Contents of /trunk/kernel-lts/patches-3.4/0166-3.4.67-all-fixes.patch
Parent Directory | Revision Log
Revision 2321 -
(show annotations)
(download)
Mon Nov 18 12:00:05 2013 UTC (10 years, 10 months ago) by niro
File size: 10889 byte(s)
Mon Nov 18 12:00:05 2013 UTC (10 years, 10 months ago) by niro
File size: 10889 byte(s)
-linux-3.4.67
1 | diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c |
2 | index 45ba99f..71d7d72 100644 |
3 | --- a/arch/parisc/kernel/traps.c |
4 | +++ b/arch/parisc/kernel/traps.c |
5 | @@ -810,14 +810,14 @@ void notrace handle_interruption(int code, struct pt_regs *regs) |
6 | else { |
7 | |
8 | /* |
9 | - * The kernel should never fault on its own address space. |
10 | + * The kernel should never fault on its own address space, |
11 | + * unless pagefault_disable() was called before. |
12 | */ |
13 | |
14 | - if (fault_space == 0) |
15 | + if (fault_space == 0 && !in_atomic()) |
16 | { |
17 | pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); |
18 | parisc_terminate("Kernel Fault", regs, code, fault_address); |
19 | - |
20 | } |
21 | } |
22 | |
23 | diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S |
24 | index 24b23a4..126f38d 100644 |
25 | --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S |
26 | +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S |
27 | @@ -935,7 +935,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206) |
28 | BEGIN_FTR_SECTION |
29 | mfspr r8, SPRN_DSCR |
30 | ld r7, HSTATE_DSCR(r13) |
31 | - std r8, VCPU_DSCR(r7) |
32 | + std r8, VCPU_DSCR(r9) |
33 | mtspr SPRN_DSCR, r7 |
34 | END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206) |
35 | |
36 | diff --git a/drivers/char/random.c b/drivers/char/random.c |
37 | index d98b2a6..817eeb6 100644 |
38 | --- a/drivers/char/random.c |
39 | +++ b/drivers/char/random.c |
40 | @@ -1435,12 +1435,11 @@ ctl_table random_table[] = { |
41 | |
42 | static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned; |
43 | |
44 | -static int __init random_int_secret_init(void) |
45 | +int random_int_secret_init(void) |
46 | { |
47 | get_random_bytes(random_int_secret, sizeof(random_int_secret)); |
48 | return 0; |
49 | } |
50 | -late_initcall(random_int_secret_init); |
51 | |
52 | /* |
53 | * Get a random word for internal kernel use only. Similar to urandom but |
54 | diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c |
55 | index 15d1f08..ad72295 100644 |
56 | --- a/drivers/gpu/drm/radeon/evergreen.c |
57 | +++ b/drivers/gpu/drm/radeon/evergreen.c |
58 | @@ -1912,7 +1912,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev) |
59 | rdev->config.evergreen.sx_max_export_size = 256; |
60 | rdev->config.evergreen.sx_max_export_pos_size = 64; |
61 | rdev->config.evergreen.sx_max_export_smx_size = 192; |
62 | - rdev->config.evergreen.max_hw_contexts = 8; |
63 | + rdev->config.evergreen.max_hw_contexts = 4; |
64 | rdev->config.evergreen.sq_num_cf_insts = 2; |
65 | |
66 | rdev->config.evergreen.sc_prim_fifo_size = 0x40; |
67 | diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c |
68 | index 8df050d..1c53745 100644 |
69 | --- a/drivers/watchdog/ts72xx_wdt.c |
70 | +++ b/drivers/watchdog/ts72xx_wdt.c |
71 | @@ -310,7 +310,8 @@ static long ts72xx_wdt_ioctl(struct file *file, unsigned int cmd, |
72 | |
73 | case WDIOC_GETSTATUS: |
