Linux 3.0.58

commit 2a68fec1118107fbaa40c631d45641d40d88ad71
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Jan 11 09:04:08 2013 -0800

    Linux 3.0.58

commit a0ed2e748abaf7f31e6a2e8129efa461a4181277
Author: Alexander Stein <alexander.stein@systec-electronic.com>
Date:   Tue Nov 27 08:52:34 2012 +0100

    can: Do not call dev_put if restart timer is running upon close

    commit ab48b03ec9ae1840a1e427e2375bd0d9d554b4ed upstream.

    If the restart timer is running due to BUS-OFF and the device is
    disconnected an dev_put will decrease the usage counter to -1 thus
    blocking the interface removal, resulting in the following dmesg
    lines repeating every 10s:
    can: notifier: receive list not found for dev can0
    can: notifier: receive list not found for dev can0
    can: notifier: receive list not found for dev can0
    unregister_netdevice: waiting for can0 to become free. Usage count = -1

    Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c39096f1ae6551a0d43b84cb5dad309f0d392a38
Author: Michal Hocko <mhocko@suse.cz>
Date:   Fri Jan 4 15:35:12 2013 -0800

    mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT

    commit 53a59fc67f97374758e63a9c785891ec62324c81 upstream.

    Since commit e303297e6c3a ("mm: extended batches for generic
    mmu_gather") we are batching pages to be freed until either
    tlb_next_batch cannot allocate a new batch or we are done.

    This works just fine most of the time but we can get in troubles with
    non-preemptible kernel (CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY)
    on large machines where too aggressive batching might lead to soft
    lockups during process exit path (exit_mmap) because there are no
    scheduling points down the free_pages_and_swap_cache path and so the
    freeing can take long enough to trigger the soft lockup.

    The lockup is harmless except when the system is setup to panic on
    softlockup which is not that unusual.

    The simplest way to work around this issue is to limit the maximum
    number of batches in a single mmu_gather.  10k of collected pages should
    be safe to prevent from soft lockups (we would have 2ms for one) even if
    they are all freed without an explicit scheduling point.

    This patch doesn't add any new explicit scheduling points because it
    relies on zap_pmd_range during page tables zapping which calls
    cond_resched per PMD.

    The following lockup has been reported for 3.0 kernel with a huge
    process (in order of hundreds gigs but I do know any more details).

      BUG: soft lockup - CPU#56 stuck for 22s! [kernel:31053]
      Modules linked in: af_packet nfs lockd fscache auth_rpcgss nfs_acl sunrpc mptctl mptbase autofs4 binfmt_misc dm_round_robin dm_multipath bonding cpufreq_conservative cpufreq_userspace cpufreq_powersave pcc_cpufreq mperf microcode fuse loop osst sg sd_mod crc_t10dif st qla2xxx scsi_transport_fc scsi_tgt netxen_nic i7core_edac iTCO_wdt joydev e1000e serio_raw pcspkr edac_core iTCO_vendor_support acpi_power_meter rtc_cmos hpwdt hpilo button container usbhid hid dm_mirror dm_region_hash dm_log linear uhci_hcd ehci_hcd usbcore usb_common scsi_dh_emc scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh dm_snapshot pcnet32 mii edd dm_mod raid1 ext3 mbcache jbd fan thermal processor thermal_sys hwmon cciss scsi_mod
      Supported: Yes
      CPU 56
      Pid: 31053, comm: kernel Not tainted 3.0.31-0.9-default #1 HP ProLiant DL580 G7
      RIP: 0010:  _raw_spin_unlock_irqrestore+0x8/0x10
      RSP: 0018:ffff883ec1037af0  EFLAGS: 00000206
      RAX: 0000000000000e00 RBX: ffffea01a0817e28 RCX: ffff88803ffd9e80
      RDX: 0000000000000200 RSI: 0000000000000206 RDI: 0000000000000206
      RBP: 0000000000000002 R08: 0000000000000001 R09: ffff887ec724a400
      R10: 0000000000000000 R11: dead000000200200 R12: ffffffff8144c26e
      R13: 0000000000000030 R14: 0000000000000297 R15: 000000000000000e
      FS:  00007ed834282700(0000) GS:ffff88c03f200000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 000000000068b240 CR3: 0000003ec13c5000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process kernel (pid: 31053, threadinfo ffff883ec1036000, task ffff883ebd5d4100)
      Call Trace:
        release_pages+0xc5/0x260
        free_pages_and_swap_cache+0x9d/0xc0
        tlb_flush_mmu+0x5c/0x80
        tlb_finish_mmu+0xe/0x50
        exit_mmap+0xbd/0x120
        mmput+0x49/0x120
        exit_mm+0x122/0x160
        do_exit+0x17a/0x430
        do_group_exit+0x3d/0xb0
        get_signal_to_deliver+0x247/0x480
        do_signal+0x71/0x1b0
        do_notify_resume+0x98/0xb0
        int_signal+0x12/0x17
      DWARF2 unwinder stuck at int_signal+0x12/0x17

    Signed-off-by: Michal Hocko <mhocko@suse.cz>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2e111385dba40ec7bf70ad944e1139387281078
Author: Tony Prisk <linux@prisktech.co.nz>
Date:   Fri Jan 4 15:35:48 2013 -0800

    drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time

    commit 2f90b68309683f2c5765a1b04ca23d71e51f1494 upstream.

    tm_mon is 0..11, whereas vt8500 expects 1..12 for the month field,
    causing invalid date errors for January, and causing the day field to
    roll over incorrectly.

    The century flag is only handled in vt8500_rtc_read_time, but not set in
    vt8500_rtc_set_time.  This patch corrects the behaviour of the century
    flag.

    Signed-off-by: Edgar Toernig <froese@gmx.de>
    Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit afc0e69cd367175e058c3bcbe5cb624aad4df3e5
Author: Tony Prisk <linux@prisktech.co.nz>
Date:   Fri Jan 4 15:35:47 2013 -0800

    drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield

    commit 532db570e5181abc8f4f7bfa6c77c69ec2240198 upstream.

    Control register bitfield for 12H/24H mode is handled incorrectly.
    Setting CR_24H actually enables 12H mode.  This patch renames the define
    and changes the initialization code to correctly set 24H mode.

    Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
    Cc: Edgar Toernig <froese@gmx.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a16c403b4eed0a8519969ede7617f616336570a
Author: Corey Minyard <cminyard@mvista.com>
Date:   Tue Dec 18 14:21:19 2012 -0800

    CRIS: fix I/O macros

    commit c24bf9b4cc6a0f330ea355d73bfdf1dae7e63a05 upstream.

    The inb/outb macros for CRIS are broken from a number of points of view,
    missing () around parameters and they have an unprotected if statement
    in them.  This was breaking the compile of IPMI on CRIS and thus I was
    being annoyed by build regressions, so I fixed them.

    Plus I don't think they would have worked at all, since the data values
    were missing "&" and the outsl had a "3" instead of a "4" for the size.
    From what I can tell, this stuff is not used at all, so this can't be
    any more broken than it was before, anyway.

    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Cc: Jesper Nilsson <jesper.nilsson@axis.com>
    Cc: Mikael Starvik <starvik@axis.com>
    Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b7b38a408b548f91d0de7506cd4ffeb91f5cef0
Author: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Date:   Wed Nov 21 00:50:21 2012 -0200

    Bluetooth: cancel power_on work when unregistering the device

    commit b9b5ef188e5a2222cfc16ef62a4703080750b451 upstream.

    We need to cancel the hci_power_on work in order to avoid it run when we
    try to free the hdev.

    [ 1434.201149] ------------[ cut here ]------------
    [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
    [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci
    _power_on+0x0/0x90
    [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G        W    3.7.0-rc5-next-
    20121112-sasha-00018-g2f4ce0e #127
    [ 1434.210760] Call Trace:
    [ 1434.210760]  [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
    [ 1434.210760]  [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
    [ 1434.210760]  [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
    [ 1434.210760]  [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
    [ 1434.210760]  [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
    [ 1434.210760]  [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
    [ 1434.210760]  [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
    [ 1434.210760]  [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
    [ 1434.210760]  [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
    [ 1434.210760]  [<ffffffff8125eee7>] kfree+0x227/0x330
    [ 1434.210760]  [<ffffffff83785db0>] bt_host_release+0x10/0x20
    [ 1434.210760]  [<ffffffff81e539e5>] device_release+0x65/0xc0
    [ 1434.210760]  [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
    [ 1434.210760]  [<ffffffff819d39cd>] kobject_release+0xd/0x10
    [ 1434.210760]  [<ffffffff819d33cc>] kobject_put+0x4c/0x60
    [ 1434.210760]  [<ffffffff81e548b2>] put_device+0x12/0x20
    [ 1434.210760]  [<ffffffff8376a334>] hci_free_dev+0x24/0x30
    [ 1434.210760]  [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
    [ 1434.210760]  [<ffffffff8127be12>] __fput+0x122/0x250
    [ 1434.210760]  [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
    [ 1434.210760]  [<ffffffff8127bf49>] ____fput+0x9/0x10
    [ 1434.210760]  [<ffffffff81133402>] task_work_run+0xb2/0xf0
    [ 1434.210760]  [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
    [ 1434.210760]  [<ffffffff83bfb0ea>] int_signal+0x12/0x17
    [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---

    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bc262193cd981640f89bfbe76fa0afb6a88ee1f
Author: Marcos Chaparro <marcos@mrkindustries.com.ar>
Date:   Tue Nov 6 16:19:11 2012 -0300

    Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027]

    commit acd9454433e28c1a365d8b069813c35c1c3a8ac3 upstream.

    Added Atheros AR3011 internal bluetooth device found in Sony VAIO VPCEH to the
    devices list.
    Before this, the bluetooth module was identified as an Foxconn / Hai bluetooth
    device [0489:e027], now it claims to be an AtherosAR3011 Bluetooth
    [0cf3:3005].

    T:  Bus=01 Lev=02 Prnt=02 Port=04 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e027 Rev= 0.01
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Marcos Chaparro <marcos@mrkindustries.com.ar>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e64130678871755b43019a3ee191d6548d9862ca
Author: Andy Lutomirski <luto@amacapital.net>
Date:   Sat Dec 1 12:37:20 2012 -0800

    PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz

    commit 812089e01b9f65f90fc8fc670d8cce72a0e01fbb upstream.

    Otherwise it fails like this on cards like the Transcend 16GB SDHC card:

        mmc0: new SDHC card at address b368
        mmcblk0: mmc0:b368 SDC   15.0 GiB
        mmcblk0: error -110 sending status command, retrying
        mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response 0x900, card status 0xb0

    Tested on my Lenovo x200 laptop.

    [bhelgaas: changelog]
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: Chris Ball <cjb@laptop.org>
    CC: Manoj Iyer <manoj.iyer@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit decbd08d03e98e88f5c1f3b602ee02935c6c6ee4
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Dec 11 14:57:14 2012 +0000

    solos-pci: fix double-free of TX skb in DMA mode

    commit cae49ede00ec3d0cda290b03fee55b72b49efc11 upstream.

    We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
    If there wasn't another skb ready to transmit immediately, this led to a
    double-free because we'd free it *again* next time we did have a packet to
    send.

    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b6916a71e85cd2e51c7cc3062814374a42753b9
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Sun Dec 16 00:25:57 2012 +0000

    ARM: missing ->mmap_sem around find_vma() in swp_emulate.c

    commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream.

    find_vma() is *not* safe when somebody else is removing vmas.  Not just
    the return value might get bogus just as you are getting it (this instance
    doesn't try to dereference the resulting vma), the search itself can get
    buggered in rather spectacular ways.  IOW, ->mmap_sem really, really is
    not optional here.

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f61019b8f7253ee77cebe22e9ff58865d16378a7
Author: Will Deacon <will.deacon@arm.com>
Date:   Tue Sep 18 19:18:35 2012 +0100

    ARM: mm: use pteval_t to represent page protection values

    commit 864aa04cd02979c2c755cb28b5f4fe56039171c0 upstream.

    When updating the page protection map after calculating the user_pgprot
    value, the base protection map is temporarily stored in an unsigned long
    type, causing truncation of the protection bits when LPAE is enabled.
    This effectively means that calls to mprotect() will corrupt the upper
    page attributes, clearing the XN bit unconditionally.

    This patch uses pteval_t to store the intermediate protection values,
    preserving the upper bits for 64-bit descriptors.

    Acked-by: Nicolas Pitre <nico@linaro.org>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d15569e14cfcf9151e9e3b4c0cb98369943a2bb
Author: Eric Dumazet <edumazet@google.com>
Date:   Sun Oct 21 19:57:11 2012 +0000

    tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation

    [ Upstream commit 354e4aa391ed50a4d827ff6fc11e0667d0859b25 ]

    RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation]

      All TCP stacks MAY implement the following mitigation.  TCP stacks
      that implement this mitigation MUST add an additional input check to
      any incoming segment.  The ACK value is considered acceptable only if
      it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
      SND.NXT).  All incoming segments whose ACK value doesn't satisfy the
      above condition MUST be discarded and an ACK sent back.

    Move tcp_send_challenge_ack() before tcp_ack() to avoid a forward
    declaration.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Jerry Chu <hkchu@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ffd34fcbce326a88668075b9e5480cb301ac6a78
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Nov 13 05:37:18 2012 +0000

    tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()

    [ Upstream commit bd090dfc634ddd711a5fbd0cadc6e0ab4977bcaf ]

    We added support for RFC 5961 in latest kernels but TCP fails
    to perform exhaustive check of ACK sequence.

    We can update our view of peer tsval from a frame that is
    later discarded by tcp_ack()

    This makes timestamps enabled sessions vulnerable to injection of
    a high tsval : peers start an ACK storm, since the victim
    sends a dupack each time it receives an ACK from the other peer.

    As tcp_validate_incoming() is called before tcp_ack(), we should
    not peform tcp_replace_ts_recent() from it, and let callers do it
    at the right time.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Nandita Dukkipati <nanditad@google.com>
    Cc: H.K. Jerry Chu <hkchu@google.com>
    Cc: Romain Francoise <romain@orebokech.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 282190eab6442da4789ae3c3037c7b19d65eaf52
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jul 17 12:29:30 2012 +0000

    tcp: refine SYN handling in tcp_validate_incoming

    [ Upstream commit e371589917011efe6ff8c7dfb4e9e81934ac5855 ]

    Followup of commit 0c24604b68fc (tcp: implement RFC 5961 4.2)

    As reported by Vijay Subramanian, we should send a challenge ACK
    instead of a dup ack if a SYN flag is set on a packet received out of
    window.

    This permits the ratelimiting to work as intended, and to increase
    correct SNMP counters.

    Suggested-by: Vijay Subramanian <subramanian.vijay@gmail.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Vijay Subramanian <subramanian.vijay@gmail.com>
    Cc: Kiran Kumar Kella <kkiran@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab5c718d0fd643ba6f2112235e12ea5222f4edf3
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jul 17 01:41:30 2012 +0000

    tcp: implement RFC 5961 4.2

    [ Upstream commit 0c24604b68fc7810d429d6c3657b6f148270e528 ]

    Implement the RFC 5691 mitigation against Blind
    Reset attack using SYN bit.

    Section 4.2 of RFC 5961 advises to send a Challenge ACK and drop
    incoming packet, instead of resetting the session.

    Add a new SNMP counter to count number of challenge acks sent
    in response to SYN packets.
    (netstat -s | grep TCPSYNChallenge)

    Remove obsolete TCPAbortOnSyn, since we no longer abort a TCP session
    because of a SYN flag.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Kiran Kumar Kella <kkiran@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86791bbfe5ed7b275be040cfeff049a1624af1b7
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jul 17 10:13:05 2012 +0200

    tcp: implement RFC 5961 3.2

    [ Upstream commit 282f23c6ee343126156dd41218b22ece96d747e3 ]

    Implement the RFC 5691 mitigation against Blind
    Reset attack using RST bit.

    Idea is to validate incoming RST sequence,
    to match RCV.NXT value, instead of previouly accepted
    window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND)

    If sequence is in window but not an exact match, send
    a "challenge ACK", so that the other part can resend an
    RST with the appropriate sequence.

    Add a new sysctl, tcp_challenge_ack_limit, to limit
    number of challenge ACK sent per second.

    Add a new SNMP counter to count number of challenge acks sent.
    (netstat -s | grep TCPChallengeACK)

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Kiran Kumar Kella <kkiran@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b79271d999e75f68410a5a5f23327c151dc450b
Author: Stefan Hasko <hasko.stevo@gmail.com>
Date:   Fri Dec 21 15:04:59 2012 +0000

    net: sched: integer overflow fix

    [ Upstream commit d2fe85da52e89b8012ffad010ef352a964725d5f ]

    Fixed integer overflow in function htb_dequeue

    Signed-off-by: Stefan Hasko <hasko.stevo@gmail.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1e8928ab69d2e72f035adfc54d198b22b488c7e1
Author: Dave Kleikamp <dave.kleikamp@oracle.com>
Date:   Mon Dec 17 11:52:47 2012 -0600

    sparc: huge_ptep_set_* functions need to call set_huge_pte_at()

    [ Upstream commit 6cb9c3697585c47977c42c5cc1b9fc49247ac530 ]

    Modifying the huge pte's requires that all the underlying pte's be
    modified.

    Version 2: added missing flush_tlb_page()

    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6fe7238ef44ba212b7f6d912c47f8e72ec1b9984
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Mon Dec 12 15:22:41 2011 -0500

    ftrace: Do not function trace inlined functions

    commit 45959ee7aa645815a5ce303a0ea1e48a21e67c6a upstream.

    When gcc inlines a function, it does not mark it with the mcount
    prologue, which in turn means that inlined functions are not traced
    by the function tracer. But if CONFIG_OPTIMIZE_INLINING is set, then
    gcc is allowed not to inline a function that is marked inline.

    Depending on the options and the compiler, a function may or may
    not be traced by the function tracer, depending on whether gcc
    decides to inline a function or not. This has caused several
    problems in the pass becaues gcc is not always consistent with
    what it decides to inline between different gcc versions.

    Some places should not be traced (like paravirt native_* functions)
    and these are mostly marked as inline. When gcc decides not to
    inline the function, and if that function should not be traced, then
    the ftrace function tracer will suddenly break when it use to work
    fine. This becomes even harder to debug when different versions of
    gcc will not inline that function, making the same kernel and config
    work for some gcc versions and not work for others.

    By making all functions marked inline to not be traced will remove
    the ambiguity that gcc adds when it comes to tracing functions marked
    inline. All gcc versions will be consistent with what functions are
    traced and having volatile working code will be removed.

    Note, only the inline macro when CONFIG_OPTIMIZE_INLINING is set needs
    to have notrace added, as the attribute __always_inline will force
    the function to be inlined and then not traced.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c94f438854d6b83f1fcc8eb29d18ae118c8e292
Author: Andre Przywara <andre.przywara@amd.com>
Date:   Wed Oct 31 17:20:50 2012 +0100

    x86, amd: Disable way access filter on Piledriver CPUs

    commit 2bbf0a1427c377350f001fbc6260995334739ad7 upstream.

    The Way Access Filter in recent AMD CPUs may hurt the performance of
    some workloads, caused by aliasing issues in the L1 cache.
    This patch disables it on the affected CPUs.

    The issue is similar to that one of last year:
    http://lkml.indiana.edu/hypermail/linux/kernel/1107.3/00041.html
    This new patch does not replace the old one, we just need another
    quirk for newer CPUs.

    The performance penalty without the patch depends on the
    circumstances, but is a bit less than the last year's 3%.

    The workloads affected would be those that access code from the same
    physical page under different virtual addresses, so different
    processes using the same libraries with ASLR or multiple instances of
    PIE-binaries. The code needs to be accessed simultaneously from both
    cores of the same compute unit.

    More details can be found here:
    http://developer.amd.com/Assets/SharedL1InstructionCacheonAMD15hCPU.pdf

    CPUs affected are anything with the core known as Piledriver.
    That includes the new parts of the AMD A-Series (aka Trinity) and the
    just released new CPUs of the FX-Series (aka Vishera).
    The model numbering is a bit odd here: FX CPUs have model 2,
    A-Series has model 10h, with possible extensions to 1Fh. Hence the
    range of model ids.

    Signed-off-by: Andre Przywara <osp@andrep.de>
    Link: http://lkml.kernel.org/r/1351700450-9277-1-git-send-email-osp@andrep.de
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 01fdcf4e373725f4a1238d9876063fd0b51bed15
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Nov 19 08:13:35 2012 -0800

    cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()

    commit 175431635ec09b1d1bba04979b006b99e8305a83 upstream.

    cgroup_create_dir() does weird dancing with dentry refcnt.  On
    success, it gets and then puts it achieving nothing.  On failure, it
    puts but there isn't no matching get anywhere leading to the following
    oops if cgroup_create_file() fails for whatever reason.

      ------------[ cut here ]------------
      kernel BUG at /work/os/work/fs/dcache.c:552!
      invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      Modules linked in:
      CPU 2
      Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs
      RIP: 0010:[<ffffffff811d9c0c>]  [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
      RSP: 0018:ffff88001a3ebef8  EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403
      RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58
      RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001
      R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea
      R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60
      FS:  00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080)
      Stack:
       ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000
       ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8
       ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8
      Call Trace:
       [<ffffffff811cc889>] done_path_create+0x19/0x50
       [<ffffffff811d1fc9>] sys_mkdirat+0x59/0x80
       [<ffffffff811d2009>] sys_mkdir+0x19/0x20
       [<ffffffff81be1e02>] system_call_fastpath+0x16/0x1b
      Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 <0f> 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41
      RIP  [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
       RSP <ffff88001a3ebef8>
      ---[ end trace 1277bcfd9561ddb0 ]---

    Fix it by dropping the unnecessary dget/dput() pair.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5729b1319c8925deb177192dbe3a134845ab258f
Author: Russell Webb <russell.webb@linux.intel.com>
Date:   Fri Nov 9 13:58:49 2012 -0800

    xhci: Add Lynx Point LP to list of Intel switchable hosts

    commit bb1e5dd7113d2fd178d3af9aca8f480ae0468edf upstream.

    Like Lynx Point, Lynx Point LP is also switchable.  See
    1c12443ab8eba71a658fae4572147e56d1f84f66 for more details.

    This patch should be backported to stable kernels as old as 3.0,
    that contain commit 69e848c2090aebba5698a1620604c7dccb448684
    "Intel xhci: Support EHCI/xHCI port switching."

    Signed-off-by: Russell Webb <russell.webb@linux.intel.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d0389110863a993f19ba11bdf9ac639df713a1f2
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Sat Nov 3 11:52:09 2012 +0100

    genirq: Always force thread affinity

    commit 04aa530ec04f61875b99c12721162e2964e3318c upstream.

    Sankara reported that the genirq core code fails to adjust the
    affinity of an interrupt thread in several cases:

     1) On request/setup_irq() the call to setup_affinity() happens before
        the new action is registered, so the new thread is not notified.

     2) For secondary shared interrupts nothing notifies the new thread to
        change its affinity.

     3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving
        the thread either.

    Fix this by setting the thread affinity flag right on thread creation
    time. This ensures that under all circumstances the thread moves to
    the right place. Requires a check in irq_thread_check_affinity for an
    existing affinity mask (CONFIG_CPU_MASK_OFFSTACK=y)

    Reported-and-tested-by: Sankara Muthukrishnan <sankara.m@gmail.com>
    Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1209041738200.2754@ionos
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ada84ad6dd091c7ee6ce70a01fd5dc214eb1d96d
Author: Peter Popovec <popovec@oko.fei.tuke.sk>
Date:   Fri Dec 14 22:57:25 2012 -0800

    Input: walkera0701 - fix crash on startup

    commit a455e2985f57e2a71566bb8850094af38b2c932d upstream.

    The driver's timer must be set up before enabling IRQ handler, otherwise
    bad things may happen.

    Reported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Peter Popovec <popovec@fei.tuke.sk>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31c4e8cd42eb2f6aedccd13670e113d2ca1db39e
Author: Xi Wang <xi.wang@gmail.com>
Date:   Fri Jan 4 03:22:57 2013 -0500

    nfs: fix null checking in nfs_get_option_str()

    commit e25fbe380c4e3c09afa98bcdcd9d3921443adab8 upstream.

    The following null pointer check is broken.

    	*option = match_strdup(args);
    	return !option;

    The pointer `option' must be non-null, and thus `!option' is always false.
    Use `!*option' instead.

    The bug was introduced in commit c5cb09b6f8 ("Cleanup: Factor out some
    cut-and-paste code.").

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6e0c42ccbb489d73ebc3973583474257a028d66
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue Dec 4 18:25:10 2012 -0500

    nfsd4: fix oops on unusual readlike compound

    commit d5f50b0c290431c65377c4afa1c764e2c3fe5305 upstream.

    If the argument and reply together exceed the maximum payload size, then
    a reply with a read-like operation can overlow the rq_pages array.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d53441a95261c71d18938a797eb96f469b9dc09
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Fri Dec 14 16:38:46 2012 -0500

    NFS: Fix calls to drop_nlink()

    commit 1f018458b30b0d5c535c94e577aa0acbb92e1395 upstream.

    It is almost always wrong for NFS to call drop_nlink() after removing a
    file. What we really want is to mark the inode's attributes for
    revalidation, and we want to ensure that the VFS drops it if we're
    reasonably sure that this is the final unlink().
    Do the former using the usual cache validity flags, and the latter
    by testing if inode->i_nlink == 1, and clearing it in that case.

    This also fixes the following warning reported by Neil Brown and
    Jeff Layton (among others).

    [634155.004438] WARNING:
    at /home/abuild/rpmbuild/BUILD/kernel-desktop-3.5.0/lin [634155.004442]
    Hardware name: Latitude E6510 [634155.004577]  crc_itu_t crc32c_intel
    snd_hwdep snd_pcm snd_timer snd soundcor [634155.004609] Pid: 13402, comm:
    bash Tainted: G        W    3.5.0-36-desktop # [634155.004611] Call Trace:
    [634155.004630]  [<ffffffff8100444a>] dump_trace+0xaa/0x2b0
    [634155.004641]  [<ffffffff815a23dc>] dump_stack+0x69/0x6f
    [634155.004653]  [<ffffffff81041a0b>] warn_slowpath_common+0x7b/0xc0
    [634155.004662]  [<ffffffff811832e4>] drop_nlink+0x34/0x40
    [634155.004687]  [<ffffffffa05bb6c3>] nfs_dentry_iput+0x33/0x70 [nfs]
    [634155.004714]  [<ffffffff8118049e>] dput+0x12e/0x230
    [634155.004726]  [<ffffffff8116b230>] __fput+0x170/0x230
    [634155.004735]  [<ffffffff81167c0f>] filp_close+0x5f/0x90
    [634155.004743]  [<ffffffff81167cd7>] sys_close+0x97/0x100
    [634155.004754]  [<ffffffff815c3b39>] system_call_fastpath+0x16/0x1b
    [634155.004767]  [<00007f2a73a0d110>] 0x7f2a73a0d10f

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64b45c804286cb18c50b387169b7da64279bc1ed
Author: NeilBrown <neilb@suse.de>
Date:   Thu Dec 13 15:14:36 2012 +1100

    NFS: avoid NULL dereference in nfs_destroy_server

    commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream.

    In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
    an error between setting server->destory (to nfs_destroy_server), and
    calling nfs_start_lockd (which will set server->nlm_host).

    If this happens, nfs_clone_server will call nfs_free_server which
    will call nfs_destroy_server and thence nlmclnt_done(NULL).  This
    causes the NULL to be dereferenced.

    So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.

    The other guards there are irrelevant as nlm_host can only be non-NULL
    if one of these flags are set - so remove those tests.  (Thanks to Trond
    for this suggestion).

    This is suitable for any stable kernel since 2.6.25.

    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 611d6f03ec50fe38c6753ada7ffbed3febb862c1
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Fri Jan 4 23:00:54 2013 +0100

    ACPI / scan: Do not use dummy HID for system bus ACPI nodes

    commit 4f5f64cf0cc916220aaa055992e31195470cfe37 upstream.

    At one point acpi_device_set_id() checks if acpi_device_hid(device)
    returns NULL, but that never happens, so system bus devices with an
    empty list of PNP IDs are given the dummy HID ("device") instead of
    the "system bus HID" ("LNXSYBUS").  Fix the code to use the right
    check.

    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42fac8ebfa863c060d2e4613c0a4f8b8fdad8352
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Mon Oct 22 22:15:04 2012 +0200

    usb: gadget: phonet: free requests in pn_bind()'s error path

    commit d0eca719dd11ad0619e8dd6a1f3eceb95b0216dd upstream.

    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1db444fb78d281a2f84f20ee38bba7711b3d31f3
Author: Christian Lamparter <chunkeey@googlemail.com>
Date:   Thu Dec 27 15:18:20 2012 +0100

    p54usb: add USBIDs for two more p54usb devices

    commit 4010fe21a315b4223c25376714c6a2b61b722e5c upstream.

    This patch adds USBIDs for:
    	- DrayTek Vigor 530
    	- Zoom 4410a

    It also adds a note about Gemtek WUBI-100GW
    and SparkLAN WL-682 USBID conflict [WUBI-100GW
    is a ISL3886+NET2280 (LM86 firmare) solution,
    whereas WL-682 is a ISL3887 (LM87 firmware)]
    device.

    Source: <http://www.wikidevi.com/wiki/Intersil/p54/usb/windows>

    Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 45a62afa80bb272768366e564b38a6f9392bf475
Author: Tomasz Guszkowski <tsg@o2.pl>
Date:   Sat Dec 22 18:30:01 2012 +0100

    p54usb: add USB ID for T-Com Sinus 154 data II

    commit 3194b7fcdf6caea338b5d2c72d76fed80437649c upstream.

    Added USB ID for T-Com Sinus 154 data II.

    Signed-off-by: Tomasz Guszkowski <tsg@o2.pl>
    Acked-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ab1dea0945d7179637bbec02e7e8894a59f8ba6
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Dec 3 11:30:50 2012 +0100

    ALSA: usb-audio: Fix missing autopm for MIDI input

    commit f5f165418cabf2218eb466c0e94693b8b1aee88b upstream.

    The commit [88a8516a: ALSA: usbaudio: implement USB autosuspend] added
    the support of autopm for USB MIDI output, but it didn't take the MIDI
    input into account.

    This patch adds the following for fixing the autopm:
    - Manage the URB start at the first MIDI input stream open, instead of
      the time of instance creation
    - Move autopm code to the common substream_open()
    - Make snd_usbmidi_input_start/_stop() more robust and add the running
      state check

    Reviewd-by: Clemens Ladisch <clemens@ladisch.de>
    Tested-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5a6400c991f269eaab5a175d8b7c656155a74129
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Dec 3 11:12:46 2012 +0100

    ALSA: usb-audio: Avoid autopm calls after disconnection

    commit 59866da9e4ae54819e3c4e0a8f426bdb0c2ef993 upstream.

    Add a similar protection against the disconnection race and the
    invalid use of usb instance after disconnection, as well as we've done
    for the USB audio PCM.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=51201

    Reviewd-by: Clemens Ladisch <clemens@ladisch.de>
    Tested-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 51afc625ccd2e38f76f690ccce93e11a21d9543b
Author: Hugh Dickins <hughd@google.com>
Date:   Wed Jan 2 02:01:33 2013 -0800

    tmpfs mempolicy: fix /proc/mounts corrupting memory

    commit f2a07f40dbc603c15f8b06e6ec7f768af67b424f upstream.

    Recently I suggested using "mount -o remount,mpol=local /tmp" in NUMA
    mempolicy testing.  Very nasty.  Reading /proc/mounts, /proc/pid/mounts
    or /proc/pid/mountinfo may then corrupt one bit of kernel memory, often
    in a page table (causing "Bad swap" or "Bad page map" warning or "Bad
    pagetable" oops), sometimes in a vm_area_struct or rbnode or somewhere
    worse.  "mpol=prefer" and "mpol=prefer:Node" are equally toxic.

    Recent NUMA enhancements are not to blame: this dates back to 2.6.35,
    when commit e17f74af351c "mempolicy: don't call mpol_set_nodemask() when
    no_context" skipped mpol_parse_str()'s call to mpol_set_nodemask(),
    which used to initialize v.preferred_node, or set MPOL_F_LOCAL in flags.
    With slab poisoning, you can then rely on mpol_to_str() to set the bit
    for node 0x6b6b, probably in the next page above the caller's stack.

    mpol_parse_str() is only called from shmem_parse_options(): no_context
    is always true, so call it unused for now, and remove !no_context code.
    Set v.nodes or v.preferred_node or MPOL_F_LOCAL as mpol_to_str() might
    expect.  Then mpol_to_str() can ignore its no_context argument also,
    the mpol being appropriately initialized whether contextualized or not.
    Rename its no_context unused too, and let subsequent patch remove them
    (that's not needed for stable backporting, which would involve rejects).

    I don't understand why MPOL_LOCAL is described as a pseudo-policy:
    it's a reasonable policy which suffers from a confusing implementation
    in terms of MPOL_PREFERRED with MPOL_F_LOCAL.  I believe this would be
    much more robust if MPOL_LOCAL were recognized in switch statements
    throughout, MPOL_F_LOCAL deleted, and MPOL_PREFERRED use the (possibly
    empty) nodes mask like everyone else, instead of its preferred_node
    variant (I presume an optimization from the days before MPOL_LOCAL).
    But that would take me too long to get right and fully tested.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fafe011ed532384b845e53fec7b9392310e56e6
Author: Christoffer Dall <cdall@cs.columbia.edu>
Date:   Fri Dec 21 13:03:50 2012 -0500

    mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED

    commit ad4b3fb7ff9940bcdb1e4cd62bd189d10fa636ba upstream.

    Unfortunately with !CONFIG_PAGEFLAGS_EXTENDED, (!PageHead) is false, and
    (PageHead) is true, for tail pages.  If this is indeed the intended
    behavior, which I doubt because it breaks cache cleaning on some ARM
    systems, then the nomenclature is highly problematic.

    This patch makes sure PageHead is only true for head pages and PageTail
    is only true for tail pages, and neither is true for non-compound pages.

    [ This buglet seems ancient - seems to have been introduced back in Apr
      2008 in commit 6a1e7f777f61: "pageflags: convert to the use of new
      macros".  And the reason nobody noticed is because the PageHead()
      tests are almost all about just sanity-checking, and only used on
      pages that are actual page heads.  The fact that the old code returned
      true for tail pages too was thus not really noticeable.   - Linus ]

    Signed-off-by: Christoffer Dall <cdall@cs.columbia.edu>
    Acked-by:  Andrea Arcangeli <aarcange@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Will Deacon <Will.Deacon@arm.com>
    Cc: Steve Capper <Steve.Capper@arm.com>
    Cc: Christoph Lameter <cl@linux.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 812e6380b5b54fa5eb3189f83b3cbb22a6b7bd69
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Oct 19 14:03:33 2012 +0100

    virtio: force vring descriptors to be allocated from lowmem

    commit b92b1b89a33c172c075edccf6afb0edc41d851fd upstream.

    Virtio devices may attempt to add descriptors to a virtqueue from atomic
    context using GFP_ATOMIC allocation. This is problematic because such
    allocations can fall outside of the lowmem mapping, causing virt_to_phys
    to report bogus physical addresses which are subsequently passed to
    userspace via the buffers for the virtual device.

    This patch masks out __GFP_HIGH and __GFP_HIGHMEM from the requested
    flags when allocating descriptors for a virtqueue. If an atomic
    allocation is requested and later fails, we will return -ENOSPC which
    will be handled by the driver.

    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Cc: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 276c234515c9491d591c0463c118d1f497d726f3
Author: Ondrej Zary <linux@rainbow-software.org>
Date:   Tue Dec 11 22:18:05 2012 +0100

    x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops

    commit ad68652412276f68ad4fe3e1ecf5ee6880876783 upstream.

    Some MSI laptop BIOSes are broken - INT 15h code uses port 92h to enable A20
    line but resume code assumes that KBC was used.
    The laptop will not resume from S3 otherwise but powers off after a while
    and then powers on again stuck with a blank screen.

    Fix it by enabling A20 using KBC in i8042_platform_init for x86.

    Fixes https://bugzilla.kernel.org/show_bug.cgi?id=12878

    Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
    Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: Rafael J. Wysocki <rjw@sisk.pl>
    Link: http://lkml.kernel.org/r/201212112218.06551.linux@rainbow-software.org
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 28278b332bc73f45189939a6c1797cba0eb5879f
Author: Kees Cook <keescook@chromium.org>
Date:   Thu Dec 20 15:05:16 2012 -0800

    exec: do not leave bprm->interp on stack

    commit b66c5984017533316fd1951770302649baf1aa33 upstream.

    If a series of scripts are executed, each triggering module loading via
    unprintable bytes in the script header, kernel stack contents can leak
    into the command line.

    Normally execution of binfmt_script and binfmt_misc happens recursively.
    However, when modules are enabled, and unprintable bytes exist in the
    bprm->buf, execution will restart after attempting to load matching
    binfmt modules.  Unfortunately, the logic in binfmt_script and
    binfmt_misc does not expect to get restarted.  They leave bprm->interp
    pointing to their local stack.  This means on restart bprm->interp is
    left pointing into unused stack memory which can then be copied into the
    userspace argv areas.

    After additional study, it seems that both recursion and restart remains
    the desirable way to handle exec with scripts, misc, and modules.  As
    such, we need to protect the changes to interp.

    This changes the logic to require allocation for any changes to the
    bprm->interp.  To avoid adding a new kmalloc to every exec, the default
    value is left as-is.  Only when passing through binfmt_script or
    binfmt_misc does an allocation take place.

    For a proof of concept, see DoTest.sh from:

       http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Cc: halfdog <me@halfdog.net>
    Cc: P J P <ppandit@redhat.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 947d71656ecaa1da2df6053d3cb1a1e9739d7ae5
Author: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date:   Fri Dec 7 23:11:14 2012 +0100

    pnpacpi: fix incorrect TEST_ALPHA() test

    commit cdc87c5a30f407ed1ce43d8a22261116873d5ef1 upstream.

    TEST_ALPHA() is broken and always returns 0.

    [akpm@linux-foundation.org: return false for '@' as well, per Bjorn]
    Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d759d1c877b16c40113812c05535372f61b4e2b
Author: Jay Purohit <jspurohit@velocitylimitless.com>
Date:   Sun Oct 14 07:07:21 2012 +0000

    usb/ipheth: Add iPhone 5 support

    [ Upstream commit af1b85e49089f945deb46258b0fc4bc9910afb22 ]

    I noticed that the iPhone ethernet driver did not support
    iPhone 5. I quickly added support to it in my kernel, here's
    a patch.

    Signed-off-by: Jay Purohit <jspurohit@velocitylimitless.com>
    Acked-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
    Signed-off-by: Jan Ceuleers <jan.ceuleers@computer.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98ffdcd624c187390baaadf56325aa6a2c0208f1
Author: Alexander Shiyan <shc_work@mail.ru>
Date:   Tue Nov 20 09:59:11 2012 +0000

    irda: sir_dev: Fix copy/paste typo

    [ Upstream commit 2355a62bcbdcc4b567425bab036bfab6ade87eed ]

    Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 80fef291d6f5d9f6f20e8c54cbc6ecbf47b187df
Author: Alan Cox <alan@linux.intel.com>
Date:   Tue Nov 20 06:31:57 2012 +0000

    ne2000: add the right platform device

    [ Upstream commit da9da01d9199b5bb15289d0859053c9aa3a34ac0 ]

    Without this udev doesn't have a way to key the ne device to the platform
    device.

    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 55fdb80050ce0f4a124d24bb5c6394f8f521260b
Author: Tommi Rantala <tt.rantala@gmail.com>
Date:   Thu Nov 22 03:23:16 2012 +0000

    sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall

    [ Upstream commit 6e51fe7572590d8d86e93b547fab6693d305fd0d ]

    Consider the following program, that sets the second argument to the
    sendto() syscall incorrectly:

     #include <string.h>
     #include <arpa/inet.h>
     #include <sys/socket.h>

     int main(void)
     {
             int fd;
             struct sockaddr_in sa;

             fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
             if (fd < 0)
                     return 1;

             memset(&sa, 0, sizeof(sa));
             sa.sin_family = AF_INET;
             sa.sin_addr.s_addr = inet_addr("127.0.0.1");
             sa.sin_port = htons(11111);

             sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

             return 0;
     }

    We get -ENOMEM:

     $ strace -e sendto ./demo
     sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ENOMEM (Cannot allocate memory)

    Propagate the error code from sctp_user_addto_chunk(), so that we will
    tell user space what actually went wrong:

     $ strace -e sendto ./demo
     sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EFAULT (Bad address)

    Noticed while running Trinity (the syscall fuzzer).

    Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e620776f6cfe4e60acd2f2cec9210934cdb24b17
Author: Tommi Rantala <tt.rantala@gmail.com>
Date:   Tue Nov 27 04:01:46 2012 +0000

    sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails

    [ Upstream commit be364c8c0f17a3dd42707b5a090b318028538eb9 ]

    Trinity (the syscall fuzzer) discovered a memory leak in SCTP,
    reproducible e.g. with the sendto() syscall by passing invalid
    user space pointer in the second argument:

     #include <string.h>
     #include <arpa/inet.h>
     #include <sys/socket.h>

     int main(void)
     {
             int fd;
             struct sockaddr_in sa;

             fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
             if (fd < 0)
                     return 1;

             memset(&sa, 0, sizeof(sa));
             sa.sin_family = AF_INET;
             sa.sin_addr.s_addr = inet_addr("127.0.0.1");
             sa.sin_port = htons(11111);

             sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

             return 0;
     }

    As far as I can tell, the leak has been around since ~2003.

    Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cefbc0583507deea5f6fd6232909761e0c3cc01a
Author: nikolay@redhat.com <nikolay@redhat.com>
Date:   Thu Nov 29 01:37:59 2012 +0000

    bonding: fix race condition in bonding_store_slaves_active

    [ Upstream commit e196c0e579902f42cf72414461fb034e5a1ffbf7 ]

    Race between bonding_store_slaves_active() and slave manipulation
     functions. The bond_for_each_slave use in bonding_store_slaves_active()
     is not protected by any synchronization mechanism.
     NULL pointer dereference is easy to reach.
     Fixed by acquiring the bond->lock for the slave walk.

     v2: Make description text < 75 columns

    Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
    Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a8695e1c800bcf21dc9cf55044dd749a3f805427
Author: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
Date:   Wed Nov 21 04:35:03 2012 +0000

    bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.

    [ Upstream commit 0e376bd0b791ac6ac6bdb051492df0769c840848 ]

    Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.

    Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.0.59

commit 0829a6cc39cfcd76caaf562b4254c95392463b62
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Jan 17 08:48:09 2013 -0800

    Linux 3.0.59

commit 7633459bb303190c8c016817de45534b202a82d1
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Thu Jan 3 12:15:26 2013 +0000

    staging: comedi: Kconfig: COMEDI_NI_AT_A2150 should select COMEDI_FC

    commit 34ffb33e09132401872fe79e95c30824ce194d23 upstream.

    The 'ni_at_a2150' module links to `cfc_write_to_buffer` in the
    'comedi_fc' module, so selecting 'COMEDI_NI_AT_A2150' in the kernel config
    needs to also select 'COMEDI_FC'.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 57a750294d5d53a6ec49ac69e837216b1d982d78
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Fri Mar 30 17:14:58 2012 +0100

    staging: comedi: don't hijack hardware device private data

    commit c43435d7722134ed1fda58ce1025f41029bd58ad upstream.

    comedi_auto_config() associates a Comedi minor device number with an
    auto-configured hardware device and comedi_auto_unconfig() disassociates
    it.  Currently, these use the hardware device's private data pointer to
    point to some allocated storage holding the minor device number.  This
    is a bit of a waste of the hardware device's private data pointer,
    preventing it from being used for something more useful by the low-level
    comedi device drivers.  For example, it would make more sense if
    comedi_usb_auto_config() was passed a pointer to the struct
    usb_interface instead of the struct usb_device, but this cannot be done
    currently because the low-level comedi drivers already use the private
    data pointer in the struct usb_interface for something more useful.

    This patch stops the comedi core hijacking the hardware device's private
    data pointer.  Instead, comedi_auto_config() stores a pointer to the
    hardware device's struct device in the struct comedi_device_file_info
    associated with the minor device number, and comedi_auto_unconfig()
    calls new function comedi_find_board_minor() to recover the minor device
    number associated with the hardware device.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f387ee89aca7a06b376c27326afd114fe93e01c2
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Jan 7 10:27:13 2013 +0100

    Revert "drm/i915: no lvds quirk for Zotac ZDBOX SD ID12/ID13"

    commit 48e858340dae43189a4e55647f6eac736766f828 upstream.

    This reverts commit 9756fe38d10b2bf90c81dc4d2f17d5632e135364.

    The bogus lvds output is actually a lvds->hdmi bridge, which we don't
    really support. But unconditionally disabling it breaks some existing
    setups.

    Reported-by: John Tapsell <johnflux@gmail.com>
    References: http://permalink.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/17237
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Luis Henriques <luis.henriques@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d2fdadbde8314c8b55bb4a58af9584897298233
Author: Alexander Graf <agraf@suse.de>
Date:   Sat Oct 6 03:56:35 2012 +0200

    KVM: PPC: 44x: fix DCR read/write

    commit e43a028752fed049e4bd94ef895542f96d79fa74 upstream.

    When remembering the direction of a DCR transaction, we should write
    to the same variable that we interpret on later when doing vcpu_run
    again.

    Signed-off-by: Alexander Graf <agraf@suse.de>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5b8692bf7ca5beed9bb75cf97b47dc1d3e5691e2
Author: Woodhouse, David <david.woodhouse@intel.com>
Date:   Wed Dec 19 13:25:35 2012 +0000

    intel-iommu: Free old page tables before creating superpage

    commit 6491d4d02893d9787ba67279595990217177b351 upstream.

    The dma_pte_free_pagetable() function will only free a page table page
    if it is asked to free the *entire* 2MiB range that it covers. So if a
    page table page was used for one or more small mappings, it's likely to
    end up still present in the page tables... but with no valid PTEs.

    This was fine when we'd only be repopulating it with 4KiB PTEs anyway
    but the same virtual address range can end up being reused for a
    *large-page* mapping. And in that case were were trying to insert the
    large page into the second-level page table, and getting a complaint
    from the sanity check in __domain_mapping() because there was already a
    corresponding entry. This was *relatively* harmless; it led to a memory
    leak of the old page table page, but no other ill-effects.

    Fix it by calling dma_pte_clear_range (hopefully redundant) and
    dma_pte_free_pagetable() before setting up the new large page.

    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Tested-by: Ravi Murty <Ravi.Murty@intel.com>
    Tested-by: Sudeep Dutt <sudeep.dutt@intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d668f92bf357683de292ce7538fc7b1186354004
Author: Benjamin Marzinski <bmarzins@redhat.com>
Date:   Wed Nov 7 00:38:06 2012 -0600

    GFS2: Test bufdata with buffer locked and gfs2_log_lock held

    commit 96e5d1d3adf56f1c7eeb07258f6a1a0a7ae9c489 upstream.

    In gfs2_trans_add_bh(), gfs2 was testing if a there was a bd attached to the
    buffer without having the gfs2_log_lock held. It was then assuming it would
    stay attached for the rest of the function. However, without either the log
    lock being held of the buffer locked, __gfs2_ail_flush() could detach bd at any
    time.  This patch moves the locking before the test.  If there isn't a bd
    already attached, gfs2 can safely allocate one and attach it before locking.
    There is no way that the newly allocated bd could be on the ail list,
    and thus no way for __gfs2_ail_flush() to detach it.

    Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
    Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

commit 961161c905e212ed2510fb0612549a3d1aefb495
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Mon Dec 17 14:12:35 2012 -0800

    xhci: Handle HS bulk/ctrl endpoints that don't NAK.

    commit 55c1945edaac94c5338a3647bc2e85ff75d9cf36 upstream.

    A high speed control or bulk endpoint may have bInterval set to zero,
    which means it does not NAK.  If bInterval is non-zero, it means the
    endpoint NAKs at a rate of 2^(bInterval - 1).

    The xHCI code to compute the NAK interval does not handle the special
    case of zero properly.  The current code unconditionally subtracts one
    from bInterval and uses it as an exponent.  This causes a very large
    bInterval to be used, and warning messages like these will be printed:

    usb 1-1: ep 0x1 - rounding interval to 32768 microframes, ep desc says 0 microframes

    This may cause the xHCI host hardware to reject the Configure Endpoint
    command, which means the HS device will be unusable under xHCI ports.

    This patch should be backported to kernels as old as 2.6.31, that contain
    commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math in
    xhci_get_endpoint_interval()".

    Reported-by: Vincent Pelletier <plr.vincent@gmail.com>
    Suggested-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b30765e89105c321ed5a5259dc6b05752cbc8137
Author: Oliver Neukum <oliver@neukum.org>
Date:   Thu Nov 29 15:05:57 2012 +0100

    USB: hub: handle claim of enabled remote wakeup after reset

    commit 07e72b95f5038cc82304b9a4a2eb7f9fc391ea68 upstream.

    Some touchscreens have buggy firmware which claims
    remote wakeup to be enabled after a reset. They nevertheless
    crash if the feature is cleared by the host.
    Add a check for reset resume before checking for
    an enabled remote wakeup feature. On compliant
    devices the feature must be cleared after a reset anyway.

    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e16e202710af9cc74b01c60ea1e338e3e954e6ed
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Wed Nov 14 17:16:52 2012 -0800

    USB: Increase reset timeout.

    commit 77c7f072c87fa951e9a74805febf26466f31170c upstream.

    John's NEC 0.96 xHCI host controller needs a longer timeout for a warm
    reset to complete.  The logs show it takes 650ms to complete the warm
    reset, so extend the hub reset timeout to 800ms to be on the safe side.

    This commit should be backported to kernels as old as 3.2, that contain
    the commit 75d7cf72ab9fa01dc70877aa5c68e8ef477229dc "usbcore: refine
    warm reset logic".

    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: John Covici <covici@ccs.covici.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fca884e203ab0faf0e505f10d302ee0a2ffb54c7
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Tue Nov 20 13:23:15 2012 +0100

    usb: gadget: dummy: fix enumeration with g_multi

    commit 1d16638e3b9cc195bac18a8fcbca748f33c1bc24 upstream.

    If we do have endpoints named like "ep-a" then bEndpointAddress is
    counted internally by the gadget framework.

    If we do have endpoints named like "ep-1" then bEndpointAddress is
    assigned from the digit after "ep-".

    If we do have both, then it is likely that after we used up the
    "generic" endpoints we will use the digits and thus assign one
    bEndpointAddress to multiple endpoints.

    This theory can be proofed by using the completely enabled g_multi.
    Without this patch, the mass storage won't enumerate and times out
    because it shares endpoints with RNDIS.

    This patch also adds fills up the endpoints list so we have in total
    endpoints 1 to 15 in + out available while some of them are restricted
    to certain types like BULK or ISO. Without this change the nokia gadget
    won't load because the system does not provide enough (BULK) endpoints
    but it did before ep-a - ep-f were removed.

    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6d9a5f52d4604191d62f51b58ab7fd2320931f53
Author: Denis N Ladin <denladin@gmail.com>
Date:   Wed Dec 26 18:29:44 2012 +0500

    USB: cdc-acm: Add support for "PSC Scanning, Magellan 800i"

    commit 036915a7a402753c05b8d0529f5fd08805ab46d0 upstream.

    Adding support "PSC Scanning, Magellan 800i" in cdc-acm

    Very simple, but very necessary.
    Suitable for all versions of the kernel > 2.6

    Signed-off-by: Denis N Ladin <denladin@gmail.com>
    Acked-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit edce154f05d0c7e474e01c833d4c3522987fa125
Author: Tomasz Mloduchowski <q@qdot.me>
Date:   Sun Jan 13 23:32:53 2013 +0100

    usb: ftdi_sio: Crucible Technologies COMET Caller ID - pid added

    commit 8cf65dc386f3634a43312f436cc7a935476a40c4 upstream.

    Simple fix to add support for Crucible Technologies COMET Caller ID
    USB decoder - a device containing FTDI USB/Serial converter chip,
    handling 1200bps CallerID messages decoded from the phone line -
    adding correct USB PID is sufficient.

    Tested to apply cleanly and work flawlessly against 3.6.9, 3.7.0-rc8
    and 3.8.0-rc3 on both amd64 and x86 arches.

    Signed-off-by: Tomasz Mloduchowski <q@qdot.me>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 54923deb52fa43659a0f0c9edc7cec13201c9663
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Dec 28 17:29:52 2012 +0100

    USB: option: add Telekom Speedstick LTE II

    commit 5ec0085440ef8c2cf50002b34d5a504ee12aa2bf upstream.

    also known as Alcatel One Touch L100V LTE

    The driver description files gives these names to the vendor specific
    functions on this modem:

     Application1: VID_1BBB&PID_011E&MI_00
     Application2: VID_1BBB&PID_011E&MI_01
     Modem:        VID_1BBB&PID_011E&MI_03
     Ethernet:     VID_1BBB&PID_011E&MI_04

    Reported-by: Thomas Schäfer <tschaefer@t-online.de>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 40d3aadc78529b6a1fb37b5ed554d041d80ceafa
Author: Quentin.Li <snowmanli88@163.com>
Date:   Wed Dec 26 16:58:22 2012 +0800

    USB: option: Add new MEDIATEK PID support

    commit 94a85b633829b946eef53fc1825d526312fb856f upstream.

    In option.c, add some new MEDIATEK PIDs support for MEDIATEK new products. This
    is a MEDIATEK inc. release patch.

    Signed-off-by: Quentin.Li <snowmanli88@163.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eaf103dbb8e51967bdee9ea89059176ea4c87465
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Dec 19 15:15:17 2012 +0100

    USB: option: blacklist network interface on ZTE MF880

    commit fab38246f318edcd0dcb8fd3852a47cf8938878a upstream.

    The driver description files gives these names to the vendor specific
    functions on this modem:

     diag: VID_19D2&PID_0284&MI_00
     nmea: VID_19D2&PID_0284&MI_01
     at:   VID_19D2&PID_0284&MI_02
     mdm:  VID_19D2&PID_0284&MI_03
     net:  VID_19D2&PID_0284&MI_04

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aa6e90f665c2551aa20892e225fb2dc12be25c8a
Author: Dzianis Kahanovich <mahatma@bspu.unibel.by>
Date:   Mon Dec 3 16:06:26 2012 +0300

    USB: option: add Nexpring NP10T terminal id

    commit ad86e58661b38b279b7519d4e49c7a19dc1654bb upstream.

    Hyundai Petatel Inc. Nexpring NP10T terminal (EV-DO rev.A USB modem) ID

    Signed-off-by: Denis Kaganovich <mahatma@eu.by>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e2bd12a24c248e9b31af76f18f01c88ae32cd95
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Dec 13 23:08:52 2012 +0100

    mac80211: use del_timer_sync for final sta cleanup timer deletion

    commit a56f992cdabc63f56b4b142885deebebf936ff76 upstream.

    This is a very old bug, but there's nothing that prevents the
    timer from running while the module is being removed when we
    only do del_timer() instead of del_timer_sync().

    The timer should normally not be running at this point, but
    it's not clearly impossible (or we could just remove this.)

    Tested-by: Ben Greear <greearb@candelatech.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0c3b520e7407b92ebdcc21b80c8f7f8539601ae3
Author: Jerome Glisse <jglisse@redhat.com>
Date:   Tue Jan 8 18:41:01 2013 -0500

    radeon/kms: force rn50 chip to always report connected on analog output

    commit 51861d4eebc2ddc25c77084343d060fa79f6e291 upstream.

    Those rn50 chip are often connected to console remoting hw and load
    detection often fails with those. Just don't try to load detect and
    report connect.

    Signed-off-by: Jerome Glisse <jglisse@redhat.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71a1306551e811989c0164c614845fea352d8b57
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Mon Jan 7 22:03:51 2013 +0100

    staging: speakup: avoid out-of-range access in synth_add()

    commit 6102c48bd421074a33e102f2ebda3724e8d275f9 upstream.

    Check that array index is in-bounds before accessing the synths[] array.

    Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Cc: Nickolai Zeldovich <nickolai@csail.mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36aa8707613d57452ebfda30812e8715f019c453
Author: Nickolai Zeldovich <nickolai@csail.mit.edu>
Date:   Sat Jan 5 14:17:45 2013 -0500

    staging: speakup: avoid out-of-range access in synth_init()

    commit ae428655b826f2755a8101b27beda42a275ef8ad upstream.

    Check that array index is in-bounds before accessing the synths[] array.

    Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
    Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30571057bbec7bd1f2850f308d131eba4c432225
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Sat Dec 29 11:36:53 2012 -0600

    staging: r8712u: Add new device ID

    commit da849a92d3bafaf24d770e971c2c9e5c3f60b5d1 upstream.

    The ISY IWL 1000 USB WLAN stick with USB ID 050d:11f1 is a clone of
    the Belkin F7D1101 V1 device.

    Reported-by: Thomas Hartmann <hartmann@ict.tuwien.ac.at>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Thomas Hartmann <hartmann@ict.tuwien.ac.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d8a66efb832e17e906415a4e563182258cc0ab2
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Fri Jan 4 11:33:21 2013 +0000

    staging: comedi: comedi_test: fix race when cancelling command

    commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream.

    Éric Piel reported a kernel oops in the "comedi_test" module.  It was a
    NULL pointer dereference within `waveform_ai_interrupt()` (actually a
    timer function) that sometimes occurred when a running asynchronous
    command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing
    the device file).

    This seems to be a race between the caller of `waveform_ai_cancel()`
    which on return from that function goes and tears down the running
    command, and the timer function which uses the command.  In particular,
    `async->cmd.chanlist` gets freed (and the pointer set to NULL) by
    `do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled
    `waveform_ai_interrupt()` timer function will dereference that pointer
    regardless, leading to the oops.

    Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()`
    with `del_timer_sync()`.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Reported-by: Éric Piel <piel@delmic.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf302ba15f9fc5fa2d84c6eaa2e740a0e0bb596b
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Tue Dec 4 15:59:55 2012 +0000

    staging: comedi: prevent auto-unconfig of manually configured devices

    commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c upstream.

    When a low-level comedi driver auto-configures a device, a `struct
    comedi_dev_file_info` is allocated (as well as a `struct
    comedi_device`) by `comedi_alloc_board_minor()`.  A pointer to the
    hardware `struct device` is stored as a cookie in the `struct
    comedi_dev_file_info`.  When the low-level comedi driver
    auto-unconfigures the device, `comedi_auto_unconfig()` uses the cookie
    to find the `struct comedi_dev_file_info` so it can detach the comedi
    device from the driver, clean it up and free it.

    A problem arises if the user manually unconfigures and reconfigures the
    comedi device using the `COMEDI_DEVCONFIG` ioctl so that is no longer
    associated with the original hardware device.  The problem is that the
    cookie is not cleared, so that a call to `comedi_auto_unconfig()` from
    the low-level driver will still find it, detach it, clean it up and free
    it.

    Stop this problem occurring by always clearing the `hardware_device`
    cookie in the `struct comedi_dev_file_info` whenever the
    `COMEDI_DEVCONFIG` ioctl call is successful.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e2abf662bcedc0be6f73e7575cc203a5e3c9262c
Author: Mike Dunn <mikedunn@newsguy.com>
Date:   Mon Jan 7 13:55:12 2013 -0800

    ALSA: pxa27x: fix ac97 cold reset

    commit 41b645c8624df6ace020a8863ad1449d69140f7d upstream.

    Cold reset on the pxa27x currently fails and

         pxa2xx_ac97_try_cold_reset: cold reset timeout (GSR=0x44)

    appears in the kernel log.  Through trial-and-error (the pxa270 developer's
    manual is mostly incoherent on the topic of ac97 reset), I got cold reset to
    complete by setting the WARM_RST bit in the GCR register (and later noticed that
    pxa3xx does this for cold reset as well).  Also, a timeout loop is needed to
    wait for the reset to complete.

    Tested on a palm treo 680 machine.

    Signed-off-by: Mike Dunn <mikedunn@newsguy.com>
    Acked-by: Igor Grinberg <grinberg@compulab.co.il>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 639fd95292222bf03e1bb8616437b261321e1536
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Fri Jan 4 21:18:12 2013 +0000

    ASoC: wm2000: Fix sense of speech clarity enable

    commit 267f8fa2e1eef0612b2007e1f1846bcbc35cc1fa upstream.

    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 93b40265d0c287271b19320574a76070d76d5a3b
Author: Eric Wong <normalperson@yhbt.net>
Date:   Tue Jan 1 21:20:27 2013 +0000

    epoll: prevent missed events on EPOLL_CTL_MOD

    commit 128dd1759d96ad36c379240f8b9463e8acfd37a1 upstream.

    EPOLL_CTL_MOD sets the interest mask before calling f_op->poll() to
    ensure events are not missed.  Since the modifications to the interest
    mask are not protected by the same lock as ep_poll_callback, we need to
    ensure the change is visible to other CPUs calling ep_poll_callback.

    We also need to ensure f_op->poll() has an up-to-date view of past
    events which occured before we modified the interest mask.  So this
    barrier also pairs with the barrier in wq_has_sleeper().

    This should guarantee either ep_poll_callback or f_op->poll() (or both)
    will notice the readiness of a recently-ready/modified item.

    This issue was encountered by Andreas Voellmy and Junchang(Jason) Wang in:
    http://thread.gmane.org/gmane.linux.kernel/1408782/

    Signed-off-by: Eric Wong <normalperson@yhbt.net>
    Cc: Hans Verkuil <hans.verkuil@cisco.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Jonathan Corbet <corbet@lwn.net>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Davide Libenzi <davidel@xmailserver.org>
    Cc: Hans de Goede <hdegoede@redhat.com>
    Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
    Cc: David Miller <davem@davemloft.net>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Andreas Voellmy <andreas.voellmy@yale.edu>
    Tested-by: "Junchang(Jason) Wang" <junchang.wang@yale.edu>
    Cc: netdev@vger.kernel.org
    Cc: linux-fsdevel@vger.kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b18401af7f51cddd5d2e03c9b800ba7dd60f18a0
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Fri Jan 4 00:34:22 2013 +0000

    rtnetlink: fix rtnl_calcit() and rtnl_dump_ifinfo()

    commit a4b64fbe482c7766f7925f03067fc637716bfa3f upstream.

    nlmsg_parse() might return an error, so test its return value before
    potential random memory accesses.

    Errors introduced in commit 115c9b81928 (rtnetlink: Fix problem with
    buffer allocation)

    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Acked-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0d3aa1f04a7430fc80f6f1a7aaaaf495da8d8e1
Author: Greg Rose <gregory.v.rose@intel.com>
Date:   Fri Jan 4 00:33:34 2013 +0000

    rtnetlink: Fix problem with buffer allocation

    commit 115c9b81928360d769a76c632bae62d15206a94a upstream.

    Implement a new netlink attribute type IFLA_EXT_MASK.  The mask
    is a 32 bit value that can be used to indicate to the kernel that
    certain extended ifinfo values are requested by the user application.
    At this time the only mask value defined is RTEXT_FILTER_VF to
    indicate that the user wants the ifinfo dump to send information
    about the VFs belonging to the interface.

    This patch fixes a bug in which certain applications do not have
    large enough buffers to accommodate the extra information returned
    by the kernel with large numbers of SR-IOV virtual functions.
    Those applications will not send the new netlink attribute with
    the interface info dump request netlink messages so they will
    not get unexpectedly large request buffers returned by the kernel.

    Modifies the rtnl_calcit function to traverse the list of net
    devices and compute the minimum buffer size that can hold the
    info dumps of all matching devices based upon the filter passed
    in via the new netlink attribute filter mask.  If no filter
    mask is sent then the buffer allocation defaults to NLMSG_GOODSIZE.

    With this change it is possible to add yet to be defined netlink
    attributes to the dump request which should make it fairly extensible
    in the future.

    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Acked-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.0:
     - Adjust context
     - Drop the change in do_setlink() that reverts commit f18da1456581
       ('net: RTNETLINK adjusting values of min_ifinfo_dump_size'), which
       was never applied here]
    Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e3cbdeae8e4d13087657d95ed7a5be57dc9695e
Author: Greg Rose <gregory.v.rose@intel.com>
Date:   Fri Jan 4 00:32:54 2013 +0000

    rtnetlink: Compute and store minimum ifinfo dump size

    commit c7ac8679bec9397afe8918f788cbcef88c38da54 upstream.

    The message size allocated for rtnl ifinfo dumps was limited to
    a single page.  This is not enough for additional interface info
    available with devices that support SR-IOV and caused a bug in
    which VF info would not be displayed if more than approximately
    40 VFs were created per interface.

    Implement a new function pointer for the rtnl_register service that will
    calculate the amount of data required for the ifinfo dump and allocate
    enough data to satisfy the request.

    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Cc: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a6cf0c4f4f8465d61adbf3aaaec2bd100e30d97
Author: Zhang Rui <rui.zhang@intel.com>
Date:   Tue Dec 4 23:23:16 2012 +0100

    ACPI : do not use Lid and Sleep button for S5 wakeup

    commit b7e383046c2c7c13ad928cd7407eafff758ddd4b upstream.

    When system enters power off, the _PSW of Lid device is enabled.
    But this may cause the system to reboot instead of power off.

    A proper way to fix this is to always disable lid wakeup capability for S5.

    References: https://bugzilla.kernel.org/show_bug.cgi?id=35262
    Signed-off-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Cc: Joseph Salisbury <joseph.salisbury@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e3fe67e02c53e5a5fcf0e2b0d91dd93f757d50b
Author: Andre Przywara <andre.przywara@amd.com>
Date:   Wed Oct 31 17:20:50 2012 +0100

    x86, amd: Disable way access filter on Piledriver CPUs

    commit 2bbf0a1427c377350f001fbc6260995334739ad7 upstream.

    The Way Access Filter in recent AMD CPUs may hurt the performance of
    some workloads, caused by aliasing issues in the L1 cache.
    This patch disables it on the affected CPUs.

    The issue is similar to that one of last year:
    http://lkml.indiana.edu/hypermail/linux/kernel/1107.3/00041.html
    This new patch does not replace the old one, we just need another
    quirk for newer CPUs.

    The performance penalty without the patch depends on the
    circumstances, but is a bit less than the last year's 3%.

    The workloads affected would be those that access code from the same
    physical page under different virtual addresses, so different
    processes using the same libraries with ASLR or multiple instances of
    PIE-binaries. The code needs to be accessed simultaneously from both
    cores of the same compute unit.

    More details can be found here:
    http://developer.amd.com/Assets/SharedL1InstructionCacheonAMD15hCPU.pdf

    CPUs affected are anything with the core known as Piledriver.
    That includes the new parts of the AMD A-Series (aka Trinity) and the
    just released new CPUs of the FX-Series (aka Vishera).
    The model numbering is a bit odd here: FX CPUs have model 2,
    A-Series has model 10h, with possible extensions to 1Fh. Hence the
    range of model ids.

    Signed-off-by: Andre Przywara <osp@andrep.de>
    Link: http://lkml.kernel.org/r/1351700450-9277-1-git-send-email-osp@andrep.de
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 457a972f3038b8de2eba76dc4b7f9117f1084f7e
Author: David Rientjes <rientjes@google.com>
Date:   Tue May 29 15:06:23 2012 -0700

    thp, memcg: split hugepage for memcg oom on cow

    commit 1f1d06c34f7675026326cd9f39ff91e4555cf355 upstream.

    On COW, a new hugepage is allocated and charged to the memcg.  If the
    system is oom or the charge to the memcg fails, however, the fault
    handler will return VM_FAULT_OOM which results in an oom kill.

    Instead, it's possible to fallback to splitting the hugepage so that the
    COW results only in an order-0 page being allocated and charged to the
    memcg which has a higher liklihood to succeed.  This is expensive
    because the hugepage must be split in the page fault handler, but it is
    much better than unnecessarily oom killing a process.

    Signed-off-by: David Rientjes <rientjes@google.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: Michal Hocko <mhocko@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cdfcbd8d74fdfd7a0d55330a1b60411b153ae71b
Author: Namjae Jeon <namjae.jeon@samsung.com>
Date:   Wed Oct 10 00:09:12 2012 +0900

    udf: don't increment lenExtents while writing to a hole

    commit fb719c59bdb4fca86ee1fd1f42ab3735ca12b6b2 upstream.

    Incrementing lenExtents even while writing to a hole is bad
    for performance as calls to udf_discard_prealloc and
    udf_truncate_tail_extent would not return from start if
    isize != lenExtents

    Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
    Signed-off-by: Ashish Sangwan <a.sangwan@samsung.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Shuah Khan <shuah.khan@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit de3ecca3e3d55f2bb3118839a8fd709362d55678
Author: Namjae Jeon <namjae.jeon@samsung.com>
Date:   Wed Oct 10 00:08:56 2012 +0900

    udf: fix memory leak while allocating blocks during write

    commit 2fb7d99d0de3fd8ae869f35ab682581d8455887a upstream.

    Need to brelse the buffer_head stored in cur_epos and next_epos.

    Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
    Signed-off-by: Ashish Sangwan <a.sangwan@samsung.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Shuah Khan <shuah.khan@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 39a731949954614cea44b92e80bbb4bb54832785
Author: Ed Cashin <ecashin@coraid.com>
Date:   Sat Jan 12 06:43:35 2013 -0500

    aoe: do not call bdi_init after blk_alloc_queue

    commit 0a41409c518083133e79015092585d68915865be upstream, but doesn't
    apply, so this version is different for older kernels than 3.7.x

    blk_alloc_queue has already done a bdi_init, so do not bdi_init
    again in aoeblk_gdalloc.  The extra call causes list corruption
    in the per-CPU backing dev info stats lists.

    Affected users see console WARNINGs about list_del corruption on
    percpu_counter_destroy when doing "rmmod aoe" or "aoeflush -a"
    when AoE targets have been detected and initialized by the
    system.

    The patch below applies to v3.6.11, with its v47 aoe driver.  It
    is expected to apply to all currently maintained stable kernels
    except 3.7.y.  A related but different fix has been posted for
    3.7.y.

    References:

      RedHat bugzilla ticket with original report
      https://bugzilla.redhat.com/show_bug.cgi?id=853064

      LKML discussion of bug and fix
      http://thread.gmane.org/gmane.linux.kernel/1416336/focus=1416497

    Reported-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Ed Cashin <ecashin@coraid.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a4202fd727f6bf57827061104a60307e78124ea2
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Thu Dec 27 01:42:48 2012 -0500

    ext4: lock i_mutex when truncating orphan inodes

    commit 721e3eba21e43532e438652dd8f1fcdfce3187e7 upstream.

    Commit c278531d39 added a warning when ext4_flush_unwritten_io() is
    called without i_mutex being taken.  It had previously not been taken
    during orphan cleanup since races weren't possible at that point in
    the mount process, but as a result of this c278531d39, we will now see
    a kernel WARN_ON in this case.  Take the i_mutex in
    ext4_orphan_cleanup() to suppress this warning.

    Reported-by: Alexander Beregalov <a.beregalov@gmail.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Reviewed-by: Zheng Liu <wenqing.lz@taobao.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ba9a27ec24b133799bc1b8a77d733c4015d0abd
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Tue Dec 25 14:08:16 2012 -0500

    ext4: do not try to write superblock on ro remount w/o journal

    commit d096ad0f79a782935d2e06ae8fb235e8c5397775 upstream.

    When a journal-less ext4 filesystem is mounted on a read-only block
    device (blockdev --setro will do), each remount (for other, unrelated,
    flags, like suid=>nosuid etc) results in a series of scary messages
    from kernel telling about I/O errors on the device.

    This is becauese of the following code ext4_remount():

           if (sbi->s_journal == NULL)
                    ext4_commit_super(sb, 1);

    at the end of remount procedure, which forces writing (flushing) of
    a superblock regardless whenever it is dirty or not, if the filesystem
    is readonly or not, and whenever the device itself is readonly or not.

    We only need call ext4_commit_super when the file system had been
    previously mounted read/write.

    Thanks to Eric Sandeen for help in diagnosing this issue.

    Signed-off-By: Michael Tokarev <mjt@tls.msk.ru>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c558b7eb837ca7bc014af2f5509be143c3c3670
Author: Jan Kara <jack@suse.cz>
Date:   Fri Dec 21 00:15:51 2012 -0500

    jbd2: fix assertion failure in jbd2_journal_flush()

    commit d7961c7fa4d2e3c3f12be67e21ba8799b5a7238a upstream.

    The following race is possible between start_this_handle() and someone
    calling jbd2_journal_flush().

    Process A                              Process B
    start_this_handle().
      if (journal->j_barrier_count) # false
      if (!journal->j_running_transaction) { #true
        read_unlock(&journal->j_state_lock);
                                           jbd2_journal_lock_updates()
                                           jbd2_journal_flush()
                                             write_lock(&journal->j_state_lock);
                                             if (journal->j_running_transaction) {
                                               # false
                                             ... wait for committing trans ...
                                             write_unlock(&journal->j_state_lock);
        ...
        write_lock(&journal->j_state_lock);
        if (!journal->j_running_transaction) { # true
          jbd2_get_transaction(journal, new_transaction);
        write_unlock(&journal->j_state_lock);
        goto repeat; # eventually blocks on j_barrier_count > 0
                                             ...
                                             J_ASSERT(!journal->j_running_transaction);
                                               # fails

    We fix the race by rechecking j_barrier_count after reacquiring j_state_lock
    in exclusive mode.

    Reported-by: yjwsignal@empal.com
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8cbe63802ddac6b242e4a4293fc338fa7808272c
Author: Forrest Liu <forrestl@synology.com>
Date:   Mon Dec 17 09:55:39 2012 -0500

    ext4: fix extent tree corruption caused by hole punch

    commit c36575e663e302dbaa4d16b9c72d2c9a913a9aef upstream.

    When depth of extent tree is greater than 1, logical start value of
    interior node is not correctly updated in ext4_ext_rm_idx.

    Signed-off-by: Forrest Liu <forrestl@synology.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Reviewed-by: Ashish Sangwan <ashishsangwan2@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc65b0bb8b56913b0610588d83c78d0e5e968e9d
Author: Lothar Waßmann <LW@KARO-electronics.de>
Date:   Thu Nov 22 13:49:14 2012 +0100

    video: mxsfb: fix crash when unblanking the display

    commit 6c1ecba8d84841277d68140ef485335d5be28485 upstream.

    The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature.
    The write in mxsfb_disable_controller() sets the data_cnt for the LCD
    DMA to 0 which obviously means the max. count for the LCD DMA and
    leads to overwriting arbitrary memory when the display is unblanked.

    Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
    Acked-by: Juergen Beisert <jbe@pengutronix.de>
    Tested-by: Lauri Hintsala <lauri.hintsala@bluegiga.net>
    Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f125f803570b6e617ea417d08091703e81951d87
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Nov 11 16:07:57 2012 +0000

    staging: vt6656: 64bit fixes: vCommandTimerWait change calculation of timer.

    commit 70e227790d4ee4590023d8041a3485f8053593fc upstream.

    The timer appears to run too fast/race on 64 bit systems.

    Using msecs_to_jiffies seems to cause a deadlock on 64 bit.

    A calculation of (MSecond * HZ) / 1000 appears to run satisfactory.

    Change BSSIDInfoCount to u32.

    After this patch the driver can be successfully connect on little endian 64/32 bit systems.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit afaac0d6cd73f303df1e456905de6a4364d2a81d
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Nov 11 15:49:59 2012 +0000

    staging: vt6656: 64bit fixes: key.c/h change unsigned long to u32

    commit c0d05b305b00c698b0a8c1b3d46c9380bce9db45 upstream.

    Fixes long issues.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 355bda552316d6ae9fc87e25a915e5fcf90167d3
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Nov 11 15:45:52 2012 +0000

    staging: vt6656: 64 bit fixes: fix long warning messages.

    commit b4dc03af5513774277c9c36b12a25cd3f25f4404 upstream.

    Fixes long warning messages from patch
    [PATCH 08/14] staging: vt6656: 64 bit fixes : correct all type sizes

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f25b87741e96bfdd732cb7680fe0b251877ea362
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Nov 11 15:41:25 2012 +0000

    staging: vt6656: 64 bit fixes : correct all type sizes

    commit 7730492855a2f9c828599bcd8d62760f96d319e4 upstream.

    After this patch all BYTE/WORD/DWORD types can be replaced with the appropriate u sizes.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4f668e4c2635b8a33feed913ccbe7a8a1b5ead05
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Nov 11 15:32:05 2012 +0000

    staging: vt6656: 64 bit fixes: use u32 for QWORD definition.

    commit a552397d5e4ef0cc0bd3e9595d6acc9a3b381171 upstream.

    Size of long issues replace with u32.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a32f2fed9432a39357bfcf392849f0e233639727
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Oct 7 08:27:00 2012 +0100

    staging: vt6656: [BUG] out of bound array reference in RFbSetPower.

    commit ab1dd9963137a1e122004d5378a581bf16ae9bc8 upstream.

    Calling RFbSetPower with uCH zero value will cause out of bound array reference.

    This causes 64 bit kernels to oops on boot.

    Note: Driver does not function on 64 bit kernels and should be
    blacklisted on them.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1cf819361e77cff23d4385775a6f120cabe29839
Author: Alasdair G Kergon <agk@redhat.com>
Date:   Fri Dec 21 20:23:30 2012 +0000

    dm ioctl: prevent unsafe change to dm_ioctl data_size

    commit e910d7ebecd1aac43125944a8641b6cb1a0dfabe upstream.

    Abort dm ioctl processing if userspace changes the data_size parameter
    after we validated it but before we finished copying the data buffer
    from userspace.

    The dm ioctl parameters are processed in the following sequence:
     1. ctl_ioctl() calls copy_params();
     2. copy_params() makes a first copy of the fixed-sized portion of the
        userspace parameters into the local variable "tmp";
     3. copy_params() then validates tmp.data_size and allocates a new
        structure big enough to hold the complete data and copies the whole
        userspace buffer there;
     4. ctl_ioctl() reads userspace data the second time and copies the whole
        buffer into the pointer "param";
     5. ctl_ioctl() reads param->data_size without any validation and stores it
        in the variable "input_param_size";
     6. "input_param_size" is further used as the authoritative size of the
        kernel buffer.

    The problem is that userspace code could change the contents of user
    memory between steps 2 and 4.  In particular, the data_size parameter
    can be changed to an invalid value after the kernel has validated it.
    This lets userspace force the kernel to access invalid kernel memory.

    The fix is to ensure that the size has not changed at step 4.

    This patch shouldn't have a security impact because CAP_SYS_ADMIN is
    required to run this code, but it should be fixed anyway.

    Reported-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61cdfbb6eb92943c61cb1d6f812c3f20435cddde
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Thu Nov 29 22:31:16 2012 -0500

    ring-buffer: Fix race between integrity check and readers

    commit 9366c1ba13fbc41bdb57702e75ca4382f209c82f upstream.

    The function rb_check_pages() was added to make sure the ring buffer's
    pages were sane. This check is done when the ring buffer size is modified
    as well as when the iterator is released (closing the "trace" file),
    as that was considered a non fast path and a good place to do a sanity
    check.

    The problem is that the check does not have any locks around it.
    If one process were to read the trace file, and another were to read
    the raw binary file, the check could happen while the reader is reading
    the file.

    The issues with this is that the check requires to clear the HEAD page
    before doing the full check and it restores it afterward. But readers
    require the HEAD page to exist before it can read the buffer, otherwise
    it gives a nasty warning and disables the buffer.

    By adding the reader lock around the check, this keeps the race from
    happening.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 39126acfb3cdd46a51f5dd940a4d69cccbf4a473
Author: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
Date:   Thu Dec 6 19:58:27 2012 +0000

    RDMA/nes: Fix for terminate timer crash

    commit 7bfcfa51c35cdd2d37e0d70fc11790642dd11fb3 upstream.

    The terminate timer needs to be initialized just once.

    Signed-off-by: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 84181e48b7fd15d47ca85b711ee363da5e1fe108
Author: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
Date:   Thu Dec 6 20:05:02 2012 +0000

    RDMA/nes: Fix for crash when registering zero length MR for CQ

    commit 7d9c199a55200c9b9fcad08e150470d02fb385be upstream.

    Signed-off-by: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f03ef102300ce1ac5744f2cee8e48825d6350222
Author: Paulo Zanoni <paulo.r.zanoni@intel.com>
Date:   Tue Nov 20 13:27:41 2012 -0200

    drm/i915: make the panel fitter work on pipes B and C on IVB

    commit 13888d78c664a1f61d7b09d282f5916993827a40 upstream.

    I actually found this problem on Haswell, but then discovered Ivy
    Bridge also has it by reading the spec.

    I don't have the hardware to test this.

    Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
    Reviewed-by: Damien Lespiau <damien.lespiau@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 03bdf8eeff05f6f0a31b7ef387809171722aec8c
Author: Dan Williams <dcbw@redhat.com>
Date:   Fri Dec 14 13:10:50 2012 +0000

    i2400m: add Intel 6150 device IDs

    commit 999a7c5776a0ed2133645fa7e008bec05bda9254 upstream.

    Add device IDs for WiMAX function of Intel 6150 cards.

    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 43f5d330de7b4238cd4c0b3f287218e1734332af
Author: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date:   Mon Nov 5 22:40:14 2012 +0400

    jffs2: hold erase_completion_lock on exit

    commit 2cbba75a56ea78e6876b4e2547a882f10b3fe72b upstream.

    Users of jffs2_do_reserve_space() expect they still held
    erase_completion_lock after call to it. But there is a path
    where jffs2_do_reserve_space() leaves erase_completion_lock unlocked.
    The patch fixes it.

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 113b47f82db411f22e10cfa374328031cc394976
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Fri Jan 4 12:23:21 2013 -0500

    SUNRPC: Ensure that we free the rpc_task after cleanups are done

    commit c6567ed1402c55e19b012e66a8398baec2a726f3 upstream.

