2.6.42.10-1.fc15

12 files changed, 190 insertions, 377 deletions

diff --git a/freed-ora/current/f15/bsg-fix-sysfs-link-remove-warning.patch b/freed-ora/current/f15/bsg-fix-sysfs-link-remove-warning.patch
deleted file mode 100644
index 6e7625327..000000000
--- a/freed-ora/current/f15/bsg-fix-sysfs-link-remove-warning.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/block/bsg.c b/block/bsg.c
-index 4cf703f..ff64ae3 100644
---- a/block/bsg.c
-+++ b/block/bsg.c
-@@ -983,7 +983,8 @@ void bsg_unregister_queue(struct request_queue *q)
- 
- 	mutex_lock(&bsg_mutex);
- 	idr_remove(&bsg_minor_idr, bcd->minor);
--	sysfs_remove_link(&q->kobj, "bsg");
-+	if (q->kobj.sd)
-+		sysfs_remove_link(&q->kobj, "bsg");
- 	device_unregister(bcd->class_dev);
- 	bcd->class_dev = NULL;
- 	kref_put(&bcd->ref, bsg_kref_release_function);
--- 
-1.7.4.4
diff --git a/freed-ora/current/f15/cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch b/freed-ora/current/f15/cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch
deleted file mode 100644
index 9fd87acac..000000000
--- a/freed-ora/current/f15/cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 5bccda0ebc7c0331b81ac47d39e4b920b198b2cd Mon Sep 17 00:00:00 2001
-From: Jeff Layton <jlayton@redhat.com>
-Date: Thu, 23 Feb 2012 09:37:45 -0500
-Subject: [PATCH] cifs: fix dentry refcount leak when opening a FIFO on lookup
-
-The cifs code will attempt to open files on lookup under certain
-circumstances. What happens though if we find that the file we opened
-was actually a FIFO or other special file?
-
-Currently, the open filehandle just ends up being leaked leading to
-a dentry refcount mismatch and oops on umount. Fix this by having the
-code close the filehandle on the server if it turns out not to be a
-regular file. While we're at it, change this spaghetti if statement
-into a switch too.
-
-Cc: stable@vger.kernel.org
-Reported-by: CAI Qian <caiqian@redhat.com>
-Tested-by: CAI Qian <caiqian@redhat.com>
-Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
-Signed-off-by: Jeff Layton <jlayton@redhat.com>
-Signed-off-by: Steve French <smfrench@gmail.com>
----
- fs/cifs/dir.c |   20 ++++++++++++++++++--
- 1 files changed, 18 insertions(+), 2 deletions(-)
-
-diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
-index 63a196b..bc7e244 100644
---- a/fs/cifs/dir.c
-+++ b/fs/cifs/dir.c
-@@ -584,10 +584,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
- 			 * If either that or op not supported returned, follow
- 			 * the normal lookup.
- 			 */
--			if ((rc == 0) || (rc == -ENOENT))
-+			switch (rc) {
-+			case 0:
-+				/*
-+				 * The server may allow us to open things like
-+				 * FIFOs, but the client isn't set up to deal
-+				 * with that. If it's not a regular file, just
-+				 * close it and proceed as if it were a normal
-+				 * lookup.
-+				 */
-+				if (newInode && !S_ISREG(newInode->i_mode)) {
-+					CIFSSMBClose(xid, pTcon, fileHandle);
-+					break;
-+				}
-+			case -ENOENT:
- 				posix_open = true;
--			else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
-+			case -EOPNOTSUPP:
-+				break;
-+			default:
- 				pTcon->broken_posix_open = true;
-+			}
- 		}
- 		if (!posix_open)
- 			rc = cifs_get_inode_info_unix(&newInode, full_path,
--- 
-1.7.0.4
-
diff --git a/freed-ora/current/f15/kernel.spec b/freed-ora/current/f15/kernel.spec
index 31af7061e..63c328d76 100644
--- a/freed-ora/current/f15/kernel.spec
+++ b/freed-ora/current/f15/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # When changing real_sublevel below, reset this by hand to 1
 # (or to 0 and then use rpmdev-bumpspec).
 #
-%global baserelease 2
+%global baserelease 1
 %global fedora_build %{baserelease}
 
 # real_sublevel is the 3.x kernel version we're starting with
@@ -54,10 +54,35 @@ Summary: The Linux kernel
 # changes.  This is only used to determine which tarball to use.
 #define librev
 
+#define baselibre -libre
+%define basegnu -libre%{?librev}
+
+%define rcrevgnux %{basegnu}
+
 # To be inserted between "patch" and "-2.6.".
-%define stablelibre -libre
-#define rcrevlibre -libre
-#define gitrevlibre -libre
+%define stablelibre -3.2%{?stablegnux}
+#define rcrevlibre -3.2%{?rcrevgnux}
+#define gitrevlibre -3.2%{?gitrevgnux}
+
+%if 0%{?stablelibre:1}
+%define stablegnu -libre%{?librev}
+%endif
+%if 0%{?rcrevlibre:1}
+%define rcrevgnu -libre%{?librev}
+%endif
+%if 0%{?gitrevlibre:1}
+%define gitrevgnu -libre%{?librev}
+%endif
+
+%if !0%{?stablegnux:1}
+%define stablegnux %{?stablegnu}
+%endif
+%if !0%{?rcrevgnux:1}
+%define rcrevgnux %{?rcrevgnu}
+%endif
+%if !0%{?gitrevgnux:1}
+%define gitrevgnux %{?gitrevgnu}
+%endif
 
 # libres (s for suffix) may be bumped for rebuilds in which patches
 # change but fedora_build doesn't.  Make sure it starts with a dot.
@@ -65,7 +90,7 @@ Summary: The Linux kernel
 #define libres .
 
 # Do we have a -stable update to apply?
-%define stable_update 9
+%define stable_update 10
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -570,11 +595,11 @@ Source1000: config-local
 # For a stable release kernel
 %if 0%{?stable_update}
 %if 0%{?stable_base}
-%define    stable_patch_00  patch%{?stablelibre}-3.%{real_sublevel}.%{stable_base}.xz
+%define    stable_patch_00  patch%{?stablelibre}-3.%{real_sublevel}.%{stable_base}%{?stablegnu}.xz
 Patch00: %{stable_patch_00}
 %endif
 %if 0%{?stable_rc}
-%define    stable_patch_01  patch%{?rcrevlibre}-3.%{real_sublevel}.%{stable_update}-rc%{stable_rc}.xz
+%define    stable_patch_01  patch%{?rcrevlibre}-3.%{real_sublevel}.%{stable_update}-rc%{stable_rc}%{?rcrevgnu}.xz
 Patch01: %{stable_patch_01}
 %endif
 %endif
@@ -640,7 +665,6 @@ Patch1500: fix_xen_guest_on_old_EC2.patch
 Patch1810: drm-nouveau-updates.patch
 # intel drm is all merged upstream
 Patch1824: drm-intel-next.patch
-Patch1825: drm-intel-crtc-dpms-fix.patch
 # hush the i915 fbc noise
 Patch1826: drm-i915-fbc-stfu.patch
 
@@ -666,8 +690,6 @@ Patch3500: jbd-jbd2-validate-sb-s_first-in-journal_get_superblo.patch
 
 Patch12016: disable-i8042-check-on-apple-mac.patch
 
-Patch12026: bsg-fix-sysfs-link-remove-warning.patch
-
 Patch12303: dmar-disable-when-ricoh-multifunction.patch
 
 Patch13002: revert-efi-rtclock.patch
@@ -738,24 +760,18 @@ Patch21101: hpsa-add-irqf-shared.patch
 #rhbz 727865 730007
 Patch21102: ACPICA-Fix-regression-in-FADT-revision-checks.patch
 
-# rhbz 798296
-Patch21103: cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch
-
 #rhbz 728478
 Patch21104: sony-laptop-Enable-keyboard-backlight-by-default.patch
 
 # Disable threading in hibernate compression
 Patch21105: disable-threading-in-compression-for-hibernate.patch
 
-#rhbz 799782 CVE-2012-1097
-Patch21106: regset-Prevent-null-pointer-reference-on-readonly-re.patch
-Patch21107: regset-Return-EFAULT-not-EIO-on-host-side-memory-fau.patch
-
-#rhbz 786632
-Patch21108: mm-thp-fix-BUG-on-mm-nr_ptes.patch
+Patch21110: x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch
 
 Patch21200: unhandled-irqs-switch-to-polling.patch
 
+Patch22000: weird-root-dentry-name-debug.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1169,14 +1185,14 @@ do
 done
 %endif
 
-perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION =%{?stablelibre:-libre%{?librev}}/" Makefile
+perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION =%{?stablegnux}/" Makefile
 
 # released_kernel with possible stable updates
 %if 0%{?stable_base}
 ApplyPatch %{stable_patch_00}
 %endif
 %if 0%{?stable_rc}
-perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION =%{?rcrevlibre:-libre%{?librev}}/" Makefile
+perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION =%{?rcrevgnux}/" Makefile
 ApplyPatch %{stable_patch_01}
 %endif
 
@@ -1305,7 +1321,6 @@ ApplyOptionalPatch drm-nouveau-updates.patch
 
 # Intel DRM
 ApplyOptionalPatch drm-intel-next.patch
-ApplyPatch drm-intel-crtc-dpms-fix.patch
 ApplyPatch drm-i915-fbc-stfu.patch
 
 ApplyPatch linux-2.6-intel-iommu-igfx.patch
@@ -1324,8 +1339,6 @@ ApplyOptionalPatch linux-2.6-v4l-dvb-experimental.patch
 
 ApplyPatch disable-i8042-check-on-apple-mac.patch
 
-ApplyPatch bsg-fix-sysfs-link-remove-warning.patch
-
 # rhbz#605888
 ApplyPatch dmar-disable-when-ricoh-multifunction.patch
 
@@ -1389,22 +1402,17 @@ ApplyPatch bcma-brcmsmac-compat.patch
 #rhbz 727865 730007
 ApplyPatch ACPICA-Fix-regression-in-FADT-revision-checks.patch
 
-# rhbz 798296
-ApplyPatch cifs-fix-dentry-refcount-leak-when-opening-a-FIFO.patch
-
 #rhbz 728478
 ApplyPatch sony-laptop-Enable-keyboard-backlight-by-default.patch
 
 #Disable threading in hibernate compression
 ApplyPatch disable-threading-in-compression-for-hibernate.patch
 
-#rhbz 799782 CVE-2012-1097
-ApplyPatch regset-Prevent-null-pointer-reference-on-readonly-re.patch
-ApplyPatch regset-Return-EFAULT-not-EIO-on-host-side-memory-fau.patch
-
 ApplyPatch unhandled-irqs-switch-to-polling.patch
 
-ApplyPatch mm-thp-fix-BUG-on-mm-nr_ptes.patch
+ApplyPatch weird-root-dentry-name-debug.patch
+
+ApplyPatch x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch
 
 # END OF PATCH APPLICATIONS
 
@@ -2053,6 +2061,19 @@ fi
 # and build.
 
 %changelog
+* Mon Mar 12 2012 Justin M. Forbes <jforbes@redhat.com> - 2.6.42.10-1
+- Linux 3.2.10
+
+* Mon Mar 12 2012 Josh Boyer <jwboyer@redhat.com>
+- Add patch to ignore bogus io-apic entries (rhbz 801501)
+
+* Wed Mar 07 2012 Dave Jones <davej@redhat.com>
+- Add debug patch for bugs 787171/766277
+
+* Wed Mar 07 2012 Josh Boye <jwboyer@redhat.com>
+- CVE-2012-1146: memcg: unregister events attached to the same eventfd can
+  oops (rhbz 800817)
+
 * Mon Mar 05 2012 Josh Boyer <jwboyer@redhat.com>
 - CVE-2012-1097 regset: Prevent null pointer reference on readonly regsets
 - Add patch to fix BUG_ON mm->nr_ptes (rhbz 786632)
diff --git a/freed-ora/current/f15/mm-thp-fix-BUG-on-mm-nr_ptes.patch b/freed-ora/current/f15/mm-thp-fix-BUG-on-mm-nr_ptes.patch
deleted file mode 100644
index 44be5d5a9..000000000
--- a/freed-ora/current/f15/mm-thp-fix-BUG-on-mm-nr_ptes.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-On Thu, 16 Feb 2012, Andrea Arcangeli wrote:
-> On Thu, Feb 16, 2012 at 01:53:04AM -0800, Hugh Dickins wrote:
-> > Yes (and I think less troublesome than most BUGs, coming at exit
-> > while not holding locks; though we could well make it a WARN_ON,
-> > I don't think that existed back in the day).
-> 
-> A WARN_ON would be fine with me, go ahead if you prefer it... only
-> risk would be to go unnoticed or be underestimated. I am ok with the
-> BUG_ON too (even if this time it triggered false positives... sigh).
-> 
-> > Acked-by: Hugh Dickins <hughd@google.com>
-> 
-> Thanks for the quick review!
-> 
-> > In looking into the bug, it had actually bothered me a little that you
-> > were setting aside those pages, yet not counting them into nr_ptes;
-> > though the only thing that cares is oom_kill.c, and the count of pages
-> > in each hugepage can only dwarf the count in nr_ptes (whereas, without
-> > hugepages, it's possible to populate very sparsely and nr_ptes become
-> > significant).
-> 
-> Agreed, it's not significant either ways.
-> 
-> Running my two primary systems with this applied for half a day and no
-> problem so far so it should be good foro -mm at least.
-
-And I've had no trouble running your patch since then (but I never hit
-the bug it fixes either).  But we've all forgottent about it, so let me
-bring your patch back inline (I've added one introductory sentence) and
-address to akpm...
-
-
-From: Andrea Arcangeli <aarcange@redhat.com>
-Subject: [PATCH] mm: thp: fix BUG on mm->nr_ptes
-
-Dave Jones reports a few Fedora users hitting the BUG_ON(mm->nr_ptes...)
-in exit_mmap() recently.
-
-Quoting Hugh's discovery and explanation of the SMP race condition:
-
-===
-mm->nr_ptes had unusual locking: down_read mmap_sem plus
-page_table_lock when incrementing, down_write mmap_sem (or mm_users 0)
-when decrementing; whereas THP is careful to increment and decrement
-it under page_table_lock.
-
-Now most of those paths in THP also hold mmap_sem for read or write
-(with appropriate checks on mm_users), but two do not: when
-split_huge_page() is called by hwpoison_user_mappings(), and when
-called by add_to_swap().
-
-It's conceivable that the latter case is responsible for the
-exit_mmap() BUG_ON mm->nr_ptes that has been reported on Fedora.
-===
-
-The simplest way to fix it without having to alter the locking is to
-make split_huge_page() a noop in nr_ptes terms, so by counting the
-preallocated pagetables that exists for every mapped hugepage. It was
-an arbitrary choice not to count them and either way is not wrong or
-right, because they are not used but they're still allocated.
-
-Reported-by: Dave Jones <davej@redhat.com>
-Reported-by: Hugh Dickins <hughd@google.com>
-Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
-Acked-by: Hugh Dickins <hughd@google.com>
----
- mm/huge_memory.c |    6 +++---
- 1 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/mm/huge_memory.c b/mm/huge_memory.c
-index 91d3efb..8f7fc39 100644
---- a/mm/huge_memory.c
-+++ b/mm/huge_memory.c
-@@ -671,6 +671,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
- 		set_pmd_at(mm, haddr, pmd, entry);
- 		prepare_pmd_huge_pte(pgtable, mm);
- 		add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
-+		mm->nr_ptes++;
- 		spin_unlock(&mm->page_table_lock);
- 	}
- 
-@@ -789,6 +790,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
- 	pmd = pmd_mkold(pmd_wrprotect(pmd));
- 	set_pmd_at(dst_mm, addr, dst_pmd, pmd);
- 	prepare_pmd_huge_pte(pgtable, dst_mm);
-+	dst_mm->nr_ptes++;
- 
- 	ret = 0;
- out_unlock:
-@@ -887,7 +889,6 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
- 	}
- 	kfree(pages);
- 
--	mm->nr_ptes++;
- 	smp_wmb(); /* make pte visible before pmd */
- 	pmd_populate(mm, pmd, pgtable);
- 	page_remove_rmap(page);
-@@ -1047,6 +1048,7 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
- 			VM_BUG_ON(page_mapcount(page) < 0);
- 			add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
- 			VM_BUG_ON(!PageHead(page));
-+			tlb->mm->nr_ptes--;
- 			spin_unlock(&tlb->mm->page_table_lock);
- 			tlb_remove_page(tlb, page);
- 			pte_free(tlb->mm, pgtable);
-@@ -1375,7 +1377,6 @@ static int __split_huge_page_map(struct page *page,
- 			pte_unmap(pte);
- 		}
- 
--		mm->nr_ptes++;
- 		smp_wmb(); /* make pte visible before pmd */
- 		/*
- 		 * Up to this point the pmd is present and huge and
-@@ -1988,7 +1989,6 @@ static void collapse_huge_page(struct mm_struct *mm,
- 	set_pmd_at(mm, address, pmd, _pmd);
- 	update_mmu_cache(vma, address, _pmd);
- 	prepare_pmd_huge_pte(pgtable, mm);
--	mm->nr_ptes--;
- 	spin_unlock(&mm->page_table_lock);
- 
- #ifndef CONFIG_NUMA
diff --git a/freed-ora/current/f15/patch-3.2-libre-3.2.10-libre.xz.sign b/freed-ora/current/f15/patch-3.2-libre-3.2.10-libre.xz.sign
new file mode 100644
index 000000000..84b04b032
--- /dev/null
+++ b/freed-ora/current/f15/patch-3.2-libre-3.2.10-libre.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.18 (GNU/Linux)
+
+iEYEABECAAYFAk9edIoACgkQvLfPh359R6fiVQCeOf4lOM4Vp1qGeZ5pgvhvjLpb
+4SAAn0CHcSVzmP2zR2Es+aR5tXVOcmUm
+=/1pL
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f15/patch-libre-3.2.9.xz.sign b/freed-ora/current/f15/patch-libre-3.2.9.xz.sign
deleted file mode 100644
index 6118e052b..000000000
--- a/freed-ora/current/f15/patch-libre-3.2.9.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.18 (GNU/Linux)
-
-iEYEABECAAYFAk9O8PgACgkQvLfPh359R6e31gCfdzz06OKnO1A+eKfXIS5byXDn
-ELEAniq5/8Cizdp1NOsMuTa0L61RoprY
-=Wjsw
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f15/regset-Prevent-null-pointer-reference-on-readonly-re.patch b/freed-ora/current/f15/regset-Prevent-null-pointer-reference-on-readonly-re.patch
deleted file mode 100644
index 6e2462ee1..000000000
--- a/freed-ora/current/f15/regset-Prevent-null-pointer-reference-on-readonly-re.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From c8e252586f8d5de906385d8cf6385fee289a825e Mon Sep 17 00:00:00 2001
-From: "H. Peter Anvin" <hpa@zytor.com>
-Date: Fri, 2 Mar 2012 10:43:48 -0800
-Subject: [PATCH 1/2] regset: Prevent null pointer reference on readonly
- regsets
-
-The regset common infrastructure assumed that regsets would always
-have .get and .set methods, but not necessarily .active methods.
-Unfortunately people have since written regsets without .set methods.
-
-Rather than putting in stub functions everywhere, handle regsets with
-null .get or .set methods explicitly.
-
-Signed-off-by: H. Peter Anvin <hpa@zytor.com>
-Reviewed-by: Oleg Nesterov <oleg@redhat.com>
-Acked-by: Roland McGrath <roland@hack.frob.com>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- fs/binfmt_elf.c        |    2 +-
- include/linux/regset.h |    6 ++++++
- 2 files changed, 7 insertions(+), 1 deletions(-)
-
-diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index bcb884e..07d096c 100644
---- a/fs/binfmt_elf.c
-+++ b/fs/binfmt_elf.c
-@@ -1421,7 +1421,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
- 	for (i = 1; i < view->n; ++i) {
- 		const struct user_regset *regset = &view->regsets[i];
- 		do_thread_regset_writeback(t->task, regset);
--		if (regset->core_note_type &&
-+		if (regset->core_note_type && regset->get &&
- 		    (!regset->active || regset->active(t->task, regset))) {
- 			int ret;
- 			size_t size = regset->n * regset->size;
-diff --git a/include/linux/regset.h b/include/linux/regset.h
-index 8abee65..5150fd1 100644
---- a/include/linux/regset.h
-+++ b/include/linux/regset.h
-@@ -335,6 +335,9 @@ static inline int copy_regset_to_user(struct task_struct *target,
- {
- 	const struct user_regset *regset = &view->regsets[setno];
- 
-+	if (!regset->get)
-+		return -EOPNOTSUPP;
-+
- 	if (!access_ok(VERIFY_WRITE, data, size))
- 		return -EIO;
- 
-@@ -358,6 +361,9 @@ static inline int copy_regset_from_user(struct task_struct *target,
- {
- 	const struct user_regset *regset = &view->regsets[setno];
- 
-+	if (!regset->set)
-+		return -EOPNOTSUPP;
-+
- 	if (!access_ok(VERIFY_READ, data, size))
- 		return -EIO;
- 
--- 
-1.7.7.6
-
diff --git a/freed-ora/current/f15/regset-Return-EFAULT-not-EIO-on-host-side-memory-fau.patch b/freed-ora/current/f15/regset-Return-EFAULT-not-EIO-on-host-side-memory-fau.patch
deleted file mode 100644
index 21b8ae1ce..000000000
--- a/freed-ora/current/f15/regset-Return-EFAULT-not-EIO-on-host-side-memory-fau.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 5189fa19a4b2b4c3bec37c3a019d446148827717 Mon Sep 17 00:00:00 2001
-From: "H. Peter Anvin" <hpa@zytor.com>
-Date: Fri, 2 Mar 2012 10:43:49 -0800
-Subject: [PATCH 2/2] regset: Return -EFAULT, not -EIO, on host-side memory
- fault
-
-There is only one error code to return for a bad user-space buffer
-pointer passed to a system call in the same address space as the
-system call is executed, and that is EFAULT.  Furthermore, the
-low-level access routines, which catch most of the faults, return
-EFAULT already.
-
-Signed-off-by: H. Peter Anvin <hpa@zytor.com>
-Reviewed-by: Oleg Nesterov <oleg@redhat.com>
-Acked-by: Roland McGrath <roland@hack.frob.com>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- include/linux/regset.h |    4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/include/linux/regset.h b/include/linux/regset.h
-index 5150fd1..686f373 100644
---- a/include/linux/regset.h
-+++ b/include/linux/regset.h
-@@ -339,7 +339,7 @@ static inline int copy_regset_to_user(struct task_struct *target,
- 		return -EOPNOTSUPP;
- 
- 	if (!access_ok(VERIFY_WRITE, data, size))
--		return -EIO;
-+		return -EFAULT;
- 
- 	return regset->get(target, regset, offset, size, NULL, data);
- }
-@@ -365,7 +365,7 @@ static inline int copy_regset_from_user(struct task_struct *target,
- 		return -EOPNOTSUPP;
- 
- 	if (!access_ok(VERIFY_READ, data, size))
--		return -EIO;
-+		return -EFAULT;
- 
- 	return regset->set(target, regset, offset, size, NULL, data);
- }
--- 
-1.7.7.6
-
diff --git a/freed-ora/current/f15/sources b/freed-ora/current/f15/sources
index cfaf72974..9ae745094 100644
--- a/freed-ora/current/f15/sources
+++ b/freed-ora/current/f15/sources
@@ -1,2 +1,2 @@
 27c641c4f6785fc647cdd3e44963a55c  linux-3.2-libre.tar.xz
-8e601878ccdd37111cc84500ebd81387  patch-libre-3.2.9.xz
+2f7fa0bab9808b7d75ea2fe79ee84da0  patch-3.2-libre-3.2.10-libre.xz
diff --git a/freed-ora/current/f15/unhandled-irqs-switch-to-polling.patch b/freed-ora/current/f15/unhandled-irqs-switch-to-polling.patch
index 8eb09052b..6eeaf0bec 100644
--- a/freed-ora/current/f15/unhandled-irqs-switch-to-polling.patch
+++ b/freed-ora/current/f15/unhandled-irqs-switch-to-polling.patch
@@ -140,16 +140,16 @@ every time during debugging).
 
 
 Signed-off-by: Jeroen Van den Keybus <jeroen.vandenkeybus@gmail.com>
+
+Make it less chatty.  Josh Boyer <jwboyer@redhat.com>
 ======
 
-diff -up linux-3.2-rc4.orig/kernel/irq/spurious.c
-linux-3.2-rc4/kernel/irq/spurious.c
---- linux-3.2-rc4.orig/kernel/irq/spurious.c	2011-12-01 23:56:01.000000000 +0100
-+++ linux-3.2-rc4/kernel/irq/spurious.c	2011-12-11 16:14:48.188377387 +0100
+--- linux-2.6.orig/kernel/irq/spurious.c
++++ linux-2.6/kernel/irq/spurious.c
 @@ -18,7 +18,7 @@
-
+ 
  static int irqfixup __read_mostly;
-
+ 
 -#define POLL_SPURIOUS_IRQ_INTERVAL (HZ/10)
 +#define POLL_SPURIOUS_IRQ_INTERVAL (HZ/100)
  static void poll_spurious_irqs(unsigned long dummy);
@@ -161,42 +161,37 @@ linux-3.2-rc4/kernel/irq/spurious.c
  	struct irq_desc *desc;
 -	int i;
 +	int i, poll_again;
-
+ 
  	if (atomic_inc_return(&irq_poll_active) != 1)
  		goto out;
  	irq_poll_cpu = smp_processor_id();
-
+ 
 +	poll_again = 0; /* Will stay false as long as no polling candidate is found */
  	for_each_irq_desc(i, desc) {
 -		unsigned int state;
 +		unsigned int state, irq;
-
+ 
  		if (!i)
  			 continue;
-@@ -158,15 +159,33 @@ static void poll_spurious_irqs(unsigned
- 		barrier();
+@@ -159,14 +160,29 @@ static void poll_spurious_irqs(unsigned
  		if (!(state & IRQS_SPURIOUS_DISABLED))
  			continue;
--
+ 
 -		local_irq_disable();
 -		try_one_irq(i, desc, true);
 -		local_irq_enable();
-+		
 +		/* We end up here with a disabled spurious interrupt.
 +		   desc->irqs_unhandled now tracks the number of times
 +		   the interrupt has been polled */
 +
 +		irq = desc->irq_data.irq;
 +		if (desc->irqs_unhandled < 100) { /* 1 second delay with poll frequency 100 Hz */
-+			if (desc->irqs_unhandled == 0)
-+				printk("Polling IRQ %d\n", irq);
 +			local_irq_disable();
 +			try_one_irq(i, desc, true);
 +			local_irq_enable();
 +			desc->irqs_unhandled++;
 +			poll_again = 1;
 +		} else {
-+			printk("Reenabling IRQ %d\n", irq);
 +			irq_enable(desc); /* Reenable the interrupt line */
 +			desc->depth--;
 +			desc->istate &= (~IRQS_SPURIOUS_DISABLED);
@@ -211,11 +206,11 @@ linux-3.2-rc4/kernel/irq/spurious.c
 -	mod_timer(&poll_spurious_irq_timer,
 -		  jiffies + POLL_SPURIOUS_IRQ_INTERVAL);
  }
-
+ 
  static inline int bad_action_ret(irqreturn_t action_ret)
-@@ -177,11 +196,19 @@ static inline int bad_action_ret(irqretu
+@@ -177,11 +193,19 @@ static inline int bad_action_ret(irqretu
  }
-
+ 
  /*
 - * If 99,900 of the previous 100,000 interrupts have not been handled
 + * If 9 of the previous 10 interrupts have not been handled
@@ -235,14 +230,14 @@ linux-3.2-rc4/kernel/irq/spurious.c
   *  functioning device sharing an IRQ with the failing one)
   */
  static void
-@@ -302,19 +329,19 @@ void note_interrupt(unsigned int irq, st
+@@ -302,19 +326,19 @@ void note_interrupt(unsigned int irq, st
  	}
-
+ 
  	desc->irq_count++;
 -	if (likely(desc->irq_count < 100000))
 +	if (likely(desc->irq_count < 10))
  		return;
-
+ 
  	desc->irq_count = 0;
 -	if (unlikely(desc->irqs_unhandled > 99900)) {
 +	if (unlikely(desc->irqs_unhandled >= 9)) {
@@ -259,11 +254,3 @@ linux-3.2-rc4/kernel/irq/spurious.c
  		desc->istate |= IRQS_SPURIOUS_DISABLED;
  		desc->depth++;
  		irq_disable(desc);
-
-======
---
-To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
-Please read the FAQ at  http://www.tux.org/lkml/
-
diff --git a/freed-ora/current/f15/weird-root-dentry-name-debug.patch b/freed-ora/current/f15/weird-root-dentry-name-debug.patch
new file mode 100644
index 000000000..e2fb2e116
--- /dev/null
+++ b/freed-ora/current/f15/weird-root-dentry-name-debug.patch
@@ -0,0 +1,19 @@
+debug patch for bz 787171/766277
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index bcbdb33..a6a5fdb 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2530,8 +2530,10 @@ global_root:
+ 	 */
+ 	if (IS_ROOT(dentry) &&
+ 	    (dentry->d_name.len != 1 || dentry->d_name.name[0] != '/')) {
+-		WARN(1, "Root dentry has weird name <%.*s>\n",
+-		     (int) dentry->d_name.len, dentry->d_name.name);
++		WARN(1, "Root dentry has weird name <%.*s>  vfsmnt:%s fs:%s\n",
++		     (int) dentry->d_name.len, dentry->d_name.name,
++			vfsmnt->mnt_root->d_name.name,
++			vfsmnt->mnt_sb->s_type->name);
+ 	}
+ 	if (!slash)
+ 		error = prepend(buffer, buflen, "/", 1);
diff --git a/freed-ora/current/f15/x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch b/freed-ora/current/f15/x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch
new file mode 100644
index 000000000..9928829e0
--- /dev/null
+++ b/freed-ora/current/f15/x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch
@@ -0,0 +1,93 @@
+On Tue, 2012-01-31 at 09:26 -0500, Josh Boyer wrote:
+> On Wed, Jan 25, 2012 at 06:15:35PM -0500, Josh Boyer wrote:
+> > On Wed, Jan 25, 2012 at 02:04:08PM -0800, Suresh Siddha wrote:
+> > > On Wed, 2012-01-25 at 08:49 -0500, Josh Boyer wrote:
+> > > > [    0.000000] IOAPIC[1]: apic_id 2, version 255, address 0xfec28000, GSI 24-279
+> > > 
+> > > This looks indeed like a bogus entry probably returning all 1's for
+> > > RTE's etc. Can you please send me a dmesg with "apic=verbose" boot
+> > > parameter?
+> > 
+> > Here you go:
+> > 
+> > https://bugzilla.redhat.com/attachment.cgi?id=557552
+> 
+> Was this helpful at all?  I've been watching lkml for a related patch
+> in case I was missed on CC but haven't seen anything as of yet.
+
+Yes, it was helpful. Something like the appended patch should ignore the
+bogus io-apic entry all together. As I can't test this, can you or the
+reporter give the appended patch a try and ack please?
+
+thanks,
+suresh
+---
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Subject: x86, ioapic: add register checks for bogus io-apic entries
+
+With the recent changes to clear_IO_APIC_pin() which tries to clear
+remoteIRR bit explicitly, some of the users started to see
+"Unable to reset IRR for apic .." messages.
+
+Close look shows that these are related to bogus IO-APIC entries which
+return's all 1's for their io-apic registers. And the above mentioned error
+messages are benign. But kernel should have ignored such io-apic's in the
+first place.
+
+Check if register 0, 1, 2 of the listed io-apic are all 1's and ignore
+such io-apic.
+
+Reported-by: Álvaro Castillo <midgoon@gmail.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+---
+ arch/x86/kernel/apic/io_apic.c |   26 ++++++++++++++++++++++++++
+ 1 files changed, 26 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index fb07275..953e54d 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -3979,6 +3979,26 @@ static __init int bad_ioapic(unsigned long address)
+ 	return 0;
+ }
+ 
++static __init int bad_ioapic_regs(int idx)
++{
++	union IO_APIC_reg_00 reg_00;
++	union IO_APIC_reg_01 reg_01;
++	union IO_APIC_reg_02 reg_02;
++
++	reg_00.raw = io_apic_read(idx, 0);
++	reg_01.raw = io_apic_read(idx, 1);
++	reg_02.raw = io_apic_read(idx, 2);
++
++	if (reg_00.raw == -1 && reg_01.raw == -1 && reg_02.raw == -1) {
++		printk(KERN_WARNING
++		       "I/O APIC 0x%x regs return all ones, skipping!\n",
++		       mpc_ioapic_addr(idx));
++		return 1;
++	}
++
++	return 0;
++}
++
+ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
+ {
+ 	int idx = 0;
+@@ -3995,6 +4015,12 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
+ 	ioapics[idx].mp_config.apicaddr = address;
+ 
+ 	set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
++
++	if (bad_ioapic_regs(idx)) {
++		clear_fixmap(FIX_IO_APIC_BASE_0 + idx);
++		return;
++	}
++
+ 	ioapics[idx].mp_config.apicid = io_apic_unique_id(id);
+ 	ioapics[idx].mp_config.apicver = io_apic_get_version(idx);
+ 
+
+
+