Commits on Feb 18, 2013
  1. Linux 3.8

    committed Feb 18, 2013
  2. Merge branch 'for-linus' of git://…

    Pull input subsystem fixes from Dmitry Torokhov:
     "Two small driver fixups and a documentation update for managed input
    * 'for-linus' of git://
      Input: wacom - fix wacom_set_report retry logic
      Input: document that unregistering managed devices is not necessary
      Input: lm8323 - fix checking PWM interrupt status
    committed Feb 18, 2013
  3. mm: fix pageblock bitmap allocation

    Commit c060f94 ("mm: use aligned zone start for pfn_to_bitidx
    calculation") fixed out calculation of the index into the pageblock
    bitmap when a !SPARSEMEM zome was not aligned to pageblock_nr_pages.
    However, the _allocation_ of that bitmap had never taken this alignment
    requirement into accout, so depending on the exact size and alignment of
    the zone, the use of that index could then access past the allocation,
    resulting in some very subtle memory corruption.
    This was reported (and bisected) by Ingo Molnar: one of his random
    config builds would hang with certain very specific kernel command line
    In the meantime, commit c060f94 has been marked for stable, so this
    fix needs to be back-ported to the stable kernels that backported the
    commit to use the right alignment.
    Bisected-and-tested-by: Ingo Molnar <>
    Acked-by: Mel Gorman <>
    Signed-off-by: Linus Torvalds <>
    committed Feb 18, 2013
Commits on Feb 15, 2013
  1. Merge tag 'stable/for-linus-3.8-rc7-tag-two' of git://…

    Pull xen fixes from Konrad Rzeszutek Wilk:
     "Two fixes:
       - A simple bug-fix for redundant NULL check.
       - CVE-2013-0228/XSA-42: x86/xen: don't assume %ds is usable in
         xen_iret for 32-bit PVOPS
      and two reverts:
       - Revert the PVonHVM kexec.  The patch introduces a regression with
         older hypervisor stacks, such as Xen 4.1."
    * tag 'stable/for-linus-3.8-rc7-tag-two' of git://
      Revert "xen PVonHVM: use E820_Reserved area for shared_info"
      Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info"
      xen: remove redundant NULL check before unregister_and_remove_pcpu().
      x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS.
    committed Feb 15, 2013
  2. Revert "[media] dvb_frontend: return -ENOTTY for unimplement IOCTL"

    As reported by Klaus Schmidinger:
     "In VDR I use an ioctl() call with FE_READ_UNCORRECTED_BLOCKS on a
      device (using stb0899).  After this call I check 'errno' for
      EOPNOTSUPP to determine whether this device supports this call.  This
      used to work just fine, until a few months ago I noticed that my
      devices using stb0899 didn't display their signal quality in VDR's OSD
      any more.  After further investigation I found that
      ioctl(FE_READ_UNCORRECTED_BLOCKS) no longer returns EOPNOTSUPP, but
      rather ENOTTY.  And since I stop getting the signal quality in case
      any unknown errno value appears, this broke my signal quality query
    While the changes reflect what is there at:
    it does cause regression on userspace.  So, revert it to stop the
    This reverts commit 177ffe5 ("[media] dvb_frontend: return -ENOTTY
    for unimplement IOCTL").
    Reported-by: Klaus Schmidinger <>
    Signed-off-by: Mauro Carvalho Chehab <>
    Signed-off-by: Linus Torvalds <>
    Mauro Carvalho Chehab committed with Feb 15, 2013
  3. Merge git://

    Pull sparc fixes from David Miller:
     "A couple small fixes for sparc including some THP brown-paper-bag
       1) During the merging of all the THP support for various
          architectures, sparc missed adding a
          HAVE_ARCH_TRANSPARENT_HUGEPAGE to it's Kconfig, oops.
       2) Sparc needs to be mindful of hugepages in get_user_pages_fast().
       3) Fix memory leak in SBUS probe, from Cong Ding.
       4) The sunvdc virtual disk client driver has a test of the bitmask of
          vdisk server supported operations which was off by one bit"
    * git://
      sunvdc: Fix off-by-one in generic_request().
      sparc64: Fix get_user_pages_fast() wrt. THP.
      sparc64: Add missing HAVE_ARCH_TRANSPARENT_HUGEPAGE.
      sparc: kernel/sbus.c: fix memory leakage
    committed Feb 15, 2013
  4. Merge branch 'x86-urgent-for-linus' of git://…

