update build info

Signed-off-by: Lens-F <tnoah12@gmail.com>
Linux 3.4.91

commit 3ddd37aaf5db2fbcd0f8a485a9a3390d22574371
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Thu Jan 23 14:42:43 2014 -0500

    tgafb: fix mode setting with fbset

    commit 624966589041deb32a2626ee2e176e8274581101 upstream.

    Mode setting in the TGA driver is broken for these reasons:

    - info->fix.line_length is set just once in tgafb_init_fix function. If
      we change videomode, info->fix.line_length is not recalculated - so
      the video mode is changed but the screen is corrupted because of wrong
      info->fix.line_length.

    - info->fix.smem_len is set in tgafb_init_fix to the size of the default
      video mode (640x480). If we set a higher resolution,
      info->fix.smem_len is smaller than the current screen size, preventing
      the userspace program from mapping the framebuffer.

    This patch fixes it:

    - info->fix.line_length initialization is moved to tgafb_set_par so that
      it is recalculated with each mode change.

    - info->fix.smem_len is set to a fixed value representing the real
      amount of video ram (the values are taken from xfree86 driver).

    - add a check to tgafb_check_var to prevent us from setting a videomode
      that doesn't fit into videoram.

    - in tgafb_register, tgafb_init_fix is moved upwards, to be called
      before fb_find_mode (because fb_find_mode already needs the videoram
      size set in tgafb_init_fix).

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7dff32efd24849aca3ab1eabe8b867025f34a3f8
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Mon Dec 30 15:31:17 2013 +0100

    powerpc: Add vr save/restore functions

    commit 8fe9c93e7453e67b8bd09f263ec1bb0783c733fc upstream.

    GCC 4.8 now generates out-of-line vr save/restore functions when
    optimizing for size.  They are needed for the raid6 altivec support.

    Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bd3c53d12e0e454091ad35090410267af0e4a84
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Wed Feb 26 10:54:36 2014 -0500

    tracepoint: Do not waste memory on mods with no tracepoints

    commit 7dec935a3aa04412cba2cebe1524ae0d34a30c24 upstream.

    No reason to allocate tp_module structures for modules that have no
    tracepoints. This just wastes memory.

    Fixes: b75ef8b44b1c "Tracepoint: Dissociate from module mutex"
    Acked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8ed40c122919cd79bc3c059e5864e5e7d9d455f0
Author: Thomas Graf <tgraf@suug.ch>
Date:   Fri Apr 4 17:57:45 2014 +0200

    netfilter: Can't fail and free after table replacement

    commit c58dd2dd443c26d856a168db108a0cd11c285bf3 upstream.

    All xtables variants suffer from the defect that the copy_to_user()
    to copy the counters to user memory may fail after the table has
    already been exchanged and thus exposed. Return an error at this
    point will result in freeing the already exposed table. Any
    subsequent packet processing will result in a kernel panic.

    We can't copy the counters before exposing the new tables as we
    want provide the counter state after the old table has been
    unhooked. Therefore convert this into a silent error.

    Cc: Florian Westphal <fw@strlen.de>
    Signed-off-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4ede126ea94672827d60e5237ed2c6624b06a255
Author: Joe Perches <joe@perches.com>
Date:   Sun May 13 21:56:25 2012 +0000

    net: Add net_ratelimited_function and net_<level>_ratelimited macros

    commit 3a3bfb61e64476ff1e4ac3122cb6dec9c79b795c upstream.

    __ratelimit() can be considered an inverted bool test because
    it returns true when not ratelimited.  Several tests in the
    kernel tree use this __ratelimit() function incorrectly.

    No net_ratelimit uses are incorrect currently though.

    Most uses of net_ratelimit are to log something via printk or
    pr_<level>.

    In order to minimize the uses of net_ratelimit, and to start
    standardizing the code style used for __ratelimit() and net_ratelimit(),
    add a net_ratelimited_function() macro and net_<level>_ratelimited()
    logging macros similar to pr_<level>_ratelimited that use the global
    net_ratelimit instead of a static per call site "struct ratelimit_state".

    Signed-off-by: Joe Perches <joe@perches.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b87f408045848f42ae574326faf64073f92f2af
Author: Andrey Vagin <avagin@openvz.org>
Date:   Fri Mar 28 13:54:32 2014 +0400

    netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len

    commit 223b02d923ecd7c84cf9780bb3686f455d279279 upstream.

