Linux 3.4.79

commit e3b1f4138a12a66dcd2a48e5b4a7fa1bba9c2c5b
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Feb 6 11:05:59 2014 -0800

    Linux 3.4.79

commit 988e453293f02271214645c7887638124095aa88
Author: Paul Mackerras <paulus@samba.org>
Date:   Sat Jan 18 21:14:47 2014 +1100

    powerpc: Make sure "cache" directory is removed when offlining cpu

    commit 91b973f90c1220d71923e7efe1e61f5329806380 upstream.

    The code in remove_cache_dir() is supposed to remove the "cache"
    subdirectory from the sysfs directory for a CPU when that CPU is
    being offlined.  It tries to do this by calling kobject_put() on
    the kobject for the subdirectory.  However, the subdirectory only
    gets removed once the last reference goes away, and the reference
    being put here may well not be the last reference.  That means
    that the "cache" subdirectory may still exist when the offlining
    operation has finished.  If the same CPU subsequently gets onlined,
    the code tries to add a new "cache" subdirectory.  If the old
    subdirectory has not yet been removed, we get a WARN_ON in the
    sysfs code, with stack trace, and an error message printed on the
    console.  Further, we ultimately end up with an online cpu with no
    "cache" subdirectory.

    This fixes it by doing an explicit kobject_del() at the point where
    we want the subdirectory to go away.  kobject_del() removes the sysfs
    directory even though the object still exists in memory.  The object
    will get freed at some point in the future.  A subsequent onlining
    operation can create a new sysfs directory, even if the old object
    still exists in memory, without causing any problems.

    Signed-off-by: Paul Mackerras <paulus@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 06c23d087a238d3838de9b87c793195daae8a8bc
Author: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
Date:   Tue Jan 7 17:26:58 2014 +0800

    Btrfs: handle EAGAIN case properly in btrfs_drop_snapshot()

    commit 90515e7f5d7d24cbb2a4038a3f1b5cfa2921aa17 upstream.

    We may return early in btrfs_drop_snapshot(), we shouldn't
    call btrfs_std_err() for this case, fix it.

    Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
    Signed-off-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: Chris Mason <clm@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e7fe101104b9254d37e316250d9570e0b29ecd2
Author: Andy Grover <agrover@redhat.com>
Date:   Fri Jan 24 16:18:54 2014 -0800

    target/iscsi: Fix network portal creation race

    commit ee291e63293146db64668e8d65eb35c97e8324f4 upstream.

    When creating network portals rapidly, such as when restoring a
    configuration, LIO's code to reuse existing portals can return a false
    negative if the thread hasn't run yet and set np_thread_state to
    ISCSI_NP_THREAD_ACTIVE. This causes an error in the network stack
    when attempting to bind to the same address/port.

    This patch sets NP_THREAD_ACTIVE before the np is placed on g_np_list,
    so even if the thread hasn't run yet, iscsit_get_np will return the
    existing np.

    Also, convert np_lock -> np_mutex + hold across adding new net portal
    to g_np_list to prevent a race where two threads may attempt to create
    the same network portal, resulting in one of them failing.

    (nab: Add missing mutex_unlocks in iscsit_add_np failure paths)
    (DanC: Fix incorrect spin_unlock -> spin_unlock_bh)

    Signed-off-by: Andy Grover <agrover@redhat.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bce4e9bf144e6394b61d1b275a720d76e2bc4b1a
Author: Vijaya Mohan Guvva <vmohan@brocade.com>
Date:   Wed Dec 4 05:43:58 2013 -0800

    SCSI: bfa: Chinook quad port 16G FC HBA claim issue

    commit dcaf9aed995c2b2a49fb86bbbcfa2f92c797ab5d upstream.

    Bfa driver crash is observed while pushing the firmware on to chinook
    quad port card due to uninitialized bfi_image_ct2 access which gets
    initialized only for CT2 ASIC based cards after request_firmware().
    For quard port chinook (CT2 ASIC based), bfi_image_ct2 is not getting
    initialized as there is no check for chinook PCI device ID before
    request_firmware and instead bfi_image_cb is initialized as it is the
    default case for card type check.

    This patch includes changes to read the right firmware for quad port chinook.