    Pull one more x86 fix from Peter Anvin:
     "Sigh.  One more patch in the "please don't brick my Samsung" series"
    * 'x86-urgent-for-linus' of git://
      efi: Clear EFI_RUNTIME_SERVICES rather than EFI_BOOT by "noefi" boot parameter
    committed Feb 15, 2013
  5. Merge tag '3.8-pci-fixes-3' of git://…

    Pull PCI fix from Bjorn Helgaas:
     "This is another fix for v3.8.  It fixes an oops that happens when a
      Thunderbolt adapter is unplugged (remove device, poll for PME events
      on no-longer-existing device, oops)."
    * tag '3.8-pci-fixes-3' of git://
      PCI/PM: Clean up PME state when removing a device
    committed Feb 15, 2013
  6. Merge tag 'omapdss-for-3.8-rc8' of git://…

    Pull omapdss fixes from Tomi Valkeinen:
     "It'd be great if these two late fixes would still make it into 3.8.
      The other one fixes ARM kernel compilation when using 'allyesconfig',
      and the other makes DPI displays function again on OMAP3630 boards:
       - Fix ARM compilation with "allyesconfig" (omapdrm: fix the
         dependency to omapdss)
       - fix DPI displays on OMAP3630 (OMAPDSS: add FEAT_DPI_USES_VDDS_DSI
         to omap3630_dss_feat_list)"
    * tag 'omapdss-for-3.8-rc8' of git://
      omapdrm: fix the dependency to omapdss
      OMAPDSS: add FEAT_DPI_USES_VDDS_DSI to omap3630_dss_feat_list
    committed Feb 15, 2013
  7. Merge branch 'i2c/for-current' of git://…

    Pull i2c maintainer info update from Wolfram Sang:
     "Since my old email and repos are not working anymore, and this already
      caused some confusion, I think a MAINTAINERS update for 3.8 is
      helpful.  So, people trying I2C with the new kernel can properly reach
      me and find my repos."
    * 'i2c/for-current' of git://
      MAINTAINERS: change my email and repos
    committed Feb 15, 2013
  8. Revert "xen PVonHVM: use E820_Reserved area for shared_info"

    This reverts commit 9d02b43.
    We are doing this b/c on 32-bit PVonHVM with older hypervisors
    (Xen 4.1) it ends up bothing up the start_info. This is bad b/c
    we use it for the time keeping, and the timekeeping code loops
    forever - as the version field never changes. Olaf says to
    revert it, so lets do that.
    Acked-by: Olaf Hering <>
    Signed-off-by: Konrad Rzeszutek Wilk <>
    Konrad Rzeszutek Wilk committed Feb 15, 2013
  9. Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info"

    This reverts commit a7be94a.
    Signed-off-by: Konrad Rzeszutek Wilk <>
    Konrad Rzeszutek Wilk committed Feb 15, 2013
Commits on Feb 14, 2013
  1. @davem330

    sunvdc: Fix off-by-one in generic_request().

    The 'operations' bitmap corresponds one-for-one with the operation
    codes, no adjustment is necessary.
    Reported-by: Mark Kettenis <>
    Signed-off-by: David S. Miller <>
    davem330 committed Feb 14, 2013
  2. @tomba

    omapdrm: fix the dependency to omapdss

    omapdrm uses "select" in Kconfig to enable omapdss. This doesn't work
    correctly, as "select" forces omapdss to be enabled in the config even
    if it normally could not be enabled because of missing Kconfig
    This causes a build break on ARM, when using allyesconfig:
    drivers/video/omap2/dss/dss.c: In function 'dss_calc_clock_div':
    drivers/video/omap2/dss/dss.c:572:20: error: 'CONFIG_OMAP2_DSS_MIN_FCK_PER_PCK' undeclared (first use in this function)
    drivers/video/omap2/dss/dss.c:572:20: note: each undeclared identifier is reported only once for each function it appears in
    Instead of using select, this patch changes omapdrm to use "depend
    Signed-off-by: Tomi Valkeinen <>
    tomba committed Feb 7, 2013
  3. @neilbrown @tomba