74 | case WDIOC_GETBOOTSTATUS: |
75 | - return put_user(0, p); |
76 | + error = put_user(0, p); |
77 | + break; |
78 | |
79 | case WDIOC_KEEPALIVE: |
80 | ts72xx_wdt_kick(wdt); |
81 | diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c |
82 | index e712a8c..b1aa7fd 100644 |
83 | --- a/fs/ext4/xattr.c |
84 | +++ b/fs/ext4/xattr.c |
85 | @@ -1268,6 +1268,8 @@ retry: |
86 | s_min_extra_isize) { |
87 | tried_min_extra_isize++; |
88 | new_extra_isize = s_min_extra_isize; |
89 | + kfree(is); is = NULL; |
90 | + kfree(bs); bs = NULL; |
91 | goto retry; |
92 | } |
93 | error = -1; |
94 | diff --git a/fs/statfs.c b/fs/statfs.c |
95 | index 43e6b6f..d1812b2 100644 |
96 | --- a/fs/statfs.c |
97 | +++ b/fs/statfs.c |
98 | @@ -87,7 +87,7 @@ int user_statfs(const char __user *pathname, struct kstatfs *st) |
99 | |
100 | int fd_statfs(int fd, struct kstatfs *st) |
101 | { |
102 | - struct file *file = fget(fd); |
103 | + struct file *file = fget_raw(fd); |
104 | int error = -EBADF; |
105 | if (file) { |
106 | error = vfs_statfs(&file->f_path, st); |
107 | diff --git a/include/linux/random.h b/include/linux/random.h |
108 | index ac621ce..7e58ad2 100644 |
109 | --- a/include/linux/random.h |
110 | +++ b/include/linux/random.h |
111 | @@ -56,6 +56,7 @@ extern void add_interrupt_randomness(int irq, int irq_flags); |
112 | extern void get_random_bytes(void *buf, int nbytes); |
113 | extern void get_random_bytes_arch(void *buf, int nbytes); |
114 | void generate_random_uuid(unsigned char uuid_out[16]); |
115 | +extern int random_int_secret_init(void); |
116 | |
117 | #ifndef MODULE |
118 | extern const struct file_operations random_fops, urandom_fops; |
119 | diff --git a/init/main.c b/init/main.c |
120 | index 02c1384..db8e381 100644 |
121 | --- a/init/main.c |
122 | +++ b/init/main.c |
123 | @@ -68,6 +68,7 @@ |
124 | #include <linux/shmem_fs.h> |
125 | #include <linux/slab.h> |
126 | #include <linux/perf_event.h> |
127 | +#include <linux/random.h> |
128 | |
129 | #include <asm/io.h> |
130 | #include <asm/bugs.h> |
131 | @@ -779,6 +780,7 @@ static void __init do_basic_setup(void) |
132 | do_ctors(); |
133 | usermodehelper_enable(); |
134 | do_initcalls(); |
135 | + random_int_secret_init(); |
136 | } |
137 | |
138 | static void __init do_pre_smp_initcalls(void) |
139 | diff --git a/mm/mmap.c b/mm/mmap.c |
140 | index ed884dd..69367e4 100644 |
141 | --- a/mm/mmap.c |
142 | +++ b/mm/mmap.c |
143 | @@ -6,6 +6,7 @@ |
144 | * Address space accounting code <alan@lxorguk.ukuu.org.uk> |
145 | */ |
146 | |
147 | +#include <linux/kernel.h> |
148 | #include <linux/slab.h> |
149 | #include <linux/backing-dev.h> |
150 | #include <linux/mm.h> |
151 | @@ -392,6 +393,34 @@ find_vma_prepare(struct mm_struct *mm, unsigned long addr, |
152 | return vma; |
153 | } |
154 | |
155 | +static unsigned long count_vma_pages_range(struct mm_struct *mm, |
156 | + unsigned long addr, unsigned long end) |
157 | +{ |
158 | + unsigned long nr_pages = 0; |
159 | + struct vm_area_struct *vma; |
160 | + |
161 | + /* Find first overlaping mapping */ |
162 | + vma = find_vma_intersection(mm, addr, end); |
163 | + if (!vma) |
164 | + return 0; |
165 | + |
166 | + nr_pages = (min(end, vma->vm_end) - |
167 | + max(addr, vma->vm_start)) >> PAGE_SHIFT; |
168 | + |
169 | + /* Iterate over the rest of the overlaps */ |
