commit af4bafb430f94bc8c298a213a792137169bad077
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Aug 14 22:55:43 2013 -0700

    Linux 3.0.91

commit 0e4f7396371a839713b587c33b4a768f15dba9a6
Author: Joshua Zhu <zhu.wen-jie@hp.com>
Date:   Sat Jan 5 13:29:57 2013 +0800

    perf tools: Add anonymous huge page recognition
    
    commit d0528b5d71faf612014dd7672e44225c915344b2 upstream.
    
    Judging anonymous memory's vm_area_struct, perf_mmap_event's filename
    will be set to "//anon" indicating this vma belongs to anonymous
    memory.
    
    Once hugepage is used, vma's vm_file points to hugetlbfs. In this way,
    this vma will not be regarded as anonymous memory by is_anon_memory() in
    perf user space utility.
    
    Signed-off-by: Joshua Zhu <zhu.wen-jie@hp.com>
    Cc: Akihiro Nagai <akihiro.nagai.hw@hitachi.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: David Ahern <dsahern@gmail.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Joshua Zhu <zhu.wen-jie@hp.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Vinson Lee <vlee@freedesktop.org>
    Link: http://lkml.kernel.org/r/1357363797-3550-1-git-send-email-zhu.wen-jie@hp.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 03b9342ba877075b024e3932b43afa68e5d3f0fd
Author: NeilBrown <neilb@suse.de>
Date:   Thu Nov 8 16:09:37 2012 -0800

    vfs: d_obtain_alias() needs to use "/" as default name.
    
    commit b911a6bdeef5848c468597d040e3407e0aee04ce upstream.
    
    NFS appears to use d_obtain_alias() to create the root dentry rather than
    d_make_root.  This can cause 'prepend_path()' to complain that the root
    has a weird name if an NFS filesystem is lazily unmounted.  e.g.  if
    "/mnt" is an NFS mount then
    
     { cd /mnt; umount -l /mnt ; ls -l /proc/self/cwd; }
    
    will cause a WARN message like
       WARNING: at /home/git/linux/fs/dcache.c:2624 prepend_path+0x1d7/0x1e0()
       ...
       Root dentry has weird name <>
    
    to appear in kernel logs.
    
    So change d_obtain_alias() to use "/" rather than "" as the anonymous
    name.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    [bwh: Backported to 3.2: use named initialisers instead of QSTR_INIT()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5fc83a91c5d973a204efc619006699da9676e37f
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Mar 14 15:21:36 2013 +0100

    SCSI: nsp32: use mdelay instead of large udelay constants
    
    commit b497ceb964a80ebada3b9b3cea4261409039e25a upstream.
    
    ARM cannot handle udelay for more than 2 miliseconds, so we
    should use mdelay instead for those.
    
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: GOTO Masanori <gotom@debian.or.jp>
    Cc: YOKOTA Hiroshi <yokota@netlab.is.tsukuba.ac.jp>
    Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
    Cc: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c63eea737793f3562cc62d1395b6b1d325804d27
Author: Andrew Vagin <avagin@openvz.org>
Date:   Fri Aug 2 21:16:43 2013 +0400

    tracing: Fix fields of struct trace_iterator that are zeroed by mistake
    
    commit ed5467da0e369e65b247b99eb6403cb79172bcda upstream.
    
    tracing_read_pipe zeros all fields bellow "seq". The declaration contains
    a comment about that, but it doesn't help.
    
    The first field is "snapshot", it's true when current open file is
    snapshot. Looks obvious, that it should not be zeroed.
    
    The second field is "started". It was converted from cpumask_t to
    cpumask_var_t (v2.6.28-4983-g4462344), in other words it was
    converted from cpumask to pointer on cpumask.
    
    Currently the reference on "started" memory is lost after the first read
    from tracing_read_pipe and a proper object will never be freed.
    
    The "started" is never dereferenced for trace_pipe, because trace_pipe
    can't have the TRACE_FILE_ANNOTATE options.
    
    Link: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org
    
    Signed-off-by: Andrew Vagin <avagin@openvz.org>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a9d8aaedf15cc981df0aebda88b113eeee9c5cab
Author: Jeff Layton <jlayton@redhat.com>
Date:   Mon Mar 26 09:55:29 2012 -0400

    cifs: silence compiler warnings showing up with gcc-4.7.0
    
    commit b2a3ad9ca502169fc4c11296fa20f56059c7c031 upstream.
    
    gcc-4.7.0 has started throwing these warnings when building cifs.ko.
    
      CC [M]  fs/cifs/cifssmb.o
    fs/cifs/cifssmb.c: In function ‘CIFSSMBSetCIFSACL’:
    fs/cifs/cifssmb.c:3905:9: warning: array subscript is above array bounds [-Warray-bounds]
    fs/cifs/cifssmb.c: In function ‘CIFSSMBSetFileInfo’:
    fs/cifs/cifssmb.c:5711:8: warning: array subscript is above array bounds [-Warray-bounds]
    fs/cifs/cifssmb.c: In function ‘CIFSSMBUnixSetFileInfo’:
    fs/cifs/cifssmb.c:6001:25: warning: array subscript is above array bounds [-Warray-bounds]
    
    This patch cleans up the code a bit by using the offsetof macro instead
    of the funky "&pSMB->hdr.Protocol" construct.
    
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b48f57ff205805a81c56c7b480347349bf19620
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Fri Jul 26 17:12:56 2013 +0200

    debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)
    
    commit 776164c1faac4966ab14418bb0922e1820da1d19 upstream.
    
    debugfs_remove_recursive() is wrong,
    
    1. it wrongly assumes that !list_empty(d_subdirs) means that this
       dir should be removed.
    
       This is not that bad by itself, but:
    
    2. if d_subdirs does not becomes empty after __debugfs_remove()
       it gives up and silently fails, it doesn't even try to remove
       other entries.
    
       However ->d_subdirs can be non-empty because it still has the
       already deleted !debugfs_positive() entries.
    
    3. simple_release_fs() is called even if __debugfs_remove() fails.
    
    Suppose we have
    
    	dir1/
    		dir2/
    			file2
    		file1
    
    and someone opens dir1/dir2/file2.
    
    Now, debugfs_remove_recursive(dir1/dir2) succeeds, and dir1/dir2 goes
    away.
    
    But debugfs_remove_recursive(dir1) silently fails and doesn't remove
    this directory. Because it tries to delete (the already deleted)
    dir1/dir2/file2 again and then fails due to "Avoid infinite loop"
    logic.
    
    Test-case:
    
    	#!/bin/sh
    
    	cd /sys/kernel/debug/tracing
    	echo 'p:probe/sigprocmask sigprocmask' >> kprobe_events
    	sleep 1000 < events/probe/sigprocmask/id &
    	echo -n >| kprobe_events
    
    	[ -d events/probe ] && echo "ERR!! failed to rm probe"
    
    And after that it is not possible to create another probe entry.
    
    With this patch debugfs_remove_recursive() skips !debugfs_positive()
    files although this is not strictly needed. The most important change
    is that it does not try to make ->d_subdirs empty, it simply scans
    the whole list(s) recursively and removes as much as possible.
    
    Link: http://lkml.kernel.org/r/20130726151256.GC19472@redhat.com
    
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1336e0d81c7ea5128f87993907aaff3db71bf973
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:23:21 2013 +0930

    virtio: console: return -ENODEV on all read operations after unplug
    
    commit 96f97a83910cdb9d89d127c5ee523f8fc040a804 upstream.
    
    If a port gets unplugged while a user is blocked on read(), -ENODEV is
    returned.  However, subsequent read()s returned 0, indicating there's no
    host-side connection (but not indicating the device went away).
    
    This also happened when a port was unplugged and the user didn't have
    any blocking operation pending.  If the user didn't monitor the SIGIO
    signal, they won't have a chance to find out if the port went away.
    
    Fix by returning -ENODEV on all read()s after the port gets unplugged.
    write() already behaves this way.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7ba6337874c92f15212065b120fa70de573c56ed
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:21:32 2013 +0930

    virtio: console: fix raising SIGIO after port unplug
    
    commit 92d3453815fbe74d539c86b60dab39ecdf01bb99 upstream.
    
    SIGIO should be sent when a port gets unplugged.  It should only be sent
    to prcesses that have the port opened, and have asked for SIGIO to be
    delivered.  We were clearing out guest_connected before calling
    send_sigio_to_port(), resulting in a sigio not getting sent to
    processes.
    
    Fix by setting guest_connected to false after invoking the sigio
    function.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64aafc3d30fac8bc65bb28b1bbd97528cb5ef725
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:20:29 2013 +0930

    virtio: console: clean up port data immediately at time of unplug
    
    commit ea3768b4386a8d1790f4cc9a35de4f55b92d6442 upstream.
    
    We used to keep the port's char device structs and the /sys entries
    around till the last reference to the port was dropped.  This is
    actually unnecessary, and resulted in buggy behaviour:
    
    1. Open port in guest
    2. Hot-unplug port
    3. Hot-plug a port with the same 'name' property as the unplugged one
    
    This resulted in hot-plug being unsuccessful, as a port with the same
    name already exists (even though it was unplugged).
    
    This behaviour resulted in a warning message like this one:
    
    -------------------8<---------------------------------------
    WARNING: at fs/sysfs/dir.c:512 sysfs_add_one+0xc9/0x130() (Not tainted)
    Hardware name: KVM
    sysfs: cannot create duplicate filename
    '/devices/pci0000:00/0000:00:04.0/virtio0/virtio-ports/vport0p1'
    
    Call Trace:
     [<ffffffff8106b607>] ? warn_slowpath_common+0x87/0xc0
     [<ffffffff8106b6f6>] ? warn_slowpath_fmt+0x46/0x50
     [<ffffffff811f2319>] ? sysfs_add_one+0xc9/0x130
     [<ffffffff811f23e8>] ? create_dir+0x68/0xb0
     [<ffffffff811f2469>] ? sysfs_create_dir+0x39/0x50
     [<ffffffff81273129>] ? kobject_add_internal+0xb9/0x260
     [<ffffffff812733d8>] ? kobject_add_varg+0x38/0x60
     [<ffffffff812734b4>] ? kobject_add+0x44/0x70
     [<ffffffff81349de4>] ? get_device_parent+0xf4/0x1d0
     [<ffffffff8134b389>] ? device_add+0xc9/0x650
    
    -------------------8<---------------------------------------
    
    Instead of relying on guest applications to release all references to
    the ports, we should go ahead and unregister the port from all the core
    layers.  Any open/read calls on the port will then just return errors,
    and an unplug/plug operation on the host will succeed as expected.
    
    This also caused buggy behaviour in case of the device removal (not just
    a port): when the device was removed (which means all ports on that
    device are removed automatically as well), the ports with active
    users would clean up only when the last references were dropped -- and
    it would be too late then to be referencing char device pointers,
    resulting in oopses:
    
    -------------------8<---------------------------------------
    PID: 6162   TASK: ffff8801147ad500  CPU: 0   COMMAND: "cat"
     #0 [ffff88011b9d5a90] machine_kexec at ffffffff8103232b
     #1 [ffff88011b9d5af0] crash_kexec at ffffffff810b9322
     #2 [ffff88011b9d5bc0] oops_end at ffffffff814f4a50
     #3 [ffff88011b9d5bf0] die at ffffffff8100f26b
     #4 [ffff88011b9d5c20] do_general_protection at ffffffff814f45e2
     #5 [ffff88011b9d5c50] general_protection at ffffffff814f3db5
        [exception RIP: strlen+2]
        RIP: ffffffff81272ae2  RSP: ffff88011b9d5d00  RFLAGS: 00010246
        RAX: 0000000000000000  RBX: ffff880118901c18  RCX: 0000000000000000
        RDX: ffff88011799982c  RSI: 00000000000000d0  RDI: 3a303030302f3030
        RBP: ffff88011b9d5d38   R8: 0000000000000006   R9: ffffffffa0134500
        R10: 0000000000001000  R11: 0000000000001000  R12: ffff880117a1cc10
        R13: 00000000000000d0  R14: 0000000000000017  R15: ffffffff81aff700
        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
     #6 [ffff88011b9d5d00] kobject_get_path at ffffffff8126dc5d
     #7 [ffff88011b9d5d40] kobject_uevent_env at ffffffff8126e551
     #8 [ffff88011b9d5dd0] kobject_uevent at ffffffff8126e9eb
     #9 [ffff88011b9d5de0] device_del at ffffffff813440c7
    
    -------------------8<---------------------------------------
    
    So clean up when we have all the context, and all that's left to do when
    the references to the port have dropped is to free up the port struct
    itself.
    
    Reported-by: chayang <chayang@redhat.com>
    Reported-by: YOGANANTH SUBRAMANIAN <anantyog@in.ibm.com>
    Reported-by: FuXiangChun <xfu@redhat.com>
    Reported-by: Qunfang Zhang <qzhang@redhat.com>
    Reported-by: Sibiao Luo <sluo@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c17607b4149b82da3cabffca74c2cdfb8479bb1
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:17:13 2013 +0930

    virtio: console: fix race in port_fops_open() and port unplug
    
    commit 671bdea2b9f210566610603ecbb6584c8a201c8c upstream.
    
    Between open() being called and processed, the port can be unplugged.
    Check if this happened, and bail out.
    
    A simple test script to reproduce this is:
    
    while true; do for i in $(seq 1 100); do echo $i > /dev/vport0p3; done; done;
    
    This opens and closes the port a lot of times; unplugging the port while
    this is happening triggers the bug.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e3a5a432070dcebaffee8f9af193f99471280ea9
Author: Amit Shah <amit.shah@redhat.com>
Date:   Mon Jul 29 14:16:13 2013 +0930

    virtio: console: fix race with port unplug and open/close
    
    commit 057b82be3ca3d066478e43b162fc082930a746c9 upstream.
    
    There's a window between find_port_by_devt() returning a port and us
    taking a kref on the port, where the port could get unplugged.  Fix it
    by taking the reference in find_port_by_devt() itself.
    
    Problem reported and analyzed by Mateusz Guzik.
    
    Reported-by: Mateusz Guzik <mguzik@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2e18e5161c634aa5d7e685f348aca98d295accb8
Author: Curt Brune <curt@cumulusnetworks.com>
Date:   Thu Aug 8 12:11:03 2013 -0700

    hwmon: (adt7470) Fix incorrect return code check
    
    commit 93d783bcca69bfacc8dc739d8a050498402587b5 upstream.
    
    In adt7470_write_word_data(), which writes two bytes using
    i2c_smbus_write_byte_data(), the return codes are incorrectly AND-ed
    together when they should be OR-ed together.
    
    The return code of i2c_smbus_write_byte_data() is zero for success.
    
    The upshot is only the first byte was ever written to the hardware.
    The 2nd byte was never written out.
    
    I noticed that trying to set the fan speed limits was not working
    correctly on my system.  Setting the fan speed limits is the only
    code that uses adt7470_write_word_data().  After making the change
    the limit settings work and the alarms work also.
    
    Signed-off-by: Curt Brune <curt@cumulusnetworks.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>