Permalink
Commits on Jan 3, 2015
  1. Input: xpad - use proper endpoint type

    gregkh authored and tjormola committed Nov 25, 2014
    The xpad wireless endpoint is not a bulk endpoint on my devices, but
    rather an interrupt one, so the USB core complains when it is submitted.
    I'm guessing that the author really did mean that this should be an
    interrupt urb, but as there are a zillion different xpad devices out
    there, let's cover out bases and handle both bulk and interrupt
    endpoints just as easily.
    
    Signed-off-by: "Pierre-Loup A. Griffais" <pgriffais@valvesoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
  2. Input: xpad - add Thrustmaster as Xbox 360 controller vendor

    rantala authored and tjormola committed Oct 16, 2014
    Add Thrustmaster as Xbox 360 controller vendor. This is required for
    example to make the GP XID (044f:b326) gamepad work.
    
    Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
  3. Input: xpad - add USB ID for Thrustmaster Ferrari 458 Racing Wheel

    rantala authored and tjormola committed Oct 16, 2014
    Add the USB ID for the Xbox 360 Thrustmaster Ferrari 458 Racing Wheel.
    
    Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
  4. Input: xpad - sync device IDs with xboxdrv

    benpicco authored and tjormola committed Sep 8, 2014
    The userspace xboxdrv driver knows some more device ids than the kernel.
    This patch adds the missing xbox gamepads from [1] to xpad.c
    
    [1] https://github.com/Grumbel/xboxdrv/blob/master/src/xpad_device.cpp
    
    Signed-off-by: Benjamin Valentin <benpicco@zedat.fu-berlin.de>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
  5. Input: xpad - add VID/PID for Razer Sabertooth

    zzattack authored and tjormola committed Sep 8, 2014
    The xpad driver recognizes Razer Sabertooth controllers as generic xbox
    controller, while it is really a 360 controller.  This patch adds pid/vid
    mappings for the controller so that it is correctly recognized.
    
    Signed-off-by: Frank Razenberg <frank@zzattack.org>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
  6. Input: xpad - add new USB IDs for Logitech F310 and F710

    PetrSebor authored and tjormola committed Jan 2, 2014
    This enables the rumble force feedback on the F710 unit since
    it is no longer treated as XTYPE_UNKNOWN type.
    
    Signed-off-by: Petr Sebor <petr@scssoft.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
  7. Input: xpad - change D-PAD mapping on Razer devices

    thor27 authored and tjormola committed Jan 2, 2014
    When using Razer Onza controller the dpad doesn't work in many games
    because D-PAD was mapped to buttons (useful for dance pads) and not to
    HAT0X/Y axis.
    
    ers who really want to have it mapped to buttons can restore previous
    behavior by using 'dpad_to_buttons' module option.
    
    Signed-off-by: Thomaz de Oliveira dos Reis <thor27@gmail.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Tuomas Jormola <tj@solitudo.net>
Commits on Nov 20, 2014
  1. Merge pull request ValveSoftware#10 from LunarG/sample_c-performance

    Plagman committed Nov 20, 2014
    Set fast sample_c: bit 9 of HALF_SLICE_CHICKEN3
  2. Merge pull request ValveSoftware#9 from fledermaus/alchemist-3.10+bac…

    Plagman committed Nov 20, 2014
    …kports-2014-11
    
    Alchemist 3.10+backports 2014 11
  3. Merge pull request ValveSoftware#8 from ArtVandelae/alchemist-3.10

    Plagman committed Nov 20, 2014
    Sony driver changes to sync with upstream
  4. Set fast sample_c: bit 9 of HALF_SLICE_CHICKEN3

    Mike Stroyan Mike Stroyan
    Mike Stroyan authored and Mike Stroyan committed Nov 4, 2014
Commits on Nov 14, 2014
  1. Linux 3.10.60

    gregkh committed Nov 14, 2014
  2. libceph: ceph-msgr workqueue needs a resque worker

    idryomov authored and gregkh committed Oct 10, 2014
    commit f9865f0 upstream.
    