    Signed-off-by: Vijaya Mohan Guvva <vmohan@brocade.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7af4a2da7aaca5f5a0e97fec4050cd8a3c59ebcd
Author: Thomas Pugliese <thomas.pugliese@gmail.com>
Date:   Mon Dec 9 13:40:29 2013 -0600

    usb: core: get config and string descriptors for unauthorized devices

    commit 83e83ecb79a8225e79bc8e54e9aff3e0e27658a2 upstream.

    There is no need to skip querying the config and string descriptors for
    unauthorized WUSB devices when usb_new_device is called.  It is allowed
    by WUSB spec.  The only action that needs to be delayed until
    authorization time is the set config.  This change allows user mode
    tools to see the config and string descriptors earlier in enumeration
    which is needed for some WUSB devices to function properly on Android
    systems.  It also reduces the amount of divergent code paths needed
    for WUSB devices.

    Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd1e02030a6f006234061a306454c4e3e4d4701a
Author: Andy Honig <ahonig@google.com>
Date:   Tue Nov 19 14:12:18 2013 -0800

    KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367)

    commit b963a22e6d1a266a67e9eecc88134713fd54775c upstream.

    Under guest controllable circumstances apic_get_tmcct will execute a
    divide by zero and cause a crash.  If the guest cpuid support
    tsc deadline timers and performs the following sequence of requests
    the host will crash.
    - Set the mode to periodic
    - Set the TMICT to 0
    - Set the mode bits to 11 (neither periodic, nor one shot, nor tsc deadline)
    - Set the TMICT to non-zero.
    Then the lapic_timer.period will be 0, but the TMICT will not be.  If the
    guest then reads from the TMCCT then the host will perform a divide by 0.

    This patch ensures that if the lapic_timer.period is 0, then the division
    does not occur.

    Reported-by: Andrew Honig <ahonig@google.com>
    Signed-off-by: Andrew Honig <ahonig@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    [bwh: Backported to 3.2: s/kvm_apic_get_reg/apic_get_reg/]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Vinson Lee <vlee@twopensource.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee270c98472e0bf2ef7d9c15c81be0b1353bd969
Author: Richard Weinberger <richard@nod.at>
Date:   Tue Jan 14 22:46:36 2014 +0100

    net,via-rhine: Fix tx_timeout handling

    [ Upstream commit a926592f5e4e900f3fa903298c4619a131e60963 ]

    rhine_reset_task() misses to disable the tx scheduler upon reset,
    this can lead to a crash if work is still scheduled while we're resetting
    the tx queue.

    Fixes:
    [   93.591707] BUG: unable to handle kernel NULL pointer dereference at 0000004c
    [   93.595514] IP: [<c119d10d>] rhine_napipoll+0x491/0x6

    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit df647935d589103da0b8f8e3d4354646c006e85b
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date:   Mon Jan 13 02:45:22 2014 +0100

    net: avoid reference counter overflows on fib_rules in multicast forwarding

    [ Upstream commit 95f4a45de1a0f172b35451fc52283290adb21f6e ]

    Bob Falken reported that after 4G packets, multicast forwarding stopped
    working. This was because of a rule reference counter overflow which
    freed the rule as soon as the overflow happend.

    This patch solves this by adding the FIB_LOOKUP_NOREF flag to
    fib_rules_lookup calls. This is safe even from non-rcu locked sections
    as in this case the flag only implies not taking a reference to the rule,
    which we don't need at all.

    Rules only hold references to the namespace, which are guaranteed to be
    available during the call of the non-rcu protected function reg_vif_xmit
    because of the interface reference which itself holds a reference to
    the net namespace.

    Fixes: f0ad0860d01e47 ("ipv4: ipmr: support multiple tables")
    Fixes: d1db275dd3f6e4 ("ipv6: ip6mr: support multiple tables")
    Reported-by: Bob Falken <NetFestivalHaveFun@gmx.com>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Thomas Graf <tgraf@suug.ch>
    Cc: Julian Anastasov <ja@ssi.bg>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 237275e9210b828f11c7dc2feac0ca1b0ced8eee
Author: Neal Cardwell <ncardwell@google.com>
Date:   Sun Feb 2 20:40:13 2014 -0500

    inet_diag: fix inet_diag_dump_icsk() timewait socket state logic

    [ Based upon upstream commit 70315d22d3c7383f9a508d0aab21e2eb35b2303a ]

    Fix inet_diag_dump_icsk() to reflect the fact that both TIME_WAIT and
    FIN_WAIT2 connections are represented by inet_timewait_sock (not just
    TIME_WAIT). Thus:

    (a) We need to iterate through the time_wait buckets if the user wants
    either TIME_WAIT or FIN_WAIT2. (Before fixing this, "ss -nemoi state
    fin-wait-2" would not return any sockets, even if there were some in
    FIN_WAIT2.)

