--- /dev/null
+From 7ecd0bde5bfea524a843ad8fa8cb66ccbce68779 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Wed, 14 Jan 2015 11:11:03 -0200
+Subject: ARM: dts: imx25: Fix PWM "per" clocks
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 7ecd0bde5bfea524a843ad8fa8cb66ccbce68779 upstream.
+
+Currently PWM functionality is broken on mx25 due to the wrong assignment of the
+PWM "per" clock.
+
+According to Documentation/devicetree/bindings/clock/imx25-clock.txt:
+ pwm_ipg_per 52
+
+,so update the pwm "per" to use 'pwm_ipg_per' instead of 'per10' clock.
+
+With this change PWM can work fine on mx25.
+
+Reported-by: Carlos Soto <csotoalonso@gmail.com>
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx25.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -369,7 +369,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fa0000 0x4000>;
+- clocks = <&clks 106>, <&clks 36>;
++ clocks = <&clks 106>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <36>;
+ };
+@@ -388,7 +388,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fa8000 0x4000>;
+- clocks = <&clks 107>, <&clks 36>;
++ clocks = <&clks 107>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <41>;
+ };
+@@ -429,7 +429,7 @@
+ pwm4: pwm@53fc8000 {
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ reg = <0x53fc8000 0x4000>;
+- clocks = <&clks 108>, <&clks 36>;
++ clocks = <&clks 108>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <42>;
+ };
+@@ -476,7 +476,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fe0000 0x4000>;
+- clocks = <&clks 105>, <&clks 36>;
++ clocks = <&clks 105>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <26>;
+ };
--- /dev/null
+From 8f1e8ee28660018a935c7576b9af8ffe1feab54c Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Fri, 16 Jan 2015 17:11:27 +0100
+Subject: ARM: mvebu: completely disable hardware I/O coherency
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit 8f1e8ee28660018a935c7576b9af8ffe1feab54c upstream.
+
+The current hardware I/O coherency is known to cause problems with DMA
+coherent buffers, as it still requires explicit I/O synchronization
+barriers, which is not compatible with the semantics expected by the
+Linux DMA coherent buffers API.
+
+So, in order to have enough time to validate a new solution based on
+automatic I/O synchronization barriers, this commit disables hardware
+I/O coherency entirely. Future patches will re-enable it.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-mvebu/coherency.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-mvebu/coherency.c
++++ b/arch/arm/mach-mvebu/coherency.c
+@@ -398,9 +398,14 @@ static int coherency_type(void)
+ return type;
+ }
+
++/*
++ * As a precaution, we currently completely disable hardware I/O
++ * coherency, until enough testing is done with automatic I/O
++ * synchronization barriers to validate that it is a proper solution.
++ */
+ int coherency_available(void)
+ {
+- return coherency_type() != COHERENCY_FABRIC_TYPE_NONE;
++ return false;
+ }
+
+ int __init coherency_init(void)
--- /dev/null
+From 38bdf45f4aa5cb6186d50a29e6cbbd9d486a1519 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Sun, 18 Jan 2015 09:46:10 -0600
+Subject: bus: mvebu-mbus: fix support of MBus window 13
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+commit 38bdf45f4aa5cb6186d50a29e6cbbd9d486a1519 upstream.
+
+On Armada XP, 375 and 38x the MBus window 13 has the remap capability,
+like windows 0 to 7. However, the mvebu-mbus driver isn't currently
+taking into account this special case, which means that when window 13
+is actually used, the remap registers are left to 0, making the device
+using this MBus window unavailable.
+
+As a minimal fix for stable, don't use window 13. A full fix will
+follow later.
+
+Fixes: fddddb52a6c ("bus: introduce an Marvell EBU MBus driver")
+Reviewed-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bus/mvebu-mbus.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/bus/mvebu-mbus.c
++++ b/drivers/bus/mvebu-mbus.c
+@@ -182,12 +182,25 @@ static void mvebu_mbus_disable_window(st
+ }
+
+ /* Checks whether the given window number is available */
++
++/* On Armada XP, 375 and 38x the MBus window 13 has the remap
++ * capability, like windows 0 to 7. However, the mvebu-mbus driver
++ * isn't currently taking into account this special case, which means
++ * that when window 13 is actually used, the remap registers are left
++ * to 0, making the device using this MBus window unavailable. The
++ * quick fix for stable is to not use window 13. A follow up patch
++ * will correctly handle this window.
++*/
+ static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus,
+ const int win)
+ {
+ void __iomem *addr = mbus->mbuswins_base +
+ mbus->soc->win_cfg_offset(win);
+ u32 ctrl = readl(addr + WIN_CTRL_OFF);
++
++ if (win == 13)
++ return false;
++
+ return !(ctrl & WIN_CTRL_ENABLE);
+ }
+
--- /dev/null
+From 378ff1a53b5724f3ac97b0aba3c9ecac072f6fcd Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 18 Jan 2015 23:37:32 -0500
+Subject: fix deadlock in cifs_ioctl_clone()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 378ff1a53b5724f3ac97b0aba3c9ecac072f6fcd upstream.
