6 years ago- patches.fixes/mm-fix_possible_compile_issue_page_cgroup.patch:
Michal Hocko [Mon, 22 Aug 2011 07:48:59 +0000 (09:48 +0200)]
- patches.fixes/mm-fix_possible_compile_issue_page_cgroup.patch:
  Fix node_start/end_pfn() definition for mm/page_cgroup.c
  (bnc#708160, bnc#712316).

suse-commit: 3811b6910313cc9564c3e893d6ba75645ee38a6b

6 years ago- patches.fixes/mm-fix_memoryless_nodes_exact_nid.patch:
Michal Hocko [Mon, 22 Aug 2011 07:09:31 +0000 (09:09 +0200)]
- patches.fixes/mm-fix_memoryless_nodes_exact_nid.patch:
  memcg: fix init_page_cgroup nid with sparsemem (bnc#708160,

suse-commit: 8cceca89009d64663e63df0b94fa265f144b6aa4

6 years ago- patches.fixes/jbd-remove_journal_head-oops-fix.diff: jbd:
Jan Kara [Thu, 18 Aug 2011 22:25:27 +0000 (00:25 +0200)]
- patches.fixes/jbd-remove_journal_head-oops-fix.diff: jbd:
  Fix oops in journal_remove_journal_head() (bnc#694315).

suse-commit: 054734ac3fd20ad51c0fa6c85f5eba18c0c09af0

6 years ago- patches.suse/revert-crypto-Move-md5_transform-to-lib-md5.c.patch:
Jiri Slaby [Wed, 17 Aug 2011 20:08:17 +0000 (22:08 +0200)]
- patches.suse/revert-crypto-Move-md5_transform-to-lib-md5.c.patch:
  Revert "crypto: Move md5_transform to lib/md5.c".
- patches.suse/revert-net-Compute-protocol-sequence-numbers-and-fra.patch:
  Revert "net: Compute protocol sequence numbers and fragment
  IDs using MD5.".
- patches.suse/SoN-16-netvm-reserve-inet.patch: Refresh.
  It's causing network slowdown.

suse-commit: f498b0d35be9d9ace0d474e82b06dd7bd79f0174

6 years ago- patches.fixes/writeback-sb-locking-performance-fix.diff:
Jan Kara [Wed, 17 Aug 2011 08:44:56 +0000 (10:44 +0200)]
- patches.fixes/writeback-sb-locking-performance-fix.diff:
  Do not wait for flusher thread during sync(1) (bnc#703786).
  since the above patch fixes regression caused by them.

suse-commit: 78f2a960175bb5f208c2e8e01331353fce544208

6 years ago- Update to
Jiri Slaby [Tue, 16 Aug 2011 08:00:15 +0000 (10:00 +0200)]
- Update to
- patches.suse/SoN-16-netvm-reserve-inet.patch: Refresh.

suse-commit: 5e8ab2591f630a72884c5d6c3ebdd3bfead44104

6 years ago- patches.xen/1101-x86-m2p-nr.patch: x86: replace order-based range
Jan Beulich [Tue, 16 Aug 2011 09:51:19 +0000 (11:51 +0200)]
- patches.xen/1101-x86-m2p-nr.patch: x86: replace order-based range
  checking of M2P table by linear one.
- patches.xen/1102-x86-max-contig-order.patch: x86: use dynamically
  adjusted upper bound for contiguous regions (bnc#635880).
- Refresh other Xen patches (bnc#707644).
- patches.kabi/1101-x86-m2p-nr.patch: re-introduce
  machine_to_phys_order for kABI consistency.

suse-commit: 7f5e39283f7c12527cde397778decf4ae607aa86

6 years agoLinux
Greg Kroah-Hartman [Tue, 16 Aug 2011 01:57:37 +0000 (18:57 -0700)]

6 years agopowerpc: pseries: Fix kexec on machines with more than 4TB of RAM
Anton Blanchard [Tue, 26 Jul 2011 18:15:03 +0000 (18:15 +0000)]
powerpc: pseries: Fix kexec on machines with more than 4TB of RAM

commit bed9a31527af8ff3dfbad62a1a42815cef4baab7 upstream.

On a box with 8TB of RAM the MMU hashtable is 64GB in size. That
means we have 4G PTEs. pSeries_lpar_hptab_clear was using a signed
int to store the index which will overflow at 2G.

Signed-off-by: Anton Blanchard <>
Acked-by: Michael Neuling <>
Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agopowerpc: Fix device tree claim code
Anton Blanchard [Mon, 25 Jul 2011 20:47:07 +0000 (20:47 +0000)]
powerpc: Fix device tree claim code

commit 966728dd88b4026ec58fee169ccceaeaf56ef120 upstream.

I have a box that fails in OF during boot with:

DEFAULT CATCH!, exception-handler=fff00400
at   %SRR0: 49424d2c4c6f6768   %SRR1: 800000004000b002

ie "IBM,Logh". OF got corrupted with a device tree string.

Looking at make_room and alloc_up, we claim the first chunk (1 MB)
but we never claim any more. mem_end is always set to alloc_top
which is the top of our available address space, guaranteeing we will
never call alloc_up and claim more memory.

Also alloc_up wasn't setting alloc_bottom to the bottom of the
available address space.

This doesn't help the box to boot, but we at least fail with
an obvious error. We could relocate the device tree in a future

Signed-off-by: Anton Blanchard <>
Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoALSA: snd-usb-caiaq: Fix keymap for RigKontrol3
Daniel Mack [Sat, 6 Aug 2011 07:13:08 +0000 (09:13 +0200)]
ALSA: snd-usb-caiaq: Fix keymap for RigKontrol3

commit f4389489b5cbe60b3441869c68bb4afe760969c4 upstream.

Signed-off-by: Daniel Mack <>
Reported-by: Renato <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoALSA: timer - Fix Oops at closing slave timer
Takashi Iwai [Mon, 8 Aug 2011 10:24:46 +0000 (12:24 +0200)]
ALSA: timer - Fix Oops at closing slave timer

commit 0584ffa548b6e59aceb027112f23a55f0133400e upstream.

A slave-timer instance has no timer reference, and this results in
NULL-dereference at stopping the timer, typically called at closing
the device.


Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agonet: Compute protocol sequence numbers and fragment IDs using MD5.
David S. Miller [Thu, 4 Aug 2011 03:50:44 +0000 (20:50 -0700)]
net: Compute protocol sequence numbers and fragment IDs using MD5.

Computers have become a lot faster since we compromised on the
partial MD4 hash which we use currently for performance reasons.

MD5 is a much safer choice, and is inline with both RFC1948 and
other ISS generators (OpenBSD, Solaris, etc.)

Furthermore, only having 24-bits of the sequence number be truly
unpredictable is a very serious limitation.  So the periodic
regeneration and 8-bit counter have been removed.  We compute and
use a full 32-bit sequence number.

For ipv6, DCCP was found to use a 32-bit truncated initial sequence
number (it needs 43-bits) and that is fixed here as well.