    This patch ensures that we free the rpc_task after the cleanup callbacks
    are done in order to avoid a deadlock problem that can be triggered if
    the callback needs to wait for another workqueue item to complete.

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Weston Andros Adamson <dros@netapp.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Bruce Fields <bfields@fieldses.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d4cbf806eaefbf4a8a63de492a060e06b07f5a6
Author: Eugene Shatokhin <eugene.shatokhin@rosalab.ru>
Date:   Thu Nov 8 15:11:11 2012 -0500

    ext4: fix memory leak in ext4_xattr_set_acl()'s error path

    commit 24ec19b0ae83a385ad9c55520716da671274b96c upstream.

    In ext4_xattr_set_acl(), if ext4_journal_start() returns an error,
    posix_acl_release() will not be called for 'acl' which may result in a
    memory leak.

    This patch fixes that.

    Reviewed-by: Lukas Czerner <lczerner@redhat.com>
    Signed-off-by: Eugene Shatokhin <eugene.shatokhin@rosalab.ru>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2c4427689134e7bce111584eef33122a14f77e9f
Author: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Date:   Fri Nov 9 16:15:28 2012 +0000

    mfd: Only unregister platform devices allocated by the mfd core

    commit b9fbb62eb61452d728c39b2e5020739c575aac53 upstream.

    mfd_remove_devices would iterate over all devices sharing a parent with
    an mfd device regardless of whether they were allocated by the mfd core
    or not. This especially caused problems when the device structure was
    not contained within a platform_device, because to_platform_device is
    used on each device pointer.

    This patch defines a device_type for mfd devices and checks this is
    present from mfd_remove_devices_fn before processing the device.

    Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Tested-by: Peter Tyser <ptyser@xes-inc.com>
    Reviewed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 52ae560ee055f41b4631db337c509040cf1d5109
Author: Yi Zou <yi.zou@intel.com>
Date:   Mon Dec 10 17:04:00 2012 -0800

    target/tcm_fc: fix the lockdep warning due to inconsistent lock state

    commit 9f4ad44b264f8bb61ffdd607148215566568430d upstream.

    The lockdep warning below is in theory correct but it will be in really weird
    rare situation that ends up that deadlock since the tcm fc session is hashed
    based the rport id. Nonetheless, the complaining below is about rcu callback
    that does the transport_deregister_session() is happening in softirq, where
    transport_register_session() that happens earlier is not. This triggers the
    lockdep warning below. So, just fix this to make lockdep happy by disabling
    the soft irq before calling transport_register_session() in ft_prli.

    BTW, this was found in FCoE VN2VN over two VMs, couple of create and destroy
    would get this triggered.

    v1: was enforcing register to be in softirq context which was not righ. See,
    http://www.spinics.net/lists/target-devel/msg03614.html

    v2: following comments from Roland&Nick (thanks), it seems we don't have to
    do transport_deregister_session() in rcu callback, so move it into ft_sess_free()
    but still do kfree() of the corresponding ft_sess struct in rcu callback to
    make sure the ft_sess is not freed till the rcu callback.

    ...
    [ 1328.370592] scsi2 : FCoE Driver
    [ 1328.383429] fcoe: No FDMI support.
    [ 1328.384509] host2: libfc: Link up on port (000000)
    [ 1328.934229] host2: Assigned Port ID 00a292
    [ 1357.232132] host2: rport 00a393: Remove port
    [ 1357.232568] host2: rport 00a393: Port sending LOGO from Ready state
    [ 1357.233692] host2: rport 00a393: Delete port
    [ 1357.234472] host2: rport 00a393: work event 3
    [ 1357.234969] host2: rport 00a393: callback ev 3
    [ 1357.235979] host2: rport 00a393: Received a LOGO response closed
    [ 1357.236706] host2: rport 00a393: work delete
    [ 1357.237481]
    [ 1357.237631] =================================
    [ 1357.238064] [ INFO: inconsistent lock state ]
    [ 1357.238450] 3.7.0-rc7-yikvm+ #3 Tainted: G           O
    [ 1357.238450] ---------------------------------
    [ 1357.238450] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
    [ 1357.238450] ksoftirqd/0/3 [HC0[0]:SC1[1]:HE0:SE0] takes:
    [ 1357.238450]  (&(&se_tpg->session_lock)->rlock){+.?...}, at: [<ffffffffa01eacd4>] transport_deregister_session+0x41/0x148 [target_core_mod]
    [ 1357.238450] {SOFTIRQ-ON-W} state was registered at:
    [ 1357.238450]   [<ffffffff810834f5>] mark_held_locks+0x6d/0x95
    [ 1357.238450]   [<ffffffff8108364a>] trace_hardirqs_on_caller+0x12d/0x197
    [ 1357.238450]   [<ffffffff810836c1>] trace_hardirqs_on+0xd/0xf
    [ 1357.238450]   [<ffffffff8149caba>] _raw_spin_unlock_irq+0x2d/0x45
    [ 1357.238450]   [<ffffffffa01e8d10>] __transport_register_session+0xb8/0x122 [target_core_mod]
    [ 1357.238450]   [<ffffffffa01e8dbe>] transport_register_session+0x44/0x5a [target_core_mod]
    [ 1357.238450]   [<ffffffffa018e32c>] ft_prli+0x1e3/0x275 [tcm_fc]
    [ 1357.238450]   [<ffffffffa0160e8d>] fc_rport_recv_req+0x95e/0xdc5 [libfc]
    [ 1357.238450]   [<ffffffffa015be88>] fc_lport_recv_els_req+0xc4/0xd5 [libfc]
    [ 1357.238450]   [<ffffffffa015c778>] fc_lport_recv_req+0x12f/0x18f [libfc]
    [ 1357.238450]   [<ffffffffa015a6d7>] fc_exch_recv+0x8ba/0x981 [libfc]
    [ 1357.238450]   [<ffffffffa0176d7a>] fcoe_percpu_receive_thread+0x47a/0x4e2 [fcoe]
    [ 1357.238450]   [<ffffffff810549f1>] kthread+0xb1/0xb9
    [ 1357.238450]   [<ffffffff814a40ec>] ret_from_fork+0x7c/0xb0
    [ 1357.238450] irq event stamp: 275411
    [ 1357.238450] hardirqs last  enabled at (275410): [<ffffffff810bb6a0>] rcu_process_callbacks+0x229/0x42a
    [ 1357.238450] hardirqs last disabled at (275411): [<ffffffff8149c2f7>] _raw_spin_lock_irqsave+0x22/0x8e
    [ 1357.238450] softirqs last  enabled at (275394): [<ffffffff8103d669>] __do_softirq+0x246/0x26f
    [ 1357.238450] softirqs last disabled at (275399): [<ffffffff8103d6bb>] run_ksoftirqd+0x29/0x62
    [ 1357.238450]
    [ 1357.238450] other info that might help us debug this:
    [ 1357.238450]  Possible unsafe locking scenario:
    [ 1357.238450]
    [ 1357.238450]        CPU0
    [ 1357.238450]        ----
    [ 1357.238450]   lock(&(&se_tpg->session_lock)->rlock);
    [ 1357.238450]   <Interrupt>
    [ 1357.238450]     lock(&(&se_tpg->session_lock)->rlock);
    [ 1357.238450]
    [ 1357.238450]  *** DEADLOCK ***
    [ 1357.238450]
    [ 1357.238450] no locks held by ksoftirqd/0/3.
    [ 1357.238450]
    [ 1357.238450] stack backtrace:
    [ 1357.238450] Pid: 3, comm: ksoftirqd/0 Tainted: G           O 3.7.0-rc7-yikvm+ #3
    [ 1357.238450] Call Trace:
    [ 1357.238450]  [<ffffffff8149399a>] print_usage_bug+0x1f5/0x206
    [ 1357.238450]  [<ffffffff8100da59>] ? save_stack_trace+0x2c/0x49
    [ 1357.238450]  [<ffffffff81082aae>] ? print_irq_inversion_bug.part.14+0x1ae/0x1ae
    [ 1357.238450]  [<ffffffff81083336>] mark_lock+0x106/0x258
    [ 1357.238450]  [<ffffffff81084e34>] __lock_acquire+0x2e7/0xe53
    [ 1357.238450]  [<ffffffff8102903d>] ? pvclock_clocksource_read+0x48/0xb4
    [ 1357.238450]  [<ffffffff810ba6a3>] ? rcu_process_gp_end+0xc0/0xc9
    [ 1357.238450]  [<ffffffffa01eacd4>] ? transport_deregister_session+0x41/0x148 [target_core_mod]
    [ 1357.238450]  [<ffffffff81085ef1>] lock_acquire+0x119/0x143
    [ 1357.238450]  [<ffffffffa01eacd4>] ? transport_deregister_session+0x41/0x148 [target_core_mod]
    [ 1357.238450]  [<ffffffff8149c329>] _raw_spin_lock_irqsave+0x54/0x8e
    [ 1357.238450]  [<ffffffffa01eacd4>] ? transport_deregister_session+0x41/0x148 [target_core_mod]
    [ 1357.238450]  [<ffffffffa01eacd4>] transport_deregister_session+0x41/0x148 [target_core_mod]
    [ 1357.238450]  [<ffffffff810bb6a0>] ? rcu_process_callbacks+0x229/0x42a
    [ 1357.238450]  [<ffffffffa018ddc5>] ft_sess_rcu_free+0x17/0x24 [tcm_fc]
    [ 1357.238450]  [<ffffffffa018ddae>] ? ft_sess_free+0x1b/0x1b [tcm_fc]
    [ 1357.238450]  [<ffffffff810bb6d7>] rcu_process_callbacks+0x260/0x42a
    [ 1357.238450]  [<ffffffff8103d55d>] __do_softirq+0x13a/0x26f
    [ 1357.238450]  [<ffffffff8149b34e>] ? __schedule+0x65f/0x68e
    [ 1357.238450]  [<ffffffff8103d6bb>] run_ksoftirqd+0x29/0x62
    [ 1357.238450]  [<ffffffff8105c83c>] smpboot_thread_fn+0x1a5/0x1aa
    [ 1357.238450]  [<ffffffff8105c697>] ? smpboot_unregister_percpu_thread+0x47/0x47
    [ 1357.238450]  [<ffffffff810549f1>] kthread+0xb1/0xb9
    [ 1357.238450]  [<ffffffff8149b49d>] ? wait_for_common+0xbb/0x10a
    [ 1357.238450]  [<ffffffff81054940>] ? __init_kthread_worker+0x59/0x59
    [ 1357.238450]  [<ffffffff814a40ec>] ret_from_fork+0x7c/0xb0
    [ 1357.238450]  [<ffffffff81054940>] ? __init_kthread_worker+0x59/0x59
    [ 1417.440099]  rport-2:0-0: blocked FC remote port time out: removing rport

    Signed-off-by: Yi Zou <yi.zou@intel.com>
    Cc: Open-FCoE <devel@open-fcoe.org>
    Cc: Nicholas A. Bellinger <nab@risingtidesystems.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 454a7d59865e05a44757cff30608066ccf1d4655
Author: Xiaotian Feng <xtfeng@gmail.com>
Date:   Thu Dec 13 16:12:18 2012 +0800

    libata: fix Null pointer dereference on disk error

    commit 26cd4d65deba587f3cf2329b6869ce02bcbe68ec upstream.

    Following oops were observed when disk error happened:

    [ 4272.896937] sd 0:0:0:0: [sda] Unhandled error code
    [ 4272.896939] sd 0:0:0:0: [sda] Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
    [ 4272.896942] sd 0:0:0:0: [sda] CDB: Read(10): 28 00 00 5a de a7 00 00 08 00
    [ 4272.896951] end_request: I/O error, dev sda, sector 5955239
    [ 4291.574947] BUG: unable to handle kernel NULL pointer dereference at (null)
    [ 4291.658305] IP: [] ahci_activity_show+0x1/0x40
    [ 4291.730090] PGD 76dbbc067 PUD 6c4fba067 PMD 0
    [ 4291.783408] Oops: 0000 [#1] SMP
    [ 4291.822100] last sysfs file: /sys/devices/pci0000:00/0000:00:1f.2/host0/target0:0:0/0:0:0:0/sw_activity
    [ 4291.934235] CPU 9
    [ 4291.958301] Pid: 27942, comm: hwinfo ......

    ata_scsi_find_dev could return NULL, so ata_scsi_activity_{show,store} should check if atadev is NULL.

    Signed-off-by: Xiaotian Feng <dannyfeng@tencent.com>
    Cc: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b49bdf3376f3c6e9b38ccfd509db19d006c5d2b
Author: Aaron Lu <aaron.lu@intel.com>
Date:   Mon Dec 3 11:35:02 2012 +0800

    libata: set dma_mode to 0xff in reset

    commit 5416912af75de9cba5d1c75b99a7888b0bbbd2fb upstream.

    ata_device->dma_mode's initial value is zero, which is not a valid dma
    mode, but ata_dma_enabled will return true for this value. This patch
    sets dma_mode to 0xff in reset function, so that ata_dma_enabled will
    not return true for this case, or it will cause problem for pata_acpi.

    The corrsponding bugzilla page is at:
    https://bugzilla.kernel.org/show_bug.cgi?id=49151

    Reported-by: Phillip Wood <phillip.wood@dunelm.org.uk>
    Signed-off-by: Aaron Lu <aaron.lu@intel.com>
    Tested-by: Szymon Janc <szymon@janc.net.pl>
    Tested-by: Dutra Julio <dutra.julio@gmail.com>
    Acked-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bf35799a1d4fa0db11cdfa0da020fabde140982
Author: Mikael Pettersson <mikpe@it.uu.se>
Date:   Sun Sep 16 20:53:43 2012 +0200

    sata_promise: fix hardreset lockdep error

    commit 3100d49d3cd236443faae9d81137c81b22d36003 upstream.

    sata_promise's pdc_hard_reset_port() needs to serialize because it
    flips a port-specific bit in controller register that's shared by
    all ports. The code takes the ata host lock for this, but that's
    broken because an interrupt may arrive on our irq during the hard
    reset sequence, and that too will take the ata host lock. With
    lockdep enabled a big nasty warning is seen.

    Fixed by adding private state to the ata host structure, containing
    a second lock used only for serializing the hard reset sequences.
    This eliminated the lockdep warnings both on my test rig and on
    the original reporter's machine.

    Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
    Tested-by: Adko Branil <adkobranil@yahoo.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78c9672f78f8bdf6321f6bead28c7dbd251ddd24
Author: David Jeffery <djeffery@redhat.com>
Date:   Wed Nov 21 02:39:54 2012 -0500

    SCSI: qla2xxx: Test and clear FCPORT_UPDATE_NEEDED atomically.

    commit a394aac88506159e047630fc90dc2242568382d8 upstream.

    When the qla2xxx driver loses access to multiple, remote ports, there is a race
    condition which can occur which will keep the request stuck on a scsi request
    queue indefinitely.

    This bad state occurred do to a race condition with how the FCPORT_UPDATE_NEEDED
    bit is set in qla2x00_schedule_rport_del(), and how it is cleared in
    qla2x00_do_dpc().  The problem port has its drport pointer set, but it has never
    been processed by the driver to inform the fc transport that the port has been
    lost.  qla2x00_schedule_rport_del() sets drport, and then sets the
    FCPORT_UPDATE_NEEDED bit.  In qla2x00_do_dpc(), the port lists are walked and
    any drport pointer is handled and the fc transport informed of the port loss,
    then the FCPORT_UPDATE_NEEDED bit is cleared.  This leaves a race where the
    dpc thread is processing one port removal, another port removal is marked
    with a call to qla2x00_schedule_rport_del(), and the dpc thread clears the
    bit for both removals, even though only the first removal was actually
    handled.  Until another event occurs to set FCPORT_UPDATE_NEEDED, the later
    port removal is never finished and qla2xxx stays in a bad state which causes
    requests to become stuck on request queues.

    This patch updates the driver to test and clear FCPORT_UPDATE_NEEDED
    atomically.  This ensures the port state changes are processed and not lost.

    Signed-off-by: David Jeffery <djeffery@redhat.com>
    Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
    Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b9ebaf5aad54cb173db311f007057976d867cdd3
Author: Xi Wang <xi.wang@gmail.com>
Date:   Fri Nov 16 14:40:03 2012 -0500

    SCSI: mvsas: fix undefined bit shift

    commit beecadea1b8d67f591b13f7099559f32f3fd601d upstream.

    The macro bit(n) is defined as ((u32)1 << n), and thus it doesn't work
    with n >= 32, such as in mvs_94xx_assign_reg_set():

    	if (i >= 32) {
    		mvi->sata_reg_set |= bit(i);
    		...
    	}

    The shift ((u32)1 << n) with n >= 32 also leads to undefined behavior.
    The result varies depending on the architecture.

    This patch changes bit(n) to do a 64-bit shift.  It also simplifies
    mv_ffc64() using __ffs64(), since invoking ffz() with ~0 is undefined.

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Acked-by: Xiangliang Yu <yuxiangl@marvell.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f8ef1b36636fadc891a039baef46414e635a2a72
Author: Stephan Gatzka <stephan.gatzka@gmail.com>
Date:   Wed Nov 28 20:04:32 2012 +0100

    firewire: net: Fix handling of fragmented multicast/broadcast packets.

    commit 9d2373420900a39f5212a3b289331aa3535b1000 upstream.

    This patch fixes both the transmit and receive portion of sending
    fragmented mutlicast and broadcast packets.

    The transmit section was broken because the offset for INTFRAG and
    LASTFRAG packets were just miscalculated by IEEE1394_GASP_HDR_SIZE (which
    was reserved with skb_push() in fwnet_send_packet).

    The receive section was broken because in fwnet_incoming_packet is a call
    to fwnet_peer_find_by_node_id(). Called with generation == -1 it will
    not find a peer and the partial datagrams are associated to a peer.

    [Stefan R:  The fix to use context->card->generation is not perfect.
    It relies on the IR tasklet which processes packets from the prior bus
    generation to run before the self-ID-complete worklet which sets the
    current card generation.  Alas, there is no simple way of a race-free
    implementation.  Let's do it this way for now.]

    Signed-off-by: Stephan Gatzka <stephan.gatzka@gmail.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 46bea30a01949caf8143be4a88038cbe1003b10e
Author: Gabor Juhos <juhosg@openwrt.org>
Date:   Sun Dec 9 23:57:09 2012 +0100

    ath9k: ar9003: fix OTP register offsets for AR9340

    commit b3cd8021379306c0be6932e4d3b4b01efc681769 upstream.

    Trying to access the OTP memory on the AR9340
    causes a data bus error like this:

      Data bus error, epc == 86e84164, ra == 86e84164
      Oops[#1]:
      Cpu 0
      $ 0   : 00000000 00000061 deadc0de 00000000
      $ 4   : b8115f18 00015f18 00000007 00000004
      $ 8   : 00000001 7c7c3c7c 7c7c7c7c 7c7c7c7c
      $12   : 7c7c3c7c 001f0041 00000000 7c7c7c3c
      $16   : 86ee0000 00015f18 00000000 00000007
      $20   : 00000004 00000064 00000004 86d71c44
      $24   : 00000000 86e6ca00
      $28   : 86d70000 86d71b20 86ece0c0 86e84164
      Hi    : 00000000
      Lo    : 00000064
      epc   : 86e84164 ath9k_hw_wait+0x58/0xb0 [ath9k_hw]
          Tainted: G           O
      ra    : 86e84164 ath9k_hw_wait+0x58/0xb0 [ath9k_hw]
      Status: 1100d403    KERNEL EXL IE
      Cause : 4080801c
      PrId  : 0001974c (MIPS 74Kc)
      Modules linked in: ath9k(O+) ath9k_common(O) ath9k_hw(O) ath(O) ar934x_nfc
      mac80211(O) usbcore usb_common scsi_mod nls_base nand nand_ecc nand_ids
      crc_ccitt cfg80211(O) compat(O) arc4 aes_generic crypto_blkcipher cryptomgr
      aead crypto_hash crypto_algapi ledtrig_timer ledtrig_default_on leds_gpio
      Process insmod (pid: 459, threadinfo=86d70000, task=87942140, tls=779ac440)
      Stack : 802fb500 000200da 804db150 804e0000 87816130 86ee0000 00010000 86d71b88
              86d71bc0 00000004 00000003 86e9fcd0 80305300 0002c0d0 86e74c50 800b4c20
              000003e8 00000001 00000000 86ee0000 000003ff 86e9fd64 80305300 80123938
              fffffffc 00000004 000058bc 00000000 86ea0000 86ee0000 000001ff 878d6000
              99999999 86e9fdc0 86ee0fcc 86e9e664 0000c0d0 86ee0000 0000700000007000
              ...
      Call Trace:
      [<86e84164>] ath9k_hw_wait+0x58/0xb0 [ath9k_hw]
      [<86e9fcd0>] ath9k_hw_setup_statusring+0x16b8/0x1c7c [ath9k_hw]

      Code: 0000a812  0040f809  00000000 <00531024> 1054000b  24020001  0c05b5dc  2404000a  26520001

    The cause of the error is that the OTP register
    offsets are different on the AR9340 than the
    actually used values.

    Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae172f61ff5d599fe56d2eec814e8310fda7cd43
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Thu Dec 6 18:40:11 2012 +0100

    Revert "ath9k_hw: Update AR9003 high_power tx gain table"

    commit 9c170e068636deb3e3f96114034bb711675f0faa upstream.

    This reverts commit f74b9d365ddd33a375802b064f96a5d0e99af7c0.

    Turns out reverting commit a240dc7b3c7463bd60cf0a9b2a90f52f78aae0fd
    "ath9k_hw: Updated AR9003 tx gain table for 5GHz" was not enough to
    bring the tx power back to normal levels on devices like the
    Buffalo WZR-HP-G450H, this one needs to be reverted as well.

    This revert improves tx power by ~10 db on that device

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Cc: rmanohar@qca.qualcomm.com
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da0e14f01594bc013022bf057bcd714566a7b99e
Author: Laura Abbott <lauraa@codeaurora.org>
Date:   Fri Jan 11 14:31:51 2013 -0800

    mm: use aligned zone start for pfn_to_bitidx calculation

    commit c060f943d0929f3e429c5d9522290584f6281d6e upstream.

    The current calculation in pfn_to_bitidx assumes that (pfn -
    zone->zone_start_pfn) >> pageblock_order will return the same bit for
    all pfn in a pageblock.  If zone_start_pfn is not aligned to
    pageblock_nr_pages, this may not always be correct.

    Consider the following with pageblock order = 10, zone start 2MB:

      pfn     | pfn - zone start | (pfn - zone start) >> page block order
      ----------------------------------------------------------------
      0x26000 | 0x25e00	   |  0x97
      0x26100 | 0x25f00	   |  0x97
      0x26200 | 0x26000	   |  0x98
      0x26300 | 0x26100	   |  0x98

    This means that calling {get,set}_pageblock_migratetype on a single page
    will not set the migratetype for the full block.  Fix this by rounding
    down zone_start_pfn when doing the bitidx calculation.

    For our use case, the effects of this bug were mostly tied to the fact
    that CMA allocations would either take a long time or fail to happen.
    Depending on the driver using CMA, this could result in anything from
    visual glitches to application failures.

    Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
    Acked-by: Mel Gorman <mgorman@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 63c54425c02a07bfa162189f2839a3f204a37b5b
Author: Jason Liu <r64343@freescale.com>
Date:   Fri Jan 11 14:31:47 2013 -0800

    mm: compaction: fix echo 1 > compact_memory return error issue

    commit 7964c06d66c76507d8b6b662bffea770c29ef0ce upstream.

    when run the folloing command under shell, it will return error

      sh/$ echo 1 > /proc/sys/vm/compact_memory
      sh/$ sh: write error: Bad address

    After strace, I found the following log:

      ...
      write(1, "1\n", 2)               = 3
      write(1, "", 4294967295)         = -1 EFAULT (Bad address)
      write(2, "echo: write error: Bad address\n", 31echo: write error: Bad address
      ) = 31

    This tells system return 3(COMPACT_COMPLETE) after write data to
    compact_memory.

    The fix is to make the system just return 0 instead 3(COMPACT_COMPLETE)
    from sysctl_compaction_handler after compaction_nodes finished.

    Signed-off-by: Jason Liu <r64343@freescale.com>
    Suggested-by: David Rientjes <rientjes@google.com>
    Acked-by: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Minchan Kim <minchan@kernel.org>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Acked-by: David Rientjes <rientjes@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2c77bb37171f8d07402f13a94390c8a20c985f50
Author: Sebastian Ott <sebott@linux.vnet.ibm.com>
Date:   Fri Nov 30 16:48:59 2012 +0100

    s390/cio: fix pgid reserved check

    commit d99e79ec5574fc556c988f613ed6175f6de66f4a upstream.

    The check to whom a device is reserved is done by checking the path
    state of the affected channel paths. If it turns out that one path is
    flagged as reserved by someone else the whole device is marked as such.

    However the meaning of the RESVD_ELSE bit is that the addressed device
    is reserved to a different pathgroup (and not reserved to a different
    LPAR). If we do this test on a path which is currently not a member of
    the pathgroup we could erroneously mark the device as reserved to
    someone else.

    To fix this collect the reserved state for all potential members of the
    pathgroup and only mark the device as reserved if all of those potential
    members have the RESVD_ELSE bit set.

    Acked-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
    Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aea63e0027f3eb9ff17fd0b6a4a528d91e9e820f
Author: Shan Hai <shan.hai@windriver.com>
Date:   Thu Nov 8 15:57:49 2012 +0000

    powerpc/vdso: Remove redundant locking in update_vsyscall_tz()

    commit ce73ec6db47af84d1466402781ae0872a9e7873c upstream.

    The locking in update_vsyscall_tz() is not only unnecessary because the vdso
    code copies the data unproteced in __kernel_gettimeofday() but also
    introduces a hard to reproduce race condition between update_vsyscall()
    and update_vsyscall_tz(), which causes user space process to loop
    forever in vdso code.

    The following patch removes the locking from update_vsyscall_tz().

    Locking is not only unnecessary because the vdso code copies the data
    unprotected in __kernel_gettimeofday() but also erroneous because updating
    the tb_update_count is not atomic and introduces a hard to reproduce race
    condition between update_vsyscall() and update_vsyscall_tz(), which further
    causes user space process to loop forever in vdso code.

    The below scenario describes the race condition,
    x==0	Boot CPU			other CPU
    	proc_P: x==0
    	    timer interrupt
    		update_vsyscall
    x==1		    x++;sync		settimeofday
    					    update_vsyscall_tz
    x==2						x++;sync
    x==3		    sync;x++
    						sync;x++
    	proc_P: x==3 (loops until x becomes even)

    Because the ++ operator would be implemented as three instructions and not
    atomic on powerpc.

    A similar change was made for x86 in commit 6c260d58634
    ("x86: vdso: Remove bogus locking in update_vsyscall_tz")

    Signed-off-by: Shan Hai <shan.hai@windriver.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dc22f2dc55c1b395db33a2695f5f356726800c6a
Author: Anton Blanchard <anton@samba.org>
Date:   Sun Nov 11 19:01:05 2012 +0000

    powerpc: Fix CONFIG_RELOCATABLE=y CONFIG_CRASH_DUMP=n build

    commit 11ee7e99f35ecb15f59b21da6a82d96d2cd3fcc8 upstream.

    If we build a kernel with CONFIG_RELOCATABLE=y CONFIG_CRASH_DUMP=n,
    the kernel fails when we run at a non zero offset. It turns out
    we were incorrectly wrapping some of the relocatable kernel code
    with CONFIG_CRASH_DUMP.

    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>