    Commit f363e45 ("net/ceph: make ceph_msgr_wq non-reentrant")
    effectively removed WQ_MEM_RECLAIM flag from ceph_msgr_wq.  This is
    wrong - libceph is very much a memory reclaim path, so restore it.
    
    Signed-off-by: Ilya Dryomov <idryomov@redhat.com>
    Tested-by: Micha Krause <micha@krausam.de>
    Reviewed-by: Sage Weil <sage@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  3. Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup

    masoncl authored and gregkh committed Nov 4, 2014
    commit 6e5aafb upstream.
    
    If we hit any errors in btrfs_lookup_csums_range, we'll loop through all
    the csums we allocate and free them.  But the code was using list_entry
    incorrectly, and ended up trying to free the on-stack list_head instead.
    
    This bug came from commit 0678b61
    
    btrfs: Don't BUG_ON kzalloc error in btrfs_lookup_csums_range()
    
    Signed-off-by: Chris Mason <clm@fb.com>
    Reported-by: Erik Berg <btrfs@slipsprogrammoer.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  4. of: Fix overflow bug in string property parsing functions

    glikely authored and gregkh committed Nov 3, 2014
    commit a87fa1d upstream.
    
    The string property read helpers will run off the end of the buffer if
    it is handed a malformed string property. Rework the parsers to make
    sure that doesn't happen. At the same time add new test cases to make
    sure the functions behave themselves.
    
    The original implementations of of_property_read_string_index() and
    of_property_count_strings() both open-coded the same block of parsing
    code, each with it's own subtly different bugs. The fix here merges
    functions into a single helper and makes the original functions static
    inline wrappers around the helper.
    
    One non-bugfix aspect of this patch is the addition of a new wrapper,
    of_property_read_string_array(). The new wrapper is needed by the
    device_properties feature that Rafael is working on and planning to
    merge for v3.19. The implementation is identical both with and without
    the new static inline wrapper, so it just got left in to reduce the
    churn on the header file.
    
    Signed-off-by: Grant Likely <grant.likely@linaro.org>
    Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
    Cc: Rob Herring <robh+dt@kernel.org>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Darren Hart <darren.hart@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  5. sysfs: driver core: Fix glue dir race condition by gdp_mutex

    YijingWang authored and gregkh committed Nov 7, 2014
    commit e4a60d1 upstream.
    
    There is a race condition when removing glue directory.
    It can be reproduced in following test:
    
    path 1: Add first child device
    device_add()
        get_device_parent()
                /*find parent from glue_dirs.list*/
                list_for_each_entry(k, &dev->class->p->glue_dirs.list, entry)
                        if (k->parent == parent_kobj) {
                                kobj = kobject_get(k);
                                break;
                        }
                ....
                class_dir_create_and_add()
    
    path2: Remove last child device under glue dir
    device_del()
        cleanup_device_parent()
                cleanup_glue_dir()
                        kobject_put(glue_dir);
    
    If path2 has been called cleanup_glue_dir(), but not
    call kobject_put(glue_dir), the glue dir is still
    in parent's kset list. Meanwhile, path1 find the glue
    dir from the glue_dirs.list. Path2 may release glue dir
    before path1 call kobject_get(). So kernel will report
    the warning and bug_on.
    
    This is a "classic" problem we have of a kref in a list
    that can be found while the last instance could be removed
    at the same time.
    
    This patch reuse gdp_mutex to fix this race condition.
    
    The following calltrace is captured in kernel 3.4, but
    the latest kernel still has this bug.
    
