b43: stop format string leaking into error msgs

commit e0e29b683d6784ef59bbc914eac85a04b650e63c upstream.

The module parameter "fwpostfix" is userspace controllable, unfiltered,
and is used to define the firmware filename. b43_do_request_fw() populates
ctx->errors[] on error, containing the firmware filename. b43err()
parses its arguments as a format string. For systems with b43 hardware,
this could lead to a uid-0 to ring-0 escalation.

CVE-2013-2852

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ath9k: Disable PowerSave by default

commit 531671cb17af07281e6f28c1425f754346e65c41 upstream.

Almost all the DMA issues which have plagued ath9k (in station mode)
for years are related to PS. Disabling PS usually "fixes" the user's
connection stablility. Reports of DMA problems are still trickling in
and are sitting in the kernel bugzilla. Until the PS code in ath9k is
given a thorough review, disbale it by default. The slight increase
in chip power consumption is a small price to pay for improved link
stability.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drm/i915: prefer VBT modes for SVDO-LVDS over EDID

commit c3456fb3e4712d0448592af3c5d644c9472cd3c1 upstream.

In

commit 53d3b4d7778daf15900867336c85d3f8dd70600c
Author: Egbert Eich <eich@suse.de>
Date:   Tue Jun 4 17:13:21 2013 +0200

    drm/i915/sdvo: Use &intel_sdvo->ddc instead of intel_sdvo->i2c for DDC

Egbert Eich fixed a long-standing bug where we simply used a
non-working i2c controller to read the EDID for SDVO-LVDS panels.
Unfortunately some machines seem to not be able to cope with the mode
provided in the EDID. Specifically they seem to not be able to cope
with a 4x pixel mutliplier instead of a 2x one, which seems to have
been worked around by slightly changing the panels native mode in the
VBT so that the dotclock is just barely above 50MHz.

Since it took forever to notice the breakage it's fairly safe to
assume that at least for SDVO-LVDS panels the VBT contains fairly sane
data. So just switch around the order and use VBT modes first.

v2: Also add EDID modes just in case, and spell Egbert correctly.

v3: Elaborate a bit more about what's going on on Chris' machine.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65524
Reported-and-tested-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Egbert Eich <eich@suse.de>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion

commit cbab0e4eec299e9059199ebe6daf48730be46d2b upstream.

read_swap_cache_async() can race against get_swap_page(), and stumble
across a SWAP_HAS_CACHE entry in the swap map whose page wasn't brought
into the swapcache yet.

This transient swap_map state is expected to be transitory, but the
actual placement of discard at scan_swap_map() inserts a wait for I/O
completion thus making the thread at read_swap_cache_async() to loop
around its -EEXIST case, while the other end at get_swap_page() is
scheduled away at scan_swap_map().  This can leave the system deadlocked
if the I/O completion happens to be waiting on the CPU waitqueue where
read_swap_cache_async() is busy looping and !CONFIG_PREEMPT.

This patch introduces a cond_resched() call to make the aforementioned
read_swap_cache_async() busy loop condition to bail out when necessary,
thus avoiding the subtle race window.

Signed-off-by: Rafael Aquini <aquini@redhat.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Shaohua Li <shli@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mm: migration: add migrate_entry_wait_huge()

commit 30dad30922ccc733cfdbfe232090cf674dc374dc upstream.

When we have a page fault for the address which is backed by a hugepage
under migration, the kernel can't wait correctly and do busy looping on
hugepage fault until the migration finishes.  As a result, users who try
to kick hugepage migration (via soft offlining, for example) occasionally
experience long delay or soft lockup.

This is because pte_offset_map_lock() can't get a correct migration entry
or a correct page table lock for hugepage.  This patch introduces
migration_entry_wait_huge() to solve this.

Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Reviewed-by: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
x86: Fix typo in kexec register clearing

commit c8a22d19dd238ede87aa0ac4f7dbea8da039b9c1 upstream.

Fixes a typo in register clearing code. Thanks to PaX Team for fixing
this originally, and James Troup for pointing it out.

Signed-off-by: Kees Cook <keescook@chromium.org>
Link: http://lkml.kernel.org/r/20130605184718.GA8396@www.outflux.net
Cc: PaX Team <pageexec@freemail.hu>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ceph: fix statvfs fr_size

commit 92a49fb0f79f3300e6e50ddf56238e70678e4202 upstream.

Different versions of glibc are broken in different ways, but the short of
it is that for the time being, frsize should == bsize, and be used as the
multiple for the blocks, free, and available fields.  This mirrors what is
done for NFS.  The previous reporting of the page size for frsize meant
that newer glibc and df would report a very small value for the fs size.

Fixes http://tracker.ceph.com/issues/3793.

Signed-off-by: Sage Weil <sage@inktank.com>
Reviewed-by: Greg Farnum <greg@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.0.83
Merge branch 'linux-3.0.y' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into cm-10.1
massive update to i/o schedulers, thx to kasper_h for squashing my commits from smdk4412 kernel, this has made porting much easier :)
Original work of many authors, Individual patches:

block: fiops bias sync workload
block: fiops preserve vios key for deep queue depth workload
block: fiops add ioprio support
block: fiops sync/async scale
block: fiops read/write request scale
block: fiops ioscheduler core
by: Shaohua Li

block: row: Fix starvation tolerance values
by: Maya Erez authored 2 months ago

block: urgent request: Update dispatch_urgent in case of requeue/rein
block: row: Update sysfs functions
block: row: Prevent starvation of regular priority by high priority
block: urgent request: remove unnecessary urgent marking
block: row: Re-design urgent request notification mechanism
block: row: Update initial values of ROW data structures
block: row: Don't notify URGENT if there are un-completed urgent req
block: row: Idling mechanism re-factoring
block: row: Dispatch requests according to their io-priority
block:row: fix idling mechanism in ROW
block: ROW: Correct minimum values of ROW tunable parameters
by: Tatyana Brokhman

block: blk-core: add printk_ratelimit
by: Asutosh Das

block: blk-merge: don't merge the pages with non-contiguous descriptors
by: Subhash Jadavani authored 5 months ago

cfq-iosched: Fix null pointer dereference
by: Sujit Reddy Thumma

block: Add BLKROTATIONAL ioctl
block: Introduce blk_set_stacking_limits function
by: Martin K. Petersen

block: remove WARN_ON_ONCE() in exit_io_context()
block: an exiting task should be allowed to create io_context
block: recursive merge requests
by: Tejun Heo

block: ioc_cgroup_changed() needs to be exported
by: axboe

block, cfq: fix empty queue crash caused by request merge
by: Shaohua Li

block, cfq: move icq creation and rq->elv.icq association to block core
block, cfq: restructure io_cq creation path for io_context interface
block, cfq: move io_cq exit/release to blk-ioc.c
block, cfq: move icq cache management to block core
block, cfq: move io_cq lookup to blk-ioc.c
block, cfq: move cfqd->icq_list to request_queue and add request->elv
block, cfq: reorganize cfq_io_context into generic and cfq specific
block, cfq: replace current_io_context() with create_io_context() …
block, cfq: kill cic->key
block, cfq: kill ioc_gone
block, cfq: remove delayed unlink
block, cfq: unlink cfq_io_context's immediately
block, cfq: fix cic lookup locking
block, cfq: fix race condition in cic creation path and tighten locking
block, cfq: move ioc ioprio/cgroup changed handling to cic
block, cfq: misc updates to cfq_io_context
block, cfq: move cfqd->cic_index to q->id
block: misc updates to blk_get_queue()
Initialize request_count in __make_request
block: make ioc get/put interface more conventional and fix race
block: misc ioc cleanups
block: add missing blk_queue_dead() checks
block: fix drain_all condition in blk_drain_queue()
block: add blk_queue_dead()
block, sx8: kill blk_insert_request()
block: don't call blk_drain_queue() if elevator is not up
block: fix request_queue lifetime handling by making blk_queue_cleanup
block: drop @tsk from attempt_plug_merge() and explain sync rules
block: make get_request[_wait]() fail if queue is dead
block: reorganize throtl_get_tg() and blk_throtl_bio()
block: drop unnecessary blk_get/put_queue() in scsi_cmd_ioctl()
block: reorganize queue draining
block: pass around REQ_* flags instead of broken down booleans during
block: move blk_throtl prototypes to block/blk.h
block: fix genhd refcounting in blkio_policy_parse_and_set()
by: Tejun Heo

blk-throttle: use queue_is_locked() instead of lockdep_is_held()
by: axboe

blk-throttle: Take blkcg->lock while traversing blkcg->policy_list
blk-throttle: Free up policy node associated with deleted rule
by: Vivek Goyal

block: warn if tag is greater than real_max_depth
block: Remove the control of complete cpu from bio
by: taoma-tm

blk-flush: fix invalid BUG_ON in blk_insert_flush
by: Jeff Moyer

block: fix a typo in the blk-cgroup.h file
by: pibroch

ida: make ida_simple_get/put() IRQ saf
by: Tejun Heo

fixlet: Remove fs_excl from struct task.
by: Justin TerAvest

block: strict rq_affinity
by: djbw

block: reorder request_queue to remove 64 bit alignment padding
by: Richard Ke

block: document blk_plug list a
block: avoid building too big plug list
by: Shaohua Li

bloc
by: gaowanlong

backing-dev: us
by: Mikulas Patocka

compat_i
compat_ioctl: fix make headers_check
by: Johannes Stezenbach
block: urgent: Fix dispatching of URGENT mechanism

There are cases when blk_peek_request is called not from blk_fetch_request
thus the URGENT request may be started but the flag q->dispatched_urgent is
not updated.

Change-Id: I4fb588823f1b2949160cbd3907f4729767932e12
CRs-fixed: 471736
CRs-fixed: 473036
Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>
block: Remove "requeuing urgent req" error messages

It is possible for URGENT request to be requeued/reinserted if it was
fetched during the creation of a packed list. This end case is rare and is
not handled at the moment.
This patch changes the messages notifying of the above to debug level
(instead of error) in order to clear the dmesg log.

Change-Id: Ie8bc067e61559a6f702077b95c5dbcc426404232
Signed-off-by: Tatyana Brokhman <tlinder@codeaurora.org>
staging: android: lowmemorykiller: well-marked debug print

Add "lowmemorykiller:" prefix to the debug print so it's easier to
analyse LMK's debug output:
dmesg | grep lowmemorykiller

Signed-off-by: Dmitry Voytik <dvv.kernel@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: stratosk <stratosk@semaphore.gr>