3.0 patches

6 files changed, 214 insertions, 0 deletions

diff --git a/queue-3.0/befs-validate-length-of-long-symbolic-links.patch b/queue-3.0/befs-validate-length-of-long-symbolic-links.patch
new file mode 100644
index 0000000000..06f2880e46
--- /dev/null
+++ b/queue-3.0/befs-validate-length-of-long-symbolic-links.patch
@@ -0,0 +1,51 @@
+From 338d0f0a6fbc82407864606f5b64b75aeb3c70f2 Mon Sep 17 00:00:00 2001
+From: Timo Warns <Warns@pre-sense.de>
+Date: Wed, 17 Aug 2011 17:59:56 +0200
+Subject: befs: Validate length of long symbolic links.
+
+From: Timo Warns <Warns@pre-sense.de>
+
+commit 338d0f0a6fbc82407864606f5b64b75aeb3c70f2 upstream.
+
+Signed-off-by: Timo Warns <warns@pre-sense.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/befs/linuxvfs.c |   23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/fs/befs/linuxvfs.c
++++ b/fs/befs/linuxvfs.c
+@@ -474,17 +474,22 @@ befs_follow_link(struct dentry *dentry,
+ 		befs_data_stream *data = &befs_ino->i_data.ds;
+ 		befs_off_t len = data->size;
+ 
+-		befs_debug(sb, "Follow long symlink");
+-
+-		link = kmalloc(len, GFP_NOFS);
+-		if (!link) {
+-			link = ERR_PTR(-ENOMEM);
+-		} else if (befs_read_lsymlink(sb, data, link, len) != len) {
+-			kfree(link);
+-			befs_error(sb, "Failed to read entire long symlink");
++		if (len == 0) {
++			befs_error(sb, "Long symlink with illegal length");
+ 			link = ERR_PTR(-EIO);
+ 		} else {
+-			link[len - 1] = '\0';
++			befs_debug(sb, "Follow long symlink");
++
++			link = kmalloc(len, GFP_NOFS);
++			if (!link) {
++				link = ERR_PTR(-ENOMEM);
++			} else if (befs_read_lsymlink(sb, data, link, len) != len) {
++				kfree(link);
++				befs_error(sb, "Failed to read entire long symlink");
++				link = ERR_PTR(-EIO);
++			} else {
++				link[len - 1] = '\0';
++			}
+ 		}
+ 	} else {
+ 		link = befs_ino->i_data.symlink;
diff --git a/queue-3.0/cifs-demote-cerror-in-build_path_from_dentry-to-cfyi.patch b/queue-3.0/cifs-demote-cerror-in-build_path_from_dentry-to-cfyi.patch
new file mode 100644
index 0000000000..4eb8090bb2
--- /dev/null
+++ b/queue-3.0/cifs-demote-cerror-in-build_path_from_dentry-to-cfyi.patch
@@ -0,0 +1,46 @@
+From fa71f447065f676157ba6a2c121ba419818fc559 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 8 Aug 2011 11:50:24 -0400
+Subject: cifs: demote cERROR in build_path_from_dentry to cFYI
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit fa71f447065f676157ba6a2c121ba419818fc559 upstream.
+
+Running the cthon tests on a recent kernel caused this message to pop
+occasionally:
+
+    CIFS VFS: did not end path lookup where expected namelen is 0
+
+Some added debugging showed that namelen and dfsplen were both 0 when
+this occurred. That means that the read_seqretry returned true.
+
+Assuming that the comment inside the if statement is true, this should
+be harmless and just means that we raced with a rename. If that is the
+case, then there's no need for alarm and we can demote this to cFYI.
+
+While we're at it, print the dfsplen too so that we can see what
+happened here if the message pops during debugging.
+
+Cc: Al Viro <viro@ZenIV.linux.org.uk>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/dir.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -110,8 +110,8 @@ cifs_bp_rename_retry:
+ 	}
+ 	rcu_read_unlock();
+ 	if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
+-		cERROR(1, "did not end path lookup where expected namelen is %d",
+-			namelen);
++		cFYI(1, "did not end path lookup where expected. namelen=%d "
++			"dfsplen=%d", namelen, dfsplen);
+ 		/* presumably this is only possible if racing with a rename
+ 		of one of the parent directories  (we can not lock the dentries
+ 		above us to prevent this, but retrying should be harmless) */
diff --git a/queue-3.0/i7core_edac-fixed-typo-in-error-count-calculation.patch b/queue-3.0/i7core_edac-fixed-typo-in-error-count-calculation.patch
new file mode 100644
index 0000000000..643c045a43
--- /dev/null
+++ b/queue-3.0/i7core_edac-fixed-typo-in-error-count-calculation.patch
@@ -0,0 +1,32 @@
+From 8cf2d2399ab60842f55598bc1b00fd15503b9950 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli@googlemail.com>
+Date: Thu, 18 Aug 2011 09:17:00 +0200
+Subject: i7core_edac: fixed typo in error count calculation
+
+From: Mathias Krause <minipli@googlemail.com>
+
+commit 8cf2d2399ab60842f55598bc1b00fd15503b9950 upstream.
+
+Based on a patch from the PaX Team, found during a clang analysis pass.
+
+Signed-off-by: Mathias Krause <minipli@googlemail.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Cc: PaX Team <pageexec@freemail.hu>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/i7core_edac.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1670,7 +1670,7 @@ static void i7core_mce_output_error(stru
+ 	char *type, *optype, *err, *msg;
+ 	unsigned long error = m->status & 0x1ff0000l;
+ 	u32 optypenum = (m->status >> 4) & 0x07;
+-	u32 core_err_cnt = (m->status >> 38) && 0x7fff;
++	u32 core_err_cnt = (m->status >> 38) & 0x7fff;
+ 	u32 dimm = (m->misc >> 16) & 0x3;
+ 	u32 channel = (m->misc >> 18) & 0x3;
+ 	u32 syndrome = m->misc >> 32;
diff --git a/queue-3.0/possible-memory-corruption-on-mount.patch b/queue-3.0/possible-memory-corruption-on-mount.patch
new file mode 100644
index 0000000000..8c04eeab24
--- /dev/null
+++ b/queue-3.0/possible-memory-corruption-on-mount.patch
@@ -0,0 +1,37 @@
+From 13589c437daf4c8e429b3236c0b923de1c9420d8 Mon Sep 17 00:00:00 2001
+From: Steve French <sfrench@us.ibm.com>
+Date: Thu, 18 Aug 2011 04:41:55 +0000
+Subject: [CIFS] possible memory corruption on mount
+
+From: Steve French <sfrench@us.ibm.com>
+
+commit 13589c437daf4c8e429b3236c0b923de1c9420d8 upstream.
+
+CIFS cleanup_volume_info_contents() looks like having a memory
+corruption problem.
+When UNCip is set to "&vol->UNC[2]" in cifs_parse_mount_options(), it
+should not be kfree()-ed in cleanup_volume_info_contents().
+
+Introduced in commit b946845a9dc523c759cae2b6a0f6827486c3221a
+
+Signed-off-by: J.R. Okajima <hooanon05@yahoo.co.jp>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2838,7 +2838,8 @@ cleanup_volume_info_contents(struct smb_
+ 	kfree(volume_info->username);
+ 	kzfree(volume_info->password);
+ 	kfree(volume_info->UNC);
+-	kfree(volume_info->UNCip);
++	if (volume_info->UNCip != volume_info->UNC + 2)
++		kfree(volume_info->UNCip);
+ 	kfree(volume_info->domainname);
+ 	kfree(volume_info->iocharset);
+ 	kfree(volume_info->prepath);
diff --git a/queue-3.0/series b/queue-3.0/series
index 6cede878e2..7a03840847 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -1 +1,6 @@
 genirq-fix-wrong-bit-operation.patch
+cifs-demote-cerror-in-build_path_from_dentry-to-cfyi.patch
+befs-validate-length-of-long-symbolic-links.patch
+i7core_edac-fixed-typo-in-error-count-calculation.patch
+possible-memory-corruption-on-mount.patch
+x86-intel-power-correct-the-msr_ia32_energy_perf_bias.patch
diff --git a/queue-3.0/x86-intel-power-correct-the-msr_ia32_energy_perf_bias.patch b/queue-3.0/x86-intel-power-correct-the-msr_ia32_energy_perf_bias.patch
new file mode 100644
index 0000000000..4f337494d3
--- /dev/null
+++ b/queue-3.0/x86-intel-power-correct-the-msr_ia32_energy_perf_bias.patch
@@ -0,0 +1,43 @@
+From 17edf2d79f1ea6dfdb4c444801d928953b9f98d6 Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Fri, 15 Jul 2011 17:37:15 -0400
+Subject: x86, intel, power: Correct the MSR_IA32_ENERGY_PERF_BIAS message
+
+From: Len Brown <len.brown@intel.com>
+
+commit 17edf2d79f1ea6dfdb4c444801d928953b9f98d6 upstream.
+
+Fix the printk_once() so that it actually prints (didn't print before
+due to a stray comma.)
+
+[ hpa: changed to an incremental patch and adjusted the description
+  accordingly. ]
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1107151732480.18606@x980
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -465,11 +465,11 @@ static void __cpuinit init_intel(struct
+ 		u64 epb;
+ 
+ 		rdmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
+-		if ((epb & 0xF) == 0) {
+-			printk_once(KERN_WARNING, "x86: updated energy_perf_bias"
+-				" to 'normal' from 'performance'\n"
+-				"You can view and update epb via utility,"
+-				" such as x86_energy_perf_policy(8)\n");
++		if ((epb & 0xF) == ENERGY_PERF_BIAS_PERFORMANCE) {
++			printk_once(KERN_WARNING "ENERGY_PERF_BIAS:"
++				" Set to 'normal', was 'performance'\n"
++				"ENERGY_PERF_BIAS: View and update with"
++				" x86_energy_perf_policy(8)\n");
+ 			epb = (epb & ~0xF) | ENERGY_PERF_BIAS_NORMAL;
+ 			wrmsrl(MSR_IA32_ENERGY_PERF_BIAS, epb);
+ 		}