    -----------------------------------------------------
    <4>[ 3965.441471] WARNING: at ...include/linux/kref.h:41 kobject_get+0x33/0x40()
    <4>[ 3965.441474] Hardware name: Romley
    <4>[ 3965.441475] Modules linked in: isd_iop(O) isd_xda(O)...
    ...
    <4>[ 3965.441605] Call Trace:
    <4>[ 3965.441611]  [<ffffffff8103717a>] warn_slowpath_common+0x7a/0xb0
    <4>[ 3965.441615]  [<ffffffff810371c5>] warn_slowpath_null+0x15/0x20
    <4>[ 3965.441618]  [<ffffffff81215963>] kobject_get+0x33/0x40
    <4>[ 3965.441624]  [<ffffffff812d1e45>] get_device_parent.isra.11+0x135/0x1f0
    <4>[ 3965.441627]  [<ffffffff812d22d4>] device_add+0xd4/0x6d0
    <4>[ 3965.441631]  [<ffffffff812d0dbc>] ? dev_set_name+0x3c/0x40
    ....
    <2>[ 3965.441912] kernel BUG at ..../fs/sysfs/group.c:65!
    <4>[ 3965.441915] invalid opcode: 0000 [ValveSoftware#1] SMP
    ...
    <4>[ 3965.686743]  [<ffffffff811a677e>] sysfs_create_group+0xe/0x10
    <4>[ 3965.686748]  [<ffffffff810cfb04>] blk_trace_init_sysfs+0x14/0x20
    <4>[ 3965.686753]  [<ffffffff811fcabb>] blk_register_queue+0x3b/0x120
    <4>[ 3965.686756]  [<ffffffff812030bc>] add_disk+0x1cc/0x490
    ....
    -------------------------------------------------------
    
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  6. i2c: at91: don't account as iowait

    Wolfram Sang authored and gregkh committed Nov 3, 2014
    commit 11cfbfb upstream.
    
    iowait is for blkio [1]. I2C shouldn't use it.
    
    [1] https://lkml.org/lkml/2014/11/3/317
    
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  7. acer-wmi: Add acpi_backlight=video quirk for the Acer KAV80

    jwrdegoede authored and gregkh committed Oct 22, 2014
    commit 183fd8f upstream.
    
    The acpi-video backlight interface on the Acer KAV80 is broken, and worse
    it causes the entire machine to slow down significantly after a suspend/resume.
    
    Blacklist it, and use the acer-wmi backlight interface instead. Note that
    the KAV80 is somewhat unique in that it is the only Acer model where we
    fall back to acer-wmi after blacklisting, rather then using the native
    (e.g. intel) backlight driver. This is done because there is no native
    backlight interface on this model.
    
    BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1128309
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  8. rbd: Fix error recovery in rbd_obj_read_sync()

    jankara authored and gregkh committed Oct 22, 2014
    commit a8d4205 upstream.
    
    When we fail to allocate page vector in rbd_obj_read_sync() we just
    basically ignore the problem and continue which will result in an oops
    later. Fix the problem by returning proper error.
    
    CC: Yehuda Sadeh <yehuda@inktank.com>
    CC: Sage Weil <sage@inktank.com>
    CC: ceph-devel@vger.kernel.org
    Coverity-id: 1226882
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Ilya Dryomov <idryomov@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  9. drm/radeon: remove invalid pci id

    Alex Deucher authored and gregkh committed Oct 26, 2014
    commit 8c3e434 upstream.
    
    0x4c6e is a secondary device id so should not be used
    by the driver.
    
    Noticed-by: Mark Kettenis <mark.kettenis@xs4all.nl>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  10. usb: gadget: udc: core: fix kernel oops with soft-connect

    Felipe Balbi authored and gregkh committed Nov 10, 2014
    [ Upstream commit bfa6b18 ]
    
    Currently, there's no guarantee that udc->driver
    will be valid when using soft_connect sysfs
    interface. In fact, we can very easily trigger
    a NULL pointer dereference by trying to disconnect
    when a gadget driver isn't loaded.
    
    Fix this bug:
    
    ~# echo disconnect > soft_connect
    [   33.685743] Unable to handle kernel NULL pointer dereference at virtual address 00000014
    [   33.694221] pgd = ed0cc000
    [   33.697174] [00000014] *pgd=ae351831, *pte=00000000, *ppte=00000000
    [   33.703766] Internal error: Oops: 17 [ValveSoftware#1] SMP ARM
    [   33.708697] Modules linked in: xhci_plat_hcd xhci_hcd snd_soc_davinci_mcasp snd_soc_tlv320aic3x snd_soc_edma snd_soc_omap snd_soc_evm snd_soc_core dwc3 snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd lis3lv02d_i2c matrix_keypad lis3lv02d dwc3_omap input_polldev soundcore
    [   33.734372] CPU: 0 PID: 1457 Comm: bash Not tainted 3.17.0-09740-ga93416e-dirty #345
    [   33.742457] task: ee71ce00 ti: ee68a000 task.ti: ee68a000
    [   33.748116] PC is at usb_udc_softconn_store+0xa4/0xec
    [   33.753416] LR is at mark_held_locks+0x78/0x90
    [   33.758057] pc : [<c04df128>]    lr : [<c00896a4>]    psr: 20000013
    [   33.758057] sp : ee68bec8  ip : c0c00008  fp : ee68bee4
    [   33.770050] r10: ee6b394c  r9 : ee68bf80  r8 : ee6062c0
    [   33.775508] r7 : 00000000  r6 : ee6062c0  r5 : 0000000b  r4 : ee739408
    [   33.782346] r3 : 00000000  r2 : 00000000  r1 : ee71d390  r0 : ee664170
    [   33.789168] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
    [   33.796636] Control: 10c5387d  Table: ad0cc059  DAC: 00000015
    [   33.802638] Process bash (pid: 1457, stack limit = 0xee68a248)
    [   33.808740] Stack: (0xee68bec8 to 0xee68c000)
    [   33.813299] bec0:                   0000000b c0411284 ee6062c0 00000000 ee68bef4 ee68bee8
    [   33.821862] bee0: c04112ac c04df090 ee68bf14 ee68bef8 c01c2868 c0411290 0000000b ee6b3940
    [   33.830419] bf00: 00000000 00000000 ee68bf4c ee68bf18 c01c1a24 c01c2818 00000000 00000000
    [   33.838990] bf20: ee61b940 ee2f47c0 0000000b 000ce408 ee68bf80 c000f304 ee68a000 00000000
    [   33.847544] bf40: ee68bf7c ee68bf50 c0152dd8 c01c1960 ee68bf7c c0170af8 ee68bf7c ee2f47c0
    [   33.856099] bf60: ee2f47c0 000ce408 0000000b c000f304 ee68bfa4 ee68bf80 c0153330 c0152d34
    [   33.864653] bf80: 00000000 00000000 0000000b 000ce408 b6e7fb50 00000004 00000000 ee68bfa8
    [   33.873204] bfa0: c000f080 c01532e8 0000000b 000ce408 00000001 000ce408 0000000b 00000000
    [   33.881763] bfc0: 0000000b 000ce408 b6e7fb50 00000004 0000000b 00000000 000c5758 00000000
    [   33.890319] bfe0: 00000000 bec2c924 b6de422d b6e1d226 40000030 00000001 75716d2f 00657565
    [   33.898890] [<c04df128>] (usb_udc_softconn_store) from [<c04112ac>] (dev_attr_store+0x28/0x34)
    [   33.907920] [<c04112ac>] (dev_attr_store) from [<c01c2868>] (sysfs_kf_write+0x5c/0x60)
    [   33.916200] [<c01c2868>] (sysfs_kf_write) from [<c01c1a24>] (kernfs_fop_write+0xd0/0x194)
    [   33.924773] [<c01c1a24>] (kernfs_fop_write) from [<c0152dd8>] (vfs_write+0xb0/0x1bc)
    [   33.932874] [<c0152dd8>] (vfs_write) from [<c0153330>] (SyS_write+0x54/0xb0)
    [   33.940247] [<c0153330>] (SyS_write) from [<c000f080>] (ret_fast_syscall+0x0/0x48)
    [   33.948160] Code: e1a01007 e12fff33 e5140004 e5143008 (e5933014)
    [   33.954625] ---[ end trace f849bead94eab7ea ]---
    
    Fixes: 2ccea03 (usb: gadget: introduce UDC Class)
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  11. usb: gadget: function: acm: make f_acm pass USB20CV Chapter9

    Felipe Balbi authored and gregkh committed Nov 10, 2014
    [ Upstream commit 52ec49a ]
    
    During Halt Endpoint Test, our interrupt endpoint
    will be disabled, which will clear out ep->desc
    to NULL. Unless we call config_ep_by_speed() again,
    we will not be able to enable this endpoint which
    will make us fail that test.
    