    (b) We need to check tw_substate to see if the user wants to dump
    sockets in the particular substate (TIME_WAIT or FIN_WAIT2) that a
    given connection is in. (Before fixing this, "ss -nemoi state
    time-wait" would actually return sockets in state FIN_WAIT2.)

    An analogous fix is in v3.13: 70315d22d3c7383f9a508d0aab21e2eb35b2303a
    ("inet_diag: fix inet_diag_dump_icsk() to use correct state for
    timewait sockets") but that patch is quite different because 3.13 code
    is very different in this area due to the unification of TCP hash
    tables in 05dbc7b ("tcp/dccp: remove twchain") in v3.13-rc1.

    I tested that this applies cleanly between v3.3 and v3.12, and tested
    that it works in both 3.3 and 3.12. It does not apply cleanly to 3.2
    and earlier (though it makes semantic sense), and semantically is not
    the right fix for 3.13 and beyond (as mentioned above).

    Signed-off-by: Neal Cardwell <ncardwell@google.com>
    Cc: Eric Dumazet <edumazet@google.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 335d84d37ae8c6e293bada7565c32eff404519ed
Author: Michal Schmidt <mschmidt@redhat.com>
Date:   Thu Jan 9 14:36:27 2014 +0100

    bnx2x: fix DMA unmapping of TSO split BDs

    [ Upstream commit 95e92fd40c967c363ad66b2fd1ce4dcd68132e54 ]

    bnx2x triggers warnings with CONFIG_DMA_API_DEBUG=y:

      WARNING: CPU: 0 PID: 2253 at lib/dma-debug.c:887 check_unmap+0xf8/0x920()
      bnx2x 0000:28:00.0: DMA-API: device driver frees DMA memory with
      different size [device address=0x00000000da2b389e] [map size=1490 bytes]
      [unmap size=66 bytes]

    The reason is that bnx2x splits a TSO BD into two BDs (headers + data)
    using one DMA mapping for both, but it uses only the length of the first
    BD when unmapping.

    This patch fixes the bug by unmapping the whole length of the two BDs.

    Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Dmitry Kravkov <dmitry@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49ac3cba40b81521509c3a08c93ea1d6b5660745
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Jan 13 12:32:44 2014 +0100

    hp_accel: Add a new PnP ID HPQ6007 for new HP laptops

    commit b0ad4ff35d479a46a3b995a299db9aeb097acfce upstream.

    The DriveGuard chips on the new HP laptops are with a new PnP ID
    "HPQ6007".  It should be compatible with older chips.

    Acked-by: Éric Piel <eric.piel@tremplin-utc.net>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6a2797db120b8c9ffe34e9327e451f705894b82a
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Jan 10 14:20:42 2014 +0100

    ALSA: Enable CONFIG_ZONE_DMA for smaller PCI DMA masks

    commit 80ab8eae70e51d578ebbeb228e0f7a562471b8b7 upstream.

    The PCI devices with DMA masks smaller than 32bit should enable
    CONFIG_ZONE_DMA.  Since the recent change of page allocator, page
    allocations via dma_alloc_coherent() with the limited DMA mask bits
    may fail more frequently, ended up with no available buffers, when
    CONFIG_ZONE_DMA isn't enabled.  With CONFIG_ZONE_DMA, the system has
    much more chance to obtain such pages.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=68221
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f2d6404bdb7a2a8e6832d98cac1428ff12c2c5cf
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Dec 27 00:13:08 2013 +0200

    ALSA: rme9652: fix a missing comma in channel_map_9636_ds[]

    commit 770bd4bf2e664939a9dacd3d26ec9ff7a3933210 upstream.

