]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 1 Mar 2016 18:54:11 +0000 (10:54 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 1 Mar 2016 18:54:11 +0000 (10:54 -0800)
added patches:
dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch
dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch
gspca-ov534-topro-prevent-a-division-by-0.patch
media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch
tda1004x-only-update-the-frontend-properties-if-locked.patch

queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch [new file with mode: 0644]
queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch [new file with mode: 0644]
queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch [new file with mode: 0644]
queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch [new file with mode: 0644]
queue-3.14/series
queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch [new file with mode: 0644]

diff --git a/queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch b/queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch
new file mode 100644 (file)
index 0000000..723e920
--- /dev/null
@@ -0,0 +1,135 @@
+From 385277bfb57faac44e92497104ba542cdd82d5fe Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 8 Jan 2016 19:07:55 -0500
+Subject: dm snapshot: fix hung bios when copy error occurs
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 385277bfb57faac44e92497104ba542cdd82d5fe upstream.
+
+When there is an error copying a chunk dm-snapshot can incorrectly hold
+associated bios indefinitely, resulting in hung IO.
+
+The function copy_callback sets pe->error if there was error copying the
+chunk, and then calls complete_exception.  complete_exception calls
+pending_complete on error, otherwise it calls commit_exception with
+commit_callback (and commit_callback calls complete_exception).
+
+The persistent exception store (dm-snap-persistent.c) assumes that calls
+to prepare_exception and commit_exception are paired.
+persistent_prepare_exception increases ps->pending_count and
+persistent_commit_exception decreases it.
+
+If there is a copy error, persistent_prepare_exception is called but
+persistent_commit_exception is not.  This results in the variable
+ps->pending_count never returning to zero and that causes some pending
+exceptions (and their associated bios) to be held forever.
+
+Fix this by unconditionally calling commit_exception regardless of
+whether the copy was successful.  A new "valid" parameter is added to
+commit_exception -- when the copy fails this parameter is set to zero so
+that the chunk that failed to copy (and all following chunks) is not
+recorded in the snapshot store.  Also, remove commit_callback now that
+it is merely a wrapper around pending_complete.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-exception-store.h |    2 +-
+ drivers/md/dm-snap-persistent.c |    5 ++++-
+ drivers/md/dm-snap-transient.c  |    4 ++--
+ drivers/md/dm-snap.c            |   20 +++++---------------
+ 4 files changed, 12 insertions(+), 19 deletions(-)
+
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -70,7 +70,7 @@ struct dm_exception_store_type {
+        * Update the metadata with this exception.
+        */
+       void (*commit_exception) (struct dm_exception_store *store,
+-                                struct dm_exception *e,
++                                struct dm_exception *e, int valid,
+                                 void (*callback) (void *, int success),
+                                 void *callback_context);
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -700,7 +700,7 @@ static int persistent_prepare_exception(
+ }
+ static void persistent_commit_exception(struct dm_exception_store *store,
+-                                      struct dm_exception *e,
++                                      struct dm_exception *e, int valid,
+                                       void (*callback) (void *, int success),
+                                       void *callback_context)
+ {
+@@ -709,6 +709,9 @@ static void persistent_commit_exception(
+       struct core_exception ce;
+       struct commit_callback *cb;
++      if (!valid)
++              ps->valid = 0;
++
+       ce.old_chunk = e->old_chunk;
+       ce.new_chunk = e->new_chunk;
+       write_exception(ps, ps->current_committed++, &ce);
+--- a/drivers/md/dm-snap-transient.c
++++ b/drivers/md/dm-snap-transient.c
+@@ -52,12 +52,12 @@ static int transient_prepare_exception(s
+ }
+ static void transient_commit_exception(struct dm_exception_store *store,
+-                                     struct dm_exception *e,
++                                     struct dm_exception *e, int valid,
+                                      void (*callback) (void *, int success),
+                                      void *callback_context)
+ {
+       /* Just succeed */
+-      callback(callback_context, 1);
++      callback(callback_context, valid);
+ }
+ static void transient_usage(struct dm_exception_store *store,
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1388,8 +1388,9 @@ static void __invalidate_snapshot(struct
+       dm_table_event(s->ti->table);
+ }
+-static void pending_complete(struct dm_snap_pending_exception *pe, int success)
++static void pending_complete(void *context, int success)
+ {
++      struct dm_snap_pending_exception *pe = context;
+       struct dm_exception *e;
+       struct dm_snapshot *s = pe->snap;
+       struct bio *origin_bios = NULL;
+@@ -1460,24 +1461,13 @@ out:
+       free_pending_exception(pe);
+ }
+-static void commit_callback(void *context, int success)
+-{
+-      struct dm_snap_pending_exception *pe = context;
+-
+-      pending_complete(pe, success);
+-}
+-
+ static void complete_exception(struct dm_snap_pending_exception *pe)
+ {
+       struct dm_snapshot *s = pe->snap;
+-      if (unlikely(pe->copy_error))
+-              pending_complete(pe, 0);
+-
+-      else
+-              /* Update the metadata if we are persistent */
+-              s->store->type->commit_exception(s->store, &pe->e,
+-                                               commit_callback, pe);
++      /* Update the metadata if we are persistent */
++      s->store->type->commit_exception(s->store, &pe->e, !pe->copy_error,
++                                       pending_complete, pe);
+ }
+ /*
diff --git a/queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch b/queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch
new file mode 100644 (file)
index 0000000..165fc82
--- /dev/null
@@ -0,0 +1,39 @@
+From 512167788a6fe9481a33a3cce5f80b684631a1bb Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Mon, 14 Dec 2015 09:26:01 -0500
+Subject: dm space map metadata: remove unused variable in brb_pop()
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 512167788a6fe9481a33a3cce5f80b684631a1bb upstream.
+
+Remove the unused struct block_op pointer that was inadvertantly
+introduced, via cut-and-paste of previous brb_op() code, as part of
+commit 50dd842ad.
+
+(Cc'ing stable@ because commit 50dd842ad did)
+
+Fixes: 50dd842ad ("dm space map metadata: fix ref counting bug when bootstrapping a new space map")
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c |    3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -152,12 +152,9 @@ static int brb_peek(struct bop_ring_buff
+ static int brb_pop(struct bop_ring_buffer *brb)
+ {
+-      struct block_op *bop;
+-
+       if (brb_empty(brb))
+               return -ENODATA;
+-      bop = brb->bops + brb->begin;
+       brb->begin = brb_next(brb, brb->begin);
+       return 0;
diff --git a/queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch b/queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch
new file mode 100644 (file)
index 0000000..7fcfe2c
--- /dev/null
@@ -0,0 +1,109 @@
+From dcc7fdbec53a960588f2c40232db2c6466c09917 Mon Sep 17 00:00:00 2001
+From: Antonio Ospite <ao2@ao2.it>
+Date: Fri, 2 Oct 2015 17:33:13 -0300
+Subject: [media] gspca: ov534/topro: prevent a division by 0
+
+From: Antonio Ospite <ao2@ao2.it>
+
+commit dcc7fdbec53a960588f2c40232db2c6466c09917 upstream.
+
+v4l2-compliance sends a zeroed struct v4l2_streamparm in
+v4l2-test-formats.cpp::testParmType(), and this results in a division by
+0 in some gspca subdrivers:
+
+  divide error: 0000 [#1] SMP
+  Modules linked in: gspca_ov534 gspca_main ...
+  CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1
+  Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS
+    ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010
+  task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000
+  RIP: 0010:[<ffffffffa079bd62>]  [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
+  RSP: 0018:ffff880095c4fce8  EFLAGS: 00010296
+  RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140
+  RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000
+  RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc
+  R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400
+  R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000
+  FS:  00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0
+  Stack:
+   ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616
+   ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000
+   ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016
+  Call Trace:
+   [<ffffffffa07a6431>] ? v4l_s_parm+0x21/0x50 [videodev]
+   [<ffffffffa077656e>] ? vidioc_s_parm+0x4e/0x60 [gspca_main]
+   [<ffffffffa07a5e20>] ? __video_do_ioctl+0x280/0x2f0 [videodev]
+   [<ffffffffa07a5ba0>] ? video_ioctl2+0x20/0x20 [videodev]
+   [<ffffffffa07a59b9>] ? video_usercopy+0x319/0x4e0 [videodev]
+   [<ffffffff81182dc1>] ? page_add_new_anon_rmap+0x71/0xa0
+   [<ffffffff811afb92>] ? mem_cgroup_commit_charge+0x52/0x90
+   [<ffffffff81179b18>] ? handle_mm_fault+0xc18/0x1680
+   [<ffffffffa07a15cc>] ? v4l2_ioctl+0xac/0xd0 [videodev]
+   [<ffffffff811c846f>] ? do_vfs_ioctl+0x28f/0x480
+   [<ffffffff811c86d4>] ? SyS_ioctl+0x74/0x80
+   [<ffffffff8154a8b6>] ? entry_SYSCALL_64_fastpath+0x16/0x75
+  Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00
+    00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 <f7>
+    76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f
+  RIP  [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
+   RSP <ffff880095c4fce8>
+  ---[ end trace 279710c2c6c72080 ]---
+
+Following what the doc says about a zeroed timeperframe (see
+http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html):
+
+  ...
+  To reset manually applications can just set this field to zero.
+
+fix the issue by resetting the frame rate to a default value in case of
+an unusable timeperframe.
+
+The fix is done in the subdrivers instead of gspca.c because only the
+subdrivers have notion of a default frame rate to reset the camera to.
