Linux 3.0.60

commit d4184347012fbe705671037a4a0e4c7021ea4329
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Jan 21 11:48:40 2013 -0800

    Linux 3.0.60

commit 42e29fded95cbb72b4fb42fb0b36c5b355ce3dad
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Mon Jan 14 01:29:17 2013 +0000

    staging: vt6656: Fix inconsistent structure packing

    commit 1ee4c55fc9620451b2a825d793042a7e0775391b upstream.

    vt6656 has several headers that use the #pragma pack(1) directive to
    enable structure packing, but never disable it.  The layout of
    structures defined in other headers can then depend on which order the
    various headers are included in, breaking the One Definition Rule.

    In practice this resulted in crashes on x86_64 until the order of header
    inclusion was changed for some files in commit 11d404cb56ecd ('staging:
    vt6656: fix headers and add cfg80211.').  But we need a proper fix that
    won't be affected by future changes to the order of inclusion.

    This removes the #pragma pack(1) directives and adds __packed to the
    structure definitions for which packing appears to have been intended.

    Reported-and-tested-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 904e718cc7b18ea8db425d51e9601fb21699892e
Author: chao bi <chao.bi@intel.com>
Date:   Wed Dec 12 11:40:56 2012 +0800

    serial:ifx6x60:Delete SPI timer when shut down port

    commit 014b9b4ce84281ccb3d723c792bed19815f3571a upstream.

    When shut down SPI port, it's possible that MRDY has been asserted and a SPI
    timer was activated waiting for SRDY assert, in the case, it needs to delete
    this timer.

    Signed-off-by: Chen Jun <jun.d.chen@intel.com>
    Signed-off-by: channing <chao.bi@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f21c75c02cfdc2518e8c07d5bbed2fd815bfd457
Author: Bjørn Mork <bjorn@mork.no>
Date:   Thu Jan 17 15:14:22 2013 +0100

    USB: option: blacklist network interface on ONDA MT8205 4G LTE

    Signed-off-by: Bjørn Mork <bjorn@mork.no>

    commit 2291dff02e5f8c708a46a7c4c888f2c467e26642 upstream.

    The driver description files gives these names to the vendor specific
    functions on this modem:

     Diag   VID_19D2&PID_0265&MI_00
     NMEA   VID_19D2&PID_0265&MI_01
     AT cmd VID_19D2&PID_0265&MI_02
     Modem  VID_19D2&PID_0265&MI_03
     Net    VID_19D2&PID_0265&MI_04

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da1213a9153967f434ececb1747fd545918c31d1
Author: Bjørn Mork <bjorn@mork.no>
Date:   Tue Jan 15 10:29:49 2013 +0100

    USB: option: add TP-LINK HSUPA Modem MA180

    commit 99beb2e9687ffd61c92a9875141eabe6f57a71b9 upstream.

    The driver description files gives these names to the vendor specific
    functions on this modem:

     Diagnostics VID_2357&PID_0201&MI_00
     NMEA        VID_2357&PID_0201&MI_01
     Modem       VID_2357&PID_0201&MI_03
     Networkcard VID_2357&PID_0201&MI_04

    Reported-by: Thomas Schäfer <tschaefer@t-online.de>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5b0529675bcd9d7d3304d1f61fd1e14d6760c0b
Author: Frediano Ziglio <frediano.ziglio@citrix.com>
Date:   Wed Jan 16 12:00:55 2013 +0000

    xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.

    commit 9174adbee4a9a49d0139f5d71969852b36720809 upstream.

    This fixes CVE-2013-0190 / XSA-40

    There has been an error on the xen_failsafe_callback path for failed
    iret, which causes the stack pointer to be wrong when entering the
    iret_exc error path.  This can result in the kernel crashing.

    In the classic kernel case, the relevant code looked a little like:

            popl %eax      # Error code from hypervisor
            jz 5f
            addl $16,%esp
            jmp iret_exc   # Hypervisor said iret fault
    5:      addl $16,%esp
                           # Hypervisor said segment selector fault

    Here, there are two identical addls on either option of a branch which
    appears to have been optimised by hoisting it above the jz, and
    converting it to an lea, which leaves the flags register unaffected.

    In the PVOPS case, the code looks like:

            popl_cfi %eax         # Error from the hypervisor
            lea 16(%esp),%esp     # Add $16 before choosing fault path
            CFI_ADJUST_CFA_OFFSET -16
            jz 5f
            addl $16,%esp         # Incorrectly adjust %esp again
            jmp iret_exc

    It is possible unprivileged userspace applications to cause this
    behaviour, for example by loading an LDT code selector, then changing
    the code selector to be not-present.  At this point, there is a race
    condition where it is possible for the hypervisor to return back to
    userspace from an interrupt, fault on its own iret, and inject a
    failsafe_callback into the kernel.

    This bug has been present since the introduction of Xen PVOPS support
    in commit 5ead97c84 (xen: Core Xen implementation), in 2.6.23.

    Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b2167cc50f31531ee7cae375801489d1105d547
Author: Julius Werner <jwerner@chromium.org>
Date:   Thu Nov 1 12:47:59 2012 -0700

    xhci: fix null-pointer dereference when destroying half-built segment rings

    commit 68e5254adb88bede68285f11fb442a4d34fb550c upstream.

    xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
    the tail to head at the end (forming a ring). When it bails out for OOM
    reasons half-way through, it tries to destroy its half-built list with
    xhci_free_segments_for_ring(), even though it is not a ring yet. This
    causes a null-pointer dereference upon hitting the last element.

    Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
    the output parameters to be valid upon this kind of OOM failure, and
    calls xhci_ring_free() on them. Since the (incomplete) list/ring should
    already be destroyed in that case, this would lead to a use after free.

    This patch fixes those issues by having xhci_alloc_segments_for_ring()
    destroy its half-built, non-circular list manually and destroying the
    invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().

    This patch should be backported to kernels as old as 2.6.31, that
    contains the commit 0ebbab37422315a5d0cb29792271085bafdf38c0 "USB: xhci:
    Ring allocation and initialization."

    A separate patch will need to be developed for kernels older than 3.4,
    since the ring allocation code was refactored in that kernel.

    Signed-off-by: Julius Werner <jwerner@chromium.org>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Julius Werner <jwerner@chromium.org>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Since segment allocation is done directly in xhci_ring_alloc(), walk
       the list starting from ring->first_seg when freeing]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ff95abca6fe594a7c9182d96fa4aa37997c4a86
Author: Philipp Reisner <philipp.reisner@linbit.com>
Date:   Thu Feb 23 12:56:26 2012 +0100

    drbd: add missing part_round_stats to _drbd_start_io_acct

    commit 72585d2428fa3a0daab02ebad1f41e5ef517dbaa upstream.

    Without this, iostat frequently sees bogus svctime and >= 100% "utilization".

    Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
    Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
    Cc: Raoul Bhatia <raoul@bhatia.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e16037a0ab5939064c95635f44e0753ecc520516
Author: Tom Mingarelli <thomas.mingarelli@hp.com>
Date:   Tue Nov 20 19:43:17 2012 +0000

    intel-iommu: Prevent devices with RMRRs from being placed into SI Domain

    commit ea2447f700cab264019b52e2b417d689e052dcfd upstream.

    This patch is to prevent non-USB devices that have RMRRs associated with them from
    being placed into the SI Domain during init. This fixes the issue where the RMRR info
    for devices being placed in and out of the SI Domain gets lost.

    Signed-off-by: Thomas Mingarelli <thomas.mingarelli@hp.com>
    Tested-by: Shuah Khan <shuah.khan@hp.com>
    Reviewed-by: Donald Dutile <ddutile@redhat.com>
    Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
    Signed-off-by: Joerg Roedel <joro@8bytes.org>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b436f48a31692bc41b9d049dec23cf55714d70d5
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Wed Nov 7 10:31:30 2012 -0500

    USB: fix endpoint-disabling for failed config changes

    commit 36caff5d795429c572443894e8789c2150dd796b upstream.

    This patch (as1631) fixes a bug that shows up when a config change
    fails for a device under an xHCI controller.  The controller needs to
    be told to disable the endpoints that have been enabled for the new
    config.  The existing code does this, but before storing the
    information about which endpoints were enabled!  As a result, any
    second attempt to install the new config is doomed to fail because
    xhci-hcd will refuse to enable an endpoint that is already enabled.

    The patch optimistically initializes the new endpoints' device
    structures before asking the device to switch to the new config.  If
    the request fails then the endpoint information is already stored, so
    we can use usb_hcd_alloc_bandwidth() to disable the endpoints with no
    trouble.  The rest of the error path is slightly more complex now; we
    have to disable the new interfaces and call put_device() rather than
    simply deallocating them.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-and-tested-by: Matthias Schniedermeyer <ms@citd.de>
    CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: CAI Qian <caiqian@redhat.com>

commit e82efee857da0e3331cb57607e0a4058dafadb4b
Author: Shuah Khan <shuah.khan@hp.com>
Date:   Wed Dec 12 16:27:51 2012 -0700

    powerpc: fix wii_memory_fixups() compile error on 3.0.y tree

    [not upstream as the code involved was removed in the 3.3.0 release]

    Fix wii_memory_fixups() the following compile error on 3.0.y tree with
    wii_defconfig on 3.0.y tree.

      CC      arch/powerpc/platforms/embedded6xx/wii.o
    arch/powerpc/platforms/embedded6xx/wii.c: In function ‘wii_memory_fixups’:
    arch/powerpc/platforms/embedded6xx/wii.c:88:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘phys_addr_t’ [-Werror=format]
    arch/powerpc/platforms/embedded6xx/wii.c:88:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘phys_addr_t’ [-Werror=format]
    arch/powerpc/platforms/embedded6xx/wii.c:90:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘phys_addr_t’ [-Werror=format]
    arch/powerpc/platforms/embedded6xx/wii.c:90:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘phys_addr_t’ [-Werror=format]
    cc1: all warnings being treated as errors
    make[2]: *** [arch/powerpc/platforms/embedded6xx/wii.o] Error 1
    make[1]: *** [arch/powerpc/platforms/embedded6xx] Error 2
    make: *** [arch/powerpc/platforms] Error 2

    Signed-off-by: Shuah Khan <shuah.khan@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 97765f30c49d3023a6dafe7c48c7e520fca441f8
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Wed Nov 14 22:22:05 2012 -0500

    ext4: init pagevec in ext4_da_block_invalidatepages

    commit 66bea92c69477a75a5d37b9bfed5773c92a3c4b4 upstream.

    ext4_da_block_invalidatepages is missing a pagevec_init(),
    which means that pvec->cold contains random garbage.

    This affects whether the page goes to the front or
    back of the LRU when ->cold makes it to
    free_hot_cold_page()

    Reviewed-by: Lukas Czerner <lczerner@redhat.com>
    Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6d8f58e7c32624663e6f41ecd2c94c487fffcb0
Author: Jesse Barnes <jbarnes@virtuousgeek.org>
Date:   Wed Nov 14 20:43:31 2012 +0000

    x86/Sandy Bridge: reserve pages when integrated graphics is present

    commit a9acc5365dbda29f7be2884efb63771dc24bd815 upstream.

    SNB graphics devices have a bug that prevent them from accessing certain
    memory ranges, namely anything below 1M and in the pages listed in the
    table.  So reserve those at boot if set detect a SNB gfx device on the
    CPU to avoid GPU hangs.

    Stephane Marchesin had a similar patch to the page allocator awhile
    back, but rather than reserving pages up front, it leaked them at
    allocation time.

    [ hpa: made a number of stylistic changes, marked arrays as static
      const, and made less verbose; use "memblock=debug" for full
      verbosity. ]

    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 228f49c2da2a6729ecd3af45f882296f9007287e
Author: Heiko Carstens <heiko.carstens@de.ibm.com>
Date:   Mon Jan 14 16:55:55 2013 +0100

    s390/time: fix sched_clock() overflow

    commit ed4f20943cd4c7b55105c04daedf8d63ab6d499c upstream.

    Converting a 64 Bit TOD format value to nanoseconds means that the value
    must be divided by 4.096. In order to achieve that we multiply with 125
    and divide by 512.
    When used within sched_clock() this triggers an overflow after appr.
    417 days. Resulting in a sched_clock() return value that is much smaller
    than previously and therefore may cause all sort of weird things in
    subsystems that rely on a monotonic sched_clock() behaviour.

    To fix this implement a tod_to_ns() helper function which converts TOD
    values without overflow and call this function from both places that
    open coded the conversion: sched_clock() and kvm_s390_handle_wait().

    Reviewed-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5304f42eab6d502a281337ec493b108d863da964
Author: Mark Rustad <mark.d.rustad@intel.com>
Date:   Fri Dec 21 10:58:19 2012 -0800

    tcm_fc: Do not report target role when target is not defined

    commit edec8dfefa1f372b2dd8197da555352e76a10c03 upstream.

    Clear the target role when no target is provided for
    the node performing a PRLI.

    Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
    Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
    Acked by Robert Love <robert.w.love@intel.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed46841dd015efca61c4fec2f1b3edbe1c20f6d4
Author: Mark Rustad <mark.d.rustad@intel.com>
Date:   Fri Dec 21 10:58:14 2012 -0800

    tcm_fc: Do not indicate retry capability to initiators

    commit f2eeba214bcd0215b7f558cab6420e5fd153042b upstream.

    When generating a PRLI response to an initiator, clear the
    FCP_SPPF_RETRY bit in the response.

    Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
    Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
    Acked by Robert Love <robert.w.love@intel.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b738689710e427fcc0f49e940027e20316d098a3
Author: Thomas Schwinge <thomas@codesourcery.com>
Date:   Fri Nov 16 10:46:20 2012 +0100

    sh: Fix FDPIC binary loader

    commit 4a71997a3279a339e7336ea5d0cd27282e2dea44 upstream.

    Ensure that the aux table is properly initialized, even when optional features
    are missing.  Without this, the FDPIC loader did not work.  This was meant to
    be included in commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1.

    Signed-off-by: Thomas Schwinge <thomas@codesourcery.com>
    Signed-off-by: Paul Mundt <lethal@linux-sh.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>