I see it in both 2.6.36 and 3.3.  I did
    not look back further.

    Signed-off-by: Greg Thelen <gthelen@google.com>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36c15fe81edd6963781d3472d27b199279f5d28a
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Thu Feb 21 16:44:04 2013 -0800

    drivers/video/backlight/adp88?0_bl.c: fix resume

    commit 5eb02c01bd1f3ef195989ab05e835e2b0711b5a9 upstream.

    Clearing the NSTBY bit in the control register also automatically clears
    the BLEN bit.  So we need to make sure to set it again during resume,
    otherwise the backlight will stay off.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Michael Hennerich <michael.hennerich@analog.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 099f19c0426e465c44b66cc93f923461af6e5f8d
Author: Junxiao Bi <junxiao.bi@oracle.com>
Date:   Thu Feb 21 16:42:45 2013 -0800

    ocfs2: unlock super lock if lockres refresh failed

    commit 3278bb748d2437eb1464765f36429e5d6aa91c38 upstream.

    If lockres refresh failed, the super lock will never be released which
    will cause some processes on other cluster nodes hung forever.

    Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Mark Fasheh <mfasheh@suse.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9a84bc2154b9787917cfc69cd619110bb9ab802f
Author: Jim Somerville <Jim.Somerville@windriver.com>
Date:   Thu Feb 21 16:41:59 2013 -0800

    inotify: remove broken mask checks causing unmount to be EINVAL

    commit 676a0675cf9200ac047fb50825f80867b3bb733b upstream.

    Running the command:

    	inotifywait -e unmount /mnt/disk

    immediately aborts with a -EINVAL return code.  This is however a valid
    parameter.  This abort occurs only if unmount is the sole event
    parameter.  If other event parameters are supplied, then the unmount
    event wait will work.

    The problem was introduced by commit 44b350fc23e ("inotify: Fix mask
    checks").  In that commit, it states:

    	The mask checks in inotify_update_existing_watch() and
    	inotify_new_watch() are useless because inotify_arg_to_mask()
    	sets FS_IN_IGNORED and FS_EVENT_ON_CHILD bits anyway.

    But instead of removing the useless checks, it did this:

    	        mask = inotify_arg_to_mask(arg);
    	-       if (unlikely(!mask))
    	+       if (unlikely(!(mask & IN_ALL_EVENTS)))
    	                return -EINVAL;

    The problem is that IN_ALL_EVENTS doesn't include IN_UNMOUNT, and other
    parts of the code keep IN_UNMOUNT separate from IN_ALL_EVENTS.  So the
    check should be:

    	if (unlikely(!(mask & (IN_ALL_EVENTS | IN_UNMOUNT))))

    But inotify_arg_to_mask(arg) always sets the IN_UNMOUNT bit in the mask
    anyway, so the check is always going to pass and thus should simply be
    removed.  Also note that inotify_arg_to_mask completely controls what
    mask bits get set from arg, there's no way for invalid bits to get
    enabled there.

    Lets fix it by simply removing the useless broken checks.

    Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Cc: Jerome Marchand <jmarchan@redhat.com>
    Cc: John McCutchan <john@johnmccutchan.com>
    Cc: Robert Love <rlove@rlove.org>
    Cc: Eric Paris <eparis@parisplace.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 58c9ce6fad8e00d9726447f939fe7e78e2aec891
Author: Christian Borntraeger <borntraeger@de.ibm.com>
Date:   Fri Jan 25 15:34:15 2013 +0100

    s390/kvm: Fix store status for ACRS/FPRS

    commit 15bc8d8457875f495c59d933b05770ba88d1eacb upstream.

    On store status we need to copy the current state of registers
    into a save area. Currently we might save stale versions:
    The sie state descriptor doesnt have fields for guest ACRS,FPRS,
    those registers are simply stored in the host registers. The host
    program must copy these away if needed. We do that in vcpu_put/load.

