Linux 3.0.70

commit ef4fb40e21750ad9c3d1b017c61a9a69701039ff
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Mar 20 12:59:35 2013 -0700

    Linux 3.0.70

commit 5678a7694c47188498a740ae805a8dee2fd7d178
Author: Mathias Krause <minipli@googlemail.com>
Date:   Sat Mar 9 05:52:21 2013 +0000

    dcbnl: fix various netlink info leaks

    [ Upstream commit 29cd8ae0e1a39e239a3a7b67da1986add1199fc0 ]

    The dcb netlink interface leaks stack memory in various places:
    * perm_addr[] buffer is only filled at max with 12 of the 32 bytes but
      copied completely,
    * no in-kernel driver fills all fields of an IEEE 802.1Qaz subcommand,
      so we're leaking up to 58 bytes for ieee_ets structs, up to 136 bytes
      for ieee_pfc structs, etc.,
    * the same is true for CEE -- no in-kernel driver fills the whole
      struct,

    Prevent all of the above stack info leaks by properly initializing the
    buffers/structures involved.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3385fcdbf46ec6fbbcefffd41ac10a8c4daafd32
Author: Mathias Krause <minipli@googlemail.com>
Date:   Sat Mar 9 05:52:20 2013 +0000

    rtnl: fix info leak on RTM_GETLINK request for VF devices

    [ Upstream commit 84d73cd3fb142bf1298a8c13fd4ca50fd2432372 ]

    Initialize the mac address buffer with 0 as the driver specific function
    will probably not fill the whole buffer. In fact, all in-kernel drivers
    fill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible
    bytes. Therefore we currently leak 26 bytes of stack memory to userland
    via the netlink interface.

    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f401a6d4d0bebbb5e80711305d1f4904f192cee
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date:   Fri Mar 8 02:07:23 2013 +0000

    ipv6: stop multicast forwarding to process interface scoped addresses

    [ Upstream commit ddf64354af4a702ee0b85d0a285ba74c7278a460 ]

    v2:
    a) used struct ipv6_addr_props

    v3:
    a) reverted changes for ipv6_addr_props

    v4:
    a) do not use __ipv6_addr_needs_scope_id

    Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b8268476626db0dac71fad35da5532e32f6a879e
Author: Cristian Bercaru <B43982@freescale.com>
Date:   Fri Mar 8 07:03:38 2013 +0000

    bridging: fix rx_handlers return code

    [ Upstream commit 3bc1b1add7a8484cc4a261c3e128dbe1528ce01f ]

    The frames for which rx_handlers return RX_HANDLER_CONSUMED are no longer
    counted as dropped. They are counted as successfully received by
    'netif_receive_skb'.

    This allows network interface drivers to correctly update their RX-OK and
    RX-DRP counters based on the result of 'netif_receive_skb'.

    Signed-off-by: Cristian Bercaru <B43982@freescale.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ae1c7c9e9da70544a23906e4433223a58bdec11
Author: Paul Moore <pmoore@redhat.com>
Date:   Wed Mar 6 11:45:24 2013 +0000

    netlabel: correctly list all the static label mappings

    [ Upstream commits 0c1233aba1e948c37f6dc7620cb7c253fcd71ce9 and
      a6a8fe950e1b8596bb06f2c89c3a1a4bf2011ba9 ]

    When we have a large number of static label mappings that spill across
    the netlink message boundary we fail to properly save our state in the
    netlink_callback struct which causes us to repeat the same listings.
    This patch fixes this problem by saving the state correctly between
    calls to the NetLabel static label netlink "dumpit" routines.

    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20ef510141e92e872e5dfd84dd6c77b8f94effee
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Mar 6 11:02:37 2013 +0000

    tun: add a missing nf_reset() in tun_net_xmit()

    [ Upstream commit f8af75f3517a24838a36eb5797a1a3e60bf9e276 ]

    Dave reported following crash :