    The lack of comma leads to the wrong channel for an SPDIF channel.
    Unfortunately this wasn't caught by compiler because it's still a
    valid expression.

    Reported-by: Alexander Aristov <aristov.alexander@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f5e764b0d4b5252c2850eabd00748e60d951f2b5
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Wed Jan 8 11:22:25 2014 +0100

    ASoC: adau1701: Fix ADAU1701_SEROCTL_WORD_LEN_16 constant

    commit e20970ada3f699c113fe64b04492af083d11a7d8 upstream.

    The driver defines ADAU1701_SEROCTL_WORD_LEN_16 as 0x10 while it should be b10,
    so 0x2. This patch fixes it.

    Reported-by: Magnus Reftel <magnus.reftel@lockless.no>
    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 28a02c0eef5ec0cb78c181e611f46d251e08a711
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Wed Nov 27 17:43:43 2013 +0100

    parport: parport_pc: remove double PCI ID for NetMos

    commit d6a484520c5572a4170fa915109ccfc0c38f5008 upstream.

    In commit 85747f ("PATCH] parport: add NetMOS 9805 support") Max added
    the PCI ID for NetMOS 9805 based on a Debian bug report from 2k4 which
    was at the v2.4.26 time frame. The patch made into 2.6.14.
    Shortly before that patch akpm merged commit 296d3c783b ("[PATCH] Support
    NetMOS based PCI cards providing serial and parallel ports") which made
    into v2.6.9-rc1.
    Now we have two different entries for the same PCI id.
    I have here the NetMos 9805 which claims to support SPP/EPP/ECP mode.
    This patch takes Max's entry for titan_1284p1 (base != -1 specifies the
    ioport for ECP mode) and replaces akpm's entry for netmos_9805 which
    specified -1 (=none). Both share the same PCI-ID (my card has subsystem
    0x1000 / 0x0020 so it should match PCI_ANY).

    While here I also drop the entry for titan_1284p2 which is the same as
    netmos_9815.

    Cc: Maximilian Attems <maks@stro.at>
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 17b27b25f3618f48d3a80ab2b2887ab597446015
Author: Yegor Yefremov <yegorslists@googlemail.com>
Date:   Mon Dec 9 12:11:15 2013 +0100

    serial: add support for 200 v3 series Titan card

    commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream.

    Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fbc32582959394e3932b9eb1688d6991c9a42ea2
Author: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
Date:   Thu Jan 9 16:01:54 2014 +0100

    ARM: at91: smc: bug fix in sam9_smc_cs_read()

    commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream.

    There was a copy/paste error when reading the nwe_pulse value.

    Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
    Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Kevin Hilman <khilman@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3a9694557f5aefc34a08bddcfcbd0ca12d8dec9a
Author: Marek Roszko <mark.roszko@gmail.com>
Date:   Tue Jan 7 11:45:06 2014 +0100

    tty/serial: at91: Handle shutdown more safely

    commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream.

    Interrupts were being cleaned up late in the shutdown handler, it is possible
    that an interrupt can occur and schedule a tasklet that runs after the port is
    cleaned up. There is a null dereference due to this race condition with the
    following stacktrace:

    [<c02092b0>] (atmel_tasklet_func+0x514/0x814) from [<c001fd34>] (tasklet_action+0x70/0xa8)
    [<c001fd34>] (tasklet_action+0x70/0xa8) from [<c001f60c>] (__do_softirq+0x90/0x144)
    [<c001f60c>] (__do_softirq+0x90/0x144) from [<c001fa18>] (irq_exit+0x40/0x4c)
    [<c001fa18>] (irq_exit+0x40/0x4c) from [<c000e298>] (handle_IRQ+0x64/0x84)
    [<c000e298>] (handle_IRQ+0x64/0x84) from [<c000d6c0>] (__irq_svc+0x40/0x50)
    [<c000d6c0>] (__irq_svc+0x40/0x50) from [<c0208060>] (atmel_rx_dma_release+0x88/0xb8)
    [<c0208060>] (atmel_rx_dma_release+0x88/0xb8) from [<c0209740>] (atmel_shutdown+0x104/0x160)
    [<c0209740>] (atmel_shutdown+0x104/0x160) from [<c0205e8c>] (uart_port_shutdown+0x2c/0x38)

    Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
    Acked-by: Leilei Zhao <leilei.zhao@atmel.com>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b135ecd41b9e19dda09654086a54f9cd13ab89b3
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sun Dec 8 09:11:30 2013 +0000

    staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning

    commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream.

    byBBPreEDIndex value is initially 0, this means that from
    cold BBvUpdatePreEDThreshold is never set.