    If we now do a store status in KVM code between vcpu_put/load, the
    saved values are not up-to-date. Lets collect the ACRS/FPRS before
    saving them.

    This also fixes some strange problems with hotplug and virtio-ccw,
    since the low level machine check handler (on hotplug a machine check
    will happen) will revalidate all registers with the content of the
    save area.

    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Gleb Natapov <gleb@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 25adbf9cfa6ea467b681a11219d29c7ff41637c7
Author: Cornelia Huck <cornelia.huck@de.ibm.com>
Date:   Fri Dec 14 17:02:16 2012 +0100

    KVM: s390: Handle hosts not supporting s390-virtio.

    commit 55c171a6d90dc0574021f9c836127cfd1a7d2e30 upstream.

    Running under a kvm host does not necessarily imply the presence of
    a page mapped above the main memory with the virtio information;
    however, the code includes a hard coded access to that page.

    Instead, check for the presence of the page and exit gracefully
    before we hit an addressing exception if it does not exist.

    Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com>
    Reviewed-by: Alexander Graf <agraf@suse.de>
    Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
    Signed-off-by: Gleb Natapov <gleb@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8e78002093815336a22ba3e723c1d9d15000d9b5
Author: Robin Holt <holt@sgi.com>
Date:   Fri Feb 22 16:35:34 2013 -0800

    mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts

    commit 751efd8610d3d7d67b7bdf7f62646edea7365dd7 upstream.

    There is a race condition between mmu_notifier_unregister() and
    __mmu_notifier_release().

    Assume two tasks, one calling mmu_notifier_unregister() as a result of a
    filp_close() ->flush() callout (task A), and the other calling
    mmu_notifier_release() from an mmput() (task B).

                    A                               B
    t1                                              srcu_read_lock()
    t2              if (!hlist_unhashed())
    t3                                              srcu_read_unlock()
    t4              srcu_read_lock()
    t5                                              hlist_del_init_rcu()
    t6                                              synchronize_srcu()
    t7              srcu_read_unlock()
    t8              hlist_del_rcu()  <--- NULL pointer deref.

    Additionally, the list traversal in __mmu_notifier_release() is not
    protected by the by the mmu_notifier_mm->hlist_lock which can result in
    callouts to the ->release() notifier from both mmu_notifier_unregister()
    and __mmu_notifier_release().

    -stable suggestions:

    The stable trees prior to 3.7.y need commits 21a92735f660 and
    70400303ce0c cherry-picked in that order prior to cherry-picking this
    commit.  The 3.7.y tree already has those two commits.

    Signed-off-by: Robin Holt <holt@sgi.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
    Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Cc: Avi Kivity <avi@redhat.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Marcelo Tosatti <mtosatti@redhat.com>
    Cc: Sagi Grimberg <sagig@mellanox.co.il>
    Cc: Haggai Eran <haggaie@mellanox.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d98f0eb2ac95485b0fce8f14f77f1482ce293948
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Mon Oct 8 16:31:52 2012 -0700

    mm: mmu_notifier: make the mmu_notifier srcu static

    commit 70400303ce0c4ced3139499c676d5c79636b0c72 upstream.

    The variable must be static especially given the variable name.

    s/RCU/SRCU/ over a few comments.

    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Cc: Sagi Grimberg <sagig@mellanox.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Haggai Eran <haggaie@mellanox.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed5ac19078a65a66008f9bef0037b56828349b5b
Author: Sagi Grimberg <sagig@mellanox.co.il>
Date:   Mon Oct 8 16:29:24 2012 -0700

    mm: mmu_notifier: have mmu_notifiers use a global SRCU so they may safely schedule

    commit 21a92735f660eaecf69a6f2e777f18463760ec32 upstream.

    With an RCU based mmu_notifier implementation, any callout to
    mmu_notifier_invalidate_range_{start,end}() or
    mmu_notifier_invalidate_page() would not be allowed to call schedule()
    as that could potentially allow a modification to the mmu_notifier
    structure while it is currently being used.