    OMAPDSS: add FEAT_DPI_USES_VDDS_DSI to omap3630_dss_feat_list

    commit 195e672
       OMAPDSS: DPI: Remove cpu_is_xxxx checks
    made the mistake of assuming that cpu_is_omap34xx() is exclusive of
    other cpu_is_* predicates whereas it includes cpu_is_omap3630().
    So on an omap3630, code that was previously enabled by
      if (cpu_is_omap34xx())
    is now disabled as
    So add FEAT_DPI_USES_VDDS_DSI to omap3630_dss_feat_list.
    Cc: Chandrabhanu Mahapatra <>
    Cc: Tomi Valkeinen <>
    Signed-off-by: NeilBrown <>
    Signed-off-by: Tomi Valkeinen <>
    neilbrown committed with tomba Dec 15, 2012
  4. efi: Clear EFI_RUNTIME_SERVICES rather than EFI_BOOT by "noefi" boot …

    There was a serious problem in samsung-laptop that its platform driver is
    designed to run under BIOS and running under EFI can cause the machine to
    become bricked or can cause Machine Check Exceptions.
        Discussion about this problem:
        The patches to fix this problem:
        efi: Make 'efi_enabled' a function to query EFI facilities
        samsung-laptop: Disable on EFI hardware
    Unfortunately this problem comes back again if users specify "noefi" option.
    This parameter clears EFI_BOOT and that driver continues to run even if running
    under EFI. Refer to the document, this parameter should clear
    	noefi		[X86] Disable EFI runtime services support.
    - If some or all EFI runtime services don't work, you can try following
      kernel command line parameters to turn off some or all EFI runtime
    	noefi		turn off all EFI runtime services
    Signed-off-by: Satoru Takeuchi <>
    Cc: Matt Fleming <>
    Cc: <>
    Signed-off-by: H. Peter Anvin <>
    Satoru Takeuchi committed with H. Peter Anvin Feb 14, 2013
Commits on Feb 13, 2013
  1. @Steap

    xen: remove redundant NULL check before unregister_and_remove_pcpu().

    unregister_and_remove_pcpu on a NULL pointer is a no-op, so the NULL check in
    sync_pcpu can be removed.
    Signed-off-by: Cyril Roelandt <>
    Signed-off-by: Konrad Rzeszutek Wilk <>
    Steap committed with Konrad Rzeszutek Wilk Feb 12, 2013
  2. @jbeulich

    x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS.