    "len" contains sizeof(nf_ct_ext) and size of extensions. In a worst
    case it can contain all extensions. Bellow you can find sizes for all
    types of extensions. Their sum is definitely bigger than 256.

    nf_ct_ext_types[0]->len = 24
    nf_ct_ext_types[1]->len = 32
    nf_ct_ext_types[2]->len = 24
    nf_ct_ext_types[3]->len = 32
    nf_ct_ext_types[4]->len = 152
    nf_ct_ext_types[5]->len = 2
    nf_ct_ext_types[6]->len = 16
    nf_ct_ext_types[7]->len = 8

    I have seen "len" up to 280 and my host has crashes w/o this patch.

    The right way to fix this problem is reducing the size of the ecache
    extension (4) and Florian is going to do this, but these changes will
    be quite large to be appropriate for a stable tree.

    Fixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)
    Cc: Pablo Neira Ayuso <pablo@netfilter.org>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Cc: "David S. Miller" <davem@davemloft.net>
    Signed-off-by: Andrey Vagin <avagin@openvz.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14eee5bd065d6aac0acbdc6092a25ba68c55b9c8
Author: Roman Pen <r.peniaev@gmail.com>
Date:   Tue Mar 4 23:13:10 2014 +0900

    blktrace: fix accounting of partially completed requests

    commit af5040da01ef980670b3741b3e10733ee3e33566 upstream.

    trace_block_rq_complete does not take into account that request can
    be partially completed, so we can get the following incorrect output
    of blkparser:

      C   R 232 + 240 [0]
      C   R 240 + 232 [0]
      C   R 248 + 224 [0]
      C   R 256 + 216 [0]

    but should be:

      C   R 232 + 8 [0]
      C   R 240 + 8 [0]
      C   R 248 + 8 [0]
      C   R 256 + 8 [0]

    Also, the whole output summary statistics of completed requests and
    final throughput will be incorrect.

    This patch takes into account real completion size of the request and
    fixes wrong completion accounting.

    Signed-off-by: Roman Pen <r.peniaev@gmail.com>
    CC: Steven Rostedt <rostedt@goodmis.org>
    CC: Frederic Weisbecker <fweisbec@gmail.com>
    CC: Ingo Molnar <mingo@redhat.com>
    CC: linux-kernel@vger.kernel.org
    Signed-off-by: Jens Axboe <axboe@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 664c0fc651b6ca2ab43ddbb73bbda2acdb2c9915
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Sat May 3 14:04:59 2014 +0200

    n_tty: Fix n_tty_write crash when echoing in raw mode

    commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.

    The tty atomic_write_lock does not provide an exclusion guarantee for
    the tty driver if the termios settings are LECHO & !OPOST.  And since
    it is unexpected and not allowed to call TTY buffer helpers like
    tty_insert_flip_string concurrently, this may lead to crashes when
    concurrect writers call pty_write. In that case the following two
    writers:
    * the ECHOing from a workqueue and
    * pty_write from the process
    race and can overflow the corresponding TTY buffer like follows.

    If we look into tty_insert_flip_string_fixed_flag, there is:
      int space = __tty_buffer_request_room(port, goal, flags);
      struct tty_buffer *tb = port->buf.tail;
      ...
      memcpy(char_buf_ptr(tb, tb->used), chars, space);
      ...
      tb->used += space;

    so the race of the two can result in something like this:
                  A                                B
    __tty_buffer_request_room
                                      __tty_buffer_request_room
    memcpy(buf(tb->used), ...)
    tb->used += space;
                                      memcpy(buf(tb->used), ...) ->BOOM

    B's memcpy is past the tty_buffer due to the previous A's tb->used
    increment.

    Since the N_TTY line discipline input processing can output
    concurrently with a tty write, obtain the N_TTY ldisc output_lock to
    serialize echo output with normal tty writes.  This ensures the tty
    buffer helper tty_insert_flip_string is not called concurrently and
    everything is fine.

    Note that this is nicely reproducible by an ordinary user using
    forkpty and some setup around that (raw termios + ECHO). And it is
    present in kernels at least after commit
    d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
    use the normal buffering logic) in 2.6.31-rc3.

    js: add more info to the commit log
    js: switch to bool
    js: lock unconditionally
    js: lock only the tty->ops->write call

    References: CVE-2014-0196
    Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

commit 3307c63bcea0f3a2d912bec9f460335fe051aaa8
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Oct 30 20:13:51 2013 +0300

    SCSI: megaraid: missing bounds check in mimd_to_kioc()

    commit 3de2260140417759c669d391613d583baf03b0cf upstream.

    pthru32->dataxferlen comes from the user so we need to check that it's
    not too large so we don't overflow the buffer.

    Reported-by: Nico Golde <nico@ngolde.de>
    Reported-by: Fabian Yamaguchi <fabs@goesec.de>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Sumit Saxena <sumit.saxena@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Lens-F <tnoah12@gmail.com>