Commits on Dec 4, 2012
  1. Merge branch 'distro-3.6' into pf-3.6

    Oleksandr Natalenko committed Dec 4, 2012
  2. Merge branch 'version-3.6' into pf-3.6

    Oleksandr Natalenko committed Dec 4, 2012
  3. distro-3.6: bump to v3.6.11-pf

    Oleksandr Natalenko committed Dec 4, 2012
  4. version-3.6: bump to v3.6.11-pf

    Oleksandr Natalenko committed Dec 4, 2012
  5. fix merge conflict

    Oleksandr Natalenko committed Dec 4, 2012
Commits on Dec 3, 2012
  1. Linux 3.6.9

    gregkh committed Dec 3, 2012
  2. md/raid10: close race that lose writes lost when replacement completes.

    commit e7c0c3f upstream.
    When a replacement operation completes there is a small window
    when the original device is marked 'faulty' and the replacement
    still looks like a replacement.  The faulty should be removed and
    the replacement moved in place very quickly, bit it isn't instant.
    So the code write out to the array must handle the possibility that
    the only working device for some slot in the replacement - but it
    doesn't.  If the primary device is faulty it just gives up.  This
    can lead to corruption.
    So make the code more robust: if either  the primary or the
    replacement is present and working, write to them.  Only when
    neither are present do we give up.
    This bug has been present since replacement was introduced in
    3.3, so it is suitable for any -stable kernel since then.
    Reported-by: "George Spelvin" <>
    Signed-off-by: NeilBrown <>
    Signed-off-by: George Spelvin <>
    Signed-off-by: Greg Kroah-Hartman <>
    neilbrown committed with gregkh Nov 22, 2012
  3. mmc: sdhci-s3c: fix the wrong number of max bus clocks

    commit 5feb54a upstream.
    We can use up to four bus-clocks; but on module remove, we didn't
    disable the fourth bus clock.
    Signed-off-by: Jaehoon Chung <>
    Signed-off-by: Kyungmin Park <>
    Signed-off-by: Chris Ball <>
    Cc: Ben Hutchings <>
    Signed-off-by: Greg Kroah-Hartman <>
    Jaehoon Chung committed with gregkh Sep 19, 2012
  4. powerpc/eeh: Lock module while handling EEH event

    commit feadf7c upstream.
    The EEH core is talking with the PCI device driver to determine the
    action (purely reset, or PCI device removal). During the period, the
    driver might be unloaded and in turn causes kernel crash as follows:
    EEH: Detected PCI bus error on PHB#4-PE#10000
    EEH: This PCI device has failed 3 times in the last hour
    lpfc 0004:01:00.0: 0:2710 PCI channel disable preparing for reset
    Unable to handle kernel paging request for data at address 0x00000490
    Faulting instruction address: 0xd00000000e682c90
    cpu 0x1: Vector: 300 (Data Access) at [c000000fc75ffa20]
        pc: d00000000e682c90: .lpfc_io_error_detected+0x30/0x240 [lpfc]
        lr: d00000000e682c8c: .lpfc_io_error_detected+0x2c/0x240 [lpfc]
        sp: c000000fc75ffca0
       msr: 8000000000009032
       dar: 490
     dsisr: 40000000
      current = 0xc000000fc79b88b0
      paca    = 0xc00000000edb0380	 softe: 0	 irq_happened: 0x00
        pid   = 3386, comm = eehd
    enter ? for help
    [c000000fc75ffca0] c000000fc75ffd30 (unreliable)
    [c000000fc75ffd30] c00000000004fd3c .eeh_report_error+0x7c/0xf0
    [c000000fc75ffdc0] c00000000004ee00 .eeh_pe_dev_traverse+0xa0/0x180
    [c000000fc75ffe70] c00000000004ffd8 .eeh_handle_event+0x68/0x300
    [c000000fc75fff00] c0000000000503a0 .eeh_event_handler+0x130/0x1a0
    [c000000fc75fff90] c000000000020138 .kernel_thread+0x54/0x70
    The patch increases the reference of the corresponding driver modules
    while EEH core does the negotiation with PCI device driver so that the
    corresponding driver modules can't be unloaded during the period and
    we're safe to refer the callbacks.
    Reported-by: Alexey Kardashevskiy <>
    Signed-off-by: Gavin Shan <>
    Signed-off-by: Benjamin Herrenschmidt <>
    [ herton: backported for 3.5, adjusted driver assignments, return 0
      instead of NULL, assume dev is not NULL ]
    Signed-off-by: Herton Ronaldo Krzesinski <>
    Cc: Ben Hutchings <>
    Signed-off-by: Greg Kroah-Hartman <>
    shangw committed with gregkh Sep 17, 2012
  5. ext4: remove erroneous ext4_superblock_csum_set() in update_backups()