    This means that sensitivity may be in an ambiguous state,
    failing to scan any wireless points or at least distant ones.

    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86374e1cbe070cc1d554d0490a0357c09a5d95f0
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Tue Dec 24 11:22:54 2013 -0600

    staging: r8712u: Set device type to wlan

    commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream.

    The latest version of NetworkManager does not recognize the device as wireless
    without this change.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b17696dbe5c61eb8a312789878c0538517c26f02
Author: ZHAO Gang <gamerh2o@gmail.com>
Date:   Sat Jan 18 00:17:38 2014 +0800

    b43: fix the wrong assignment of status.freq in b43_rx()

    commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream.

    Use the right function to update frequency value.

    If rx skb is probe response or beacon, the wrong frequency value can
    cause problem that bss info can't be updated when it should be.

    Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion")
    Signed-off-by: ZHAO Gang <gamerh2o@gmail.com>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 06600864a0aa2827669c3bad96bf0081a7c4019e
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Sun Jan 12 15:11:39 2014 -0600

    b43legacy: Fix unload oops if firmware is not available

    commit 452028665312672c6ba9e16a19248ee00ead9400 upstream.

    The asyncronous firmware load uses a completion struct to hold firmware
    processing until the user-space routines are up and running. There is.
    however, a problem in that the waiter is nevered canceled during teardown.
    As a result, unloading the driver when firmware is not available causes an oops.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5cdc61ecc7d1753890162f5f59a5ddebc81d6b97
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Sun Jan 12 15:11:38 2014 -0600

    b43: Fix unload oops if firmware is not available

    commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream.

    The asyncronous firmware load uses a completion struct to hold firmware
    processing until the user-space routines are up and running. There is.
    however, a problem in that the waiter is nevered canceled during teardown.
    As a result, unloading the driver when firmware is not available causes an oops.

    To be able to access the completion structure at teardown, it had to be moved
    into the b43_wldev structure.

    This patch also fixes a typo in a comment.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4dbfb7dd725b29e1aa1bbe2db6aadaf6d825b9c4
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Sun Jan 12 15:11:37 2014 -0600

    b43: Fix lockdep splat

    commit 09164043f63c947a49797750a09ca1cd7c31108e upstream.

    In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
    when b43 is used with hostapd, and rfkill is used to kill the radio output.

    The lockdep splat (in part) is as follows:

    ======================================================
    [ INFO: possible circular locking dependency detected ]
    3.12.0 #1 Not tainted
    -------------------------------------------------------
    rfkill/10040 is trying to acquire lock:
     (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20

    but task is already holding lock:
     (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]

    --snip--

    Chain exists of:
      rtnl_mutex --> misc_mtx --> rfkill_global_mutex

    The fix is to move the initialization of the hardware random number generator
    outside the code range covered by the rtnl_mutex.

    Reported-by: yury <urykhy@gmail.com>
    Tested-by: yury <urykhy@gmail.com>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ef4b350117b132da638064241c0d1e4a05e3408
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Mon Nov 18 11:11:34 2013 -0600

    rtlwifi: rtl8192cu: Fix some code in RF handling

    commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb14346e16c5dfad3b0eac308b6f4f93fdf0e3dd
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Mon Nov 18 11:11:28 2013 -0600

    rtlwifi: Set the link state

    commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream.

    The present code fails to set the linked state when an interface is
    added.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 94c773a2f58ca0c5b7204753d653b221f5761d0a
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Thu Jan 9 10:27:27 2014 -0600

    rtlwifi: rtl8192cu: Add new device ID

    commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream.

    Reported-by: Jan Prinsloo <janroot@gmail.com>
    Tested-by: Jan Prinsloo <janroot@gmail.com>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 23faa15314addfc1a1a2768ce55c3f8a61570d6e
Author: Jack Pham <jackp@codeaurora.org>
Date:   Fri Nov 15 14:53:14 2013 -0800

    usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix()

    commit 9005355af23856c55a5538c9024355785424821b upstream.

