Linux 3.0.98

commit f45b5c1b0301e144f2096dfe2745e93a8cb2b172
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Oct 1 08:55:54 2013 -0700

    Linux 3.0.98

commit bfe3887cc200ec2b63e6137c682602e31bb33fa1
Author: Daniel Santos <daniel.santos@pobox.com>
Date:   Thu Oct 4 17:15:05 2012 -0700

    kernel-doc: bugfix - multi-line macros

    commit 654784284430bf2739985914b65e09c7c35a7273 upstream.

    Prior to this patch the following code breaks:

    /**
     * multiline_example - this breaks kernel-doc
     */
     #define multiline_example( \
    myparam)

    Producing this error:

    Error(somefile.h:983): cannot understand prototype: 'multiline_example( \ '

    This patch fixes the issue by appending all lines ending in a blackslash
    (optionally followed by whitespace), removing the backslash and any
    whitespace after it prior to appending (just like the C pre-processor
    would).

    This fixes a break in kerel-doc introduced by the additions to rbtree.h.

    Signed-off-by: Daniel Santos <daniel.santos@pobox.com>
    Cc: Randy Dunlap <rdunlap@xenotime.net>
    Cc: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f77b78d931314d3e066266c23b44f90807ee5774
Author: Ben Hutchings <bhutchings@solarflare.com>
Date:   Fri Sep 6 22:39:20 2013 +0100

    sfc: Fix efx_rx_buf_offset() for recycled pages

    This bug fix is only for stable branches older than 3.10.  The bug was
    fixed upstream by commit 2768935a4660 ('sfc: reuse pages to avoid DMA
    mapping/unmapping costs'), but that change is totally unsuitable for
    stable.

    Commit b590ace09d51 ('sfc: Fix efx_rx_buf_offset() in the presence of
    swiotlb') added an explicit page_offset member to struct
    efx_rx_buffer, which must be set consistently with the u.page and
    dma_addr fields.  However, it failed to add the necessary assignment
    in efx_resurrect_rx_buffer().  It also did not correct the calculation
    of efx_rx_buffer::dma_addr in efx_resurrect_rx_buffer(), which assumes
    that DMA-mapping a page will result in a page-aligned DMA address
    (exactly what swiotlb violates).

    Add the assignment of efx_rx_buffer::page_offset and change the
    calculation of dma_addr to make use of it.

    Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe826cd4ead9e72cdb0815660a306e267eab34d1
Author: Andi Kleen <ak@linux.intel.com>
Date:   Wed Apr 24 17:03:02 2013 -0700

    perf tools: Handle JITed code in shared memory

    commit 89365e6c9ad4c0e090e4c6a4b67a3ce319381d89 upstream.

    Need to check for /dev/zero.

    Most likely more strings are missing too.

    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Link: http://lkml.kernel.org/r/1366848182-30449-1-git-send-email-andi@firstfloor.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Vinson Lee <vlee@freedesktop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 07d351b5f618e5be5bd97443d25db41eb1bb8244
Author: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Date:   Fri Mar 23 02:42:23 2012 +0100

    fanotify: dont merge permission events

    commit 03a1cec1f17ac1a6041996b3e40f96b5a2f90e1b upstream.

    Boyd Yang reported a problem for the case that multiple threads of the same
    thread group are waiting for a reponse for a permission event.
    In this case it is possible that some of the threads are never woken up, even
    if the response for the event has been received
    (see http://marc.info/?l=linux-kernel&m=131822913806350&w=2).

    The reason is that we are currently merging permission events if they belong to
    the same thread group. But we are not prepared to wake up more than one waiter
    for each event. We do

    wait_event(group->fanotify_data.access_waitq, event->response ||
                atomic_read(&group->fanotify_data.bypass_perm));
    and after that
      event->response = 0;

    which is the reason that even if we woke up all waiters for the same event
    some of them may see event->response being already set 0 again, then go back to
    sleep and block forever.

    With this patch we avoid that more than one thread is waiting for a response
    by not merging permission events for the same thread group any more.

    Reported-by: Boyd Yang <boyd.yang@gmail.com>
    Signed-off-by: Lino Sanfilippo <LinoSanfilipp@gmx.de>
    Signed-off-by: Eric Paris <eparis@redhat.com>
    Cc: Mihai Donțu <mihai.dontu@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0f722a400afccaa0fac2ff010ba337ba428bd78b
Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
Date:   Tue Oct 2 15:41:23 2012 +0200

    perf: Fix perf_cgroup_switch for sw-events

    commit 95cf59ea72331d0093010543b8951bb43f262cac upstream.

    Jiri reported that he could trigger the WARN_ON_ONCE() in
    perf_cgroup_switch() using sw-events. This is because sw-events share
    a cpuctx with multiple PMUs.

    Use the ->unique_pmu pointer to limit the pmu iteration to unique
    cpuctx instances.

    Reported-and-Tested-by: Jiri Olsa <jolsa@redhat.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/n/tip-so7wi2zf3jjzrwcutm2mkz0j@git.kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 38770b82bdd3523d92596a0807d3751bb7d25224
Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
Date:   Tue Oct 2 15:38:52 2012 +0200

    perf: Clarify perf_cpu_context::active_pmu usage by renaming it to ::unique_pmu

    commit 3f1f33206c16c7b3839d71372bc2ac3f305aa802 upstream.

    Stephane thought the perf_cpu_context::active_pmu name confusing and
    suggested using 'unique_pmu' instead.

    This pointer is a pointer to a 'random' pmu sharing the cpuctx
    instance, therefore limiting a for_each_pmu loop to those where
    cpuctx->unique_pmu matches the pmu we get a loop over unique cpuctx
    instances.

    Suggested-by: Stephane Eranian <eranian@google.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/n/tip-kxyjqpfj2fn9gt7kwu5ag9ks@git.kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e129d3e2ecef34372ccf2f2ea0002e0ec72998e8
Author: Li Zefan <lizefan@huawei.com>
Date:   Mon Feb 18 14:13:35 2013 +0800

    cgroup: fail if monitored file and event_control are in different cgroup

    commit f169007b2773f285e098cb84c74aac0154d65ff7 upstream.

    If we pass fd of memory.usage_in_bytes of cgroup A to cgroup.event_control
    of cgroup B, then we won't get memory usage notification from A but B!

    What's worse, if A and B are in different mount hierarchy, we'll end up
    accessing NULL pointer!

    Disallow this kind of invalid usage.

    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Acked-by: Kirill A. Shutemov <kirill@shutemov.name>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3a454fd0a92af12ab465b88a25a7089e65eb8420
Author: Sasha Levin <levinsasha928@gmail.com>
Date:   Wed Jan 25 22:16:16 2012 -0500

    SCSI: iscsi: don't hang in endless loop if no targets present

    commit 46a7c17d26967922092f3a8291815ffb20f6cabe upstream.

    iscsi_if_send_reply() may return -ESRCH if there were no targets to send
    data to. Currently we're ignoring this value and looping in attempt to do it
    over and over, which will usually lead in a hung task like this one:

    [ 4920.817298] INFO: task trinity:9074 blocked for more than 120 seconds.
    [ 4920.818527] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    [ 4920.819982] trinity         D 0000000000000000  5504  9074   2756 0x00000004
    [ 4920.825374]  ffff880003961a98 0000000000000086 ffff8800001aa000 ffff8800001aa000
    [ 4920.826791]  00000000001d4340 ffff880003961fd8 ffff880003960000 00000000001d4340
    [ 4920.828241]  00000000001d4340 00000000001d4340 ffff880003961fd8 00000000001d4340
    [ 4920.833231]
    [ 4920.833519] Call Trace:
    [ 4920.834010]  [<ffffffff826363fa>] schedule+0x3a/0x50
    [ 4920.834953]  [<ffffffff82634ac9>] __mutex_lock_common+0x209/0x5b0
    [ 4920.836226]  [<ffffffff81af805d>] ? iscsi_if_rx+0x2d/0x990
    [ 4920.837281]  [<ffffffff81053943>] ? sched_clock+0x13/0x20
    [ 4920.838305]  [<ffffffff81af805d>] ? iscsi_if_rx+0x2d/0x990
    [ 4920.839336]  [<ffffffff82634eb0>] mutex_lock_nested+0x40/0x50
    [ 4920.840423]  [<ffffffff81af805d>] iscsi_if_rx+0x2d/0x990
    [ 4920.841434]  [<ffffffff810dffed>] ? sub_preempt_count+0x9d/0xd0
    [ 4920.842548]  [<ffffffff82637bb0>] ? _raw_read_unlock+0x30/0x60
    [ 4920.843666]  [<ffffffff821f71de>] netlink_unicast+0x1ae/0x1f0
    [ 4920.844751]  [<ffffffff821f7997>] netlink_sendmsg+0x227/0x350
    [ 4920.845850]  [<ffffffff821857bd>] ? sock_update_netprioidx+0xdd/0x1b0
    [ 4920.847060]  [<ffffffff82185732>] ? sock_update_netprioidx+0x52/0x1b0
    [ 4920.848276]  [<ffffffff8217f226>] sock_aio_write+0x166/0x180
    [ 4920.849348]  [<ffffffff810dfe41>] ? get_parent_ip+0x11/0x50
    [ 4920.850428]  [<ffffffff811d0d9a>] do_sync_write+0xda/0x120
    [ 4920.851465]  [<ffffffff810dffed>] ? sub_preempt_count+0x9d/0xd0
    [ 4920.852579]  [<ffffffff810dfe41>] ? get_parent_ip+0x11/0x50
    [ 4920.853608]  [<ffffffff81791887>] ? security_file_permission+0x27/0xb0
    [ 4920.854821]  [<ffffffff811d0f4c>] vfs_write+0x16c/0x180
    [ 4920.855781]  [<ffffffff811d104f>] sys_write+0x4f/0xa0
    [ 4920.856798]  [<ffffffff82638e79>] system_call_fastpath+0x16/0x1b
    [ 4920.877487] 1 lock held by trinity/9074:
    [ 4920.878239]  #0:  (rx_queue_mutex){+.+...}, at: [<ffffffff81af805d>] iscsi_if_rx+0x2d/0x990
    [ 4920.880005] Kernel panic - not syncing: hung_task: blocked tasks

    Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
    Acked-by: Mike Christie <michaelc@cs.wisc.edu>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Cc: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2864d3c11eced6708234b92186149f70748a85c4
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Aug 27 12:36:01 2013 -0400

    drm/radeon: fix handling of variable sized arrays for router objects

    commit fb93df1c2d8b3b1fb16d6ee9e32554e0c038815d upstream.

    The table has the following format:

    typedef struct _ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT         //usSrcDstTableOffset pointing to this structure
    {
      UCHAR               ucNumberOfSrc;
      USHORT              usSrcObjectID[1];
      UCHAR               ucNumberOfDst;
      USHORT              usDstObjectID[1];
    }ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT;

    usSrcObjectID[] and usDstObjectID[] are variably sized, so we
    can't access them directly.  Use pointers and update the offset
    appropriately when accessing the Dst members.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d8dcb2c6f47bab3dfd8059e58a3641b37ca70c30
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Aug 26 17:52:12 2013 -0400

    drm/radeon: fix resume on some rs4xx boards (v2)

    commit acf88deb8ddbb73acd1c3fa32fde51af9153227f upstream.

    Setting MC_MISC_CNTL.GART_INDEX_REG_EN causes hangs on
    some boards on resume.  The systems seem to work fine
    without touching this bit so leave it as is.

    v2: read-modify-write the GART_INDEX_REG_EN bit.
    I suspect the problem is that we are losing the other
    settings in the register.

    fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=52952

    Reported-by: Ondrej Zary <linux@rainbow-software.org>
    Tested-by: Daniel Tobias <dan.g.tob@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea0f1f563576a598112cd64308ddb461379d85a9
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Aug 19 11:06:50 2013 -0400

    drm/radeon: update line buffer allocation for dce4.1/5

    commit 0b31e02363b0db4e7931561bc6c141436e729d9f upstream.

    We need to allocate line buffer to each display when
    setting up the watermarks.  Failure to do so can lead
    to a blank screen.  This fixes blank screen problems
    on dce4.1/5 asics.

    Based on an initial fix from:
    Jay Cornwall <jay.cornwall@amd.com>

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3df0155c467f982d4c06078b74d042d7a5c2a743
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Aug 20 14:59:01 2013 -0400

    drm/radeon: fix LCD record parsing

    commit 95663948ba22a4be8b99acd67fbf83e86ddffba4 upstream.

    If the LCD table contains an EDID record, properly account
    for the edid size when walking through the records.

    This should fix error messages about unknown LCD records.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 69e5a58ed3cdfa6a4a708f6f00ec0ee79e2fe6cd
Author: Kees Cook <keescook@chromium.org>
Date:   Wed Sep 11 21:56:51 2013 +0200

    HID: zeroplus: validate output report details

    commit 78214e81a1bf43740ce89bb5efda78eac2f8ef83 upstream.

    The zeroplus HID driver was not checking the size of allocated values
    in fields it used. A HID device could send a malicious output report
    that would cause the driver to write beyond the output report allocation
    during initialization, causing a heap overflow:

    [ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
    ...
    [ 1466.243173] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

    CVE-2013-2889

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7247e66f07168b28410549634ea5d29a84602f81
Author: Kees Cook <keescook@chromium.org>
Date:   Wed Sep 11 21:56:50 2013 +0200

    HID: provide a helper for validating hid reports

    commit 331415ff16a12147d57d5c953f3a961b7ede348b upstream.

    Many drivers need to validate the characteristics of their HID report
    during initialization to avoid misusing the reports. This adds a common
    helper to perform validation of the report exisitng, the field existing,
    and the expected number of values within the field.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d46f78f18ccd208c5325357bfe108f5e02044b6b
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Mon Aug 26 15:18:53 2013 +0200

    rt2800: fix wrong TX power compensation

    commit 6e956da2027c767859128b9bfef085cf2a8e233b upstream.

    We should not do temperature compensation on devices without
    EXTERNAL_TX_ALC bit set (called DynamicTxAgcControl on vendor driver).
    Such devices can have totally bogus TSSI parameters on the EEPROM,
    but still threaded by us as valid and result doing wrong TX power
    calculations.

    This fix inability to connect to AP on slightly longer distance on
    some Ralink chips/devices.

    Reported-and-tested-by: Fabien ADAM <id2ndr@crocobox.org>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 43423691a01dcee991ba1cf4111bb82b2aa0e677
Author: Fabio Porcedda <fabio.porcedda@gmail.com>
Date:   Mon Sep 16 11:47:50 2013 +0200

    net: usb: cdc_ether: Use wwan interface for Telit modules

    commit 0092820407901a0b2c4e343e85f96bb7abfcded1 upstream.

    Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
    Acked-by: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 88d1fdb41513e68a6a11d1ee8c2d23ef9fdf63a5
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Sep 27 08:34:49 2013 -0700

    Revert "sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()"

    This reverts commit b23270416da409bd4e637a5acbe31a1126235fb6 which is
    commit f6e80abeab928b7c47cc1fbf53df13b4398a2bec.

    Michal writes:
        Mainline commit f6e80abe was introduced in v3.7-rc2 as a
        follow-up fix to commit

          edfee033  sctp: check src addr when processing SACK to update transport state

        (from v3.7-rc1) which changed the interpretation of third
        argument to sctp_cmd_process_sack() and sctp_outq_sack(). But as
        commit edfee033 has never been backported to stable branches,
        backport of commit f6e80abe actually breaks the code rather than
        fixing it.

    Reported-by: Michal Kubecek <mkubecek@suse.cz>
    Cc: Zijie Pan <zijie.pan@6wind.com>
    Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Cc: Vlad Yasevich <vyasevich@gmail.com>
    Acked-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>