    Since srcu allocs 4 machine words per instance per cpu, we may end up
    with memory exhaustion if we use srcu per mm.  So all mms share a global
    srcu.  Note that during large mmu_notifier activity exit & unregister
    paths might hang for longer periods, but it is tolerable for current
    mmu_notifier clients.

    Signed-off-by: Sagi Grimberg <sagig@mellanox.co.il>
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Haggai Eran <haggaie@mellanox.com>
    Cc: "Paul E. McKenney" <paulmck@us.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0eec39b02834d2af586ec6ebe84117273995021c
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Tue Jan 29 16:44:27 2013 -0700

    Driver core: treat unregistered bus_types as having no devices

    commit 4fa3e78be7e985ca814ce2aa0c09cbee404efcf7 upstream.

    A bus_type has a list of devices (klist_devices), but the list and the
    subsys_private structure that contains it are not initialized until the
    bus_type is registered with bus_register().

    The panic/reboot path has fixups that look up devices in pci_bus_type.  If
    we panic before registering pci_bus_type, the bus_type exists but the list
    does not, so mach_reboot_fixups() trips over a null pointer and panics
    again:

        mach_reboot_fixups
          pci_get_device
            ..
              bus_find_device(&pci_bus_type, ...)
                bus->p is NULL

    Joonsoo reported a problem when panicking before PCI was initialized.
    I think this patch should be sufficient to replace the patch he posted
    here: https://lkml.org/lkml/2012/12/28/75 ("[PATCH] x86, reboot: skip
    reboot_fixups in early boot phase")

    Reported-by: Joonsoo Kim <js1304@gmail.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20807f47cffc5e85f9127c260621d12dc3b7814b
Author: Stefan Bader <stefan.bader@canonical.com>
Date:   Fri Feb 15 09:48:52 2013 +0100

    xen: Send spinlock IPI to all waiters

    commit 76eaca031f0af2bb303e405986f637811956a422 upstream.

    There is a loophole between Xen's current implementation of
    pv-spinlocks and the scheduler. This was triggerable through
    a testcase until v3.6 changed the TLB flushing code. The
    problem potentially is still there just not observable in the
    same way.

    What could happen was (is):

    1. CPU n tries to schedule task x away and goes into a slow
       wait for the runq lock of CPU n-# (must be one with a lower
       number).
    2. CPU n-#, while processing softirqs, tries to balance domains
       and goes into a slow wait for its own runq lock (for updating
       some records). Since this is a spin_lock_irqsave in softirq
       context, interrupts will be re-enabled for the duration of
       the poll_irq hypercall used by Xen.
    3. Before the runq lock of CPU n-# is unlocked, CPU n-1 receives
       an interrupt (e.g. endio) and when processing the interrupt,
       tries to wake up task x. But that is in schedule and still
       on_cpu, so try_to_wake_up goes into a tight loop.
    4. The runq lock of CPU n-# gets unlocked, but the message only
       gets sent to the first waiter, which is CPU n-# and that is
       busily stuck.
    5. CPU n-# never returns from the nested interruption to take and
       release the lock because the scheduler uses a busy wait.
       And CPU n never finishes the task migration because the unlock
       notification only went to CPU n-#.

    To avoid this and since the unlocking code has no real sense of
    which waiter is best suited to grab the lock, just send the IPI
    to all of them. This causes the waiters to return from the hyper-
    call (those not interrupted at least) and do active spinlocking.

    BugLink: http://bugs.launchpad.net/bugs/1011792

    Acked-by: Jan Beulich <JBeulich@suse.com>
    Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 212d2748ffe43d4e2756be40ddfdd7044197936d
Author: Ian Campbell <ian.campbell@citrix.com>
Date:   Tue Feb 19 09:05:46 2013 +0000

    xen/netback: check correct frag when looking for head frag

    When I backported 7d5145d8eb2b "xen/netback: don't leak pages on failure in
    xen_netbk_tx_check_gop" to 3.0 (where it became f0457844e605) I somehow picked
    up an extraneous hunk breaking this.

