commit 5dba9ddd98cbc7ad319d687887981a0ea0062c75
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Oct 22 08:58:59 2013 +0100

    Linux 3.0.101

commit 676d438e25b8b1fe251c1d474fab86187dbc6293
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Wed Nov 23 15:49:31 2011 -0500

    ipv6: tcp: fix panic in SYN processing
    
    commit c16a98ed91597b40b22b540c6517103497ef8e74 upstream.
    
    commit 72a3effaf633bc ([NET]: Size listen hash tables using backlog
    hint) added a bug allowing inet6_synq_hash() to return an out of bound
    array index, because of u16 overflow.
    
    Bug can happen if system admins set net.core.somaxconn &
    net.ipv4.tcp_max_syn_backlog sysctls to values greater than 65536
    
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Willy Tarreau <w@1wt.eu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f11d481f8f81dec26d3370bcf8f4c1f2d53ccefc
Author: wojciech kapuscinski <wojtask9@wp.pl>
Date:   Tue Oct 1 19:54:33 2013 -0400

    drm/radeon: fix hw contexts for SUMO2 asics
    
    commit 50b8f5aec04ebec7dbdf2adb17220b9148c99e63 upstream.
    
    They have 4 rather than 8.
    
    Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=63599
    
    Signed-off-by: wojciech kapuscinski <wojtask9@wp.pl>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 826380d59f09185201d4327121f4919d2914a2cc
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri Aug 23 11:40:59 2013 +0300

    watchdog: ts72xx_wdt: locking bug in ioctl
    
    commit 8612ed0d97abcf1c016d34755b7cf2060de71963 upstream.
    
    Calling the WDIOC_GETSTATUS & WDIOC_GETBOOTSTATUS and twice will cause a
    interruptible deadlock.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
    Cc: Jonghwan Choi <jhbird.choi@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ac008905d50badfe8b695fa3f1eef20ac352e3e6
Author: Helge Deller <deller@gmx.de>
Date:   Tue Oct 1 21:54:46 2013 +0200

    parisc: fix interruption handler to respect pagefault_disable()
    
    commit 59b33f148cc08fb33cbe823fca1e34f7f023765e upstream.
    
    Running an "echo t > /proc/sysrq-trigger" crashes the parisc kernel.  The
    problem is, that in print_worker_info() we try to read the workqueue info via
    the probe_kernel_read() functions which use pagefault_disable() to avoid
    crashes like this:
        probe_kernel_read(&pwq, &worker->current_pwq, sizeof(pwq));
        probe_kernel_read(&wq, &pwq->wq, sizeof(wq));
        probe_kernel_read(name, wq->name, sizeof(name) - 1);
    
    The problem here is, that the first probe_kernel_read(&pwq) might return zero
    in pwq and as such the following probe_kernel_reads() try to access contents of
    the page zero which is read protected and generate a kernel segfault.
    
    With this patch we fix the interruption handler to call parisc_terminate()
    directly only if pagefault_disable() was not called (in which case
    preempt_count()==0).  Otherwise we hand over to the pagefault handler which
    will try to look up the faulting address in the fixup tables.
    
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: John David Anglin  <dave.anglin@bell.net>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 546a50594e6241e2002cddbef7c350e177e08e52
Author: Dave Jones <davej@redhat.com>
Date:   Thu Oct 10 20:05:35 2013 -0400

    ext4: fix memory leak in xattr
    
    commit 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc upstream.
    
    If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
    potentionally return from the function without having freed these
    allocations.  If we don't do the return, we over-write the previous
    allocation pointers, so we leak either way.
    
    Spotted with Coverity.
    
    [ Fixed by tytso to set is and bs to NULL after freeing these
      pointers, in case in the retry loop we later end up triggering an
      error causing a jump to cleanup, at which point we could have a double
      free bug. -- Ted ]
    
    Signed-off-by: Dave Jones <davej@fedoraproject.org>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Reviewed-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0ffc34c0d09a7d36ff84d1ac506a352a06ef5e4e
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Sep 30 08:35:10 2013 -0700

    vfs: allow O_PATH file descriptors for fstatfs()
    
    commit 9d05746e7b16d8565dddbe3200faa1e669d23bbf upstream.
    
    Olga reported that file descriptors opened with O_PATH do not work with
    fstatfs(), found during further development of ksh93's thread support.
    
    There is no reason to not allow O_PATH file descriptors here (fstatfs is
    very much a path operation), so use "fdget_raw()".  See commit
    55815f70147d ("vfs: make O_PATH file descriptors usable for 'fstat()'")
    for a very similar issue reported for fstat() by the same team.
    
    Reported-and-tested-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
    Acked-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa759b5d100c8b0d2ec2b83fcac990f2c3ac13b7
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Tue Sep 10 10:52:35 2013 -0400

    random: run random_int_secret_init() run after all late_initcalls
    
    commit 47d06e532e95b71c0db3839ebdef3fe8812fca2c upstream.
    
    The some platforms (e.g., ARM) initializes their clocks as
    late_initcalls for some unknown reason.  So make sure
    random_int_secret_init() is run after all of the late_initcalls are
    run.
    
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>