3.4.92-stable review

This is the start of the stable review cycle for the 3.4.92 release. There are 214 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat Jun 7 04:15:47 UTC 2014. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 3.4.92-rc1

Marc Dionne <[email protected]>
HID: logitech: don't use stack based dj_report structures

Joe Lawrence <[email protected]>
PCI/ASPM: Don't touch ASPM if forcibly disabled

Wei Liu <[email protected]>
xen-netfront: reduce gso_max_size to account for max TCP header

Joe Perches <[email protected]>
net: Add net_ratelimited_function and net_<level>_ratelimited macros

Gerald Schaefer <[email protected]>
crypto: s390 - Fix aes-xts parameter corruption

Oliver Hartkopp <[email protected]>
can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value

Johan Hovold <[email protected]>
backlight: atmel-pwm-bl: fix gpio polarity in remove

Brian Norris <[email protected]>
mtd: m25p80: fix allocation size

Herbert Xu <[email protected]>
crypto: s390 - Fix aes-cbc IV corruption

Felix Fietkau <[email protected]>
mac80211: drop spoofed packets in ad-hoc mode

Marcelo Tosatti <[email protected]>
vgacon.c: add cond reschedule points in vgacon_do_font_op

Hauke Mehrtens <[email protected]>
b43: ensue that BCMA is "y" when B43 is "y"

Shane Huang <[email protected]>
i2c-piix4: Add AMD CZ SMBus device ID

Johannes Berg <[email protected]>

    cfg80211: check wdev->netdev in connection work

Jiri Kosina <[email protected]>
random: fix accounting race condition with lockless irq entropy_count update

Ben Hutchings <[email protected]>
rapidio/tsi721: Fix interrupt mask when handling MSI

Alexandre Bounine <[email protected]>
rapidio/tsi721: fix bug in MSI interrupt handling

Maxim Mikityanskiy <[email protected]>
msi-wmi: Fix memory leak

Jakub Kicinski <[email protected]>
ixgbe: fix registration order of driver and DCA nofitication

Laxman Dewangan <[email protected]>
i2c: tegra: check the clk_prepare_enable() return value

Samuel Thibault <[email protected]>
speakup: lower default software speech rate

James Ralston <[email protected]>
ata_piix: Add Device IDs for Intel Lynx Point-LP PCH

Linus Walleij <[email protected]>
drivers/rtc/rtc-pl031.c: restore ST variant functionality

Maia Kozheva <[email protected]>

    rt2800usb: Add support for 2001:3c1e (D-Link DWA-125 rev B1) USB Wi-Fi adapter

Jaume Delclòs <[email protected]>
Wireless: rt2x00: Add device id for Sweex LW323 to rt2800usb.c

Xose Vazquez Perez <[email protected]>

    wireless: rt2x00: rt{2500,73}usb.c put back duplicate id

Haojian Zhuang <[email protected]>
drivers/rtc/rtc-pl031.c: fix the missing operation on enable

Alex Deucher <[email protected]>
drm/radeon: always program the MC on startup

Alex Deucher <[email protected]>
drm/radeon: fix hdmi mode enable on RS600/RS690/RS740

Thomas Hellstrom <[email protected]>
drm/ttm: Fix memory type compatibility check

Chris Wilson <[email protected]>
drm: Pad drm_mode_get_connector to 64-bit boundary

Alex Deucher <[email protected]>
drm/radeon: fix panel scaling with eDP and LVDS bridges

Jani Nikula <[email protected]>
drm/i915: try not to lose backlight CBLV precision

Ondrej Zary <[email protected]>
drm/radeon: Another card with wrong primary dac adj

Jani Nikula <[email protected]>
drm/i915: ensure single initialization and cleanup of backlight device

Chris Wilson <[email protected]>
drm/i915: Workaround incoherence between fences and LLC across multiple CPUs

Alex Deucher <[email protected]>
drm/radeon: cleanup properly if mmio mapping fails

Alex Deucher <[email protected]>
drm/radeon: use frac fb div on RS780/RS880

Egbert Eich <[email protected]>
DRM/i915: Add QUIRK_INVERT_BRIGHTNESS for NCR machines.

Jani Nikula <[email protected]>
drm/i915: add quirk to invert brightness on Packard Bell NCL20

Jani Nikula <[email protected]>
drm/i915: add quirk to invert brightness on eMachines e725

Jani Nikula <[email protected]>
drm/i915: add quirk to invert brightness on eMachines G725

Carsten Emde <[email protected]>
drm/i915: panel: invert brightness acer aspire 5734z

Carsten Emde <[email protected]>
drm/i915: panel: invert brightness via quirk

Carsten Emde <[email protected]>
drm/i915: panel: invert brightness via parameter

Jani Nikula <[email protected]>
drm/i915: add missing \n to UTS_RELEASE in the error_state

Daniel Vetter <[email protected]>
drm/i915: dump UTS_RELEASE into the error_state

Chris Wilson <[email protected]>
drm/i915; Only increment the user-pin-count after successfully pinning the bo

Chris Wilson <[email protected]>
drm/i915: Close race between processing unpin task and queueing the flip

Alex Deucher <[email protected]>
drm/radeon: fix typo in evergreen_mc_resume()

Aaro Koskinen <[email protected]>
drm/nouveau: fix init with agpgart-uninorth

Alex Deucher <[email protected]>
drm/radeon: add connector table for Mac G4 Silver

Alex Deucher <[email protected]>
drm/radeon: add connector table for SAM440ep embedded board

Jerome Glisse <[email protected]>
drm/radeon: fix amd afusion gpu setup aka sumo v2

Alex Deucher <[email protected]>
drm/radeon/dce32+: use fractional fb dividers for high clocks

Alex Deucher <[email protected]>
drm: fix documentation for drm_crtc_set_mode()

Jani Nikula <[email protected]>
drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures

Jason Wang <[email protected]>
drivers: hv: switch to use mb() instead of smp_mb()

Paolo Bonzini <[email protected]>
nbd: fsync and kill block device on shutdown

Ben Hutchings <[email protected]>
x86/efi: Fix dummy variable buffer allocation

Matthew Garrett <[email protected]>
Modify UEFI anti-bricking code

Richard Weinberger <[email protected]>
x86,efi: Implement efi_no_storage_paranoia parameter

Sergey Vlasov <[email protected]>
efi: Export efi_query_variable_store() for efivars.ko

Richard Weinberger <[email protected]>
x86,efi: Check max_size only if it is non-zero.

Matt Fleming <[email protected]>
x86, efivars: firmware bug workarounds should be in platform code

Seiji Aguchi <[email protected]>
efi_pstore: Introducing workqueue updating sysfs

Ben Hutchings <[email protected]>
efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE

Seth Forshee <[email protected]>
efivars: Add module parameter to disable use as a pstore backend

Seth Forshee <[email protected]>
efivars: Allow disabling use as a pstore backend

Ben Hutchings <[email protected]>
efivars: pstore: Do not check size when erasing variable

Josh Boyer <[email protected]>
efi: be more paranoid about available space when creating variables

Josh Boyer <[email protected]>

    efivars: Disable external interrupt while holding efivars->lock

Seiji Aguchi <[email protected]>
efi_pstore: Check remaining space with QueryVariableInfo() before writing data

H. Peter Anvin <[email protected]>
x86/Sandy Bridge: mark arrays in __init functions as __initconst

Oleg Nesterov <[email protected]>

    ptrace/x86: Partly fix set_task_blockstep()->update_debugctlmsr() logic

Oleg Nesterov <[email protected]>
ptrace/x86: Introduce set_task_blockstep() helper

Radu Caragea <[email protected]>
x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member

Russ Gorby <[email protected]>
n_gsm: replace kfree_skb w/ appropriate dev_* versions

Russ Gorby <[email protected]>
n_gsm: avoid accessing freed memory during CMD_FCOFF condition

samix.lebsir <[email protected]>
char: n_gsm: remove message filtering for contipated DLCI

Frederic Berat <[email protected]>
n_gsm : Flow control handling in Mux driver

Randy Dunlap <[email protected]>
x86: fix build error and kconfig for ia32_emulation and binfmt

Fenghua Yu <[email protected]>
x86/apic: Disable I/O APIC before shutdown of the local APIC

H. Peter Anvin <[email protected]>
x86, build: Pass in additional -mno-mmx, -mno-sse options

H. Peter Anvin <[email protected]>
x86, build, icc: Remove uninitialized_var() from compiler-intel.h

Dirk Behme <[email protected]>
tty: serial: imx: don't reinit clock in imx_setup_ufcr()

Takashi Iwai <[email protected]>
ALSA: hda - Add support for CX20952

Takashi Iwai <[email protected]>

    ALSA: hda - Add Conexant CX20755/20756/20757 codec IDs

Takashi Iwai <[email protected]>
ALSA: hda/conexant - Correct vendor IDs for new codecs

Takashi Iwai <[email protected]>
ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522

David Henningsson <[email protected]>
ALSA: hda - Fix oops caused by recent commit "Fix internal mic for Lenovo Ideapad U300s"

Felix Kaechele <[email protected]>
ALSA: hda - Add inverted internal mic quirk for Lenovo IdeaPad U310

David Henningsson <[email protected]>
ALSA: HDA: Add inverted internal mic quirk for Lenovo S205

Alex Hung <[email protected]>
thinkpad-acpi: fix issuing duplicated key events for brightness up/down

Bjorn Helgaas <[email protected]>
PCI: shpchp: Use per-slot workqueues to avoid deadlock

Stanislaw Gruszka <[email protected]>

    mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL

Bruce Allan <[email protected]>
e1000e: DoS while TSO enabled caused by link partner with small MSS

Alexander Stein <[email protected]>
can: c_can: Set reserved bit in IFx_MASK2 to 1 on write

Konrad Rzeszutek Wilk <[email protected]>
intel_idle: Don't register CPU notifier if we are not running.

Axel Lin <[email protected]>
regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel

Axel Lin <[email protected]>
regulator: max8997: Use uV in voltage_map_desc

Krzysztof Mazur <[email protected]>
i915: ensure that VGA plane is disabled

Mauro Carvalho Chehab <[email protected]>
i82975x_edac: Fix dimm label initialization

Jiri Slaby <[email protected]>
MISC: hpilo, remove pci_disable_device

Herton Ronaldo Krzesinski <[email protected]>
floppy: properly handle failure on add_disk loop

Seth Forshee <[email protected]>
Input: synaptics - adjust threshold for treating position values as negative

Matthieu CASTET <[email protected]>
UBI: erase free PEB with bitflip in EC header

Rashika Kheria <[email protected]>
Staging: zram: Fix access of NULL pointer

Sergey Senozhatsky <[email protected]>
zram: allow request end to coincide with disksize

Jiang Liu <[email protected]>
zram: avoid access beyond the zram device

Jiang Liu <[email protected]>
zram: destroy all devices on error recovery path in zram_init()

Jiang Liu <[email protected]>
zram: avoid invalid memory access in zram_exit()

Minchan Kim <[email protected]>
zram: Fix deadlock bug in partial read/write

Joe Thornber <[email protected]>
dm thin: fix discard corruption

Shiva Krishna Merla <[email protected]>
dm mpath: fix race condition between multipath_dtr and pg_init_done

Mikulas Patocka <[email protected]>
dm snapshot: avoid snapshot space leak on crash

Harshula Jayasuriya <[email protected]>
nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file

NeilBrown <[email protected]>
md/raid10: fix "enough" function for detecting if array is failed.

Mikulas Patocka <[email protected]>
dm snapshot: add missing module aliases

Mikulas Patocka <[email protected]>
dm bufio: avoid a possible __vmalloc deadlock

Trond Myklebust <[email protected]>
NFSv4.1: Handle NFS4ERR_DELAY when resetting the NFSv4.1 session

Weston Andros Adamson <[email protected]>
NFSv4.1: Don't decode skipped layoutgets

Trond Myklebust <[email protected]>
NFSv4.1: Fix a race in pNFS layoutcommit

Chuck Lever <[email protected]>
NFS: nfs_getaclargs.acl_len is a size_t

fanchaoting <[email protected]>
nfsd: don't run get_file if nfs4_preprocess_stateid_op return error

Dan Carpenter <[email protected]>
NFSv4.1: integer overflow in decode_cb_sequence_args()

J. Bruce Fields <[email protected]>
nfsd4: fix xdr decoding of large non-write compounds

Andy Adamson <[email protected]>
NFSv4 wait on recovery for async session errors

Mateusz Guzik <[email protected]>
cifs: delay super block destruction until all cifsFileInfo objects are gone

Linus Torvalds <[email protected]>
VFS: make vfs_fstat() use f[get|put]_light()

Steven Rostedt (Red Hat) <[email protected]>
tracing: Keep overwrite in sync between regular and snapshot buffers

Wei Yongjun <[email protected]>
perf: Fix error return code

libin <[email protected]>

    sched/debug: Fix sd->*_idx limit range avoiding overflow

Namhyung Kim <[email protected]>

    sched/debug: Limit sd->*_idx range on sysctl

Steven Rostedt (Red Hat) <[email protected]>
ftrace: Check module functions being traced on reload

Peter Zijlstra <[email protected]>
perf: Fix perf ring buffer memory ordering

Justin Lecher <[email protected]>
fs: cachefiles: add support for large files in filesystem caching

Geyslan G. Bem <[email protected]>
ecryptfs: Fix memory leakage in keystore.c

Pavel Shilovsky <[email protected]>
CIFS: Fix error handling in cifs_push_mandatory_locks

Steve French <[email protected]>
setfacl removes part of ACL when setting POSIX ACLs to Samba

Horia Geanta <[email protected]>
crypto: caam - add allocation failure handling in SPRINTFCAT macro

Du, Wenkai <[email protected]>
i2c: designware: Mask all interrupts during i2c controller enable

Hans de Goede <[email protected]>
ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX

Marcel Apfelbaum <[email protected]>
PCI: shpchp: Check bridge's secondary (not primary) bus speed

Linus Torvalds <[email protected]>
x86-64, modify_ldt: Make support for 16-bit segments a runtime option

Charles Keepax <[email protected]>
ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile

Jianyu Zhan <[email protected]>
percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()

J. Bruce Fields <[email protected]>
nfsd4: remove lockowner when removing lock stateid

J. Bruce Fields <[email protected]>
nfsd4: warn on finding lockowner without stateid's

Kinglong Mee <[email protected]>

    NFSD: Call ->set_acl with a NULL ACL structure if no entries

Romain Izard <[email protected]>
trace: module: Maintain a valid user count

Salva Peiró <[email protected]>
media: media-device: fix infoleak in ioctl media_enum_entities()

Tim Chen <[email protected]>
crypto: crypto_wq - Fix late crypto work queue initialization

Geert Uytterhoeven <[email protected]>
Documentation: Update stable address in Chinese and Japanese translations

Ilia Mirkin <[email protected]>
drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi

Ben Hutchings <[email protected]>
rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()

Liu Hua <[email protected]>
ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr

Christoph Hellwig <[email protected]>
posix_acl: handle NULL ACL in posix_acl_equiv_mode

Stanislaw Gruszka <[email protected]>
rt2x00: fix beaconing on USB

Daniele Forsi <[email protected]>
USB: Nokia 5300 should be treated as unusual dev

Victor A. Santos <[email protected]>
USB: Nokia 305 should be treated as unusual dev

Daniele Forsi <[email protected]>
usb: storage: shuttle_usbat: fix discs being detected twice

Jean-Jacques Hiblot <[email protected]>
usb: gadget: at91-udc: fix irq and iomem resource retrieval

Alex Deucher <[email protected]>
drm/radeon: fix ATPX detection on non-VGA GPUs

NeilBrown <[email protected]>
md: avoid possible spinning md thread at shutdown.

Viresh Kumar <[email protected]>
hrtimer: Set expiry time before switch_hrtimer_base()

Leon Ma <[email protected]>
hrtimer: Prevent remote enqueue of leftmost timers

Stuart Hayes <[email protected]>
hrtimer: Prevent all reprogramming if hang detected

Grant Likely <[email protected]>
drivercore: deferral race condition fix

Josef Gajdusek <[email protected]>
hwmon: (emc1403) Support full range of known chip revision numbers

Josef Gajdusek <[email protected]>
hwmon: (emc1403) fix inverted store_hyst()

Chen Yucong <[email protected]>
hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

Anthony Iliopoulos <[email protected]>
x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow()

Corey Minyard <[email protected]>
ipmi: Reset the KCS timeout when starting error recovery

Bodo Stroesser <[email protected]>
ipmi: Fix a race restarting the timer

Jiri Bohac <[email protected]>
timer: Prevent overflow in apply_slack

Linus Torvalds <[email protected]>
mm: make fixup_user_fault() check the vma access rights too

Bartlomiej Zolnierkiewicz <[email protected]>
pata_at91: fix ata_host_activate() failure handling

Steven Rostedt (Red Hat) <[email protected]>
ftrace/module: Hardcode ftrace_module_init() call into load_module()

Thomas Gleixner <[email protected]>
futex: Prevent attaching to kernel threads

Thomas Gleixner <[email protected]>
futex: Add another early deadlock detection check

Eric Dumazet <[email protected]>

    net-gro: reset skb->truesize in napi_reuse_skb()

Alexander Duyck <[email protected]>
skb: Add inline helper for getting the skb end offset from head

Li RongQing <[email protected]>
ipv4: initialise the itag variable in __mkroute_input

Jason Wang <[email protected]>
act_mirred: do not drop packets when fails to mirror it

Sergey Popovich <[email protected]>
ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation

Florian Westphal <[email protected]>
net: ipv4: ip_forward: fix inverted local_df test

Liu Yu <[email protected]>
tcp_cubic: fix the range of delayed_ack

Vlad Yasevich <[email protected]>
Revert "macvlan : fix checksums error when we are in bridge mode"

David Gibson <[email protected]>
rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set

David Gibson <[email protected]>
rtnetlink: Warn when interface's information won't fit in our packet

Ivan Vecera <[email protected]>
tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled

Mathias Krause <[email protected]>
filter: prevent nla extensions to peek beyond the end of the message

Wang, Xiaoming <[email protected]>
net: ipv4: current group_info should be put after using.

Eric Dumazet <[email protected]>
ipv6: Limit mtu to 65575 bytes

Thomas Richter <[email protected]>
bonding: Remove debug_fs files when module init fails

Florian Westphal <[email protected]>
net: core: don't account for udp header size when computing seglen

Dmitry Petukhov <[email protected]>
l2tp: take PMTU from tunnel UDP socket

Daniel Borkmann <[email protected]>
net: sctp: test if association is dead in sctp_wake_up_waiters

Daniel Borkmann <[email protected]>
net: sctp: wake up all assocs if sndbuf policy is per socket

Oleg Nesterov <[email protected]>
list: introduce list_next_entry() and list_prev_entry()

Alex Deucher <[email protected]>
drm/radeon: call drm_edid_to_eld when we update the edid

Christopher Friedt <[email protected]>
drm/vmwgfx: correct fb_fix_screeninfo.line_length

Bjørn Mork <[email protected]>
usb: option: add and update a number of CMOTech devices

Bjørn Mork <[email protected]>
usb: option: add Alcatel L800MA

Bjørn Mork <[email protected]>
usb: option: add Olivetti Olicard 500

Johan Hovold <[email protected]>
USB: io_ti: fix firmware download on big-endian machines

Johan Hovold <[email protected]>
Revert "USB: serial: add usbid for dell wwan card to sierra.c"

Daniele Palmas <[email protected]>
usb: option driver, add support for Telit UE910v2

Michele Baldessari <[email protected]>
USB: serial: ftdi_sio: add id for Brainboxes serial cards

Tristan Bruns <[email protected]>

    USB: cp210x: Add 8281 (Nanotec Plug & Drive)

Michael Ulbricht <[email protected]>
USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver

Mizuma, Masayoshi <[email protected]>
mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()

Helge Deller <[email protected]>
parisc: fix epoll_pwait syscall on compat kernel

-------------

Diffstat:

 Documentation/i2c/busses/i2c-piix4             |   2 +-
 Documentation/ja_JP/HOWTO                      |   2 +-
 Documentation/ja_JP/stable_kernel_rules.txt    |   6 +-
 Documentation/kernel-parameters.txt            |  20 ++
 Documentation/zh_CN/HOWTO                      |   2 +-
 Documentation/zh_CN/stable_kernel_rules.txt    |   2 +-
 Makefile                                       |   4 +-
 arch/arm/kernel/crash_dump.c                   |   2 +-
 arch/parisc/kernel/syscall_table.S             |   2 +-
 arch/s390/crypto/aes_s390.c                    |  50 +++--
 arch/x86/Kconfig                               |   1 +
 arch/x86/boot/Makefile                         |   6 +-
 arch/x86/boot/compressed/Makefile              |   1 +
 arch/x86/include/asm/hugetlb.h                 |   1 +
 arch/x86/kernel/crash.c                        |   2 +-
 arch/x86/kernel/ldt.c                          |   4 +-
 arch/x86/kernel/reboot.c                       |  11 +-
 arch/x86/kernel/setup.c                        |   4 +-
 arch/x86/kernel/step.c                         |  53 +++--
 arch/x86/kernel/sys_x86_64.c                   |   2 +-
 arch/x86/mm/mmap.c                             |   6 +-
 arch/x86/platform/efi/efi.c                    | 105 ++++++++++
 arch/x86/vdso/vdso32-setup.c                   |   8 +
 crypto/crypto_wq.c                             |   2 +-
 drivers/acpi/blacklist.c                       |  13 ++
 drivers/ata/ata_piix.c                         |   8 +
 drivers/ata/pata_at91.c                        |  11 +-
 drivers/atm/ambassador.c                       |   2 +-
 drivers/atm/idt77252.c                         |   2 +-
 drivers/base/dd.c                              |  17 ++
 drivers/block/floppy.c                         |  11 +-
 drivers/block/nbd.c                            |   9 +
 drivers/char/ipmi/ipmi_kcs_sm.c                |   5 +-
 drivers/char/ipmi/ipmi_si_intf.c               |  46 +++--
 drivers/char/random.c                          |  24 ++-
 drivers/crypto/caam/error.c                    |  10 +-
 drivers/edac/i82975x_edac.c                    |  11 +-
 drivers/firmware/Kconfig                       |  18 ++
 drivers/firmware/efivars.c                     | 256 ++++++++++++++++++-------
 drivers/gpu/drm/drm_crtc_helper.c              |   4 +-
 drivers/gpu/drm/i915/i915_debugfs.c            |   6 +-
 drivers/gpu/drm/i915/i915_drv.h                |   4 +-
 drivers/gpu/drm/i915/i915_gem.c                |  23 ++-
 drivers/gpu/drm/i915/i915_irq.c                |   4 +-
 drivers/gpu/drm/i915/intel_display.c           | 114 ++++++++++-
 drivers/gpu/drm/i915/intel_dp.c                |   5 -
 drivers/gpu/drm/i915/intel_drv.h               |   5 +-
 drivers/gpu/drm/i915/intel_lvds.c              |   3 +-
 drivers/gpu/drm/i915/intel_opregion.c          |   2 +-
 drivers/gpu/drm/i915/intel_panel.c             |  31 ++-
 drivers/gpu/drm/i915/intel_sdvo.c              |  22 ++-
 drivers/gpu/drm/nouveau/nouveau_acpi.c         |   3 -
 drivers/gpu/drm/nouveau/nouveau_bo.c           |   2 +-
 drivers/gpu/drm/radeon/atombios_crtc.c         |   5 +
 drivers/gpu/drm/radeon/evergreen.c             |   9 +-
 drivers/gpu/drm/radeon/ni.c                    |   3 +-
 drivers/gpu/drm/radeon/r600.c                  |   3 +-
 drivers/gpu/drm/radeon/r600_hdmi.c             |   4 +-
 drivers/gpu/drm/radeon/radeon_atpx_handler.c   |   7 +
 drivers/gpu/drm/radeon/radeon_combios.c        | 125 +++++++++++-
 drivers/gpu/drm/radeon/radeon_connectors.c     |  34 +++-
 drivers/gpu/drm/radeon/radeon_display.c        |   1 +
 drivers/gpu/drm/radeon/radeon_kms.c            |   4 +
 drivers/gpu/drm/radeon/radeon_mode.h           |   2 +
 drivers/gpu/drm/radeon/rv770.c                 |   3 +-
 drivers/gpu/drm/radeon/si.c                    |   3 +-
 drivers/gpu/drm/ttm/ttm_bo.c                   |  32 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_fb.c             |   5 +-
 drivers/hid/hid-logitech-dj.c                  |  38 ++--
 drivers/hv/ring_buffer.c                       |   4 +-
 drivers/hv/vmbus_drv.c                         |   2 +-
 drivers/hwmon/emc1403.c                        |   4 +-
 drivers/i2c/busses/Kconfig                     |   1 +
 drivers/i2c/busses/i2c-designware-core.c       |   3 +
 drivers/i2c/busses/i2c-piix4.c                 |   3 +-
 drivers/i2c/busses/i2c-tegra.c                 |  13 +-
 drivers/idle/intel_idle.c                      |   7 +-
 drivers/input/mouse/synaptics.c                |  31 ++-
 drivers/md/dm-bufio.c                          |  26 ++-
 drivers/md/dm-mpath.c                          |  18 +-
 drivers/md/dm-snap.c                           |  73 ++++++-
 drivers/md/dm-thin.c                           |   4 +-
 drivers/md/md.c                                |   3 +-
 drivers/md/persistent-data/dm-btree-remove.c   |  46 ++---
 drivers/md/raid10.c                            |   8 +-
 drivers/media/media-device.c                   |   1 +
 drivers/misc/hpilo.c                           |  11 +-
 drivers/mtd/devices/m25p80.c                   |  19 +-
 drivers/mtd/ubi/scan.c                         |   2 +-
 drivers/net/bonding/bond_main.c                |   1 +
 drivers/net/can/c_can/c_can.c                  |   6 +-
 drivers/net/can/sja1000/sja1000.c              |  17 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c |   3 -
 drivers/net/ethernet/broadcom/tg3.c            |   4 +-
 drivers/net/ethernet/intel/e1000e/e1000.h      |   1 +
 drivers/net/ethernet/intel/e1000e/netdev.c     |  48 +++--
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c  |   7 +-
 drivers/net/macvlan.c                          |   3 -
 drivers/net/wimax/i2400m/usb-rx.c              |   2 +-
 drivers/net/wireless/b43/Kconfig               |   4 +-
 drivers/net/wireless/rt2x00/rt2500usb.c        |   2 +-
 drivers/net/wireless/rt2x00/rt2800usb.c        |   2 +
 drivers/net/wireless/rt2x00/rt2x00mac.c        |  22 ++-
 drivers/net/wireless/rt2x00/rt73usb.c          |   1 +
 drivers/net/wireless/rtlwifi/rtl8192cu/hw.c    |   2 +-
 drivers/net/xen-netfront.c                     |  17 +-
 drivers/pci/hotplug/shpchp.h                   |   2 +-
 drivers/pci/hotplug/shpchp_core.c              |  26 +--
 drivers/pci/hotplug/shpchp_ctrl.c              |  10 +-
 drivers/pci/pcie/aspm.c                        |   3 +
 drivers/platform/x86/msi-wmi.c                 |   4 +-
 drivers/platform/x86/thinkpad_acpi.c           |   2 +-
 drivers/rapidio/devices/tsi721.c               |  11 ++
 drivers/regulator/max8997.c                    |  36 ++--
 drivers/regulator/max8998.c                    |   2 +-
 drivers/rtc/rtc-pl031.c                        |  10 +-
 drivers/staging/octeon/ethernet-tx.c           |   2 +-
 drivers/staging/speakup/speakup_soft.c         |   2 +-
 drivers/staging/zram/zram_drv.c                |  38 ++--
 drivers/staging/zram/zram_sysfs.c              |   6 +-
 drivers/tty/n_gsm.c                            |  78 ++++----
 drivers/tty/serial/imx.c                       |  18 +-
 drivers/usb/class/cdc-acm.c                    |  28 ++-
 drivers/usb/gadget/at91_udc.c                  |  10 -
 drivers/usb/serial/cp210x.c                    |   1 +
 drivers/usb/serial/ftdi_sio.c                  |  33 ++++
 drivers/usb/serial/ftdi_sio_ids.h              |  37 ++++
 drivers/usb/serial/io_ti.c                     |  50 +++--
 drivers/usb/serial/option.c                    |  83 +++++++-
 drivers/usb/serial/sierra.c                    |   1 -
 drivers/usb/storage/shuttle_usbat.c            |   2 +-
 drivers/usb/storage/unusual_devs.h             |  14 ++
 drivers/video/backlight/atmel-pwm-bl.c         |   3 +-
 drivers/video/console/vgacon.c                 |  17 +-
 fs/cachefiles/rdwr.c                           |   2 +-
 fs/cifs/cifsfs.c                               |  24 +++
 fs/cifs/cifsfs.h                               |   4 +
 fs/cifs/cifssmb.c                              |   8 +-
 fs/cifs/file.c                                 |   8 +-
 fs/ecryptfs/keystore.c                         |   3 +-
 fs/nfs/callback_xdr.c                          |   6 +-
 fs/nfs/nfs4proc.c                              |  23 +--
 fs/nfs/nfs4state.c                             |  14 +-
 fs/nfs/pnfs.c                                  |  19 +-
 fs/nfsd/nfs4acl.c                              |  17 +-
 fs/nfsd/nfs4proc.c                             |   8 +-
 fs/nfsd/nfs4state.c                            |  15 +-
 fs/nfsd/nfs4xdr.c                              |   2 +-
 fs/nfsd/vfs.c                                  |   5 +-
 fs/posix_acl.c                                 |   6 +
 fs/stat.c                                      |   5 +-
 include/drm/drm_mode.h                         |   2 +
 include/linux/compiler-intel.h                 |   2 -
 include/linux/efi.h                            |  16 +-
 include/linux/ftrace.h                         |   2 +
 include/linux/list.h                           |  16 ++
 include/linux/mm_types.h                       |   1 +
 include/linux/net.h                            |  23 +++
 include/linux/perf_event.h                     |  12 +-
 include/linux/skbuff.h                         |  12 +-
 include/net/ip6_route.h                        |   5 +
 include/net/mac80211.h                         |   5 +
 include/trace/events/module.h                  |   2 +-
 include/xen/interface/io/netif.h               |   1 +
 kernel/events/core.c                           |   4 +-
 kernel/events/ring_buffer.c                    |  31 ++-
 kernel/futex.c                                 |  52 +++--
 kernel/hrtimer.c                               |  30 ++-
 kernel/module.c                                |   3 +
 kernel/sched/core.c                            |  35 ++--
 kernel/timer.c                                 |   2 +-
 kernel/trace/ftrace.c                          |  98 ++++++----
 kernel/trace/trace.c                           |   6 +-
 mm/hugetlb.c                                   |   1 +
 mm/memory-failure.c                            |  15 +-
 mm/memory.c                                    |   5 +
 mm/percpu.c                                    |   2 +-
 net/core/dev.c                                 |   1 +
 net/core/filter.c                              |   6 +-
 net/core/rtnetlink.c                           |  33 ++--
 net/core/skbuff.c                              |  21 +-
 net/ipv4/fib_semantics.c                       |   2 +-
 net/ipv4/ip_forward.c                          |   4 +-
 net/ipv4/ping.c                                |  15 +-
 net/ipv4/route.c                               |   2 +-
 net/ipv4/tcp_cubic.c                           |   2 +-
 net/ipv6/route.c                               |   5 +-
 net/l2tp/l2tp_ppp.c                            |   4 +-
 net/mac80211/rx.c                              |   3 +
 net/mac80211/status.c                          |   6 +-
 net/sched/act_mirred.c                         |  11 +-
 net/sctp/socket.c                              |  42 +++-
 net/wireless/sme.c                             |   3 +
 sound/pci/hda/patch_conexant.c                 |  34 +++-
 sound/soc/codecs/wm8962.c                      |  15 +-
 sound/soc/codecs/wm8962.h                      |   4 +
 196 files changed, 2217 insertions(+), 745 deletions(-)

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Helge Deller <[email protected]>

commit ab3e55b119c9653b19ea4edffb86f04db867ac98 upstream.

This bug was detected with the libio-epoll-perl debian package where the test case IO-Ppoll-compat.t failed.

---
 arch/parisc/kernel/syscall_table.S |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -395,7 +395,7 @@
 	ENTRY_COMP(vmsplice)
 	ENTRY_COMP(move_pages)		/* 295 */
 	ENTRY_SAME(getcpu)
-	ENTRY_SAME(epoll_pwait)
+	ENTRY_COMP(epoll_pwait)
 	ENTRY_COMP(statfs64)
 	ENTRY_COMP(fstatfs64)
 	ENTRY_COMP(kexec_load)		/* 300 */

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Mizuma, Masayoshi" <[email protected]>

commit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream.

soft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 "mm:
hugetlb: fix softlockup when a large number of hugepages are freed." can happen in return_unused_surplus_pages(), so let's fix it.

---
 mm/hugetlb.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1082,6 +1082,7 @@ static void return_unused_surplus_pages(
 	while (nr_pages--) {
 		if (!free_pool_huge_page(h, &node_states[N_HIGH_MEMORY], 1))
 			break;
+		cond_resched_lock(&hugetlb_lock);
 	}
 }
 

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Ulbricht <[email protected]>

commit 895d240d1db0b2736d779200788e4c4aea28a0c6 upstream.

By specifying NO_UNION_NORMAL the ACM driver does only use the first two USB interfaces (modem data & control). The AT Port, Diagnostic and NMEA interfaces are left to the USB serial driver.

---
 drivers/usb/class/cdc-acm.c |   28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

@@ -1587,13 +1587,27 @@ static const struct usb_device_id acm_id
 	},
 	/* Motorola H24 HSPA module: */
 	{ USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
-	{ USB_DEVICE(0x22b8, 0x2d92) }, /* modem           + diagnostics        */
-	{ USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port                      */
-	{ USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics        */
-	{ USB_DEVICE(0x22b8, 0x2d96) }, /* modem                         + NMEA */
-	{ USB_DEVICE(0x22b8, 0x2d97) }, /* modem           + diagnostics + NMEA */
-	{ USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port               + NMEA */
-	{ USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
+	{ USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
+	{ USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
+	{ USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
+	{ USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
+	{ USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
+	{ USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
+	{ USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
+	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+	},
 
 	{ USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
 	.driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tristan Bruns <[email protected]>

commit 72b3007951010ce1bbf950e23b19d9839fa905a5 upstream.

---
 drivers/usb/serial/cp210x.c |    1 +
 1 file changed, 1 insertion(+)

@@ -110,6 +110,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
 	{ USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
 	{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
+	{ USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
 	{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
 	{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michele Baldessari <[email protected]>

commit efe26e16b1d93ac0085e69178cc18811629e8fc5 upstream.

Custom VID/PIDs for Brainboxes cards as reported in
https://bugzilla.redhat.com/show_bug.cgi?id=1071914

---
 drivers/usb/serial/ftdi_sio.c     |   33 +++++++++++++++++++++++++++++++++
 drivers/usb/serial/ftdi_sio_ids.h |   37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)

@@ -920,6 +920,39 @@ static struct usb_device_id id_table_com
 	{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
 	/* Cressi Devices */
 	{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
+	/* Brainboxes Devices */
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
+	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
 	{ },					/* Optional parameter entry */
 	{ }					/* Terminating entry */
 };

@@ -1326,3 +1326,40 @@
  * Manufacturer: Cressi
  */
 #define FTDI_CRESSI_PID		0x87d0
+
+/*
+ * Brainboxes devices
+ */
+#define BRAINBOXES_VID			0x05d1
+#define BRAINBOXES_VX_001_PID		0x1001 /* VX-001 ExpressCard 1 Port RS232 */
+#define BRAINBOXES_VX_012_PID		0x1002 /* VX-012 ExpressCard 2 Port RS232 */
+#define BRAINBOXES_VX_023_PID		0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
+#define BRAINBOXES_VX_034_PID		0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
+#define BRAINBOXES_US_101_PID		0x1011 /* US-101 1xRS232 */
+#define BRAINBOXES_US_324_PID		0x1013 /* US-324 1xRS422/485 1Mbaud */
+#define BRAINBOXES_US_606_1_PID		0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
+#define BRAINBOXES_US_606_2_PID		0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
+#define BRAINBOXES_US_606_3_PID		0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
+#define BRAINBOXES_US_701_1_PID		0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_701_2_PID		0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_279_1_PID		0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_279_2_PID		0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_279_3_PID		0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_279_4_PID		0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_346_1_PID		0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_346_2_PID		0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_257_PID		0x5001 /* US-257 2xRS232 1Mbaud */
+#define BRAINBOXES_US_313_PID		0x6001 /* US-313 2xRS422/485 1Mbaud */
+#define BRAINBOXES_US_357_PID		0x7001 /* US_357 1xRS232/422/485 */
+#define BRAINBOXES_US_842_1_PID		0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_842_2_PID		0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_842_3_PID		0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_842_4_PID		0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_160_1_PID		0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_160_2_PID		0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_160_3_PID		0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_160_4_PID		0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_160_5_PID		0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
+#define BRAINBOXES_US_160_6_PID		0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
+#define BRAINBOXES_US_160_7_PID		0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
+#define BRAINBOXES_US_160_8_PID		0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniele Palmas <[email protected]>

commit d6de486bc22255779bd54b0fceb4c240962bf146 upstream.

option driver, added VID/PID for Telit UE910v2 modem

---
 drivers/usb/serial/option.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -243,6 +243,7 @@ static void option_instat_callback(struc
 #define TELIT_PRODUCT_CC864_DUAL		0x1005
 #define TELIT_PRODUCT_CC864_SINGLE		0x1006
 #define TELIT_PRODUCT_DE910_DUAL		0x1010
+#define TELIT_PRODUCT_UE910_V2			0x1012
 #define TELIT_PRODUCT_LE920			0x1200
 
 /* ZTE PRODUCTS */

@@ -1055,6 +1056,7 @@ static const struct usb_device_id option
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 2e01280d2801c72878cf3a7119eac30077b463d5 upstream.

This reverts commit 1ebca9dad5abe8b2ed4dbd186cd657fb47c1f321.

This device was erroneously added to the sierra driver even though it's not a Sierra device and was already handled by the option driver.

---
 drivers/usb/serial/sierra.c |    1 -
 1 file changed, 1 deletion(-)

@@ -305,7 +305,6 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x0f3d, 0x68A3), 	/* Airprime/Sierra Wireless Direct IP modems */
 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
 	},
-       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
 
 	{ }
 };

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 5509076d1b4485ce9fb07705fcbcd2695907ab5b upstream.

During firmware download the device expects memory addresses in big-endian byte order. As the wIndex parameter which hold the address is sent in little-endian byte order regardless of host byte order, we need to use swab16 rather than cpu_to_be16.

Also make sure to handle the struct ti_i2c_desc size parameter which is returned in little-endian byte order.

---
 drivers/usb/serial/io_ti.c |   50 +++++++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 17 deletions(-)

@@ -29,6 +29,7 @@
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/serial.h>
+#include <linux/swab.h>
 #include <linux/kfifo.h>
 #include <linux/ioctl.h>
 #include <linux/firmware.h>

@@ -298,7 +299,7 @@ static int read_download_mem(struct usb_
 {
 	int status = 0;
 	__u8 read_length;
-	__be16 be_start_address;
+	u16 be_start_address;
 
 	dbg("%s - @ %x for %d", __func__, start_address, length);
 

@@ -315,10 +316,14 @@ static int read_download_mem(struct usb_
 			dbg("%s - @ %x for %d", __func__,
 			     start_address, read_length);
 		}
-		be_start_address = cpu_to_be16(start_address);
+		/*
+		 * NOTE: Must use swab as wIndex is sent in little-endian
+		 *       byte order regardless of host byte order.
+		 */
+		be_start_address = swab16((u16)start_address);
 		status = ti_vread_sync(dev, UMPC_MEMORY_READ,
 					(__u16)address_type,
-					(__force __u16)be_start_address,
+					be_start_address,
 					buffer, read_length);
 
 		if (status) {

@@ -418,7 +423,7 @@ static int write_i2c_mem(struct edgeport
 {
 	int status = 0;
 	int write_length;
-	__be16 be_start_address;
+	u16 be_start_address;
 
 	/* We can only send a maximum of 1 aligned byte page at a time */
 

@@ -434,11 +439,16 @@ static int write_i2c_mem(struct edgeport
 	usb_serial_debug_data(debug, &serial->serial->dev->dev,
 						__func__, write_length, buffer);
 
-	/* Write first page */
-	be_start_address = cpu_to_be16(start_address);
+	/*
+	 * Write first page.
+	 *
+	 * NOTE: Must use swab as wIndex is sent in little-endian byte order
+	 *       regardless of host byte order.
+	 */
+	be_start_address = swab16((u16)start_address);
 	status = ti_vsend_sync(serial->serial->dev,
 				UMPC_MEMORY_WRITE, (__u16)address_type,
-				(__force __u16)be_start_address,
+				be_start_address,
 				buffer,	write_length);
 	if (status) {
 		dbg("%s - ERROR %d", __func__, status);

@@ -462,11 +472,16 @@ static int write_i2c_mem(struct edgeport
 		usb_serial_debug_data(debug, &serial->serial->dev->dev,
 					__func__, write_length, buffer);
 
-		/* Write next page */
-		be_start_address = cpu_to_be16(start_address);
+		/*
+		 * Write next page.
+		 *
+		 * NOTE: Must use swab as wIndex is sent in little-endian byte
+		 *       order regardless of host byte order.
+		 */
+		be_start_address = swab16((u16)start_address);
 		status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
 				(__u16)address_type,
-				(__force __u16)be_start_address,
+				be_start_address,
 				buffer, write_length);
 		if (status) {
 			dev_err(&serial->serial->dev->dev, "%s - ERROR %d\n",

@@ -673,8 +688,8 @@ static int get_descriptor_addr(struct ed
 		if (rom_desc->Type == desc_type)
 			return start_address;
 
-		start_address = start_address + sizeof(struct ti_i2c_desc)
-							+ rom_desc->Size;
+		start_address = start_address + sizeof(struct ti_i2c_desc) +
+						le16_to_cpu(rom_desc->Size);
 
 	} while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
 

@@ -687,7 +702,7 @@ static int valid_csum(struct ti_i2c_desc
 	__u16 i;
 	__u8 cs = 0;
 
-	for (i = 0; i < rom_desc->Size; i++)
+	for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
 		cs = (__u8)(cs + buffer[i]);
 
 	if (cs != rom_desc->CheckSum) {

@@ -741,7 +756,7 @@ static int check_i2c_image(struct edgepo
 			break;
 
 		if ((start_address + sizeof(struct ti_i2c_desc) +
-					rom_desc->Size) > TI_MAX_I2C_SIZE) {
+			le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
 			status = -ENODEV;
 			dbg("%s - structure too big, erroring out.", __func__);
 			break;

@@ -756,7 +771,8 @@ static int check_i2c_image(struct edgepo
 			/* Read the descriptor data */
 			status = read_rom(serial, start_address +
 						sizeof(struct ti_i2c_desc),
-						rom_desc->Size, buffer);
+						le16_to_cpu(rom_desc->Size),
+						buffer);
 			if (status)
 				break;
 

@@ -765,7 +781,7 @@ static int check_i2c_image(struct edgepo
 				break;
 		}
 		start_address = start_address + sizeof(struct ti_i2c_desc) +
-								rom_desc->Size;
+						le16_to_cpu(rom_desc->Size);
 
 	} while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
 				(start_address < TI_MAX_I2C_SIZE));

@@ -804,7 +820,7 @@ static int get_manuf_info(struct edgepor
 
 	/* Read the descriptor data */
 	status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
-						rom_desc->Size, buffer);
+					le16_to_cpu(rom_desc->Size), buffer);
 	if (status)
 		goto exit;
 

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <[email protected]>

commit 533b3994610f316e5cd61b56d0c4daa15c830f89 upstream.

Device interface layout:
0: ff/ff/ff - serial
1: ff/ff/ff - serial AT+PPP
2: 08/06/50 - storage
3: ff/ff/ff - serial
4: ff/ff/ff - QMI/wwan

---
 drivers/usb/serial/option.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -354,6 +354,7 @@ static void option_instat_callback(struc
 #define OLIVETTI_PRODUCT_OLICARD100		0xc000
 #define OLIVETTI_PRODUCT_OLICARD145		0xc003
 #define OLIVETTI_PRODUCT_OLICARD200		0xc005
+#define OLIVETTI_PRODUCT_OLICARD500		0xc00b
 
 /* Celot products */
 #define CELOT_VENDOR_ID				0x211f

@@ -1565,6 +1566,9 @@ static const struct usb_device_id option
 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
 		.driver_info = (kernel_ulong_t)&net_intf6_blacklist
 	},
+	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
+		.driver_info = (kernel_ulong_t)&net_intf4_blacklist
+	},
 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <[email protected]>

commit dd6b48ecec2ea7d15f28d5e5474388681899a5e1 upstream.

Device interface layout:
0: ff/ff/ff - serial
1: ff/00/00 - serial AT+PPP
2: ff/ff/ff - QMI/wwan
3: 08/06/50 - storage

---
 drivers/usb/serial/option.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -292,6 +292,7 @@ static void option_instat_callback(struc
 #define ALCATEL_PRODUCT_X060S_X200		0x0000
 #define ALCATEL_PRODUCT_X220_X500D		0x0017
 #define ALCATEL_PRODUCT_L100V			0x011e
+#define ALCATEL_PRODUCT_L800MA			0x0203
 
 #define PIRELLI_VENDOR_ID			0x1266
 #define PIRELLI_PRODUCT_C100_1			0x1002

@@ -1521,6 +1522,8 @@ static const struct usb_device_id option
 	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
+	  .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <[email protected]>

commit 34f972d6156fe9eea2ab7bb418c71f9d1d5c8e7b upstream.

A number of older CMOTech modems are based on Qualcomm chips. The blacklisted interfaces are QMI/wwan.

---
 drivers/usb/serial/option.c |   74 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 70 insertions(+), 4 deletions(-)

@@ -234,8 +234,31 @@ static void option_instat_callback(struc
 #define QUALCOMM_VENDOR_ID			0x05C6
 
 #define CMOTECH_VENDOR_ID			0x16d8
-#define CMOTECH_PRODUCT_6008			0x6008
-#define CMOTECH_PRODUCT_6280			0x6280
+#define CMOTECH_PRODUCT_6001			0x6001
+#define CMOTECH_PRODUCT_CMU_300			0x6002
+#define CMOTECH_PRODUCT_6003			0x6003
+#define CMOTECH_PRODUCT_6004			0x6004
+#define CMOTECH_PRODUCT_6005			0x6005
+#define CMOTECH_PRODUCT_CGU_628A		0x6006
+#define CMOTECH_PRODUCT_CHE_628S		0x6007
+#define CMOTECH_PRODUCT_CMU_301			0x6008
+#define CMOTECH_PRODUCT_CHU_628			0x6280
+#define CMOTECH_PRODUCT_CHU_628S		0x6281
+#define CMOTECH_PRODUCT_CDU_680			0x6803
+#define CMOTECH_PRODUCT_CDU_685A		0x6804
+#define CMOTECH_PRODUCT_CHU_720S		0x7001
+#define CMOTECH_PRODUCT_7002			0x7002
+#define CMOTECH_PRODUCT_CHU_629K		0x7003
+#define CMOTECH_PRODUCT_7004			0x7004
+#define CMOTECH_PRODUCT_7005			0x7005
+#define CMOTECH_PRODUCT_CGU_629			0x7006
+#define CMOTECH_PRODUCT_CHU_629S		0x700a
+#define CMOTECH_PRODUCT_CHU_720I		0x7211
+#define CMOTECH_PRODUCT_7212			0x7212
+#define CMOTECH_PRODUCT_7213			0x7213
+#define CMOTECH_PRODUCT_7251			0x7251
+#define CMOTECH_PRODUCT_7252			0x7252
+#define CMOTECH_PRODUCT_7253			0x7253
 
 #define TELIT_VENDOR_ID				0x1bc7
 #define TELIT_PRODUCT_UC864E			0x1003

@@ -517,6 +540,10 @@ static const struct option_blacklist_inf
 	.reserved = BIT(1) | BIT(2),
 };
 
+static const struct option_blacklist_info net_intf0_blacklist = {
+	.reserved = BIT(0),
+};
+
 static const struct option_blacklist_info net_intf1_blacklist = {
 	.reserved = BIT(1),
 };

@@ -1051,8 +1078,47 @@ static const struct usb_device_id option
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
+	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
+	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
+	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
+	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
+	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
+	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
+	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
+	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christopher Friedt <[email protected]>

commit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream.

Previously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust the FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.

See https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples.

---
 drivers/gpu/drm/vmwgfx/vmwgfx_fb.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_va
 	}
 
 	if (!vmw_kms_validate_mode_vram(vmw_priv,
-					info->fix.line_length,
+					var->xres * var->bits_per_pixel/8,
 					var->yoffset + var->yres)) {
 		DRM_ERROR("Requested geom can not fit in framebuffer\n");
 		return -EINVAL;

@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info
 	struct vmw_private *vmw_priv = par->vmw_priv;
 	int ret;
 
+	info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8;
+
 	ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres,
 				 info->fix.line_length,
 				 par->bpp, par->depth);

@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info
 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
+		vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
 	}
 

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <[email protected]>

commit 16086279353cbfecbb3ead474072dced17b97ddc upstream.

This needs to be done to update some of the fields in the connector structure used by the audio code.

Noticed by several users on irc.

---
 drivers/gpu/drm/radeon/radeon_display.c |    1 +
 1 file changed, 1 insertion(+)

@@ -750,6 +750,7 @@ int radeon_ddc_get_modes(struct radeon_c
 	if (radeon_connector->edid) {
 		drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
 		ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
+		drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
 		return ret;
 	}
 	drm_mode_connector_update_edid_property(&radeon_connector->base, NULL);

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oleg Nesterov <[email protected]>

[ Upstream commit 008208c6b26f21c2648c250a09c55e737c02c5f8 ]

Add two trivial helpers list_next_entry() and list_prev_entry(), they can have a lot of users including list.h itself. In fact the 1st one is already defined in events/core.c and bnx2x_sp.c, so the patch simply moves the definition to list.h.

---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c |    3 ---
 include/linux/list.h                           |   16 ++++++++++++++++
 kernel/events/core.c                           |    3 ---
 3 files changed, 16 insertions(+), 6 deletions(-)

@@ -1030,9 +1030,6 @@ static void bnx2x_set_one_vlan_mac_e1h(s
 				     ETH_VLAN_FILTER_CLASSIFY, config);
 }
 
-#define list_next_entry(pos, member) \
-	list_entry((pos)->member.next, typeof(*(pos)), member)
-
 /**
  * bnx2x_vlan_mac_restore - reconfigure next MAC/VLAN/VLAN-MAC element
  *

@@ -362,6 +362,22 @@ static inline void list_splice_tail_init
 	list_entry((ptr)->next, type, member)
 
 /**
+ * list_next_entry - get the next element in list
+ * @pos:	the type * to cursor
+ * @member:	the name of the list_struct within the struct.
+ */
+#define list_next_entry(pos, member) \
+	list_entry((pos)->member.next, typeof(*(pos)), member)
+
+/**
+ * list_prev_entry - get the prev element in list
+ * @pos:	the type * to cursor
+ * @member:	the name of the list_struct within the struct.
+ */
+#define list_prev_entry(pos, member) \
+	list_entry((pos)->member.prev, typeof(*(pos)), member)
+
+/**
  * list_for_each	-	iterate over a list
  * @pos:	the &struct list_head to use as a loop cursor.
  * @head:	the head for your list.

@@ -1973,9 +1973,6 @@ static void __perf_event_sync_stat(struc
 	perf_event_update_userpage(next_event);
 }
 
-#define list_next_entry(pos, member) \
-	list_entry(pos->member.next, typeof(*pos), member)
-
 static void perf_event_sync_stat(struct perf_event_context *ctx,
 				   struct perf_event_context *next_ctx)
 {

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

[ Upstream commit 52c35befb69b005c3fc5afdaae3a5717ad013411 ]

SCTP charges chunks for wmem accounting via skb->truesize in sctp_set_owner_w(), and sctp_wfree() respectively as the reverse operation. If a sender runs out of wmem, it needs to wait via sctp_wait_for_sndbuf(), and gets woken up by a call to __sctp_write_space() mostly via sctp_wfree().

__sctp_write_space() is being called per association. Although we assign sk->sk_write_space() to sctp_write_space(), which is then being done per socket, it is only used if send space is increased per socket option (SO_SNDBUF), as SOCK_USE_WRITE_QUEUE is set and therefore not invoked in sock_wfree().

Commit 4c3a5bdae293 ("sctp: Don't charge for data in sndbuf again when transmitting packet") fixed an issue where in case sctp_packet_transmit() manages to queue up more than sndbuf bytes, sctp_wait_for_sndbuf() will never be woken up again unless it is interrupted by a signal. However, a still remaining issue is that if net.sctp.sndbuf_policy=0, that is accounting per socket, and one-to-many sockets are in use, the reclaimed write space from sctp_wfree() is 'unfairly' handed back on the server to the association that is the lucky one to be woken up again via __sctp_write_space(), while the remaining associations are never be woken up again (unless by a signal).

The effect disappears with net.sctp.sndbuf_policy=1, that is wmem accounting per association, as it guarantees a fair share of wmem among associations.

Therefore, if we have reclaimed memory in case of per socket accounting, wake all related associations to a socket in a fair manner, that is, traverse the socket association list starting from the current neighbour of the association and issue a __sctp_write_space() to everyone until we end up waking ourselves. This guarantees that no association is preferred over another and even if more associations are taken into the one-to-many session, all receivers will get messages from the server and are not stalled forever on high load. This setting still leaves the advantage of per socket accounting in touch as an association can still use up global limits if unused by others.

---
 net/sctp/socket.c |   36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

@@ -6369,6 +6369,40 @@ static void __sctp_write_space(struct sc
 	}
 }
 
+static void sctp_wake_up_waiters(struct sock *sk,
+				 struct sctp_association *asoc)
+{
+	struct sctp_association *tmp = asoc;
+
+	/* We do accounting for the sndbuf space per association,
+	 * so we only need to wake our own association.
+	 */
+	if (asoc->ep->sndbuf_policy)
+		return __sctp_write_space(asoc);
+
+	/* Accounting for the sndbuf space is per socket, so we
+	 * need to wake up others, try to be fair and in case of
+	 * other associations, let them have a go first instead
+	 * of just doing a sctp_write_space() call.
+	 *
+	 * Note that we reach sctp_wake_up_waiters() only when
+	 * associations free up queued chunks, thus we are under
+	 * lock and the list of associations on a socket is
+	 * guaranteed not to change.
+	 */
+	for (tmp = list_next_entry(tmp, asocs); 1;
+	     tmp = list_next_entry(tmp, asocs)) {
+		/* Manually skip the head element. */
+		if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
+			continue;
+		/* Wake up association. */
+		__sctp_write_space(tmp);
+		/* We've reached the end. */
+		if (tmp == asoc)
+			break;
+	}
+}
+
 /* Do accounting for the sndbuf space.
  * Decrement the used sndbuf space of the corresponding association by the
  * data size which was just transmitted(freed).

@@ -6396,7 +6430,7 @@ static void sctp_wfree(struct sk_buff *s
 	sk_mem_uncharge(sk, skb->truesize);
 
 	sock_wfree(skb);
-	__sctp_write_space(asoc);
+	sctp_wake_up_waiters(sk, asoc);
 
 	sctp_association_put(asoc);
 }

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email protected]>

[ Upstream commit 1e1cdf8ac78793e0875465e98a648df64694a8d0 ]

In function sctp_wake_up_waiters(), we need to involve a test if the association is declared dead. If so, we don't have any reference to a possible sibling association anymore and need to invoke sctp_write_space() instead, and normally walk the socket's associations and notify them of new wmem space. The reason for special casing is that otherwise, we could run into the following issue when a sctp_primitive_SEND() call from sctp_sendmsg() fails, and tries to flush an association's outq, i.e. in the following way:

sctp_association_free()
`-> list_del(&asoc->asocs) <-- poisons list pointer

    asoc->base.dead = true
    sctp_outq_free(&asoc->outqueue)
    `-> __sctp_outq_teardown()
     `-> sctp_chunk_free()
      `-> consume_skb()
       `-> sctp_wfree()
        `-> sctp_wake_up_waiters() <-- dereferences poisoned pointers
                                       if asoc->ep->sndbuf_policy=0

Therefore, only walk the list in an 'optimized' way if we find that the current association is still active. We could also use list_del_init() in addition when we call sctp_association_free(), but as Vlad suggests, we want to trap such bugs and thus leave it poisoned as is.

Why is it safe to resolve the issue by testing for asoc->base.dead? Parallel calls to sctp_sendmsg() are protected under socket lock, that is lock_sock()/release_sock(). Only within that path under lock held, we're setting skb/chunk owner via sctp_set_owner_w(). Eventually, chunks are freed directly by an association still under that lock. So when traversing association list on destruction time from sctp_wake_up_waiters() via sctp_wfree(), a different CPU can't be running sctp_wfree() while another one calls sctp_association_free() as both happens under the same lock. Therefore, this can also not race with setting/testing against asoc->base.dead as we are guaranteed for this to happen in order, under lock. Further, Vlad says: the times we check asoc->base.dead is when we've cached an association pointer for later processing. In between cache and processing, the association may have been freed and is simply still around due to reference counts. We check asoc->base.dead under a lock, so it should always be safe to check and not race against sctp_association_free(). Stress-testing seems fine now, too.

---
 net/sctp/socket.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -6380,6 +6380,12 @@ static void sctp_wake_up_waiters(struct
 	if (asoc->ep->sndbuf_policy)
 		return __sctp_write_space(asoc);
 
+	/* If association goes down and is just flushing its
+	 * outq, then just normally notify others.
+	 */
+	if (asoc->base.dead)
+		return sctp_write_space(sk);
+
 	/* Accounting for the sndbuf space is per socket, so we
 	 * need to wake up others, try to be fair and in case of
 	 * other associations, let them have a go first instead

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Petukhov <[email protected]>

[ Upstream commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba ]

When l2tp driver tries to get PMTU for the tunnel destination, it uses the pointer to struct sock that represents PPPoX socket, while it should use the pointer that represents UDP socket of the tunnel.

---
 net/l2tp/l2tp_ppp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -772,9 +772,9 @@ static int pppol2tp_connect(struct socke
 	session->deref = pppol2tp_session_sock_put;
 
 	/* If PMTU discovery was enabled, use the MTU that was discovered */
-	dst = sk_dst_get(sk);
+	dst = sk_dst_get(tunnel->sock);
 	if (dst != NULL) {
-		u32 pmtu = dst_mtu(__sk_dst_get(sk));
+		u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
 		if (pmtu != 0)
 			session->mtu = session->mru = pmtu -
 				PPPOL2TP_HEADER_OVERHEAD;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Westphal <[email protected]>

[ Upstream commit 6d39d589bb76ee8a1c6cde6822006ae0053decff ]

In case of tcp, gso_size contains the tcpmss.

For UFO (udp fragmentation offloading) skbs, gso_size is the fragment payload size, i.e. we must not account for udp header size.

Otherwise, when using virtio drivers, a to-be-forwarded UFO GSO packet will be needlessly fragmented in the forward path, because we think its individual segments are too large for the outgoing link.

---
 net/core/skbuff.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

@@ -3297,12 +3297,14 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding)
 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
 	const struct skb_shared_info *shinfo = skb_shinfo(skb);
-	unsigned int hdr_len;
 
 	if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-		hdr_len = tcp_hdrlen(skb);
-	else
-		hdr_len = sizeof(struct udphdr);
-	return hdr_len + shinfo->gso_size;
+		return tcp_hdrlen(skb) + shinfo->gso_size;
+
+	/* UFO sets gso_size to the size of the fragmentation
+	 * payload, i.e. the size of the L4 (UDP) header is already
+	 * accounted for.
+	 */
+	return shinfo->gso_size;
 }
 EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Richter <[email protected]>

[ Upstream commit db29868653394937037d71dc3545768302dda643 ]

Remove the bonding debug_fs entries when the module initialization fails. The debug_fs
entries should be removed together with all other already allocated resources.

---
 drivers/net/bonding/bond_main.c |    1 +
 1 file changed, 1 insertion(+)

@@ -4930,6 +4930,7 @@ static int __init bonding_init(void)
 out:
 	return res;
 err:
+	bond_destroy_debugfs();
 	rtnl_link_unregister(&bond_link_ops);
 err_link:
 	unregister_pernet_subsys(&bond_net_ops);

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 30f78d8ebf7f514801e71b88a10c948275168518 ]

Francois reported that setting big mtu on loopback device could prevent tcp sessions making progress.

We do not support (yet ?) IPv6 Jumbograms and cook corrupted packets.

We must limit the IPv6 MTU to (65535 + 40) bytes in theory.

Tested:

ifconfig lo mtu 70000
netperf -H ::1

Before patch : Throughput : 0.05 Mbits

After patch : Throughput : 35484 Mbits

---
 include/net/ip6_route.h |    5 +++++
 net/ipv6/route.c        |    5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)

@@ -34,6 +34,11 @@ struct route_info {
 #define RT6_LOOKUP_F_SRCPREF_PUBLIC	0x00000010
 #define RT6_LOOKUP_F_SRCPREF_COA	0x00000020
 
+/* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
+ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
+ */
+#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr))
+
 /*
  * rt6_srcprefs2flags() and rt6_flags2srcprefs() translate
  * between IPV6_ADDR_PREFERENCES socket option values

@@ -1092,7 +1092,7 @@ static unsigned int ip6_mtu(const struct
 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
 
 	if (mtu)
-		return mtu;
+		goto out;
 
 	mtu = IPV6_MIN_MTU;
 

@@ -1102,7 +1102,8 @@ static unsigned int ip6_mtu(const struct
 		mtu = idev->cnf.mtu6;
 	rcu_read_unlock();
 
-	return mtu;
+out:
+	return min_t(unsigned int, mtu, IP6_MAX_MTU);
 }
 
 static struct dst_entry *icmp6_dst_gc_list;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Wang, Xiaoming" <[email protected]>

[ Upstream commit b04c46190219a4f845e46a459e3102137b7f6cac ]

Plug a group_info refcount leak in ping_init. group_info is only needed during initialization and the code failed to release the reference on exit. While here move grabbing the reference to a place where it is actually needed.

---
 net/ipv4/ping.c |   15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

@@ -203,26 +203,33 @@ static int ping_init_sock(struct sock *s
 	struct net *net = sock_net(sk);
 	gid_t group = current_egid();
 	gid_t range[2];
-	struct group_info *group_info = get_current_groups();
-	int i, j, count = group_info->ngroups;
+	struct group_info *group_info;
+	int i, j, count;
+	int ret = 0;
 
 	inet_get_ping_group_range_net(net, range, range+1);
 	if (range[0] <= group && group <= range[1])
 		return 0;
 
+	group_info = get_current_groups();
+	count = group_info->ngroups;
 	for (i = 0; i < group_info->nblocks; i++) {
 		int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
 
 		for (j = 0; j < cp_count; j++) {
 			group = group_info->blocks[i][j];
 			if (range[0] <= group && group <= range[1])
-				return 0;
+				goto out_release_group;
 		}
 
 		count -= cp_count;
 	}
 
-	return -EACCES;
+	ret = -EACCES;
+
+out_release_group:
+	put_group_info(group_info);
+	return ret;
 }
 
 static void ping_close(struct sock *sk, long timeout)

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mathias Krause <[email protected]>

[ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]

The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check for a minimal message length before testing the supplied offset to be within the bounds of the message. This allows the subtraction of the nla header to underflow and therefore -- as the data type is unsigned -- allowing far to big offset and length values for the search of the netlink attribute.

The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is also wrong. It has the minuend and subtrahend mixed up, therefore calculates a huge length value, allowing to overrun the end of the message while looking for the netlink attribute.

The following three BPF snippets will trigger the bugs when attached to a UNIX datagram socket and parsing a message with length 1, 2 or 3.

,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--

 | ld	#0x87654321
 | ldx	#42
 | ld	#nla
 | ret	a

`---

,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--

 | ld	#0x87654321
 | ldx	#42
 | ld	#nlan
 | ret	a

`---

,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--

 | ; (needs a fake netlink header at offset 0)
 | ld	#0
 | ldx	#42
 | ld	#nlan
 | ret	a

`---

Fix the first issue by ensuring the message length fulfills the minimal size constrains of a nla header. Fix the second bug by getting the math for the remainder calculation right.

---
 net/core/filter.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -338,11 +338,15 @@ load_b:
 
 			if (skb_is_nonlinear(skb))
 				return 0;
+			if (skb->len < sizeof(struct nlattr))
+				return 0;
+			if (skb->len < sizeof(struct nlattr))
+				return 0;
 			if (A > skb->len - sizeof(struct nlattr))
 				return 0;
 
 			nla = (struct nlattr *)&skb->data[A];
-			if (nla->nla_len > A - skb->len)
+			if (nla->nla_len > skb->len - A)
 				return 0;
 
 			nla = nla_find_nested(nla, X);

This seems to be due to a bug in patch <https://bugs.debian.org/717782>.
I had the same problem when initially trying to fix this in 3.14. The first two inserted lines should be 16 lines further up.

Ben.

Ben Hutchings
I say we take off; nuke the site from orbit.  It's the only way to be sure.

Awesome! Thank you both for clarifying that.

Cheers,
--
Lu�s

Good catch! The diff should look more like the the one in the attachment. I guess patch(1) just failed here to find the right place to apply the hunk to.

Thanks,
Mathias

index 6f755cc..3b7398a 100644
@@ -322,6 +322,8 @@ load_b:
 
 			if (skb_is_nonlinear(skb))
 				return 0;
+			if (skb->len < sizeof(struct nlattr))
+				return 0;
 			if (A > skb->len - sizeof(struct nlattr))
 				return 0;
 

@@ -338,11 +340,13 @@ load_b:
 
 			if (skb_is_nonlinear(skb))
 				return 0;
+			if (skb->len < sizeof(struct nlattr))
+				return 0;
 			if (A > skb->len - sizeof(struct nlattr))
 				return 0;
 
 			nla = (struct nlattr *)&skb->data[A];
-			if (nla->nla_len > A - skb->len)
+			if (nla->nla_len > skb->len - A)
 				return 0;
 
 			nla = nla_find_nested(nla, X);

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ivan Vecera <[email protected]>

The patch fixes a problem with dropped jumbo frames after usage of 'ethtool -G ... rx'.

Scenario:
1. ip link set eth0 up
2. ethtool -G eth0 rx N # <- This zeroes rx-jumbo
3. ip link set mtu 9000 dev eth0

The ethtool command set rx_jumbo_pending to zero so any received jumbo packets are dropped and you need to use 'ethtool -G eth0 rx-jumbo N' to workaround the issue.
The patch changes the logic so rx_jumbo_pending value is changed only if jumbo frames are enabled (MTU > 1500).

---
 drivers/net/ethernet/broadcom/tg3.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -10861,7 +10861,9 @@ static int tg3_set_ringparam(struct net_
 	if (tg3_flag(tp, MAX_RXPEND_64) &&
 	    tp->rx_pending > 63)
 		tp->rx_pending = 63;
-	tp->rx_jumbo_pending = ering->rx_jumbo_pending;
+
+	if (tg3_flag(tp, JUMBO_RING_ENABLE))
+		tp->rx_jumbo_pending = ering->rx_jumbo_pending;
 
 	for (i = 0; i < tp->irq_max; i++)
 		tp->napi[i].tx_pending = ering->tx_pending;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Gibson <[email protected]>

[ Upstream commit 973462bbde79bb827824c73b59027a0aed5c9ca6 ]

Without IFLA_EXT_MASK specified, the information reported for a single interface in response to RTM_GETLINK is expected to fit within a netlink packet of NLMSG_GOODSIZE.

If it doesn't, however, things will go badly wrong, When listing all interfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first message in a packet as the end of the listing and omit information for that interface and all subsequent ones. This can cause getifaddrs(3) to enter an infinite loop.

This patch won't fix the problem, but it will WARN_ON() making it easier to track down what's going wrong.

---
 net/core/rtnetlink.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

@@ -1059,6 +1059,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
 	struct hlist_node *node;
 	struct nlattr *tb[IFLA_MAX+1];
 	u32 ext_filter_mask = 0;
+	int err;
 
 	s_h = cb->args[0];
 	s_idx = cb->args[1];

@@ -1079,11 +1080,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
 		hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
 			if (idx < s_idx)
 				goto cont;
-			if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-					     NETLINK_CB(cb->skb).pid,
-					     cb->nlh->nlmsg_seq, 0,
-					     NLM_F_MULTI,
-					     ext_filter_mask) <= 0)
+			err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+					       NETLINK_CB(cb->skb).pid,
+					       cb->nlh->nlmsg_seq, 0,
+					       NLM_F_MULTI,
+					       ext_filter_mask);
+			/* If we ran out of room on the first message,
+			 * we're in trouble
+			 */
+			WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
+
+			if (err <= 0)
 				goto out;
 
 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Gibson <[email protected]>

[ Upstream commit c53864fd60227de025cb79e05493b13f69843971 ]

Since 115c9b81928360d769a76c632bae62d15206a94a (rtnetlink: Fix problem with buffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST attribute if they were solicited by a GETLINK message containing an IFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.

That was done because some user programs broke when they received more data than expected - because IFLA_VFINFO_LIST contains information for each VF it can become large if there are many VFs.

However, the IFLA_VF_PORTS attribute, supplied for devices which implement ndo_get_vf_port (currently the 'enic' driver only), has the same problem. It supplies per-VF information and can therefore become large, but it is not currently conditional on the IFLA_EXT_MASK value.

Worse, it interacts badly with the existing EXT_MASK handling. When IFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at NLMSG_GOODSIZE. If the information for IFLA_VF_PORTS exceeds this, then rtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet. netlink_dump() will misinterpret this as having finished the listing and omit data for this interface and all subsequent ones. That can cause getifaddrs(3) to enter an infinite loop.

This patch addresses the problem by only supplying IFLA_VF_PORTS when IFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.

---
 net/core/rtnetlink.c |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

@@ -746,7 +746,8 @@ static inline int rtnl_vfinfo_size(const
 		return 0;
 }
 
-static size_t rtnl_port_size(const struct net_device *dev)
+static size_t rtnl_port_size(const struct net_device *dev,
+			     u32 ext_filter_mask)
 {
 	size_t port_size = nla_total_size(4)		/* PORT_VF */
 		+ nla_total_size(PORT_PROFILE_MAX)	/* PORT_PROFILE */

@@ -762,7 +763,8 @@ static size_t rtnl_port_size(const struc
 	size_t port_self_size = nla_total_size(sizeof(struct nlattr))
 		+ port_size;
 
-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+	    !(ext_filter_mask & RTEXT_FILTER_VF))
 		return 0;
 	if (dev_num_vf(dev->dev.parent))
 		return port_self_size + vf_ports_size +

@@ -793,7 +795,7 @@ static noinline size_t if_nlmsg_size(con
 	       + nla_total_size(ext_filter_mask
 			        & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
 	       + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
-	       + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+	       + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
 	       + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
 	       + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
 }

@@ -853,11 +855,13 @@ static int rtnl_port_self_fill(struct sk
 	return 0;
 }
 
-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
+static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
+			  u32 ext_filter_mask)
 {
 	int err;
 
-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+	    !(ext_filter_mask & RTEXT_FILTER_VF))
 		return 0;
 
 	err = rtnl_port_self_fill(skb, dev);

@@ -1004,7 +1008,7 @@ static int rtnl_fill_ifinfo(struct sk_bu
 		nla_nest_end(skb, vfinfo);
 	}
 
-	if (rtnl_port_fill(skb, dev))
+	if (rtnl_port_fill(skb, dev, ext_filter_mask))
 		goto nla_put_failure;
 
 	if (dev->rtnl_link_ops) {

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vlad Yasevich <[email protected]>

[ Upstream commit f114890cdf84d753f6b41cd0cc44ba51d16313da ]

This reverts commit 12a2856b604476c27d85a5f9a57ae1661fc46019. The commit above doesn't appear to be necessary any more as the checksums appear to be correctly computed/validated.

Additionally the above commit breaks kvm configurations where one VM is using a device that support checksum offload (virtio) and the other VM does not.
In this case, packets leaving virtio device will have CHECKSUM_PARTIAL set. The packets is forwarded to a macvtap that has offload features turned off. Since we use CHECKSUM_UNNECESSARY, the host does does not update the checksum and thus a bad checksum is passed up to the guest.

---
 drivers/net/macvlan.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -237,11 +237,9 @@ static int macvlan_queue_xmit(struct sk_
 	const struct macvlan_dev *vlan = netdev_priv(dev);
 	const struct macvlan_port *port = vlan->port;
 	const struct macvlan_dev *dest;
-	__u8 ip_summed = skb->ip_summed;
 
 	if (vlan->mode == MACVLAN_MODE_BRIDGE) {
 		const struct ethhdr *eth = (void *)skb->data;
-		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 		/* send to other bridge ports directly */
 		if (is_multicast_ether_addr(eth->h_dest)) {

@@ -259,7 +257,6 @@ static int macvlan_queue_xmit(struct sk_
 	}
 
 xmit_world:
-	skb->ip_summed = ip_summed;
 	skb->dev = vlan->lowerdev;
 	return dev_queue_xmit(skb);
 }

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Liu Yu <[email protected]>

[ Upstream commit 0cda345d1b2201dd15591b163e3c92bad5191745 ]

commit b9f47a3aaeab (tcp_cubic: limit delayed_ack ratio to prevent divide error) try to prevent divide error, but there is still a little chance that delayed_ack can reach zero. In case the param cnt get negative value, then ratio+cnt would overflow and may happen to be zero. As a result, min(ratio, ACK_RATIO_LIMIT) will calculate to be zero.

In some old kernels, such as 2.6.32, there is a bug that would pass negative param, which then ultimately leads to this divide error.

commit 5b35e1e6e9c (tcp: fix tcp_trim_head() to adjust segment count with skb MSS) fixed the negative param issue. However, it's safe that we fix the range of delayed_ack as well, to make sure we do not hit a divide by zero.

---
 net/ipv4/tcp_cubic.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -408,7 +408,7 @@ static void bictcp_acked(struct sock *sk
 		ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
 		ratio += cnt;
 
-		ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
+		ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
 	}
 
 	/* Some calls are for duplicates without timetamps */

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Westphal <[email protected]>

[ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]

local_df means 'ignore DF bit if set', so if its set we're allowed to perform ip fragmentation.

This wasn't noticed earlier because the output path also drops such skbs (and emits needed icmp error) and because netfilter ip defrag did not set local_df until couple of days ago.

Only difference is that DF-packets-larger-than MTU now discarded earlier (f.e. we avoid pointless netfilter postrouting trip).

While at it, drop the repeated test ip_exceeds_mtu, checking it once is enough...

---
 net/ipv4/ip_forward.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -42,12 +42,12 @@
 static bool ip_may_fragment(const struct sk_buff *skb)
 {
 	return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
-	       !skb->local_df;
+		skb->local_df;
 }
 
 static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
 {
-	if (skb->len <= mtu || skb->local_df)
+	if (skb->len <= mtu)
 		return false;
 
 	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergey Popovich <[email protected]>

[ Upstream commit aeefa1ecfc799b0ea2c4979617f14cecd5cccbfd ]

Increment fib_info_cnt in fib_create_info() right after successfuly alllocating fib_info structure, overwise fib_metrics allocation failure leads to fib_info_cnt incorrectly decremented in free_fib_info(), called on error path from fib_create_info().

---
 net/ipv4/fib_semantics.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -751,13 +751,13 @@ struct fib_info *fib_create_info(struct
 	fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
 	if (fi == NULL)
 		goto failure;
+	fib_info_cnt++;
 	if (cfg->fc_mx) {
 		fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
 		if (!fi->fib_metrics)
 			goto failure;
 	} else
 		fi->fib_metrics = (u32 *) dst_default_metrics;
-	fib_info_cnt++;
 
 	fi->fib_net = hold_net(net);
 	fi->fib_protocol = cfg->fc_protocol;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jason Wang <[email protected]>

[ Upstream commit 16c0b164bd24d44db137693a36b428ba28970c62 ]

We drop packet unconditionally when we fail to mirror it. This is not intended in some cases. Consdier for kvm guest, we may mirror the traffic of the bridge to a tap device used by a VM. When kernel fails to mirror the packet in conditions such as when qemu crashes or stop polling the tap, it's hard for the management software to detect such condition and clean the the mirroring before. This would lead all packets to the bridge to be dropped and break the netowrk of other virtual machines.

To solve the issue, the patch does not drop packets when kernel fails to mirror it, and only drop the redirected packets.

---
 net/sched/act_mirred.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

@@ -201,13 +201,12 @@ static int tcf_mirred(struct sk_buff *sk
 out:
 	if (err) {
 		m->tcf_qstats.overlimits++;
-		/* should we be asking for packet to be dropped?
-		 * may make sense for redirect case only
-		 */
-		retval = TC_ACT_SHOT;
-	} else {
+		if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
+			retval = TC_ACT_SHOT;
+		else
+			retval = m->tcf_action;
+	} else
 		retval = m->tcf_action;
-	}
 	spin_unlock(&m->tcf_lock);
 
 	return retval;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Li RongQing <[email protected]>

[ Upstream commit fbdc0ad095c0a299e9abf5d8ac8f58374951149a ]

the value of itag is a random value from stack, and may not be initiated by fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID is not set

This will make the cached dst uncertainty

---
 net/ipv4/route.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2129,7 +2129,7 @@ static int __mkroute_input(struct sk_buf
 	struct in_device *out_dev;
 	unsigned int flags = 0;
 	__be32 spec_dst;
-	u32 itag;
+	u32 itag = 0;
 
 	/* get a working reference to the output device */
 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Duyck <[email protected]>

[ Upstream commit ec47ea82477404631d49b8e568c71826c9b663ac ]

With the recent changes for how we compute the skb truesize it occurs to me we are probably going to have a lot of calls to skb_end_pointer - skb->head. Instead of running all over the place doing that it would make more sense to just make it a separate inline skb_end_offset(skb) that way we can return the correct value without having gcc having to do all the optimization to cancel out skb->head - skb->head.

---
 drivers/atm/ambassador.c             |    2 +-
 drivers/atm/idt77252.c               |    2 +-
 drivers/net/wimax/i2400m/usb-rx.c    |    2 +-
 drivers/staging/octeon/ethernet-tx.c |    2 +-
 include/linux/skbuff.h               |   12 +++++++++++-
 net/core/skbuff.c                    |    9 ++++-----
 6 files changed, 19 insertions(+), 10 deletions(-)

@@ -802,7 +802,7 @@ static void fill_rx_pool (amb_dev * dev,
     }
     // cast needed as there is no %? for pointer differences
     PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
-	    skb, skb->head, (long) (skb_end_pointer(skb) - skb->head));
+	    skb, skb->head, (long) skb_end_offset(skb));
     rx.handle = virt_to_bus (skb);
     rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
     if (rx_give (dev, &rx, pool))

@@ -1258,7 +1258,7 @@ idt77252_rx_raw(struct idt77252_dev *car
 	tail = readl(SAR_REG_RAWCT);
 
 	pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(queue),
-				    skb_end_pointer(queue) - queue->head - 16,
+				    skb_end_offset(queue) - 16,
 				    PCI_DMA_FROMDEVICE);
 
 	while (head != tail) {

@@ -277,7 +277,7 @@ retry:
 		d_printf(1, dev, "RX: size changed to %d, received %d, "
 			 "copied %d, capacity %ld\n",
 			 rx_size, read_size, rx_skb->len,
-			 (long) (skb_end_pointer(new_skb) - new_skb->head));
+			 (long) skb_end_offset(new_skb));
 		goto retry;
 	}
 		/* In most cases, it happens due to the hardware scheduling a

@@ -345,7 +345,7 @@ int cvm_oct_xmit(struct sk_buff *skb, st
 	}
 	if (unlikely
 	    (skb->truesize !=
-	     sizeof(*skb) + skb_end_pointer(skb) - skb->head)) {
+	     sizeof(*skb) + skb_end_offset(skb))) {
 		/*
 		   printk("TX buffer truesize has been changed\n");
 		 */

@@ -640,11 +640,21 @@ static inline unsigned char *skb_end_poi
 {
 	return skb->head + skb->end;
 }
+
+static inline unsigned int skb_end_offset(const struct sk_buff *skb)
+{
+	return skb->end;
+}
 #else
 static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
 {
 	return skb->end;
 }
+
+static inline unsigned int skb_end_offset(const struct sk_buff *skb)
+{
+	return skb->end - skb->head;
+}
 #endif
 
 /* Internal */

@@ -2574,7 +2584,7 @@ static inline bool skb_is_recycleable(co
 		return false;
 
 	skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
-	if (skb_end_pointer(skb) - skb->head < skb_size)
+	if (skb_end_offset(skb) < skb_size)
 		return false;
 
 	if (skb_shared(skb) || skb_cloned(skb))

@@ -821,7 +821,7 @@ static void copy_skb_header(struct sk_bu
 struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
 {
 	int headerlen = skb_headroom(skb);
-	unsigned int size = (skb_end_pointer(skb) - skb->head) + skb->data_len;
+	unsigned int size = skb_end_offset(skb) + skb->data_len;
 	struct sk_buff *n = alloc_skb(size, gfp_mask);
 
 	if (!n)

@@ -922,7 +922,7 @@ int pskb_expand_head(struct sk_buff *skb
 {
 	int i;
 	u8 *data;
-	int size = nhead + (skb_end_pointer(skb) - skb->head) + ntail;
+	int size = nhead + skb_end_offset(skb) + ntail;
 	long off;
 	bool fastpath;
 

@@ -2721,14 +2721,13 @@ struct sk_buff *skb_segment(struct sk_bu
 			if (unlikely(!nskb))
 				goto err;
 
-			hsize = skb_end_pointer(nskb) - nskb->head;
+			hsize = skb_end_offset(nskb);
 			if (skb_cow_head(nskb, doffset + headroom)) {
 				kfree_skb(nskb);
 				goto err;
 			}
 
-			nskb->truesize += skb_end_pointer(nskb) - nskb->head -
-					  hsize;
+			nskb->truesize += skb_end_offset(nskb) - hsize;
 			skb_release_head_state(nskb);
 			__skb_push(nskb, doffset);
 		} else {

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb ]

Recycling skb always had been very tough...

This time it appears GRO layer can accumulate skb->truesize adjustments made by drivers when they attach a fragment to skb.

skb_gro_receive() can only subtract from skb->truesize the used part of a fragment.

I spotted this problem seeing TcpExtPruneCalled and TcpExtTCPRcvCollapsed that were unexpected with a recent kernel, where TCP receive window should be sized properly to accept traffic coming from a driver not overshooting skb->truesize.

---
 net/core/dev.c |    1 +
 1 file changed, 1 insertion(+)

@@ -3574,6 +3574,7 @@ static void napi_reuse_skb(struct napi_s
 	skb->vlan_tci = 0;
 	skb->dev = napi->dev;
 	skb->skb_iif = 0;
+	skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
 
 	napi->skb = skb;
 }

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit 866293ee54227584ffcb4a42f69c1f365974ba7f upstream.

Dave Jones trinity syscall fuzzer exposed an issue in the deadlock detection code of rtmutex:
http://lkml.kernel.org/r/[email protected]

That underlying issue has been fixed with a patch to the rtmutex code, but the futex code must not call into rtmutex in that case because
- it can detect that issue early
- it avoids a different and more complex fixup for backing out

If the user space variable got manipulated to 0x80000000 which means no lock holder, but the waiters bit set and an active pi_state in the kernel is found we can figure out the recursive locking issue by looking at the pi_state owner. If that is the current task, then we can safely return -EDEADLK.

The check should have been added in commit 59fa62451 (futex: Handle futex_pi OWNER_DIED take over correctly) already, but I did not see the above issue caused by user space manipulation back then.

---
 kernel/futex.c |   47 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 34 insertions(+), 13 deletions(-)

@@ -590,7 +590,8 @@ void exit_pi_state_list(struct task_stru
 
 static int
 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
-		union futex_key *key, struct futex_pi_state **ps)
+		union futex_key *key, struct futex_pi_state **ps,
+		struct task_struct *task)
 {
 	struct futex_pi_state *pi_state = NULL;
 	struct futex_q *this, *next;

@@ -634,6 +635,16 @@ lookup_pi_state(u32 uval, struct futex_h
 					return -EINVAL;
 			}
 
+			/*
+			 * Protect against a corrupted uval. If uval
+			 * is 0x80000000 then pid is 0 and the waiter
+			 * bit is set. So the deadlock check in the
+			 * calling code has failed and we did not fall
+			 * into the check above due to !pid.
+			 */
+			if (task && pi_state->owner == task)
+				return -EDEADLK;
+
 			atomic_inc(&pi_state->refcount);
 			*ps = pi_state;
 

@@ -783,7 +794,7 @@ retry:
 	 * We dont have the lock. Look up the PI state (or create it if
 	 * we are the first waiter):
 	 */
-	ret = lookup_pi_state(uval, hb, key, ps);
+	ret = lookup_pi_state(uval, hb, key, ps, task);
 
 	if (unlikely(ret)) {
 		switch (ret) {

@@ -1193,7 +1204,7 @@ void requeue_pi_wake_futex(struct futex_
  *
  * Returns:
  *  0 - failed to acquire the lock atomicly
- *  1 - acquired the lock
+ * >0 - acquired the lock, return value is vpid of the top_waiter
  * <0 - error
  */
 static int futex_proxy_trylock_atomic(u32 __user *pifutex,

@@ -1204,7 +1215,7 @@ static int futex_proxy_trylock_atomic(u3
 {
 	struct futex_q *top_waiter = NULL;
 	u32 curval;
-	int ret;
+	int ret, vpid;
 
 	if (get_futex_value_locked(&curval, pifutex))
 		return -EFAULT;

@@ -1232,11 +1243,13 @@ static int futex_proxy_trylock_atomic(u3
 	 * the contended case or if set_waiters is 1.  The pi_state is returned
 	 * in ps in contended cases.
 	 */
+	vpid = task_pid_vnr(top_waiter->task);
 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
 				   set_waiters);
-	if (ret == 1)
+	if (ret == 1) {
 		requeue_pi_wake_futex(top_waiter, key2, hb2);
-
+		return vpid;
+	}
 	return ret;
 }
 

@@ -1268,7 +1281,6 @@ static int futex_requeue(u32 __user *uad
 	struct futex_hash_bucket *hb1, *hb2;
 	struct plist_head *head1;
 	struct futex_q *this, *next;
-	u32 curval2;
 
 	if (requeue_pi) {
 		/*

@@ -1354,16 +1366,25 @@ retry_private:
 		 * At this point the top_waiter has either taken uaddr2 or is
 		 * waiting on it.  If the former, then the pi_state will not
 		 * exist yet, look it up one more time to ensure we have a
-		 * reference to it.
+		 * reference to it. If the lock was taken, ret contains the
+		 * vpid of the top waiter task.
 		 */
-		if (ret == 1) {
+		if (ret > 0) {
 			WARN_ON(pi_state);
 			drop_count++;
 			task_count++;
-			ret = get_futex_value_locked(&curval2, uaddr2);
-			if (!ret)
-				ret = lookup_pi_state(curval2, hb2, &key2,
-						      &pi_state);
+			/*
+			 * If we acquired the lock, then the user
+			 * space value of uaddr2 should be vpid. It
+			 * cannot be changed by the top waiter as it
+			 * is blocked on hb2 lock if it tries to do
+			 * so. If something fiddled with it behind our
+			 * back the pi state lookup might unearth
+			 * it. So we rather use the known value than
+			 * rereading and handing potential crap to
+			 * lookup_pi_state.
+			 */
+			ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
 		}
 
 		switch (ret) {

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream.

We happily allow userspace to declare a random kernel thread to be the owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find some fast way to validate whether the "alleged" owner has RW access on the file which backs the SHM, but that's a separate issue.

---
 kernel/futex.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -662,6 +662,11 @@ lookup_pi_state(u32 uval, struct futex_h
 	if (!p)
 		return -ESRCH;
 
+	if (!p->mm) {
+		put_task_struct(p);
+		return -EPERM;
+	}
+
 	/*
 	 * We need to look at the task state flags to figure out,
 	 * whether the task is exiting. To protect against the do_exit

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <[email protected]>

commit a949ae560a511fe4e3adf48fa44fefded93e5c2b upstream.

A race exists between module loading and enabling of function tracer.

	CPU 1				CPU 2
	-----				-----

load_module()
module->state = MODULE_STATE_COMING

				register_ftrace_function()
				 mutex_lock(&ftrace_lock);
				 ftrace_startup()
				  update_ftrace_function();
				   ftrace_arch_code_modify_prepare()
				    set_all_module_text_rw();
				   <enables-ftrace>
				    ftrace_arch_code_modify_post_process()
				     set_all_module_text_ro();

				[ here all module text is set to RO,
				  including the module that is
				  loading!! ]

   blocking_notifier_call_chain(MODULE_STATE_COMING);
    ftrace_init_module()

[ tries to modify code, but it's RO, and fails!
ftrace_bug() is called]

When this race happens, ftrace_bug() will produces a nasty warning and all of the function tracing features will be disabled until reboot.

The simple solution is to treate module load the same way the core kernel is treated at boot. To hardcode the ftrace function modification of converting calls to mcount into nops. This is done in init/main.c there's no reason it could not be done in load_module(). This gives a better control of the changes and doesn't tie the state of the module to its notifiers as much. Ftrace is special, it needs to be treated as such.

The reason this would work, is that the ftrace_module_init() would be called while the module is in MODULE_STATE_UNFORMED, which is ignored by the set_all_module_text_ro() call.

---
 include/linux/ftrace.h |    2 ++
 kernel/module.c        |    3 +++
 kernel/trace/ftrace.c  |   27 ++++-----------------------
 3 files changed, 9 insertions(+), 23 deletions(-)

@@ -374,6 +374,7 @@ extern int ftrace_make_call(struct dyn_f
 extern int ftrace_arch_read_dyn_info(char *buf, int size);
 
 extern int skip_trace(unsigned long ip);
+extern void ftrace_module_init(struct module *mod);
 
 extern void ftrace_disable_daemon(void);
 extern void ftrace_enable_daemon(void);

@@ -383,6 +384,7 @@ static inline int ftrace_force_update(vo
 static inline void ftrace_disable_daemon(void) { }
 static inline void ftrace_enable_daemon(void) { }
 static inline void ftrace_release_mod(struct module *mod) {}
+static inline void ftrace_module_init(struct module *mod) {}
 static inline int register_ftrace_command(struct ftrace_func_command *cmd)
 {
 	return -EINVAL;

@@ -2951,6 +2951,9 @@ static struct module *load_module(void _
 	/* This has to be done once we're sure module name is unique. */
 	dynamic_debug_setup(info.debug, info.num_debug);
 
+	/* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
+	ftrace_module_init(mod);
+
 	/* Find duplicate symbols */
 	err = verify_export_symbols(mod);
 	if (err < 0)

@@ -3880,16 +3880,11 @@ static void ftrace_init_module(struct mo
 	ftrace_process_locs(mod, start, end);
 }
 
-static int ftrace_module_notify_enter(struct notifier_block *self,
-				      unsigned long val, void *data)
+void ftrace_module_init(struct module *mod)
 {
-	struct module *mod = data;
-
-	if (val == MODULE_STATE_COMING)
-		ftrace_init_module(mod, mod->ftrace_callsites,
-				   mod->ftrace_callsites +
-				   mod->num_ftrace_callsites);
-	return 0;
+	ftrace_init_module(mod, mod->ftrace_callsites,
+			   mod->ftrace_callsites +
+			   mod->num_ftrace_callsites);
 }
 
 static int ftrace_module_notify_exit(struct notifier_block *self,

@@ -3903,11 +3898,6 @@ static int ftrace_module_notify_exit(str
 	return 0;
 }
 #else
-static int ftrace_module_notify_enter(struct notifier_block *self,
-				      unsigned long val, void *data)
-{
-	return 0;
-}
 static int ftrace_module_notify_exit(struct notifier_block *self,
 				     unsigned long val, void *data)
 {

@@ -3915,11 +3905,6 @@ static int ftrace_module_notify_exit(str
 }
 #endif /* CONFIG_MODULES */
 
-struct notifier_block ftrace_module_enter_nb = {
-	.notifier_call = ftrace_module_notify_enter,
-	.priority = INT_MAX,	/* Run before anything that can use kprobes */
-};
-
 struct notifier_block ftrace_module_exit_nb = {
 	.notifier_call = ftrace_module_notify_exit,
 	.priority = INT_MIN,	/* Run after anything that can remove kprobes */

@@ -3956,10 +3941,6 @@ void __init ftrace_init(void)
 				  __start_mcount_loc,
 				  __stop_mcount_loc);
 
-	ret = register_module_notifier(&ftrace_module_enter_nb);
-	if (ret)
-		pr_warning("Failed to register trace ftrace module enter notifier\n");
-
 	ret = register_module_notifier(&ftrace_module_exit_nb);
 	if (ret)
 		pr_warning("Failed to register trace ftrace module exit notifier\n");

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bartlomiej Zolnierkiewicz <[email protected]>

commit 27aa64b9d1bd0d23fd692c91763a48309b694311 upstream.

Add missing clk_put() call to ata_host_activate() failure path.

Sergei says,

"Hm, I have once fixed that (see that *if* (!ret)) but looks like a
later commit 477c87e90853d136b188c50c0e4a93d01cad872e (ARM:
at91/pata: use gpio_is_valid to check the gpio) broke it again. :-( Would be good if the changelog did mention that..."

---
 drivers/ata/pata_at91.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

@@ -408,12 +408,13 @@ static int __devinit pata_at91_probe(str
 
 	host->private_data = info;
 
-	return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
-			gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
-			irq_flags, &pata_at91_sht);
+	ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+				gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+				irq_flags, &pata_at91_sht);
+	if (ret)
+		goto err_put;
 
-	if (!ret)
-		return 0;
+	return 0;
 
 err_put:
 	clk_put(info->mck);

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <[email protected]>

commit 1b17844b29ae042576bea588164f2f1e9590a8bc upstream.

fixup_user_fault() is used by the futex code when the direct user access fails, and the futex code wants it to either map in the page in a usable form or return an error. It relied on handle_mm_fault() to map the page, and correctly checked the error return from that, but while that does map the page, it doesn't actually guarantee that the page will be mapped with sufficient permissions to be then accessed.

So do the appropriate tests of the vma access rights by hand.

[ Side note: arguably handle_mm_fault() could just do that itself, but
we have traditionally done it in the caller, because some callers - notably get_user_pages() - have been able to access pages even when they are mapped with PROT_NONE. Maybe we should re-visit that design decision, but in the meantime this is the minimal patch. ]

Found by Dave Jones running his trinity tool.

---
 mm/memory.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -1872,12 +1872,17 @@ int fixup_user_fault(struct task_struct
 		     unsigned long address, unsigned int fault_flags)
 {
 	struct vm_area_struct *vma;
+	vm_flags_t vm_flags;
 	int ret;
 
 	vma = find_extend_vma(mm, address);
 	if (!vma || address < vma->vm_start)
 		return -EFAULT;
 
+	vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
+	if (!(vm_flags & vma->vm_flags))
+		return -EFAULT;
+
 	ret = handle_mm_fault(mm, vma, address, fault_flags);
 	if (ret & VM_FAULT_ERROR) {
 		if (ret & VM_FAULT_OOM)

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiri Bohac <[email protected]>

commit 98a01e779f3c66b0b11cd7e64d531c0e41c95762 upstream.

On architectures with sizeof(int) < sizeof (long), the computation of mask inside apply_slack() can be undefined if the computed bit is > 32.

E.g. with: expires = 0xffffe6f5 and slack = 25, we get:

expires_limit = 0x20000000e
bit = 33
mask = (1 << 33) - 1 /* undefined */

On x86, mask becomes 1 and and the slack is not applied properly. On s390, mask is -1, expires is set to 0 and the timer fires immediately.

Use 1UL << bit to solve that issue.

---
 kernel/timer.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -815,7 +815,7 @@ unsigned long apply_slack(struct timer_l
 
 	bit = find_last_bit(&mask, BITS_PER_LONG);
 
-	mask = (1 << bit) - 1;
+	mask = (1UL << bit) - 1;
 
 	expires_limit = expires_limit & ~(mask);
 

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bodo Stroesser <[email protected]>

commit 48e8ac2979920ffa39117e2d725afa3a749bfe8d upstream.

With recent changes it is possible for the timer handler to detect an idle interface and not start the timer, but the thread to start an operation at the same time. The thread will not start the timer in that instance, resulting in the timer not running.

Instead, move all timer operations under the lock and start the timer in the thread if it detect non-idle and the timer is not already running. Moving under locks allows the last timeout to be set in both the thread and the timer. 'Timer is not running' means that the timer is not pending and smi_timeout() is not running. So we need a flag to detect this correctly.

Also fix a few other timeout bugs: setting the last timeout when the interrupt has to be disabled and the timer started, and setting the last timeout in check_start_timer_thread possibly racing with the timer

---
 drivers/char/ipmi/ipmi_si_intf.c |   46 +++++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 18 deletions(-)

@@ -244,6 +244,9 @@ struct smi_info {
 	/* The timer for this si. */
 	struct timer_list   si_timer;
 
+	/* This flag is set, if the timer is running (timer_pending() isn't enough) */
+	bool		    timer_running;
+
 	/* The time (in jiffies) the last timeout occurred at. */
 	unsigned long       last_timeout_jiffies;
 

@@ -427,6 +430,13 @@ static void start_clear_flags(struct smi
 	smi_info->si_state = SI_CLEARING_FLAGS;
 }
 
+static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
+{
+	smi_info->last_timeout_jiffies = jiffies;
+	mod_timer(&smi_info->si_timer, new_val);
+	smi_info->timer_running = true;
+}
+
 /*
  * When we have a situtaion where we run out of memory and cannot
  * allocate messages, we just leave them in the BMC and run the system

@@ -439,8 +449,7 @@ static inline void disable_si_irq(struct
 		start_disable_irq(smi_info);
 		smi_info->interrupt_disabled = 1;
 		if (!atomic_read(&smi_info->stop_operation))
-			mod_timer(&smi_info->si_timer,
-				  jiffies + SI_TIMEOUT_JIFFIES);
+			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
 	}
 }
 

@@ -896,15 +905,7 @@ static void sender(void                *
 		list_add_tail(&msg->link, &smi_info->xmit_msgs);
 
 	if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
-		/*
-		 * last_timeout_jiffies is updated here to avoid
-		 * smi_timeout() handler passing very large time_diff
-		 * value to smi_event_handler() that causes
-		 * the send command to abort.
-		 */
-		smi_info->last_timeout_jiffies = jiffies;
-
-		mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
+		smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
 
 		if (smi_info->thread)
 			wake_up_process(smi_info->thread);

@@ -993,6 +994,17 @@ static int ipmi_thread(void *data)
 
 		spin_lock_irqsave(&(smi_info->si_lock), flags);
 		smi_result = smi_event_handler(smi_info, 0);
+
+		/*
+		 * If the driver is doing something, there is a possible
+		 * race with the timer.  If the timer handler see idle,
+		 * and the thread here sees something else, the timer
+		 * handler won't restart the timer even though it is
+		 * required.  So start it here if necessary.
+		 */
+		if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
+			smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+
 		spin_unlock_irqrestore(&(smi_info->si_lock), flags);
 		busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
 						  &busy_until);

@@ -1062,10 +1074,6 @@ static void smi_timeout(unsigned long da
 		     * SI_USEC_PER_JIFFY);
 	smi_result = smi_event_handler(smi_info, time_diff);
 
-	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
-
-	smi_info->last_timeout_jiffies = jiffies_now;
-
 	if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
 		/* Running with interrupts, only do long timeouts. */
 		timeout = jiffies + SI_TIMEOUT_JIFFIES;

@@ -1087,7 +1095,10 @@ static void smi_timeout(unsigned long da
 
  do_mod_timer:
 	if (smi_result != SI_SM_IDLE)
-		mod_timer(&(smi_info->si_timer), timeout);
+		smi_mod_timer(smi_info, timeout);
+	else
+		smi_info->timer_running = false;
+	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
 }
 
 static irqreturn_t si_irq_handler(int irq, void *data)

@@ -1135,8 +1146,7 @@ static int smi_start_processing(void
 
 	/* Set up the timer that drives the interface. */
 	setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
-	new_smi->last_timeout_jiffies = jiffies;
-	mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
+	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
 
 	/*
 	 * Check if the user forcefully enabled the daemon.

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Corey Minyard <[email protected]>

commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.

The OBF timer in KCS was not reset in one situation when error recovery was started, resulting in an immediate timeout.

---
 drivers/char/ipmi/ipmi_kcs_sm.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm
 	if (!GET_STATUS_OBF(status)) {
 		kcs->obf_timeout -= time;
 		if (kcs->obf_timeout < 0) {
-		    start_error_recovery(kcs, "OBF not ready in time");
-		    return 1;
+			kcs->obf_timeout = OBF_RETRY_TIMEOUT;
+			start_error_recovery(kcs, "OBF not ready in time");
+			return 1;
 		}
 		return 0;
 	}

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Anthony Iliopoulos <[email protected]>

commit 9844f5462392b53824e8b86726e7c33b5ecbb676 upstream.

The invalidation is required in order to maintain proper semantics under CoW conditions. In scenarios where a process clones several threads, a thread operating on a core whose DTLB entry for a particular hugepage has not been invalidated, will be reading from the hugepage that belongs to the forked child process, even after hugetlb_cow().

The thread will not see the updated page as long as the stale DTLB entry remains cached, the thread attempts to write into the page, the child process exits, or the thread gets migrated to a different processor.

---
 arch/x86/include/asm/hugetlb.h |    1 +
 1 file changed, 1 insertion(+)

@@ -51,6 +51,7 @@ static inline pte_t huge_ptep_get_and_cl
 static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
 					 unsigned long addr, pte_t *ptep)
 {
+	ptep_clear_flush(vma, addr, ptep);
 }
 
 static inline int huge_pte_none(pte_t pte)

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chen Yucong <[email protected]>

commit b985194c8c0a130ed155b71662e39f7eaea4876f upstream.

For handling a free hugepage in memory failure, the race will happen if another thread hwpoisoned this hugepage concurrently. So we need to check PageHWPoison instead of !PageHWPoison.

If hwpoison_filter(p) returns true or a race happens, then we need to unlock_page(hpage).

---
 mm/memory-failure.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

@@ -1061,15 +1061,16 @@ int memory_failure(unsigned long pfn, in
 			return 0;
 		} else if (PageHuge(hpage)) {
 			/*
-			 * Check "just unpoisoned", "filter hit", and
-			 * "race with other subpage."
+			 * Check "filter hit" and "race with other subpage."
 			 */
 			lock_page(hpage);
-			if (!PageHWPoison(hpage)
-			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
-			    || (p != hpage && TestSetPageHWPoison(hpage))) {
-				atomic_long_sub(nr_pages, &mce_bad_pages);
-				return 0;
+			if (PageHWPoison(hpage)) {
+				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
+				    || (p != hpage && TestSetPageHWPoison(hpage))) {
+					atomic_long_sub(nr_pages, &mce_bad_pages);
+					unlock_page(hpage);
+					return 0;
+				}
 			}
 			set_page_hwpoison_huge_page(hpage);
 			res = dequeue_hwpoisoned_huge_page(hpage);

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Gajdusek <[email protected]>

commit 17c048fc4bd95efea208a1920f169547d8588f1f upstream.

Attempts to set the hysteresis value to a temperature below the target limit fails with "write error: Numerical result out of range" due to an inverted comparison.

---
 drivers/hwmon/emc1403.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -161,7 +161,7 @@ static ssize_t store_hyst(struct device
 	if (retval < 0)
 		goto fail;
 
-	hyst = val - retval * 1000;
+	hyst = retval * 1000 - val;
 	hyst = DIV_ROUND_CLOSEST(hyst, 1000);
 	if (hyst < 0 || hyst > 255) {
 		retval = -ERANGE;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Gajdusek <[email protected]>

commit 3a18e1398fc2dc9c32bbdc50664da3a77959a8d1 upstream.

The datasheet for EMC1413/EMC1414, which is fully compatible to EMC1403/1404 and uses the same chip identification, references revision numbers 0x01, 0x03, and 0x04. Accept the full range of revision numbers from 0x01 to 0x04 to make sure none are missed.

---
 drivers/hwmon/emc1403.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -294,7 +294,7 @@ static int emc1403_detect(struct i2c_cli
 	}
 
 	id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
-	if (id != 0x01)
+	if (id < 0x01 || id > 0x04)
 		return -ENODEV;
 
 	return 0;

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Grant Likely <[email protected]>

commit 58b116bce13612e5aa6fcd49ecbd4cf8bb59e835 upstream.

When the kernel is built with CONFIG_PREEMPT it is possible to reach a state when all modules loaded but some driver still stuck in the deferred list and there is a need for external event to kick the deferred queue to probe these drivers.

The issue has been observed on embedded systems with CONFIG_PREEMPT enabled, audio support built as modules and using nfsroot for root filesystem.

The following log fragment shows such sequence when all audio modules were loaded but the sound card is not present since the machine driver has failed to probe due to missing dependency during it's probe. The board is am335x-evmsk (McASP<->tlv320aic3106 codec) with davinci-evm machine driver:

...

[   12.615118] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: ENTER
[   12.719969] davinci_evm sound.3: davinci_evm_probe: ENTER
[   12.725753] davinci_evm sound.3: davinci_evm_probe: snd_soc_register_card
[   12.753846] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: snd_soc_register_component
[   12.922051] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: snd_soc_register_component DONE
[   12.950839] davinci_evm sound.3: ASoC: platform (null) not registered
[   12.957898] davinci_evm sound.3: davinci_evm_probe: snd_soc_register_card DONE (-517)
[   13.099026] davinci-mcasp 4803c000.mcasp: Kicking the deferred list
[   13.177838] davinci-mcasp 4803c000.mcasp: really_probe: probe_count = 2
[   13.194130] davinci_evm sound.3: snd_soc_register_card failed (-517)
[   13.346755] davinci_mcasp_driver_init: LEAVE
[   13.377446] platform sound.3: Driver davinci_evm requests probe deferral
[   13.592527] platform sound.3: really_probe: probe_count = 0

In the log the machine driver enters it's probe at 12.719969 (this point it has been removed from the deferred lists). McASP driver already executing it's probing (since 12.615118).
The machine driver tries to construct the sound card (12.950839) but did not found one of the components so it fails. After this McASP driver registers all the ASoC components (the machine driver still in it's probe function after it failed to construct the card) and the deferred work is prepared at 13.099026 (note that this time the machine driver is not in the lists so it is not going to be handled when the work is executing). Lastly the machine driver exit from it's probe and the core places it to the deferred list but there will be no other driver going to load and the deferred queue is not going to be kicked again - till we have external event like connecting USB stick, etc.

The proposed solution is to try the deferred queue once more when the last driver is asking for deferring and we had drivers loaded while this last driver was probing.

This way we can avoid drivers stuck in the deferred queue.

---
 drivers/base/dd.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

@@ -51,6 +51,7 @@ static DEFINE_MUTEX(deferred_probe_mutex
 static LIST_HEAD(deferred_probe_pending_list);
 static LIST_HEAD(deferred_probe_active_list);
 static struct workqueue_struct *deferred_wq;
+static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
 
 /**
  * deferred_probe_work_func() - Retry probing devices in the active list.

@@ -122,6 +123,17 @@ static bool driver_deferred_probe_enable
  * This functions moves all devices from the pending list to the active
  * list and schedules the deferred probe workqueue to process them.  It
  * should be called anytime a driver is successfully bound to a device.
+ *
+ * Note, there is a race condition in multi-threaded probe. In the case where
+ * more than one device is probing at the same time, it is possible for one
+ * probe to complete successfully while another is about to defer. If the second
+ * depends on the first, then it will get put on the pending list after the
+ * trigger event has already occured and will be stuck there.
+ *
+ * The atomic 'deferred_trigger_count' is used to determine if a successful
+ * trigger has occurred in the midst of probing a driver. If the trigger count
+ * changes in the midst of a probe, then deferred processing should be triggered
+ * again.
  */
 static void driver_deferred_probe_trigger(void)
 {

@@ -134,6 +146,7 @@ static void driver_deferred_probe_trigge
 	 * into the active list so they can be retried by the workqueue
 	 */
 	mutex_lock(&deferred_probe_mutex);
+	atomic_inc(&deferred_trigger_count);
 	list_splice_tail_init(&deferred_probe_pending_list,
 			      &deferred_probe_active_list);
 	mutex_unlock(&deferred_probe_mutex);

@@ -252,6 +265,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_wai
 static int really_probe(struct device *dev, struct device_driver *drv)
 {
 	int ret = 0;
+	int local_trigger_count = atomic_read(&deferred_trigger_count);
 
 	atomic_inc(&probe_count);
 	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",

@@ -290,6 +304,9 @@ probe_failed:
 		/* Driver requested deferred probing */
 		dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
 		driver_deferred_probe_add(dev);
+		/* Did a trigger occur while probing? Need to re-trigger if yes */
+		if (local_trigger_count != atomic_read(&deferred_trigger_count))
+			driver_deferred_probe_trigger();
 	} else if (ret != -ENODEV && ret != -ENXIO) {
 		/* driver matched but the probe failed */
 		printk(KERN_WARNING

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stuart Hayes <[email protected]>

commit 6c6c0d5a1c949d2e084706f9e5fb1fccc175b265 upstream.

If the last hrtimer interrupt detected a hang it sets hang_detected=1 and programs the clock event device with a delay to let the system make progress.

If hang_detected == 1, we prevent reprogramming of the clock event device in hrtimer_reprogram() but not in hrtimer_force_reprogram().

This can lead to the following situation:

hrtimer_interrupt()
hang_detected = 1;
program ce device to Xms from now (hang delay)

We have two timers pending:
T1 expires 50ms from now
T2 expires 5s from now

Now T1 gets canceled, which causes hrtimer_force_reprogram() to be invoked, which in turn programs the clock event device to T2 (5 seconds from now).

Any hrtimer_start after that will not reprogram the hardware due to hang_detected still being set. So we effectivly block all timers until the T2 event fires and cleans up the hang situation.

Add a check for hang_detected to hrtimer_force_reprogram() which prevents the reprogramming of the hang delay in the hardware timer. The subsequent hrtimer_interrupt will resolve all outstanding issues.

[ tglx: Rewrote subject and changelog and fixed up the comment in
hrtimer_force_reprogram() ]

---
 kernel/hrtimer.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

@@ -567,6 +567,23 @@ hrtimer_force_reprogram(struct hrtimer_c
 
 	cpu_base->expires_next.tv64 = expires_next.tv64;
 
+	/*
+	 * If a hang was detected in the last timer interrupt then we
+	 * leave the hang delay active in the hardware. We want the
+	 * system to make progress. That also prevents the following
+	 * scenario:
+	 * T1 expires 50ms from now
+	 * T2 expires 5s from now
+	 *
+	 * T1 is removed, so this code is called and would reprogram
+	 * the hardware to 5s from now. Any hrtimer_start after that
+	 * will not reprogram the hardware due to hang_detected being
+	 * set. So we'd effectivly block all timers until the T2 event
+	 * fires.
+	 */
+	if (cpu_base->hang_detected)
+		return;
+
 	if (cpu_base->expires_next.tv64 != KTIME_MAX)
 		tick_program_event(cpu_base->expires_next, 1);
 }

3.4-stable review patch. If anyone has any objections, please let me know.

------------------

From: Leon Ma <[email protected]>

commit 012a45e3f4af68e86d85cce060c6c2fed56498b2 upstream.

If a cpu is idle and starts an hrtimer which is not pinned on that same cpu, the nohz code might target the timer to a different cpu.

In the case that we switch the cpu base of the timer we already have a sanity check in place, which determines whether the timer is earlier than the current leftmost timer on the target cpu. In that case we enqueue the timer on the current cpu because we cannot reprogram the clock event device on the target.

If the timers base is already the target CPU we do not have this sanity check in place so we enqueue the timer as the leftmost timer in the target cpus rb tree, but we cannot reprogram the clock event device on the target cpu. So the timer expires late and subsequently prevents the reprogramming of the target cpu clock event device until the previously programmed event fires or a timer with an earlier expiry time gets enqueued on the target cpu itself.

Add the same target check as we have for the switch base case and start the timer on the current cpu if it would become the leftmost timer on the target.

[ tglx: Rewrote subject and changelog ]

---
 kernel/hrtimer.c |    5 +++++
 1 file changed, 5 insertions(+)

@@ -232,6 +232,11 @@ again:
 			goto again;
 		}
 		timer->base = new_base;
+	} else {
+		if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
+			cpu = this_cpu;
+			goto again;
+		}
 	}
 	return new_base;
 }