    Reported-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 13efbfc6083d955929052394254d1ccba840edfc
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 29 20:07:41 2013 +0100

    tty: set_termios/set_termiox should not return -EINTR

    commit 183d95cdd834381c594d3aa801c1f9f9c0c54fa9 upstream.

    See https://bugzilla.redhat.com/show_bug.cgi?id=904907
    read command causes bash to abort with double free or corruption (out).

    A simple test-case from Roman:

    	// Compile the reproducer and send sigchld ti that process.
    	// EINTR occurs even if SA_RESTART flag is set.

    	void handler(int sig)
    	{
    	}

    	main()
    	{
    	  struct sigaction act;
    	  act.sa_handler = handler;
    	  act.sa_flags = SA_RESTART;
    	  sigaction (SIGCHLD, &act, 0);
    	  struct termio ttp;
    	  ioctl(0, TCGETA, &ttp);
    	  while(1)
    	  {
    	    if (ioctl(0, TCSETAW, ttp) < 0)
    	      {
    		if (errno == EINTR)
    		{
    		  fprintf(stderr, "BUG!"); return(1);
    		}
    	      }
    	  }
    	}

    Change set_termios/set_termiox to return -ERESTARTSYS to fix this
    particular problem.

    I didn't dare to change other EINTR's in drivers/tty/, but they look
    equally wrong.

    Reported-by: Roman Rakus <rrakus@redhat.com>
    Reported-by: Lingzhu Xiang <lxiang@redhat.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Cc: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4e466c1472a407c6dc1a03d3a17783e9f35e6304
Author: Denis Efremov <yefremov.denis@gmail.com>
Date:   Mon Feb 11 19:04:06 2013 +0400

    ALSA: rme32.c irq enabling after spin_lock_irq

    commit f49a59c4471d81a233e09dda45187cc44fda009d upstream.

    According to the other code in this driver and similar
    code in rme96 it seems, that spin_lock_irq in
    snd_rme32_capture_close function should be paired
    with spin_unlock_irq.

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 89251132aead7e623602604146d0b30e265c9259
Author: Denis Efremov <yefremov.denis@gmail.com>
Date:   Mon Feb 11 19:49:48 2013 +0400

    ALSA: ali5451: remove irq enabling in pointer callback

    commit dacae5a19b4cbe1b5e3a86de23ea74cbe9ec9652 upstream.

    snd_ali_pointer function is called with local
    interrupts disabled. However it seems very strange to
    reenable them in such way.

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bdc82b1e7a4dfc5b287d3f52e173ba8e0183be15
Author: Leonid Shatz <leonid.shatz@ravellosystems.com>
Date:   Mon Feb 4 14:33:37 2013 +0200

    hrtimer: Prevent hrtimer_enqueue_reprogram race

    commit b22affe0aef429d657bc6505aacb1c569340ddd2 upstream.

    hrtimer_enqueue_reprogram contains a race which could result in
    timer.base switch during unlock/lock sequence.

    hrtimer_enqueue_reprogram is releasing the lock protecting the timer
    base for calling raise_softirq_irqsoff() due to a lock ordering issue
    versus rq->lock.

    If during that time another CPU calls __hrtimer_start_range_ns() on
    the same hrtimer, the timer base might switch, before the current CPU
    can lock base->lock again and therefor the unlock_timer_base() call
    will unlock the wrong lock.

    [ tglx: Added comment and massaged changelog ]

    Signed-off-by: Leonid Shatz <leonid.shatz@ravellosystems.com>
    Signed-off-by: Izik Eidus <izik.eidus@ravellosystems.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Link: http://lkml.kernel.org/r/1359981217-389-1-git-send-email-izik.eidus@ravellosystems.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c56dec21a605c9cad4e37492ca292f114d2aad34
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Fri Feb 15 11:08:11 2013 +0100

    posix-cpu-timers: Fix nanosleep task_struct leak

    commit e6c42c295e071dd74a66b5a9fcf4f44049888ed8 upstream.