Reported-by: Dan Kaminsky <>
Tested-by: Willy Tarreau <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agocrypto: Move md5_transform to lib/md5.c
David S. Miller [Thu, 4 Aug 2011 02:45:10 +0000 (19:45 -0700)]
crypto: Move md5_transform to lib/md5.c

We are going to use this for TCP/IP sequence number and fragment ID

Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years ago- patches.fixes/xfs-async-flush-fix.patch: xfs: Replace async
Jan Kara [Mon, 15 Aug 2011 23:02:04 +0000 (01:02 +0200)]
- patches.fixes/xfs-async-flush-fix.patch: xfs: Replace async
  callers of xfs_flush_pages() (bnc#663678).

suse-commit: e8fe7efb8f207fab8e66cf9c983d2ff4c939f431

6 years ago- patches.fixes/validate-size-of-efi-guid-partition-entries.patch:
Miklos Szeredi [Fri, 12 Aug 2011 14:41:57 +0000 (16:41 +0200)]
- patches.fixes/validate-size-of-efi-guid-partition-entries.patch:
  Validate size of EFI GUID partition entries (bnc#692784,

suse-commit: 62e997a8c7dcd02fcd0585b47264a243f2ab1690

6 years ago- patches.suse/staging-hv-vmbus-init-on-dmi-match.patch:
Olaf Hering [Thu, 11 Aug 2011 17:50:52 +0000 (19:50 +0200)]
- patches.suse/staging-hv-vmbus-init-on-dmi-match.patch:
  only load the driver in a hyper-v guest (bnc#704957, bnc#711752)

suse-commit: 89b3585cd0603c94d226890c92f4c2f6c34e62e3

6 years ago- patches.fixes/ocfs2-clean-up-mount-option-about-atime-in-ocfs2.txt.patch:
David Sterba [Thu, 11 Aug 2011 14:25:33 +0000 (16:25 +0200)]
- patches.fixes/ocfs2-clean-up-mount-option-about-atime-in-ocfs2.txt.patch:
  ocfs2: clean up mount option about atime in ocfs2.txt.
- patches.fixes/ocfs2-dlm-Cleanup-mlogs-in-dlmthread.c-dlmast.c-and-.patch:
  ocfs2/dlm: Cleanup mlogs in dlmthread.c, dlmast.c and
- patches.fixes/ocfs2-cluster-Pin-the-remote-node-item-in-configfs.patch:
- patches.fixes/ocfs2-cluster-Remove-dropped-region-from-o2hb-quorum.patch:

suse-commit: b383e209607a320c4ad55241d418457655460291

6 years ago- patches.fixes/ocfs2-Release-buffer_head-in-case-of-error-in-ocfs2_.patch:
David Sterba [Thu, 11 Aug 2011 13:59:59 +0000 (15:59 +0200)]
- patches.fixes/ocfs2-Release-buffer_head-in-case-of-error-in-ocfs2_.patch:
  ocfs2: Release buffer_head in case of error in ocfs2_double_lock.
- patches.fixes/ocfs2-Skip-mount-recovery-for-hard-ro-mounts.patch:
  ocfs2: Skip mount recovery for hard-ro mounts.
- patches.fixes/ocfs2-Try-to-free-truncate-log-when-meeting-ENOSPC-i.patch:
  ocfs2: Try to free truncate log when meeting ENOSPC in write.
- patches.fixes/ocfs2-cluster-Heartbeat-mismatch-message-improved.patch:
  ocfs2/cluster: Heartbeat mismatch message improved.
- patches.fixes/ocfs2-cluster-Increase-the-live-threshold-for-global.patch:
  ocfs2/cluster: Increase the live threshold for global heartbeat.
- patches.fixes/ocfs2-cluster-Pin-the-remote-node-item-in-configfs.patch:
  ocfs2/cluster: Pin the remote node item in configfs.
- patches.fixes/ocfs2-cluster-Remove-dropped-region-from-o2hb-quorum.patch:
  ocfs2/cluster: Remove dropped region from o2hb quorum region
- patches.fixes/ocfs2-cluster-dereferencing-before-checking-in-nst_s.patch:
  ocfs2/cluster: dereferencing before checking in nst_seq_show().
- patches.fixes/ocfs2-dlm-Target-node-death-during-resource-migratio.patch:
  ocfs2/dlm: Target node death during resource migration leads
  to thread spin.
- patches.fixes/ocfs2-dlm-make-existing-convertion-precedent-over-ne.patch:
  ocfs2/dlm: make existing convertion precedent over new lock.
- patches.fixes/ocfs2-make-the-feature-checks-in-fallocate-future-proof.patch:
  make the feature checks in ->fallocate future proof.
- patches.suse/gfs2-ro-mounts-only.patch: Refresh.

suse-commit: 7cf83a9067fad5231b088425c7714988f6fb9a8c

6 years ago- patches.fixes/novfs-dentry-leak.patch: fs: novfs: Fix exit
Jan Kara [Thu, 11 Aug 2011 10:03:35 +0000 (12:03 +0200)]
- patches.fixes/novfs-dentry-leak.patch: fs: novfs: Fix exit
  handlers on local_unlink (bnc#649625).

suse-commit: d5b211018c836112ffec12e4a4d0b5e952ff64a2

6 years ago- Update to
Jiri Slaby [Mon, 8 Aug 2011 20:39:32 +0000 (22:39 +0200)]
- Update to
- patches.arch/x86_64-hpet-64bit-timer.patch: Refresh.
- patches.kabi/net_bridge_port-kABI_guard.patch: net_bridge_port
  kABI guard.
- patches.xen/linux-2.6.19-rc1-kexec-move_segment_code-i386.patch:
- patches.xen/linux-2.6.19-rc1-kexec-move_segment_code-x86_64.patch:
- patches.arch/x86-hpet-pre-read: Delete.
- patches.fixes/cifs-ensure-credentials-match-when-using-existing-session:
- patches.fixes/gre-fix-netns-vs-proto-registration-ordering:
- patches.fixes/proc-restrict-access-to-proc-pid-io: Delete.
- patches.fixes/tunnels-fix-netns-vs-proto-registration-ordering:

suse-commit: 5e009db449d48f14f69b7ee8ad4128f0641bcb9e

6 years ago- patches.fixes/md-raid1-throttle.fix: md: add proper
NeilBrown [Tue, 9 Aug 2011 05:57:47 +0000 (15:57 +1000)]
- patches.fixes/md-raid1-throttle.fix: md: add proper
  write-congestion reporting to RAID1 (bnc#663678).

suse-commit: f97f1173e103782466ee095fe510ba5d90f1ed4a

6 years agoMerge branch 'scripts' into SLE11-SP1
Michal Marek [Mon, 8 Aug 2011 22:56:52 +0000 (00:56 +0200)]
Merge branch 'scripts' into SLE11-SP1

suse-commit: a69da142086dc32c091ce3cade04f6f71dc15200

6 years agoLinux
Greg Kroah-Hartman [Mon, 8 Aug 2011 17:32:25 +0000 (10:32 -0700)]

6 years agoatm: [br2684] allow routed mode operation again
chas williams - CONTRACTOR [Fri, 4 Dec 2009 11:06:32 +0000 (11:06 +0000)]
atm: [br2684] allow routed mode operation again

commit 2e302ebfeac04beb5a5d6af1ac583c6a1fb76d1a upstream.

in routed mode, we don't have a hardware address so netdev_ops doesnt
need to validate our hardware address via .ndo_validate_addr

Reported-by: Manuel Fuentes <>
Signed-off-by: Chas Williams - CONTRACTOR <>
Signed-off-by: David S. Miller <>
Cc: Pascal Hambourg <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoperf: overflow/perf_count_sw_cpu_clock crashes recent kernels
Peter Zijlstra [Wed, 3 Aug 2011 11:49:31 +0000 (13:49 +0200)]
perf: overflow/perf_count_sw_cpu_clock crashes recent kernels

The below patch is for -stable only, upstream has a much larger patch
that contains the below hunk in commit a8b0ca17b80e92faab46ee7179ba9e99ccb61233

Vince found that under certain circumstances software event overflows
go wrong and deadlock. Avoid trying to delete a timer from the timer

Reported-by: Vince Weaver <>
Signed-off-by: Peter Zijlstra <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agodm: fix idr leak on module removal
Alasdair G Kergon [Tue, 2 Aug 2011 11:32:01 +0000 (12:32 +0100)]
dm: fix idr leak on module removal

commit d15b774c2920d55e3d58275c97fbe3adc3afde38 upstream.

Destroy _minor_idr when unloading the core dm module.  (Found by kmemleak.)

Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agodm mpath: fix potential NULL pointer in feature arg processing
Mike Snitzer [Tue, 2 Aug 2011 11:32:00 +0000 (12:32 +0100)]
dm mpath: fix potential NULL pointer in feature arg processing

commit 286f367dad40beb3234a18c17391d03ba939a7f3 upstream.

Avoid dereferencing a NULL pointer if the number of feature arguments
supplied is fewer than indicated.

Signed-off-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoALSA: sound/core/pcm_compat.c: adjust array index
Julia Lawall [Thu, 28 Jul 2011 12:46:05 +0000 (14:46 +0200)]
ALSA: sound/core/pcm_compat.c: adjust array index

commit ca9380fd68514c7bc952282c1b4fc70607e9fe43 upstream.

Convert array index from the loop bound to the loop index.

A simplified version of the semantic patch that fixes this problem is as
follows: (

// <smpl>
expression e1,e2,ar;

for(e1 = 0; e1 < e2; e1++) { <...
- e2
+ e1
  ...> }
// </smpl>

Signed-off-by: Julia Lawall <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoproc: restrict access to /proc/PID/io
Vasiliy Kulikov [Fri, 24 Jun 2011 12:08:38 +0000 (16:08 +0400)]
proc: restrict access to /proc/PID/io

commit 1d1221f375c94ef961ba8574ac4f85c8870ddd51 upstream.

/proc/PID/io may be used for gathering private information.  E.g.  for
openssh and vsftpd daemons wchars/rchars may be used to learn the
precise password length.  Restrict it to processes being able to ptrace
the target process.

ptrace_may_access() is needed to prevent keeping open file descriptor of
"io" file, executing setuid binary and gathering io information of the
setuid'ed process.

Signed-off-by: Vasiliy Kulikov <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoalpha: fix several security issues
Dan Rosenberg [Wed, 15 Jun 2011 22:09:01 +0000 (15:09 -0700)]
alpha: fix several security issues

commit 21c5977a836e399fc710ff2c5367845ed5c2527f upstream.

Fix several security issues in Alpha-specific syscalls.  Untested, but
mostly trivial.

1. Signedness issue in osf_getdomainname allows copying out-of-bounds
kernel memory to userland.

2. Signedness issue in osf_sysinfo allows copying large amounts of
kernel memory to userland.

3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy
size, allowing copying large amounts of kernel memory to userland.

4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows
privilege escalation via writing return value of sys_wait4 to kernel

Signed-off-by: Dan Rosenberg <>
Cc: Richard Henderson <>
Cc: Ivan Kokshaysky <>
Cc: Matt Turner <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agotunnels: fix netns vs proto registration ordering
Alexey Dobriyan [Tue, 16 Feb 2010 09:05:04 +0000 (09:05 +0000)]
tunnels: fix netns vs proto registration ordering

commit d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978 upstream.

Same stuff as in ip_gre patch: receive hook can be called before netns
setup is done, oopsing in net_generic().

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agonetns xfrm: fixup xfrm6_tunnel error propagation
Alexey Dobriyan [Mon, 25 Jan 2010 10:28:21 +0000 (10:28 +0000)]
netns xfrm: fixup xfrm6_tunnel error propagation

commit e924960dacdf85d118a98c7262edf2f99c3015cf upstream.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agogre: fix netns vs proto registration ordering
Alexey Dobriyan [Tue, 16 Feb 2010 07:57:44 +0000 (07:57 +0000)]
gre: fix netns vs proto registration ordering

commit c2892f02712e9516d72841d5c019ed6916329794 upstream.

GRE protocol receive hook can be called right after protocol addition is done.
If netns stuff is not yet initialized, we're going to oops in

This is remotely oopsable if ip_gre is compiled as module and packet
comes at unfortunate moment of module loading.

Signed-off-by: Alexey Dobriyan <>
Signed-off-by: David S. Miller <>
[dannf: backported to Debian's 2.6.32]
Signed-off-by: Greg Kroah-Hartman <>
6 years agocifs: check for NULL session password
Jeff Layton [Mon, 23 Aug 2010 15:38:04 +0000 (11:38 -0400)]
cifs: check for NULL session password

commit 24e6cf92fde1f140d8eb0bf7cd24c2c78149b6b2 upstream.

It's possible for a cifsSesInfo struct to have a NULL password, so we
need to check for that prior to running strncmp on it.

Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agocifs: fix NULL pointer dereference in cifs_find_smb_ses
Jeff Layton [Wed, 18 Aug 2010 17:13:39 +0000 (13:13 -0400)]
cifs: fix NULL pointer dereference in cifs_find_smb_ses

commit fc87a40677bbe0937e2ff0642c7e83c9a4813f3d upstream.

cifs_find_smb_ses assumes that the vol->password field is a valid
pointer, but that's only the case if a password was passed in via
the options string. It's possible that one won't be if there is
no mount helper on the box.

Reported-by: diabel <>
Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agocifs: clean up cifs_find_smb_ses (try #2)
Jeff Layton [Wed, 7 Jul 2010 00:43:02 +0000 (20:43 -0400)]
cifs: clean up cifs_find_smb_ses (try #2)

commit 4ff67b720c02c36e54d55b88c2931879b7db1cd2 upstream.

This patch replaces the earlier patch by the same name. The only
difference is that MAX_PASSWORD_SIZE has been increased to attempt to
match the limits that windows enforces.

Do a better job of matching sessions by authtype. Matching by username
for a Kerberos session is incorrect, and anonymous sessions need special

Also, in the case where we do match by username, we also need to match
by password. That ensures that someone else doesn't "borrow" an existing
session without needing to know the password.

Finally, passwords can be longer than 16 bytes. Bump MAX_PASSWORD_SIZE
to 512 to match the size that the userspace mount helper allows.

Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
[dannf: backported to Debian's 2.6.32]
Cc: Moritz Muehlenhoff <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoRevert "block: rescan partitions on invalidated devices on -ENOMEDIA too"
Greg Kroah-Hartman [Tue, 2 Aug 2011 21:45:26 +0000 (14:45 -0700)]
Revert "block: rescan partitions on invalidated devices on -ENOMEDIA too"

This reverts commit 5b2745db12a3f97a9ec9efd4ffa077da707d3e4c (commit
02e352287a40bd456eb78df705bf888bc3161d3f upstream)

This should have only been commited on .38 and newer, not older kernels
like this one, sorry.

Cc: Tejun Heo <>
Cc: David Zeuthen <>
Cc: Martin Pitt <>
Cc: Kay Sievers <>
Cc: Alan Cox <>
Cc: Jens Axboe <>
Cc: Andi Kleen <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agox86: HPET: Chose a paranoid safe value for the ETIME check
Thomas Gleixner [Fri, 29 Jul 2011 10:07:44 +0000 (14:07 +0400)]
x86: HPET: Chose a paranoid safe value for the ETIME check

(imported from commit v2.6.37-rc5-64-gf1c1807)

commit 995bd3bb5 (x86: Hpet: Avoid the comparator readback penalty)
chose 8 HPET cycles as a safe value for the ETIME check, as we had the
confirmation that the posted write to the comparator register is
delayed by two HPET clock cycles on Intel chipsets which showed
readback problems.

After that patch hit mainline we got reports from machines with newer
AMD chipsets which seem to have an even longer delay. See and for further

Boris tried to come up with an ACPI based selection of the minimum
HPET cycles, but this failed on a couple of test machines. And of
course we did not get any useful information from the hardware folks.

For now our only option is to chose a paranoid high and safe value for
the minimum HPET cycles used by the ETIME check. Adjust the minimum ns
value for the HPET clockevent accordingly.

Reported-Bistected-and-Tested-by: Markus Trippelsdorf <>
Signed-off-by: Thomas Gleixner <>
LKML-Reference: <alpine.LFD.2.00.1012131222420.2653@localhost6.localdomain6>
Cc: Simon Kirby <>
Cc: Borislav Petkov <>
Cc: Andreas Herrmann <>
Cc: John Stultz <>
Signed-off-by: Konstantin Khlebnikov <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agox86: Hpet: Avoid the comparator readback penalty
Thomas Gleixner [Fri, 29 Jul 2011 10:07:43 +0000 (14:07 +0400)]
x86: Hpet: Avoid the comparator readback penalty

(imported from commit v2.6.36-rc4-167-g995bd3b)

Due to the overly intelligent design of HPETs, we need to workaround
the problem that the compare value which we write is already behind
the actual counter value at the point where the value hits the real
compare register. This happens for two reasons:

1) We read out the counter, add the delta and write the result to the
   compare register. When a NMI or SMI hits between the read out and
   the write then the counter can be ahead of the event already

2) The write to the compare register is delayed by up to two HPET
   cycles in certain chipsets.

We worked around this by reading back the compare register to make
sure that the written value has hit the hardware. For certain ICH9+
chipsets this can require two readouts, as the first one can return
the previous compare register value. That's bad performance wise for
the normal case where the event is far enough in the future.