    commit bef53b0 upstream.
    The update_backups() function is used to backup all the metadata
    blocks, so we should not take it for granted that 'data' is pointed to
    a super block and use ext4_superblock_csum_set to calculate the
    checksum there.  In case where the data is a group descriptor block,
    it will corrupt the last group descriptor, and then e2fsck will
    complain about it it.
    As all the metadata checksums should already be OK when we do the
    backup, remove the wrong ext4_superblock_csum_set and it should be
    just fine.
    Reported-by: "Theodore Ts'o" <>
    Signed-off-by: Tao Ma <>
    Signed-off-by: "Theodore Ts'o" <>
    Cc: Ben Hutchings <>
    Signed-off-by: Greg Kroah-Hartman <>
    taoma-tm committed with gregkh Sep 20, 2012
  6. MPI: Fix compilation on MIPS with GCC 4.4 and newer

    commit a3cea98 upstream.
    Since 4.4 GCC on MIPS no longer recognizes the "h" constraint,
    leading to this build failure:
      CC      lib/mpi/generic_mpih-mul1.o
    lib/mpi/generic_mpih-mul1.c: In function 'mpihelp_mul_1':
    lib/mpi/generic_mpih-mul1.c:50:3: error: impossible constraint in 'asm'
    This patch updates MPI with the latest umul_ppm implementations for MIPS.
    Signed-off-by: Manuel Lauss <>
    Cc: Linux-MIPS <>
    Cc: Dmitry Kasatkin <>
    Cc: James Morris <>
    Signed-off-by: Ralf Baechle <>
    Cc: Shuah Khan <>
    Signed-off-by: Greg Kroah-Hartman <>
    mlauss committed with gregkh Nov 22, 2012
  7. watchdog: using u64 in get_sample_period()

    commit 8ffeb9b upstream.
    In get_sample_period(), unsigned long is not enough:
      watchdog_thresh * 2 * (NSEC_PER_SEC / 5)
      watchdog_thresh is 10 by default, the sample value will be: 0xEE6B2800
     set watchdog_thresh is 20, the sample value will be: 0x1 DCD6 5000
    In case2, we need use u64 to express the sample period.  Otherwise,
    changing the threshold thru proc often can not be successful.
    Signed-off-by: liu chuansheng <>
    Acked-by: Don Zickus <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Shuah Khan <>
    Signed-off-by: Greg Kroah-Hartman <>
    Chuansheng Liu committed with gregkh Nov 27, 2012
  8. mm: vmscan: check for fatal signals iff the process was throttled