    general protection fault: 0000 [#1] SMP
    CPU 2
    Pid: 25407, comm: qemu-kvm Not tainted 3.7.9-205.fc18.x86_64 #1 Hewlett-Packard HP Z400 Workstation/0B4Ch
    RIP: 0010:[<ffffffffa0399bd5>]  [<ffffffffa0399bd5>] destroy_conntrack+0x35/0x120 [nf_conntrack]
    RSP: 0018:ffff880276913d78  EFLAGS: 00010206
    RAX: 50626b6b7876376c RBX: ffff88026e530d68 RCX: ffff88028d158e00
    RDX: ffff88026d0d5470 RSI: 0000000000000011 RDI: 0000000000000002
    RBP: ffff880276913d88 R08: 0000000000000000 R09: ffff880295002900
    R10: 0000000000000000 R11: 0000000000000003 R12: ffffffff81ca3b40
    R13: ffffffff8151a8e0 R14: ffff880270875000 R15: 0000000000000002
    FS:  00007ff3bce38a00(0000) GS:ffff88029fc40000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 00007fd1430bd000 CR3: 000000027042b000 CR4: 00000000000027e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process qemu-kvm (pid: 25407, threadinfo ffff880276912000, task ffff88028c369720)
    Stack:
     ffff880156f59100 ffff880156f59100 ffff880276913d98 ffffffff815534f7
     ffff880276913db8 ffffffff8151a74b ffff880270875000 ffff880156f59100
     ffff880276913dd8 ffffffff8151a5a6 ffff880276913dd8 ffff88026d0d5470
    Call Trace:
     [<ffffffff815534f7>] nf_conntrack_destroy+0x17/0x20
     [<ffffffff8151a74b>] skb_release_head_state+0x7b/0x100
     [<ffffffff8151a5a6>] __kfree_skb+0x16/0xa0
     [<ffffffff8151a666>] kfree_skb+0x36/0xa0
     [<ffffffff8151a8e0>] skb_queue_purge+0x20/0x40
     [<ffffffffa02205f7>] __tun_detach+0x117/0x140 [tun]
     [<ffffffffa022184c>] tun_chr_close+0x3c/0xd0 [tun]
     [<ffffffff8119669c>] __fput+0xec/0x240
     [<ffffffff811967fe>] ____fput+0xe/0x10
     [<ffffffff8107eb27>] task_work_run+0xa7/0xe0
     [<ffffffff810149e1>] do_notify_resume+0x71/0xb0
     [<ffffffff81640152>] int_signal+0x12/0x17
    Code: 00 00 04 48 89 e5 41 54 53 48 89 fb 4c 8b a7 e8 00 00 00 0f 85 de 00 00 00 0f b6 73 3e 0f b7 7b 2a e8 10 40 00 00 48 85 c0 74 0e <48> 8b 40 28 48 85 c0 74 05 48 89 df ff d0 48 c7 c7 08 6a 3a a0
    RIP  [<ffffffffa0399bd5>] destroy_conntrack+0x35/0x120 [nf_conntrack]
     RSP <ffff880276913d78>

    This is because tun_net_xmit() needs to call nf_reset()
    before queuing skb into receive_queue

    Reported-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b1a7a7672b91264a9ff65be7d39f395522942efc
Author: Neal Cardwell <ncardwell@google.com>
Date:   Mon Mar 4 06:23:05 2013 +0000

    tcp: fix double-counted receiver RTT when leaving receiver fast path

    [ Upstream commit aab2b4bf224ef8358d262f95b568b8ad0cecf0a0 ]

    We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both
    before and after going to step5. That wastes CPU and double-counts the
    receiver-side RTT sample.

    Signed-off-by: Neal Cardwell <ncardwell@google.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e7a432a0c3f5bd368535e529ce66f27b834c0e9c
Author: Lorenzo Colitti <lorenzo@google.com>
Date:   Sun Mar 3 20:46:46 2013 +0000

    net: ipv6: Don't purge default router if accept_ra=2

    [ Upstream commit 3e8b0ac3e41e3c882222a5522d5df7212438ab51 ]

    Setting net.ipv6.conf.<interface>.accept_ra=2 causes the kernel
    to accept RAs even when forwarding is enabled. However, enabling
    forwarding purges all default routes on the system, breaking
    connectivity until the next RA is received. Fix this by not
    purging default routes on interfaces that have accept_ra=2.

    Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
    Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36561fe245c06205300ae6e4e5476a7b2deff4df
Author: Cong Wang <amwang@redhat.com>
Date:   Sun Mar 3 16:18:11 2013 +0000

    rds: limit the size allocated by rds_message_alloc()

    [ Upstream commit ece6b0a2b25652d684a7ced4ae680a863af041e0 ]

    Dave Jones reported the following bug:

    "When fed mangled socket data, rds will trust what userspace gives it,
    and tries to allocate enormous amounts of memory larger than what
    kmalloc can satisfy."

    WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()
    Hardware name: GA-MA78GM-S2H
    Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s
    Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65
    Call Trace:
     [<ffffffff81044155>] warn_slowpath_common+0x75/0xa0
     [<ffffffff8104419a>] warn_slowpath_null+0x1a/0x20
     [<ffffffff811444ad>] __alloc_pages_nodemask+0xa0d/0xbe0
     [<ffffffff8100a196>] ? native_sched_clock+0x26/0x90
     [<ffffffff810b2128>] ? trace_hardirqs_off_caller+0x28/0xc0
     [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10
     [<ffffffff811861f8>] alloc_pages_current+0xb8/0x180
     [<ffffffff8113eaaa>] __get_free_pages+0x2a/0x80
     [<ffffffff811934fe>] kmalloc_order_trace+0x3e/0x1a0
     [<ffffffff81193955>] __kmalloc+0x2f5/0x3a0
     [<ffffffff8104df0c>] ? local_bh_enable_ip+0x7c/0xf0
     [<ffffffffa0401ab3>] rds_message_alloc+0x23/0xb0 [rds]
     [<ffffffffa04043a1>] rds_sendmsg+0x2b1/0x990 [rds]
     [<ffffffff810b21cd>] ? trace_hardirqs_off+0xd/0x10
     [<ffffffff81564620>] sock_sendmsg+0xb0/0xe0
     [<ffffffff810b2052>] ? get_lock_stats+0x22/0x70
     [<ffffffff810b24be>] ? put_lock_stats.isra.23+0xe/0x40
     [<ffffffff81567f30>] sys_sendto+0x130/0x180
     [<ffffffff810b872d>] ? trace_hardirqs_on+0xd/0x10
     [<ffffffff816c547b>] ? _raw_spin_unlock_irq+0x3b/0x60
     [<ffffffff816cd767>] ? sysret_check+0x1b/0x56
     [<ffffffff810b8695>] ? trace_hardirqs_on_caller+0x115/0x1a0
     [<ffffffff81341d8e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
     [<ffffffff816cd742>] system_call_fastpath+0x16/0x1b
    ---[ end trace eed6ae990d018c8b ]---

    Reported-by: Dave Jones <davej@redhat.com>
    Cc: Dave Jones <davej@redhat.com>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
    Signed-off-by: Cong Wang <amwang@redhat.com>
    Acked-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a965143b0d56545cf931fb34fe9464df457d2188
Author: Guillaume Nault <g.nault@alphalink.fr>
Date:   Fri Mar 1 05:02:02 2013 +0000

    l2tp: Restore socket refcount when sendmsg succeeds

    [ Upstream commit 8b82547e33e85fc24d4d172a93c796de1fefa81a ]

    The sendmsg() syscall handler for PPPoL2TP doesn't decrease the socket
    reference counter after successful transmissions. Any successful
    sendmsg() call from userspace will then increase the reference counter
    forever, thus preventing the kernel's session and tunnel data from
    being freed later on.

    The problem only happens when writing directly on L2TP sockets.
    PPP sockets attached to L2TP are unaffected as the PPP subsystem
    uses pppol2tp_xmit() which symmetrically increase/decrease reference
    counters.

    This patch adds the missing call to sock_put() before returning from
    pppol2tp_sendmsg().

    Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 965fa30c0675af7086dffa940839bcc894ca376d
Author: Guo Chao <yan@linux.vnet.ibm.com>
Date:   Thu Feb 21 15:16:45 2013 -0800

    loopdev: fix a deadlock

    commit 5370019dc2d2c2ff90e95d181468071362934f3a upstream.

    bd_mutex and lo_ctl_mutex can be held in different order.

    Path #1:

    blkdev_open
     blkdev_get
      __blkdev_get (hold bd_mutex)
       lo_open (hold lo_ctl_mutex)

    Path #2:

    blkdev_ioctl
     lo_ioctl (hold lo_ctl_mutex)
      lo_set_capacity (hold bd_mutex)

    Lockdep does not report it, because path #2 actually holds a subclass of
    lo_ctl_mutex.  This subclass seems creep into the code by mistake.  The
    patch author actually just mentioned it in the changelog, see commit
    f028f3b2 ("loop: fix circular locking in loop_clr_fd()"), also see:

    	http://marc.info/?l=linux-kernel&m=123806169129727&w=2

    Path #2 hold bd_mutex to call bd_set_size(), I've protected it
    with i_mutex in a previous patch, so drop bd_mutex at this site.

    Signed-off-by: Guo Chao <yan@linux.vnet.ibm.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Guo Chao <yan@linux.vnet.ibm.com>
    Cc: M. Hindess <hindessm@uk.ibm.com>
    Cc: Nikanth Karthikesan <knikanth@suse.de>
    Cc: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Acked-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 827401f0005244b97f9742df38996b3c76d8e297
Author: Guo Chao <yan@linux.vnet.ibm.com>
Date:   Thu Feb 21 15:16:42 2013 -0800

    block: use i_size_write() in bd_set_size()

    commit d646a02a9d44d1421f273ae3923d97b47b918176 upstream.

    blkdev_ioctl(GETBLKSIZE) uses i_size_read() to read size of block device.
    If we update block size directly, reader may see intermediate result in
    some machines and configurations.  Use i_size_write() instead.

    Signed-off-by: Guo Chao <yan@linux.vnet.ibm.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Guo Chao <yan@linux.vnet.ibm.com>
    Cc: M. Hindess <hindessm@uk.ibm.com>
    Cc: Nikanth Karthikesan <knikanth@suse.de>
    Cc: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Acked-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e97d818d630b09895d0f5efd879df08777273f11
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sat Mar 16 06:32:16 2013 -0700

    hwmon: (sht15) Fix memory leak if regulator_enable() fails

    Commit 3e78080f8148 ('hwmon: (sht15) Check return value of
    regulator_enable()') depends on the use of devm_kmalloc() for automatic
    resource cleanup in the failure cases, which was introduced in 3.7.  In
    older stable branches, explicit cleanup is needed.

    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f77ce97ae2bc14cd3a340b3ce91008350fc3fa3f
Author: Dmitry Rogozhkin <dmitry.v.rogozhkin@intel.com>
Date:   Wed Oct 3 17:15:26 2012 +0300

    drm/i915: EBUSY status handling added to i915_gem_fault().

    commit e79e0fe380847493266fba557217e2773c61bd1b upstream.

    Subsequent threads returning EBUSY from vm_insert_pfn() was not handled
    correctly. As a result concurrent access from new threads to
    mmapped data caused SIGBUS.

    Note that this fixes i-g-t/tests/gem_threaded_tiled_access.

    Tested-by: Mika Kuoppala <mika.kuoppala@intel.com>
    Signed-off-by: Dmitry Rogozhkin <dmitry.v.rogozhkin@intel.com>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d039dc5859a079df992b83138e8dec32f5c8fbf0
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Sat Mar 9 15:18:39 2013 +0000

    btrfs: use rcu_barrier() to wait for bdev puts at unmount

    commit bc178622d40d87e75abc131007342429c9b03351 upstream.

    Doing this would reliably fail with -EBUSY for me:

    # mount /dev/sdb2 /mnt/scratch; umount /mnt/scratch; mkfs.btrfs -f /dev/sdb2
    ...
    unable to open /dev/sdb2: Device or resource busy

    because mkfs.btrfs tries to open the device O_EXCL, and somebody still has it.

    Using systemtap to track bdev gets & puts shows a kworker thread doing a
    blkdev put after mkfs attempts a get; this is left over from the unmount
    path:

    btrfs_close_devices
    	__btrfs_close_devices
    		call_rcu(&device->rcu, free_device);
    			free_device
    				INIT_WORK(&device->rcu_work, __free_device);
    				schedule_work(&device->rcu_work);

    so unmount might complete before __free_device fires & does its blkdev_put.

    Adding an rcu_barrier() to btrfs_close_devices() causes unmount to wait
    until all blkdev_put()s are done, and the device is truly free once
    unmount completes.

    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Josef Bacik <jbacik@fusionio.com>
    Signed-off-by: Chris Mason <chris.mason@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2932ef21c24f5f248b869a92c1604e531750df17
Author: Heiko Carstens <heiko.carstens@de.ibm.com>
Date:   Mon Mar 4 14:14:11 2013 +0100

    s390/mm: fix flush_tlb_kernel_range()

    commit f6a70a07079518280022286a1dceb797d12e1edf upstream.

    Our flush_tlb_kernel_range() implementation calls __tlb_flush_mm() with
    &init_mm as argument. __tlb_flush_mm() however will only flush tlbs
    for the passed in mm if its mm_cpumask is not empty.

    For the init_mm however its mm_cpumask has never any bits set. Which in
    turn means that our flush_tlb_kernel_range() implementation doesn't
    work at all.

    This can be easily verified with a vmalloc/vfree loop which allocates
    a page, writes to it and then frees the page again. A crash will follow
    almost instantly.

    To fix this remove the cpumask_empty() check in __tlb_flush_mm() since
    there shouldn't be too many mms with a zero mm_cpumask, besides the
    init_mm of course.

    Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 68e0bbe8b7781877de7dc96d620a4ce6af8807f9
Author: David Rientjes <rientjes@google.com>
Date:   Sun Mar 17 15:49:10 2013 -0700

    perf,x86: fix link failure for non-Intel configs

    commit 6c4d3bc99b3341067775efd4d9d13cc8e655fd7c upstream.

    Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after
    suspend/resume") introduces a link failure since
    perf_restore_debug_store() is only defined for CONFIG_CPU_SUP_INTEL:

    	arch/x86/power/built-in.o: In function `restore_processor_state':
    	(.text+0x45c): undefined reference to `perf_restore_debug_store'

    Fix it by defining the dummy function appropriately.

    Signed-off-by: David Rientjes <rientjes@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe204aa40cedb6c34c5865be223da8f77d6a1545
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Mar 17 15:44:43 2013 -0700

    perf,x86: fix wrmsr_on_cpu() warning on suspend/resume

    commit 2a6e06b2aed6995af401dcd4feb5e79a0c7ea554 upstream.

    Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after
    suspend/resume") fixed a crash when doing PEBS performance profiling
    after resuming, but in using init_debug_store_on_cpu() to restore the
    DS_AREA mtrr it also resulted in a new WARN_ON() triggering.

    init_debug_store_on_cpu() uses "wrmsr_on_cpu()", which in turn uses CPU
    cross-calls to do the MSR update.  Which is not really valid at the
    early resume stage, and the warning is quite reasonable.  Now, it all
    happens to _work_, for the simple reason that smp_call_function_single()
    ends up just doing the call directly on the CPU when the CPU number
    matches, but we really should just do the wrmsr() directly instead.

    This duplicates the wrmsr() logic, but hopefully we can just remove the
    wrmsr_on_cpu() version eventually.

    Reported-and-tested-by: Parag Warudkar <parag.lkml@gmail.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 87a42f27adef5e88b8907edbc168de1380e7129e
Author: Stephane Eranian <eranian@google.com>
Date:   Fri Mar 15 14:26:07 2013 +0100

    perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

    commit 1d9d8639c063caf6efc2447f5f26aa637f844ff6 upstream.

    This patch fixes a kernel crash when using precise sampling (PEBS)
    after a suspend/resume. Turns out the CPU notifier code is not invoked
    on CPU0 (BP). Therefore, the DS_AREA (used by PEBS) is not restored properly
    by the kernel and keeps it power-on/resume value of 0 causing any PEBS
    measurement to crash when running on CPU0.

    The workaround is to add a hook in the actual resume code to restore
    the DS Area MSR value. It is invoked for all CPUS. So for all but CPU0,
    the DS_AREA will be restored twice but this is harmless.

    Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Stephane Eranian <eranian@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Shuah Khan <shuah.khan@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e44eef46e81bf6e159b44fa893cf7dd47a88f53
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sat Mar 16 12:48:11 2013 +0300

    selinux: use GFP_ATOMIC under spin_lock

    commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream.

    The call tree here is:

    sk_clone_lock()              <- takes bh_lock_sock(newsk);
    xfrm_sk_clone_policy()
    __xfrm_sk_clone_policy()
    clone_policy()               <- uses GFP_ATOMIC for allocations
    security_xfrm_policy_clone()
    security_ops->xfrm_policy_clone_security()
    selinux_xfrm_policy_clone()

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: James Morris <james.l.morris@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99c817e4571710eca014345ac44c5ba41e77a853
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Wed Mar 13 09:55:02 2013 +1100

    powerpc: Fix cputable entry for 970MP rev 1.0

    commit d63ac5f6cf31c8a83170a9509b350c1489a7262b upstream.

    Commit 44ae3ab3358e962039c36ad4ae461ae9fb29596c forgot to update
    the entry for the 970MP rev 1.0 processor when moving some CPU
    features bits to the MMU feature bit mask. This breaks booting
    on some rare G5 models using that chip revision.

    Reported-by: Phileas Fogg <phileas-fogg@mail.ru>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 47c89922d3af8dc01ad77e34a61e5ceae2d7a11c
Author: Marcin Jurkowski <marcin1j@gmail.com>
Date:   Sat Mar 2 14:50:15 2013 +0100

    w1: fix oops when w1_search is called from netlink connector

    commit 9d1817cab2f030f6af360e961cc69bb1da8ad765 upstream.

    On Sat, Mar 02, 2013 at 10:45:10AM +0100, Sven Geggus wrote:
    > This is the bad commit I found doing git bisect:
    > 04f482faf50535229a5a5c8d629cf963899f857c is the first bad commit
    > commit 04f482faf50535229a5a5c8d629cf963899f857c
    > Author: Patrick McHardy <kaber@trash.net>
    > Date:   Mon Mar 28 08:39:36 2011 +0000

    Good job. I was too lazy to bisect for bad commit;)

    Reading the code I found problematic kthread_should_stop call from netlink
    connector which causes the oops. After applying a patch, I've been testing
    owfs+w1 setup for nearly two days and it seems to work very reliable (no
    hangs, no memleaks etc).
    More detailed description and possible fix is given below:

    Function w1_search can be called from either kthread or netlink callback.
    While the former works fine, the latter causes oops due to kthread_should_stop
    invocation.

    This patch adds a check if w1_search is serving netlink command, skipping
    kthread_should_stop invocation if so.

    Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
    Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
    Cc: Josh Boyer <jwboyer@gmail.com>
    Tested-by: Sven Geggus <lists@fuchsschwanzdomain.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b25a5de428a92dfef306a28f6bf6b2beac2b0074
Author: Axel Lin <axel.lin@ingics.com>
Date:   Thu Mar 14 16:27:18 2013 +0800

    hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes

    commit df069079c153d22adf6c28dcc0b1cf62bba75167 upstream.