+
+It really needs to check that src is non-directory *and* use
+{un,}lock_two_nodirectories(). As it is, it's trivial to cause
+double-lock (ioctl(fd, CIFS_IOC_COPYCHUNK_FILE, fd)) and if the
+last argument is an fd of directory, we are asking for trouble
+by violating the locking order - all directories go before all
+non-directories. If the last argument is an fd of parent
+directory, it has 50% odds of locking child before parent,
+which will cause AB-BA deadlock if we race with unlink().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/ioctl.c | 21 +++++----------------
+ 1 file changed, 5 insertions(+), 16 deletions(-)
+
+--- a/fs/cifs/ioctl.c
++++ b/fs/cifs/ioctl.c
+@@ -86,21 +86,16 @@ static long cifs_ioctl_clone(unsigned in
+ }
+
+ src_inode = file_inode(src_file.file);
++ rc = -EINVAL;
++ if (S_ISDIR(src_inode->i_mode))
++ goto out_fput;
+
+ /*
+ * Note: cifs case is easier than btrfs since server responsible for
+ * checks for proper open modes and file type and if it wants
+ * server could even support copy of range where source = target
+ */
+-
+- /* so we do not deadlock racing two ioctls on same files */
+- if (target_inode < src_inode) {
+- mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_PARENT);
+- mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_CHILD);
+- } else {
+- mutex_lock_nested(&src_inode->i_mutex, I_MUTEX_PARENT);
+- mutex_lock_nested(&target_inode->i_mutex, I_MUTEX_CHILD);
+- }
++ lock_two_nondirectories(target_inode, src_inode);
+
+ /* determine range to clone */
+ rc = -EINVAL;
+@@ -124,13 +119,7 @@ static long cifs_ioctl_clone(unsigned in
+ out_unlock:
+ /* although unlocking in the reverse order from locking is not
+ strictly necessary here it is a little cleaner to be consistent */
+- if (target_inode < src_inode) {
+- mutex_unlock(&src_inode->i_mutex);
+- mutex_unlock(&target_inode->i_mutex);
+- } else {
+- mutex_unlock(&target_inode->i_mutex);
+- mutex_unlock(&src_inode->i_mutex);
+- }
++ unlock_two_nondirectories(src_inode, target_inode);
+ out_fput:
+ fdput(src_file);
+ out_drop_write:
dm-cache-share-cache-metadata-object-across-inactive-and-active-dm-tables.patch
dm-cache-fix-problematic-dual-use-of-a-single-migration-count-variable.patch
irqchip-omap-intc-fix-legacy-dma-regression.patch
+time-settimeofday-validate-the-values-of-tv-from-user.patch
+time-adjtimex-validate-the-adj_frequency-values.patch
+arm-dts-imx25-fix-pwm-per-clocks.patch
+arm-mvebu-completely-disable-hardware-i-o-coherency.patch
+bus-mvebu-mbus-fix-support-of-mbus-window-13.patch
+fix-deadlock-in-cifs_ioctl_clone.patch
--- /dev/null
+From 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Wed, 3 Dec 2014 19:25:05 -0500
+Subject: time: adjtimex: Validate the ADJ_FREQUENCY values
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream.
+
+Verify that the frequency value from userspace is valid and makes sense.
+
+Unverified values can cause overflows later on.
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+[jstultz: Fix up bug for negative values and drop redunent cap check]
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/ntp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -633,6 +633,13 @@ int ntp_validate_timex(struct timex *txc
+ if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
+ return -EPERM;
+
++ if (txc->modes & ADJ_FREQUENCY) {
++ if (LONG_MIN / PPM_SCALE > txc->freq)
++ return -EINVAL;
++ if (LONG_MAX / PPM_SCALE < txc->freq)
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Wed, 3 Dec 2014 19:22:48 -0500
+Subject: time: settimeofday: Validate the values of tv from user
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 upstream.
+
+An unvalidated user input is multiplied by a constant, which can result in
+an undefined behaviour for large values. While this is validated later,
+we should avoid triggering undefined behaviour.
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+[jstultz: include trivial milisecond->microsecond correction noticed
+by Andy]
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/time.h | 13 +++++++++++++
+ kernel/time/time.c | 4 ++++
+ 2 files changed, 17 insertions(+)
+
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -99,6 +99,19 @@ static inline bool timespec_valid_strict
+ return true;
+ }
+
++static inline bool timeval_valid(const struct timeval *tv)
++{
++ /* Dates before 1970 are bogus */
++ if (tv->tv_sec < 0)
++ return false;
++
++ /* Can't have more microseconds then a second */
++ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
++ return false;
++
++ return true;
++}
++
+ extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
+
+ #define CURRENT_TIME (current_kernel_time())
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -196,6 +196,10 @@ SYSCALL_DEFINE2(settimeofday, struct tim
+ if (tv) {
+ if (copy_from_user(&user_tv, tv, sizeof(*tv)))
+ return -EFAULT;
++
++ if (!timeval_valid(&user_tv))
++ return -EINVAL;
++
+ new_ts.tv_sec = user_tv.tv_sec;
+ new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
