commit 67db9db0bfd9448feb8e69224dfbb83e5834082b Author: Greg Kroah-Hartman Date: Tue Aug 20 08:26:48 2013 -0700 Linux 3.4.59 commit 9cfae3e2f1cac477673d211e9f6a06248dda5b8a Author: Jan Kara Date: Mon Aug 12 09:53:28 2013 -0400 jbd2: Fix use after free after error in jbd2_journal_dirty_metadata() commit 91aa11fae1cf8c2fd67be0609692ea9741cdcc43 upstream. When jbd2_journal_dirty_metadata() returns error, __ext4_handle_dirty_metadata() stops the handle. However callers of this function do not count with that fact and still happily used now freed handle. This use after free can result in various issues but very likely we oops soon. The motivation of adding __ext4_journal_stop() into __ext4_handle_dirty_metadata() in commit 9ea7a0df seems to be only to improve error reporting. So replace __ext4_journal_stop() with ext4_journal_abort_handle() which was there before that commit and add WARN_ON_ONCE() to dump stack to provide useful information. Reported-by: Sage Weil Signed-off-by: Jan Kara Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit dadf2af13293d83259645efeda3d84634bce2afb Author: Geert Uytterhoeven Date: Fri Jul 26 00:08:25 2013 +0200 m68k/atari: ARAnyM - Fix NatFeat module support commit e8184e10f89736a23ea6eea8e24cd524c5c513d2 upstream. As pointed out by Andreas Schwab, pointers passed to ARAnyM NatFeat calls should be physical addresses, not virtual addresses. Fortunately on Atari, physical and virtual kernel addresses are the same, as long as normal kernel memory is concerned, so this usually worked fine without conversion. But for modules, pointers to literal strings are located in vmalloc()ed memory. Depending on the version of ARAnyM, this causes the nf_get_id() call to just fail, or worse, crash ARAnyM itself with e.g. Gotcha! Illegal memory access. Atari PC = $968c This is a big issue for distro kernels, who want to have all drivers as loadable modules in an initrd. Add a wrapper for nf_get_id() that copies the literal to the stack to work around this issue. Reported-by: Thorsten Glaser Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit aa1f7bc0da50758ab02cd5fd9ee6b24e7e7dba27 Author: Andreas Schwab Date: Fri Aug 9 15:14:08 2013 +0200 m68k: Truncate base in do_div() commit ea077b1b96e073eac5c3c5590529e964767fc5f7 upstream. Explicitly truncate the second operand of do_div() to 32 bits to guard against bogus code calling it with a 64-bit divisor. [Thorsten] After upgrading from 3.2 to 3.10, mounting a btrfs volume fails with: btrfs: setting nodatacow, compression disabled btrfs: enabling auto recovery btrfs: disk space caching is enabled *** ZERO DIVIDE *** FORMAT=2 Current process id is 722 BAD KERNEL TRAP: 00000000 Modules linked in: evdev mac_hid ext4 crc16 jbd2 mbcache btrfs xor lzo_compress zlib_deflate raid6_pq crc32c libcrc32c PC: [<319535b2>] __btrfs_map_block+0x11c/0x119a [btrfs] SR: 2000 SP: 30c1fab4 a2: 30f0faf0 d0: 00000000 d1: 00001000 d2: 00000000 d3: 00000000 d4: 00010000 d5: 00000000 a0: 3085c72c a1: 3085c72c Process mount (pid: 722, task=30f0faf0) Frame format=2 instr addr=319535ae Stack from 30c1faec: 00000000 00000020 00000000 00001000 00000000 01401000 30253928 300ffc00 00a843ac 3026f640 00000000 00010000 0009e250 00d106c0 00011220 00000000 00001000 301c6830 0009e32a 000000ff 00000009 3085c72c 00000000 00000000 30c1fd14 00000000 00000020 00000000 30c1fd14 0009e26c 00000020 00000003 00000000 0009dd8a 300b0b6c 30253928 00a843ac 00001000 00000000 00000000 0000a008 3194e76a 30253928 00a843ac 00001000 00000000 00000000 00000002 Call Trace: [<00001000>] kernel_pg_dir+0x0/0x1000 [...] Code: 222e ff74 2a2e ff5c 2c2e ff60 4c45 1402 <2d40> ff64 2d41 ff68 2205 4c2e 1800 ff68 4c04 0800 2041 d1c0 2206 4c2e 1400 ff68 [Geert] As diagnosed by Andreas, fs/btrfs/volumes.c:__btrfs_map_block() calls do_div(stripe_nr, stripe_len); with stripe_len