+
+Signed-off-by: Antonio Ospite <ao2@ao2.it>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/gspca/ov534.c |    9 +++++++--
+ drivers/media/usb/gspca/topro.c |    6 +++++-
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/gspca/ov534.c
++++ b/drivers/media/usb/gspca/ov534.c
+@@ -1490,8 +1490,13 @@ static void sd_set_streamparm(struct gsp
+       struct v4l2_fract *tpf = &cp->timeperframe;
+       struct sd *sd = (struct sd *) gspca_dev;
+-      /* Set requested framerate */
+-      sd->frame_rate = tpf->denominator / tpf->numerator;
++      if (tpf->numerator == 0 || tpf->denominator == 0)
++              /* Set default framerate */
++              sd->frame_rate = 30;
++      else
++              /* Set requested framerate */
++              sd->frame_rate = tpf->denominator / tpf->numerator;
++
+       if (gspca_dev->streaming)
+               set_frame_rate(gspca_dev);
+--- a/drivers/media/usb/gspca/topro.c
++++ b/drivers/media/usb/gspca/topro.c
+@@ -4792,7 +4792,11 @@ static void sd_set_streamparm(struct gsp
+       struct v4l2_fract *tpf = &cp->timeperframe;
+       int fr, i;
+-      sd->framerate = tpf->denominator / tpf->numerator;
++      if (tpf->numerator == 0 || tpf->denominator == 0)
++              sd->framerate = 30;
++      else
++              sd->framerate = tpf->denominator / tpf->numerator;
++
+       if (gspca_dev->streaming)
+               setframerate(gspca_dev, v4l2_ctrl_g_ctrl(gspca_dev->exposure));
diff --git a/queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch b/queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch
new file mode 100644 (file)
index 0000000..8168e99
--- /dev/null
@@ -0,0 +1,44 @@
+From c9d57de6103e343f2d4e04ea8d9e417e10a24da7 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Mon, 31 Aug 2015 06:13:45 -0300
+Subject: [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit c9d57de6103e343f2d4e04ea8d9e417e10a24da7 upstream.
+
+When in FE_TUNE_MODE_ONESHOT the frontend must report
+the actual capabilities so user can take appropriate
+action.
+
+With frontends that can't do auto inversion this is done
+by dvb-core automatically so CAN_INVERSION_AUTO is valid.
+
+However, when in FE_TUNE_MODE_ONESHOT this is not true.
+
+So only set FE_CAN_INVERSION_AUTO in modes other than
+FE_TUNE_MODE_ONESHOT
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-core/dvb_frontend.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -2195,9 +2195,9 @@ static int dvb_frontend_ioctl_legacy(str
+               dev_dbg(fe->dvb->device, "%s: current delivery system on cache: %d, V3 type: %d\n",
+                                __func__, c->delivery_system, fe->ops.info.type);
+-              /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't
+-               * do it, it is done for it. */
+-              info->caps |= FE_CAN_INVERSION_AUTO;
++              /* Set CAN_INVERSION_AUTO bit on in other than oneshot mode */
++              if (!(fepriv->tune_mode_flags & FE_TUNE_MODE_ONESHOT))
++                      info->caps |= FE_CAN_INVERSION_AUTO;
+               err = 0;
+               break;
+       }
index cc148faa9b27000c3bc5475706bc61353b78a007..4a22308adf569a443f79f0bf973c52dd3b8e5b8f 100644 (file)
@@ -91,3 +91,8 @@ s390-dasd-prevent-incorrect-length-error-under-z-vm-after-pav-changes.patch
 s390-dasd-fix-refcount-for-pav-reassignment.patch
 uml-flush-stdout-before-forking.patch
 uml-fix-hostfs-mknod.patch
+media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch
+gspca-ov534-topro-prevent-a-division-by-0.patch
+tda1004x-only-update-the-frontend-properties-if-locked.patch
+dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch
+dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch
diff --git a/queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch b/queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch
new file mode 100644 (file)
index 0000000..1feaa7f
--- /dev/null
@@ -0,0 +1,48 @@
+From e8beb02343e7582980c6705816cd957cf4f74c7a Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Wed, 3 Feb 2016 17:33:48 -0200
+Subject: [media] tda1004x: only update the frontend properties if locked
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit e8beb02343e7582980c6705816cd957cf4f74c7a upstream.
+
+The tda1004x was updating the properties cache before locking.
+If the device is not locked, the data at the registers are just
+random values with no real meaning.
+
+This caused the driver to fail with libdvbv5, as such library
+calls GET_PROPERTY from time to time, in order to return the
+DVB stats.
+
+Tested with a saa7134 card 78:
+       ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/tda1004x.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/dvb-frontends/tda1004x.c
++++ b/drivers/media/dvb-frontends/tda1004x.c
+@@ -903,9 +903,18 @@ static int tda1004x_get_fe(struct dvb_fr
+ {
+       struct dtv_frontend_properties *fe_params = &fe->dtv_property_cache;
+       struct tda1004x_state* state = fe->demodulator_priv;
++      int status;
+       dprintk("%s\n", __func__);
++      status = tda1004x_read_byte(state, TDA1004X_STATUS_CD);
++      if (status == -1)
++              return -EIO;
++
++      /* Only update the properties cache if device is locked */
++      if (!(status & 8))
++              return 0;
++
+       // inversion status
+       fe_params->inversion = INVERSION_OFF;
+       if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20)