    This fixes CVE-2013-0228 / XSA-42
    Drew Jones while working on CVE-2013-0190 found that that unprivileged guest user
    in 32bit PV guest can use to crash the > guest with the panic like this:
    general protection fault: 0000 [#1] SMP
    last sysfs file: /sys/devices/vbd-51712/block/xvda/dev
    Modules linked in: sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4
    iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6
    xt_state nf_conntrack ip6table_filter ip6_tables ipv6 xen_netfront ext4
    mbcache jbd2 xen_blkfront dm_mirror dm_region_hash dm_log dm_mod [last
    unloaded: scsi_wait_scan]
    Pid: 1250, comm: r Not tainted 2.6.32-356.el6.i686 #1
    EIP: 0061:[<c0407462>] EFLAGS: 00010086 CPU: 0
    EIP is at xen_iret+0x12/0x2b
    EAX: eb8d0000 EBX: 00000001 ECX: 08049860 EDX: 00000010
    ESI: 00000000 EDI: 003d0f00 EBP: b77f8388 ESP: eb8d1fe0
     DS: 0000 ES: 007b FS: 0000 GS: 00e0 SS: 0069
    Process r (pid: 1250, ti=eb8d0000 task=c2953550 task.ti=eb8d0000)
     00000000 0027f416 00000073 00000206 b77f8364 0000007b 00000000 00000000
    Call Trace:
    Code: c3 8b 44 24 18 81 4c 24 38 00 02 00 00 8d 64 24 30 e9 03 00 00 00
    8d 76 00 f7 44 24 08 00 00 02 80 75 33 50 b8 00 e0 ff ff 21 e0 <8b> 40
    10 8b 04 85 a0 f6 ab c0 8b 80 0c b0 b3 c0 f6 44 24 0d 02
    EIP: [<c0407462>] xen_iret+0x12/0x2b SS:ESP 0069:eb8d1fe0
    general protection fault: 0000 [#2]
    ---[ end trace ab0d29a492dcd330 ]---
    Kernel panic - not syncing: Fatal exception
    Pid: 1250, comm: r Tainted: G      D    ---------------
    2.6.32-356.el6.i686 #1
    Call Trace:
     [<c08476df>] ? panic+0x6e/0x122
     [<c084b63c>] ? oops_end+0xbc/0xd0
     [<c084b260>] ? do_general_protection+0x0/0x210
     [<c084a9b7>] ? error_code+0x73/
    Petr says: "
     I've analysed the bug and I think that xen_iret() cannot cope with
     mangled DS, in this case zeroed out (null selector/descriptor) by either
     xen_failsafe_callback() or RESTORE_REGS because the corresponding LDT
     entry was invalidated by the reproducer. "
    Jan took a look at the preliminary patch and came up a fix that solves
    this problem:
    "This code gets called after all registers other than those handled by
    IRET got already restored, hence a null selector in %ds or a non-null
    one that got loaded from a code or read-only data descriptor would
    cause a kernel mode fault (with the potential of crashing the kernel
    as a whole, if panic_on_oops is set)."
    The way to fix this is to realize that the we can only relay on the
    registers that IRET restores. The two that are guaranteed are the
    %cs and %ss as they are always fixed GDT selectors. Also they are
    inaccessible from user mode - so they cannot be altered. This is
    the approach taken in this patch.
    Another alternative option suggested by Jan would be to relay on
    the subtle realization that using the %ebp or %esp relative references uses
    the %ss segment.  In which case we could switch from using %eax to %ebp and
    would not need the %ss over-rides. That would also require one extra
    instruction to compensate for the one place where the register is used
    as scaled index. However Andrew pointed out that is too subtle and if
    further work was to be done in this code-path it could escape folks attention
    and lead to accidents.
    Reviewed-by: Petr Matousek <>
    Reported-by: Petr Matousek <>
    Reviewed-by: Andrew Cooper <>
    Signed-off-by: Jan Beulich <>
    Signed-off-by: Konrad Rzeszutek Wilk <>
    jbeulich committed with Konrad Rzeszutek Wilk Jan 24, 2013
  3. @davem330

    sparc64: Fix get_user_pages_fast() wrt. THP.

    Mostly mirrors the s390 logic, as unlike x86 we don't need the
    SetPageReferenced() bits.
    On sparc64 we also lack a user/privileged bit in the huge PMDs.
    In order to make this work for THP and non-THP builds, some header
    file adjustments were necessary.  Namely, provide the PMD_HUGE_* bit
    defines and the pmd_large() inline unconditionally rather than
    protected by TRANSPARENT_HUGEPAGE.
    Reported-by: Aneesh Kumar K.V <>
    Signed-off-by: David S. Miller <>
    davem330 committed Feb 13, 2013
  4. @davem330

    sparc64: Add missing HAVE_ARCH_TRANSPARENT_HUGEPAGE.

    This got missed in the cleanups done for the S390 THP
    CC: Gerald Schaefer <>
    Signed-off-by: David S. Miller <>
    davem330 committed Feb 13, 2013
  5. Merge git://