170 | + for (vma = vma->vm_next; vma; vma = vma->vm_next) { |
171 | + unsigned long overlap_len; |
172 | + |
173 | + if (vma->vm_start > end) |
174 | + break; |
175 | + |
176 | + overlap_len = min(end, vma->vm_end) - vma->vm_start; |
177 | + nr_pages += overlap_len >> PAGE_SHIFT; |
178 | + } |
179 | + |
180 | + return nr_pages; |
181 | +} |
182 | + |
183 | void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma, |
184 | struct rb_node **rb_link, struct rb_node *rb_parent) |
185 | { |
186 | @@ -1245,6 +1274,23 @@ unsigned long mmap_region(struct file *file, unsigned long addr, |
187 | unsigned long charged = 0; |
188 | struct inode *inode = file ? file->f_path.dentry->d_inode : NULL; |
189 | |
190 | + /* Check against address space limit. */ |
191 | + if (!may_expand_vm(mm, len >> PAGE_SHIFT)) { |
192 | + unsigned long nr_pages; |
193 | + |
194 | + /* |
195 | + * MAP_FIXED may remove pages of mappings that intersects with |
196 | + * requested mapping. Account for the pages it would unmap. |
197 | + */ |
198 | + if (!(vm_flags & MAP_FIXED)) |
199 | + return -ENOMEM; |
200 | + |
201 | + nr_pages = count_vma_pages_range(mm, addr, addr + len); |
202 | + |
203 | + if (!may_expand_vm(mm, (len >> PAGE_SHIFT) - nr_pages)) |
204 | + return -ENOMEM; |
205 | + } |
206 | + |
207 | /* Clear old maps */ |
208 | error = -ENOMEM; |
209 | munmap_back: |
210 | @@ -1255,10 +1301,6 @@ munmap_back: |
211 | goto munmap_back; |
212 | } |
213 | |
214 | - /* Check against address space limit. */ |
215 | - if (!may_expand_vm(mm, len >> PAGE_SHIFT)) |
216 | - return -ENOMEM; |
217 | - |
218 | /* |
219 | * Set 'VM_NORESERVE' if we should not account for the |
220 | * memory use of this mapping. |
221 | @@ -1833,9 +1875,28 @@ int expand_downwards(struct vm_area_struct *vma, |
222 | return error; |
223 | } |
224 | |
225 | +/* |
226 | + * Note how expand_stack() refuses to expand the stack all the way to |
227 | + * abut the next virtual mapping, *unless* that mapping itself is also |
228 | + * a stack mapping. We want to leave room for a guard page, after all |
229 | + * (the guard page itself is not added here, that is done by the |
230 | + * actual page faulting logic) |
231 | + * |
232 | + * This matches the behavior of the guard page logic (see mm/memory.c: |
233 | + * check_stack_guard_page()), which only allows the guard page to be |
234 | + * removed under these circumstances. |
235 | + */ |
236 | #ifdef CONFIG_STACK_GROWSUP |
237 | int expand_stack(struct vm_area_struct *vma, unsigned long address) |
238 | { |
239 | + struct vm_area_struct *next; |
240 | + |
241 | + address &= PAGE_MASK; |
242 | + next = vma->vm_next; |
243 | + if (next && next->vm_start == address + PAGE_SIZE) { |
244 | + if (!(next->vm_flags & VM_GROWSUP)) |
245 | + return -ENOMEM; |
246 | + } |
247 | return expand_upwards(vma, address); |
248 | } |
249 | |
250 | @@ -1858,6 +1919,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) |
251 | #else |
252 | int expand_stack(struct vm_area_struct *vma, unsigned long address) |
253 | { |
254 | + struct vm_area_struct *prev; |
255 | + |
256 | + address &= PAGE_MASK; |
257 | + prev = vma->vm_prev; |
258 | + if (prev && prev->vm_end == address) { |
259 | + if (!(prev->vm_flags & VM_GROWSDOWN)) |
260 | + return -ENOMEM; |
261 | + } |
262 | return expand_downwards(vma, address); |
263 | } |
264 | |
265 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
266 | index 353b32a..33abb78 100644 |
267 | --- a/sound/pci/hda/patch_realtek.c |
268 | +++ b/sound/pci/hda/patch_realtek.c |
269 | @@ -6832,6 +6832,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { |
270 | SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE), |
271 | SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE), |
272 | SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), |
273 | + SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4), |
274 | SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT), |
275 | SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2), |
276 | SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD), |
277 | diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c |
278 | index 520ef96..711299c 100644 |
279 | --- a/sound/usb/usx2y/usbusx2yaudio.c |
280 | +++ b/sound/usb/usx2y/usbusx2yaudio.c |
281 | @@ -295,19 +295,6 @@ static void usX2Y_error_urb_status(struct usX2Ydev *usX2Y, |
282 | usX2Y_clients_stop(usX2Y); |
283 | } |
284 | |
285 | -static void usX2Y_error_sequence(struct usX2Ydev *usX2Y, |
286 | - struct snd_usX2Y_substream *subs, struct urb *urb) |
287 | -{ |
288 | - snd_printk(KERN_ERR |
289 | -"Sequence Error!(hcd_frame=%i ep=%i%s;wait=%i,frame=%i).\n" |
290 | -"Most probably some urb of usb-frame %i is still missing.\n" |
291 | -"Cause could be too long delays in usb-hcd interrupt handling.\n", |
292 | - usb_get_current_frame_number(usX2Y->dev), |
293 | - subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out", |
294 | - usX2Y->wait_iso_frame, urb->start_frame, usX2Y->wait_iso_frame); |
295 | - usX2Y_clients_stop(usX2Y); |
296 | -} |
297 | - |
298 | static void i_usX2Y_urb_complete(struct urb *urb) |
299 | { |
300 | struct snd_usX2Y_substream *subs = urb->context; |
301 | @@ -324,12 +311,9 @@ static void i_usX2Y_urb_complete(struct urb *urb) |
302 | usX2Y_error_urb_status(usX2Y, subs, urb); |
303 | return; |
304 | } |
305 | - if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF))) |
306 | - subs->completed_urb = urb; |
307 | - else { |
308 | - usX2Y_error_sequence(usX2Y, subs, urb); |
309 | - return; |
310 | - } |
311 | + |
312 | + subs->completed_urb = urb; |
313 | + |
314 | { |
315 | struct snd_usX2Y_substream *capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE], |
316 | *playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK]; |
317 | diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c |
318 | index 8e40b6e..1da1eca 100644 |
319 | --- a/sound/usb/usx2y/usx2yhwdeppcm.c |
320 | +++ b/sound/usb/usx2y/usx2yhwdeppcm.c |
321 | @@ -244,13 +244,8 @@ static void i_usX2Y_usbpcm_urb_complete(struct urb *urb) |
322 | usX2Y_error_urb_status(usX2Y, subs, urb); |
323 | return; |
324 | } |
325 | - if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF))) |
326 | - subs->completed_urb = urb; |
327 | - else { |
328 | - usX2Y_error_sequence(usX2Y, subs, urb); |
329 | - return; |
330 | - } |
331 | |
332 | + subs->completed_urb = urb; |
333 | capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE]; |
334 | capsubs2 = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE + 2]; |
335 | playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK]; |