    Signed-off-by: Axel Lin <axel.lin@ingics.com>
    Acked-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d0956066d316f0026aaa058cdfec5bb159da0c55
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Mar 8 18:11:17 2013 +0100

    ALSA: seq: Fix missing error handling in snd_seq_timer_open()

    commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream.

    snd_seq_timer_open() didn't catch the whole error path but let through
    if the timer id is a slave.  This may lead to Oops by accessing the
    uninitialized pointer.

     BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae
     IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
     PGD 785cd067 PUD 76964067 PMD 0
     Oops: 0002 [#4] SMP
     CPU 0
     Pid: 4288, comm: trinity-child7 Tainted: G      D W 3.9.0-rc1+ #100 Bochs Bochs
     RIP: 0010:[<ffffffff819b3477>]  [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
     RSP: 0018:ffff88006ece7d38  EFLAGS: 00010246
     RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000
     RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38
     RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe
     R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
     R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007
     FS:  00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
     Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290)
     Stack:
      0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d
      65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000
      ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520
     Call Trace:
      [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
      [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70
      [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120
      [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0
      [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20
      [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570
      [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0
      [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
      [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0
      [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
      [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b

    Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4fa9b6e8af83048513049faba0bfaf6b1bf0d1ed
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Mar 14 15:13:02 2013 -0700

    Revert duplicated perf commit.

    This reverts commit 2431496fbdd142ccc83138d94f3f510a36ce9270 as it was
    applied incorrectly twice.

    Thanks to Jiri for pointing this out.

    Cc: Jiri Slaby <jslaby@suse.cz>
    Cc: Andrew Vagin <avagin@openvz.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f18f43cb20c3236df02472f84f5183e01c457507
Author: Sebastian Riemer <sebastian.riemer@profitbricks.com>
Date:   Thu Feb 21 13:28:09 2013 +1100

    md: protect against crash upon fsync on ro array

    commit bbfa57c0f2243a7c31fd248d22e9861a2802cad5 upstream.

    If an fsync occurs on a read-only array, we need to send a
    completion for the IO and may not increment the active IO count.
    Otherwise, we hit a bug trace and can't stop the MD array anymore.

    By advice of Christoph Hellwig we return success upon a flush
    request but we return -EROFS for other writes.
    We detect flush requests by checking if the bio has zero sectors.

    Signed-off-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Cc: NeilBrown <neilb@suse.de>
    Reported-by: Ben Hutchings <ben@decadent.org.uk>
    Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1fc6d3ad342542afb92cca52bc5d8569f29576e0
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Tue Jan 15 23:26:22 2013 +0100

    TTY: do not reset master's packet mode

    commit b81273a132177edd806476b953f6afeb17b786d5 upstream.

    Now that login from util-linux is forced to drop all references to a
    TTY which it wants to hangup (to reach reference count 1) we are
    seeing issues with telnet. When login closes its last reference to the
    slave PTY, it also resets packet mode on the *master* side. And we
    have a race here.

    What telnet does is fork+exec of `login'. Then there are two
    scenarios:
    * `login' closes the slave TTY and resets thus master's packet mode,
      but even now telnet properly sets the mode, or
    * `telnetd' sets packet mode on the master, `login' closes the slave
      TTY and resets master's packet mode.

    The former case is OK. However the latter happens in much more cases,
    by the order of magnitude to be precise. So when one tries to login to
    such a messed telnet setup, they see the following:
    inux login:
                ogin incorrect

    Note the missing first letters -- telnet thinks it is still in the
    packet mode, so when it receives "linux login" from `login', it
    considers "l" as the type of the packet and strips it.

    SuS does not mention how the implementation should behave. Both BSDs I
    checked (Free and Net) do not reset the flag upon the last close.

    By this I am resurrecting an old bug, see References. We are hitting
    it regularly now, i.e. with updated util-linux, ergo login.

    Here, I am changing a behavior introduced back in 2.1 times. It would
    better have a long time testing before goes upstream.

    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
    Cc: Bryan Mason <bmason@redhat.com>
    References: https://lkml.org/lkml/2009/11/11/223
    References: https://bugzilla.redhat.com/show_bug.cgi?id=504703
    References: https://bugzilla.novell.com/show_bug.cgi?id=797042
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e88da4a932b6f524afdf26dadb8a63f0afcfcd14
Author: Paul Bolle <pebolle@tiscali.nl>
Date:   Sat Mar 9 23:16:44 2013 +0100

    tty: serial: fix typo "ARCH_S5P6450"

    commit 827aa0d36d486f359808c8fb931cf7a71011a09d upstream.

    This could have been either ARCH_S5P64X0 or CPU_S5P6450. Looking at
    commit 2555e663b367b8d555e76023f4de3f6338c28d6c ("ARM: S5P64X0: Add UART
    serial support for S5P6450") - which added this typo - makes clear this
    should be CPU_S5P6450.

    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Acked-by: Kukjin Kim <kgene.kim@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64365ddb08f27f2583f2323a147520fed192ef40
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Sat Mar 9 15:28:44 2013 +0100

    ext3: Fix format string issues

    commit 8d0c2d10dd72c5292eda7a06231056a4c972e4cc upstream.

    ext3_msg() takes the printk prefix as the second parameter and the
    format string as the third parameter. Two callers of ext3_msg omit the
    prefix and pass the format string as the second parameter and the first
    parameter to the format string as the third parameter. In both cases
    this string comes from an arbitrary source. Which means the string may
    contain format string characters, which will
    lead to undefined and potentially harmful behavior.

    The issue was introduced in commit 4cf46b67eb("ext3: Unify log messages
    in ext3") and is fixed by this patch.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42cd41128edb092f9ae6fe89dbb5456963568602
Author: Kees Cook <keescook@chromium.org>
Date:   Wed Mar 13 14:59:33 2013 -0700

    signal: always clear sa_restorer on execve

    commit 2ca39528c01a933f6689cd6505ce65bd6d68a530 upstream.

    When the new signal handlers are set up, the location of sa_restorer is
    not cleared, leaking a parent process's address space location to
    children.  This allows for a potential bypass of the parent's ASLR by
    examining the sa_restorer value returned when calling sigaction().

    Based on what should be considered "secret" about addresses, it only
    matters across the exec not the fork (since the VMAs haven't changed
    until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
    this is where it should be fixed.

    Given the few uses of sa_restorer, a "set" function was not written
    since this would be the only use.  Instead, we use
    __ARCH_HAS_SA_RESTORER, as already done in other places.

    Example of the leak before applying this patch:

      $ cat /proc/$$/maps
      ...
      7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
      ...
      $ ./leak
      ...
      7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
      ...
      1 0 (nil) 0x7fb9f30b94a0
      2 4000000 (nil) 0x7f278bcaa4a0
      3 4000000 (nil) 0x7f278bcaa4a0
      4 0 (nil) 0x7fb9f30b94a0
      ...

    [akpm@linux-foundation.org: use SA_RESTORER for backportability]
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reported-by: Emese Revfy <re.emese@gmail.com>
    Cc: Emese Revfy <re.emese@gmail.com>
    Cc: PaX Team <pageexec@freemail.hu>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: Serge Hallyn <serge.hallyn@canonical.com>
    Cc: Julien Tinnes <jln@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e41eeb8a041667163b0d9efd6d30c01440179c9a
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Mon Feb 18 19:54:18 2013 +0000

    staging: vt6656: Fix oops on resume from suspend.

    commit 6987a6dabfc40222ef767f67b57212fe3a0225fb upstream.

    Remove usb_put_dev from vt6656_suspend and usb_get_dev
    from vt6566_resume.

    These are not normally in suspend/resume functions.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4fba7d11ee0b6dd35635c0654d424c74325a6133
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Fri Mar 1 10:51:15 2013 -0500

    USB: EHCI: don't check DMA values in QH overlays

    commit feca7746d5d9e84b105a613b7f3b6ad00d327372 upstream.

    This patch (as1661) fixes a rather obscure bug in ehci-hcd.  In a
    couple of places, the driver compares the DMA address stored in a QH's
    overlay region with the address of a particular qTD, in order to see
    whether that qTD is the one currently being processed by the hardware.
    (If it is then the status in the QH's overlay region is more
    up-to-date than the status in the qTD, and if it isn't then the
    overlay's value needs to be adjusted when the QH is added back to the
    active schedule.)

    However, DMA address in the overlay region isn't always valid.  It
    sometimes will contain a stale value, which may happen by coincidence
    to be equal to a qTD's DMA address.  Instead of checking the DMA
    address, we should check whether the overlay region is active and
    valid.  The patch tests the ACTIVE bit in the overlay, and clears this
    bit when the overlay becomes invalid (which happens when the
    currently-executing URB is unlinked).

    This is the second part of a fix for the regression reported at:

    	https://bugs.launchpad.net/bugs/1088733

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Joseph Salisbury <joseph.salisbury@canonical.com>
    Reported-and-tested-by: Stephen Thirlwall <sdt@dr.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 581964efbe9480abd67e53a35bab14a9d8232116
Author: Bjørn Mork <bjorn@mork.no>
Date:   Mon Mar 4 14:19:21 2013 +0100

    USB: storage: fix Huawei mode switching regression

    commit ab4b71644a26d1ab92b987b2fd30e17c25e89f85 upstream.

    This reverts commit 200e0d99 ("USB: storage: optimize to match the
    Huawei USB storage devices and support new switch command" and the
    followup bugfix commit cd060956 ("USB: storage: properly handle
    the endian issues of idProduct").

    The commit effectively added a large number of Huawei devices to
    the deprecated usb-storage mode switching logic.  Many of these
    devices have been in use and supported by the userspace
    usb_modeswitch utility for years.  Forcing the switching inside
    the kernel causes a number of regressions as a result of ignoring
    existing onfigurations, and also completely takes away the ability
    to configure mode switching per device/system/user.

    Known regressions caused by this:
     - Some of the devices support multiple modes, using different
      switching commands.  There are existing configurations taking
      advantage of this.

     - There is a real use case for disabling mode switching and
      instead mounting the exposed storage device. This becomes
      impossible with switching logic inside the usb-storage driver.

     - At least on device fail as a result of the usb-storage switching
      command, becoming completely unswitchable. This is possibly a
      firmware bug, but still a regression because the device work as
      expected using usb_modeswitch defaults.

    In-kernel mode switching was deprecated years ago with the
    development of the more user friendly userspace alternatives. The
    existing list of devices in usb-storage was only kept to prevent
    breaking already working systems.  The long term plan is to remove
    the list, not to add to it. Ref:
    http://permalink.gmane.org/gmane.linux.usb.general/28543

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Cc: <fangxiaozhi@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 47003abe681e978405932244d5a23acf90c78387
Author: Steve Conklin <sconklin@canonical.com>
Date:   Thu Mar 7 17:19:33 2013 -0600

    usb: serial: Add Rigblaster Advantage to device table

    commit a57e82a18779ab8a5e5a1f5841cef937cf578913 upstream.

    The Rigblaster Advantage is an amateur radio interface sold by West Mountain
    Radio. It contains a cp210x serial interface but the device ID is not in
    the driver.

    Signed-off-by: Steve Conklin <sconklin@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2ea887d1d3b43aa0d4800a5e2dedbe5f5b456c3
Author: Christian Schmiedl <christian.schmiedl@gemalto.com>
Date:   Wed Mar 6 17:08:50 2013 +0100

    USB: added support for Cinterion's products AH6 and PLS8

    commit 1941138e1c024ecb5bd797d414928d3eb94d8662 upstream.

    add support for Cinterion's products AH6 and PLS8 by adding Product IDs
    and USB_DEVICE tuples.

    Signed-off-by: Christian Schmiedl <christian.schmiedl@gemalto.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b709ddda5b44574d14607931537eca459dbcb21
Author: Matwey V. Kornilov <matwey@sai.msu.ru>
Date:   Sat Mar 9 13:57:32 2013 +0400

    usb: cp210x new Vendor/Device IDs

    commit be3101c23394af59694c8a2aae6d07f5da62fea5 upstream.

    This patch adds support for the Lake Shore Cryotronics devices to
    the CP210x driver.

    These lines are ported from cp210x driver distributed by Lake Shore web site:
       http://www.lakeshore.com/Documents/Lake%20Shore%20cp210x-3.0.0.tar.gz
    and licensed under the terms of GPLv2.

    Moreover, I've tested this changes with Lake Shore 335 in my labs.

    Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0863b3aeabd52847c62bbf806cccb3041808ad8
Author: Oliver Neukum <oneukum@suse.de>
Date:   Tue Mar 12 14:52:42 2013 +0100

    USB: cdc-wdm: fix buffer overflow

    commit c0f5ecee4e741667b2493c742b60b6218d40b3aa upstream.

    The buffer for responses must not overflow.
    If this would happen, set a flag, drop the data and return
    an error after user space has read all remaining data.

    Signed-off-by: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 77dd40c77a5eb5db824efa37ba78e9146bc6d7d9
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Feb 27 15:52:56 2013 +0100

    USB: option: add Huawei E5331

    commit daec90e7382cbd0e73eb6861109b3da91e5ab1f3 upstream.

    Another device using CDC ACM with vendor specific protocol to mark
    serial functions.

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 22220e7c212f7f64d76077c0601139cf0c56255c
Author: Amit Shah <amit.shah@redhat.com>
Date:   Fri Mar 8 11:30:18 2013 +1100

    virtio: rng: disallow multiple device registrations, fixes crashes

    commit e84e7a56a3aa2963db506299e29a5f3f09377f9b upstream.

    The code currently only supports one virtio-rng device at a time.
    Invoking guests with multiple devices causes the guest to blow up.

    Check if we've already registered and initialised the driver.  Also
    cleanup in case of registration errors or hot-unplug so that a new
    device can be used.

    Reported-by: Peter Krempa <pkrempa@redhat.com>
    Reported-by: <yunzheng@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74bb0c4e0d2644b9b070d92e675e6c2d04e5875b
Author: Dan Williams <dcbw@redhat.com>
Date:   Tue Feb 19 09:47:09 2013 -0600

    qcaux: add Franklin U600

    commit 2d90e63603ac235aecd7d20e234616e0682c8b1f upstream.

    4 ports; AT/PPP is standard CDC-ACM.  The other three (added by this
    patch) are QCDM/DIAG, possibly GPS, and unknown.

    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>