From 7df8fc578b63662ec03ad3e69ecc6f04f7d77fb8 Mon Sep 17 00:00:00 2001 From: Koen Kooi Date: Mon, 26 Mar 2012 08:52:27 -0500 Subject: linux-ti33x-psp 3.2: update to 3.2.13 Signed-off-by: Koen Kooi Signed-off-by: Denys Dmytriyenko --- conf/machine/include/ti33x.inc | 2 +- ...neo1973-fix-neo1973-wm8753-initialization.patch | 42 +++ ...altek-Apply-the-coef-setup-only-to-ALC269.patch | 56 ++++ .../0003-aio-fix-io_setup-io_destroy-race.patch | 54 ++++ .../0004-aio-fix-the-too-late-munmap-race.patch | 81 ++++++ .../0005-x86-Derandom-delay_tsc-for-64-bit.patch | 63 +++++ ...pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch | 38 +++ ...ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch | 40 +++ .../3.2.12/0008-rt2x00-fix-random-stalls.patch | 99 +++++++ ...x-local-vs-remote-memory-events-for-NHM-W.patch | 222 ++++++++++++++++ ...-Do-not-kmalloc-under-the-flocks-spinlock.patch | 140 ++++++++++ .../0011-vfs-fix-return-value-from-do_last.patch | 34 +++ ...12-vfs-fix-double-put-after-complete_walk.patch | 35 +++ ...cer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch | 77 ++++++ .../0014-atl1c-dont-use-highprio-tx-queue.patch | 51 ++++ ...neighbour-Fixed-race-condition-at-tbl-nht.patch | 48 ++++ ...ec-be-careful-of-non-existing-mac-headers.patch | 144 +++++++++++ ...ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch | 90 +++++++ ...ignment-of-ip_summed-for-pre-allocated-sk.patch | 56 ++++ ...alse-reordering-signal-in-tcp_shifted_skb.patch | 72 ++++++ .../0020-vmxnet3-Fix-transport-header-size.patch | 58 +++++ .../0021-packetengines-fix-config-default.patch | 33 +++ ...-corrupted-IP-fragments-fix-for-large-mtu.patch | 49 ++++ ...ragment-SACKed-skbs-in-tcp_mark_head_lost.patch | 55 ++++ ...-check-return-value-of-ipv6_dev_get_saddr.patch | 39 +++ ..._shift_skb_data-to-not-shift-SACKed-data-.patch | 89 +++++++ ...t-join-all-router-mcast-group-when-forwar.patch | 36 +++ .../0027-usb-asix-Patch-for-Sitecom-LN-031.patch | 36 +++ ...ix-setting-selector-in-tps6524x-set_volta.patch | 33 +++ ...ULL-pointer-dereference-in-sd_revalidate_.patch | 170 +++++++++++++ ...fix-pointer-math-issue-getting-fw-version.patch | 34 +++ ...-__blkdev_get-and-add_disk-race-condition.patch | 163 ++++++++++++ ...-freezable-workqueue-for-disk-event-polli.patch | 129 ++++++++++ ...sparc32-Add-Av8-to-assembler-command-line.patch | 40 +++ ...7ehf-Fix-writing-into-fan_stop_time-for-N.patch | 35 +++ ...3627ehf-Fix-memory-leak-in-probe-function.patch | 53 ++++ ...-w83627ehf-Fix-temp2-source-for-W83627UHG.patch | 69 +++++ ...721-fix-bug-in-register-offset-definition.patch | 103 ++++++++ ...t-Fix-spurious-SCL-timeouts-under-heavy-l.patch | 46 ++++ ...t-Fix-reservation-conflict-EBUSY-response.patch | 51 ++++ ...compatible-reservation-handling-CRH-1-wit.patch | 152 +++++++++++ ...0-Enable-interval-between-chip-accesses-f.patch | 72 ++++++ .../3.2.12/0042-Linux-3.2.12.patch | 24 ++ ...NULL-pointer-dereference-in-nilfs_load_su.patch | 62 +++++ .../0002-afs-Read-of-file-returns-EBADMSG.patch | 56 ++++ ...-Remote-abort-can-cause-BUG-in-rxrpc-code.patch | 68 +++++ ...Incorrect-use-of-snprintf-results-in-SEGV.patch | 66 +++++ ...perf-tools-Use-scnprintf-where-applicable.patch | 283 +++++++++++++++++++++ .../3.2.13/0006-tcp-fix-syncookie-regression.patch | 111 ++++++++ ...Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch | 36 +++ ...-possible-il-txq-NULL-pointer-dereference.patch | 63 +++++ ...c-Fix-SMP-kernels-on-pre-core99-UP-machin.patch | 36 +++ .../3.2.13/0010-Linux-3.2.13.patch | 24 ++ recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh | 2 +- recipes-kernel/linux/linux-ti33x-psp_3.2.bb | 52 ++++ 55 files changed, 3870 insertions(+), 2 deletions(-) create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch create mode 100644 recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch diff --git a/conf/machine/include/ti33x.inc b/conf/machine/include/ti33x.inc index b8a5c880..39cc130a 100644 --- a/conf/machine/include/ti33x.inc +++ b/conf/machine/include/ti33x.inc @@ -4,7 +4,7 @@ require conf/machine/include/soc-family.inc require conf/machine/include/tune-cortexa8.inc PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp" # Increase this everytime you change something in the kernel -MACHINE_KERNEL_PR = "r6" +MACHINE_KERNEL_PR = "r7" KERNEL_IMAGETYPE = "uImage" diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch new file mode 100644 index 00000000..d25417a3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch @@ -0,0 +1,42 @@ +From a1d89c5f542755e8508b072a1d2f9b295c6c028c Mon Sep 17 00:00:00 2001 +From: Denis 'GNUtoo' Carikli +Date: Sun, 26 Feb 2012 19:21:54 +0100 +Subject: [PATCH 01/42] ASoC: neo1973: fix neo1973 wm8753 initialization + +commit b2ccf065f7b23147ed135a41b01d05a332ca6b7e upstream. + +The neo1973 driver had wrong codec name which prevented the "sound card" +from appearing. + +Signed-off-by: Denis 'GNUtoo' Carikli +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/samsung/neo1973_wm8753.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c +index 7207189..2fba3f7 100644 +--- a/sound/soc/samsung/neo1973_wm8753.c ++++ b/sound/soc/samsung/neo1973_wm8753.c +@@ -421,7 +421,7 @@ static struct snd_soc_dai_link neo1973_dai[] = { + .platform_name = "samsung-audio", + .cpu_dai_name = "s3c24xx-iis", + .codec_dai_name = "wm8753-hifi", +- .codec_name = "wm8753-codec.0-001a", ++ .codec_name = "wm8753.0-001a", + .init = neo1973_wm8753_init, + .ops = &neo1973_hifi_ops, + }, +@@ -430,7 +430,7 @@ static struct snd_soc_dai_link neo1973_dai[] = { + .stream_name = "Voice", + .cpu_dai_name = "dfbmcs320-pcm", + .codec_dai_name = "wm8753-voice", +- .codec_name = "wm8753-codec.0-001a", ++ .codec_name = "wm8753.0-001a", + .ops = &neo1973_voice_ops, + }, + }; +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch new file mode 100644 index 00000000..b11376b7 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch @@ -0,0 +1,56 @@ +From 87e095818ba51e16500206f1507590d8cd3127ef Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Wed, 7 Mar 2012 08:25:20 +0100 +Subject: [PATCH 02/42] ALSA: hda/realtek - Apply the coef-setup only to + ALC269VB + +commit 526af6eb4dc71302f59806e2ccac7793963a7fe0 upstream. + +The coef setup in alc269_fill_coef() was designed only for ALC269VB +model, and this has some bad effects for other ALC269 variants, such +as turning off the external mic input. Apply it only to ALC269VB. + +Signed-off-by: Kailang Yang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3d8fbf4..dc8a6fc 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2063,12 +2063,16 @@ static int alc_build_controls(struct hda_codec *codec) + */ + + static void alc_init_special_input_src(struct hda_codec *codec); ++static int alc269_fill_coef(struct hda_codec *codec); + + static int alc_init(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; + unsigned int i; + ++ if (codec->vendor_id == 0x10ec0269) ++ alc269_fill_coef(codec); ++ + alc_fix_pll(codec); + alc_auto_init_amp(codec, spec->init_amp); + +@@ -5110,8 +5114,12 @@ static const struct alc_model_fixup alc269_fixup_models[] = { + + static int alc269_fill_coef(struct hda_codec *codec) + { ++ struct alc_spec *spec = codec->spec; + int val; + ++ if (spec->codec_variant != ALC269_TYPE_ALC269VB) ++ return 0; ++ + if ((alc_get_coef0(codec) & 0x00ff) < 0x015) { + alc_write_coef_idx(codec, 0xf, 0x960b); + alc_write_coef_idx(codec, 0xe, 0x8817); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch new file mode 100644 index 00000000..a01113a3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch @@ -0,0 +1,54 @@ +From e5459681303b77f0525bb3311ce20b05e570ae04 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Wed, 7 Mar 2012 05:16:35 +0000 +Subject: [PATCH 03/42] aio: fix io_setup/io_destroy race + +commit 86b62a2cb4fc09037bbce2959d2992962396fd7f upstream. + +Have ioctx_alloc() return an extra reference, so that caller would drop it +on success and not bother with re-grabbing it on failure exit. The current +code is obviously broken - io_destroy() from another thread that managed +to guess the address io_setup() would've returned would free ioctx right +under us; gets especially interesting if aio_context_t * we pass to +io_setup() points to PROT_READ mapping, so put_user() fails and we end +up doing io_destroy() on kioctx another thread has just got freed... + +Signed-off-by: Al Viro +Acked-by: Benjamin LaHaise +Reviewed-by: Jeff Moyer +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/aio.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/aio.c b/fs/aio.c +index 67e4b90..f6578cb 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -273,7 +273,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) + mm = ctx->mm = current->mm; + atomic_inc(&mm->mm_count); + +- atomic_set(&ctx->users, 1); ++ atomic_set(&ctx->users, 2); + spin_lock_init(&ctx->ctx_lock); + spin_lock_init(&ctx->ring_info.ring_lock); + init_waitqueue_head(&ctx->wait); +@@ -1338,10 +1338,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp) + ret = PTR_ERR(ioctx); + if (!IS_ERR(ioctx)) { + ret = put_user(ioctx->user_id, ctxp); +- if (!ret) ++ if (!ret) { ++ put_ioctx(ioctx); + return 0; +- +- get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */ ++ } + io_destroy(ioctx); + } + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch new file mode 100644 index 00000000..00ba981a --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0004-aio-fix-the-too-late-munmap-race.patch @@ -0,0 +1,81 @@ +From a0e1937b89ad227fad39dd1f0edb83d57dc46c12 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Thu, 8 Mar 2012 17:51:19 +0000 +Subject: [PATCH 04/42] aio: fix the "too late munmap()" race + +commit c7b285550544c22bc005ec20978472c9ac7138c6 upstream. + +Current code has put_ioctx() called asynchronously from aio_fput_routine(); +that's done *after* we have killed the request that used to pin ioctx, +so there's nothing to stop io_destroy() waiting in wait_for_all_aios() +from progressing. As the result, we can end up with async call of +put_ioctx() being the last one and possibly happening during exit_mmap() +or elf_core_dump(), neither of which expects stray munmap() being done +to them... + +We do need to prevent _freeing_ ioctx until aio_fput_routine() is done +with that, but that's all we care about - neither io_destroy() nor +exit_aio() will progress past wait_for_all_aios() until aio_fput_routine() +does really_put_req(), so the ioctx teardown won't be done until then +and we don't care about the contents of ioctx past that point. + +Since actual freeing of these suckers is RCU-delayed, we don't need to +bump ioctx refcount when request goes into list for async removal. +All we need is rcu_read_lock held just over the ->ctx_lock-protected +area in aio_fput_routine(). + +Signed-off-by: Al Viro +Reviewed-by: Jeff Moyer +Acked-by: Benjamin LaHaise +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/aio.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/fs/aio.c b/fs/aio.c +index f6578cb..b9d64d8 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx) + call_rcu(&ctx->rcu_head, ctx_rcu_free); + } + +-static inline void get_ioctx(struct kioctx *kioctx) +-{ +- BUG_ON(atomic_read(&kioctx->users) <= 0); +- atomic_inc(&kioctx->users); +-} +- + static inline int try_get_ioctx(struct kioctx *kioctx) + { + return atomic_inc_not_zero(&kioctx->users); +@@ -609,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data) + fput(req->ki_filp); + + /* Link the iocb into the context's free list */ ++ rcu_read_lock(); + spin_lock_irq(&ctx->ctx_lock); + really_put_req(ctx, req); ++ /* ++ * at that point ctx might've been killed, but actual ++ * freeing is RCU'd ++ */ + spin_unlock_irq(&ctx->ctx_lock); ++ rcu_read_unlock(); + +- put_ioctx(ctx); + spin_lock_irq(&fput_lock); + } + spin_unlock_irq(&fput_lock); +@@ -644,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req) + * this function will be executed w/out any aio kthread wakeup. + */ + if (unlikely(!fput_atomic(req->ki_filp))) { +- get_ioctx(ctx); + spin_lock(&fput_lock); + list_add(&req->ki_list, &fput_head); + spin_unlock(&fput_lock); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch new file mode 100644 index 00000000..29ebbbad --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch @@ -0,0 +1,63 @@ +From fc10b28e82caa4d0a793b9ec9657dedbd1c2afd8 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 9 Mar 2012 20:55:10 +0100 +Subject: [PATCH 05/42] x86: Derandom delay_tsc for 64 bit + +commit a7f4255f906f60f72e00aad2fb000939449ff32e upstream. + +Commit f0fbf0abc093 ("x86: integrate delay functions") converted +delay_tsc() into a random delay generator for 64 bit. The reason is +that it merged the mostly identical versions of delay_32.c and +delay_64.c. Though the subtle difference of the result was: + + static void delay_tsc(unsigned long loops) + { +- unsigned bclock, now; ++ unsigned long bclock, now; + +Now the function uses rdtscl() which returns the lower 32bit of the +TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64 +bit this fails when the lower 32bit are close to wrap around when +bclock is read, because the following check + + if ((now - bclock) >= loops) + break; + +evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0 +because the unsigned long (now - bclock) of these values results in +0xffffffff00000001 which is definitely larger than the loops +value. That explains Tvortkos observation: + +"Because I am seeing udelay(500) (_occasionally_) being short, and + that by delaying for some duration between 0us (yep) and 491us." + +Make those variables explicitely u32 again, so this works for both 32 +and 64 bit. + +Reported-by: Tvrtko Ursulin +Signed-off-by: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/lib/delay.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c +index fc45ba8..e395693 100644 +--- a/arch/x86/lib/delay.c ++++ b/arch/x86/lib/delay.c +@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops) + } + + /* TSC based delay: */ +-static void delay_tsc(unsigned long loops) ++static void delay_tsc(unsigned long __loops) + { +- unsigned long bclock, now; ++ u32 bclock, now, loops = __loops; + int cpu; + + preempt_disable(); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch new file mode 100644 index 00000000..6129b69c --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch @@ -0,0 +1,38 @@ +From 7d3540104ba156ddc2a80f5c9608958faad01cec Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Tue, 6 Mar 2012 13:41:49 -0500 +Subject: [PATCH 06/42] PCI: ignore pre-1.1 ASPM quirking when ASPM is + disabled + +commit 4949be16822e92a18ea0cc1616319926628092ee upstream. + +Right now we won't touch ASPM state if ASPM is disabled, except in the case +where we find a device that appears to be too old to reliably support ASPM. +Right now we'll clear it in that case, which is almost certainly the wrong +thing to do. The easiest way around this is just to disable the blacklisting +when ASPM is disabled. + +Signed-off-by: Matthew Garrett +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pcie/aspm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 1cfbf22..24f049e 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -500,6 +500,9 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev) + int pos; + u32 reg32; + ++ if (aspm_disabled) ++ return 0; ++ + /* + * Some functions in a slot might not all be PCIe functions, + * very strange. Disable ASPM for the whole slot +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch new file mode 100644 index 00000000..a5c82fdb --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch @@ -0,0 +1,40 @@ +From 53af81856eb79f36e3c497dd12c3875c3c340411 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Fri, 11 Nov 2011 11:22:20 -0300 +Subject: [PATCH 07/42] omap3isp: ccdc: Fix crash in HS/VS interrupt handler + +commit bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538 upstream. + +The HS/VS interrupt handler needs to access the pipeline object. It +erronously tries to get it from the CCDC output video node, which isn't +necessarily included in the pipeline. This leads to a NULL pointer +dereference. + +Fix the bug by getting the pipeline object from the CCDC subdev entity. + +Reported-by: Gary Thomas +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/video/omap3isp/ispccdc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c +index 54a4a3f..a319281 100644 +--- a/drivers/media/video/omap3isp/ispccdc.c ++++ b/drivers/media/video/omap3isp/ispccdc.c +@@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event) + + static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc) + { +- struct isp_pipeline *pipe = +- to_isp_pipeline(&ccdc->video_out.video.entity); ++ struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity); + struct video_device *vdev = ccdc->subdev.devnode; + struct v4l2_event event; + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch new file mode 100644 index 00000000..17845262 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0008-rt2x00-fix-random-stalls.patch @@ -0,0 +1,99 @@ +From c27583afc5c12c3731697b41e6a7c4fa2a239fae Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Fri, 9 Mar 2012 12:39:54 +0100 +Subject: [PATCH 08/42] rt2x00: fix random stalls + +commit 3780d038fdf4b5ef26ead10b0604ab1f46dd9510 upstream. + +Is possible that we stop queue and then do not wake up it again, +especially when packets are transmitted fast. That can be easily +reproduced with modified tx queue entry_num to some small value e.g. 16. + +If mac80211 already hold local->queue_stop_reason_lock, then we can wait +on that lock in both rt2x00queue_pause_queue() and +rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock +is possible that __ieee80211_wake_queue() will be performed before +__ieee80211_stop_queue(), hence we stop queue and newer wake up it +again. + +Another race condition is possible when between rt2x00queue_threshold() +check and rt2x00queue_pause_queue() we will process all pending tx +buffers on different cpu. This might happen if for example interrupt +will be triggered on cpu performing rt2x00mac_tx(). + +To prevent race conditions serialize pause/unpause by queue->tx_lock. + +Signed-off-by: Stanislaw Gruszka +Acked-by: Gertjan van Wingerde +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rt2x00/rt2x00dev.c | 6 +++++- + drivers/net/wireless/rt2x00/rt2x00mac.c | 9 +++++++++ + drivers/net/wireless/rt2x00/rt2x00queue.c | 3 +++ + 3 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c +index edd317f..21b529b 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry, + /* + * If the data queue was below the threshold before the txdone + * handler we must make sure the packet queue in the mac80211 stack +- * is reenabled when the txdone handler has finished. ++ * is reenabled when the txdone handler has finished. This has to be ++ * serialized with rt2x00mac_tx(), otherwise we can wake up queue ++ * before it was stopped. + */ ++ spin_lock_bh(&entry->queue->tx_lock); + if (!rt2x00queue_threshold(entry->queue)) + rt2x00queue_unpause_queue(entry->queue); ++ spin_unlock_bh(&entry->queue->tx_lock); + } + EXPORT_SYMBOL_GPL(rt2x00lib_txdone); + +diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c +index bf0acff..373dae1 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c +@@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb) + if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false))) + goto exit_fail; + ++ /* ++ * Pausing queue has to be serialized with rt2x00lib_txdone(). Note ++ * we should not use spin_lock_bh variant as bottom halve was already ++ * disabled before ieee80211_xmit() call. ++ */ ++ spin_lock(&queue->tx_lock); + if (rt2x00queue_threshold(queue)) + rt2x00queue_pause_queue(queue); ++ spin_unlock(&queue->tx_lock); + + return; + + exit_fail: ++ spin_lock(&queue->tx_lock); + rt2x00queue_pause_queue(queue); ++ spin_unlock(&queue->tx_lock); + exit_free_skb: + dev_kfree_skb_any(skb); + } +diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c +index 5adfb3e..9b1b2b7 100644 +--- a/drivers/net/wireless/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c +@@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb, + else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags)) + rt2x00queue_align_frame(skb); + ++ /* ++ * That function must be called with bh disabled. ++ */ + spin_lock(&queue->tx_lock); + + if (unlikely(rt2x00queue_full(queue))) { +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch new file mode 100644 index 00000000..d57e5e31 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch @@ -0,0 +1,222 @@ +From 1c301a267126e6e01056eda0164a67731b738f5f Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Mon, 5 Mar 2012 23:59:25 +0100 +Subject: [PATCH 09/42] perf/x86: Fix local vs remote memory events for + NHM/WSM + +commit 87e24f4b67e68d9fd8df16e0bf9c66d1ad2a2533 upstream. + +Verified using the below proglet.. before: + +[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 +remote write + + Performance counter stats for './numa 0': + + 2,101,554 node-stores + 2,096,931 node-store-misses + + 5.021546079 seconds time elapsed + +[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 +local write + + Performance counter stats for './numa 1': + + 501,137 node-stores + 199 node-store-misses + + 5.124451068 seconds time elapsed + +After: + +[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0 +remote write + + Performance counter stats for './numa 0': + + 2,107,516 node-stores + 2,097,187 node-store-misses + + 5.012755149 seconds time elapsed + +[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1 +local write + + Performance counter stats for './numa 1': + + 2,063,355 node-stores + 165 node-store-misses + + 5.082091494 seconds time elapsed + +#define _GNU_SOURCE + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define SIZE (32*1024*1024) + +volatile int done; + +void sig_done(int sig) +{ + done = 1; +} + +int main(int argc, char **argv) +{ + cpu_set_t *mask, *mask2; + size_t size; + int i, err, t; + int nrcpus = 1024; + char *mem; + unsigned long nodemask = 0x01; /* node 0 */ + DIR *node; + struct dirent *de; + int read = 0; + int local = 0; + + if (argc < 2) { + printf("usage: %s [0-3]\n", argv[0]); + printf(" bit0 - local/remote\n"); + printf(" bit1 - read/write\n"); + exit(0); + } + + switch (atoi(argv[1])) { + case 0: + printf("remote write\n"); + break; + case 1: + printf("local write\n"); + local = 1; + break; + case 2: + printf("remote read\n"); + read = 1; + break; + case 3: + printf("local read\n"); + local = 1; + read = 1; + break; + } + + mask = CPU_ALLOC(nrcpus); + size = CPU_ALLOC_SIZE(nrcpus); + CPU_ZERO_S(size, mask); + + node = opendir("/sys/devices/system/node/node0/"); + if (!node) + perror("opendir"); + while ((de = readdir(node))) { + int cpu; + + if (sscanf(de->d_name, "cpu%d", &cpu) == 1) + CPU_SET_S(cpu, size, mask); + } + closedir(node); + + mask2 = CPU_ALLOC(nrcpus); + CPU_ZERO_S(size, mask2); + for (i = 0; i < size; i++) + CPU_SET_S(i, size, mask2); + CPU_XOR_S(size, mask2, mask2, mask); // invert + + if (!local) + mask = mask2; + + err = sched_setaffinity(0, size, mask); + if (err) + perror("sched_setaffinity"); + + mem = mmap(0, SIZE, PROT_READ|PROT_WRITE, + MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); + err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE); + if (err) + perror("mbind"); + + signal(SIGALRM, sig_done); + alarm(5); + + if (!read) { + while (!done) { + for (i = 0; i < SIZE; i++) + mem[i] = 0x01; + } + } else { + while (!done) { + for (i = 0; i < SIZE; i++) + t += *(volatile char *)(mem + i); + } + } + + return 0; +} + +Signed-off-by: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lkml.kernel.org/n/tip-tq73sxus35xmqpojf7ootxgs@git.kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/perf_event_intel.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index 121f1be..957c216 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -389,14 +389,15 @@ static __initconst const u64 westmere_hw_cache_event_ids + #define NHM_LOCAL_DRAM (1 << 14) + #define NHM_NON_DRAM (1 << 15) + +-#define NHM_ALL_DRAM (NHM_REMOTE_DRAM|NHM_LOCAL_DRAM) ++#define NHM_LOCAL (NHM_LOCAL_DRAM|NHM_REMOTE_CACHE_FWD) ++#define NHM_REMOTE (NHM_REMOTE_DRAM) + + #define NHM_DMND_READ (NHM_DMND_DATA_RD) + #define NHM_DMND_WRITE (NHM_DMND_RFO|NHM_DMND_WB) + #define NHM_DMND_PREFETCH (NHM_PF_DATA_RD|NHM_PF_DATA_RFO) + + #define NHM_L3_HIT (NHM_UNCORE_HIT|NHM_OTHER_CORE_HIT_SNP|NHM_OTHER_CORE_HITM) +-#define NHM_L3_MISS (NHM_NON_DRAM|NHM_ALL_DRAM|NHM_REMOTE_CACHE_FWD) ++#define NHM_L3_MISS (NHM_NON_DRAM|NHM_LOCAL_DRAM|NHM_REMOTE_DRAM|NHM_REMOTE_CACHE_FWD) + #define NHM_L3_ACCESS (NHM_L3_HIT|NHM_L3_MISS) + + static __initconst const u64 nehalem_hw_cache_extra_regs +@@ -420,16 +421,16 @@ static __initconst const u64 nehalem_hw_cache_extra_regs + }, + [ C(NODE) ] = { + [ C(OP_READ) ] = { +- [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_ALL_DRAM, +- [ C(RESULT_MISS) ] = NHM_DMND_READ|NHM_REMOTE_DRAM, ++ [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_LOCAL|NHM_REMOTE, ++ [ C(RESULT_MISS) ] = NHM_DMND_READ|NHM_REMOTE, + }, + [ C(OP_WRITE) ] = { +- [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_ALL_DRAM, +- [ C(RESULT_MISS) ] = NHM_DMND_WRITE|NHM_REMOTE_DRAM, ++ [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_LOCAL|NHM_REMOTE, ++ [ C(RESULT_MISS) ] = NHM_DMND_WRITE|NHM_REMOTE, + }, + [ C(OP_PREFETCH) ] = { +- [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_ALL_DRAM, +- [ C(RESULT_MISS) ] = NHM_DMND_PREFETCH|NHM_REMOTE_DRAM, ++ [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_LOCAL|NHM_REMOTE, ++ [ C(RESULT_MISS) ] = NHM_DMND_PREFETCH|NHM_REMOTE, + }, + }, + }; +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch new file mode 100644 index 00000000..150144c3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch @@ -0,0 +1,140 @@ +From 6fc4721b47d58ae599a4bb37869d4bfd41f70511 Mon Sep 17 00:00:00 2001 +From: Pavel Shilovsky +Date: Mon, 5 Mar 2012 09:39:20 +0300 +Subject: [PATCH 10/42] CIFS: Do not kmalloc under the flocks spinlock + +commit d5751469f210d2149cc2159ffff66cbeef6da3f2 upstream. + +Reorganize the code to make the memory already allocated before +spinlock'ed loop. + +Reviewed-by: Jeff Layton +Signed-off-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/file.c | 69 +++++++++++++++++++++++++++++++++++++++++++++----------- + 1 file changed, 56 insertions(+), 13 deletions(-) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 4dd9283..5e64748 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -920,16 +920,26 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) + for (lockp = &inode->i_flock; *lockp != NULL; \ + lockp = &(*lockp)->fl_next) + ++struct lock_to_push { ++ struct list_head llist; ++ __u64 offset; ++ __u64 length; ++ __u32 pid; ++ __u16 netfid; ++ __u8 type; ++}; ++ + static int + cifs_push_posix_locks(struct cifsFileInfo *cfile) + { + struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode); + struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); + struct file_lock *flock, **before; +- struct cifsLockInfo *lck, *tmp; ++ unsigned int count = 0, i = 0; + int rc = 0, xid, type; ++ struct list_head locks_to_send, *el; ++ struct lock_to_push *lck, *tmp; + __u64 length; +- struct list_head locks_to_send; + + xid = GetXid(); + +@@ -940,29 +950,55 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile) + return rc; + } + ++ lock_flocks(); ++ cifs_for_each_lock(cfile->dentry->d_inode, before) { ++ if ((*before)->fl_flags & FL_POSIX) ++ count++; ++ } ++ unlock_flocks(); ++ + INIT_LIST_HEAD(&locks_to_send); + ++ /* ++ * Allocating count locks is enough because no locks can be added to ++ * the list while we are holding cinode->lock_mutex that protects ++ * locking operations of this inode. ++ */ ++ for (; i < count; i++) { ++ lck = kmalloc(sizeof(struct lock_to_push), GFP_KERNEL); ++ if (!lck) { ++ rc = -ENOMEM; ++ goto err_out; ++ } ++ list_add_tail(&lck->llist, &locks_to_send); ++ } ++ ++ i = 0; ++ el = locks_to_send.next; + lock_flocks(); + cifs_for_each_lock(cfile->dentry->d_inode, before) { ++ if (el == &locks_to_send) { ++ /* something is really wrong */ ++ cERROR(1, "Can't push all brlocks!"); ++ break; ++ } + flock = *before; ++ if ((flock->fl_flags & FL_POSIX) == 0) ++ continue; + length = 1 + flock->fl_end - flock->fl_start; + if (flock->fl_type == F_RDLCK || flock->fl_type == F_SHLCK) + type = CIFS_RDLCK; + else + type = CIFS_WRLCK; +- +- lck = cifs_lock_init(flock->fl_start, length, type, +- cfile->netfid); +- if (!lck) { +- rc = -ENOMEM; +- goto send_locks; +- } ++ lck = list_entry(el, struct lock_to_push, llist); + lck->pid = flock->fl_pid; +- +- list_add_tail(&lck->llist, &locks_to_send); ++ lck->netfid = cfile->netfid; ++ lck->length = length; ++ lck->type = type; ++ lck->offset = flock->fl_start; ++ i++; ++ el = el->next; + } +- +-send_locks: + unlock_flocks(); + + list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) { +@@ -979,11 +1015,18 @@ send_locks: + kfree(lck); + } + ++out: + cinode->can_cache_brlcks = false; + mutex_unlock(&cinode->lock_mutex); + + FreeXid(xid); + return rc; ++err_out: ++ list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) { ++ list_del(&lck->llist); ++ kfree(lck); ++ } ++ goto out; + } + + static int +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch new file mode 100644 index 00000000..f95b2aac --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0011-vfs-fix-return-value-from-do_last.patch @@ -0,0 +1,34 @@ +From f52c418abc401baac70461c9b92954f9cf77b5dc Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Tue, 6 Mar 2012 13:56:34 +0100 +Subject: [PATCH 11/42] vfs: fix return value from do_last() + +commit 7f6c7e62fcc123e6bd9206da99a2163fe3facc31 upstream. + +complete_walk() returns either ECHILD or ESTALE. do_last() turns this into +ECHILD unconditionally. If not in RCU mode, this error will reach userspace +which is complete nonsense. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman +--- + fs/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namei.c b/fs/namei.c +index 744e942..b8344d0 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2139,7 +2139,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path, + /* sayonara */ + error = complete_walk(nd); + if (error) +- return ERR_PTR(-ECHILD); ++ return ERR_PTR(error); + + error = -ENOTDIR; + if (nd->flags & LOOKUP_DIRECTORY) { +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch new file mode 100644 index 00000000..7a88ad0c --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch @@ -0,0 +1,35 @@ +From c2f9efa695b37b1f5e70557edfdfd36f8d186d31 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Tue, 6 Mar 2012 13:56:33 +0100 +Subject: [PATCH 12/42] vfs: fix double put after complete_walk() + +commit 097b180ca09b581ef0dc24fbcfc1b227de3875df upstream. + +complete_walk() already puts nd->path, no need to do it again at cleanup time. + +This would result in Oopses if triggered, apparently the codepath is not too +well exercised. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman +--- + fs/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/namei.c b/fs/namei.c +index b8344d0..9680cef 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2238,7 +2238,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path, + /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */ + error = complete_walk(nd); + if (error) +- goto exit; ++ return ERR_PTR(error); + error = -EISDIR; + if (S_ISDIR(nd->inode->i_mode)) + goto exit; +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch new file mode 100644 index 00000000..6cb9d28d --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch @@ -0,0 +1,77 @@ +From 9102b08273c16ddc92444c913e81572989342a8f Mon Sep 17 00:00:00 2001 +From: Ike Panhc +Date: Fri, 3 Feb 2012 16:46:39 +0800 +Subject: [PATCH 13/42] acer-wmi: No wifi rfkill on Lenovo machines + +commit 461e74377cfcfc2c0d6bbdfa8fc5fbc21b052c2a upstream. + +We have several reports which says acer-wmi is loaded on ideapads +and register rfkill for wifi which can not be unblocked. + +Since ideapad-laptop also register rfkill for wifi and it works +reliably, it will be fine acer-wmi is not going to register rfkill +for wifi once VPC2004 is found. + +Also put IBM0068/LEN0068 in the list. Though thinkpad_acpi has no +wifi rfkill capability, there are reports which says acer-wmi also +block wireless on Thinkpad E520/E420. + +Signed-off-by: Ike Panhc +Signed-off-by: Matthew Garrett +Cc: Jonathan Nieder +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/acer-wmi.c | 30 +++++++++++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index b848277..1e5290b 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -679,6 +679,32 @@ static acpi_status AMW0_find_mailled(void) + return AE_OK; + } + ++static int AMW0_set_cap_acpi_check_device_found; ++ ++static acpi_status AMW0_set_cap_acpi_check_device_cb(acpi_handle handle, ++ u32 level, void *context, void **retval) ++{ ++ AMW0_set_cap_acpi_check_device_found = 1; ++ return AE_OK; ++} ++ ++static const struct acpi_device_id norfkill_ids[] = { ++ { "VPC2004", 0}, ++ { "IBM0068", 0}, ++ { "LEN0068", 0}, ++ { "", 0}, ++}; ++ ++static int AMW0_set_cap_acpi_check_device(void) ++{ ++ const struct acpi_device_id *id; ++ ++ for (id = norfkill_ids; id->id[0]; id++) ++ acpi_get_devices(id->id, AMW0_set_cap_acpi_check_device_cb, ++ NULL, NULL); ++ return AMW0_set_cap_acpi_check_device_found; ++} ++ + static acpi_status AMW0_set_capabilities(void) + { + struct wmab_args args; +@@ -692,7 +718,9 @@ static acpi_status AMW0_set_capabilities(void) + * work. + */ + if (wmi_has_guid(AMW0_GUID2)) { +- interface->capability |= ACER_CAP_WIRELESS; ++ if ((quirks != &quirk_unknown) || ++ !AMW0_set_cap_acpi_check_device()) ++ interface->capability |= ACER_CAP_WIRELESS; + return AE_OK; + } + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch new file mode 100644 index 00000000..72577e44 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch @@ -0,0 +1,51 @@ +From 8bdd32d35e2bc723a11b475eb797a9f11e8db598 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 15 Feb 2012 20:43:11 +0000 +Subject: [PATCH 14/42] atl1c: dont use highprio tx queue + +[ Upstream commit 11aad99af6ef629ff3b05d1c9f0936589b204316 ] + +This driver attempts to use two TX rings but lacks proper support : + +1) IRQ handler only takes care of TX completion on first TX ring +2) the stop/start logic uses the legacy functions (for non multiqueue +drivers) + +This means all packets witk skb mark set to 1 are sent through high +queue but are never cleaned and queue eventualy fills and block the +device, triggering the infamous "NETDEV WATCHDOG" message. + +Lets use a single TX ring to fix the problem, this driver is not a real +multiqueue one yet. + +Minimal fix for stable kernels. + +Reported-by: Thomas Meyer +Tested-by: Thomas Meyer +Signed-off-by: Eric Dumazet +Cc: Jay Cliburn +Cc: Chris Snook +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +index 02c7ed8..eccdcff 100644 +--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +@@ -2241,10 +2241,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb, + dev_info(&adapter->pdev->dev, "tx locked\n"); + return NETDEV_TX_LOCKED; + } +- if (skb->mark == 0x01) +- type = atl1c_trans_high; +- else +- type = atl1c_trans_normal; + + if (atl1c_tpd_avail(adapter, type) < tpd_req) { + /* no enough descriptor, just stop queue */ +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch new file mode 100644 index 00000000..35bd0721 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch @@ -0,0 +1,48 @@ +From 3ba7a3f4339ce0147ffa46086eead88cb45c9b0d Mon Sep 17 00:00:00 2001 +From: Michel Machado +Date: Tue, 21 Feb 2012 11:04:13 +0000 +Subject: [PATCH 15/42] neighbour: Fixed race condition at tbl->nht + +[ Upstream commit 84338a6c9dbb6ff3de4749864020f8f25d86fc81 ] + +When the fixed race condition happens: + +1. While function neigh_periodic_work scans the neighbor hash table +pointed by field tbl->nht, it unlocks and locks tbl->lock between +buckets in order to call cond_resched. + +2. Assume that function neigh_periodic_work calls cond_resched, that is, +the lock tbl->lock is available, and function neigh_hash_grow runs. + +3. Once function neigh_hash_grow finishes, and RCU calls +neigh_hash_free_rcu, the original struct neigh_hash_table that function +neigh_periodic_work was using doesn't exist anymore. + +4. Once back at neigh_periodic_work, whenever the old struct +neigh_hash_table is accessed, things can go badly. + +Signed-off-by: Michel Machado +CC: "David S. Miller" +CC: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/neighbour.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 5ac07d3..7aafaed 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -802,6 +802,8 @@ next_elt: + write_unlock_bh(&tbl->lock); + cond_resched(); + write_lock_bh(&tbl->lock); ++ nht = rcu_dereference_protected(tbl->nht, ++ lockdep_is_held(&tbl->lock)); + } + /* Cycle through all hash buckets every base_reachable_time/2 ticks. + * ARP entry timeouts range from 1/2 base_reachable_time to 3/2 +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch new file mode 100644 index 00000000..706cdd61 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch @@ -0,0 +1,144 @@ +From b38838f790c928ebeb30dbd6a06d4a26e84d54dc Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 23 Feb 2012 10:55:02 +0000 +Subject: [PATCH 16/42] ipsec: be careful of non existing mac headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 03606895cd98c0a628b17324fd7b5ff15db7e3cd ] + +Niccolo Belli reported ipsec crashes in case we handle a frame without +mac header (atm in his case) + +Before copying mac header, better make sure it is present. + +Bugzilla reference: https://bugzilla.kernel.org/show_bug.cgi?id=42809 + +Reported-by: Niccolò Belli +Tested-by: Niccolò Belli +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 10 ++++++++++ + net/ipv4/xfrm4_mode_beet.c | 5 +---- + net/ipv4/xfrm4_mode_tunnel.c | 6 ++---- + net/ipv6/xfrm6_mode_beet.c | 6 +----- + net/ipv6/xfrm6_mode_tunnel.c | 6 ++---- + 5 files changed, 16 insertions(+), 17 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index fe86488..6cf8b53 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1453,6 +1453,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset) + } + #endif /* NET_SKBUFF_DATA_USES_OFFSET */ + ++static inline void skb_mac_header_rebuild(struct sk_buff *skb) ++{ ++ if (skb_mac_header_was_set(skb)) { ++ const unsigned char *old_mac = skb_mac_header(skb); ++ ++ skb_set_mac_header(skb, -skb->mac_len); ++ memmove(skb_mac_header(skb), old_mac, skb->mac_len); ++ } ++} ++ + static inline int skb_checksum_start_offset(const struct sk_buff *skb) + { + return skb->csum_start - skb_headroom(skb); +diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c +index 6341818..e3db3f9 100644 +--- a/net/ipv4/xfrm4_mode_beet.c ++++ b/net/ipv4/xfrm4_mode_beet.c +@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb) + + skb_push(skb, sizeof(*iph)); + skb_reset_network_header(skb); +- +- memmove(skb->data - skb->mac_len, skb_mac_header(skb), +- skb->mac_len); +- skb_set_mac_header(skb, -skb->mac_len); ++ skb_mac_header_rebuild(skb); + + xfrm4_beet_make_header(skb); + +diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c +index 534972e..ed4bf11 100644 +--- a/net/ipv4/xfrm4_mode_tunnel.c ++++ b/net/ipv4/xfrm4_mode_tunnel.c +@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) + + static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) + { +- const unsigned char *old_mac; + int err = -EINVAL; + + if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP) +@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) + if (!(x->props.flags & XFRM_STATE_NOECN)) + ipip_ecn_decapsulate(skb); + +- old_mac = skb_mac_header(skb); +- skb_set_mac_header(skb, -skb->mac_len); +- memmove(skb_mac_header(skb), old_mac, skb->mac_len); + skb_reset_network_header(skb); ++ skb_mac_header_rebuild(skb); ++ + err = 0; + + out: +diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c +index 3437d7d..f37cba9 100644 +--- a/net/ipv6/xfrm6_mode_beet.c ++++ b/net/ipv6/xfrm6_mode_beet.c +@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb) + static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb) + { + struct ipv6hdr *ip6h; +- const unsigned char *old_mac; + int size = sizeof(struct ipv6hdr); + int err; + +@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb) + + __skb_push(skb, size); + skb_reset_network_header(skb); +- +- old_mac = skb_mac_header(skb); +- skb_set_mac_header(skb, -skb->mac_len); +- memmove(skb_mac_header(skb), old_mac, skb->mac_len); ++ skb_mac_header_rebuild(skb); + + xfrm6_beet_make_header(skb); + +diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c +index 4d6edff..23ecd68 100644 +--- a/net/ipv6/xfrm6_mode_tunnel.c ++++ b/net/ipv6/xfrm6_mode_tunnel.c +@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) + static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) + { + int err = -EINVAL; +- const unsigned char *old_mac; + + if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6) + goto out; +@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) + if (!(x->props.flags & XFRM_STATE_NOECN)) + ipip6_ecn_decapsulate(skb); + +- old_mac = skb_mac_header(skb); +- skb_set_mac_header(skb, -skb->mac_len); +- memmove(skb_mac_header(skb), old_mac, skb->mac_len); + skb_reset_network_header(skb); ++ skb_mac_header_rebuild(skb); ++ + err = 0; + + out: +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch new file mode 100644 index 00000000..fe5fd328 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch @@ -0,0 +1,90 @@ +From 486667d032b8183f75da22b245635debbfa381ca Mon Sep 17 00:00:00 2001 +From: Ben McKeegan +Date: Fri, 24 Feb 2012 06:33:56 +0000 +Subject: [PATCH 17/42] ppp: fix 'ppp_mp_reconstruct bad seq' errors + +[ Upstream commit 8a49ad6e89feb5015e77ce6efeb2678947117e20 ] + +This patch fixes a (mostly cosmetic) bug introduced by the patch +'ppp: Use SKB queue abstraction interfaces in fragment processing' +found here: http://www.spinics.net/lists/netdev/msg153312.html + +The above patch rewrote and moved the code responsible for cleaning +up discarded fragments but the new code does not catch every case +where this is necessary. This results in some discarded fragments +remaining in the queue, and triggering a 'bad seq' error on the +subsequent call to ppp_mp_reconstruct. Fragments are discarded +whenever other fragments of the same frame have been lost. +This can generate a lot of unwanted and misleading log messages. + +This patch also adds additional detail to the debug logging to +make it clearer which fragments were lost and which other fragments +were discarded as a result of losses. (Run pppd with 'kdebug 1' +option to enable debug logging.) + +Signed-off-by: Ben McKeegan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ppp/ppp_generic.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index edfa15d..486b404 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp) + continue; + } + if (PPP_MP_CB(p)->sequence != seq) { ++ u32 oldseq; + /* Fragment `seq' is missing. If it is after + minseq, it might arrive later, so stop here. */ + if (seq_after(seq, minseq)) + break; + /* Fragment `seq' is lost, keep going. */ + lost = 1; ++ oldseq = seq; + seq = seq_before(minseq, PPP_MP_CB(p)->sequence)? + minseq + 1: PPP_MP_CB(p)->sequence; ++ ++ if (ppp->debug & 1) ++ netdev_printk(KERN_DEBUG, ppp->dev, ++ "lost frag %u..%u\n", ++ oldseq, seq-1); ++ + goto again; + } + +@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp) + struct sk_buff *tmp2; + + skb_queue_reverse_walk_from_safe(list, p, tmp2) { ++ if (ppp->debug & 1) ++ netdev_printk(KERN_DEBUG, ppp->dev, ++ "discarding frag %u\n", ++ PPP_MP_CB(p)->sequence); + __skb_unlink(p, list); + kfree_skb(p); + } +@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp) + /* If we have discarded any fragments, + signal a receive error. */ + if (PPP_MP_CB(head)->sequence != ppp->nextseq) { ++ skb_queue_walk_safe(list, p, tmp) { ++ if (p == head) ++ break; ++ if (ppp->debug & 1) ++ netdev_printk(KERN_DEBUG, ppp->dev, ++ "discarding frag %u\n", ++ PPP_MP_CB(p)->sequence); ++ __skb_unlink(p, list); ++ kfree_skb(p); ++ } ++ + if (ppp->debug & 1) + netdev_printk(KERN_DEBUG, ppp->dev, + " missed pkts %u..%u\n", +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch new file mode 100644 index 00000000..ac641a9b --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch @@ -0,0 +1,56 @@ +From 724515edd415300e12da1a3d2e84cadd6a5cd90b Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Fri, 24 Feb 2012 15:12:34 +0000 +Subject: [PATCH 18/42] sfc: Fix assignment of ip_summed for pre-allocated + skbs + +[ Upstream commit ff3bc1e7527504a93710535611b2f812f3bb89bf ] + +When pre-allocating skbs for received packets, we set ip_summed = +CHECKSUM_UNNCESSARY. We used to change it back to CHECKSUM_NONE when +the received packet had an incorrect checksum or unhandled protocol. + +Commit bc8acf2c8c3e43fcc192762a9f964b3e9a17748b ('drivers/net: avoid +some skb->ip_summed initializations') mistakenly replaced the latter +assignment with a DEBUG-only assertion that ip_summed == +CHECKSUM_NONE. This assertion is always false, but it seems no-one +has exercised this code path in a DEBUG build. + +Fix this by moving our assignment of CHECKSUM_UNNECESSARY into +efx_rx_packet_gro(). + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/sfc/rx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c +index 752d521..5ef4cc0 100644 +--- a/drivers/net/ethernet/sfc/rx.c ++++ b/drivers/net/ethernet/sfc/rx.c +@@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue) + if (unlikely(!skb)) + return -ENOMEM; + +- /* Adjust the SKB for padding and checksum */ ++ /* Adjust the SKB for padding */ + skb_reserve(skb, NET_IP_ALIGN); + rx_buf->len = skb_len - NET_IP_ALIGN; + rx_buf->is_page = false; +- skb->ip_summed = CHECKSUM_UNNECESSARY; + + rx_buf->dma_addr = pci_map_single(efx->pci_dev, + skb->data, rx_buf->len, +@@ -499,6 +498,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel, + + EFX_BUG_ON_PARANOID(!checksummed); + rx_buf->u.skb = NULL; ++ skb->ip_summed = CHECKSUM_UNNECESSARY; + + gro_result = napi_gro_receive(napi, skb); + } +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch new file mode 100644 index 00000000..7796b7d3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch @@ -0,0 +1,72 @@ +From 201eee97e7d58fbde884394768761fb24229602a Mon Sep 17 00:00:00 2001 +From: Neal Cardwell +Date: Sun, 26 Feb 2012 10:06:19 +0000 +Subject: [PATCH 19/42] tcp: fix false reordering signal in tcp_shifted_skb + +[ Upstream commit 4c90d3b30334833450ccbb02f452d4972a3c3c3f ] + +When tcp_shifted_skb() shifts bytes from the skb that is currently +pointed to by 'highest_sack' then the increment of +TCP_SKB_CB(skb)->seq implicitly advances tcp_highest_sack_seq(). This +implicit advancement, combined with the recent fix to pass the correct +SACKed range into tcp_sacktag_one(), caused tcp_sacktag_one() to think +that the newly SACKed range was before the tcp_highest_sack_seq(), +leading to a call to tcp_update_reordering() with a degree of +reordering matching the size of the newly SACKed range (typically just +1 packet, which is a NOP, but potentially larger). + +This commit fixes this by simply calling tcp_sacktag_one() before the +TCP_SKB_CB(skb)->seq advancement that can advance our notion of the +highest SACKed sequence. + +Correspondingly, we can simplify the code a little now that +tcp_shifted_skb() should update the lost_cnt_hint in all cases where +skb == tp->lost_skb_hint. + +Signed-off-by: Neal Cardwell +Acked-by: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 53113b9..9e32fca 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1406,8 +1406,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, + + BUG_ON(!pcount); + +- /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */ +- if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint)) ++ /* Adjust counters and hints for the newly sacked sequence ++ * range but discard the return value since prev is already ++ * marked. We must tag the range first because the seq ++ * advancement below implicitly advances ++ * tcp_highest_sack_seq() when skb is highest_sack. ++ */ ++ tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked, ++ start_seq, end_seq, dup_sack, pcount); ++ ++ if (skb == tp->lost_skb_hint) + tp->lost_cnt_hint += pcount; + + TCP_SKB_CB(prev)->end_seq += shifted; +@@ -1433,12 +1441,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, + skb_shinfo(skb)->gso_type = 0; + } + +- /* Adjust counters and hints for the newly sacked sequence range but +- * discard the return value since prev is already marked. +- */ +- tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked, +- start_seq, end_seq, dup_sack, pcount); +- + /* Difference in this won't matter, both ACKed by the same cumul. ACK */ + TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS); + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch new file mode 100644 index 00000000..8bcb9aea --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0020-vmxnet3-Fix-transport-header-size.patch @@ -0,0 +1,58 @@ +From 40cfa9924ed2f94482607fc884f1acb414d492b9 Mon Sep 17 00:00:00 2001 +From: Shreyas Bhatewara +Date: Tue, 28 Feb 2012 22:17:38 +0000 +Subject: [PATCH 20/42] vmxnet3: Fix transport header size + +[ Upstream commit efead8710aad9e384730ecf25eae0287878840d7 ] + +Fix transport header size + +Fix the transpoert header size for UDP packets. + +Signed-off-by: Shreyas N Bhatewara +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 7 +------ + drivers/net/vmxnet3/vmxnet3_int.h | 4 ++-- + 2 files changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index d96bfb1..d426261 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq, + ctx->l4_hdr_size = ((struct tcphdr *) + skb_transport_header(skb))->doff * 4; + else if (iph->protocol == IPPROTO_UDP) +- /* +- * Use tcp header size so that bytes to +- * be copied are more than required by +- * the device. +- */ + ctx->l4_hdr_size = +- sizeof(struct tcphdr); ++ sizeof(struct udphdr); + else + ctx->l4_hdr_size = 0; + } else { +diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h +index b18eac1..8df921b 100644 +--- a/drivers/net/vmxnet3/vmxnet3_int.h ++++ b/drivers/net/vmxnet3/vmxnet3_int.h +@@ -70,10 +70,10 @@ + /* + * Version numbers + */ +-#define VMXNET3_DRIVER_VERSION_STRING "1.1.18.0-k" ++#define VMXNET3_DRIVER_VERSION_STRING "1.1.29.0-k" + + /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */ +-#define VMXNET3_DRIVER_VERSION_NUM 0x01011200 ++#define VMXNET3_DRIVER_VERSION_NUM 0x01011D00 + + #if defined(CONFIG_PCI_MSI) + /* RSS only makes sense if MSI-X is supported. */ +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch new file mode 100644 index 00000000..6cfbc55a --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0021-packetengines-fix-config-default.patch @@ -0,0 +1,33 @@ +From 08a5b2365331981cd769e07182fce70ed50c8b66 Mon Sep 17 00:00:00 2001 +From: stephen hemminger +Date: Fri, 2 Mar 2012 13:38:56 +0000 +Subject: [PATCH 21/42] packetengines: fix config default + +[ Upstream commit 3f2010b2ad3d66d5291497c9b274315e7b807ecd ] + +As part of the big network driver reorg, each vendor directory defaults to +yes, so that older config's can migrate correctly. Looks like this one +got missed. + +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/packetengines/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig +index b97132d..8f29feb 100644 +--- a/drivers/net/ethernet/packetengines/Kconfig ++++ b/drivers/net/ethernet/packetengines/Kconfig +@@ -4,6 +4,7 @@ + + config NET_PACKET_ENGINE + bool "Packet Engine devices" ++ default y + depends on PCI + ---help--- + If you have a network (Ethernet) card belonging to this class, say Y +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch new file mode 100644 index 00000000..497caa41 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch @@ -0,0 +1,49 @@ +From 87f64e870bbad8d4558ae32ea0152c5e986a5264 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?fran=C3=A7ois=20romieu?= +Date: Fri, 2 Mar 2012 04:43:14 +0000 +Subject: [PATCH 22/42] r8169: corrupted IP fragments fix for large mtu. + +[ Upstream commit 9c5028e9da1255dd2b99762d8627b88b29f68cce ] + +Noticed with the 8168d (-vb-gr, aka RTL_GIGA_MAC_VER_26). + +ConfigX registers should only be written while the Config9346 lock +is held. + +Signed-off-by: Francois Romieu +Reported-by: Nick Bowler +Cc: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index c8f47f1..0cf2351 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp) + + static void rtl_hw_jumbo_enable(struct rtl8169_private *tp) + { ++ void __iomem *ioaddr = tp->mmio_addr; ++ ++ RTL_W8(Cfg9346, Cfg9346_Unlock); + rtl_generic_op(tp, tp->jumbo_ops.enable); ++ RTL_W8(Cfg9346, Cfg9346_Lock); + } + + static void rtl_hw_jumbo_disable(struct rtl8169_private *tp) + { ++ void __iomem *ioaddr = tp->mmio_addr; ++ ++ RTL_W8(Cfg9346, Cfg9346_Unlock); + rtl_generic_op(tp, tp->jumbo_ops.disable); ++ RTL_W8(Cfg9346, Cfg9346_Lock); + } + + static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp) +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch new file mode 100644 index 00000000..41a53871 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch @@ -0,0 +1,55 @@ +From c0313fea8fa8ff77714bfdab4eed42ae0785dc37 Mon Sep 17 00:00:00 2001 +From: Neal Cardwell +Date: Fri, 2 Mar 2012 21:36:51 +0000 +Subject: [PATCH 23/42] tcp: don't fragment SACKed skbs in + tcp_mark_head_lost() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit c0638c247f559e1a16ee79e54df14bca2cb679ea ] + +In tcp_mark_head_lost() we should not attempt to fragment a SACKed skb +to mark the first portion as lost. This is for two primary reasons: + +(1) tcp_shifted_skb() coalesces adjacent regions of SACKed skbs. When +doing this, it preserves the sum of their packet counts in order to +reflect the real-world dynamics on the wire. But given that skbs can +have remainders that do not align to MSS boundaries, this packet count +preservation means that for SACKed skbs there is not necessarily a +direct linear relationship between tcp_skb_pcount(skb) and +skb->len. Thus tcp_mark_head_lost()'s previous attempts to fragment +off and mark as lost a prefix of length (packets - oldcnt)*mss from +SACKed skbs were leading to occasional failures of the WARN_ON(len > +skb->len) in tcp_fragment() (which used to be a BUG_ON(); see the +recent "crash in tcp_fragment" thread on netdev). + +(2) there is no real point in fragmenting off part of a SACKed skb and +calling tcp_skb_mark_lost() on it, since tcp_skb_mark_lost() is a NOP +for SACKed skbs. + +Signed-off-by: Neal Cardwell +Acked-by: Ilpo Järvinen +Acked-by: Yuchung Cheng +Acked-by: Nandita Dukkipati +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 9e32fca..1c774af 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2571,6 +2571,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head) + + if (cnt > packets) { + if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) || ++ (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) || + (oldcnt >= packets)) + break; + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch new file mode 100644 index 00000000..7a05ae29 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch @@ -0,0 +1,39 @@ +From 384298df213387fc31905729a5e23e79bc6b8222 Mon Sep 17 00:00:00 2001 +From: Ulrich Weber +Date: Mon, 5 Mar 2012 04:52:44 +0000 +Subject: [PATCH 24/42] bridge: check return value of ipv6_dev_get_saddr() + +[ Upstream commit d1d81d4c3dd886d5fa25a2c4fa1e39cb89613712 ] + +otherwise source IPv6 address of ICMPV6_MGM_QUERY packet +might be random junk if IPv6 is disabled on interface or +link-local address is not yet ready (DAD). + +Signed-off-by: Ulrich Weber +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_multicast.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index a5f4e57..8eb6b15 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br, + ip6h->nexthdr = IPPROTO_HOPOPTS; + ip6h->hop_limit = 1; + ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1)); +- ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, +- &ip6h->saddr); ++ if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0, ++ &ip6h->saddr)) { ++ kfree_skb(skb); ++ return NULL; ++ } + ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); + + hopopt = (u8 *)(ip6h + 1); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch new file mode 100644 index 00000000..07ce46b5 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch @@ -0,0 +1,89 @@ +From c0ebd50aab8d8fa2f98ceb9da54d161f492326e0 Mon Sep 17 00:00:00 2001 +From: Neal Cardwell +Date: Mon, 5 Mar 2012 19:35:04 +0000 +Subject: [PATCH 25/42] tcp: fix tcp_shift_skb_data() to not shift SACKed data + below snd_una + +[ Upstream commit 4648dc97af9d496218a05353b0e442b3dfa6aaab ] + +This commit fixes tcp_shift_skb_data() so that it does not shift +SACKed data below snd_una. + +This fixes an issue whose symptoms exactly match reports showing +tp->sacked_out going negative since 3.3.0-rc4 (see "WARNING: at +net/ipv4/tcp_input.c:3418" thread on netdev). + +Since 2008 (832d11c5cd076abc0aa1eaf7be96c81d1a59ce41) +tcp_shift_skb_data() had been shifting SACKed ranges that were below +snd_una. It checked that the *end* of the skb it was about to shift +from was above snd_una, but did not check that the end of the actual +shifted range was above snd_una; this commit adds that check. + +Shifting SACKed ranges below snd_una is problematic because for such +ranges tcp_sacktag_one() short-circuits: it does not declare anything +as SACKed and does not increase sacked_out. + +Before the fixes in commits cc9a672ee522d4805495b98680f4a3db5d0a0af9 +and daef52bab1fd26e24e8e9578f8fb33ba1d0cb412, shifting SACKed ranges +below snd_una happened to work because tcp_shifted_skb() was always +(incorrectly) passing in to tcp_sacktag_one() an skb whose end_seq +tcp_shift_skb_data() had already guaranteed was beyond snd_una. Hence +tcp_sacktag_one() never short-circuited and always increased +tp->sacked_out in this case. + +After those two fixes, my testing has verified that shifting SACKed +ranges below snd_una could cause tp->sacked_out to go negative with +the following sequence of events: + +(1) tcp_shift_skb_data() sees an skb whose end_seq is beyond snd_una, + then shifts a prefix of that skb that is below snd_una + +(2) tcp_shifted_skb() increments the packet count of the + already-SACKed prev sk_buff + +(3) tcp_sacktag_one() sees the end of the new SACKed range is below + snd_una, so it short-circuits and doesn't increase tp->sacked_out + +(5) tcp_clean_rtx_queue() sees the SACKed skb has been ACKed, + decrements tp->sacked_out by this "inflated" pcount that was + missing a matching increase in tp->sacked_out, and hence + tp->sacked_out underflows to a u32 like 0xFFFFFFFF, which casted + to s32 is negative. + +(6) this leads to the warnings seen in the recent "WARNING: at + net/ipv4/tcp_input.c:3418" thread on the netdev list; e.g.: + tcp_input.c:3418 WARN_ON((int)tp->sacked_out < 0); + +More generally, I think this bug can be tickled in some cases where +two or more ACKs from the receiver are lost and then a DSACK arrives +that is immediately above an existing SACKed skb in the write queue. + +This fix changes tcp_shift_skb_data() to abort this sequence at step +(1) in the scenario above by noticing that the bytes are below snd_una +and not shifting them. + +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 1c774af..e4d1e4a 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1588,6 +1588,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb, + } + } + ++ /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */ ++ if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una)) ++ goto fallback; ++ + if (!skb_shift(prev, skb, len)) + goto fallback; + if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack)) +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch new file mode 100644 index 00000000..048a7e3f --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch @@ -0,0 +1,36 @@ +From 7ddf7a941aeb1bdb57801edb82c68fae8d40ea75 Mon Sep 17 00:00:00 2001 +From: Li Wei +Date: Mon, 5 Mar 2012 14:45:17 +0000 +Subject: [PATCH 26/42] IPv6: Fix not join all-router mcast group when + forwarding set. + +[ Upstream commit d6ddef9e641d1229d4ec841dc75ae703171c3e92 ] + +When forwarding was set and a new net device is register, +we need add this device to the all-router mcast group. + +Signed-off-by: Li Wei +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 836c4ea..a5521c5 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev) + /* Join all-node multicast group */ + ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes); + ++ /* Join all-router multicast group if forwarding is set */ ++ if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST)) ++ ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters); ++ + return ndev; + } + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch new file mode 100644 index 00000000..be2bf826 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch @@ -0,0 +1,36 @@ +From 636b06096f3e95adf81e162fdb74ed388c696be1 Mon Sep 17 00:00:00 2001 +From: Joerg Neikes +Date: Thu, 8 Mar 2012 22:44:03 +0000 +Subject: [PATCH 27/42] usb: asix: Patch for Sitecom LN-031 + +commit 4e50391968849860dff1aacde358b4eb14aa5127 upstream. + +This patch adds support for the Sitecom LN-031 USB adapter with a AX88178 chip. + +Added USB id to find correct driver for AX88178 1000 Ethernet adapter. + +Signed-off-by: Joerg Neikes +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/asix.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c +index f5e063a..fda4be2 100644 +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -1595,6 +1595,10 @@ static const struct usb_device_id products [] = { + USB_DEVICE (0x6189, 0x182d), + .driver_info = (unsigned long) &ax8817x_info, + }, { ++ // Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter" ++ USB_DEVICE (0x0df6, 0x0056), ++ .driver_info = (unsigned long) &ax88178_info, ++}, { + // corega FEther USB2-TX + USB_DEVICE (0x07aa, 0x0017), + .driver_info = (unsigned long) &ax8817x_info, +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch new file mode 100644 index 00000000..32f16eb3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch @@ -0,0 +1,33 @@ +From 62c35c47cb8ddee3510f8da30768d995d62736ba Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Thu, 8 Mar 2012 10:02:17 +0800 +Subject: [PATCH 28/42] regulator: Fix setting selector in tps6524x + set_voltage function + +commit f03570cf1709397ebe656608266b44ec772960c2 upstream. + +Don't assign the voltage to selector. + +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/tps6524x-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/tps6524x-regulator.c b/drivers/regulator/tps6524x-regulator.c +index 9166aa0..229b6f4 100644 +--- a/drivers/regulator/tps6524x-regulator.c ++++ b/drivers/regulator/tps6524x-regulator.c +@@ -481,7 +481,7 @@ static int set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV, + if (i >= info->n_voltages) + i = info->n_voltages - 1; + +- *selector = info->voltages[i]; ++ *selector = i; + + return write_field(hw, &info->voltage, i); + } +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch new file mode 100644 index 00000000..3a4af4b3 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch @@ -0,0 +1,170 @@ +From f90fbbb22b2a145c5a3d66a31a46a32bb54ed722 Mon Sep 17 00:00:00 2001 +From: Jun'ichi Nomura +Date: Fri, 2 Mar 2012 10:38:33 +0100 +Subject: [PATCH 29/42] block: Fix NULL pointer dereference in + sd_revalidate_disk + +commit fe316bf2d5847bc5dd975668671a7b1067603bc7 upstream. + +Since 2.6.39 (1196f8b), when a driver returns -ENOMEDIUM for open(), +__blkdev_get() calls rescan_partitions() to remove +in-kernel partition structures and raise KOBJ_CHANGE uevent. + +However it ends up calling driver's revalidate_disk without open +and could cause oops. + +In the case of SCSI: + + process A process B + ---------------------------------------------- + sys_open + __blkdev_get + sd_open + returns -ENOMEDIUM + scsi_remove_device + + rescan_partitions + sd_revalidate_disk + +Oopses are reported here: +http://marc.info/?l=linux-scsi&m=132388619710052 + +This patch separates the partition invalidation from rescan_partitions() +and use it for -ENOMEDIUM case. + +Reported-by: Huajun Li +Signed-off-by: Jun'ichi Nomura +Acked-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + fs/block_dev.c | 16 ++++++++++++---- + fs/partitions/check.c | 48 ++++++++++++++++++++++++++++++++++++++++-------- + include/linux/genhd.h | 1 + + 3 files changed, 53 insertions(+), 12 deletions(-) + +diff --git a/fs/block_dev.c b/fs/block_dev.c +index b07f1da..abe9b48 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1159,8 +1159,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + * The latter is necessary to prevent ghost + * partitions on a removed medium. + */ +- if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) +- rescan_partitions(disk, bdev); ++ if (bdev->bd_invalidated) { ++ if (!ret) ++ rescan_partitions(disk, bdev); ++ else if (ret == -ENOMEDIUM) ++ invalidate_partitions(disk, bdev); ++ } + if (ret) + goto out_clear; + } else { +@@ -1190,8 +1194,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + if (bdev->bd_disk->fops->open) + ret = bdev->bd_disk->fops->open(bdev, mode); + /* the same as first opener case, read comment there */ +- if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) +- rescan_partitions(bdev->bd_disk, bdev); ++ if (bdev->bd_invalidated) { ++ if (!ret) ++ rescan_partitions(bdev->bd_disk, bdev); ++ else if (ret == -ENOMEDIUM) ++ invalidate_partitions(bdev->bd_disk, bdev); ++ } + if (ret) + goto out_unlock_bdev; + } +diff --git a/fs/partitions/check.c b/fs/partitions/check.c +index e3c63d1..6b5fcc5 100644 +--- a/fs/partitions/check.c ++++ b/fs/partitions/check.c +@@ -539,17 +539,11 @@ static bool disk_unlock_native_capacity(struct gendisk *disk) + } + } + +-int rescan_partitions(struct gendisk *disk, struct block_device *bdev) ++static int drop_partitions(struct gendisk *disk, struct block_device *bdev) + { +- struct parsed_partitions *state = NULL; + struct disk_part_iter piter; + struct hd_struct *part; +- int p, highest, res; +-rescan: +- if (state && !IS_ERR(state)) { +- kfree(state); +- state = NULL; +- } ++ int res; + + if (bdev->bd_part_count) + return -EBUSY; +@@ -562,6 +556,24 @@ rescan: + delete_partition(disk, part->partno); + disk_part_iter_exit(&piter); + ++ return 0; ++} ++ ++int rescan_partitions(struct gendisk *disk, struct block_device *bdev) ++{ ++ struct parsed_partitions *state = NULL; ++ struct hd_struct *part; ++ int p, highest, res; ++rescan: ++ if (state && !IS_ERR(state)) { ++ kfree(state); ++ state = NULL; ++ } ++ ++ res = drop_partitions(disk, bdev); ++ if (res) ++ return res; ++ + if (disk->fops->revalidate_disk) + disk->fops->revalidate_disk(disk); + check_disk_size_change(disk, bdev); +@@ -665,6 +677,26 @@ rescan: + return 0; + } + ++int invalidate_partitions(struct gendisk *disk, struct block_device *bdev) ++{ ++ int res; ++ ++ if (!bdev->bd_invalidated) ++ return 0; ++ ++ res = drop_partitions(disk, bdev); ++ if (res) ++ return res; ++ ++ set_capacity(disk, 0); ++ check_disk_size_change(disk, bdev); ++ bdev->bd_invalidated = 0; ++ /* tell userspace that the media / partition table may have changed */ ++ kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE); ++ ++ return 0; ++} ++ + unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p) + { + struct address_space *mapping = bdev->bd_inode->i_mapping; +diff --git a/include/linux/genhd.h b/include/linux/genhd.h +index 6d18f35..c6f7f6a 100644 +--- a/include/linux/genhd.h ++++ b/include/linux/genhd.h +@@ -596,6 +596,7 @@ extern char *disk_name (struct gendisk *hd, int partno, char *buf); + + extern int disk_expand_part_tbl(struct gendisk *disk, int target); + extern int rescan_partitions(struct gendisk *disk, struct block_device *bdev); ++extern int invalidate_partitions(struct gendisk *disk, struct block_device *bdev); + extern struct hd_struct * __must_check add_partition(struct gendisk *disk, + int partno, sector_t start, + sector_t len, int flags, +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch new file mode 100644 index 00000000..0ed858c0 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch @@ -0,0 +1,34 @@ +From 5a399c9c3325b2a72d3bf522b7e1b0fa48954d96 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 3 Mar 2012 12:09:17 +0100 +Subject: [PATCH 30/42] block, sx8: fix pointer math issue getting fw version + +commit ea5f4db8ece896c2ab9eafa0924148a2596c52e4 upstream. + +"mem" is type u8. We need parenthesis here or it screws up the pointer +math probably leading to an oops. + +Signed-off-by: Dan Carpenter +Acked-by: Jeff Garzik +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/sx8.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c +index b70f0fc..eec7b7a 100644 +--- a/drivers/block/sx8.c ++++ b/drivers/block/sx8.c +@@ -1116,7 +1116,7 @@ static inline void carm_handle_resp(struct carm_host *host, + break; + case MISC_GET_FW_VER: { + struct carm_fw_ver *ver = (struct carm_fw_ver *) +- mem + sizeof(struct carm_msg_get_fw_ver); ++ (mem + sizeof(struct carm_msg_get_fw_ver)); + if (!error) { + host->fw_ver = le32_to_cpu(ver->version); + host->flags |= (ver->features & FL_FW_VER_MASK); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch new file mode 100644 index 00000000..4a08d314 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch @@ -0,0 +1,163 @@ +From 365dff776f2730d8aa79bb2d4cec1abcca4d30fd Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Fri, 2 Mar 2012 10:43:28 +0100 +Subject: [PATCH 31/42] block: fix __blkdev_get and add_disk race condition + +commit 9f53d2fe815b4011ff930a7b6db98385d45faa68 upstream. + +The following situation might occur: + +__blkdev_get: add_disk: + + register_disk() +get_gendisk() + +disk_block_events() + disk->ev == NULL + + disk_add_events() + +__disk_unblock_events() + disk->ev != NULL + --ev->block + +Then we unblock events, when they are suppose to be blocked. This can +trigger events related block/genhd.c warnings, but also can crash in +sd_check_events() or other places. + +I'm able to reproduce crashes with the following scripts (with +connected usb dongle as sdb disk). + + +DEV=/dev/sdb +ENABLE=/sys/bus/usb/devices/1-2/bConfigurationValue + +function stop_me() +{ + for i in `jobs -p` ; do kill $i 2> /dev/null ; done + exit +} + +trap stop_me SIGHUP SIGINT SIGTERM + +for ((i = 0; i < 10; i++)) ; do + while true; do fdisk -l $DEV 2>&1 > /dev/null ; done & +done + +while true ; do +echo 1 > $ENABLE +sleep 1 +echo 0 > $ENABLE +done + + +I use the script to verify patch fixing oops in sd_revalidate_disk +http://marc.info/?l=linux-scsi&m=132935572512352&w=2 +Without Jun'ichi Nomura patch titled "Fix NULL pointer dereference in +sd_revalidate_disk" or this one, script easily crash kernel within +a few seconds. With both patches applied I do not observe crash. +Unfortunately after some time (dozen of minutes), script will hung in: + +[ 1563.906432] [] schedule_timeout_uninterruptible+0x15/0x20 +[ 1563.906437] [] msleep+0x15/0x20 +[ 1563.906443] [] blk_drain_queue+0x32/0xd0 +[ 1563.906447] [] blk_cleanup_queue+0xd0/0x170 +[ 1563.906454] [] scsi_free_queue+0x3f/0x60 +[ 1563.906459] [] __scsi_remove_device+0x6e/0xb0 +[ 1563.906463] [] scsi_forget_host+0x4f/0x60 +[ 1563.906468] [] scsi_remove_host+0x5a/0xf0 +[ 1563.906482] [] quiesce_and_remove_host+0x5b/0xa0 [usb_storage] +[ 1563.906490] [] usb_stor_disconnect+0x13/0x20 [usb_storage] + +Anyway I think this patch is some step forward. + +As drawback, I do not teardown on sysfs file create error, because I do +not know how to nullify disk->ev (since it can be used). However add_disk +error handling practically does not exist too, and things will work +without this sysfs file, except events will not be exported to user +space. + +Signed-off-by: Stanislaw Gruszka +Acked-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/genhd.c | 32 +++++++++++++++++++------------- + 1 file changed, 19 insertions(+), 13 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 02e9fca..9db720d 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -36,6 +36,7 @@ static DEFINE_IDR(ext_devt_idr); + + static struct device_type disk_type; + ++static void disk_alloc_events(struct gendisk *disk); + static void disk_add_events(struct gendisk *disk); + static void disk_del_events(struct gendisk *disk); + static void disk_release_events(struct gendisk *disk); +@@ -602,6 +603,8 @@ void add_disk(struct gendisk *disk) + disk->major = MAJOR(devt); + disk->first_minor = MINOR(devt); + ++ disk_alloc_events(disk); ++ + /* Register BDI before referencing it from bdev */ + bdi = &disk->queue->backing_dev_info; + bdi_register_dev(bdi, disk_devt(disk)); +@@ -1734,9 +1737,9 @@ module_param_cb(events_dfl_poll_msecs, &disk_events_dfl_poll_msecs_param_ops, + &disk_events_dfl_poll_msecs, 0644); + + /* +- * disk_{add|del|release}_events - initialize and destroy disk_events. ++ * disk_{alloc|add|del|release}_events - initialize and destroy disk_events. + */ +-static void disk_add_events(struct gendisk *disk) ++static void disk_alloc_events(struct gendisk *disk) + { + struct disk_events *ev; + +@@ -1749,16 +1752,6 @@ static void disk_add_events(struct gendisk *disk) + return; + } + +- if (sysfs_create_files(&disk_to_dev(disk)->kobj, +- disk_events_attrs) < 0) { +- pr_warn("%s: failed to create sysfs files for events\n", +- disk->disk_name); +- kfree(ev); +- return; +- } +- +- disk->ev = ev; +- + INIT_LIST_HEAD(&ev->node); + ev->disk = disk; + spin_lock_init(&ev->lock); +@@ -1767,8 +1760,21 @@ static void disk_add_events(struct gendisk *disk) + ev->poll_msecs = -1; + INIT_DELAYED_WORK(&ev->dwork, disk_events_workfn); + ++ disk->ev = ev; ++} ++ ++static void disk_add_events(struct gendisk *disk) ++{ ++ if (!disk->ev) ++ return; ++ ++ /* FIXME: error handling */ ++ if (sysfs_create_files(&disk_to_dev(disk)->kobj, disk_events_attrs) < 0) ++ pr_warn("%s: failed to create sysfs files for events\n", ++ disk->disk_name); ++ + mutex_lock(&disk_events_mutex); +- list_add_tail(&ev->node, &disk_events); ++ list_add_tail(&disk->ev->node, &disk_events); + mutex_unlock(&disk_events_mutex); + + /* +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch new file mode 100644 index 00000000..de8f4c99 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch @@ -0,0 +1,129 @@ +From 21816a3fe95d2536991ece0a71609d8c22f8af9d Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 2 Mar 2012 10:51:00 +0100 +Subject: [PATCH 32/42] Block: use a freezable workqueue for disk-event + polling + +commit 62d3c5439c534b0e6c653fc63e6d8c67be3a57b1 upstream. + +This patch (as1519) fixes a bug in the block layer's disk-events +polling. The polling is done by a work routine queued on the +system_nrt_wq workqueue. Since that workqueue isn't freezable, the +polling continues even in the middle of a system sleep transition. + +Obviously, polling a suspended drive for media changes and such isn't +a good thing to do; in the case of USB mass-storage devices it can +lead to real problems requiring device resets and even re-enumeration. + +The patch fixes things by creating a new system-wide, non-reentrant, +freezable workqueue and using it for disk-events polling. + +Signed-off-by: Alan Stern +Acked-by: Tejun Heo +Acked-by: Rafael J. Wysocki +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/genhd.c | 10 +++++----- + include/linux/workqueue.h | 4 ++++ + kernel/workqueue.c | 7 ++++++- + 3 files changed, 15 insertions(+), 6 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 9db720d..997afd6 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1479,9 +1479,9 @@ static void __disk_unblock_events(struct gendisk *disk, bool check_now) + intv = disk_events_poll_jiffies(disk); + set_timer_slack(&ev->dwork.timer, intv / 4); + if (check_now) +- queue_delayed_work(system_nrt_wq, &ev->dwork, 0); ++ queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0); + else if (intv) +- queue_delayed_work(system_nrt_wq, &ev->dwork, intv); ++ queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv); + out_unlock: + spin_unlock_irqrestore(&ev->lock, flags); + } +@@ -1525,7 +1525,7 @@ void disk_flush_events(struct gendisk *disk, unsigned int mask) + ev->clearing |= mask; + if (!ev->block) { + cancel_delayed_work(&ev->dwork); +- queue_delayed_work(system_nrt_wq, &ev->dwork, 0); ++ queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0); + } + spin_unlock_irq(&ev->lock); + } +@@ -1562,7 +1562,7 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask) + + /* uncondtionally schedule event check and wait for it to finish */ + disk_block_events(disk); +- queue_delayed_work(system_nrt_wq, &ev->dwork, 0); ++ queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0); + flush_delayed_work(&ev->dwork); + __disk_unblock_events(disk, false); + +@@ -1599,7 +1599,7 @@ static void disk_events_workfn(struct work_struct *work) + + intv = disk_events_poll_jiffies(disk); + if (!ev->block && intv) +- queue_delayed_work(system_nrt_wq, &ev->dwork, intv); ++ queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv); + + spin_unlock_irq(&ev->lock); + +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 0d556de..e228ca9 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -289,12 +289,16 @@ enum { + * + * system_freezable_wq is equivalent to system_wq except that it's + * freezable. ++ * ++ * system_nrt_freezable_wq is equivalent to system_nrt_wq except that ++ * it's freezable. + */ + extern struct workqueue_struct *system_wq; + extern struct workqueue_struct *system_long_wq; + extern struct workqueue_struct *system_nrt_wq; + extern struct workqueue_struct *system_unbound_wq; + extern struct workqueue_struct *system_freezable_wq; ++extern struct workqueue_struct *system_nrt_freezable_wq; + + extern struct workqueue_struct * + __alloc_workqueue_key(const char *name, unsigned int flags, int max_active, +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 42fa9ad..bb425b1 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -253,11 +253,13 @@ struct workqueue_struct *system_long_wq __read_mostly; + struct workqueue_struct *system_nrt_wq __read_mostly; + struct workqueue_struct *system_unbound_wq __read_mostly; + struct workqueue_struct *system_freezable_wq __read_mostly; ++struct workqueue_struct *system_nrt_freezable_wq __read_mostly; + EXPORT_SYMBOL_GPL(system_wq); + EXPORT_SYMBOL_GPL(system_long_wq); + EXPORT_SYMBOL_GPL(system_nrt_wq); + EXPORT_SYMBOL_GPL(system_unbound_wq); + EXPORT_SYMBOL_GPL(system_freezable_wq); ++EXPORT_SYMBOL_GPL(system_nrt_freezable_wq); + + #define CREATE_TRACE_POINTS + #include +@@ -3821,8 +3823,11 @@ static int __init init_workqueues(void) + WQ_UNBOUND_MAX_ACTIVE); + system_freezable_wq = alloc_workqueue("events_freezable", + WQ_FREEZABLE, 0); ++ system_nrt_freezable_wq = alloc_workqueue("events_nrt_freezable", ++ WQ_NON_REENTRANT | WQ_FREEZABLE, 0); + BUG_ON(!system_wq || !system_long_wq || !system_nrt_wq || +- !system_unbound_wq || !system_freezable_wq); ++ !system_unbound_wq || !system_freezable_wq || ++ !system_nrt_freezable_wq); + return 0; + } + early_initcall(init_workqueues); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch new file mode 100644 index 00000000..7807d732 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch @@ -0,0 +1,40 @@ +From 80a069c15be0297948b3075c0e691832b9241187 Mon Sep 17 00:00:00 2001 +From: "David S. Miller" +Date: Tue, 13 Mar 2012 18:19:51 -0700 +Subject: [PATCH 33/42] sparc32: Add -Av8 to assembler command line. + +commit e0adb9902fb338a9fe634c3c2a3e474075c733ba upstream. + +Newer version of binutils are more strict about specifying the +correct options to enable certain classes of instructions. + +The sparc32 build is done for v7 in order to support sun4c systems +which lack hardware integer multiply and divide instructions. + +So we have to pass -Av8 when building the assembler routines that +use these instructions and get patched into the kernel when we find +out that we have a v8 capable cpu. + +Reported-by: Paul Gortmaker +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile +index ad1fb5d..eddcfb3 100644 +--- a/arch/sparc/Makefile ++++ b/arch/sparc/Makefile +@@ -31,7 +31,7 @@ UTS_MACHINE := sparc + + #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7 + KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7 +-KBUILD_AFLAGS += -m32 ++KBUILD_AFLAGS += -m32 -Wa,-Av8 + + #LDFLAGS_vmlinux = -N -Ttext 0xf0004000 + # Since 2.5.40, the first stage is left not btfix-ed. +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch new file mode 100644 index 00000000..0fb2aca1 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch @@ -0,0 +1,35 @@ +From 0cf88be2891cd60ef2f132c0eb55cb5334b6439d Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Mon, 12 Mar 2012 08:21:16 -0700 +Subject: [PATCH 34/42] hwmon: (w83627ehf) Fix writing into fan_stop_time for + NCT6775F/NCT6776F + +commit 33fa9b620409edfc71aa6cf01a51f990fbe46ab8 upstream. + +NCT6775F and NCT6776F have their own set of registers for FAN_STOP_TIME. The +correct registers were used to read FAN_STOP_TIME, but writes used the wrong +registers. Fix it. + +Signed-off-by: Guenter Roeck +Acked-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627ehf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c +index c25387d..7a44a56 100644 +--- a/drivers/hwmon/w83627ehf.c ++++ b/drivers/hwmon/w83627ehf.c +@@ -1607,7 +1607,7 @@ store_##reg(struct device *dev, struct device_attribute *attr, \ + val = step_time_to_reg(val, data->pwm_mode[nr]); \ + mutex_lock(&data->update_lock); \ + data->reg[nr] = val; \ +- w83627ehf_write_value(data, W83627EHF_REG_##REG[nr], val); \ ++ w83627ehf_write_value(data, data->REG_##REG[nr], val); \ + mutex_unlock(&data->update_lock); \ + return count; \ + } \ +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch new file mode 100644 index 00000000..0df8c385 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch @@ -0,0 +1,53 @@ +From 61fa0a2298850898c90ce67bb0b9b440c452820a Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Mon, 12 Mar 2012 08:33:10 -0700 +Subject: [PATCH 35/42] hwmon: (w83627ehf) Fix memory leak in probe function + +commit 32260d94408c553dca4ce54104edf79941a27536 upstream. + +The driver probe function leaked memory if creating the cpu0_vid attribute file +failed. Fix by converting the driver to use devm_kzalloc. + +Signed-off-by: Guenter Roeck +Acked-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/w83627ehf.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c +index 7a44a56..3ffa1fa 100644 +--- a/drivers/hwmon/w83627ehf.c ++++ b/drivers/hwmon/w83627ehf.c +@@ -2004,7 +2004,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev) + goto exit; + } + +- data = kzalloc(sizeof(struct w83627ehf_data), GFP_KERNEL); ++ data = devm_kzalloc(&pdev->dev, sizeof(struct w83627ehf_data), ++ GFP_KERNEL); + if (!data) { + err = -ENOMEM; + goto exit_release; +@@ -2498,9 +2499,8 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev) + + exit_remove: + w83627ehf_device_remove_files(dev); +- kfree(data); +- platform_set_drvdata(pdev, NULL); + exit_release: ++ platform_set_drvdata(pdev, NULL); + release_region(res->start, IOREGION_LENGTH); + exit: + return err; +@@ -2514,7 +2514,6 @@ static int __devexit w83627ehf_remove(struct platform_device *pdev) + w83627ehf_device_remove_files(&pdev->dev); + release_region(data->addr, IOREGION_LENGTH); + platform_set_drvdata(pdev, NULL); +- kfree(data); + + return 0; + } +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch new file mode 100644 index 00000000..40044dd0 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch @@ -0,0 +1,69 @@ +From 9a7969b58bd5d4f2c05fefa4143f244ccb5b06ab Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Tue, 13 Mar 2012 04:03:27 -0400 +Subject: [PATCH 36/42] hwmon: (w83627ehf) Fix temp2 source for W83627UHG + +commit aacb6b0052692c72fe0cb94c6b547202def6ef46 upstream. + +Properly set the source of temp2 for the W83627UHG. Also fix a +comment right before that, and document the W83627UHG as reporting up +to 3 temperatures. + +Signed-off-by: Jean Delvare +Cc: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/hwmon/w83627ehf | 2 +- + drivers/hwmon/w83627ehf.c | 8 ++++---- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/Documentation/hwmon/w83627ehf b/Documentation/hwmon/w83627ehf +index 3f44dbd..75f3155 100644 +--- a/Documentation/hwmon/w83627ehf ++++ b/Documentation/hwmon/w83627ehf +@@ -50,7 +50,7 @@ W83627DHG, W83627DHG-P, W83627UHG, W83667HG, W83667HG-B, W83667HG-I + (NCT6775F), and NCT6776F super I/O chips. We will refer to them collectively + as Winbond chips. + +-The chips implement 2 to 4 temperature sensors (9 for NCT6775F and NCT6776F), ++The chips implement 3 to 4 temperature sensors (9 for NCT6775F and NCT6776F), + 2 to 5 fan rotation speed sensors, 8 to 10 analog voltage sensors, one VID + (except for 627UHG), alarms with beep warnings (control unimplemented), + and some automatic fan regulation strategies (plus manual fan control mode). +diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c +index 3ffa1fa..ceaec92 100644 +--- a/drivers/hwmon/w83627ehf.c ++++ b/drivers/hwmon/w83627ehf.c +@@ -39,7 +39,7 @@ + 0x8860 0xa1 + w83627dhg 9 5 4 3 0xa020 0xc1 0x5ca3 + w83627dhg-p 9 5 4 3 0xb070 0xc1 0x5ca3 +- w83627uhg 8 2 2 2 0xa230 0xc1 0x5ca3 ++ w83627uhg 8 2 2 3 0xa230 0xc1 0x5ca3 + w83667hg 9 5 3 3 0xa510 0xc1 0x5ca3 + w83667hg-b 9 5 3 4 0xb350 0xc1 0x5ca3 + nct6775f 9 4 3 9 0xb470 0xc1 0x5ca3 +@@ -2158,16 +2158,16 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev) + w83627ehf_set_temp_reg_ehf(data, 3); + + /* +- * Temperature sources for temp1 and temp2 are selected with ++ * Temperature sources for temp2 and temp3 are selected with + * bank 0, registers 0x49 and 0x4a. + */ + data->temp_src[0] = 0; /* SYSTIN */ + reg = w83627ehf_read_value(data, 0x49) & 0x07; + /* Adjust to have the same mapping as other source registers */ + if (reg == 0) +- data->temp_src[1]++; ++ data->temp_src[1] = 1; + else if (reg >= 2 && reg <= 5) +- data->temp_src[1] += 2; ++ data->temp_src[1] = reg + 2; + else /* should never happen */ + data->have_temp &= ~(1 << 1); + reg = w83627ehf_read_value(data, 0x4a); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch new file mode 100644 index 00000000..4f59e542 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch @@ -0,0 +1,103 @@ +From 4998c8b933c68ede83d8c017928a6666d26b42de Mon Sep 17 00:00:00 2001 +From: Alexandre Bounine +Date: Thu, 15 Mar 2012 15:17:09 -0700 +Subject: [PATCH 37/42] rapidio/tsi721: fix bug in register offset definitions + +commit 9bbad7da76b3dd578fb55c862624366a8c9ccd22 upstream. + +Fix indexed register offset definitions that use decimal (wrong) instead +of hexadecimal (correct) notation for indexing multipliers. + +Incorrect definitions do not affect Tsi721 driver in its current default +configuration because it uses only IDB queue 0. Loss of inbound +doorbell functionality should be observed if queue other than 0 is used. + +Signed-off-by: Alexandre Bounine +Cc: Matt Porter +Cc: Chul Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rapidio/devices/tsi721.h | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h +index 822e54c..1c226b3 100644 +--- a/drivers/rapidio/devices/tsi721.h ++++ b/drivers/rapidio/devices/tsi721.h +@@ -118,34 +118,34 @@ + + #define TSI721_IDB_ENTRY_SIZE 64 + +-#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 1000) ++#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 0x1000) + #define TSI721_IDQ_SUSPEND 0x00000002 + #define TSI721_IDQ_INIT 0x00000001 + +-#define TSI721_IDQ_STS(x) (0x20004 + (x) * 1000) ++#define TSI721_IDQ_STS(x) (0x20004 + (x) * 0x1000) + #define TSI721_IDQ_RUN 0x00200000 + +-#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 1000) ++#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 0x1000) + #define TSI721_IDQ_MASK_MASK 0xffff0000 + #define TSI721_IDQ_MASK_PATT 0x0000ffff + +-#define TSI721_IDQ_RP(x) (0x2000c + (x) * 1000) ++#define TSI721_IDQ_RP(x) (0x2000c + (x) * 0x1000) + #define TSI721_IDQ_RP_PTR 0x0007ffff + +-#define TSI721_IDQ_WP(x) (0x20010 + (x) * 1000) ++#define TSI721_IDQ_WP(x) (0x20010 + (x) * 0x1000) + #define TSI721_IDQ_WP_PTR 0x0007ffff + +-#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 1000) ++#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 0x1000) + #define TSI721_IDQ_BASEL_ADDR 0xffffffc0 +-#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 1000) +-#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 1000) ++#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 0x1000) ++#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 0x1000) + #define TSI721_IDQ_SIZE_VAL(size) (__fls(size) - 4) + #define TSI721_IDQ_SIZE_MIN 512 + #define TSI721_IDQ_SIZE_MAX (512 * 1024) + +-#define TSI721_SR_CHINT(x) (0x20040 + (x) * 1000) +-#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 1000) +-#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 1000) ++#define TSI721_SR_CHINT(x) (0x20040 + (x) * 0x1000) ++#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 0x1000) ++#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 0x1000) + #define TSI721_SR_CHINT_ODBOK 0x00000020 + #define TSI721_SR_CHINT_IDBQRCV 0x00000010 + #define TSI721_SR_CHINT_SUSP 0x00000008 +@@ -156,7 +156,7 @@ + + #define TSI721_IBWIN_NUM 8 + +-#define TSI721_IBWINLB(x) (0x29000 + (x) * 20) ++#define TSI721_IBWINLB(x) (0x29000 + (x) * 0x20) + #define TSI721_IBWINLB_BA 0xfffff000 + #define TSI721_IBWINLB_WEN 0x00000001 + +@@ -187,13 +187,13 @@ + */ + #define TSI721_OBWIN_NUM TSI721_PC2SR_WINS + +-#define TSI721_OBWINLB(x) (0x40000 + (x) * 20) ++#define TSI721_OBWINLB(x) (0x40000 + (x) * 0x20) + #define TSI721_OBWINLB_BA 0xffff8000 + #define TSI721_OBWINLB_WEN 0x00000001 + +-#define TSI721_OBWINUB(x) (0x40004 + (x) * 20) ++#define TSI721_OBWINUB(x) (0x40004 + (x) * 0x20) + +-#define TSI721_OBWINSZ(x) (0x40008 + (x) * 20) ++#define TSI721_OBWINSZ(x) (0x40008 + (x) * 0x20) + #define TSI721_OBWINSZ_SIZE 0x00001f00 + #define TSI721_OBWIN_SIZE(size) (__fls(size) - 15) + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch new file mode 100644 index 00000000..896f6abc --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch @@ -0,0 +1,46 @@ +From 67d192ddf0b8fb26bc4f8f2cf405b984174522b8 Mon Sep 17 00:00:00 2001 +From: Ville Syrjala +Date: Thu, 15 Mar 2012 18:11:05 +0100 +Subject: [PATCH 38/42] i2c-algo-bit: Fix spurious SCL timeouts under heavy + load + +commit 8ee161ce5e0cfc689eb677f227a6248191165fac upstream. + +When the system is under heavy load, there can be a significant delay +between the getscl() and time_after() calls inside sclhi(). That delay +may cause the time_after() check to trigger after SCL has gone high, +causing sclhi() to return -ETIMEDOUT. + +To fix the problem, double check that SCL is still low after the +timeout has been reached, before deciding to return -ETIMEDOUT. + +Signed-off-by: Ville Syrjala +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/algos/i2c-algo-bit.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c +index 525c734..24f94f4 100644 +--- a/drivers/i2c/algos/i2c-algo-bit.c ++++ b/drivers/i2c/algos/i2c-algo-bit.c +@@ -103,8 +103,14 @@ static int sclhi(struct i2c_algo_bit_data *adap) + * chips may hold it low ("clock stretching") while they + * are processing data internally. + */ +- if (time_after(jiffies, start + adap->timeout)) ++ if (time_after(jiffies, start + adap->timeout)) { ++ /* Test one last time, as we may have been preempted ++ * between last check and timeout test. ++ */ ++ if (getscl(adap)) ++ break; + return -ETIMEDOUT; ++ } + cond_resched(); + } + #ifdef DEBUG +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch new file mode 100644 index 00000000..3b071da9 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch @@ -0,0 +1,51 @@ +From 68cefddd17e9b4f4600a64b0351acff4bb250419 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Tue, 13 Mar 2012 18:20:11 -0700 +Subject: [PATCH 39/42] iscsi-target: Fix reservation conflict -EBUSY response + handling bug + +commit 00fdc6bbef77844ce397a7de7acfaf25e8e2e4eb upstream. + +This patch addresses a iscsi-target specific bug related to reservation conflict +handling in iscsit_handle_scsi_cmd() that has been causing reservation conflicts +to complete and not fail as expected due to incorrect errno checking. The problem +occured with the change to return -EBUSY from transport_generic_cmd_sequencer() -> +transport_generic_allocate_tasks() failures, that broke iscsit_handle_scsi_cmd() +checking for -EINVAL in order to invoke a non GOOD status response. + +This was manifesting itself as data corruption with legacy SPC-2 reservations, +but also effects iscsi-target LUNs with SPC-3 persistent reservations. + +This bug was originally introduced in lio-core commit: + +commit 03e98c9eb916f3f0868c1dc344dde2a60287ff72 +Author: Nicholas Bellinger +Date: Fri Nov 4 02:36:16 2011 -0700 + + target: Address legacy PYX_TRANSPORT_* return code breakage + +Reported-by: Martin Svec +Cc: Martin Svec +Cc: Christoph Hellwig +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman +--- + drivers/target/iscsi/iscsi_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 0c1d5c73..03d3528 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1029,7 +1029,7 @@ done: + return iscsit_add_reject_from_cmd( + ISCSI_REASON_BOOKMARK_NO_RESOURCES, + 1, 1, buf, cmd); +- } else if (transport_ret == -EINVAL) { ++ } else if (transport_ret < 0) { + /* + * Unsupported SAM Opcode. CHECK_CONDITION will be sent + * in iscsit_execute_cmd() during the CmdSN OOO Execution +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch new file mode 100644 index 00000000..1673697d --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch @@ -0,0 +1,152 @@ +From 16add6db674e266a62219145284435960e47435e Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Tue, 13 Mar 2012 21:29:06 -0700 +Subject: [PATCH 40/42] target: Fix compatible reservation handling (CRH=1) + with legacy RESERVE/RELEASE + +commit 087a03b3ea1c8d6e2d5743a8d1c6d571058caa04 upstream. + +This patch addresses a bug with target_check_scsi2_reservation_conflict() +return checking in target_scsi2_reservation_[reserve,release]() that was +preventing CRH=1 operation from silently succeeding in the two special +cases defined by SPC-3, and not failing with reservation conflict status +when dealing with legacy RESERVE/RELEASE + active SPC-3 PR logic. + +Also explictly set cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT during +the early non reservation holder failure from pr_ops->t10_seq_non_holder() +check in transport_generic_cmd_sequencer() for fabrics that already expect +it to be set. + +This bug was originally introduced in mainline commit: + +commit eacac00ce5bfde8086cd0615fb53c986f7f970fe +Author: Christoph Hellwig +Date: Thu Nov 3 17:50:40 2011 -0400 + + target: split core_scsi2_emulate_crh + +Reported-by: Martin Svec +Cc: Martin Svec +Cc: Christoph Hellwig +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman +--- + drivers/target/target_core_pr.c | 34 +++++++++++++++++++++----------- + drivers/target/target_core_transport.c | 1 + + 2 files changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c +index 778c1a6..6cf6ff4 100644 +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -120,7 +120,7 @@ static struct t10_pr_registration *core_scsi3_locate_pr_reg(struct se_device *, + struct se_node_acl *, struct se_session *); + static void core_scsi3_put_pr_reg(struct t10_pr_registration *); + +-static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) ++static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd) + { + struct se_session *se_sess = cmd->se_sess; + struct se_subsystem_dev *su_dev = cmd->se_dev->se_sub_dev; +@@ -130,7 +130,7 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) + int conflict = 0; + + if (!crh) +- return false; ++ return -EINVAL; + + pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl, + se_sess); +@@ -158,16 +158,14 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) + */ + if (pr_reg->pr_res_holder) { + core_scsi3_put_pr_reg(pr_reg); +- *ret = 0; +- return false; ++ return 1; + } + if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) || + (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) || + (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) || + (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) { + core_scsi3_put_pr_reg(pr_reg); +- *ret = 0; +- return true; ++ return 1; + } + core_scsi3_put_pr_reg(pr_reg); + conflict = 1; +@@ -192,10 +190,10 @@ static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int *ret) + " while active SPC-3 registrations exist," + " returning RESERVATION_CONFLICT\n"); + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; +- return true; ++ return -EBUSY; + } + +- return false; ++ return 0; + } + + int target_scsi2_reservation_release(struct se_task *task) +@@ -204,12 +202,18 @@ int target_scsi2_reservation_release(struct se_task *task) + struct se_device *dev = cmd->se_dev; + struct se_session *sess = cmd->se_sess; + struct se_portal_group *tpg = sess->se_tpg; +- int ret = 0; ++ int ret = 0, rc; + + if (!sess || !tpg) + goto out; +- if (target_check_scsi2_reservation_conflict(cmd, &ret)) ++ rc = target_check_scsi2_reservation_conflict(cmd); ++ if (rc == 1) ++ goto out; ++ else if (rc < 0) { ++ cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; ++ ret = -EINVAL; + goto out; ++ } + + ret = 0; + spin_lock(&dev->dev_reservation_lock); +@@ -246,7 +250,7 @@ int target_scsi2_reservation_reserve(struct se_task *task) + struct se_device *dev = cmd->se_dev; + struct se_session *sess = cmd->se_sess; + struct se_portal_group *tpg = sess->se_tpg; +- int ret = 0; ++ int ret = 0, rc; + + if ((cmd->t_task_cdb[1] & 0x01) && + (cmd->t_task_cdb[1] & 0x02)) { +@@ -262,8 +266,14 @@ int target_scsi2_reservation_reserve(struct se_task *task) + */ + if (!sess || !tpg) + goto out; +- if (target_check_scsi2_reservation_conflict(cmd, &ret)) ++ rc = target_check_scsi2_reservation_conflict(cmd); ++ if (rc == 1) + goto out; ++ else if (rc < 0) { ++ cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; ++ ret = -EINVAL; ++ goto out; ++ } + + ret = 0; + spin_lock(&dev->dev_reservation_lock); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index e4ddb93..cdb774b 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2507,6 +2507,7 @@ static int transport_generic_cmd_sequencer( + cmd, cdb, pr_reg_type) != 0) { + cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION; + cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT; ++ cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT; + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; + return -EBUSY; + } +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch new file mode 100644 index 00000000..7d266e88 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch @@ -0,0 +1,72 @@ +From e4dffc01371682d0b23d22f1fe611f96b53cc486 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 13 Mar 2012 09:05:14 -0700 +Subject: [PATCH 41/42] hwmon: (zl6100) Enable interval between chip accesses + for all chips + +commit fecfb64422d91a9621a3f96ab75c3a5f13e80b58 upstream. + +Intersil reports that all chips supported by the zl6100 driver require +an interval between chip accesses, even ZL2004 and ZL6105 which were thought +to be safe. + +Reported-by: Vivek Gani +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/hwmon/zl6100 | 14 ++++++-------- + drivers/hwmon/pmbus/zl6100.c | 11 +++-------- + 2 files changed, 9 insertions(+), 16 deletions(-) + +diff --git a/Documentation/hwmon/zl6100 b/Documentation/hwmon/zl6100 +index 7617798..c5e1a5b 100644 +--- a/Documentation/hwmon/zl6100 ++++ b/Documentation/hwmon/zl6100 +@@ -73,14 +73,12 @@ Module parameters + delay + ----- + +-Some Intersil/Zilker Labs DC-DC controllers require a minimum interval between +-I2C bus accesses. According to Intersil, the minimum interval is 2 ms, though +-1 ms appears to be sufficient and has not caused any problems in testing. +-The problem is known to affect ZL6100, ZL2105, and ZL2008. It is known not to +-affect ZL2004 and ZL6105. The driver automatically sets the interval to 1 ms +-except for ZL2004 and ZL6105. To enable manual override, the driver provides a +-writeable module parameter, 'delay', which can be used to set the interval to +-a value between 0 and 65,535 microseconds. ++Intersil/Zilker Labs DC-DC controllers require a minimum interval between I2C ++bus accesses. According to Intersil, the minimum interval is 2 ms, though 1 ms ++appears to be sufficient and has not caused any problems in testing. The problem ++is known to affect all currently supported chips. For manual override, the ++driver provides a writeable module parameter, 'delay', which can be used to set ++the interval to a value between 0 and 65,535 microseconds. + + + Sysfs entries +diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c +index ba296fd..5c5cdd2 100644 +--- a/drivers/hwmon/pmbus/zl6100.c ++++ b/drivers/hwmon/pmbus/zl6100.c +@@ -178,16 +178,11 @@ static int zl6100_probe(struct i2c_client *client, + data->id = mid->driver_data; + + /* +- * ZL2008, ZL2105, and ZL6100 are known to require a wait time +- * between I2C accesses. ZL2004 and ZL6105 are known to be safe. +- * +- * Only clear the wait time for chips known to be safe. The wait time +- * can be cleared later for additional chips if tests show that it +- * is not needed (in other words, better be safe than sorry). ++ * According to information from the chip vendor, all currently ++ * supported chips are known to require a wait time between I2C ++ * accesses. + */ + data->delay = delay; +- if (data->id == zl2004 || data->id == zl6105) +- data->delay = 0; + + /* + * Since there was a direct I2C device access above, wait before +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch new file mode 100644 index 00000000..282912d1 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.12/0042-Linux-3.2.12.patch @@ -0,0 +1,24 @@ +From 5193c69b7a34cf74e5cd0ed629eb921c3f029b3e Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 19 Mar 2012 09:03:17 -0700 +Subject: [PATCH 42/42] Linux 3.2.12 + +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 4b76371..15e80f1 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 11 ++SUBLEVEL = 12 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch new file mode 100644 index 00000000..29df2996 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch @@ -0,0 +1,62 @@ +From 4f3587e3e193f8ae9278442bf254d1271c4d010d Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Fri, 16 Mar 2012 17:08:39 -0700 +Subject: [PATCH 01/10] nilfs2: fix NULL pointer dereference in + nilfs_load_super_block() + +commit d7178c79d9b7c5518f9943188091a75fc6ce0675 upstream. + +According to the report from Slicky Devil, nilfs caused kernel oops at +nilfs_load_super_block function during mount after he shrank the +partition without resizing the filesystem: + + BUG: unable to handle kernel NULL pointer dereference at 00000048 + IP: [] nilfs_load_super_block+0x17e/0x280 [nilfs2] + *pde = 00000000 + Oops: 0000 [#1] PREEMPT SMP + ... + Call Trace: + [] init_nilfs+0x4b/0x2e0 [nilfs2] + [] nilfs_mount+0x447/0x5b0 [nilfs2] + [] mount_fs+0x36/0x180 + [] vfs_kern_mount+0x51/0xa0 + [] do_kern_mount+0x3e/0xe0 + [] do_mount+0x169/0x700 + [] sys_mount+0x6b/0xa0 + [] sysenter_do_call+0x12/0x28 + Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43 + 20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 <8b> 72 + 48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00 + EIP: [] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:ca9bbdcc + CR2: 0000000000000048 + +This turned out due to a defect in an error path which runs if the +calculated location of the secondary super block was invalid. + +This patch fixes it and eliminates the reported oops. + +Reported-by: Slicky Devil +Signed-off-by: Ryusuke Konishi +Tested-by: Slicky Devil +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/the_nilfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c +index d327140..35a8970 100644 +--- a/fs/nilfs2/the_nilfs.c ++++ b/fs/nilfs2/the_nilfs.c +@@ -515,6 +515,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs, + brelse(sbh[1]); + sbh[1] = NULL; + sbp[1] = NULL; ++ valid[1] = 0; + swp = 0; + } + if (!valid[swp]) { +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch new file mode 100644 index 00000000..ff1e0d96 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch @@ -0,0 +1,56 @@ +From d603197ba390bdeba1aa79167697278669fdd9f3 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Fri, 16 Mar 2012 10:28:07 +0000 +Subject: [PATCH 02/10] afs: Read of file returns EBADMSG + +commit 2c724fb92732c0b2a5629eb8af74e82eb62ac947 upstream. + +A read of a large file on an afs mount failed: + +# cat junk.file > /dev/null +cat: junk.file: Bad message + +Looking at the trace, call->offset wrapped since it is only an +unsigned short. In afs_extract_data: + + _enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count); +... + + if (call->offset < count) { + if (last) { + _leave(" = -EBADMSG [%d < %zu]", call->offset, count); + return -EBADMSG; + } + +Which matches the trace: + +[cat ] ==> afs_extract_data({65132},{524},1,,65536) +[cat ] <== afs_extract_data() = -EBADMSG [0 < 65536] + +call->offset went from 65132 to 0. Fix this by making call->offset an +unsigned int. + +Signed-off-by: Anton Blanchard +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index d2b0888..a306bb6 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -109,7 +109,7 @@ struct afs_call { + unsigned reply_size; /* current size of reply */ + unsigned first_offset; /* offset into mapping[first] */ + unsigned last_to; /* amount of mapping[last] */ +- unsigned short offset; /* offset into received data store */ ++ unsigned offset; /* offset into received data store */ + unsigned char unmarshall; /* unmarshalling phase */ + bool incoming; /* T if incoming call */ + bool send_pages; /* T if data from mapping should be sent */ +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch new file mode 100644 index 00000000..22cfa613 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch @@ -0,0 +1,68 @@ +From 4dd3f846325bf16e5b2d976dce42da7f722ade1f Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Fri, 16 Mar 2012 10:28:19 +0000 +Subject: [PATCH 03/10] afs: Remote abort can cause BUG in rxrpc code + +commit c0173863528a8c9212c53e080d63a1aaae5ef4f4 upstream. + +When writing files to afs I sometimes hit a BUG: + +kernel BUG at fs/afs/rxrpc.c:179! + +With a backtrace of: + + afs_free_call + afs_make_call + afs_fs_store_data + afs_vnode_store_data + afs_write_back_from_locked_page + afs_writepages_region + afs_writepages + +The cause is: + + ASSERT(skb_queue_empty(&call->rx_queue)); + +Looking at a tcpdump of the session the abort happens because we +are exceeding our disk quota: + + rx abort fs reply store-data error diskquota exceeded (32) + +So the abort error is valid. We hit the BUG because we haven't +freed all the resources for the call. + +By freeing any skbs in call->rx_queue before calling afs_free_call +we avoid hitting leaking memory and avoid hitting the BUG. + +Signed-off-by: Anton Blanchard +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/rxrpc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index e45a323..8ad8c2a 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -314,6 +314,7 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp, + struct msghdr msg; + struct kvec iov[1]; + int ret; ++ struct sk_buff *skb; + + _enter("%x,{%d},", addr->s_addr, ntohs(call->port)); + +@@ -380,6 +381,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp, + + error_do_abort: + rxrpc_kernel_abort_call(rxcall, RX_USER_ABORT); ++ while ((skb = skb_dequeue(&call->rx_queue))) ++ afs_free_skb(skb); + rxrpc_kernel_end_call(rxcall); + call->rxcall = NULL; + error_kill_call: +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch new file mode 100644 index 00000000..0cfd7651 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch @@ -0,0 +1,66 @@ +From 4458ed1dbe1180712e2c42c1816145bb793b9422 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Wed, 7 Mar 2012 11:42:49 +1100 +Subject: [PATCH 04/10] perf tools: Incorrect use of snprintf results in SEGV + +commit b832796caa1fda8516464a003c8c7cc547bc20c2 upstream. + +I have a workload where perf top scribbles over the stack and we SEGV. +What makes it interesting is that an snprintf is causing this. + +The workload is a c++ gem that has method names over 3000 characters +long, but snprintf is designed to avoid overrunning buffers. So what +went wrong? + +The problem is we assume snprintf returns the number of characters +written: + + ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level); +... + ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name); + +Unfortunately this is not how snprintf works. snprintf returns the +number of characters that would have been written if there was enough +space. In the above case, if the first snprintf returns a value larger +than size, we pass a negative size into the second snprintf and happily +scribble over the stack. If you have 3000 character c++ methods thats a +lot of stack to trample. + +This patch fixes repsep_snprintf by clamping the value at size - 1 which +is the maximum snprintf can write before adding the NULL terminator. + +I get the sinking feeling that there are a lot of other uses of snprintf +that have this same bug, we should audit them all. + +Cc: David Ahern +Cc: Eric B Munson +Cc: Frederic Weisbecker +Cc: Ingo Molnar +Cc: Paul Mackerras +Cc: Peter Zijlstra +Cc: Yanmin Zhang +Link: http://lkml.kernel.org/r/20120307114249.44275ca3@kryten +Signed-off-by: Anton Blanchard +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/sort.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index 16da30d..076c9d4 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -33,6 +33,9 @@ static int repsep_snprintf(char *bf, size_t size, const char *fmt, ...) + } + } + va_end(ap); ++ ++ if (n >= (int)size) ++ return size - 1; + return n; + } + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch new file mode 100644 index 00000000..0b3e626e --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch @@ -0,0 +1,283 @@ +From 0761aae695aebede1d2ab4bf704419ee0ac957f1 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Wed, 14 Mar 2012 12:29:29 -0300 +Subject: [PATCH 05/10] perf tools: Use scnprintf where applicable + +commit e7f01d1e3d8d501deb8abeaa269d5d48a703b8b0 upstream. + +Several places were expecting that the value returned was the number of +characters printed, not what would be printed if there was space. + +Fix it by using the scnprintf and vscnprintf variants we inherited from +the kernel sources. + +Some corner cases where the number of printed characters were not +accounted were fixed too. + +Reported-by: Anton Blanchard +Cc: Anton Blanchard +Cc: Eric B Munson +Cc: David Ahern +Cc: Frederic Weisbecker +Cc: Mike Galbraith +Cc: Paul Mackerras +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Yanmin Zhang +Link: http://lkml.kernel.org/n/tip-kwxo2eh29cxmd8ilixi2005x@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/powerpc/util/header.c | 2 +- + tools/perf/arch/x86/util/header.c | 2 +- + tools/perf/util/color.c | 9 +++++---- + tools/perf/util/header.c | 4 ++-- + tools/perf/util/hist.c | 30 +++++++++++++++--------------- + tools/perf/util/strbuf.c | 7 ++++--- + tools/perf/util/ui/browsers/hists.c | 12 ++++++------ + tools/perf/util/ui/helpline.c | 2 +- + 8 files changed, 35 insertions(+), 33 deletions(-) + +diff --git a/tools/perf/arch/powerpc/util/header.c b/tools/perf/arch/powerpc/util/header.c +index eba80c2..2f7073d 100644 +--- a/tools/perf/arch/powerpc/util/header.c ++++ b/tools/perf/arch/powerpc/util/header.c +@@ -25,7 +25,7 @@ get_cpuid(char *buffer, size_t sz) + + pvr = mfspr(SPRN_PVR); + +- nb = snprintf(buffer, sz, "%lu,%lu$", PVR_VER(pvr), PVR_REV(pvr)); ++ nb = scnprintf(buffer, sz, "%lu,%lu$", PVR_VER(pvr), PVR_REV(pvr)); + + /* look for end marker to ensure the entire data fit */ + if (strchr(buffer, '$')) { +diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c +index f940060..146d12a 100644 +--- a/tools/perf/arch/x86/util/header.c ++++ b/tools/perf/arch/x86/util/header.c +@@ -48,7 +48,7 @@ get_cpuid(char *buffer, size_t sz) + if (family >= 0x6) + model += ((a >> 16) & 0xf) << 4; + } +- nb = snprintf(buffer, sz, "%s,%u,%u,%u$", vendor, family, model, step); ++ nb = scnprintf(buffer, sz, "%s,%u,%u,%u$", vendor, family, model, step); + + /* look for end marker to ensure the entire data fit */ + if (strchr(buffer, '$')) { +diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c +index 521c38a..11e46da1 100644 +--- a/tools/perf/util/color.c ++++ b/tools/perf/util/color.c +@@ -1,3 +1,4 @@ ++#include + #include "cache.h" + #include "color.h" + +@@ -182,12 +183,12 @@ static int __color_vsnprintf(char *bf, size_t size, const char *color, + } + + if (perf_use_color_default && *color) +- r += snprintf(bf, size, "%s", color); +- r += vsnprintf(bf + r, size - r, fmt, args); ++ r += scnprintf(bf, size, "%s", color); ++ r += vscnprintf(bf + r, size - r, fmt, args); + if (perf_use_color_default && *color) +- r += snprintf(bf + r, size - r, "%s", PERF_COLOR_RESET); ++ r += scnprintf(bf + r, size - r, "%s", PERF_COLOR_RESET); + if (trail) +- r += snprintf(bf + r, size - r, "%s", trail); ++ r += scnprintf(bf + r, size - r, "%s", trail); + return r; + } + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 33c17a2..2cd88c1 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -1227,7 +1227,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir, + if (realname == NULL || filename == NULL || linkname == NULL) + goto out_free; + +- len = snprintf(filename, size, "%s%s%s", ++ len = scnprintf(filename, size, "%s%s%s", + debugdir, is_kallsyms ? "/" : "", realname); + if (mkdir_p(filename, 0755)) + goto out_free; +@@ -1242,7 +1242,7 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir, + goto out_free; + } + +- len = snprintf(linkname, size, "%s/.build-id/%.2s", ++ len = scnprintf(linkname, size, "%s/.build-id/%.2s", + debugdir, sbuild_id); + + if (access(linkname, X_OK) && mkdir_p(linkname, 0755)) +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c +index abef270..216e33a 100644 +--- a/tools/perf/util/hist.c ++++ b/tools/perf/util/hist.c +@@ -767,7 +767,7 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s, + sep ? "%.2f" : " %6.2f%%", + (period * 100.0) / total); + else +- ret = snprintf(s, size, sep ? "%.2f" : " %6.2f%%", ++ ret = scnprintf(s, size, sep ? "%.2f" : " %6.2f%%", + (period * 100.0) / total); + if (symbol_conf.show_cpu_utilization) { + ret += percent_color_snprintf(s + ret, size - ret, +@@ -790,20 +790,20 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s, + } + } + } else +- ret = snprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period); ++ ret = scnprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period); + + if (symbol_conf.show_nr_samples) { + if (sep) +- ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, nr_events); ++ ret += scnprintf(s + ret, size - ret, "%c%" PRIu64, *sep, nr_events); + else +- ret += snprintf(s + ret, size - ret, "%11" PRIu64, nr_events); ++ ret += scnprintf(s + ret, size - ret, "%11" PRIu64, nr_events); + } + + if (symbol_conf.show_total_period) { + if (sep) +- ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period); ++ ret += scnprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period); + else +- ret += snprintf(s + ret, size - ret, " %12" PRIu64, period); ++ ret += scnprintf(s + ret, size - ret, " %12" PRIu64, period); + } + + if (pair_hists) { +@@ -818,25 +818,25 @@ static int hist_entry__pcnt_snprintf(struct hist_entry *self, char *s, + diff = new_percent - old_percent; + + if (fabs(diff) >= 0.01) +- snprintf(bf, sizeof(bf), "%+4.2F%%", diff); ++ ret += scnprintf(bf, sizeof(bf), "%+4.2F%%", diff); + else +- snprintf(bf, sizeof(bf), " "); ++ ret += scnprintf(bf, sizeof(bf), " "); + + if (sep) +- ret += snprintf(s + ret, size - ret, "%c%s", *sep, bf); ++ ret += scnprintf(s + ret, size - ret, "%c%s", *sep, bf); + else +- ret += snprintf(s + ret, size - ret, "%11.11s", bf); ++ ret += scnprintf(s + ret, size - ret, "%11.11s", bf); + + if (show_displacement) { + if (displacement) +- snprintf(bf, sizeof(bf), "%+4ld", displacement); ++ ret += scnprintf(bf, sizeof(bf), "%+4ld", displacement); + else +- snprintf(bf, sizeof(bf), " "); ++ ret += scnprintf(bf, sizeof(bf), " "); + + if (sep) +- ret += snprintf(s + ret, size - ret, "%c%s", *sep, bf); ++ ret += scnprintf(s + ret, size - ret, "%c%s", *sep, bf); + else +- ret += snprintf(s + ret, size - ret, "%6.6s", bf); ++ ret += scnprintf(s + ret, size - ret, "%6.6s", bf); + } + } + +@@ -854,7 +854,7 @@ int hist_entry__snprintf(struct hist_entry *he, char *s, size_t size, + if (se->elide) + continue; + +- ret += snprintf(s + ret, size - ret, "%s", sep ?: " "); ++ ret += scnprintf(s + ret, size - ret, "%s", sep ?: " "); + ret += se->se_snprintf(he, s + ret, size - ret, + hists__col_len(hists, se->se_width_idx)); + } +diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c +index 92e0685..2eeb51b 100644 +--- a/tools/perf/util/strbuf.c ++++ b/tools/perf/util/strbuf.c +@@ -1,4 +1,5 @@ + #include "cache.h" ++#include + + int prefixcmp(const char *str, const char *prefix) + { +@@ -89,14 +90,14 @@ void strbuf_addf(struct strbuf *sb, const char *fmt, ...) + if (!strbuf_avail(sb)) + strbuf_grow(sb, 64); + va_start(ap, fmt); +- len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); ++ len = vscnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); + va_end(ap); + if (len < 0) +- die("your vsnprintf is broken"); ++ die("your vscnprintf is broken"); + if (len > strbuf_avail(sb)) { + strbuf_grow(sb, len); + va_start(ap, fmt); +- len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); ++ len = vscnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); + va_end(ap); + if (len > strbuf_avail(sb)) { + die("this should not happen, your snprintf is broken"); +diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c +index d0c94b4..81c9fa5 100644 +--- a/tools/perf/util/ui/browsers/hists.c ++++ b/tools/perf/util/ui/browsers/hists.c +@@ -839,15 +839,15 @@ static int hists__browser_title(struct hists *self, char *bf, size_t size, + unsigned long nr_events = self->stats.nr_events[PERF_RECORD_SAMPLE]; + + nr_events = convert_unit(nr_events, &unit); +- printed = snprintf(bf, size, "Events: %lu%c %s", nr_events, unit, ev_name); ++ printed = scnprintf(bf, size, "Events: %lu%c %s", nr_events, unit, ev_name); + + if (thread) +- printed += snprintf(bf + printed, size - printed, ++ printed += scnprintf(bf + printed, size - printed, + ", Thread: %s(%d)", + (thread->comm_set ? thread->comm : ""), + thread->pid); + if (dso) +- printed += snprintf(bf + printed, size - printed, ++ printed += scnprintf(bf + printed, size - printed, + ", DSO: %s", dso->short_name); + return printed; + } +@@ -1097,7 +1097,7 @@ static void perf_evsel_menu__write(struct ui_browser *browser, + HE_COLORSET_NORMAL); + + nr_events = convert_unit(nr_events, &unit); +- printed = snprintf(bf, sizeof(bf), "%lu%c%s%s", nr_events, ++ printed = scnprintf(bf, sizeof(bf), "%lu%c%s%s", nr_events, + unit, unit == ' ' ? "" : " ", ev_name); + slsmg_printf("%s", bf); + +@@ -1107,8 +1107,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser, + if (!current_entry) + ui_browser__set_color(browser, HE_COLORSET_TOP); + nr_events = convert_unit(nr_events, &unit); +- snprintf(bf, sizeof(bf), ": %ld%c%schunks LOST!", nr_events, +- unit, unit == ' ' ? "" : " "); ++ printed += scnprintf(bf, sizeof(bf), ": %ld%c%schunks LOST!", ++ nr_events, unit, unit == ' ' ? "" : " "); + warn = bf; + } + +diff --git a/tools/perf/util/ui/helpline.c b/tools/perf/util/ui/helpline.c +index 6ef3c56..f50f81c 100644 +--- a/tools/perf/util/ui/helpline.c ++++ b/tools/perf/util/ui/helpline.c +@@ -65,7 +65,7 @@ int ui_helpline__show_help(const char *format, va_list ap) + static int backlog; + + pthread_mutex_lock(&ui__lock); +- ret = vsnprintf(ui_helpline__last_msg + backlog, ++ ret = vscnprintf(ui_helpline__last_msg + backlog, + sizeof(ui_helpline__last_msg) - backlog, format, ap); + backlog += ret; + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch new file mode 100644 index 00000000..b245f584 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0006-tcp-fix-syncookie-regression.patch @@ -0,0 +1,111 @@ +From 1783dd4e3bf403739015f4494cb05445623826c8 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 10 Mar 2012 09:20:21 +0000 +Subject: [PATCH 06/10] tcp: fix syncookie regression + +[ Upstream commit dfd25ffffc132c00070eed64200e8950da5d7e9d ] + +commit ea4fc0d619 (ipv4: Don't use rt->rt_{src,dst} in ip_queue_xmit()) +added a serious regression on synflood handling. + +Simon Kirby discovered a successful connection was delayed by 20 seconds +before being responsive. + +In my tests, I discovered that xmit frames were lost, and needed ~4 +retransmits and a socket dst rebuild before being really sent. + +In case of syncookie initiated connection, we use a different path to +initialize the socket dst, and inet->cork.fl.u.ip4 is left cleared. + +As ip_queue_xmit() now depends on inet flow being setup, fix this by +copying the temp flowi4 we use in cookie_v4_check(). + +Reported-by: Simon Kirby +Bisected-by: Simon Kirby +Signed-off-by: Eric Dumazet +Tested-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/syncookies.c | 30 ++++++++++++++++-------------- + net/ipv4/tcp_ipv4.c | 10 +++++++--- + 2 files changed, 23 insertions(+), 17 deletions(-) + +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index 90f6544..769c0e9 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -278,6 +278,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, + struct rtable *rt; + __u8 rcv_wscale; + bool ecn_ok = false; ++ struct flowi4 fl4; + + if (!sysctl_tcp_syncookies || !th->ack || th->rst) + goto out; +@@ -346,20 +347,16 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, + * hasn't changed since we received the original syn, but I see + * no easy way to do this. + */ +- { +- struct flowi4 fl4; +- +- flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), +- RT_SCOPE_UNIVERSE, IPPROTO_TCP, +- inet_sk_flowi_flags(sk), +- (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, +- ireq->loc_addr, th->source, th->dest); +- security_req_classify_flow(req, flowi4_to_flowi(&fl4)); +- rt = ip_route_output_key(sock_net(sk), &fl4); +- if (IS_ERR(rt)) { +- reqsk_free(req); +- goto out; +- } ++ flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk), ++ RT_SCOPE_UNIVERSE, IPPROTO_TCP, ++ inet_sk_flowi_flags(sk), ++ (opt && opt->srr) ? opt->faddr : ireq->rmt_addr, ++ ireq->loc_addr, th->source, th->dest); ++ security_req_classify_flow(req, flowi4_to_flowi(&fl4)); ++ rt = ip_route_output_key(sock_net(sk), &fl4); ++ if (IS_ERR(rt)) { ++ reqsk_free(req); ++ goto out; + } + + /* Try to redo what tcp_v4_send_synack did. */ +@@ -373,5 +370,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, + ireq->rcv_wscale = rcv_wscale; + + ret = get_cookie_sock(sk, skb, req, &rt->dst); ++ /* ip_queue_xmit() depends on our flow being setup ++ * Normal sockets get it right from inet_csk_route_child_sock() ++ */ ++ if (ret) ++ inet_sk(ret)->cork.fl.u.ip4 = fl4; + out: return ret; + } +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index eb90aa8..de69cec 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1465,9 +1465,13 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb, + inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen; + newinet->inet_id = newtp->write_seq ^ jiffies; + +- if (!dst && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL) +- goto put_and_exit; +- ++ if (!dst) { ++ dst = inet_csk_route_child_sock(sk, newsk, req); ++ if (!dst) ++ goto put_and_exit; ++ } else { ++ /* syncookie case : see end of cookie_v4_check() */ ++ } + sk_setup_caps(newsk, dst); + + tcp_mtup_init(newsk); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch new file mode 100644 index 00000000..c1e22fb4 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch @@ -0,0 +1,36 @@ +From 599c3a877230bfb0db2f20028170b27a9cfef914 Mon Sep 17 00:00:00 2001 +From: "RongQing.Li" +Date: Thu, 15 Mar 2012 22:54:14 +0000 +Subject: [PATCH 07/10] ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu. + +[ Upstream commit c577923756b7fe9071f28a76b66b83b306d1d001 ] + +ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't +need to dev_hold(). +With dev_hold(), not corresponding dev_put(), will lead to leak. + +[ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ] + +Signed-off-by: RongQing.Li +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index ee7839f..2257366 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -257,7 +257,6 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net, + + if (rt) { + dev = rt->rt6i_dev; +- dev_hold(dev); + dst_release(&rt->dst); + } + } else +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch new file mode 100644 index 00000000..07ecf541 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch @@ -0,0 +1,63 @@ +From 50090beeab6611dbfccd8565bf6a6a97beddc6ee Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Thu, 8 Mar 2012 13:16:01 +0100 +Subject: [PATCH 08/10] iwl3945: fix possible il->txq NULL pointer dereference + in delayed works + +commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream. + +On il3945_down procedure we free tx queue data and nullify il->txq +pointer. After that we drop mutex and then cancel delayed works. There +is possibility, that after drooping mutex and before the cancel, some +delayed work will start and crash while trying to send commands to +the device. For example, here is reported crash in +il3945_bg_reg_txpower_periodic(): +https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10 + +Patch fix problem by adding il->txq check on works that send commands, +hence utilize tx queue. + +Reported-by: Clemens Eisserer +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +--- + drivers/net/wireless/iwlegacy/iwl-3945.c | 7 ++++--- + drivers/net/wireless/iwlegacy/iwl3945-base.c | 2 +- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/iwlegacy/iwl-3945.c b/drivers/net/wireless/iwlegacy/iwl-3945.c +index f7c0a74..7d1aa7c 100644 +--- a/drivers/net/wireless/iwlegacy/iwl-3945.c ++++ b/drivers/net/wireless/iwlegacy/iwl-3945.c +@@ -1870,11 +1870,12 @@ static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work) + struct iwl_priv *priv = container_of(work, struct iwl_priv, + _3945.thermal_periodic.work); + +- if (test_bit(STATUS_EXIT_PENDING, &priv->status)) +- return; +- + mutex_lock(&priv->mutex); ++ if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL) ++ goto out; ++ + iwl3945_reg_txpower_periodic(priv); ++out: + mutex_unlock(&priv->mutex); + } + +diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c +index 05f2ad1..b3d9f3f 100644 +--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c ++++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c +@@ -2513,7 +2513,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data) + container_of(data, struct iwl_priv, alive_start.work); + + mutex_lock(&priv->mutex); +- if (test_bit(STATUS_EXIT_PENDING, &priv->status)) ++ if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL) + goto out; + + iwl3945_alive_start(priv); +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch new file mode 100644 index 00000000..98111cb5 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch @@ -0,0 +1,36 @@ +From 93bbacdcea5490053dc692cad003f74eb116fd4a Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 9 Dec 2011 15:06:18 +1100 +Subject: [PATCH 09/10] powerpc/pmac: Fix SMP kernels on pre-core99 UP + machines + +commit 78c5c68a4cf4329d17abfa469345ddf323d4fd62 upstream. + +The code for "powersurge" SMP would kick in and cause a crash +at boot due to the lack of a NULL test. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Jeremy Kerr +Reported-by: Adam Conrad +Tested-by: Adam Conrad +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/powermac/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c +index 9b6a820..3394254 100644 +--- a/arch/powerpc/platforms/powermac/smp.c ++++ b/arch/powerpc/platforms/powermac/smp.c +@@ -414,7 +414,7 @@ static struct irqaction psurge_irqaction = { + + static void __init smp_psurge_setup_cpu(int cpu_nr) + { +- if (cpu_nr != 0) ++ if (cpu_nr != 0 || !psurge_start) + return; + + /* reset the entry point so if we get another intr we won't +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch new file mode 100644 index 00000000..08a58566 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0010-Linux-3.2.13.patch @@ -0,0 +1,24 @@ +From add3df1bc247cc4056661dd9ea3b445c1aea3e0d Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 23 Mar 2012 13:54:45 -0700 +Subject: [PATCH 10/10] Linux 3.2.13 + +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 15e80f1..172e041 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 12 ++SUBLEVEL = 13 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +-- +1.7.9.4 + diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh b/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh index 9bc6cf3a..20d590af 100755 --- a/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/patch.sh @@ -19,7 +19,7 @@ git reset --hard ${TAG} rm -Rf export previous=${TAG} -PATCHSET="3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.2.6 3.2.7 3.2.8 3.2.9 3.2.10 3.2.11 beaglebone" +PATCHSET="3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.2.6 3.2.7 3.2.8 3.2.9 3.2.10 3.2.11 3.2.12 3.2.13 beaglebone" # apply patches for patchset in ${PATCHSET} ; do diff --git a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb index c30d1be2..0b54e262 100644 --- a/recipes-kernel/linux/linux-ti33x-psp_3.2.bb +++ b/recipes-kernel/linux/linux-ti33x-psp_3.2.bb @@ -593,6 +593,58 @@ PATCHES_OVER_PSP = " \ file://3.2.10/0095-Linux-3.2.10.patch \ file://3.2.11/0001-Revert-mfd-Test-for-jack-detection-when-deciding-if-.patch \ file://3.2.11/0002-Linux-3.2.11.patch \ + file://3.2.12/0001-ASoC-neo1973-fix-neo1973-wm8753-initialization.patch \ + file://3.2.12/0002-ALSA-hda-realtek-Apply-the-coef-setup-only-to-ALC269.patch \ + file://3.2.12/0003-aio-fix-io_setup-io_destroy-race.patch \ + file://3.2.12/0004-aio-fix-the-too-late-munmap-race.patch \ + file://3.2.12/0005-x86-Derandom-delay_tsc-for-64-bit.patch \ + file://3.2.12/0006-PCI-ignore-pre-1.1-ASPM-quirking-when-ASPM-is-disabl.patch \ + file://3.2.12/0007-omap3isp-ccdc-Fix-crash-in-HS-VS-interrupt-handler.patch \ + file://3.2.12/0008-rt2x00-fix-random-stalls.patch \ + file://3.2.12/0009-perf-x86-Fix-local-vs-remote-memory-events-for-NHM-W.patch \ + file://3.2.12/0010-CIFS-Do-not-kmalloc-under-the-flocks-spinlock.patch \ + file://3.2.12/0011-vfs-fix-return-value-from-do_last.patch \ + file://3.2.12/0012-vfs-fix-double-put-after-complete_walk.patch \ + file://3.2.12/0013-acer-wmi-No-wifi-rfkill-on-Lenovo-machines.patch \ + file://3.2.12/0014-atl1c-dont-use-highprio-tx-queue.patch \ + file://3.2.12/0015-neighbour-Fixed-race-condition-at-tbl-nht.patch \ + file://3.2.12/0016-ipsec-be-careful-of-non-existing-mac-headers.patch \ + file://3.2.12/0017-ppp-fix-ppp_mp_reconstruct-bad-seq-errors.patch \ + file://3.2.12/0018-sfc-Fix-assignment-of-ip_summed-for-pre-allocated-sk.patch \ + file://3.2.12/0019-tcp-fix-false-reordering-signal-in-tcp_shifted_skb.patch \ + file://3.2.12/0020-vmxnet3-Fix-transport-header-size.patch \ + file://3.2.12/0021-packetengines-fix-config-default.patch \ + file://3.2.12/0022-r8169-corrupted-IP-fragments-fix-for-large-mtu.patch \ + file://3.2.12/0023-tcp-don-t-fragment-SACKed-skbs-in-tcp_mark_head_lost.patch \ + file://3.2.12/0024-bridge-check-return-value-of-ipv6_dev_get_saddr.patch \ + file://3.2.12/0025-tcp-fix-tcp_shift_skb_data-to-not-shift-SACKed-data-.patch \ + file://3.2.12/0026-IPv6-Fix-not-join-all-router-mcast-group-when-forwar.patch \ + file://3.2.12/0027-usb-asix-Patch-for-Sitecom-LN-031.patch \ + file://3.2.12/0028-regulator-Fix-setting-selector-in-tps6524x-set_volta.patch \ + file://3.2.12/0029-block-Fix-NULL-pointer-dereference-in-sd_revalidate_.patch \ + file://3.2.12/0030-block-sx8-fix-pointer-math-issue-getting-fw-version.patch \ + file://3.2.12/0031-block-fix-__blkdev_get-and-add_disk-race-condition.patch \ + file://3.2.12/0032-Block-use-a-freezable-workqueue-for-disk-event-polli.patch \ + file://3.2.12/0033-sparc32-Add-Av8-to-assembler-command-line.patch \ + file://3.2.12/0034-hwmon-w83627ehf-Fix-writing-into-fan_stop_time-for-N.patch \ + file://3.2.12/0035-hwmon-w83627ehf-Fix-memory-leak-in-probe-function.patch \ + file://3.2.12/0036-hwmon-w83627ehf-Fix-temp2-source-for-W83627UHG.patch \ + file://3.2.12/0037-rapidio-tsi721-fix-bug-in-register-offset-definition.patch \ + file://3.2.12/0038-i2c-algo-bit-Fix-spurious-SCL-timeouts-under-heavy-l.patch \ + file://3.2.12/0039-iscsi-target-Fix-reservation-conflict-EBUSY-response.patch \ + file://3.2.12/0040-target-Fix-compatible-reservation-handling-CRH-1-wit.patch \ + file://3.2.12/0041-hwmon-zl6100-Enable-interval-between-chip-accesses-f.patch \ + file://3.2.12/0042-Linux-3.2.12.patch \ + file://3.2.13/0001-nilfs2-fix-NULL-pointer-dereference-in-nilfs_load_su.patch \ + file://3.2.13/0002-afs-Read-of-file-returns-EBADMSG.patch \ + file://3.2.13/0003-afs-Remote-abort-can-cause-BUG-in-rxrpc-code.patch \ + file://3.2.13/0004-perf-tools-Incorrect-use-of-snprintf-results-in-SEGV.patch \ + file://3.2.13/0005-perf-tools-Use-scnprintf-where-applicable.patch \ + file://3.2.13/0006-tcp-fix-syncookie-regression.patch \ + file://3.2.13/0007-ipv6-Don-t-dev_hold-dev-in-ip6_mc_find_dev_rcu.patch \ + file://3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch \ + file://3.2.13/0009-powerpc-pmac-Fix-SMP-kernels-on-pre-core99-UP-machin.patch \ + file://3.2.13/0010-Linux-3.2.13.patch \ file://beaglebone/0001-f_rndis-HACK-around-undefined-variables.patch \ file://beaglebone/0002-da8xx-fb-add-DVI-support-for-beaglebone.patch \ file://beaglebone/0003-beaglebone-rebase-everything-onto-3.2-WARNING-MEGAPA.patch \ -- cgit v1.2.3-54-g00ecf