u64, while do_div() assumes the divisor is a 32-bit number. Due to the lack of truncation in the m68k-specific implementation of do_div(), the division is performed using the upper 32-bit word of stripe_len, which is zero. This was introduced by commit 53b381b3abeb86f12787a6c40fee9b2f71edc23b ("Btrfs: RAID5 and RAID6"), which changed the divisor from map->stripe_len (struct map_lookup.stripe_len is int) to a 64-bit temporary. Reported-by: Thorsten Glaser Signed-off-by: Andreas Schwab Tested-by: Thorsten Glaser Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit 40c366017f537354c64ea8b77d57ca81ecbd6b1d Author: Will Deacon Date: Wed Aug 7 23:39:41 2013 +0100 ARM: 7809/1: perf: fix event validation for software group leaders commit c95eb3184ea1a3a2551df57190c81da695e2144b upstream. It is possible to construct an event group with a software event as a group leader and then subsequently add a hardware event to the group. This results in the event group being validated by adding all members of the group to a fake PMU and attempting to allocate each event on their respective PMU. Unfortunately, for software events wthout a corresponding arm_pmu, this results in a kernel crash attempting to dereference the ->get_event_idx function pointer. This patch fixes the problem by checking explicitly for software events and ignoring those in event validation (since they can always be scheduled). We will probably want to revisit this for 3.12, since the validation checks don't appear to work correctly when dealing with multiple hardware PMUs anyway. Reported-by: Vince Weaver Tested-by: Vince Weaver Tested-by: Mark Rutland Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit ca4e6a56000ee4b941e2c6d78b5cb32e27245ee0 Author: Geert Uytterhoeven Date: Wed Jun 20 12:52:58 2012 -0700 xtensa: replace xtensa-specific _f{data,text} by _s{data,text} commit 5e7b6ed8e9bf3c8e3bb579fd0aec64f6526f8c81 upstream. commit a2d063ac216c161 ("extable, core_kernel_data(): Make sure all archs define _sdata") missed xtensa. Xtensa does have a start of data marker, but calls it _fdata, causing kernel/built-in.o:(.text+0x964): undefined reference to `_sdata' _stext was already defined, but it was duplicated by _fdata. Signed-off-by: Geert Uytterhoeven Cc: Steven Rostedt Cc: Chris Zankel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 85d43e3ae1b14931897a7829e8adde373357880b Author: Max Filippov Date: Mon Sep 17 05:44:31 2012 +0400 xtensa: fix linker script transformation for .text.unlikely commit f6a03a12ecdbe0dd80a55f6df3b7206c5a403a49 upstream. Now that binutils generate *.unlikely sections which don't follow documented (info as) literal section naming rules, section name transformation script doesn't work well resulting in the following errors at vmlinux link time: main.c:(.text.unlikely+0x3): dangerous relocation: l32r: literal placed after use: .literal.unlikely Fix section name transformation script by adding specific rule for .text.unlikely sections. Signed-off-by: Max Filippov Signed-off-by: Chris Zankel Cc: Geert Uytterhoeven Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit d36f8a9594acdd87233b2a7e91328b7d56fa3828 Author: Johan Hovold Date: Tue Aug 13 13:27:34 2013 +0200 USB: mos7720: fix broken control requests commit ef6c8c1d733e244f0499035be0dabe1f4ed98c6f upstream. The parallel-port code of the drivers used a stack allocated control-request buffer for asynchronous (and possibly deferred) control requests. This not only violates the no-DMA-from-stack requirement but could also lead to corrupt control requests being submitted. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 40d0288f1975286f4a249b76f3b489bde5bc0be5 Author: Oliver Neukum Date: Wed Aug 14 11:01:46 2013 +0200 usb: add two quirky touchscreen commit 304ab4ab079a8ed03ce39f1d274964a532db036b upstream. These devices tend to become unresponsive after S3 Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 2efb739b6c863a77cfc362b69f755c32805a5fc2 Author: Stephane Grosjean Date: Fri Aug 9 11:44:06 2013 +0200 can: pcan_usb: fix wrong memcpy() bytes length commit 3c322a56b01695df15c70bfdc2d02e0ccd80654e upstream. Fix possibly wrong memcpy() bytes length since some CAN records received from PCAN-USB could define a DLC field in range [9..15]. In that case, the real DLC value MUST be used to move forward the record pointer but, only 8 bytes max. MUST be copied into the data field of the struct can_frame object of the skb given to the network core. Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6e819f58e3a21214289fc7378af0889d7d344701 Author: Stanislaw Gruszka Date: Thu Aug 1 12:07:55 2013 +0200 iwl4965: reset firmware after rfkill off commit 788f7a56fce1bcb2067b62b851a086fca48a0056 upstream. Using rfkill switch can make firmware unstable, what cause various Microcode errors and kernel warnings. Reseting firmware just after rfkill off (radio on) helped with that. Resolve: https://bugzilla.redhat.com/show_bug.cgi?id=977053 Reported-and-tested-by: Justin Pearce Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 179dfb0cb213ac7873997214d33ec9a28667913a Author: Stanislaw Gruszka Date: Thu Aug 1 12:07:13 2013 +0200 iwl4965: set power mode early commit eca396d7a5bdcc1fd67b1b12f737c213ac78a6f4 upstream. If device was put into a sleep and system was restarted or module reloaded, we have to wake device up before sending other commands. Otherwise it will fail to start with Microcode error. Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1a5abb4f4a731287cbd45bfdc12fadb011c47f51 Author: Nicolas Dichtel Date: Mon Feb 18 16:24:20 2013 +0100 af_key: initialize satype in key_notify_policy_flush() commit 85dfb745ee40232876663ae206cba35f24ab2a40 upstream. This field was left uninitialized. Some user daemons perform check against this field. Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert Cc: Luis Henriques Signed-off-by: Greg Kroah-Hartman commit 938b7f3cfac46ced23a64a719062d9b56acc91aa Author: Ralf Baechle Date: Thu Aug 15 22:35:53 2013 -0700 MIPS: Rewrite pfn_valid to work in modules, too. Upstream commit 8b9232141bf40788cce31f893c13f344ec31ee66. This fixes: MODPOST 393 modules ERROR: "min_low_pfn" [arch/mips/kvm/kvm.ko] undefined! make[3]: *** [__modpost] Error 1 It would have been possible to just export min_low_pfn but in the end pfn_valid should return 1 for any pfn argument for which a struct page exists so using min_low_pfn was wrong anyway. [Backport to 3.4 kernel. Applies cleanly on top of current 3.4 patch queue, and fixes "make ARCH=mips allmodconfig; make ARCH=mips" build problem. - Guenter] Signed-off-by: Ralf Baechle Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 22a327d1685e35c2dd6b00b2ef1c27d0d252e6fa Author: David S. Miller Date: Sat May 19 15:27:01 2012 -0700 sparc32: Add ucmpdi2.o to obj-y instead of lib-y. commit 74c7b28953d4eaa6a479c187aeafcfc0280da5e8 upstream. Otherwise if no references exist in the static kernel image, we won't export the symbol properly to modules. Signed-off-by: David S. Miller Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit d326e4a01a146c8b92ca45d6ad2a90189af07989 Author: Sam Ravnborg Date: Sat May 19 11:54:11 2012 +0200 sparc32: add ucmpdi2 commit de36e66d5fa52bc6e2dacd95c701a1762b5308a7 upstream. Based on copy from microblaze add ucmpdi2 implementation. This fixes build of niu driver which failed with: drivers/built-in.o: In function `niu_get_nfc': niu.c:(.text+0x91494): undefined reference to `__ucmpdi2' This driver will never be used on a sparc32 system, but patch added to fix build breakage with all*config builds. Signed-off-by: Sam Ravnborg Signed-off-by: David S. Miller Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 1b9203bb4c658c0242afa6fdb025c71d2fc3ad76 Author: NeilBrown Date: Wed Jun 12 11:01:22 2013 +1000 md/raid1,raid10: use freeze_array in place of raise_barrier in various places. commit e2d59925221cd562e07fee38ec8839f7209ae603 upstream. Various places in raid1 and raid10 are calling raise_barrier when they really should call freeze_array. The former is only intended to be called from "make_request". The later has extra checks for 'nr_queued' and makes a call to flush_pending_writes(), so it is safe to call it from within the management thread. Using raise_barrier will sometimes deadlock. Using freeze_array should not. As 'freeze_array' currently expects one request to be pending (in handle_read_error - the only previous caller), we need to pass it the number of pending requests (extra) to ignore. The deadlock was made particularly noticeable by commits 050b66152f87c7 (raid10) and 6b740b8d79252f13 (raid1) which appeared in 3.4, so the fix is appropriate for any -stable kernel since then. This patch probably won't apply directly to some early kernels and will need to be applied by hand. Cc: stable@vger.kernel.org Reported-by: Alexander Lyakas Signed-off-by: NeilBrown [adjust context to make it can be apply on top of 3.4 ] Signed-off-by: Jack Wang Signed-off-by: Greg Kroah-Hartman commit efb5fbe89cdcc97ce170bf53c0764d7d00b7a4a6 Author: Will Deacon Date: Sun Apr 7 21:36:10 2013 +1200 alpha: makefile: don't enforce small data model for kernel builds commit cd8d2331756751b6aeb855a3c9cb0a92fbd9c725 upstream. Due to all of the goodness being packed into today's kernels, the resulting image isn't as slim as it once was. In light of this, don't pass -msmall-data to gcc, which otherwise results in link failures due to impossible relocations when compiling anything but the most trivial configurations. Reviewed-by: Matt Turner Cc: Richard Henderson Cc: Ivan Kokshaysky Tested-by: Thorsten Kranzkowski Signed-off-by: Will Deacon Signed-off-by: Michael Cree Signed-off-by: Linus Torvalds Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 30d03769e318ea195cbc30333eab29a653c9bdf6 Author: Benjamin Herrenschmidt Date: Thu Jul 5 16:30:33 2012 +0000 powerpc/numa: Avoid stupid uninitialized warning from gcc commit aa709f3bc92c6daaf177cd7e3446da2ef64426c6 upstream. Newer gcc are being a bit blind here (it's pretty obvious we don't reach the code path using the array if we haven't initialized the pointer) but none of that is performance critical so let's just silence it. Signed-off-by: Benjamin Herrenschmidt Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit fa046609113bcc1ff7d22d90928ae47b44401391 Author: Thomas Gleixner Date: Thu May 3 09:02:47 2012 +0000 frv: Use core allocator for task_struct commit c6ae063aaf3786b9db7f19a90bf4ed8aaebb7f90 upstream. There is no point having a copy of the core allocator. Signed-off-by: Thomas Gleixner Acked-by: David Howells Link: http://lkml.kernel.org/r/20120503085033.967140188@linutronix.de Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 0a2436eff9888b8fff8b7a5cf6bae49826615a7e Author: Thomas Gleixner Date: Thu May 3 09:02:47 2012 +0000 frv: Use correct size for task_struct allocation commit cce4517f33384c3794c759e206cc8e1bb6df146b upstream. alloc_task_struct_node() allocates THREAD_SIZE and maintains some weird refcount in the allocated memory. This never blew up as task_struct size on 32bit machines was always less than THREAD_SIZE Allocate just sizeof(struct task_struct) and get rid of the magic refcounting. Signed-off-by: Thomas Gleixner Acked-by: David Howells Link: http://lkml.kernel.org/r/20120503085033.898475542@linutronix.de Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit a42efb79d54d9a13c8f68df122c832bca08b74ae Author: Zhang Yi Date: Tue Jun 25 21:19:31 2013 +0800 futex: Take hugepages into account when generating futex_key