As we already know that the write can be delayed by up to two cycles
we can avoid the read back of the compare register completely if we
make the decision whether the delta has elapsed already or not based
on the following calculation:

  cmp = event - actual_count;

If cmp is less than 8 HPET clock cycles, then we decide that the event
has happened already and return -ETIME. That covers the above #1 and
#2 problems which would cause a wait for HPET wraparound (~306

Signed-off-by: Thomas Gleixner <>
Tested-by: Nix <>
Tested-by: Artur Skawina <>
Cc: Damien Wyart <>
Tested-by: John Drescher <>
Cc: Venkatesh Pallipadi <>
Cc: Arjan van de Ven <>
Cc: Andreas Herrmann <>
Tested-by: Borislav Petkov <>
Cc: Suresh Siddha <>
LKML-Reference: <alpine.LFD.2.00.1009151500060.2416@localhost6.localdomain6>
Signed-off-by: Konstantin Khlebnikov <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agopowerpc/pseries/hvconsole: Fix dropped console output
Anton Blanchard [Tue, 5 Jul 2011 21:51:36 +0000 (21:51 +0000)]
powerpc/pseries/hvconsole: Fix dropped console output

commit 51d33021425e1f905beb4208823146f2fb6517da upstream.

Return -EAGAIN when we get H_BUSY back from the hypervisor. This
makes the hvc console driver retry, avoiding dropped printks.

Signed-off-by: Anton Blanchard <>
Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoEHCI: fix direction handling for interrupt data toggles
Alan Stern [Tue, 19 Jul 2011 18:01:23 +0000 (14:01 -0400)]
EHCI: fix direction handling for interrupt data toggles

commit e04f5f7e423018bcec84c11af2058cdce87816f3 upstream.

This patch (as1480) fixes a rather obscure bug in ehci-hcd.  The
qh_update() routine needs to know the number and direction of the
endpoint corresponding to its QH argument.  The number can be taken
directly from the QH data structure, but the direction isn't stored
there.  The direction is taken instead from the first qTD linked to
the QH.

However, it turns out that for interrupt transfers, qh_update() gets
called before the qTDs are linked to the QH.  As a result, qh_update()
computes a bogus direction value, which messes up the endpoint toggle
handling.  Under the right combination of circumstances this causes
usb_reset_endpoint() not to work correctly, which causes packets to be
dropped and communications to fail.

Now, it's silly for the QH structure not to have direct access to all
the descriptor information for the corresponding endpoint.  Ultimately
it may get a pointer to the usb_host_endpoint structure; for now,
adding a copy of the direction flag solves the immediate problem.

This allows the Spyder2 color-calibration system (a low-speed USB
device that sends all its interrupt data packets with the toggle set
to 0 and hance requires constant use of usb_reset_endpoint) to work
when connected through a high-speed hub.  Thanks to Graeme Gill for
supplying the hardware that allowed me to track down this bug.

Signed-off-by: Alan Stern <>
Reported-by: Graeme Gill <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoEHCI: only power off port if over-current is active
Sergei Shtylyov [Wed, 6 Jul 2011 19:19:38 +0000 (23:19 +0400)]
EHCI: only power off port if over-current is active

commit 81463c1d707186adbbe534016cd1249edeab0dac upstream.

MAX4967 USB power supply chip we use on our boards signals over-current when
power is not enabled; once it's enabled, over-current signal returns to normal.
That unfortunately caused the endless stream of "over-current change on port"
messages. The EHCI root hub code reacts on every over-current signal change
with powering off the port -- such change event is generated the moment the
port power is enabled, so once enabled the power is immediately cut off.
I think we should only cut off power when we're seeing the active over-current
signal, so I'm adding such check to that code. I also think that the fact that
we've cut off the port power should be reflected in the result of GetPortStatus
request immediately, hence I'm adding a PORTSCn register readback after write...

Signed-off-by: Sergei Shtylyov <>
Acked-by: Alan Stern <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agosvcrpc: fix list-corrupting race on nfsd shutdown
J. Bruce Fields [Wed, 29 Jun 2011 20:49:04 +0000 (16:49 -0400)]
svcrpc: fix list-corrupting race on nfsd shutdown

commit ebc63e531cc6a457595dd110b07ac530eae788c3 upstream.

After commit 3262c816a3d7fb1eaabce633caa317887ed549ae "[PATCH] knfsd:
split svc_serv into pools", svc_delete_xprt (then svc_delete_socket) no
longer removed its xpt_ready (then sk_ready) field from whatever list it
was on, noting that there was no point since the whole list was about to
be destroyed anyway.

That was mostly true, but forgot that a few svc_xprt_enqueue()'s might
still be hanging around playing with the about-to-be-destroyed list, and
could get themselves into trouble writing to freed memory if we left
this xprt on the list after freeing it.

(This is actually functionally identical to a patch made first by Ben
Greear, but with more comments.)

Reported-by: Ben Greear <>
Tested-by: Ben Greear <>
Signed-off-by: J. Bruce Fields <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoext3: Fix oops in ext3_try_to_allocate_with_rsv()
Jan Kara [Mon, 30 May 2011 11:29:20 +0000 (13:29 +0200)]
ext3: Fix oops in ext3_try_to_allocate_with_rsv()

commit ad95c5e9bc8b5885f94dce720137cac8fa8da4c9 upstream.

Block allocation is called from two places: ext3_get_blocks_handle() and
ext3_xattr_block_set(). These two callers are not necessarily synchronized
because xattr code holds only xattr_sem and i_mutex, and
ext3_get_blocks_handle() may hold only truncate_mutex when called from
writepage() path. Block reservation code does not expect two concurrent
allocations to happen to the same inode and thus assertions can be triggered
or reservation structure corruption can occur.

Fix the problem by taking truncate_mutex in xattr code to serialize

CC: Sage Weil <>
Reported-by: Fyodor Ustinov <>
Signed-off-by: Jan Kara <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoxtensa: prevent arbitrary read in ptrace
Dan Rosenberg [Tue, 26 Jul 2011 00:11:53 +0000 (17:11 -0700)]
xtensa: prevent arbitrary read in ptrace

commit 0d0138ebe24b94065580bd2601f8bb7eb6152f56 upstream.

Prevent an arbitrary kernel read.  Check the user pointer with access_ok()
before copying data in.

Signed-off-by: Dan Rosenberg <>
Cc: Christian Zankel <>
Cc: Oleg Nesterov <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agocciss: do not attempt to read from a write-only register
Stephen M. Cameron [Sat, 9 Jul 2011 07:04:12 +0000 (09:04 +0200)]
cciss: do not attempt to read from a write-only register

commit 07d0c38e7d84f911c72058a124c7f17b3c779a65 upstream.

Most smartarrays will tolerate it, but some new ones don't.

Signed-off-by: Stephen M. Cameron <>
Note: this is a regression caused by commit 1ddd5049
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoPCI: ARI is a PCIe v2 feature
Chris Wright [Wed, 13 Jul 2011 17:14:33 +0000 (10:14 -0700)]
PCI: ARI is a PCIe v2 feature

commit 864d296cf948aef0fa32b81407541572583f7572 upstream.

The function pci_enable_ari() may mistakenly set the downstream port
of a v1 PCIe switch in ARI Forwarding mode.  This is a PCIe v2 feature,
and with an SR-IOV device on that switch port believing the switch above
is ARI capable it may attempt to use functions 8-255, translating into
invalid (non-zero) device numbers for that bus.  This has been seen
to cause Completion Timeouts and general misbehaviour including hangs
and panics.

Acked-by: Don Dutile <>
Tested-by: Don Dutile <>
Signed-off-by: Chris Wright <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agopowerpc/kdump: Fix timeout in crash_kexec_wait_realmode
Michael Neuling [Mon, 4 Jul 2011 20:40:10 +0000 (20:40 +0000)]
powerpc/kdump: Fix timeout in crash_kexec_wait_realmode

commit 63f21a56f1cc0b800a4c00349c59448f82473d19 upstream.

The existing code it pretty ugly.  How about we clean it up even more
like this?

From: Anton Blanchard <>

We check for timeout expiry in the outer loop, but we also need to
check it in the inner loop or we can lock up forever waiting for a
CPU to hit real mode.

Signed-off-by: Anton Blanchard <>
Signed-off-by: Michael Neuling <>
Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agokexec, x86: Fix incorrect jump back address if not preserving context
Huang Ying [Thu, 14 Jul 2011 01:34:37 +0000 (09:34 +0800)]
kexec, x86: Fix incorrect jump back address if not preserving context

commit 050438ed5a05b25cdf287f5691e56a58c2606997 upstream.

In kexec jump support, jump back address passed to the kexeced
kernel via function calling ABI, that is, the function call
return address is the jump back entry.

Furthermore, jump back entry == 0 should be used to signal that
the jump back or preserve context is not enabled in the original

But in the current implementation the stack position used for
function call return address is not cleared context
preservation is disabled. The patch fixes this bug.

Reported-and-tested-by: Yin Kangkai <>
Signed-off-by: Huang Ying <>
Cc: Eric W. Biederman <>
Cc: Vivek Goyal <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agopmcraid: reject negative request size
Dan Rosenberg [Mon, 11 Jul 2011 21:08:23 +0000 (14:08 -0700)]
pmcraid: reject negative request size

commit b5b515445f4f5a905c5dd27e6e682868ccd6c09d upstream.

There's a code path in pmcraid that can be reached via device ioctl that
causes all sorts of ugliness, including heap corruption or triggering the
OOM killer due to consecutive allocation of large numbers of pages.

First, the user can call pmcraid_chr_ioctl(), with a type
PMCRAID_PASSTHROUGH_IOCTL.  This calls through to
pmcraid_ioctl_passthrough().  Next, a pmcraid_passthrough_ioctl_buffer
is copied in, and the request_size variable is set to
buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit
signed value provided by the user.  If a negative value is provided
here, bad things can happen.  For example,
pmcraid_build_passthrough_ioadls() is called with this request_size,
which immediately calls pmcraid_alloc_sglist() with a negative size.
The resulting math on allocating a scatter list can result in an
overflow in the kzalloc() call (if num_elem is 0, the sglist will be
smaller than expected), or if num_elem is unexpectedly large the
subsequent loop will call alloc_pages() repeatedly, a high number of
pages will be allocated and the OOM killer might be invoked.

It looks like preventing this value from being negative in
pmcraid_ioctl_passthrough() would be sufficient.

Signed-off-by: Dan Rosenberg <>
Signed-off-by: Andrew Morton <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoses: requesting a fault indication
Douglas Gilbert [Thu, 9 Jun 2011 04:27:07 +0000 (00:27 -0400)]
ses: requesting a fault indication

commit 2a350cab9daf9a46322d83b091bb05cf54ccf6ab upstream.

Noticed that when the sysfs interface of the SCSI SES
driver was used to request a fault indication the LED
flashed but the buzzer didn't sound. So it was doing
what REQUEST IDENT (locate) should do.

   - fix the setting of REQUEST FAULT for the device slot
     and array device slot elements in the enclosure control
     diagnostic page
   - note the potentially defective code that reads the
     FAULT SENSED and FAULT REQUESTED bits from the enclosure
     status diagnostic page

The attached patch is against git/scsi-misc-2.6

Signed-off-by: Douglas Gilbert <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoBlacklist Traxdata CDR4120 and IOMEGA Zip drive to avoid lock ups.
Werner Fink [Thu, 9 Jun 2011 05:24:24 +0000 (10:54 +0530)]
Blacklist Traxdata CDR4120 and IOMEGA Zip drive to avoid lock ups.

commit 82103978189e9731658cd32da5eb85ab7b8542b8 upstream.

This patch resulted from the discussion at, .

Signed-off-by: Werner Fink <>
Signed-off-by: Ankit Jain <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agomac80211: Restart STA timers only on associated state
Rajkumar Manoharan [Thu, 7 Jul 2011 18:03:39 +0000 (23:33 +0530)]
mac80211: Restart STA timers only on associated state

commit 676b58c27475a9defccc025fea1cbd2b141ee539 upstream.

A panic was observed when the device is failed to resume properly,
and there are no running interfaces. ieee80211_reconfig tries
to restart STA timers on unassociated state.

Signed-off-by: Rajkumar Manoharan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agolibsas: remove expander from dev list on error
Luben Tuikov [Wed, 27 Jul 2011 06:10:48 +0000 (23:10 -0700)]
libsas: remove expander from dev list on error

commit 5911e963d3718e306bcac387b83e259aa4228896 upstream.

If expander discovery fails (sas_discover_expander()), remove the
expander from the port device list (sas_ex_discover_expander()),
before freeing it. Else the list is corrupted and, e.g., when we
attempt to send SMP commands to other devices, the kernel oopses.

Signed-off-by: Luben Tuikov <>
Reviewed-by: Jack Wang <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agojme: Fix unmap error (Causing system freeze)
Guo-Fu Tseng [Wed, 20 Jul 2011 16:57:36 +0000 (16:57 +0000)]
jme: Fix unmap error (Causing system freeze)

commit 94c5b41b327e08de0ddf563237855f55080652a1 upstream.

This patch add the missing dma_unmap().
Which solved the critical issue of system freeze on heavy load.

Michal Miroslaw's rejected patch:
[PATCH v2 10/46] net: jme: convert to generic DMA API
Pointed out the issue also, thank you Michal.
But the fix was incorrect. It would unmap needed address
when low memory.

Got lots of feedback from End user and Gentoo Bugzilla.
Thank you all. :)

Signed-off-by: Guo-Fu Tseng <>
Acked-by: Chris Wright <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoARM: pxa/cm-x300: fix V3020 RTC functionality
Igor Grinberg [Mon, 9 May 2011 11:41:46 +0000 (14:41 +0300)]
ARM: pxa/cm-x300: fix V3020 RTC functionality

commit 6c7b3ea52e345ab614edb91d3f0e9f3bb3713871 upstream.

While in sleep mode the CS# and other V3020 RTC GPIOs must be driven
high, otherwise V3020 RTC fails to keep the right time in sleep mode.

Signed-off-by: Igor Grinberg <>
Signed-off-by: Eric Miao <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoUSB: dummy-hcd needs the has_tt flag
Alan Stern [Tue, 7 Jun 2011 15:33:01 +0000 (11:33 -0400)]
USB: dummy-hcd needs the has_tt flag

commit c5c69f3f0dcf9b569c8f3ad67f3af92cfcedac43 upstream.

Like with other host controllers capable of operating at both high
speed and full speed, we need to indicate that the emulated controller
presented by dummy-hcd has this ability.  Otherwise usbcore will not
accept full-speed gadgets under dummy-hcd.  This patch (as1469) sets
the appropriate has_tt flag.

Signed-off-by: Alan Stern <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agousb: musb: restore INDEX register in resume path
Ajay Kumar Gupta [Fri, 8 Jul 2011 09:36:13 +0000 (15:06 +0530)]
usb: musb: restore INDEX register in resume path

commit 3c5fec75e121b21a2eb35e5a6b44291509abba6f upstream.

Restoring the missing INDEX register value in musb_restore_context().
Without this suspend resume functionality is broken with offmode

Acked-by: Anand Gadiyar <>
Signed-off-by: Ajay Kumar Gupta <>
Signed-off-by: Felipe Balbi <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoUSB: OHCI: fix another regression for NVIDIA controllers
Alan Stern [Fri, 15 Jul 2011 21:22:15 +0000 (17:22 -0400)]
USB: OHCI: fix another regression for NVIDIA controllers

commit 6ea12a04d295235ed67010a09fdea58c949e3eb0 upstream.

The NVIDIA series of OHCI controllers continues to be troublesome.  A
few people using the MCP67 chipset have reported that even with the
most recent kernels, the OHCI controller fails to handle new
connections and spams the system log with "unable to enumerate USB
port" messages.  This is different from the other problems previously
reported for NVIDIA OHCI controllers, although it is probably related.

