commit 3820288942d1c1524c3ee85cbf503fee1533cfc3 Author: Greg Kroah-Hartman Date: Mon Nov 5 09:57:06 2012 +0100 Linux 3.6.6 commit 8c1118a286324e4c16352b317f4531e82ede021a Author: Ben Skeggs Date: Thu Nov 1 16:16:32 2012 +1000 drm/nouveau: headless mode by default if pci class != vga display This is to prevent nouveau from taking over the console on headless boards such as Tesla. Backport of upstream commit: e412e95a268fa8544858ebfe066826b290430d51 Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit 83dc21544384ae8db01cc1c1a159ae6594444534 Author: Ben Skeggs Date: Thu Nov 1 16:16:31 2012 +1000 drm/nouveau: fix suspend/resume when in headless mode Backport of fixes from upstream commit: 9430738d80223a1cd791a2baa74fa170d3df1262 Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit 783250d700a2ab8d12040dec188b291328e13225 Author: Ben Skeggs Date: Mon Oct 29 09:03:07 2012 +1000 drm/nouveau: silence modesetting spam on pre-gf8 chipsets commit cee59f15a60cc6269a25e3f6fbf1a577d6ab8115 upstream. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit b2c70f388db2633fdbfe14f28d2133dd580fbb33 Author: Jiri Slaby Date: Fri Oct 19 13:28:46 2012 +0200 HID: microsoft: fix invalid rdesc for 3k kbd commit 3ccc60f9d8c39180c205dba1a020735bda1b2491 upstream. Microsoft Digital Media Keyboard 3000 has two interfaces, and the second one has a report descriptor with a bug. The second collection says: 05 01 -- global; usage page -- 01 -- Generic Desktop Controls 09 80 -- local; usage -- 80 -- System Control a1 01 -- main; collection -- 01 -- application 85 03 -- global; report ID -- 03 19 00 -- local; Usage Minimum -- 00 29 ff -- local; Usage Maximum -- ff 15 00 -- global; Logical Minimum -- 0 26 ff 00 -- global; Logical Maximum -- ff 81 00 -- main; input c0 -- main; End Collection I.e. it makes us think that there are all kinds of usages of system control. That the keyboard is a not only a keyboard, but also a joystick, mouse, gamepad, keypad, etc. The same as for the Wireless Desktop Receiver, this should be Physical Min/Max. So fix that appropriately. References: https://bugzilla.novell.com/show_bug.cgi?id=776834 Signed-off-by: Jiri Slaby Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 2ec0fe7bd41bd500e58702291edc5f7285ada81e Author: Nicholas Bellinger Date: Fri Oct 26 15:35:45 2012 -0700 target: Fix double-free of se_cmd in target_complete_tmr_failure commit e13d5fef88c40b87c8430f8274c3a9ca32ef90bc upstream. Fabric drivers currently expect to internally release se_cmd in the event of a TMR failure during target_submit_tmr(), which means the immediate call to transport_generic_free_cmd() after TFO->queue_tm_rsp() from within target_complete_tmr_failure() workqueue context is wrong. This is done as some fabrics expect TMR operations to be acknowledged before releasing the descriptor, so the assumption that core is releasing se_cmd associated TMR memory is incorrect. This fixes a OOPs where transport_generic_free_cmd() was being called more than once. This bug was originally observed with tcm_qla2xxx fabric ports. Signed-off-by: Nicholas Bellinger Cc: Christoph Hellwig Cc: Roland Dreier Cc: Andy Grover Signed-off-by: Greg Kroah-Hartman commit c7b3b9dff21b8beb7f3f49719b58495d4f744379 Author: Bernhard Kohl Date: Wed Oct 24 15:53:58 2012 +0200 target: reintroduce some obsolete SCSI-2 commands commit 1a1ff38c4cebf23be8bf0009a76b082a13bd25cb upstream. With kernel 3.6 some obsolete SCSI-2 commands including SEEK_10 have have been removed by commit 1fd032ee10d2816c947f5d5b9abda95e728f0a8f "target: move code for CDB emulation". There are still clients out there which use these old SCSI-2 commands. This mainly happens when running VMs with legacy guest systems, connected via SCSI command pass-through to iSCSI targets. Make them happy and return status GOOD. Many real SCSI disks or external iSCSI storage devices still support these old commands. So let's make LIO backward compatible as well. This patch adds support for the previously removed SEEK_10 and additionally the SEEK_6 and REZERO_UNIT commands. Signed-off-by: Bernhard Kohl Reviewed-by: Christoph Hellwig Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit aa927fcb2d23c7f0b1e350335eb822f5179c49a9 Author: Roland Dreier Date: Thu Oct 11 13:41:32 2012 -0700 qla2xxx: Update target lookup session tables when a target session changes commit c8292d1da53fa60c7516ab03a9d83f7ea266d335 upstream. It is possible for the target code to change the loop_id or s_id of a target session in reaction to an FC fabric change. However, the session structures are stored in tables that are indexed by these two keys, and if we just change the session structure but leave the pointers to it in the old places in the table, havoc can ensue. For example, a new session might come along that should go in the old slot in the table and overwrite the old session pointer. To handle this, add a new tgt_ops->update_sess() method that also updates the "by loop_id" and "by s_id" lookup tables when a session changes, so that the keys where a session pointer is stored in these tables always matches the keys in the session structure itself. (nab: Drop unnecessary double inversion with FCF_CONF_COMP_SUPPORTED usage) Signed-off-by: Roland Dreier Cc: Chad Dupuis Cc: Arun Easi Cc: Saurav Kashyap Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 16d6c35cfbed79472c8e2ae2df5b4935c2ac588b Author: Paul Bolle Date: Tue Oct 30 10:38:06 2012 +0100 USB: io_edgeport: remove unused variable The stable commit 12ddc74e8e25107eda81aceb74e3311c1480b381 ("USB: io_edgeport: fix port-data memory leak") left one variable unused: drivers/usb/serial/io_edgeport.c: In function 'edge_release': drivers/usb/serial/io_edgeport.c:3155:6: warning: unused variable 'i' [-Wunused-variable] Remove this unused variable. Signed-off-by: Paul Bolle Signed-off-by: Greg Kroah-Hartman commit 7b746b16909444af2d207b010b89885591ea54d0 Author: Johan Hovold Date: Wed Oct 31 20:48:54 2012 +0100 USB: iuu_phoenix: fix backported patches Fix two memory leaks involving dbgbuf that were introduced in port-probe error paths when backporting the following port-data fixes from v3.7 (which doesn't have dbgbuf): 0978c94 USB: iuu_phoenix: fix sysfs-attribute creation 5363655 USB: iuu_phoenix: fix port-data memory leak Reported-by: Fengguang Wu Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 0813e85449a343a214462346f146f7b0f6a2053d Author: Johan Hovold Date: Wed Oct 31 20:52:42 2012 +0100 USB: mos7840: fix port-data memory leak commit 80c00750f0c9867a65b30a17880939b6bc660a77 upstream. Fix port-data memory leak by moving port data allocation and deallocation to port_probe and port_remove. Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no driver is bound) the port private data is no longer freed at release as it is no longer accessible. Note that the indentation was kept intact using a do-while(0) in order to facilitate review. A follow-up patch will remove it. Compile-only tested. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit b7639e25716afc0211bcc14006a4af4e9e9bc2b9 Author: Alex Elder Date: Tue Oct 2 10:25:51 2012 -0500 ceph: avoid 32-bit page index overflow commit 6285bc231277419255f3498d3eb5ddc9f8e7fe79 upstream. A pgoff_t is defined (by default) to have type (unsigned long). On architectures such as i686 that's a 32-bit type. The ceph address space code was attempting to produce 64 bit offsets by shifting a page's index by PAGE_CACHE_SHIFT, but the result was not what was desired because the shift occurred before the result got promoted to 64 bits. Fix this by converting all uses of page->index used in this way to use the page_offset() macro, which ensures the 64-bit result has the intended value. This fixes http://tracker.newdream.net/issues/3112 Reported-by: Mohamed Pakkeer Signed-off-by: Alex Elder Reviewed-by: Sage Weil Signed-off-by: Greg Kroah-Hartman commit 343c7f0dcb36f71bc4edfc602eb8c20faf88fa65 Author: Sage Weil Date: Mon Sep 24 20:59:48 2012 -0700 libceph: check for invalid mapping commit d63b77f4c552cc3a20506871046ab0fcbc332609 upstream. If we encounter an invalid (e.g., zeroed) mapping, return an error and avoid a divide by zero. Signed-off-by: Sage Weil Reviewed-by: Alex Elder Signed-off-by: Greg Kroah-Hartman commit 1ad6768c537d57fec3dcb249cd384332cfacfe24 Author: Yan, Zheng Date: Thu Sep 20 17:42:25 2012 +0800 ceph: Fix oops when handling mdsmap that decreases max_mds commit 3e8f43a089f06279c5f76a9ccd42578eebf7bfa5 upstream. When i >= newmap->m_max_mds, ceph_mdsmap_get_addr(newmap, i) return NULL. Passing NULL to memcmp() triggers oops. Signed-off-by: Yan, Zheng Signed-off-by: Sage Weil Signed-off-by: Greg Kroah-Hartman commit aeb469d6f6b311f531df80d25a82b297cffc4569 Author: David Zafman Date: Thu Oct 18 14:01:43 2012 -0700 ceph: fix dentry reference leak in encode_fh() commit 52eb5a900a9863a8b77a895f770e5d825c8e02c6 upstream. Call to d_find_alias() needs a corresponding dput() This fixes http://tracker.newdream.net/issues/3271 Signed-off-by: David Zafman Reviewed-by: Sage Weil Signed-off-by: Greg Kroah-Hartman commit b6f8fbbad7bf2511aea493b0dc7be92e3b5c5a8d Author: Sage Weil Date: Wed Oct 24 16:12:58 2012 -0700 libceph: avoid NULL kref_put when osd reset races with alloc_msg commit 9bd952615a42d7e2ce3fa2c632e808e804637a1a upstream. The ceph_on_in_msg_alloc() method drops con->mutex while it allocates a message. If that races with a timeout that resends a zillion messages and resets the connection, and the ->alloc_msg() method returns a NULL message, it will call ceph_msg_put(NULL) and BUG. Fix by only calling put if msg is non-NULL. Fixes http://tracker.newdream.net/issues/3142 Signed-off-by: Sage Weil Signed-off-by: Greg Kroah-Hartman commit a407c28651969f9e34fd51ea0415886b70e5c991 Author: Alex Elder Date: Mon Oct 8 20:37:30 2012 -0700 rbd: reset BACKOFF if unable to re-queue commit 588377d6199034c36d335e7df5818b731fea072c upstream. If ceph_fault() is unable to queue work after a delay, it sets the BACKOFF connection flag so con_work() will attempt to do so. In con_work(), when BACKOFF is set, if queue_delayed_work() doesn't result in newly-queued work, it simply ignores this condition and proceeds as if no backoff delay were desired. There are two problems with this--one of which is a bug. The first problem is simply that the intended behavior is to back off, and if we aren't able queue the work item to run after a delay we're not doing that. The only reason queue_delayed_work() won't queue work is if the provided work item is already queued. In the messenger, this means that con_work() is already scheduled to be run again. So if we simply set the BACKOFF flag again when this occurs, we know the next con_work() call will again attempt to hold off activity on the connection until after the delay. The second problem--the bug--is a leak of a reference count. If queue_delayed_work() returns 0 in con_work(), con->ops->put() drops the connection reference held on entry to con_work(). However, processing is (was) allowed to continue, and at the end of the function a second con->ops->put() is called. This patch fixes both problems. Signed-off-by: Alex Elder Reviewed-by: Sage Weil Signed-off-by: Greg Kroah-Hartman commit 6d59ab3707595e1a7b2e6051ff3f5f0dabd0ad06 Author: Herton Ronaldo Krzesinski Date: Mon Aug 27 20:56:54 2012 -0300 floppy: properly handle failure on add_disk loop commit d60e7ec18c3fb2cbf90969ccd42889eb2d03aef9 upstream. On floppy initialization, if something failed inside the loop we call add_disk, there was no cleanup of previous iterations in the error handling. Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Jiri Kosina Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit d4eaaf6e3cf75c8394a36b6de67a1771da5ed2ee Author: Herton Ronaldo Krzesinski Date: Mon Aug 27 20:56:52 2012 -0300 floppy: do put_disk on current dr if blk_init_queue fails commit 238ab78469c6ab7845b43d5061cd3c92331b2452 upstream. If blk_init_queue fails, we do not call put_disk on the current dr (dr is decremented first in the error handling loop). Reviewed-by: Ben Hutchings Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Jiri Kosina Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 0de4380ecfc63f6f3940b9ec03c36c78f008ac12 Author: Herton Ronaldo Krzesinski Date: Mon Aug 27 20:56:51 2012 -0300 floppy: don't call alloc_ordered_workqueue inside the alloc_disk loop commit b54e1f88897bcacc2cd359f48ea3b39eaf55f084 upstream. Since commit 070ad7e ("floppy: convert to delayed work and single-thread wq"), we end up calling alloc_ordered_workqueue multiple times inside the loop, which shouldn't be intended. Besides the leak, other side effect in the current code is if blk_init_queue fails, we would end up calling unregister_blkdev even if we didn't call yet register_blkdev. Just moved the allocation of floppy_wq before the loop, and adjusted the code accordingly. Acked-by: Vivek Goyal Reviewed-by: Ben Hutchings Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Jiri Kosina Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 636b755668eefd3537af58e7843ef8389c4d03b6 Author: NeilBrown Date: Wed Oct 31 11:42:03 2012 +1100 md/raid1: Fix assembling of arrays containing Replacements. commit 02b898f2f04e418094f0093a3ad0b415bcdbe8eb upstream. setup_conf in raid1.c uses conf->raid_disks before assigning a value. It is used when including 'Replacement' devices. The consequence is that assembling an array which contains a replacement will misbehave and either not include the replacement, or not include the device being replaced. Though this doesn't lead directly to data corruption, it could lead to reduced data safety. So use mddev->raid_disks, which is initialised, instead. Bug was introduced by commit c19d57980b38a5bb613a898937a1cf85f422fb9b md/raid1: recognise replacements when assembling arrays. in 3.3, so fix is suitable for 3.3.y thru 3.6.y. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 4b4717878e2e70626855d5a6b4639a8e37599acc Author: Mathias Nyman Date: Thu Oct 25 14:03:03 2012 +0300 gpiolib: Don't return -EPROBE_DEFER to sysfs, or for invalid gpios commit ad2fab36d7922401c4576fb7ea9b21a47a29a17f upstream. gpios requested with invalid numbers, or gpios requested from userspace via sysfs should not try to be deferred on failure. Signed-off-by: Mathias Nyman Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 11d65f48c02dae54020c407d1cf3f2dfd44e88c0 Author: Dan Carpenter Date: Thu Oct 11 09:56:35 2012 +0300 gpio-timberdale: fix a potential wrapping issue commit d79550a7bc35c16476ebdc27c78378d8093390ec upstream. ->last_ier is an unsigned long but the high bits can't be used int the original code because the shift wraps. Signed-off-by: Dan Carpenter Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit edf5181e0804d4d484b11b4d4e8150a80a39908b Author: Jun'ichi Nomura Date: Wed Oct 17 17:45:36 2012 +0900 blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg commit 65635cbc37e011e71b208257a25e7c1078cd039b upstream. blk_put_rl() does not call blkg_put() for q->root_rl because we don't take request list reference on q->root_blkg. However, if root_blkg is once attached then detached (freed), blk_put_rl() is confused by the bogus pointer in q->root_blkg. For example, with !CONFIG_BLK_DEV_THROTTLING && CONFIG_CFQ_GROUP_IOSCHED, switching IO scheduler from cfq to deadline will cause system stall after the following warning with 3.6: > WARNING: at /work/build/linux/block/blk-cgroup.h:250 > blk_put_rl+0x4d/0x95() > Modules linked in: bridge stp llc sunrpc acpi_cpufreq freq_table mperf > ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 > Pid: 0, comm: swapper/0 Not tainted 3.6.0 #1 > Call Trace: > [] warn_slowpath_common+0x85/0x9d > [] warn_slowpath_null+0x1a/0x1c > [] blk_put_rl+0x4d/0x95 > [] __blk_put_request+0xc3/0xcb > [] blk_finish_request+0x232/0x23f > [] ? blk_end_bidi_request+0x34/0x5d > [] blk_end_bidi_request+0x42/0x5d > [] blk_end_request+0x10/0x12 > [] scsi_io_completion+0x207/0x4d5 > [] scsi_finish_command+0xfa/0x103 > [] scsi_softirq_done+0xff/0x108 > [] blk_done_softirq+0x8d/0xa1 > [] ? > generic_smp_call_function_single_interrupt+0x9f/0xd7 > [] __do_softirq+0x102/0x213 > [] ? lock_release_holdtime+0xb6/0xbb > [] ? raise_softirq_irqoff+0x9/0x3d > [] call_softirq+0x1c/0x30 > [] do_softirq+0x4b/0xa3 > [] irq_exit+0x53/0xd5 > [] smp_call_function_single_interrupt+0x34/0x36 > [] call_function_single_interrupt+0x6f/0x80 > [] ? mwait_idle+0x94/0xcd > [] ? mwait_idle+0x8b/0xcd > [] cpu_idle+0xbb/0x114 > [] rest_init+0xc1/0xc8 > [] ? csum_partial_copy_generic+0x16c/0x16c > [] start_kernel+0x3d4/0x3e1 > [] ? kernel_init+0x1f7/0x1f7 > [] x86_64_start_reservations+0xb8/0xbd > [] x86_64_start_kernel+0x101/0x110 This patch clears q->root_blkg and q->root_rl.blkg when root blkg is destroyed. Signed-off-by: Jun'ichi Nomura Acked-by: Vivek Goyal Acked-by: Tejun Heo Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit dab43b73a7c7317f941c1314e9a77374ba8999ee Author: Eric Sandeen Date: Sun Oct 28 22:24:57 2012 -0400 ext4: fix unjournaled inode bitmap modification commit ffb5387e85d528fb6d0d924abfa3fbf0fc484071 upstream. commit 119c0d4460b001e44b41dcf73dc6ee794b98bd31 changed ext4_new_inode() such that the inode bitmap was being modified outside a transaction, which could lead to corruption, and was discovered when journal_checksum found a bad checksum in the journal during log replay. Nix ran into this when using the journal_async_commit mount option, which enables journal checksumming. The ensuing journal replay failures due to the bad checksums led to filesystem corruption reported as the now infamous "Apparent serious progressive ext4 data corruption bug" [ Changed by tytso to only call ext4_journal_get_write_access() only when we're fairly certain that we're going to allocate the inode. ] I've tested this by mounting with journal_checksum and running fsstress then dropping power; I've also tested by hacking DM to create snapshots w/o first quiescing, which allows me to test journal replay repeatedly w/o actually power-cycling the box. Without the patch I hit a journal checksum error every time. With this fix it survives many iterations. Reported-by: Nix Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman