]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.0-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Apr 2012 23:14:26 +0000 (16:14 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Apr 2012 23:14:26 +0000 (16:14 -0700)
added patches:
cciss-fix-scsi-tape-io-with-more-than-255-scatter-gather-elements.patch
cciss-initialize-scsi-host-max_sectors-for-tape-drive-support.patch
drivers-rtc-rtc-pl031.c-enable-clock-on-all-st-variants.patch
hugetlb-fix-race-condition-in-hugetlb_fault.patch
sparc64-eliminate-obsolete-__handle_softirq-function.patch
sparc64-fix-bootup-crash-on-sun4v.patch
staging-iio-hmc5843-fix-crash-in-probe-function.patch
tty-serial-altera_uart-check-for-null-platform_data-in-probe.patch

queue-3.0/cciss-fix-scsi-tape-io-with-more-than-255-scatter-gather-elements.patch [new file with mode: 0644]
queue-3.0/cciss-initialize-scsi-host-max_sectors-for-tape-drive-support.patch [new file with mode: 0644]
queue-3.0/drivers-rtc-rtc-pl031.c-enable-clock-on-all-st-variants.patch [new file with mode: 0644]
queue-3.0/hugetlb-fix-race-condition-in-hugetlb_fault.patch [new file with mode: 0644]
queue-3.0/series
queue-3.0/sparc64-eliminate-obsolete-__handle_softirq-function.patch [new file with mode: 0644]
queue-3.0/sparc64-fix-bootup-crash-on-sun4v.patch [new file with mode: 0644]
queue-3.0/staging-iio-hmc5843-fix-crash-in-probe-function.patch [new file with mode: 0644]
queue-3.0/tty-serial-altera_uart-check-for-null-platform_data-in-probe.patch [new file with mode: 0644]

diff --git a/queue-3.0/cciss-fix-scsi-tape-io-with-more-than-255-scatter-gather-elements.patch b/queue-3.0/cciss-fix-scsi-tape-io-with-more-than-255-scatter-gather-elements.patch
new file mode 100644 (file)
index 0000000..2fd9aa2
--- /dev/null
@@ -0,0 +1,35 @@
+From bc67f63650fad6b3478d9ddfd5406d45a95987c9 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Thu, 22 Mar 2012 21:40:09 +0100
+Subject: cciss: Fix scsi tape io with more than 255 scatter gather elements
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit bc67f63650fad6b3478d9ddfd5406d45a95987c9 upstream.
+
+The total number of scatter gather elements in the CISS command
+used by the scsi tape code was being cast to a u8, which can hold
+at most 255 scatter gather elements.  It should have been cast to
+a u16.  Without this patch the command gets rejected by the controller
+since the total scatter gather count did not add up to the right
+value resulting in an i/o error.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/cciss_scsi.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -1411,7 +1411,7 @@ static void cciss_scatter_gather(ctlr_in
+       /* track how many SG entries we are using */
+       if (request_nsgs > h->maxSG)
+               h->maxSG = request_nsgs;
+-      c->Header.SGTotal = (__u8) request_nsgs + chained;
++      c->Header.SGTotal = (u16) request_nsgs + chained;
+       if (request_nsgs > h->max_cmd_sgentries)
+               c->Header.SGList = h->max_cmd_sgentries;
+       else
diff --git a/queue-3.0/cciss-initialize-scsi-host-max_sectors-for-tape-drive-support.patch b/queue-3.0/cciss-initialize-scsi-host-max_sectors-for-tape-drive-support.patch
new file mode 100644 (file)
index 0000000..acff3fb
--- /dev/null
@@ -0,0 +1,32 @@
+From 395d287526bb60411ff37b19ad9dd38b58ba8732 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Thu, 22 Mar 2012 21:40:08 +0100
+Subject: cciss: Initialize scsi host max_sectors for tape drive support
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit 395d287526bb60411ff37b19ad9dd38b58ba8732 upstream.
+
+The default is too small (1024 blocks), use h->cciss_max_sectors (8192 blocks)
+Without this change, if you try to set the block size of a tape drive above
+512*1024, via "mt -f /dev/st0 setblk nnn" where nnn is greater than 524288,
+it won't work right.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/cciss_scsi.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -866,6 +866,7 @@ cciss_scsi_detect(ctlr_info_t *h)
+       sh->can_queue = cciss_tape_cmds;
+       sh->sg_tablesize = h->maxsgentries;
+       sh->max_cmd_len = MAX_COMMAND_SIZE;
++      sh->max_sectors = h->cciss_max_sectors;
+       ((struct cciss_scsi_adapter_data_t *) 
+               h->scsi_ctlr)->scsi_host = sh;
diff --git a/queue-3.0/drivers-rtc-rtc-pl031.c-enable-clock-on-all-st-variants.patch b/queue-3.0/drivers-rtc-rtc-pl031.c-enable-clock-on-all-st-variants.patch
new file mode 100644 (file)
index 0000000..3a1cb49
--- /dev/null
@@ -0,0 +1,36 @@
+From 2f3972168353d355854d6381f1f360ce83b723e5 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 12 Apr 2012 12:49:16 -0700
+Subject: drivers/rtc/rtc-pl031.c: enable clock on all ST variants
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 2f3972168353d355854d6381f1f360ce83b723e5 upstream.
+
+The ST variants of the PL031 all require bit 26 in the control register
+to be set before they work properly.  Discovered this when testing on
+the Nomadik board where it would suprisingly just stand still.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Mian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
+Cc: Alessandro Rubini <rubini@unipv.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-pl031.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-pl031.c
++++ b/drivers/rtc/rtc-pl031.c
+@@ -339,8 +339,7 @@ static int pl031_probe(struct amba_devic
+       dev_dbg(&adev->dev, "revision = 0x%01x\n", ldata->hw_revision);
+       /* Enable the clockwatch on ST Variants */
+-      if ((ldata->hw_designer == AMBA_VENDOR_ST) &&
+-          (ldata->hw_revision > 1))
++      if (ldata->hw_designer == AMBA_VENDOR_ST)
+               writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
+                      ldata->base + RTC_CR);
diff --git a/queue-3.0/hugetlb-fix-race-condition-in-hugetlb_fault.patch b/queue-3.0/hugetlb-fix-race-condition-in-hugetlb_fault.patch
new file mode 100644 (file)
index 0000000..1ec6146
--- /dev/null
@@ -0,0 +1,87 @@
+From 66aebce747eaf9bc456bf1f1b217d8db843031d0 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Thu, 12 Apr 2012 12:49:15 -0700
+Subject: hugetlb: fix race condition in hugetlb_fault()
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit 66aebce747eaf9bc456bf1f1b217d8db843031d0 upstream.
+
+The race is as follows:
+
+Suppose a multi-threaded task forks a new process (on cpu A), thus
+bumping up the ref count on all the pages.  While the fork is occurring
+(and thus we have marked all the PTEs as read-only), another thread in
+the original process (on cpu B) tries to write to a huge page, taking an
+access violation from the write-protect and calling hugetlb_cow().  Now,
+suppose the fork() fails.  It will undo the COW and decrement the ref
+count on the pages, so the ref count on the huge page drops back to 1.
+Meanwhile hugetlb_cow() also decrements the ref count by one on the
+original page, since the original address space doesn't need it any
+more, having copied a new page to replace the original page.  This
+leaves the ref count at zero, and when we call unlock_page(), we panic.
+
+       fork on CPU A                           fault on CPU B
+       =============                           ==============
+       ...
+       down_write(&parent->mmap_sem);
+       down_write_nested(&child->mmap_sem);
+       ...
+       while duplicating vmas
+               if error
+                       break;
+       ...
+       up_write(&child->mmap_sem);
+       up_write(&parent->mmap_sem);            ...
+                                               down_read(&parent->mmap_sem);
+                                               ...
+                                               lock_page(page);
+                                               handle COW
+                                               page_mapcount(old_page) == 2
+                                               alloc and prepare new_page
+       ...
+       handle error
+       page_remove_rmap(page);
+       put_page(page);
+       ...
+                                               fold new_page into pte
+                                               page_remove_rmap(page);
+                                               put_page(page);
+                                               ...
+                               oops ==>        unlock_page(page);
+                                               up_read(&parent->mmap_sem);
+
+The solution is to take an extra reference to the page while we are
+holding the lock on it.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Cc: Hillf Danton <dhillf@gmail.com>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2679,6 +2679,7 @@ int hugetlb_fault(struct mm_struct *mm,
+        * so no worry about deadlock.
+        */
+       page = pte_page(entry);
++      get_page(page);
+       if (page != pagecache_page)
+               lock_page(page);
+@@ -2710,6 +2711,7 @@ out_page_table_lock:
+       }
+       if (page != pagecache_page)
+               unlock_page(page);
++      put_page(page);
+ out_mutex:
+       mutex_unlock(&hugetlb_instantiation_mutex);
index 092d4ca8c5515eafaead29532f10fa19e6033bb3..890c2667c0b3c24d1139a6706ab75d6806f2124f 100644 (file)
@@ -4,3 +4,11 @@ rtlwifi-add-missing-dma-buffer-unmapping-for-pci-drivers.patch
 arm-7384-1-thumbee-disable-userspace-teehbr-access-for-config_arm_thumbee.patch
 bluetooth-hci_ldisc-fix-null-pointer-dereference-on-tty_close.patch
 ia64-fix-futex_atomic_cmpxchg_inatomic.patch
+drivers-rtc-rtc-pl031.c-enable-clock-on-all-st-variants.patch
+hugetlb-fix-race-condition-in-hugetlb_fault.patch
+staging-iio-hmc5843-fix-crash-in-probe-function.patch
+tty-serial-altera_uart-check-for-null-platform_data-in-probe.patch
+sparc64-eliminate-obsolete-__handle_softirq-function.patch
+sparc64-fix-bootup-crash-on-sun4v.patch
+cciss-initialize-scsi-host-max_sectors-for-tape-drive-support.patch
+cciss-fix-scsi-tape-io-with-more-than-255-scatter-gather-elements.patch
diff --git a/queue-3.0/sparc64-eliminate-obsolete-__handle_softirq-function.patch b/queue-3.0/sparc64-eliminate-obsolete-__handle_softirq-function.patch
new file mode 100644 (file)
index 0000000..dbbd318
--- /dev/null
@@ -0,0 +1,60 @@
+From 3d3eeb2ef26112a200785e5fca58ec58dd33bf1e Mon Sep 17 00:00:00 2001
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Fri, 13 Apr 2012 03:35:13 +0000
+Subject: sparc64: Eliminate obsolete __handle_softirq() function
+
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+
+commit 3d3eeb2ef26112a200785e5fca58ec58dd33bf1e upstream.
+
+The invocation of softirq is now handled by irq_exit(), so there is no
+need for sparc64 to invoke it on the trap-return path.  In fact, doing so
+is a bug because if the trap occurred in the idle loop, this invocation
+can result in lockdep-RCU failures.  The problem is that RCU ignores idle
+CPUs, and the sparc64 trap-return path to the softirq handlers fails to
+tell RCU that the CPU must be considered non-idle while those handlers
+are executing.  This means that RCU is ignoring any RCU read-side critical
+sections in those handlers, which in turn means that RCU-protected data
+can be yanked out from under those read-side critical sections.
+
+The shiny new lockdep-RCU ability to detect RCU read-side critical sections
+that RCU is ignoring located this problem.
+
+The fix is straightforward: Make sparc64 stop manually invoking the
+softirq handlers.
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Suggested-by: David Miller <davem@davemloft.net>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/rtrap_64.S |    7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/arch/sparc/kernel/rtrap_64.S
++++ b/arch/sparc/kernel/rtrap_64.S
+@@ -20,11 +20,6 @@
+               .text
+               .align                  32
+-__handle_softirq:
+-              call                    do_softirq
+-               nop
+-              ba,a,pt                 %xcc, __handle_softirq_continue
+-               nop
+ __handle_preemption:
+               call                    schedule
+                wrpr                   %g0, RTRAP_PSTATE, %pstate
+@@ -89,9 +84,7 @@ rtrap:
+               cmp                     %l1, 0
+               /* mm/ultra.S:xcall_report_regs KNOWS about this load. */
+-              bne,pn                  %icc, __handle_softirq
+                ldx                    [%sp + PTREGS_OFF + PT_V9_TSTATE], %l1
+-__handle_softirq_continue:
+ rtrap_xcall:
+               sethi                   %hi(0xf << 20), %l4
+               and                     %l1, %l4, %l4
diff --git a/queue-3.0/sparc64-fix-bootup-crash-on-sun4v.patch b/queue-3.0/sparc64-fix-bootup-crash-on-sun4v.patch
new file mode 100644 (file)
index 0000000..b5189e9
--- /dev/null
@@ -0,0 +1,31 @@
+From 9e0daff30fd7ecf698e5d20b0fa7f851e427cca5 Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Fri, 13 Apr 2012 11:56:22 -0700
+Subject: sparc64: Fix bootup crash on sun4v.
+
+From: "David S. Miller" <davem@davemloft.net>
+
+commit 9e0daff30fd7ecf698e5d20b0fa7f851e427cca5 upstream.
+
+The DS driver registers as a subsys_initcall() but this can be too
+early, in particular this risks registering before we've had a chance
+to allocate and setup module_kset in kernel/params.c which is
+performed also as a subsyts_initcall().
+
+Register DS using device_initcall() insteal.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/ds.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/ds.c
++++ b/arch/sparc/kernel/ds.c
+@@ -1269,4 +1269,4 @@ static int __init ds_init(void)
+       return vio_register_driver(&ds_driver);
+ }
+-subsys_initcall(ds_init);
++fs_initcall(ds_init);
diff --git a/queue-3.0/staging-iio-hmc5843-fix-crash-in-probe-function.patch b/queue-3.0/staging-iio-hmc5843-fix-crash-in-probe-function.patch
new file mode 100644 (file)
index 0000000..e258ede
--- /dev/null
@@ -0,0 +1,105 @@
+From 62d2feb9803f18c4e3c8a1a2c7e30a54df8a1d72 Mon Sep 17 00:00:00 2001
+From: Marek Belisko <marek.belisko@open-nandra.com>
+Date: Thu, 12 Apr 2012 21:48:03 +0200
+Subject: staging: iio: hmc5843: Fix crash in probe function.
+
+From: Marek Belisko <marek.belisko@open-nandra.com>
+
+commit 62d2feb9803f18c4e3c8a1a2c7e30a54df8a1d72 upstream.
+
+Fix crash after issuing:
+       echo hmc5843 0x1e > /sys/class/i2c-dev/i2c-2/device/new_device
+
+       [   37.180999] device: '2-001e': device_add
+       [   37.188293] bus: 'i2c': add device 2-001e
+       [   37.194549] PM: Adding info for i2c:2-001e
+       [   37.200958] bus: 'i2c': driver_probe_device: matched device 2-001e with driver hmc5843
+       [   37.210815] bus: 'i2c': really_probe: probing driver hmc5843 with device 2-001e
+       [   37.224884] HMC5843 initialized
+       [   37.228759] ------------[ cut here ]------------
+       [   37.233612] kernel BUG at mm/slab.c:505!
+       [   37.237701] Internal error: Oops - BUG: 0 [#1] PREEMPT
+       [   37.243103] Modules linked in:
+       [   37.246337] CPU: 0    Not tainted  (3.3.1-gta04+ #28)
+       [   37.251647] PC is at kfree+0x84/0x144
+       [   37.255493] LR is at kfree+0x20/0x144
+       [   37.259338] pc : [<c00b408c>]    lr : [<c00b4028>]    psr: 40000093
+       [   37.259368] sp : de249cd8  ip : 0000000c  fp : 00000090
+       [   37.271362] r10: 0000000a  r9 : de229eac  r8 : c0236274
+       [   37.276855] r7 : c09d6490  r6 : a0000013  r5 : de229c00  r4 : de229c10
+       [   37.283691] r3 : c0f00218  r2 : 00000400  r1 : c0eea000  r0 : c00b4028
+       [   37.290527] Flags: nZcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
+       [   37.298095] Control: 10c5387d  Table: 9e1d0019  DAC: 00000015
+       [   37.304107] Process sh (pid: 91, stack limit = 0xde2482f0)
+       [   37.309844] Stack: (0xde249cd8 to 0xde24a000)
+       [   37.314422] 9cc0:                                                       de229c10 de229c00
+       [   37.322998] 9ce0: de229c10 ffffffea 00000005 c0236274 de140a80 c00b4798 dec00080 de140a80
+       [   37.331573] 9d00: c032f37c dec00080 000080d0 00000001 de229c00 de229c10 c048d578 00000005
+       [   37.340148] 9d20: de229eac 0000000a 00000090 c032fa40 00000001 00000000 00000001 de229c10
+       [   37.348724] 9d40: de229eac 00000029 c075b558 00000001 00000003 00000004 de229c10 c048d594