It turns out that the MCP67 controller does not like to be kept in the
RESET state very long.  After only a few seconds, it decides not to
work any more.  This patch (as1479) changes the PCI initialization
quirk code so that NVIDIA controllers are switched into the SUSPEND
state after 50 ms of RESET.  With no interrupts enabled and all the
downstream devices reset, and thus unable to send wakeup requests,
this should be perfectly safe (even for non-NVIDIA hardware).

The removal code in ohci-hcd hasn't been changed; it will still leave
the controller in the RESET state.  As a result, if someone unloads
ohci-hcd and then reloads it, the controller won't work again until
the system is rebooted.  If anybody complains about this, the removal
code can be updated similarly.

This fixes Bugzilla #22052.

Tested-by: Larry Finger <>
Signed-off-by: Alan Stern <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agostaging: comedi: fix infoleak to userspace
Vasiliy Kulikov [Sun, 26 Jun 2011 08:56:22 +0000 (12:56 +0400)]
staging: comedi: fix infoleak to userspace

commit 819cbb120eaec7e014e5abd029260db1ca8c5735 upstream.

driver_name and board_name are pointers to strings, not buffers of size
COMEDI_NAMELEN.  Copying COMEDI_NAMELEN bytes of a string containing
less than COMEDI_NAMELEN-1 bytes would leak some unrelated bytes.

Signed-off-by: Vasiliy Kulikov <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoUSB: serial: add IDs for WinChipHead USB->RS232 adapter
Wolfgang Denk [Tue, 19 Jul 2011 09:25:38 +0000 (11:25 +0200)]
USB: serial: add IDs for WinChipHead USB->RS232 adapter

commit 026dfaf18973404a01f488d6aa556a8c466e06a4 upstream.

Add ID 4348:5523 for WinChipHead USB->RS 232 adapter with
Prolifec PL2303 chipset

Signed-off-by: Wolfgang Denk <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoUSB: pl2303.h: checkpatch cleanups
Greg Kroah-Hartman [Mon, 17 May 2010 17:33:41 +0000 (10:33 -0700)]
USB: pl2303.h: checkpatch cleanups

commit 5d78fcb0caf219e2e6c8e486d7e31fec1333ac06 upstream.

Minor whitespace cleanups to make checkpatch happy.

Signed-off-by: Greg Kroah-Hartman <>
6 years agoUSB: pl2303: add AdLink ND-6530 USB IDs
Manuel Jander [Mon, 29 Mar 2010 21:51:57 +0000 (23:51 +0200)]
USB: pl2303: add AdLink ND-6530 USB IDs

commit 9a61d72602771906e11a5944e8571f8006387b39 upstream.

I read a rumor that the AdLink ND6530 USB RS232, RS422 and RS485
isolated adapter is actually a PL2303 based usb serial adapter. I
tried it out, and as far as I can tell it works.

Signed-off-by: Manuel Jander <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agox86: Make Dell Latitude E5420 use reboot=pci
Daniel J Blueman [Fri, 13 May 2011 01:04:59 +0000 (09:04 +0800)]
x86: Make Dell Latitude E5420 use reboot=pci

commit b7798d28ec15d20fd34b70fa57eb13f0cf6d1ecd upstream.

Rebooting on the Dell E5420 often hangs with the keyboard or ACPI
methods, but is reliable via the PCI method.

[ hpa: this was deferred because we believed for a long time that the
  recent reshuffling of the boot priorities in commit
  660e34cebf0a11d54f2d5dd8838607452355f321 fixed this platform.
  Unfortunately that turned out to be incorrect. ]

Signed-off-by: Daniel J Blueman <>
Signed-off-by: H. Peter Anvin <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agolibata: fix unexpectedly frozen port after ata_eh_reset()
Tejun Heo [Wed, 25 May 2011 11:19:39 +0000 (13:19 +0200)]
libata: fix unexpectedly frozen port after ata_eh_reset()

commit 8c56cacc724c7650b893d43068fa66044aa29a61 upstream.

To work around controllers which can't properly plug events while
reset, ata_eh_reset() clears error states and ATA_PFLAG_EH_PENDING
after reset but before RESET is marked done.  As reset is the final
recovery action and full verification of devices including onlineness
and classfication match is done afterwards, this shouldn't lead to
lost devices or missed hotplug events.

Unfortunately, it forgot to thaw the port when clearing EH_PENDING, so
if the condition happens after resetting an empty port, the port could
be left frozen and EH will end without thawing it, making the port
unresponsive to further hotplug events.

Thaw if the port is frozen after clearing EH_PENDING.  This problem is
reported by Bruce Stenning in the following thread.

stable: I think we should weather this patch a bit longer in -rcX
before sending it to -stable.  Please wait at least a month
after this patch makes upstream.  Thanks.

-v2: Fixed spelling in the comment per Dave Howorth.

Signed-off-by: Tejun Heo <>
Reported-by: Bruce Stenning <>
Cc: Dave Howorth <>
Signed-off-by: Jeff Garzik <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agodavinci: DM365 EVM: fix video input mux bits
Jon Povey [Tue, 19 Jul 2011 03:30:11 +0000 (12:30 +0900)]
davinci: DM365 EVM: fix video input mux bits

commit 9daedd833a38edd90cf7baa1b1fcf61c3a0721e3 upstream.

Video input mux settings for tvp7002 and imager inputs were swapped.
Comment was correct.

Tested on EVM with tvp7002 input.

Signed-off-by: Jon Povey <>
Acked-by: Manjunath Hadli <>
Signed-off-by: Sekhar Nori <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agobridge: send proper message_age in config BPDU
stephen hemminger [Fri, 22 Jul 2011 07:47:06 +0000 (07:47 +0000)]
bridge: send proper message_age in config BPDU

commit 0c03150e7ea8f7fcd03cfef29385e0010b22ee92 upstream.

A bridge topology with three systems:

      +------+  +------+
      | A(2) |--| B(1) |
      +------+  +------+
           \    /
          | C(3) |

What is supposed to happen:
 * bridge with the lowest ID is elected root (for example: B)
 * C detects that A->C is higher cost path and puts in blocking state

What happens. Bridge with lowest id (B) is elected correctly as
root and things start out fine initially. But then config BPDU
doesn't get transmitted from A -> C. Because of that
the link from A-C is transistioned to the forwarding state.

The root cause of this is that the configuration messages
is generated with bogus message age, and dropped before

In the standardmessage_age is supposed to be:
  the time since the generation of the Configuration BPDU by
  the Root that instigated the generation of this Configuration BPDU.

Reimplement this by recording the timestamp (age + jiffies) when
recording config information. The old code incorrectly used the time
elapsed on the ageing timer which was incorrect.

See also:

Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agohwmon: (max1111) Fix race condition causing NULL pointer exception
Pavel Herrmann [Sun, 17 Jul 2011 16:39:19 +0000 (18:39 +0200)]
hwmon: (max1111) Fix race condition causing NULL pointer exception

commit d3f684f2820a7f42acef68bea6622d9032127fb2 upstream.

spi_sync call uses its spi_message parameter to keep completion information,
using a drvdata structure is not thread-safe. Use a mutex to prevent
multiple access to shared driver data.

Signed-off-by: Pavel Herrmann <>
Acked-by: Russell King <>
Acked-by: Pavel Machek <>
Acked-by: Marek Vasut <>
Acked-by: Cyril Hrubis <>
Tested-by: Stanislav Brabec <>
Signed-off-by: Jean Delvare <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agosi4713-i2c: avoid potential buffer overflow on si4713
Mauro Carvalho Chehab [Sun, 17 Jul 2011 03:24:37 +0000 (00:24 -0300)]
si4713-i2c: avoid potential buffer overflow on si4713

commit dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6 upstream.

While compiling it with Fedora 15, I noticed this issue:

  inlined from ‘si4713_write_econtrol_string’ at drivers/media/radio/si4713-i2c.c:1065:24:
  arch/x86/include/asm/uaccess_32.h:211:26: error: call to ‘copy_from_user_overflow’ declared with attribute error: copy_from_user() buffer size is not provably correct

Signed-off-by: Mauro Carvalho Chehab <>
Acked-by: Sakari Ailus <>
Acked-by: Eduardo Valentin <>
Reviewed-by: Eugene Teo <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoSUNRPC: Fix use of static variable in rpcb_getport_async
Ben Greear [Tue, 12 Jul 2011 17:27:55 +0000 (10:27 -0700)]
SUNRPC: Fix use of static variable in rpcb_getport_async

commit ec0dd267bf7d08cb30e321e45a75fd40edd7e528 upstream.

Because struct rpcbind_args *map was declared static, if two
threads entered this method at the same time, the values
assigned to map could be sent two two differen tasks.
This could cause all sorts of problems, include use-after-free
and double-free of memory.

Fix this by removing the static declaration so that the map
pointer is on the stack.

Signed-off-by: Ben Greear <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoSUNRPC: Fix a race between work-queue and rpc_killall_tasks
Trond Myklebust [Wed, 6 Jul 2011 23:58:23 +0000 (19:58 -0400)]
SUNRPC: Fix a race between work-queue and rpc_killall_tasks

commit b55c59892e1f3b6c7d4b9ccffb4263e1486fb990 upstream.

Since rpc_killall_tasks may modify the rpc_task's tk_action field
without any locking, we need to be careful when dereferencing it.

Reported-by: Ben Greear <>
Tested-by: Ben Greear <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoNFSv4.1: update nfs4_fattr_bitmap_maxsz
Andy Adamson [Mon, 11 Jul 2011 21:17:42 +0000 (17:17 -0400)]
NFSv4.1: update nfs4_fattr_bitmap_maxsz

commit e5012d1f3861d18c7f3814e757c1c3ab3741dbcd upstream.

Attribute IDs assigned in RFC 5661 now require three bitmaps.
Fixes hitting a BUG_ON in xdr_shrink_bufhead when getting ACLs.

Signed-off-by: Andy Adamson <>
Signed-off-by: Trond Myklebust <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agogro: Only reset frag0 when skb can be pulled
Herbert Xu [Wed, 27 Jul 2011 13:16:28 +0000 (06:16 -0700)]
gro: Only reset frag0 when skb can be pulled

commit 17dd759c67f21e34f2156abcf415e1f60605a188 upstream.

Currently skb_gro_header_slow unconditionally resets frag0 and
frag0_len.  However, when we can't pull on the skb this leaves
the GRO fields in an inconsistent state.

This patch fixes this by only resetting those fields after the
pskb_may_pull test.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agobttv: fix s_tuner for radio
Hans Verkuil [Sun, 12 Jun 2011 10:02:43 +0000 (07:02 -0300)]
bttv: fix s_tuner for radio

commit a024c1a6b274e11596d124619e43c25560f64c01 upstream.

Fix typo: g_tuner should have been s_tuner.

Tested with a bttv card.

Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agopvrusb2: fix g/s_tuner support
Hans Verkuil [Sun, 12 Jun 2011 09:39:52 +0000 (06:39 -0300)]
pvrusb2: fix g/s_tuner support

commit 50e9efd60b213ce43ad6979bfc18e25eec2d8413 upstream.

The tuner-core subdev requires that the type field of v4l2_tuner is
filled in correctly. This is done in v4l2-ioctl.c, but pvrusb2 doesn't
use that yet, so we have to do it manually based on whether the current
input is radio or not.

Tested with my pvrusb2.

Signed-off-by: Hans Verkuil <>
Acked-by: Mike Isely <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agov4l2-ioctl.c: prefill tuner type for g_frequency and g/s_tuner
Hans Verkuil [Sun, 12 Jun 2011 09:36:41 +0000 (06:36 -0300)]
v4l2-ioctl.c: prefill tuner type for g_frequency and g/s_tuner

commit 227690df75382e46a4f6ea1bbc5df855a674b47f upstream.

The subdevs are supposed to receive a valid tuner type for the g_frequency
and g/s_tuner subdev ops. Some drivers do this, others don't. So prefill
this in v4l2-ioctl.c based on whether the device node from which this is
called is a radio node or not.

The spec does not require applications to fill in the type, and if they
leave it at 0 then the 'check_mode' call in tuner-core.c will return
an error and the ioctl does nothing.

Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
6 years agoASoC: Fix Blackfin I2S _pointer() implementation return in bounds values
Mark Brown [Mon, 13 Jun 2011 11:14:07 +0000 (12:14 +0100)]
ASoC: Fix Blackfin I2S _pointer() implementation return in bounds values

commit e999dc50404d401150a5429b6459473a691fd1a0 upstream.

The Blackfin DMA controller can report one frame beyond the end of the
buffer in the wraparound case but ALSA requires that the pointer always
be in the buffer. Do the wraparound to handle this. A similar bug is
likely to apply to the other Blackfin PCM drivers but the code is less
obvious to inspection and I don't have a user to test.

Reported-by: Kieran O'Leary <Kieran.O'>
Acked-by: Liam Girdwood <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
6 years ago- Fix rtsched_debug "Danger Will Robinson" warnings to only
Mike Galbraith [Mon, 8 Aug 2011 12:51:03 +0000 (14:51 +0200)]
- Fix rtsched_debug "Danger Will Robinson" warnings to only
  be emitted if the current task is still a realtime task.
  This will not be the case once the runqueue is throttled,
  which led to false "potential runaway" warnings pointing
  the finger at SCHED_OTHER tasks which had been given the
  CPU while the realtime hog waits for runtime refill.

- patches.fixes/sched-rtsched_debug-boot-option.patch: Refresh.

suse-commit: 997fd26f1fb606018e38eef80e6aed43be940e37

6 years ago- patches.drivers/intr-remap-allow-disabling-source-id-checking.patch:
Jiri Slaby [Sat, 6 Aug 2011 09:36:43 +0000 (11:36 +0200)]
- patches.drivers/intr-remap-allow-disabling-source-id-checking.patch:
  intr-remap: allow disabling source id checking (bnc#710352).

suse-commit: ab2df376482e98a0b82a30a7ad89d5ef349a8fda

6 years ago- patches.arch/s390-31-01-page-referenced.patch: kernel: first
John Jolly [Thu, 4 Aug 2011 18:14:59 +0000 (20:14 +0200)]
- patches.arch/s390-31-01-page-referenced.patch: kernel: first
  time swap use results in heavy swapping (bnc#705903,LTC#73132).

suse-commit: 25166de18c7833244dc9c4572fb52c5ae09f23f5

6 years ago- patches.fixes/qla2xxx-skip-msix-correction.diff: Skip MSI-X
Goldwyn Rodrigues [Thu, 4 Aug 2011 17:49:13 +0000 (19:49 +0200)]
- patches.fixes/qla2xxx-skip-msix-correction.diff: Skip MSI-X
  for qla2xxx (bnc#693513).

suse-commit: 20eed012ffd2b536ffeb389c8778ebc7b50332da

6 years agoMerge branch 'SLE11-SP1' of into SLE11-SP1
Mike Galbraith [Fri, 29 Jul 2011 15:50:27 +0000 (17:50 +0200)]
Merge branch 'SLE11-SP1' of into SLE11-SP1

suse-commit: 25099a6b3c2acd45f45e5386f6fb76fb88e9b021

6 years ago- Add a realtime debug and/or safety net boot option. If the
Mike Galbraith [Fri, 29 Jul 2011 15:49:44 +0000 (17:49 +0200)]
- Add a realtime debug and/or safety net boot option.  If the
  user runs a 100% CPU hog on a box booted with rtsched_debug
  option, the box will survive and warn.

- patches.fixes/sched-rtsched_debug-boot-option.patch:
  Add rtsched_debug boot option (bnc#708730).
- patches.arch/bug-610783_uv_nortsched_boot_option.patch: Refresh.

suse-commit: 5f2666c5747686d61b941422b7fa68a95cc587d5

6 years ago- patches.fixes/mm-remove-unused-nonblocking-and-congestion-checks.patch:
Jan Kara [Fri, 29 Jul 2011 12:56:51 +0000 (14:56 +0200)]
- patches.fixes/mm-remove-unused-nonblocking-and-congestion-checks.patch:
- patches.fixes/writeback-avoid-unnecessary-determine_dirtyable_memo.patch:
  writeback: avoid unnecessary determine_dirtyable_memory call
- patches.fixes/writeback-balance_dirty_pages-reduce-calls-to-global.patch:
  writeback: balance_dirty_pages(): reduce calls to
  global_page_state (bnc#699354).
- patches.fixes/writeback-limit-write_cache_pages-integrity-scanning.patch:
  writeback: limit write_cache_pages integrity scanning to
  current EOF (bnc#699354).
- patches.fixes/xfs-handle-negative-wbc-nr_to_write-during-sync-writ.patch:
  xfs: handle negative wbc->nr_to_write during sync writeback
- patches.fixes/xfs-remove-nr_to_write-writeback-windup.patch:
  xfs: remove nr_to_write writeback windup (bnc#699354).

suse-commit: 2ecab9d2115f6231ef6d91bf4a6eb8331b5d9945

6 years ago- patches.fixes/cpusets-randomize-node-rotor-used-in-cpuset_mem_spre.patch:
Michal Hocko [Fri, 29 Jul 2011 07:26:21 +0000 (09:26 +0200)]
- patches.fixes/cpusets-randomize-node-rotor-used-in-cpuset_mem_spre.patch:
  fixed mem_rotor overflow

suse-commit: 0f6d7041c56020f7f7c001af5f9584506f7ce67a

6 years ago- patches.fixes/cpusets-randomize-node-rotor-used-in-cpuset_mem_spre.patch:
Michal Hocko [Thu, 28 Jul 2011 15:35:01 +0000 (17:35 +0200)]
- patches.fixes/cpusets-randomize-node-rotor-used-in-cpuset_mem_spre.patch:
  Compile fix for !x86_64 architectures which do not have NUMA_NO_NODE

suse-commit: 8a86d10a1da0a496dd38ff1509bd2929524abec6

6 years ago- patches.fixes/cpusets-randomize-node-rotor-used-in-cpuset_mem_spre.patch:
Michal Hocko [Thu, 28 Jul 2011 14:50:57 +0000 (16:50 +0200)]
- patches.fixes/cpusets-randomize-node-rotor-used-in-cpuset_mem_spre.patch:
  cpusets: randomize node rotor used in cpuset_mem_spread_node()

suse-commit: e27b49d1cf757e1d596368aaa9ce6acff9a9f410

6 years ago- patches.fixes/mm-more-unused-nonblocking-and-congestion-checks.patch:
Jan Kara [Thu, 28 Jul 2011 14:58:33 +0000 (16:58 +0200)]
- patches.fixes/mm-more-unused-nonblocking-and-congestion-checks.patch:
  writeback: remove nonblocking/encountered_congestion references
- patches.fixes/mm-pay-attention-to-wbc-nr_to_write.patch:
- patches.fixes/mm-remove-unused-nonblocking-and-congestion-checks.patch:
  writeback: remove unused nonblocking and congestion checks
- patches.fixes/mm-write_cache_pages-terminate-nr_to_write-negative.patch:

suse-commit: b805c5b28635acb09fbe6d92f085e2c25880073d

6 years ago- patches.fixes/mm-pay-attention-to-wbc-nr_to_write.patch:
Jan Kara [Thu, 28 Jul 2011 12:32:37 +0000 (14:32 +0200)]
- patches.fixes/mm-pay-attention-to-wbc-nr_to_write.patch:
  writeback: pay attention to wbc->nr_to_write in
  write_cache_pages (bnc#699354).
- patches.fixes/mm-write_cache_pages-terminate-nr_to_write-negative.patch:
  writeback: write_cache_pages doesn't terminate at nr_to_write <=
  0 (bnc#699354).

suse-commit: 72d96a97f7b88abf1dfe791acf59401cffdaf083

6 years ago- patches.arch/ppc-normalize-xtime-after-rounding: time: Normalize
T. Duwe [Wed, 27 Jul 2011 15:31:26 +0000 (17:31 +0200)]
- patches.arch/ppc-normalize-xtime-after-rounding: time: Normalize
  xtime after rounding (bnc#685226).

suse-commit: 5269f501a2c6479fb6cd460c0482b8c1c22dc9bd

6 years ago- patches.fixes/scsi_transport_spi-export-host-width-and-HBA-id:
Ankit Jain [Wed, 27 Jul 2011 09:07:17 +0000 (14:37 +0530)]
- patches.fixes/scsi_transport_spi-export-host-width-and-HBA-id:
  Update Git-* tags, to reflect that the patch has been accepted upstream.

suse-commit: cd34a4ba5ae4fd27ad60e0fdc95596bc86b04802

6 years ago- patches.kabi/alsa-sp1-hda-pre_resume-codec-ops-kabi: Refresh.
Takashi Iwai [Wed, 27 Jul 2011 06:47:02 +0000 (08:47 +0200)]
- patches.kabi/alsa-sp1-hda-pre_resume-codec-ops-kabi: Refresh.
  Fix a typo.

suse-commit: 86a3e95cf07b1592c4d0acafb7fde390dfa3b38e

6 years ago- patches.fixes/kvm-stable-fix-information-leak-to-userland.patch:
Alexander Graf [Mon, 25 Jul 2011 09:50:21 +0000 (11:50 +0200)]
- patches.fixes/kvm-stable-fix-information-leak-to-userland.patch:
  KVM: x86: fix information leak to userland (bnc#706696).

suse-commit: e8d4caa9481e449611873625e299970d9a719eed

6 years ago- patches.kabi/alsa-sp1-hda-pre_resume-codec-ops-kabi: Fix kABI
Takashi Iwai [Tue, 26 Jul 2011 16:24:28 +0000 (18:24 +0200)]
- patches.kabi/alsa-sp1-hda-pre_resume-codec-ops-kabi: Fix kABI
  breakage with pre_resume codec_ops (bnc#708376).

suse-commit: ddc29b466bfbc0c4055136d77d3fb94879cded19

6 years agoFix patch-mainline tags in patches.drivers/alsa-sp1-hda-*
Takashi Iwai [Tue, 26 Jul 2011 15:43:07 +0000 (17:43 +0200)]
Fix patch-mainline tags in patches.drivers/alsa-sp1-hda-*

suse-commit: ea0ad6ec812a8e0cec9fb1c9e4cb11a83d326a53

6 years ago- patches.drivers/alsa-sp1-hda-119-Fix-invalid-mute-led-state-on-resume-of-IDT:
Takashi Iwai [Tue, 26 Jul 2011 15:11:31 +0000 (17:11 +0200)]
- patches.drivers/alsa-sp1-hda-119-Fix-invalid-mute-led-state-on-resume-of-IDT:
  ALSA: hda - Fix invalid mute led state on resume of IDT codecs
- patches.drivers/alsa-sp1-hda-120-Make-sure-mute-led-reflects-master-mute-state:
  ALSA: hda - Make sure mute led reflects master mute state
- patches.drivers/alsa-sp1-hda-121-Add-support-of-4-internal-speakers-on-cNB:
  ALSA: hda - Add support of the 4 internal speakers on certain
  HP laptops (bnc#708376).

suse-commit: 6eb2fc260a0065468fc97247c2f417bdfbbc37e6

6 years ago- patches.fixes/natsemi-long-cable-fix: natsemi: make cable
Jean Delvare [Thu, 21 Jul 2011 14:47:11 +0000 (16:47 +0200)]
- patches.fixes/natsemi-long-cable-fix: natsemi: make cable
  length magic configurable (bnc#225091, bnc#704361).
- patches.fixes/net-natsemi-fix-module-parameter-permissions.patch:
  net/natsemi: Fix module parameter permissions.

suse-commit: 9bbceb77287167d857e2ec2c781a37257790d465

6 years agoUpdate kernel-source.changes
Michal Marek [Thu, 21 Jul 2011 07:28:31 +0000 (09:28 +0200)]
Update kernel-source.changes

suse-commit: 26f65320ff62d1e0736c10003469f4f07bd01a6a

6 years agoMerge branch 'SLE11-SP1' of into SLE11-SP1
Jeff Mahoney [Wed, 20 Jul 2011 16:52:00 +0000 (12:52 -0400)]
Merge branch 'SLE11-SP1' of into SLE11-SP1

suse-commit: 782cb28d9bd2f58fb933ef2ce3ec3ddfa941d52d