    Fixes: f9c56cd (usb: gadget: Clear usb_endpoint_descriptor
    	inside the struct usb_ep on disable)
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  12. usb: dwc3: gadget: fix set_halt() bug with pending transfers

    Felipe Balbi authored and gregkh committed Nov 10, 2014
    [ Upstream commit 7a60855 ]
    
    According to our Gadget Framework API documentation,
    ->set_halt() *must* return -EAGAIN if we have pending
    transfers (on either direction) or FIFO isn't empty (on
    TX endpoints).
    
    Fix this bug so that the mass storage gadget can be used
    without stall=0 parameter.
    
    This patch should be backported to all kernels since v3.2.
    
    Suggested-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  13. crypto: algif - avoid excessive use of socket buffer in skcipher

    oniko authored and gregkh committed Aug 25, 2014
    commit e2cffb5 upstream.
    
    On archs with PAGE_SIZE >= 64 KiB the function skcipher_alloc_sgl()
    fails with -ENOMEM no matter what user space actually requested.
    This is caused by the fact sock_kmalloc call inside the function tried
    to allocate more memory than allowed by the default kernel socket buffer
    size (kernel param net.core.optmem_max).
    
    Signed-off-by: Ondrej Kozina <okozina@redhat.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  14. mm: Remove false WARN_ON from pagecache_isize_extended()

    jankara authored and gregkh committed Oct 29, 2014
    commit f55fefd upstream.
    
    The WARN_ON checking whether i_mutex is held in
    pagecache_isize_extended() was wrong because some filesystems (e.g.
    XFS) use different locks for serialization of truncates / writes. So
    just remove the check.
    
    Signed-off-by: Jan Kara <jack@suse.cz>
    Reviewed-by: Dave Chinner <dchinner@redhat.com>
    Signed-off-by: Dave Chinner <david@fromorbit.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  15. x86, apic: Handle a bad TSC more gracefully

    amluto authored and gregkh committed Oct 15, 2014
    commit b47dcbd upstream.
    
    If the TSC is unusable or disabled, then this patch fixes:
    
     - Confusion while trying to clear old APIC interrupts.
     - Division by zero and incorrect programming of the TSC deadline
       timer.
    
    This fixes boot if the CPU has a TSC deadline timer but a missing or
    broken TSC.  The failure to boot can be observed with qemu using
    -cpu qemu64,-tsc,+tsc-deadline
    
    This also happens to me in nested KVM for unknown reasons.
    With this patch, I can boot cleanly (although without a TSC).
    
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Cc: Bandan Das <bsd@redhat.com>
    Link: http://lkml.kernel.org/r/e2fa274e498c33988efac0ba8b7e3120f7f92d78.1413393027.git.luto@amacapital.net
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16. posix-timers: Fix stack info leak in timer_create()

    minipli authored and gregkh committed Oct 4, 2014
    commit 6891c45 upstream.
    
    If userland creates a timer without specifying a sigevent info, we'll
    create one ourself, using a stack local variable. Particularly will we
    use the timer ID as sival_int. But as sigev_value is a union containing
    a pointer and an int, that assignment will only partially initialize
    sigev_value on systems where the size of a pointer is bigger than the
    size of an int. On such systems we'll copy the uninitialized stack bytes
    from the timer_create() call to userland when the timer actually fires
    and we're going to deliver the signal.
    
    Initialize sigev_value with 0 to plug the stack info leak.
    
    Found in the PaX patch, written by the PaX Team.
    
    Fixes: 5a9fa73 ("posix-timers: kill ->it_sigev_signo and...")
    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Brad Spengler <spender@grsecurity.net>
    Cc: PaX Team <pageexec@freemail.hu>
    Link: http://lkml.kernel.org/r/1412456799-32339-1-git-send-email-minipli@googlemail.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  17. mac80211: fix typo in starting baserate for rts_cts_rate_idx

    Karl Beldan authored and gregkh committed Oct 13, 2014
    commit c7abf25 upstream.
    
    It affects non-(V)HT rates and can lead to selecting an rts_cts rate
    that is not a basic rate or way superior to the reference rate (ATM
    rates[0] used for the 1st attempt of the protected frame data).
    
    E.g, assuming drivers register growing (bitrate) sorted tables of
    ieee80211_rate-s, having :
    - rates[0].idx == d'2 and basic_rates == b'10100
    will select rts_cts idx b'10011 & ~d'(BIT(2)-1), i.e. 1, likewise
    - rates[0].idx == d'2 and basic_rates == b'10001
    will select rts_cts idx b'10000
    The first is not a basic rate and the second is > rates[0].
    
    Also, wrt severity of the addressed misbehavior, ATM we only have one
    rts_cts_rate_idx rather than one per rate table entry, so this idx might
    still point to bitrates > rates[1..MAX_RATES].
    
    Fixes: 5253ffb ("mac80211: always pick a basic rate to tx RTS/CTS for pre-HT rates")
    Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18. PM / Sleep: fix recovery during resuming from hibernation

    ideak authored and gregkh committed Oct 24, 2014
    commit 94fb823 upstream.
    
    If a device's dev_pm_ops::freeze callback fails during the QUIESCE
    phase, we don't rollback things correctly calling the thaw and complete
    callbacks. This could leave some devices in a suspended state in case of
    an error during resuming from hibernation.
    
    Signed-off-by: Imre Deak <imre.deak@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19. tty: Fix high cpu load if tty is unreleaseable

    peterhurley authored and gregkh committed Oct 16, 2014
    commit 37b1645 upstream.
    
    Kernel oops can cause the tty to be unreleaseable (for example, if
    n_tty_read() crashes while on the read_wait queue). This will cause
    tty_release() to endlessly loop without sleeping.
    
    Use a killable sleep timeout which grows by 2n+1 jiffies over the interval
    [0, 120 secs.) and then jumps to forever (but still killable).
    
    NB: killable just allows for the task to be rewoken manually, not
    to be terminated.
    
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20. quota: Properly return errors from dquot_writeback_dquots()

    jankara authored and gregkh committed Oct 22, 2014
    commit 474d260 upstream.
    
    Due to a switched left and right side of an assignment,
    dquot_writeback_dquots() never returned error. This could result in
    errors during quota writeback to not be reported to userspace properly.
    Fix it.
    
    Coverity-id: 1226884
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21. ext3: Don't check quota format when there are no quota files

    jankara authored and gregkh committed Sep 16, 2014
    commit 7938db4 upstream.
    
    The check whether quota format is set even though there are no
    quota files with journalled quota is pointless and it actually
    makes it impossible to turn off journalled quotas (as there's
    no way to unset journalled quota format). Just remove the check.
    
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22. nfsd4: fix crash on unknown operation number

    J. Bruce Fields authored and gregkh committed Oct 22, 2014
    commit 51904b0 upstream.
    
    Unknown operation numbers are caught in nfsd4_decode_compound() which
    sets op->opnum to OP_ILLEGAL and op->status to nfserr_op_illegal.  The
    error causes the main loop in nfsd4_proc_compound() to skip most
    processing.  But nfsd4_proc_compound also peeks ahead at the next
    operation in one case and doesn't take similar precautions there.
    
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23. cpc925_edac: Report UE events properly

    almostivan authored and gregkh committed Oct 15, 2014
    commit fa19ac4 upstream.
    
    Fix UE event being reported as HW_EVENT_ERR_CORRECTED.
    
    Signed-off-by: Jason Baron <jbaron@akamai.com>
    Link: http://lkml.kernel.org/r/8beb13803500076fef827eab33d523e355d83759.1413405053.git.jbaron@akamai.com
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>