Linux 3.0.62

commit e1c63f9f42393f7c1dc072db7e0d54e599e96b46
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Feb 3 18:22:00 2013 -0600

    Linux 3.0.62

commit d997f40c116cdb098e09f0a140501ffc42b5184e
Author: H. Peter Anvin <hpa@linux.intel.com>
Date:   Sun Jan 13 20:56:41 2013 -0800

    x86/Sandy Bridge: Sandy Bridge workaround depends on CONFIG_PCI

    commit e43b3cec711a61edf047adf6204d542f3a659ef8 upstream.

    early_pci_allowed() and read_pci_config_16() are only available if
    CONFIG_PCI is defined.

    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Abdallah Chatila <abdallah.chatila@ericsson.com>

commit 591f90ee64224287f360205f6ec14057b88a7701
Author: Nathan Zimmer <nzimmer@sgi.com>
Date:   Tue Jan 8 09:02:43 2013 -0600

    efi, x86: Pass a proper identity mapping in efi_call_phys_prelog

    commit b8f2c21db390273c3eaf0e5308faeaeb1e233840 upstream.

    Update efi_call_phys_prelog to install an identity mapping of all available
    memory.  This corrects a bug on very large systems with more then 512 GB in
    which bios would not be able to access addresses above not in the mapping.

    The result is a crash that looks much like this.

    BUG: unable to handle kernel paging request at 000000effd870020
    IP: [<0000000078bce331>] 0x78bce330
    PGD 0
    Oops: 0000 [#1] SMP
    Modules linked in:
    CPU 0
    Pid: 0, comm: swapper/0 Tainted: G        W    3.8.0-rc1-next-20121224-medusa_ntz+ #2 Intel Corp. Stoutland Platform
    RIP: 0010:[<0000000078bce331>]  [<0000000078bce331>] 0x78bce330
    RSP: 0000:ffffffff81601d28  EFLAGS: 00010006
    RAX: 0000000078b80e18 RBX: 0000000000000004 RCX: 0000000000000004
    RDX: 0000000078bcf958 RSI: 0000000000002400 RDI: 8000000000000000
    RBP: 0000000078bcf760 R08: 000000effd870000 R09: 0000000000000000
    R10: 0000000000000000 R11: 00000000000000c3 R12: 0000000000000030
    R13: 000000effd870000 R14: 0000000000000000 R15: ffff88effd870000
    FS:  0000000000000000(0000) GS:ffff88effe400000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000effd870020 CR3: 000000000160c000 CR4: 00000000000006b0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process swapper/0 (pid: 0, threadinfo ffffffff81600000, task ffffffff81614400)
    Stack:
     0000000078b80d18 0000000000000004 0000000078bced7b ffff880078b81fff
     0000000000000000 0000000000000082 0000000078bce3a8 0000000000002400
     0000000060000202 0000000078b80da0 0000000078bce45d ffffffff8107cb5a
    Call Trace:
     [<ffffffff8107cb5a>] ? on_each_cpu+0x77/0x83
     [<ffffffff8102f4eb>] ? change_page_attr_set_clr+0x32f/0x3ed
     [<ffffffff81035946>] ? efi_call4+0x46/0x80
     [<ffffffff816c5abb>] ? efi_enter_virtual_mode+0x1f5/0x305
     [<ffffffff816aeb24>] ? start_kernel+0x34a/0x3d2
     [<ffffffff816ae5ed>] ? repair_env_string+0x60/0x60
     [<ffffffff816ae2be>] ? x86_64_start_reservations+0xba/0xc1
     [<ffffffff816ae120>] ? early_idt_handlers+0x120/0x120
     [<ffffffff816ae419>] ? x86_64_start_kernel+0x154/0x163
    Code:  Bad RIP value.
    RIP  [<0000000078bce331>] 0x78bce330
     RSP <ffffffff81601d28>
    CR2: 000000effd870020
    ---[ end trace ead828934fef5eab ]---

    Signed-off-by: Nathan Zimmer <nzimmer@sgi.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Signed-off-by: Robin Holt <holt@sgi.com>
    Signed-off-by: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7497ef2e2dac54e354a65929258fd330c29db216
Author: Alan Cox <alan@linux.intel.com>
Date:   Thu Nov 15 13:06:22 2012 +0000

    x86/msr: Add capabilities check

    commit c903f0456bc69176912dee6dd25c6a66ee1aed00 upstream.

    At the moment the MSR driver only relies upon file system
    checks. This means that anything as root with any capability set
    can write to MSRs. Historically that wasn't very interesting but
    on modern processors the MSRs are such that writing to them
    provides several ways to execute arbitary code in kernel space.
    Sample code and documentation on doing this is circulating and
    MSR attacks are used on Windows 64bit rootkits already.

    In the Linux case you still need to be able to open the device
    file so the impact is fairly limited and reduces the security of
    some capability and security model based systems down towards
    that of a generic "root owns the box" setup.

    Therefore they should require CAP_SYS_RAWIO to prevent an
    elevation of capabilities. The impact of this is fairly minimal
    on most setups because they don't have heavy use of
    capabilities. Those using SELinux, SMACK or AppArmor rules might
    want to consider if their rulesets on the MSR driver could be
    tighter.

    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d915fe310d9edbc349c36d0cef1b5dd0da6b067c
Author: Wang YanQing <udknight@gmail.com>
Date:   Sat Jan 26 15:53:57 2013 +0800

    smp: Fix SMP function call empty cpu mask race

    commit f44310b98ddb7f0d06550d73ed67df5865e3eda5 upstream.

    I get the following warning every day with v3.7, once or
    twice a day:

      [ 2235.186027] WARNING: at /mnt/sda7/kernel/linux/arch/x86/kernel/apic/ipi.c:109 default_send_IPI_mask_logical+0x2f/0xb8()

    As explained by Linus as well:

     |
     | Once we've done the "list_add_rcu()" to add it to the
     | queue, we can have (another) IPI to the target CPU that can
     | now see it and clear the mask.
     |
     | So by the time we get to actually send the IPI, the mask might
     | have been cleared by another IPI.
     |

    This patch also fixes a system hang problem, if the data->cpumask
    gets cleared after passing this point:

            if (WARN_ONCE(!mask, "empty IPI mask"))
                    return;

    then the problem in commit 83d349f35e1a ("x86: don't send an IPI to
    the empty set of CPU's") will happen again.

    Signed-off-by: Wang YanQing <udknight@gmail.com>
    Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: peterz@infradead.org
    Cc: mina86@mina86.org
    Cc: srivatsa.bhat@linux.vnet.ibm.com
    Link: http://lkml.kernel.org/r/20130126075357.GA3205@udknight
    [ Tidied up the changelog and the comment in the code. ]
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 95675e4004fde70caaf119a9cb7ff489f3f0a069
Author: Anderson Lizardo <anderson.lizardo@openbossa.org>
Date:   Sun Jan 6 18:28:53 2013 -0400

    Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()

    commit 0a9ab9bdb3e891762553f667066190c1d22ad62b upstream.

    The length parameter should be sizeof(req->name) - 1 because there is no
    guarantee that string provided by userspace will contain the trailing
    '\0'.

    Can be easily reproduced by manually setting req->name to 128 non-zero
    bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on
    input subsystem:

    $ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name
    AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af

    ("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys"
    field in struct hid_device due to overflow.)

    Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 207d5e19d98446129ede65c05e4b732cc8c58262
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sat Jan 26 10:49:24 2013 +0300

    EDAC: Test correct variable in ->store function

    commit 8024c4c0b1057d1cd811fc9c3f88f81de9729fcd upstream.

    We're testing for ->show but calling ->store().

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a043100f2831bc56a1df2e536ed3079977677348
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Thu Nov 29 17:04:23 2012 +0100

    ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices

    commit d56268fb108c7c21e19933588ca4d94652585183 upstream.

    Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0)
    forgot to adjust the length check for UAC 2.0 feature unit descriptors.
    This would make the code abort on encountering a feature unit without
    per-channel controls, and thus prevented the driver to work with any
    device having such a unit, such as the RME Babyface or Fireface UCX.

    Reported-by: Florian Hanisch <fhanisch@uni-potsdam.de>
    Tested-by: Matthew Robbetts <wingfeathera@gmail.com>
    Tested-by: Michael Beer <beerml@sigma6audio.de>
    Cc: Daniel Mack <daniel@caiaq.de>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bed37001b6919a386dab95dc42084d755233ea60
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Wed Jan 9 16:16:53 2013 +0100

    ath9k: fix double-free bug on beacon generate failure

    commit 1adb2e2b5f85023d17eb4f95386a57029df27c88 upstream.

    When the next beacon is sent, the ath_buf from the previous run is reused.
    If getting a new beacon from mac80211 fails, bf->bf_mpdu is not reset, yet
    the skb is freed, leading to a double-free on the next beacon tx attempt,
    resulting in a system crash.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2e1c3918e77ad6a13b43cb04e3cfe19f55d8cd0
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Wed Jan 9 16:07:48 2013 +0530

    ath9k_htc: Fix memory leak

    commit 0981c3b24ef664f5611008a6e6d0622fac6d892b upstream.

    SKBs that are allocated in the HTC layer do not have callbacks
    registered and hence ended up not being freed, Fix this by freeing
    them properly in the TX completion routine.

    Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit afd2d0e726252844755e85262cdd00ab31fc29ec
Author: Szymon Janc <szymon.janc@tieto.com>
Date:   Tue Dec 11 08:51:19 2012 +0100

    Bluetooth: Fix sending HCI commands after reset

    commit dbccd791a3fbbdac12c33834b73beff3984988e9 upstream.

    After sending reset command wait for its command complete event before
    sending next command. Some chips sends CC event for command received
    before reset if reset was send before chip replied with CC.

    This is also required by specification that host shall not send
    additional HCI commands before receiving CC for reset.

    < HCI Command: Reset (0x03|0x0003) plen 0                              [hci0] 18.404612
    > HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.405850
          Write Extended Inquiry Response (0x03|0x0052) ncmd 1
            Status: Success (0x00)
    < HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.406079
    > HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.407864
          Reset (0x03|0x0003) ncmd 1
            Status: Success (0x00)
    < HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.408062
    > HCI Event: Command Complete (0x0e) plen 12                           [hci0] 18.408835

    Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
    Acked-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7948bfddbe1bbfe7d25b6a269d1c1d264cf52768
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Sat Jan 19 11:05:57 2013 +0000

    ARM: DMA: Fix struct page iterator in dma_cache_maint() to work with sparsemem

    commit 15653371c67c3fbe359ae37b720639dd4c7b42c5 upstream.

    Subhash Jadavani reported this partial backtrace:
      Now consider this call stack from MMC block driver (this is on the ARMv7
      based board):

      [<c001b50c>] (v7_dma_inv_range+0x30/0x48) from [<c0017b8c>] (dma_cache_maint_page+0x1c4/0x24c)
      [<c0017b8c>] (dma_cache_maint_page+0x1c4/0x24c) from [<c0017c28>] (___dma_page_cpu_to_dev+0x14/0x1c)
      [<c0017c28>] (___dma_page_cpu_to_dev+0x14/0x1c) from [<c0017ff8>] (dma_map_sg+0x3c/0x114)

    This is caused by incrementing the struct page pointer, and running off
    the end of the sparsemem page array.  Fix this by incrementing by pfn
    instead, and convert the pfn to a struct page.

    Suggested-by: James Bottomley <JBottomley@Parallels.com>
    Tested-by: Subhash Jadavani <subhashj@codeaurora.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 833a2e184ad1464cda69d569788e1faa37191f37
Author: Cong Ding <dinggnu@gmail.com>
Date:   Tue Jan 22 19:20:58 2013 -0500

    fs/cifs/cifs_dfs_ref.c: fix potential memory leakage

    commit 10b8c7dff5d3633b69e77f57d404dab54ead3787 upstream.

    When it goes to error through line 144, the memory allocated to *devname is
    not freed, and the caller doesn't free it either in line 250. So we free the
    memroy of *devname in function cifs_compose_mount_options() when it goes to
    error.

    Signed-off-by: Cong Ding <dinggnu@gmail.com>
    Reviewed-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bb40f9f8a41f8c8c793c375f5f3613d99990b705
Author: Olivier Sobrie <olivier@sobrie.be>
Date:   Fri Jan 18 09:32:41 2013 +0100

    can: pch_can: fix invalid error codes

    commit ee50e135aeb048b90fab662e661c58b67341830b upstream.

    Errors in CAN protocol (location) are reported in data[3] of the can
    frame instead of data[2].

    Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 831362319d56e37311b0893ad2dcc4c8f970cbde
Author: Olivier Sobrie <olivier@sobrie.be>
Date:   Fri Jan 18 09:32:40 2013 +0100

    can: ti_hecc: fix invalid error codes

    commit 71088c4bd9b8f8cbffb0e66f2abc14297e4b2ca8 upstream.

    Errors in CAN protocol (location) are reported in data[3] of the can
    frame instead of data[2].

    Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
    Cc: Anant Gole <anantgole@ti.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 331f275adb3f494f15e610cf7c3abf324d573d81
Author: Olivier Sobrie <olivier@sobrie.be>
Date:   Fri Jan 18 09:32:39 2013 +0100

    can: c_can: fix invalid error codes

    commit 6ea45886865c1abb01bb861f7f6bdd5d0f398cb3 upstream.

    Errors in CAN protocol (location) are reported in data[3] of the can
    frame instead of data[2].

    Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
    Cc: Bhupesh Sharma <bhupesh.sharma@st.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>