    If CONFIG_PCI is enabled, make sure xhci_cleanup_msix()
    doesn't try to free a bogus PCI IRQ or dereference an invalid
    pci_dev when the xHCI device is actually a platform_device.

    This patch should be backported to kernels as old as 3.9, that
    contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25
    "xhci-plat: Don't enable legacy PCI interrupts."

    Signed-off-by: Jack Pham <jackp@codeaurora.org>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0c18e8161aa0e9083a12c86106d0bbe19591c29e
Author: Mikhail Zolotaryov <lebon@lebon.org.ua>
Date:   Sat Dec 28 01:56:35 2013 +0200

    USB: Nokia 502 is an unusual device

    commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream.

    The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha
    Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered
    files are corrupted). A similar issue is described here:
    http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170

    The workaround is (MAX_SECTORS_64):
       rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m

    The patch adds the tested device to the unusual list permanently.

    Signed-off-by: Mikhail Zolotaryov <lebon@lebon.org.ua>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b39aa6263e96fd35de126ccd205dae6935beef6
Author: Johan Hovold <jhovold@gmail.com>
Date:   Thu Jan 2 22:49:24 2014 +0100

    USB: cypress_m8: fix ring-indicator detection and reporting

    commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream.

    Fix ring-indicator (RI) status-bit definition, which was defined as CTS,
    effectively preventing RI-changes from being detected while reporting
    false RI status.

    This bug predates git.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 88083fd5ed5d3e42050530b4098145562254c20e
Author: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Date:   Thu Jan 2 20:57:56 2014 +0530

    USB: serial: add support for iBall 3.5G connect usb modem

    commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream.

    Add support for iBall 3.5G connect usb modem.

    $lsusb
    Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY

    $usb-devices
    T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  6 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
    P:  Vendor=1c9e ProdID=9605 Rev=00.00
    S:  Manufacturer=USB Modem
    S:  Product=USB Modem
    S:  SerialNumber=1234567890ABCDEF
    C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
    I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

    Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
    Suggested-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ad28ba23eef365460ac982ebbfa579fc83c6232
Author: 张君 <zjn77777@163.com>
Date:   Wed Dec 18 15:37:17 2013 +0800

    usb: option: add new zte 3g modem pids to option driver

    commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream.

    Signed-off-by: Jun zhang <zhang.jun92@zte.com.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e0af36cc3d6134b0b40c21b4a79c90bb18e5c5f9
Author: PaX Team <pageexec@freemail.hu>
Date:   Thu Jan 30 16:59:25 2014 -0800

    x86, x32: Correct invalid use of user timespec in the kernel

    commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream.

    The x32 case for the recvmsg() timout handling is broken:

      asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
                                          unsigned int vlen, unsigned int flags,
                                          struct compat_timespec __user *timeout)
      {
              int datagrams;
              struct timespec ktspec;

              if (flags & MSG_CMSG_COMPAT)
                      return -EINVAL;

              if (COMPAT_USE_64BIT_TIME)
                      return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                            flags | MSG_CMSG_COMPAT,
                                            (struct timespec *) timeout);
              ...

    The timeout pointer parameter is provided by userland (hence the __user
    annotation) but for x32 syscalls it's simply cast to a kernel pointer
    and is passed to __sys_recvmmsg which will eventually directly
    dereference it for both reading and writing.  Other callers to
    __sys_recvmmsg properly copy from userland to the kernel first.

    The bug was introduced by commit ee4fa23c4bfc ("compat: Use
    COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels
    since 3.4 (and perhaps vendor kernels if they backported x32 support
    along with this code).

    Note that CONFIG_X86_X32_ABI gets enabled at build time and only if
    CONFIG_X86_X32 is enabled and ld can build x32 executables.

    Other uses of COMPAT_USE_64BIT_TIME seem fine.

    This addresses CVE-2014-0038.

    Signed-off-by: PaX Team <pageexec@freemail.hu>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 09f4c0c705978deb05c74b71874b3f73e55a3b77
Author: Aristeu Rozanski <aris@redhat.com>
Date:   Thu Dec 5 10:37:56 2013 -0500

    e752x_edac: Fix pci_dev usage count

    commit 90ed4988b8c030d65b41b7d13140e9376dc6ec5a upstream.

    In case the device 0, function 1 is not found using pci_get_device(),
    pci_scan_single_device() will be used but, differently than
    pci_get_device(), it allocates a pci_dev but doesn't does bump the usage
    count on the pci_dev and after few module removals and loads the pci_dev
    will be freed.

    Signed-off-by: Aristeu Rozanski <aris@redhat.com>
    Reviewed-by: mark gross <mark.gross@intel.com>
    Link: http://lkml.kernel.org/r/20131205153755.GL4545@redhat.com
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Cc: Jean Delvare <jdelvare@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 50d8f1b5c57bb29f02ab5834be334b4f7922b856
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Thu Nov 21 14:32:02 2013 -0800

    mm: hugetlbfs: fix hugetlbfs optimization

    commit 27c73ae759774e63313c1fbfeb17ba076cea64c5 upstream.

    Commit 7cb2ef56e6a8 ("mm: fix aio performance regression for database
    caused by THP") can cause dereference of a dangling pointer if
    split_huge_page runs during PageHuge() if there are updates to the
    tail_page->private field.

    Also it is repeating compound_head twice for hugetlbfs and it is running
    compound_head+compound_trans_head for THP when a single one is needed in
    both cases.

    The new code within the PageSlab() check doesn't need to verify that the
    THP page size is never bigger than the smallest hugetlbfs page size, to
    avoid memory corruption.

    A longstanding theoretical race condition was found while fixing the
    above (see the change right after the skip_unlock label, that is
    relevant for the compound_lock path too).

    By re-establishing the _mapcount tail refcounting for all compound
    pages, this also fixes the below problem:

      echo 0 >/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages

      BUG: Bad page state in process bash  pfn:59a01
      page:ffffea000139b038 count:0 mapcount:10 mapping:          (null) index:0x0
      page flags: 0x1c00000000008000(tail)
      Modules linked in:
      CPU: 6 PID: 2018 Comm: bash Not tainted 3.12.0+ #25
      Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      Call Trace:
        dump_stack+0x55/0x76
        bad_page+0xd5/0x130
        free_pages_prepare+0x213/0x280
        __free_pages+0x36/0x80
        update_and_free_page+0xc1/0xd0
        free_pool_huge_page+0xc2/0xe0
        set_max_huge_pages.part.58+0x14c/0x220
        nr_hugepages_store_common.isra.60+0xd0/0xf0
        nr_hugepages_store+0x13/0x20
        kobj_attr_store+0xf/0x20
        sysfs_write_file+0x189/0x1e0
        vfs_write+0xc5/0x1f0
        SyS_write+0x55/0xb0
        system_call_fastpath+0x16/0x1b

    Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Tested-by: Khalid Aziz <khalid.aziz@oracle.com>
    Cc: Pravin Shelar <pshelar@nicira.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Ben Hutchings <bhutchings@solarflare.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Minchan Kim <minchan@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Guillaume Morin <guillaume@morinfr.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18c8053c6b59f11bcd941850c1d13b3b502e1e74
Author: NeilBrown <neilb@suse.de>
Date:   Thu Jan 16 09:35:38 2014 +1100

    md/raid5: fix long-standing problem with bitmap handling on write failure.

    commit 9f97e4b128d2ea90a5f5063ea0ee3b0911f4c669 upstream.

    Before a write starts we set a bit in the write-intent bitmap.
    When the write completes we clear that bit if the write was successful
    to all devices.  However if the write wasn't fully successful we
    should not clear the bit.  If the faulty drive is subsequently
    re-added, the fact that the bit is still set ensure that we will
    re-write the data that is missing.

    This logic is mediated by the STRIPE_DEGRADED flag - we only clear the
    bitmap bit when this flag is not set.
    Currently we correctly set the flag if a write starts when some
    devices are failed or missing.  But we do *not* set the flag if some
    device failed during the write attempt.
    This is wrong and can result in clearing the bit inappropriately.

    So: set the flag when a write fails.

    This bug has been present since bitmaps were introduces, so the fix is
    suitable for any -stable kernel.

    Reported-by: Ethan Wilson <ethan.wilson@shiftmail.org>
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>