    commit 50694c2 upstream.
    Commit 5515061 ("mm: throttle direct reclaimers if PF_MEMALLOC
    reserves are low and swap is backed by network storage") introduced a
    check for fatal signals after a process gets throttled for network
    storage.  The intention was that if a process was throttled and got
    killed that it should not trigger the OOM killer.  As pointed out by
    Minchan Kim and David Rientjes, this check is in the wrong place and too
    broad.  If a system is in am OOM situation and a process is exiting, it
    can loop in __alloc_pages_slowpath() and calling direct reclaim in a
    loop.  As the fatal signal is pending it returns 1 as if it is making
    forward progress and can effectively deadlock.
    This patch moves the fatal_signal_pending() check after throttling to
    throttle_direct_reclaim() where it belongs.  If the process is killed
    while throttled, it will return immediately without direct reclaim
    except now it will have TIF_MEMDIE set and will use the PFMEMALLOC
    Minchan pointed out that it may be better to direct reclaim before
    returning to avoid using the reserves because there may be pages that
    can easily reclaim that would avoid using the reserves.  However, we do
    no such targetted reclaim and there is no guarantee that suitable pages
    are available.  As it is expected that this throttling happens when
    swap-over-NFS is used there is a possibility that the process will
    instead swap which may allocate network buffers from the PFMEMALLOC
    reserves.  Hence, in the swap-over-nfs case where a process can be
    throtted and be killed it can use the reserves to exit or it can
    potentially use reserves to swap a few pages and then exit.  This patch
    takes the option of using the reserves if necessary to allow the process
    exit quickly.
    If this patch passes review it should be considered a -stable candidate
    for 3.6.
    Signed-off-by: Mel Gorman <>
    Cc: David Rientjes <>
    Cc: Luigi Semenzato <>
    Cc: Dan Magenheimer <>
    Cc: KOSAKI Motohiro <>
    Cc: Sonny Rao <>
    Cc: Minchan Kim <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: CAI Qian <>
    Signed-off-by: Greg Kroah-Hartman <>
    Mel Gorman committed with gregkh Nov 27, 2012
  9. NFC: Fix nfc_llcp_local chained list insertion

    commit 16a78e9 upstream.
    list_add was called with swapped parameters
    Signed-off-by: Thierry Escande <>
    Signed-off-by: Samuel Ortiz <>
    Signed-off-by: Peter Huewe <>
    Signed-off-by: Greg Kroah-Hartman <>
    Thierry Escande committed with gregkh Oct 12, 2012
  10. NFC: pn533: Fix mem leak in pn533_in_dep_link_up

    commit 70418e6 upstream.
    cmd is allocated in pn533_dep_link_up and passed as an arg to
    pn533_send_cmd_frame_async together with a complete cb.
    arg is passed to the cb and must be kfreed there.
    Signed-off-by: Waldemar Rymarkiewicz <>
    Signed-off-by: Samuel Ortiz <>
    Signed-off-by: Peter Huewe <>
    Signed-off-by: Greg Kroah-Hartman <>
    Waldemar Rymarkiewicz committed with gregkh Oct 11, 2012
  11. NFC: Fix pn533 target mode memory leak

    commit 5b412fd upstream.
    In target mode, sent sk_buff were not freed in pn533_tm_send_complete
    Signed-off-by: Thierry Escande <>
    Signed-off-by: Samuel Ortiz <>
    Signed-off-by: Peter Huewe <>
    Signed-off-by: Greg Kroah-Hartman <>
    Thierry Escande committed with gregkh Nov 15, 2012
  12. NFC: pn533: Fix use after free

    commit 770f750 upstream.
    cmd was freed in pn533_dep_link_up regardless of
    pn533_send_cmd_frame_async return code. Cmd is passed as argument to
    pn533_in_dep_link_up_complete callback and should be freed there.
    Signed-off-by: Szymon Janc <>
    Signed-off-by: Samuel Ortiz <>
    Signed-off-by: Peter Huewe <>
    Signed-off-by: Greg Kroah-Hartman <>
    Szymon Janc committed with gregkh Oct 29, 2012
  13. get_dvb_firmware: fix download site for tda10046 firmware

    commit 25ec43d upstream.
    The previous website doesn't exist anymore. Update it to one site that
    actually exists.
    Signed-off-by: Mauro Carvalho Chehab <>
    Signed-off-by: Peter Huewe <>
    Signed-off-by: Greg Kroah-Hartman <>
    Mauro Carvalho Chehab committed with gregkh Sep 28, 2012
  14. sata_svw: check DMA start bit before reset

    commit b03e66a upstream.
    If kdump is triggered with pending IO, controller may not respond causing
    kdump to fail.
    During error recovery ata_do_dev_read_id never completes due hang
    in mmio_insw.
    if DMA start bit is cleared before reset, PIO command is successful
    and kdump succeeds.
    Signed-off-by: David Milburn <>
    Signed-off-by: Jeff Garzik <>
    Cc: CAI Qian <>
    Signed-off-by: Greg Kroah-Hartman <>
    davidmilburn committed with gregkh Oct 29, 2012
  15. ixgbe: add support for X540-AT1

    commit df376f0 upstream.
    This patch adds device support for Ethernet Controller X540-AT1.
    Signed-off-by: Josh Hay <>
    Tested-by: Phil Schmitt <>
    Signed-off-by: Jeff Kirsher <>
    Signed-off-by: Abdallah Chatila <>
    Signed-off-by: Greg Kroah-Hartman <> committed with gregkh Sep 21, 2012
  16. KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set (CVE-…

    commit 6d1068b upstream.
    On hosts without the XSAVE support unprivileged local user can trigger
    oops similar to the one below by setting X86_CR4_OSXSAVE bit in guest
    cr4 register using KVM_SET_SREGS ioctl and later issuing KVM_RUN
    invalid opcode: 0000 [#2] SMP
    Modules linked in: tun ip6table_filter ip6_tables ebtable_nat ebtables
    Pid: 24935, comm: zoog_kvm_monito Tainted: G      D      3.2.0-3-686-pae
    EIP: 0060:[<f8b9550c>] EFLAGS: 00210246 CPU: 0
    EIP is at kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm]
    EAX: 00000001 EBX: 000f387e ECX: 00000000 EDX: 00000000
    ESI: 00000000 EDI: 00000000 EBP: ef5a0060 ESP: d7c63e70
     DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
    Process zoog_kvm_monito (pid: 24935, ti=d7c62000 task=ed84a0c0
     00000001 f70a1200 f8b940a9 ef5a0060 00000000 00200202 f8769009 00000000
     ef5a0060 000f387e eda5c020 8722f9c8 00015bae 00000000 ed84a0c0 ed84a0c0
     c12bf02d 0000ae80 ef7f8740 fffffffb f359b740 ef5a0060 f8b85dc1 0000ae80
    Call Trace:
     [<f8b940a9>] ? kvm_arch_vcpu_ioctl_set_sregs+0x2fe/0x308 [kvm]
     [<c12bfb44>] ? syscall_call+0x7/0xb
    Code: 89 e8 e8 14 ee ff ff ba 00 00 04 00 89 e8 e8 98 48 ff ff 85 c0 74
    1e 83 7d 48 00 75 18 8b 85 08 07 00 00 31 c9 8b 95 0c 07 00 00 <0f> 01
    d1 c7 45 48 01 00 00 00 c7 45 1c 01 00 00 00 0f ae f0 89
    EIP: [<f8b9550c>] kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm] SS:ESP
    QEMU first retrieves the supported features via KVM_GET_SUPPORTED_CPUID
    and then sets them later. So guest's X86_FEATURE_XSAVE should be masked
    out on hosts without X86_FEATURE_XSAVE, making kvm_set_cr4 with
    X86_CR4_OSXSAVE fail. Userspaces that allow specifying guest cpuid with
    X86_FEATURE_XSAVE even on hosts that do not support it, might be
    susceptible to this attack from inside the guest as well.
    Allow setting X86_CR4_OSXSAVE bit only if host has XSAVE support.
    Signed-off-by: Petr Matousek <>
    Signed-off-by: Marcelo Tosatti <>
    Signed-off-by: Greg Kroah-Hartman <>
    Petr Matousek committed with gregkh Nov 6, 2012
  17. HID: add quirk for Freescale i.MX28 ROM recovery

    commit 2843b67 upstream.
    The USB recovery mode present in i.MX28 ROM emulates USB HID.
    It needs this quirk to behave properly.
    Signed-off-by: Marek Vasut <>
    Cc: Chen Peter <>
    Cc: Jiri Kosina <>
    [ fix alphabetical ordering]
    Signed-off-by: Jiri Kosina <>
    Signed-off-by: Greg Kroah-Hartman <>
    Marek Vasut committed with gregkh Aug 5, 2012
  18. pstore/ram: Fix printk format warning

    commit 0427193 upstream.
    Fix printk format warning (on i386) in pstore:
    fs/pstore/ram.c:409:3: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'size_t'
    Signed-off-by: Randy Dunlap <>
    Acked-by: Kees Cook <>
    Signed-off-by: Anton Vorontsov <>
    Signed-off-by: Greg Kroah-Hartman <>
    Randy Dunlap committed with gregkh Aug 4, 2012
  19. bas_gigaset: fix pre_reset handling

    commit c6fdd8e upstream.
    The delayed work function int_in_work() may call usb_reset_device()
    and thus, indirectly, the driver's pre_reset method. Trying to
    cancel the work synchronously in that situation would deadlock.
    Fix by avoiding cancel_work_sync() in the pre_reset method.
    If the reset was NOT initiated by int_in_work() this might cause
    int_in_work() to run after the post_reset method, with urb_int_in
    already resubmitted, so handle that case gracefully.
    Signed-off-by: Tilman Schmidt <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    tilmanschmidt committed with gregkh Oct 24, 2012
  20. ALSA: hda - Add support for Realtek ALC292

    commit af02dde upstream.
    We found a new codec ID 292, and that just a simple quirk would enable
    sound output/input on this ALC292 chip.
    Tested-by: Acelan Kao <>
    Signed-off-by: David Henningsson <>
    Signed-off-by: Takashi Iwai <>
    Signed-off-by: Greg Kroah-Hartman <>
    David Henningsson committed with gregkh Nov 21, 2012
  21. ALSA: hda - Fix missing beep on ASUS X43U notebook

    commit 7110005 upstream.
    Signed-off-by: Duncan Roe <>
    Signed-off-by: Takashi Iwai <>
    Signed-off-by: Greg Kroah-Hartman <>
    duncan-roe committed with gregkh Oct 10, 2012
  22. ALSA: hda - Add new codec ALC283 ALC290 support

    commit 7ff34ad upstream.
    These are compatible with standard ALC269 parser.
    Signed-off-by: Kailang Yang <>
    Signed-off-by: Takashi Iwai <>
    Signed-off-by: Greg Kroah-Hartman <>
    Kailang Yang committed with gregkh Oct 6, 2012
  23. writeback: put unused inodes to LRU after writeback completion

    commit 4eff96d upstream.
    Commit 169ebd9 ("writeback: Avoid iput() from flusher thread")
    removed iget-iput pair from inode writeback.  As a side effect, inodes
    that are dirty during iput_final() call won't be ever added to inode LRU
    (iput_final() doesn't add dirty inodes to LRU and later when the inode
    is cleaned there's noone to add the inode there).  Thus inodes are
    effectively unreclaimable until someone looks them up again.
    The practical effect of this bug is limited by the fact that inodes are
    pinned by a dentry for long enough that the inode gets cleaned.  But
    still the bug can have nasty consequences leading up to OOM conditions
    under certain circumstances.  Following can easily reproduce the
      for (( i = 0; i < 1000; i++ )); do
        mkdir $i
        for (( j = 0; j < 1000; j++ )); do
          touch $i/$j
          echo 2 > /proc/sys/vm/drop_caches
    then one needs to run 'sync; ls -lR' to make inodes reclaimable again.
    We fix the issue by inserting unused clean inodes into the LRU after
    writeback finishes in inode_sync_complete().
    Signed-off-by: Jan Kara <>
    Reported-by: OGAWA Hirofumi <>
    Cc: Al Viro <>
    Cc: OGAWA Hirofumi <>
    Cc: Wu Fengguang <>
    Cc: Dave Chinner <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
    jankara committed with gregkh Nov 27, 2012
  24. PM / QoS: fix wrong error-checking condition

    commit a7227a0 upstream.
    dev_pm_qos_add_request() can return 0, 1, or a negative error code,
    therefore the correct error test is "if (error < 0)." Checking just for
    non-zero return code leads to erroneous setting of the req->dev pointer
    to NULL, which then leads to a repeated call to
    dev_pm_qos_add_ancestor_request() in st1232_ts_irq_handler(). This in turn
    leads to an Oops, when the I2C host adapter is unloaded and reloaded again
    because of the inconsistent state of its QoS request list.
    Signed-off-by: Guennadi Liakhovetski <>
    Signed-off-by: Rafael J. Wysocki <>
    Signed-off-by: Greg Kroah-Hartman <>
    lyakh committed with gregkh Nov 23, 2012
  25. sparc64: not any error from do_sigaltstack() should fail rt_sigreturn()

    commit fae2ae2 upstream.
    If a signal handler is executed on altstack and another signal comes,
    we will end up with rt_sigreturn() on return from the second handler
    getting -EPERM from do_sigaltstack().  It's perfectly OK, since we
    are not asking to change the settings; in fact, they couldn't have been
    changed during the second handler execution exactly because we'd been
    on altstack all along.  64bit sigreturn on sparc treats any error from
    do_sigaltstack() as "SIGSEGV now"; we need to switch to the same semantics
    we are using on other architectures.
    Signed-off-by: Al Viro <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    Al Viro committed with gregkh Nov 19, 2012
  26. jbd: Fix lock ordering bug in journal_unmap_buffer()

    commit 25389bb upstream.
    Commit 09e05d4 introduced a wait for transaction commit into
    journal_unmap_buffer() in the case we are truncating a buffer undergoing commit
    in the page stradding i_size on a filesystem with blocksize < pagesize. Sadly
    we forgot to drop buffer lock before waiting for transaction commit and thus
    deadlock is possible when kjournald wants to lock the buffer.
    Fix the problem by dropping the buffer lock before waiting for transaction
    commit. Since we are still holding page lock (and that is OK), buffer cannot
    disappear under us.
    Signed-off-by: Jan Kara <>
    Signed-off-by: Greg Kroah-Hartman <>
    jankara committed with gregkh Nov 23, 2012
  27. can: bcm: initialize ifindex for timeouts without previous frame rece…

    commit 81b4011 upstream.
    Set in the rx_ifindex to pass the correct interface index in the case of a
    message timeout detection. Usually the rx_ifindex value is set at receive
    time. But when no CAN frame has been received the RX_TIMEOUT notification
    did not contain a valid value.
    Reported-by: Andre Naujoks <>
    Signed-off-by: Oliver Hartkopp <>
    Signed-off-by: Marc Kleine-Budde <>
    Signed-off-by: Greg Kroah-Hartman <>
    hartkopp committed with gregkh Nov 26, 2012
  28. can: peak_usb: fix hwtstamp assignment

    commit c9faaa0 upstream.
    The skb->tstamp is set to the hardware timestamp when available in the USB
    urb message. This leads to user visible timestamps which contain the 'uptime'
    of the USB adapter - and not the usual system generated timestamp.
    Fix this wrong assignment by applying the available hardware timestamp to the
    skb_shared_hwtstamps data structure - which is intended for this purpose.
    Signed-off-by: Oliver Hartkopp <>
    Signed-off-by: Marc Kleine-Budde <>
    Signed-off-by: Greg Kroah-Hartman <>
    hartkopp committed with gregkh Nov 21, 2012
  29. radeon: add AGPMode 1 quirk for RV250

    commit 4517100 upstream.
    The Intel 82855PM host bridge / Mobility FireGL 9000 RV250 combination
    in an (outdated) ThinkPad T41 needs AGPMode 1 for suspend/resume (under
    KMS, that is). So add a quirk for it.
    (Change R250 to RV250 in comment for preceding quirk too.)
    Signed-off-by: Paul Bolle <>
    Signed-off-by: Alex Deucher <>
    Signed-off-by: Greg Kroah-Hartman <>
    pebolle committed with gregkh Nov 19, 2012
  30. mac80211: deinitialize ibss-internals after emptiness check

    commit b78a493 upstream.
    The check whether the IBSS is active and can be removed should be
    performed before deinitializing the fields used for the check/search.
    Otherwise, the configured BSS will not be found and removed properly.
    To make it more clear for the future, rename sdata->u.ibss to the
    local pointer ifibss which is used within the checks.
    This behaviour was introduced by
    ("mac80211: fix IBSS teardown race")
    Signed-off-by: Simon Wunderlich <>
    Cc: Ignacy Gawedzki <>
    Signed-off-by: Johannes Berg <>
    Signed-off-by: Greg Kroah-Hartman <>
    Simon Wunderlich committed with gregkh Nov 13, 2012