+       [   37.357299] 9d60: 00000000 60000013 00000018 205b0007 37332020 3432322e 5d343838 c0060020
+       [   37.365905] 9d80: de251600 00000001 00000000 de251600 00000001 c0065a84 de229c00 de229c48
+       [   37.374481] 9da0: 00000006 0048d62c de229c38 de229c00 de229c00 de1f6c00 de1f6c20 00000001
+       [   37.383056] 9dc0: 00000000 c048d62c 00000000 de229c00 de229c00 de1f6c00 de1f6c20 00000001
+       [   37.391632] 9de0: 00000000 c048d62c 00000000 c0330164 00000000 de1f6c20 c048d62c de1f6c00
+       [   37.400207] 9e00: c0330078 de1f6c04 c078d714 de189b58 00000000 c02ccfd8 de1f6c20 c0795f40
+       [   37.408782] 9e20: c0238330 00000000 00000000 c02381a8 de1b9fc0 de1f6c20 de1f6c20 de249e48
+       [   37.417358] 9e40: c0238330 c0236bb0 decdbed8 de7d0f14 de1f6c20 de1f6c20 de1f6c54 de1f6c20
+       [   37.425933] 9e60: 00000000 c0238030 de1f6c20 c078d7bc de1f6c20 c02377ec de1f6c20 de1f6c28
+       [   37.434509] 9e80: dee64cb0 c0236138 c047c554 de189b58 00000000 c004b45c de1f6c20 de1f6cd8
+       [   37.443084] 9ea0: c0edfa6c de1f6c00 dee64c68 de1f6c04 de1f6c20 dee64cb8 c047c554 de189b58
+       [   37.451690] 9ec0: 00000000 c02cd634 dee64c68 de249ef4 de23b008 dee64cb0 0000000d de23b000
+       [   37.460266] 9ee0: de23b007 c02cd78c 00000002 00000000 00000000 35636d68 00333438 00000000
+       [   37.468841] 9f00: 00000000 00000000 001e0000 00000000 00000000 00000000 00000000 0a10cec0
+       [   37.477416] 9f20: 00000002 de249f80 0000000d dee62990 de189b40 c0234d88 0000000d c010c354
+       [   37.485992] 9f40: 0000000d de210f28 000acc88 de249f80 0000000d de248000 00000000 c00b7bf8
+       [   37.494567] 9f60: de210f28 000acc88 de210f28 000acc88 00000000 00000000 0000000d c00b7ed8
+       [   37.503143] 9f80: 00000000 00000000 0000000d 00000000 0007fa28 0000000d 000acc88 00000004
+       [   37.511718] 9fa0: c000e544 c000e380 0007fa28 0000000d 00000001 000acc88 0000000d 00000000
+       [   37.520294] 9fc0: 0007fa28 0000000d 000acc88 00000004 00000001 00000020 00000002 00000000
+       [   37.528869] 9fe0: 00000000 beab8624 0000ea05 b6eaebac 600d0010 00000001 00000000 00000000
+       [   37.537475] [<c00b408c>] (kfree+0x84/0x144) from [<c0236274>] (device_add+0x530/0x57c)
+       [   37.545806] [<c0236274>] (device_add+0x530/0x57c) from [<c032fa40>] (iio_device_register+0x8c8/0x990)
+       [   37.555480] [<c032fa40>] (iio_device_register+0x8c8/0x990) from [<c0330164>] (hmc5843_probe+0xec/0x114)
+       [   37.565338] [<c0330164>] (hmc5843_probe+0xec/0x114) from [<c02ccfd8>] (i2c_device_probe+0xc4/0xf8)
+       [   37.574737] [<c02ccfd8>] (i2c_device_probe+0xc4/0xf8) from [<c02381a8>] (driver_probe_device+0x118/0x218)
+       [   37.584777] [<c02381a8>] (driver_probe_device+0x118/0x218) from [<c0236bb0>] (bus_for_each_drv+0x4c/0x84)
+       [   37.594818] [<c0236bb0>] (bus_for_each_drv+0x4c/0x84) from [<c0238030>] (device_attach+0x78/0xa4)
+       [   37.604125] [<c0238030>] (device_attach+0x78/0xa4) from [<c02377ec>] (bus_probe_device+0x28/0x9c)
+       [   37.613433] [<c02377ec>] (bus_probe_device+0x28/0x9c) from [<c0236138>] (device_add+0x3f4/0x57c)
+       [   37.622650] [<c0236138>] (device_add+0x3f4/0x57c) from [<c02cd634>] (i2c_new_device+0xf8/0x19c)
+       [   37.631805] [<c02cd634>] (i2c_new_device+0xf8/0x19c) from [<c02cd78c>] (i2c_sysfs_new_device+0xb4/0x130)
+       [   37.641754] [<c02cd78c>] (i2c_sysfs_new_device+0xb4/0x130) from [<c0234d88>] (dev_attr_store+0x18/0x24)
+       [   37.651611] [<c0234d88>] (dev_attr_store+0x18/0x24) from [<c010c354>] (sysfs_write_file+0x10c/0x140)
+       [   37.661193] [<c010c354>] (sysfs_write_file+0x10c/0x140) from [<c00b7bf8>] (vfs_write+0xb0/0x178)
+       [   37.670410] [<c00b7bf8>] (vfs_write+0xb0/0x178) from [<c00b7ed8>] (sys_write+0x3c/0x68)
+       [   37.678833] [<c00b7ed8>] (sys_write+0x3c/0x68) from [<c000e380>] (ret_fast_syscall+0x0/0x3c)
+       [   37.687683] Code: 1593301c e5932000 e3120080 1a000000 (e7f001f2)
+       [   37.700775] ---[ end trace aaf805debdb69390 ]---
+
+Client data was assigned to iio_dev structure in probe but in
+hmc5843_init_client function casted to private driver data structure which
+is wrong. Possibly calling mutex_init(&data->lock); corrupt data
+which the lead to above crash.
+
+Signed-off-by: Marek Belisko <marek.belisko@open-nandra.com>
+Acked-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/magnetometer/hmc5843.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/magnetometer/hmc5843.c
++++ b/drivers/staging/iio/magnetometer/hmc5843.c
+@@ -520,7 +520,9 @@ static int hmc5843_detect(struct i2c_cli
+ /* Called when we have found a new HMC5843. */
+ static void hmc5843_init_client(struct i2c_client *client)
+ {
+-      struct hmc5843_data *data = i2c_get_clientdata(client);
++      struct iio_dev *indio_dev = i2c_get_clientdata(client);
++      struct hmc5843_data *data = iio_priv(indio_dev);
++
+       hmc5843_set_meas_conf(client, data->meas_conf);
+       hmc5843_set_rate(client, data->rate);
+       hmc5843_configure(client, data->operating_mode);
diff --git a/queue-3.0/tty-serial-altera_uart-check-for-null-platform_data-in-probe.patch b/queue-3.0/tty-serial-altera_uart-check-for-null-platform_data-in-probe.patch
new file mode 100644 (file)
index 0000000..e93305a
--- /dev/null
@@ -0,0 +1,39 @@
+From acede70d6561f2d042d9dbb153d9a3469479c0ed Mon Sep 17 00:00:00 2001
+From: Yuriy Kozlov <ykozlov@ptcusa.com>
+Date: Thu, 29 Mar 2012 09:55:27 +0200
+Subject: tty: serial: altera_uart: Check for NULL platform_data in probe.
+
+From: Yuriy Kozlov <ykozlov@ptcusa.com>
+
+commit acede70d6561f2d042d9dbb153d9a3469479c0ed upstream.
+
+Follow altera_jtag_uart.  This fixes a crash if there is a mistake in the DTS.
+
+Signed-off-by: Yuriy Kozlov <ykozlov@ptcusa.com>
+Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/altera_uart.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/altera_uart.c
++++ b/drivers/tty/serial/altera_uart.c
+@@ -555,7 +555,7 @@ static int __devinit altera_uart_probe(s
+       res_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+       if (res_mem)
+               port->mapbase = res_mem->start;
+-      else if (platp->mapbase)
++      else if (platp)
+               port->mapbase = platp->mapbase;
+       else
+               return -EINVAL;
+@@ -563,7 +563,7 @@ static int __devinit altera_uart_probe(s
+       res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+       if (res_irq)
+               port->irq = res_irq->start;
+-      else if (platp->irq)
++      else if (platp)
+               port->irq = platp->irq;
+       /* Check platform data first so we can override device node data */