    The trinity fuzzer triggered a task_struct reference leak via
    clock_nanosleep with CPU_TIMERs. do_cpu_nanosleep() calls
    posic_cpu_timer_create(), but misses a corresponding
    posix_cpu_timer_del() which leads to the task_struct reference leak.

    Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Cc: Dave Jones <davej@redhat.com>
    Cc: John Stultz <john.stultz@linaro.org>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Link: http://lkml.kernel.org/r/20130215100810.GF4392@redhat.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 890914e9fc7b9c12714a58f1e1318f3de500f241
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Nov 23 10:08:44 2012 +0100

    genirq: Avoid deadlock in spurious handling

    commit e716efde75267eab919cdb2bef5b2cb77f305326 upstream.

    commit 52553ddf(genirq: fix regression in irqfixup, irqpoll)
    introduced a potential deadlock by calling the action handler with the
    irq descriptor lock held.

    Remove the call and let the handling code run even for an interrupt
    where only a single action is registered. That matches the goal of
    the above commit and avoids the deadlock.

    Document the confusing action = desc->action reload in the handling
    loop while at it.

    Reported-and-tested-by: "Wang, Warner" <warner.wang@hp.com>
    Tested-by: Edward Donovan <edward.donovan@numble.net>
    Cc: "Wang, Song-Bo (Stoney)" <song-bo.wang@hp.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d8c3d7e8f9e47cc1a828ca7433376c60c4b9af23
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Thu Feb 7 17:14:08 2013 -0800

    timeconst.pl: Eliminate Perl warning

    commit 63a3f603413ffe82ad775f2d62a5afff87fd94a0 upstream.

    defined(@array) is deprecated in Perl and gives off a warning.
    Restructure the code to remove that warning.

    [ hpa: it would be interesting to revert to the timeconst.bc script.
      It appears that the failures reported by akpm during testing of
      that script was due to a known broken version of make, not a problem
      with bc.  The Makefile rules could probably be restructured to avoid
      the make bug, or it is probably old enough that it doesn't matter. ]

    Reported-by: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 744dac7d299be82e4d13b217e81eb4bfee9826a8
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Feb 18 09:58:02 2013 -0800

    mm: fix pageblock bitmap allocation

    commit 7c45512df987c5619db041b5c9b80d281e26d3db upstream.

    Commit c060f943d092 ("mm: use aligned zone start for pfn_to_bitidx
    calculation") fixed out calculation of the index into the pageblock
    bitmap when a !SPARSEMEM zome was not aligned to pageblock_nr_pages.

    However, the _allocation_ of that bitmap had never taken this alignment
    requirement into accout, so depending on the exact size and alignment of
    the zone, the use of that index could then access past the allocation,
    resulting in some very subtle memory corruption.

    This was reported (and bisected) by Ingo Molnar: one of his random
    config builds would hang with certain very specific kernel command line
    options.

    In the meantime, commit c060f943d092 has been marked for stable, so this
    fix needs to be back-ported to the stable kernels that backported the
    commit to use the right alignment.

    Bisected-and-tested-by: Ingo Molnar <mingo@kernel.org>
    Acked-by: Mel Gorman <mgorman@suse.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dbb694e810c87e7e1760527a783437f26ac5a547
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Thu Jan 31 13:53:10 2013 -0800

    x86-32, mm: Remove reference to resume_map_numa_kva()

    commit bb112aec5ee41427e9b9726e3d57b896709598ed upstream.

    Remove reference to removed function resume_map_numa_kva().

    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: Dave Hansen <dave@linux.vnet.ibm.com>
    Link: http://lkml.kernel.org/r/20130131005616.1C79F411@kernel.stglabs.ibm.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>