commit 13d60f4b6ab5b702dc8d2ee20999f98a93728aec upstream. The futex_keys of process shared futexes are generated from the page offset, the mapping host and the mapping index of the futex user space address. This should result in an unique identifier for each futex. Though this is not true when futexes are located in different subpages of an hugepage. The reason is, that the mapping index for all those futexes evaluates to the index of the base page of the hugetlbfs mapping. So a futex at offset 0 of the hugepage mapping and another one at offset PAGE_SIZE of the same hugepage mapping have identical futex_keys. This happens because the futex code blindly uses page->index. Steps to reproduce the bug: 1. Map a file from hugetlbfs. Initialize pthread_mutex1 at offset 0 and pthread_mutex2 at offset PAGE_SIZE of the hugetlbfs mapping. The mutexes must be initialized as PTHREAD_PROCESS_SHARED because PTHREAD_PROCESS_PRIVATE mutexes are not affected by this issue as their keys solely depend on the user space address. 2. Lock mutex1 and mutex2 3. Create thread1 and in the thread function lock mutex1, which results in thread1 blocking on the locked mutex1. 4. Create thread2 and in the thread function lock mutex2, which results in thread2 blocking on the locked mutex2. 5. Unlock mutex2. Despite the fact that mutex2 got unlocked, thread2 still blocks on mutex2 because the futex_key points to mutex1. To solve this issue we need to take the normal page index of the page which contains the futex into account, if the futex is in an hugetlbfs mapping. In other words, we calculate the normal page mapping index of the subpage in the hugetlbfs mapping. Mappings which are not based on hugetlbfs are not affected and still use page->index. Thanks to Mel Gorman who provided a patch for adding proper evaluation functions to the hugetlbfs code to avoid exposing hugetlbfs specific details to the futex code. [ tglx: Massaged changelog ] Signed-off-by: Zhang Yi Reviewed-by: Jiang Biao Tested-by: Ma Chenggong Reviewed-by: 'Mel Gorman' Acked-by: 'Darren Hart' Cc: 'Peter Zijlstra' Link: http://lkml.kernel.org/r/000101ce71a6%24a83c5880%24f8b50980%24@com Signed-off-by: Thomas Gleixner Cc: Mike Galbraith Signed-off-by: Greg Kroah-Hartman commit 4d5b24dd453b4ff44f69756106b029e8961dcb55 Author: Jesper Nilsson Date: Mon Oct 24 11:19:25 2011 +0200 CRIS: Add _sdata to vmlinux.lds.S commit 473e162eea465e60578edb93341752e7f1c1dacc upstream. Fixes link error: LD vmlinux kernel/built-in.o: In function `core_kernel_data': (.text+0x13e44): undefined reference to `_sdata' Signed-off-by: Jesper Nilsson Cc: Guenter Roeck Cc: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit 5acea25f70fe891ae6bb21288a106c742a44c238 Author: Paul Gortmaker Date: Wed Apr 18 21:58:43 2012 +0200 cris: Remove old legacy "-traditional" flag from arch-v10/lib/Makefile commit 7b91747d42a1012e3781dd09fa638d113809e3fd upstream. Most of these have been purged years ago. This one silently lived on until commit 69349c2dc01c489eccaa4c472542c08e370c6d7e "kconfig: fix IS_ENABLED to not require all options to be defined" In the above, we use some macro trickery to create a conditional that is valid in CPP and in C usage. However that trickery doesn't sit well if you have the legacy "-traditional" flag enabled. You'll get: AS arch/cris/arch-v10/lib/checksum.o In file included from :4:0: include/linux/kconfig.h:23:0: error: syntax error in macro parameter list make[2]: *** [arch/cris/arch-v10/lib/checksum.o] Error 1 Everything builds fine w/o "-traditional" so simply drop it from this location as well. Signed-off-by: Paul Gortmaker Signed-off-by: Jesper Nilsson Cc: Geert Uytterhoeven Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 38045ae9111ca99cf4bc5e743389e079efb729a5 Author: Jiri Slaby Date: Mon Apr 2 13:40:17 2012 +0200 cris: posix_types.h, include asm-generic/posix_types.h commit 74f077d2a7651409c44bb323471f219a4b0d2aab upstream. Without that I cannot build anything: In file included from include/linux/page-flags.h:8:0, from kernel/bounds.c:9: include/linux/types.h:25:1: error: unknown type name '__kernel_ino_t' include/linux/types.h:29:1: error: unknown type name '__kernel_off_t' ... Signed-off-by: Jiri Slaby Cc: Mikael Starvik Signed-off-by: Jesper Nilsson Cc: linux-cris-kernel@axis.com Cc: Geert Uytterhoeven Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit cd1be30ea12a61a67386e5752a6f7f0b12a55c9b Author: Linus Torvalds Date: Sat Apr 27 13:25:38 2013 -0700 vm: add no-mmu vm_iomap_memory() stub commit 3c0b9de6d37a481673e81001c57ca0e410c72346 upstream. I think we could just move the full vm_iomap_memory() function into util.h or similar, but I didn't get any reply from anybody actually using nommu even to this trivial patch, so I'm not going to touch it any more than required. Here's the fairly minimal stub to make the nommu case at least potentially work. It doesn't seem like anybody cares, though. Signed-off-by: Linus Torvalds Cc: Geert Uytterhoeven Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit ec3c697d1904c8c126ac8f88b16949e4c7038c2b Author: Jiri Slaby Date: Mon Nov 12 10:16:09 2012 +0100 HID: microsoft: do not use compound literal - fix build commit 6b90466cfec2a2fe027187d675d8d14217c12d82 upstream. In patch "HID: microsoft: fix invalid rdesc for 3k kbd" I fixed support for MS 3k keyboards. However the added check using memcmp and a compound statement breaks build on architectures where memcmp is a macro with parameters. hid-microsoft.c:51:18: error: macro "memcmp" passed 6 arguments, but takes just 3 On x86_64, memcmp is a function, so I did not see the error. Signed-off-by: Jiri Slaby Reported-by: Geert Uytterhoeven Signed-off-by: Jiri Kosina Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 9eae33247abc89486e375d3ae64702ad25aa08e6 Author: Paul Bolle Date: Sun May 12 14:31:19 2013 +0200 sound: Fix make allmodconfig on MIPS correctly commit a62ee234a572b4c98fe98cf5fb18e4e8b0f6e43d upstream. Commit d4702b189c ("sound: Fix make allmodconfig on MIPS") added a (negative) dependency on ISA_DMA_SUPPORT_BROKEN. Since that Kconfig symbol doesn't exist, this dependency will always evaluate to true. Apparently GENERIC_ISA_DMA_SUPPORT_BROKEN was meant to be used here. Signed-off-by: Paul Bolle Signed-off-by: Takashi Iwai Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 2f540fd1bb9eb6a68a07d962b00289ab2ae2862a Author: Takashi Iwai Date: Fri May 3 17:07:24 2013 +0200 sound: Fix make allmodconfig on MIPS commit d4702b189c6b951c1cb3260036ff998f719bfb62 upstream. The compile of soundcard.c is broken on MIPS when allmodconfig is used because of the missing MAX_DMA_CHANNELS definition. As a simple workaround, just add a Kconfig dependency. Reported-by: Andrew Morton Cc: Ralf Baechle Signed-off-by: Takashi Iwai Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 7b21e1ddaec61bfaf0540dff5d6a822c9abb04ee Author: Michal Simek Date: Fri Dec 21 10:53:59 2012 +0100 microblaze: Update microblaze defconfigs commit d0e045401f268a8de6f87d65678214748b772680 upstream. The main reason is 0-day testing system which can directly use these defconfigs for testing. Enable support for all xilinx drivers which Microblaze can use and disable dependency on external rootfs.cpio. There is only one exception which is axi ethernet driver which still uses NO_IRQ which is not defined for Microblaze. Signed-off-by: Michal Simek Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 01aeb48306e234880e41134fa0a2d26764dde6ca Author: Markos Chandras Date: Mon Jun 17 08:09:00 2013 +0000 MIPS: Expose missing pci_io{map,unmap} declarations commit 78857614104a26cdada4c53eea104752042bf5a1 upstream. The GENERIC_PCI_IOMAP does not depend on CONFIG_PCI so move it to the CONFIG_MIPS symbol so it's always selected for MIPS. This fixes the missing pci_iomap declaration for MIPS. Moreover, the pci_iounmap function was not defined in the io.h header file if the CONFIG_PCI symbol is not set, but it should since MIPS is not using CONFIG_GENERIC_IOMAP. This fixes the following problem on a allyesconfig: drivers/net/ethernet/3com/3c59x.c:1031:2: error: implicit declaration of function 'pci_iomap' [-Werror=implicit-function-declaration] drivers/net/ethernet/3com/3c59x.c:1044:3: error: implicit declaration of function 'pci_iounmap' [-Werror=implicit-function-declaration] Signed-off-by: Markos Chandras Acked-by: Steven J. Hill Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/5478/ Signed-off-by: Ralf Baechle Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit b381f38c9fb0bbfdfff5452ce11f7c74ecd94c43 Author: Daniel Vetter Date: Wed Jul 11 16:27:52 2012 +0200 drm/i915/lvds: ditch ->prepare special case commit 520c41cf2fa029d1e8b923ac2026f96664f17c4b upstream. LVDS is the first output where dpms on/off and prepare/commit don't perfectly match. Now the idea behind this special case seems to be that for simple resolution changes on the LVDS we don't need to stop the pipe, because (at least on newer chips) we can adjust the panel fitter on the fly. There are a few problems with the current code though: - We still stop and restart the pipe unconditionally, because the crtc helper code isn't flexible enough. - We show some ugly flickering, especially when changing crtcs (this the crtc helper would actually take into account, but we don't implement the encoder->get_crtc callback required to make this work properly). So it doesn't even work as advertised. I agree that it would be nice to do resolution changes on LVDS (and also eDP) whithout blacking the screen where the panel fitter allows to do that. But imo we should implement this as a special case a few layers up in the mode set code, akin to how we already detect simple framebuffer changes (and only update the required registers with ->mode_set_base). Until this is all in place, make our lives easier and just rip it out. Also note that this seems to fix actual bugs with enabling the lvds output, see: http://lists.freedesktop.org/archives/intel-gfx/2012-July/018614.html Acked-by: Chris Wilson Cc: Takashi Iwai Cc: Giacomo Comes Tested-by: Takashi Iwai Signed-Off-by: Daniel Vetter Cc: Haitao Zhang Signed-off-by: Greg Kroah-Hartman commit d77d52563beaa75183580949cdce4330a2c6c84d Author: yonghua zheng Date: Tue Aug 13 16:01:03 2013 -0700 fs/proc/task_mmu.c: fix buffer overflow in add_page_map() commit 8c8296223f3abb142be8fc31711b18a704c0e7d8 upstream. Recently we met quite a lot of random kernel panic issues after enabling CONFIG_PROC_PAGE_MONITOR. After debuggind we found this has something to do with following bug in pagemap: In struct pagemapread: struct pagemapread { int pos, len; pagemap_entry_t *buffer; bool v2; }; pos is number of PM_ENTRY_BYTES in buffer, but len is the size of buffer, it is a mistake to compare pos and len in add_page_map() for checking buffer is full or not, and this can lead to buffer overflow and random kernel panic issue. Correct len to be total number of PM_ENTRY_BYTES in buffer. [akpm@linux-foundation.org: document pagemapread.pos and .len units, fix PM_ENTRY_BYTES definition] Signed-off-by: Yonghua Zheng Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2e42d79b7e06a080d55da0b05c823c0ba2abaa0c Author: Stephen Boyd Date: Wed Aug 7 16:18:08 2013 -0700 perf/arm: Fix armpmu_map_hw_event() commit b88a2595b6d8aedbd275c07dfa784657b4f757eb upstream. Fix constraint check in armpmu_map_hw_event(). Reported-and-tested-by: Vince Weaver Signed-off-by: Ingo Molnar Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman