linux-stable.git/drivers, branch v3.4.41

mtd: Disable mtdchar mmap on MMU systems

2013-04-17T04:27:27+00:00

commit f5cf8f07423b2677cebebcebc863af77223a4972 upstream.

This code was broken because it assumed that all MTD devices were map-based.
Disable it for now, until it can be fixed properly for the next merge window.

Signed-off-by: David Woodhouse 
Signed-off-by: Greg Kroah-Hartman

r8169: fix auto speed down issue

2013-04-17T04:27:27+00:00

commit e2409d83434d77874b461b78af6a19cd6e6a1280 upstream.

It would cause no link after suspending or shutdowning when the
nic changes the speed to 10M and connects to a link partner which
forces the speed to 100M.

Check the link partner ability to determine which speed to set.

Signed-off-by: Hayes Wang 
Acked-by: Francois Romieu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mtdchar: fix offset overflow detection

2013-04-17T04:27:27+00:00

commit 9c603e53d380459fb62fec7cd085acb0b74ac18f upstream.

Sasha Levin has been running trinity in a KVM tools guest, and was able
to trigger the BUG_ON() at arch/x86/mm/pat.c:279 (verifying the range of
the memory type).  The call trace showed that it was mtdchar_mmap() that
created an invalid remap_pfn_range().

The problem is that mtdchar_mmap() does various really odd and subtle
things with the vma page offset etc, and uses the wrong types (and the
wrong overflow) detection for it.

For example, the page offset may well be 32-bit on a 32-bit
architecture, but after shifting it up by PAGE_SHIFT, we need to use a
potentially 64-bit resource_size_t to correctly hold the full value.

Also, we need to check that the vma length plus offset doesn't overflow
before we check that it is smaller than the length of the mtdmap region.

This fixes things up and tries to make the code a bit easier to read.

Reported-and-tested-by: Sasha Levin 
Acked-by: Suresh Siddha 
Acked-by: Artem Bityutskiy 
Cc: David Woodhouse 
Cc: linux-mtd@lists.infradead.org
Signed-off-by: Linus Torvalds 
Cc: Ben Hutchings 
Cc: Brad Spengler 
Signed-off-by: Greg Kroah-Hartman

udl: handle EDID failure properly.

2013-04-17T04:27:26+00:00

commit 1baee58638fc58248625255f5c5fcdb987f11b1f upstream.

Don't oops seems proper.

Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs

2013-04-17T04:27:26+00:00

commit 30f359a6f9da65a66de8cadf959f0f4a0d498bba upstream.

This patch fixes a bug where a handful of informational / control CDBs
that should be allowed during ALUA access state Standby/Offline/Transition
where incorrectly returning CHECK_CONDITION + ASCQ_04H_ALUA_TG_PT_*.

This includes INQUIRY + REPORT_LUNS, which would end up preventing LUN
registration when LUN scanning occured during these ALUA access states.

Signed-off-by: Nicholas Bellinger 
Cc: Hannes Reinecke 
Signed-off-by: Greg Kroah-Hartman

SCSI: libsas: fix handling vacant phy in sas_set_ex_phy()

2013-04-17T04:27:26+00:00

commit d4a2618fa77b5e58ec15342972bd3505a1c3f551 upstream.

If a result of the SMP discover function is PHY VACANT,
the content of discover response structure (dr) is not valid.
It sometimes happens that dr->attached_sas_addr can contain
even SAS address of other phy. In such case an invalid phy
is created, what causes NULL pointer dereference during
destruction of expander's phys.

So if a result of SMP function is PHY VACANT, the content of discover
response structure (dr) must not be copied to phy structure.

This patch fixes the following bug:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: [] sysfs_find_dirent+0x12/0x90
Call Trace:
  [] sysfs_get_dirent+0x35/0x80
  [] sysfs_unmerge_group+0x1e/0xb0
  [] dpm_sysfs_remove+0x24/0x90
  [] device_del+0x44/0x1d0
  [] sas_rphy_delete+0x9/0x20 [scsi_transport_sas]
  [] sas_destruct_devices+0xe6/0x110 [libsas]
  [] process_one_work+0x16c/0x350
  [] worker_thread+0x17a/0x410
  [] kthread+0x96/0xa0
  [] kernel_thread_helper+0x4/0x10

Signed-off-by: Lukasz Dorau 
Signed-off-by: Pawel Baldysiak 
Reviewed-by: Maciej Patelczyk 
Signed-off-by: James Bottomley 
Signed-off-by: Greg Kroah-Hartman

drm/i915: Use the correct size of the GTT for placing the per-process entries

2013-04-17T04:27:26+00:00

commit 9a0f938bde74bf9e50bd75c8de9e38c1787398cd upstream.

The current layout is to place the per-process tables at the end of the
GTT. However, this is currently using a hardcoded maximum size for the GTT
and not taking in account limitations imposed by the BIOS. Use the value
for the total number of entries allocated in the table as provided by
the configuration registers.

Reported-by: Matthew Garrett 
Signed-off-by: Chris Wilson 
Cc: Daniel Vetter 
Cc: Ben Widawsky 
Cc: Matthew Garret 
Signed-off-by: Daniel Vetter 
Cc: Jonathan Nieder 
Signed-off-by: Greg Kroah-Hartman

rt2x00: rt2x00pci_regbusy_read() - only print register access failure once

2013-04-12T16:38:47+00:00

commit 83589b30f1e1dc9898986293c9336b8ce1705dec upstream.

BugLink: http://bugs.launchpad.net/bugs/1128840

It appears that when this register read fails it never recovers, so
I think there is no need to repeat the same error message ad infinitum.

Signed-off-by: Tim Gardner 
Cc: Ivo van Doorn 
Cc: Gertjan van Wingerde 
Cc: Helmut Schaa 
Cc: "John W. Linville" 
Cc: linux-wireless@vger.kernel.org
Cc: users@rt2x00.serialmonkey.com
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

Revert "mwifiex: cancel cmd timer and free curr_cmd in shutdown process

2013-04-12T16:38:47+00:00

revert commit b9f1f48ce20a1b923429c216669d03b5a900a8cf which is commit
084c7189acb3f969c855536166042e27f5dd703f upstream.

It shouldn't have been applied to the 3.4-stable tree.

Reported-by: Ben Hutchings 
Cc: Marco Cesarano 
Reported-by: Bing Zhao 
Signed-off-by: Greg Kroah-Hartman

thermal: return an error on failure to register thermal class

2013-04-12T16:38:47+00:00

commit da28d966f6aa942ae836d09729f76a1647932309 upstream.

The return code from the registration of the thermal class is used to
unallocate resources, but this failure isn't passed back to the caller of
thermal_init.  Return this failure back to the caller.

This bug was introduced in changeset 4cb18728 which overwrote the return code
when the variable was re-used to catch the return code of the registration of
the genetlink thermal socket family.

Signed-off-by: Richard Guy Briggs 
Signed-off-by: Zhang Rui 
Cc: Jonghwan Choi 
Signed-off-by: Greg Kroah-Hartman