    Pull networking fixes from David Miller:
     "This is primarily to get those r8169 reverts sorted, but other fixes
      have accumulated meanwhile.
       1) Revert two r8169 changes to fix suspend/resume for some users,
          from Francois Romieu.
       2) PCI dma mapping errors in atl1c are not checked for and this cause
          hard crashes for some users, from Xiong Huang.
       3) In 3.8.x we merged the removal of the EXPERIMENTAL dependency for
          'dlm' but the same patch for 'sctp' got lost somewhere, resulting
          in the potential for build errors since there are cross
          dependencies.  From Kees Cook.
       4) SCTP's ipv6 socket route validation makes boolean tests
          incorrectly, fix from Daniel Borkmann.
       5) mac80211 does sizeof(ptr) instead of (sizeof(ptr) * nelem), from
          Cong Ding.
       6) arp_rcv() can crash on shared non-linear packets, from Eric
       7) Avoid crashes in macvtap by setting ->gso_type consistently in
          ixgbe, qlcnic, and bnx2x drivers.  From Michael S Tsirkin and
          Alexander Duyck.
       8) Trinity fuzzer spots infinite loop in __skb_recv_datagram(), fix
          from Eric Dumazet.
       9) STP protocol frames should use high packet priority, otherwise an
          overloaded bridge can get stuck.  From Stephen Hemminger.
      10) The HTB packet scheduler was converted some time ago to store
          internal timestamps in nanoseconds, but we don't convert back into
          psched ticks for the user during dumps.  Fix from Jiri Pirko.
      11) mwl8k channel table doesn't set the .band field properly,
          resulting in NULL pointer derefs.  Fix from Jonas Gorski.
      12) mac80211 doesn't accumulate channels properly during a scan so we
          can downgrade heavily to a much less desirable connection speed.
          Fix from Johannes Berg.
      13) PHY probe failure in stmmac can result in resource leaks and
          double MDIO registery later, from Giuseppe CAVALLARO.
      14) Correct ipv6 checksumming in ip6t_NPT netfilter module, also fix
          address prefix mangling, from YOSHIFUJI Hideaki."
    * git:// (27 commits)
      net, sctp: remove CONFIG_EXPERIMENTAL
      net: sctp: sctp_v6_get_dst: fix boolean test in dst cache
      batman-adv: Fix NULL pointer dereference in DAT hash collision avoidance
      net/macb: fix race with RX interrupt while doing NAPI
      atl1c: add error checking for pci_map_single functions
      htb: fix values in opt dump
      ixgbe: Only set gso_type to SKB_GSO_TCPV4 as RSC does not support IPv6
      net: fix infinite loop in __skb_recv_datagram()
      net: qmi_wwan: add Yota / Megafon M100-1 4g modem
      mwl8k: fix band for supported channels
      bridge: set priority of STP packets
      mac80211: fix channel selection bug
      arp: fix possible crash in arp_rcv()
      bnx2x: set gso_type
      qlcnic: set gso_type
      ixgbe: fix gso type
      stmmac: mdio register has to fail if the phy is not found
      stmmac: fix macro used for debugging the xmit
      Revert "r8169: enable internal ASPM and clock request settings".
      Revert "r8169: enable ALDPS for power saving".
    committed Feb 13, 2013
  6. Merge branch 'x86-urgent-for-linus' of git://…

    Pull x86 fixes from Peter Anvin:
     "One (hopefully) last batch of x86 fixes.  You asked for the patch by
      patch justifications, so here they are:
          x86, MCE: Retract most UAPI exports
       This one unexports from userspace a bunch of definitions which should
       never have been exported.  We really don't want to create an
       accidental legacy here.
          x86, doc: Add a bootloader ID for OVMF
       This is a documentation-only patch, just recording the official
       assignment of a boot loader ID.
          x86: Do not leak kernel page mapping locations
       Security: avoid making it needlessly easy for user space to probe the
       kernel memory layout.
          x86/mm: Check if PUD is large when validating a kernel address
       Prevent failures using /proc/kcore when using 1G pages.
          x86/apic: Work around boot failure on HP ProLiant DL980 G7 Server systems
       Works around a BIOS problem causing boot failures on affected hardware."
    * 'x86-urgent-for-linus' of git://
      x86/mm: Check if PUD is large when validating a kernel address
      x86/apic: Work around boot failure on HP ProLiant DL980 G7 Server systems
      x86, doc: Add a bootloader ID for OVMF
      x86: Do not leak kernel page mapping locations
      x86, MCE: Retract most UAPI exports
    committed Feb 13, 2013
  7. @ninjadrm

    MAINTAINERS: change my email and repos

    Change to my private email, change to my shiny new repos,
    and drop outdated entry from the former maintainer. Drop my PCA entry,
    too, since it belongs to the I2C realm anyhow.
    Signed-off-by: Wolfram Sang <>
    ninjadrm committed Feb 8, 2013
  8. @rjwysocki @bjorn-helgaas

    PCI/PM: Clean up PME state when removing a device

    Devices are added to pci_pme_list when drivers use pci_enable_wake()
    or pci_wake_from_d3(), but they aren't removed from the list unless
    the driver explicitly disables wakeup.  Many drivers never disable
    wakeup, so their devices remain on the list even after they are
    removed, e.g., via hotplug.  A subsequent PME poll will oops when
    it tries to touch the device.
    This patch disables PME# on a device before removing it, which removes
    the device from pci_pme_list.  This is safe even if the device never
    had PME# enabled.
    This oops can be triggered by unplugging a Thunderbolt ethernet adapter
    on a Macbook Pro, as reported by Daniel below.
    [bhelgaas: changelog]
    Reported-and-tested-by: Daniel J Blueman <>
    Signed-off-by: Rafael J. Wysocki <>
    Signed-off-by: Bjorn Helgaas <>
    rjwysocki committed with bjorn-helgaas Feb 11, 2013
  9. @kees @davem330

    net, sctp: remove CONFIG_EXPERIMENTAL

    This config item has not carried much meaning for a while now and is
    almost always enabled by default. As agreed during the Linux kernel
    summit, remove it.
    Acked-by: Vlad Yasevich <>
    Acked-by: Steven Whitehouse <>
    Signed-off-by: Kees Cook <>
    Signed-off-by: David Rientjes <>
    Signed-off-by: David S. Miller <>
    kees committed with davem330 Feb 13, 2013
  10. @borkmann @davem330

    net: sctp: sctp_v6_get_dst: fix boolean test in dst cache

    We walk through the bind address list and try to get the best source
    address for a given destination. However, currently, we take the
    'continue' path of the loop when an entry is invalid (!laddr->valid)
    *and* the entry state does not equal SCTP_ADDR_SRC (laddr->state !=
    Thus, still, invalid entries with SCTP_ADDR_SRC might not 'continue'
    as well as valid entries with SCTP_ADDR_{NEW, SRC, DEL}, with a possible
    false baddr and matchlen as a result, causing in worst case dst route
    to be false or possibly NULL.
    This test should actually be a '||' instead of '&&'. But lets fix it
    and make this a bit easier to read by having the condition the same way
    as similarly done in sctp_v4_get_dst.
    Signed-off-by: Daniel Borkmann <>
    Acked-by: Vlad Yasevich <>
    Acked-by: Neil Horman <>
    Signed-off-by: David S. Miller <>
    borkmann committed with davem330 Feb 12, 2013
  11. @davem330

    batman-adv: Fix NULL pointer dereference in DAT hash collision avoidance

    An entry in DAT with the hashed position of 0 can cause a NULL pointer
    dereference when the first entry is checked by batadv_choose_next_candidate.
    This first candidate automatically has the max value of 0 and the max_orig_node
    of NULL. Not checking max_orig_node for NULL in batadv_is_orig_node_eligible
    will lead to a NULL pointer dereference when checking for the lowest address.
    This problem was added in 785ea11
    ("batman-adv: Distributed ARP Table - create DHT helper functions").
    Signed-off-by: Pau Koning <>
    Signed-off-by: David S. Miller <>
    Pau Koning committed with davem330 Feb 12, 2013
  12. @noglitch @davem330

    net/macb: fix race with RX interrupt while doing NAPI

    When interrupts are disabled, an RX condition can occur but
    it is not reported when enabling interrupts again. We need to check
    RSR and use napi_reschedule() if condition is met.
    Signed-off-by: Nicolas Ferre <>
    Signed-off-by: David S. Miller <>
    noglitch committed with davem330 Feb 12, 2013
  13. @xhuang @davem330

    atl1c: add error checking for pci_map_single functions

    it is reported that code hit DMA-API errors on 3.8-rc6+,
    (see, and
    this patch just adds error handler for
        pci_map_single and skb_frag_dma_map.
    Signed-off-by: xiong <>
    Signed-off-by: David S. Miller <>
    xhuang committed with davem330 Feb 11, 2013
  14. x86/mm: Check if PUD is large when validating a kernel address

    A user reported the following oops when a backup process reads
     BUG: unable to handle kernel paging request at ffffbb00ff33b000
     IP: [<ffffffff8103157e>] kern_addr_valid+0xbe/0x110
     Call Trace:
      [<ffffffff811b8aaa>] read_kcore+0x17a/0x370
      [<ffffffff811ad847>] proc_reg_read+0x77/0xc0
      [<ffffffff81151687>] vfs_read+0xc7/0x130
      [<ffffffff811517f3>] sys_read+0x53/0xa0
      [<ffffffff81449692>] system_call_fastpath+0x16/0x1b
    Investigation determined that the bug triggered when reading
    system RAM at the 4G mark. On this system, that was the first
    address using 1G pages for the virt->phys direct mapping so the
    PUD is pointing to a physical address, not a PMD page.
    The problem is that the page table walker in kern_addr_valid() is
    not checking pud_large() and treats the physical address as if
    it was a PMD.  If it happens to look like pmd_none then it'll
    silently fail, probably returning zeros instead of real data. If
    the data happens to look like a present PMD though, it will be
    walked resulting in the oops above.
    This patch adds the necessary pud_large() check.
    Unfortunately the problem was not readily reproducible and now
    they are running the backup program without accessing
    /proc/kcore so the patch has not been validated but I think it
    makes sense.
    Signed-off-by: Mel Gorman <>
    Reviewed-by: Rik van Riel <riel@redhat.coM>
    Reviewed-by: Michal Hocko <>
    Acked-by: Johannes Weiner <>
    Signed-off-by: Ingo Molnar <>
    Mel Gorman committed with Ingo Molnar Feb 11, 2013
  15. Merge branch 'autofs-fix' of git://…

    …l/git/deller/parisc-linux into akpm
    Pull hp parisc automounter fix from Helge Deller:
     "This unbreaks automounter support for the parisc architecture (and
      probably aarch64 as well).""
    * 'autofs-fix' of git://
      unbreak automounter support on 64-bit kernel with 32-bit userspace (v2)
    committed Feb 13, 2013
  16. Merge branch 'for-linus' of git://…

    …/git/s390/linux into akpm
    Pull s390 regression fix from Martin Schwidefsky:
     "The recent fix for the s390 sched_clock() function uncovered yet
      another bug in s390_next_ktime which causes an endless loop in KVM.
      This regression should be fixed before v3.8.
      I keep the fingers crossed that this is the last one for v3.8."
    * 'for-linus' of git://
      s390/timer: avoid overflow when programming clock comparator
    committed Feb 13, 2013
  17. Merge branch 'for-linus' of git://…

    …/git/gerg/m68knommu into akpm
    Pull m68knommu fix from Greg Ungerer:
     "This contains a single critical fix for the non-MMU m68k platforms.
      The change of the kernel exec code path has revealed a problem in the
      start thread code that causes crashing on boot.  This is the fix for
    * 'for-linus' of git://
      m68knommu: fix trap on execing /bin/init
    committed Feb 13, 2013
Commits on Feb 12, 2013
  1. @jpirko @davem330

    htb: fix values in opt dump

    in htb_change_class() cl->buffer and cl->buffer are stored in ns.
    So in dump, convert them back to psched ticks.
    Note this was introduced by:
    commit 56b765b
        htb: improved accuracy at high rates
    Please consider this for -net/-stable.
    Signed-off-by: Jiri Pirko <>
    Acked-by: Eric Dumazet <>
    Signed-off-by: David S. Miller <>
    jpirko committed with davem330 Feb 12, 2013
  2. Merge branch 'stable' of git://…

    …t/cmetcalf/linux-tile into akpm
    Pull tile bugfixes from Chris Metcalf:
     "This includes a variety of minor bug fixes, mostly to do with testing
      "make allyesconfig", "make allmodconfig", "make allnoconfig", inspired
      to Tejun Heo's observation about Kconfig.freezer not being included.
      The largest changes are just syntax changes removing the tile-specific
      use of a macro named INT_MASK, which is way too commonly redefined
      throughout driver code"
    * 'stable' of git://
      tile: tag some code with #ifdef CONFIG_COMPAT
      tile: fix memcpy_*io functions for allnoconfig
      tile: export a handful of symbols appropriately
      drm: fix compile failure by including <linux/swiotlb.h>
      tile: avoid defining INT_MASK macro in <arch/interrupts.h>
      tile: provide "screen_info" when enabling VT
      drivers/input/joystick/analog.c: enable precise timer
      tile: include kernel/Kconfig.freezer in tile Kconfig
      tile: remove an unused variable in copy_thread()
    committed Feb 12, 2013