Skip to content

Commit a761439

Browse files
mdrjrmdrjr
committed
Merge tag 'v3.10.75' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into odroidc-3.10.y
This is the 3.10.75 stable release
2 parents a716b70 + 9ccc5af commit a761439

File tree

35 files changed

+144
-65
lines changed

35 files changed

+144
-65
lines changed

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
VERSION = 3
22
PATCHLEVEL = 10
3-
SUBLEVEL = 74
3+
SUBLEVEL = 75
44
EXTRAVERSION =
55
NAME = TOSSUG Baby Fish
66

‎drivers/acpi/processor_idle.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -978,7 +978,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
978978
return -EINVAL;
979979

980980
drv->safe_state_index = -1;
981-
for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
981+
for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
982982
drv->states[i].name[0] = '\0';
983983
drv->states[i].desc[0] = '\0';
984984
}

‎drivers/block/nbd.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -815,10 +815,6 @@ static int __init nbd_init(void)
815815
return -EINVAL;
816816
}
817817

818-
nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
819-
if (!nbd_dev)
820-
return -ENOMEM;
821-
822818
part_shift = 0;
823819
if (max_part > 0) {
824820
part_shift = fls(max_part);
@@ -840,6 +836,10 @@ static int __init nbd_init(void)
840836
if (nbds_max > 1UL << (MINORBITS - part_shift))
841837
return -EINVAL;
842838

839+
nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
840+
if (!nbd_dev)
841+
return -ENOMEM;
842+
843843
for (i = 0; i < nbds_max; i++) {
844844
struct gendisk *disk = alloc_disk(1 << part_shift);
845845
if (!disk)

‎drivers/dma/omap-dma.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -487,6 +487,7 @@ static int omap_dma_terminate_all(struct omap_chan *c)
487487
* c->desc is NULL and exit.)
488488
*/
489489
if (c->desc) {
490+
omap_dma_desc_free(&c->desc->vd);
490491
c->desc = NULL;
491492
/* Avoid stopping the dma twice */
492493
if (!c->paused)

‎drivers/gpu/drm/radeon/radeon_bios.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
7676

7777
static bool radeon_read_bios(struct radeon_device *rdev)
7878
{
79-
uint8_t __iomem *bios;
79+
uint8_t __iomem *bios, val1, val2;
8080
size_t size;
8181

8282
rdev->bios = NULL;
@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
8686
return false;
8787
}
8888

89-
if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
89+
val1 = readb(&bios[0]);
90+
val2 = readb(&bios[1]);
91+
92+
if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
9093
pci_unmap_rom(rdev->pdev, bios);
9194
return false;
9295
}
93-
rdev->bios = kmemdup(bios, size, GFP_KERNEL);
96+
rdev->bios = kzalloc(size, GFP_KERNEL);
9497
if (rdev->bios == NULL) {
9598
pci_unmap_rom(rdev->pdev, bios);
9699
return false;
97100
}
101+
memcpy_fromio(rdev->bios, bios, size);
98102
pci_unmap_rom(rdev->pdev, bios);
99103
return true;
100104
}

‎drivers/iio/imu/adis_trigger.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
6060
iio_trigger_set_drvdata(adis->trig, adis);
6161
ret = iio_trigger_register(adis->trig);
6262

63-
indio_dev->trig = adis->trig;
63+
indio_dev->trig = iio_trigger_get(adis->trig);
6464
if (ret)
6565
goto error_free_irq;
6666

‎drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,16 @@
2525
#include <linux/poll.h>
2626
#include "inv_mpu_iio.h"
2727

28+
static void inv_clear_kfifo(struct inv_mpu6050_state *st)
29+
{
30+
unsigned long flags;
31+
32+
/* take the spin lock sem to avoid interrupt kick in */
33+
spin_lock_irqsave(&st->time_stamp_lock, flags);
34+
kfifo_reset(&st->timestamps);
35+
spin_unlock_irqrestore(&st->time_stamp_lock, flags);
36+
}
37+
2838
int inv_reset_fifo(struct iio_dev *indio_dev)
2939
{
3040
int result;
@@ -51,6 +61,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
5161
INV_MPU6050_BIT_FIFO_RST);
5262
if (result)
5363
goto reset_fifo_fail;
64+
65+
/* clear timestamps fifo */
66+
inv_clear_kfifo(st);
67+
5468
/* enable interrupt */
5569
if (st->chip_config.accl_fifo_enable ||
5670
st->chip_config.gyro_fifo_enable) {
@@ -84,16 +98,6 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
8498
return result;
8599
}
86100

87-
static void inv_clear_kfifo(struct inv_mpu6050_state *st)
88-
{
89-
unsigned long flags;
90-
91-
/* take the spin lock sem to avoid interrupt kick in */
92-
spin_lock_irqsave(&st->time_stamp_lock, flags);
93-
kfifo_reset(&st->timestamps);
94-
spin_unlock_irqrestore(&st->time_stamp_lock, flags);
95-
}
96-
97101
/**
98102
* inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
99103
*/
@@ -187,7 +191,6 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
187191
flush_fifo:
188192
/* Flush HW and SW FIFOs. */
189193
inv_reset_fifo(indio_dev);
190-
inv_clear_kfifo(st);
191194
mutex_unlock(&indio_dev->mlock);
192195
iio_trigger_notify_done(indio_dev->trig);
193196

‎drivers/infiniband/core/umem.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
9494
if (dmasync)
9595
dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
9696

97+
/*
98+
* If the combination of the addr and size requested for this memory
99+
* region causes an integer overflow, return error.
100+
*/
101+
if ((PAGE_ALIGN(addr + size) <= size) ||
102+
(PAGE_ALIGN(addr + size) <= addr))
103+
return ERR_PTR(-EINVAL);
104+
97105
if (!can_do_mlock())
98106
return ERR_PTR(-EPERM);
99107

‎drivers/infiniband/core/uverbs_main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
460460

461461
entry->desc.async.element = element;
462462
entry->desc.async.event_type = event;
463+
entry->desc.async.reserved = 0;
463464
entry->counter = counter;
464465

465466
list_add_tail(&entry->list, &file->async_file->event_list);

‎drivers/infiniband/hw/mlx4/mad.c

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,14 @@ enum {
6464
#define GUID_TBL_BLK_NUM_ENTRIES 8
6565
#define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
6666

67+
/* Counters should be saturate once they reach their maximum value */
68+
#define ASSIGN_32BIT_COUNTER(counter, value) do {\
69+
if ((value) > U32_MAX) \
70+
counter = cpu_to_be32(U32_MAX); \
71+
else \
72+
counter = cpu_to_be32(value); \
73+
} while (0)
74+
6775
struct mlx4_mad_rcv_buf {
6876
struct ib_grh grh;
6977
u8 payload[256];
@@ -730,10 +738,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
730738
static void edit_counter(struct mlx4_counter *cnt,
731739
struct ib_pma_portcounters *pma_cnt)
732740
{
733-
pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
734-
pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
735-
pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
736-
pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
741+
ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
742+
(be64_to_cpu(cnt->tx_bytes) >> 2));
743+
ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
744+
(be64_to_cpu(cnt->rx_bytes) >> 2));
745+
ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
746+
be64_to_cpu(cnt->tx_frames));
747+
ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
748+
be64_to_cpu(cnt->rx_frames));
737749
}
738750

739751
static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,

‎drivers/media/platform/s5p-mfc/s5p_mfc_common.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929

3030
/* Offset base used to differentiate between CAPTURE and OUTPUT
3131
* while mmaping */
32-
#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
32+
#define DST_QUEUE_OFF_BASE (1 << 30)
3333

3434
#define MFC_BANK1_ALLOC_CTX 0
3535
#define MFC_BANK2_ALLOC_CTX 1

‎drivers/net/wireless/iwlwifi/dvm/dev.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -670,7 +670,6 @@ struct iwl_priv {
670670
unsigned long reload_jiffies;
671671
int reload_count;
672672
bool ucode_loaded;
673-
bool init_ucode_run; /* Don't run init uCode again */
674673

675674
u8 plcp_delta_threshold;
676675

‎drivers/net/wireless/iwlwifi/dvm/ucode.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -425,9 +425,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
425425
if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
426426
return 0;
427427

428-
if (priv->init_ucode_run)
429-
return 0;
430-
431428
iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
432429
calib_complete, ARRAY_SIZE(calib_complete),
433430
iwlagn_wait_calib, priv);
@@ -447,8 +444,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
447444
*/
448445
ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
449446
UCODE_CALIB_TIMEOUT);
450-
if (!ret)
451-
priv->init_ucode_run = true;
452447

453448
goto out;
454449

‎drivers/scsi/be2iscsi/be_main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5080,9 +5080,9 @@ static int beiscsi_dev_probe(struct pci_dev *pcidev,
50805080
hba_free:
50815081
if (phba->msix_enabled)
50825082
pci_disable_msix(phba->pcidev);
5083-
iscsi_host_remove(phba->shost);
50845083
pci_dev_put(phba->pcidev);
50855084
iscsi_host_free(phba->shost);
5085+
pci_set_drvdata(pcidev, NULL);
50865086
disable_pci:
50875087
pci_disable_device(pcidev);
50885088
return ret;

‎drivers/scsi/scsi_lib.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1242,9 +1242,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
12421242
"rejecting I/O to dead device\n");
12431243
ret = BLKPREP_KILL;
12441244
break;
1245-
case SDEV_QUIESCE:
12461245
case SDEV_BLOCK:
12471246
case SDEV_CREATED_BLOCK:
1247+
ret = BLKPREP_DEFER;
1248+
break;
1249+
case SDEV_QUIESCE:
12481250
/*
12491251
* If the devices is blocked we defer normal commands.
12501252
*/

‎drivers/target/iscsi/iscsi_target.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1179,7 +1179,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
11791179
* traditional iSCSI block I/O.
11801180
*/
11811181
if (iscsit_allocate_iovecs(cmd) < 0) {
1182-
return iscsit_add_reject_cmd(cmd,
1182+
return iscsit_reject_cmd(cmd,
11831183
ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
11841184
}
11851185
immed_data = cmd->immediate_data;

‎drivers/usb/host/xhci-pci.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
9494
if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
9595
xhci->quirks |= XHCI_LPM_SUPPORT;
9696
xhci->quirks |= XHCI_INTEL_HOST;
97+
xhci->quirks |= XHCI_AVOID_BEI;
9798
}
9899
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
99100
pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
@@ -109,7 +110,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
109110
* PPT chipsets.
110111
*/
111112
xhci->quirks |= XHCI_SPURIOUS_REBOOT;
112-
xhci->quirks |= XHCI_AVOID_BEI;
113113
}
114114
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
115115
pdev->device == PCI_DEVICE_ID_ASROCK_P67) {

‎drivers/usb/serial/ftdi_sio.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -619,6 +619,7 @@ static struct usb_device_id id_table_combined [] = {
619619
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
620620
{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
621621
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
622+
{ USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
622623
/*
623624
* ELV devices:
624625
*/
@@ -1898,8 +1899,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
18981899
{
18991900
struct usb_device *udev = serial->dev;
19001901

1901-
if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
1902-
(udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
1902+
if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
1903+
return ftdi_jtag_probe(serial);
1904+
1905+
if (udev->product &&
1906+
(!strcmp(udev->product, "BeagleBone/XDS100V2") ||
1907+
!strcmp(udev->product, "SNAP Connect E10")))
19031908
return ftdi_jtag_probe(serial);
19041909

19051910
return 0;

‎drivers/usb/serial/ftdi_sio_ids.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,12 @@
561561
*/
562562
#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
563563

564+
/*
565+
* Synapse Wireless product ids (FTDI_VID)
566+
* http://www.synapse-wireless.com
567+
*/
568+
#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
569+
564570

565571
/********************************/
566572
/** third-party VID/PID combos **/

‎fs/cifs/file.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1789,6 +1789,7 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
17891789
cifsFileInfo_put(inv_file);
17901790
spin_lock(&cifs_file_list_lock);
17911791
++refind;
1792+
inv_file = NULL;
17921793
goto refind_writable;
17931794
}
17941795
}

‎fs/ocfs2/file.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2372,10 +2372,14 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
23722372
/* buffered aio wouldn't have proper lock coverage today */
23732373
BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
23742374

2375+
if (unlikely(written <= 0))
2376+
goto no_sync;
2377+
23752378
if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
23762379
((file->f_flags & O_DIRECT) && !direct_io)) {
2377-
ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
2378-
*ppos + count - 1);
2380+
ret = filemap_fdatawrite_range(file->f_mapping,
2381+
iocb->ki_pos - written,
2382+
iocb->ki_pos - 1);
23792383
if (ret < 0)
23802384
written = ret;
23812385

@@ -2388,10 +2392,12 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
23882392
}
23892393

23902394
if (!ret)
2391-
ret = filemap_fdatawait_range(file->f_mapping, *ppos,
2392-
*ppos + count - 1);
2395+
ret = filemap_fdatawait_range(file->f_mapping,
2396+
iocb->ki_pos - written,
2397+
iocb->ki_pos - 1);
23932398
}
23942399

2400+
no_sync:
23952401
/*
23962402
* deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
23972403
* function pointer which is called when o_direct io completes so that

‎fs/proc/task_mmu.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1113,9 +1113,19 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
11131113
return ret;
11141114
}
11151115

1116+
static int pagemap_open(struct inode *inode, struct file *file)
1117+
{
1118+
/* do not disclose physical addresses to unprivileged
1119+
userspace (closes a rowhammer attack vector) */
1120+
if (!capable(CAP_SYS_ADMIN))
1121+
return -EPERM;
1122+
return 0;
1123+
}
1124+
11161125
const struct file_operations proc_pagemap_operations = {
11171126
.llseek = mem_lseek, /* borrow this */
11181127
.read = pagemap_read,
1128+
.open = pagemap_open,
11191129
};
11201130
#endif /* CONFIG_PROC_PAGE_MONITOR */
11211131

‎include/linux/blk_types.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,9 @@ enum rq_flag_bits {
170170
__REQ_ELVPRIV, /* elevator private data attached */
171171
__REQ_FAILED, /* set if the request failed */
172172
__REQ_QUIET, /* don't worry about errors */
173-
__REQ_PREEMPT, /* set for "ide_preempt" requests */
173+
__REQ_PREEMPT, /* set for "ide_preempt" requests and also
174+
for requests for which the SCSI "quiesce"
175+
state must be ignored. */
174176
__REQ_ALLOCED, /* request came from our alloc pool */
175177
__REQ_COPY_USER, /* contains copies of user pages */
176178
__REQ_FLUSH_SEQ, /* request for flush sequence */

0 commit comments

Comments
 (0)