--- /dev/null
+From 66efdc71d95887b652a742a5dae51fa834d71465 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 8 Mar 2013 18:11:17 +0100
+Subject: ALSA: seq: Fix missing error handling in snd_seq_timer_open()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream.
+
+snd_seq_timer_open() didn't catch the whole error path but let through
+if the timer id is a slave. This may lead to Oops by accessing the
+uninitialized pointer.
+
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae
+ IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
+ PGD 785cd067 PUD 76964067 PMD 0
+ Oops: 0002 [#4] SMP
+ CPU 0
+ Pid: 4288, comm: trinity-child7 Tainted: G D W 3.9.0-rc1+ #100 Bochs Bochs
+ RIP: 0010:[<ffffffff819b3477>] [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
+ RSP: 0018:ffff88006ece7d38 EFLAGS: 00010246
+ RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000
+ RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38
+ RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe
+ R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
+ R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007
+ FS: 00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290)
+ Stack:
+ 0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d
+ 65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000
+ ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520
+ Call Trace:
+ [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
+ [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70
+ [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120
+ [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0
+ [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20
+ [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570
+ [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0
+ [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
+ [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0
+ [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
+ [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b
+
+Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_timer.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -290,10 +290,10 @@ int snd_seq_timer_open(struct snd_seq_qu
+ tid.device = SNDRV_TIMER_GLOBAL_SYSTEM;
+ err = snd_timer_open(&t, str, &tid, q->queue);
+ }
+- if (err < 0) {
+- snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
+- return err;
+- }
++ }
++ if (err < 0) {
++ snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
++ return err;
+ }
+ t->callback = snd_seq_timer_interrupt;
+ t->callback_data = q;
--- /dev/null
+From 2d798a3f20ae992b0b69a2b68c04ada397c32ed4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 12 Mar 2013 20:21:34 +0100
+Subject: ARM: w1-gpio: fix erroneous gpio requests
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 2d798a3f20ae992b0b69a2b68c04ada397c32ed4 upstream.
+
+Fix regression introduced by commit d2323cf773 ("onewire: w1-gpio: add
+ext_pullup_enable pin in platform data") which added a gpio entry to the
+platform data, but did not add the required initialisers to the board
+files using it. Consequently, the driver would request gpio 0 at probe,
+which could break other uses of the corresponding pin.
+
+On AT91 requesting gpio 0 changes the pin muxing for PIOA0, which, for
+instance, breaks SPI0 on at91sam9g20.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/board-foxg20.c | 1 +
+ arch/arm/mach-at91/board-stamp9g20.c | 1 +
+ arch/arm/mach-ixp4xx/vulcan-setup.c | 1 +
+ arch/arm/mach-pxa/raumfeld.c | 1 +
+ 4 files changed, 4 insertions(+)
+
+--- a/arch/arm/mach-at91/board-foxg20.c
++++ b/arch/arm/mach-at91/board-foxg20.c
+@@ -176,6 +176,7 @@ static struct w1_gpio_platform_data w1_g
+ /* If you choose to use a pin other than PB16 it needs to be 3.3V */
+ .pin = AT91_PIN_PB16,
+ .is_open_drain = 1,
++ .ext_pullup_enable_pin = -EINVAL,
+ };
+
+ static struct platform_device w1_device = {
+--- a/arch/arm/mach-at91/board-stamp9g20.c
++++ b/arch/arm/mach-at91/board-stamp9g20.c
+@@ -188,6 +188,7 @@ static struct spi_board_info portuxg20_s
+ static struct w1_gpio_platform_data w1_gpio_pdata = {
+ .pin = AT91_PIN_PA29,
+ .is_open_drain = 1,
++ .ext_pullup_enable_pin = -EINVAL,
+ };
+
+ static struct platform_device w1_device = {
+--- a/arch/arm/mach-ixp4xx/vulcan-setup.c
++++ b/arch/arm/mach-ixp4xx/vulcan-setup.c
+@@ -163,6 +163,7 @@ static struct platform_device vulcan_max
+
+ static struct w1_gpio_platform_data vulcan_w1_gpio_pdata = {
+ .pin = 14,
++ .ext_pullup_enable_pin = -EINVAL,
+ };
+
+ static struct platform_device vulcan_w1_gpio = {
+--- a/arch/arm/mach-pxa/raumfeld.c
++++ b/arch/arm/mach-pxa/raumfeld.c
+@@ -505,6 +505,7 @@ static struct w1_gpio_platform_data w1_g
+ .pin = GPIO_ONE_WIRE,
+ .is_open_drain = 0,
+ .enable_external_pullup = w1_enable_external_pullup,
++ .ext_pullup_enable_pin = -EINVAL,
+ };
+
+ struct platform_device raumfeld_w1_gpio_device = {
--- /dev/null
+From df069079c153d22adf6c28dcc0b1cf62bba75167 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Thu, 14 Mar 2013 16:27:18 +0800
+Subject: hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit df069079c153d22adf6c28dcc0b1cf62bba75167 upstream.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/lineage-pem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/lineage-pem.c
++++ b/drivers/hwmon/lineage-pem.c
+@@ -422,6 +422,7 @@ static struct attribute *pem_input_attri
+ &sensor_dev_attr_in2_input.dev_attr.attr,
+ &sensor_dev_attr_curr1_input.dev_attr.attr,
+ &sensor_dev_attr_power1_input.dev_attr.attr,
++ NULL
+ };
+
+ static const struct attribute_group pem_input_group = {
+@@ -432,6 +433,7 @@ static struct attribute *pem_fan_attribu
+ &sensor_dev_attr_fan1_input.dev_attr.attr,
+ &sensor_dev_attr_fan2_input.dev_attr.attr,
+ &sensor_dev_attr_fan3_input.dev_attr.attr,
++ NULL
+ };
+
+ static const struct attribute_group pem_fan_group = {
--- /dev/null
+From 8c958c703ef8804093437959221951eaf0e1e664 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 21 Feb 2013 10:27:54 -0800
+Subject: hwmon: (pmbus/ltc2978) Fix temperature reporting
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 8c958c703ef8804093437959221951eaf0e1e664 upstream.
+
+On LTC2978, only READ_TEMPERATURE is supported. It reports
+the internal junction temperature. This register is unpaged.
+
+On LTC3880, READ_TEMPERATURE and READ_TEMPERATURE2 are supported.
+READ_TEMPERATURE is paged and reports external temperatures.
+READ_TEMPERATURE2 is unpaged and reports the internal junction
+temperature.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/pmbus/ltc2978.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/pmbus/ltc2978.c
++++ b/drivers/hwmon/pmbus/ltc2978.c
+@@ -59,7 +59,7 @@ enum chips { ltc2978, ltc3880 };
+ struct ltc2978_data {
+ enum chips id;
+ int vin_min, vin_max;
+- int temp_min, temp_max;
++ int temp_min, temp_max[2];
+ int vout_min[8], vout_max[8];
+ int iout_max[2];
+ int temp2_max;
+@@ -113,9 +113,10 @@ static int ltc2978_read_word_data_common
+ ret = pmbus_read_word_data(client, page,
+ LTC2978_MFR_TEMPERATURE_PEAK);
+ if (ret >= 0) {
+- if (lin11_to_val(ret) > lin11_to_val(data->temp_max))
+- data->temp_max = ret;
+- ret = data->temp_max;
++ if (lin11_to_val(ret)
++ > lin11_to_val(data->temp_max[page]))
++ data->temp_max[page] = ret;
++ ret = data->temp_max[page];
+ }
+ break;
+ case PMBUS_VIRT_RESET_VOUT_HISTORY:
+@@ -266,7 +267,7 @@ static int ltc2978_write_word_data(struc
+ break;
+ case PMBUS_VIRT_RESET_TEMP_HISTORY:
+ data->temp_min = 0x7bff;
+- data->temp_max = 0x7c00;
++ data->temp_max[page] = 0x7c00;
+ ret = ltc2978_clear_peaks(client, page, data->id);
+ break;
+ default:
+@@ -323,7 +324,8 @@ static int ltc2978_probe(struct i2c_clie
+ data->vin_min = 0x7bff;
+ data->vin_max = 0x7c00;
+ data->temp_min = 0x7bff;
+- data->temp_max = 0x7c00;
++ for (i = 0; i < ARRAY_SIZE(data->temp_max); i++)
++ data->temp_max[i] = 0x7c00;
+ data->temp2_max = 0x7c00;
+
+ switch (data->id) {
fix-4-port-and-add-support-for-8-port-unknown-pci-serial-port-cards.patch
arm-kirkwood-fix-to-retain-gbe-mac-addresses-for-dt-kernels.patch
perf-x86-fix-kernel-crash-with-pebs-bts-after-suspend-resume.patch
+alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch
+arm-w1-gpio-fix-erroneous-gpio-requests.patch
+hwmon-pmbus-ltc2978-fix-temperature-reporting.patch
+hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch
+w1-gpio-remove-erroneous-__exit-and-__exit_p.patch
+w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch
--- /dev/null
+From 9d1817cab2f030f6af360e961cc69bb1da8ad765 Mon Sep 17 00:00:00 2001
+From: Marcin Jurkowski <marcin1j@gmail.com>
+Date: Sat, 2 Mar 2013 14:50:15 +0100
+Subject: w1: fix oops when w1_search is called from netlink connector
+
+From: Marcin Jurkowski <marcin1j@gmail.com>
+
+commit 9d1817cab2f030f6af360e961cc69bb1da8ad765 upstream.
+
+On Sat, Mar 02, 2013 at 10:45:10AM +0100, Sven Geggus wrote:
+> This is the bad commit I found doing git bisect:
+> 04f482faf50535229a5a5c8d629cf963899f857c is the first bad commit
+> commit 04f482faf50535229a5a5c8d629cf963899f857c
+> Author: Patrick McHardy <kaber@trash.net>
+> Date: Mon Mar 28 08:39:36 2011 +0000
+
+Good job. I was too lazy to bisect for bad commit;)
+
+Reading the code I found problematic kthread_should_stop call from netlink
+connector which causes the oops. After applying a patch, I've been testing
+owfs+w1 setup for nearly two days and it seems to work very reliable (no
+hangs, no memleaks etc).
+More detailed description and possible fix is given below:
+
+Function w1_search can be called from either kthread or netlink callback.
+While the former works fine, the latter causes oops due to kthread_should_stop
+invocation.
+
+This patch adds a check if w1_search is serving netlink command, skipping
+kthread_should_stop invocation if so.
+
+Signed-off-by: Marcin Jurkowski <marcin1j@gmail.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Cc: Josh Boyer <jwboyer@gmail.com>
+Tested-by: Sven Geggus <lists@fuchsschwanzdomain.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/w1/w1.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -924,7 +924,8 @@ void w1_search(struct w1_master *dev, u8
+ tmp64 = (triplet_ret >> 2);
+ rn |= (tmp64 << i);
+
+- if (kthread_should_stop()) {
++ /* ensure we're called from kthread and not by netlink callback */
++ if (!dev->priv && kthread_should_stop()) {
+ mutex_unlock(&dev->bus_mutex);
+ dev_dbg(&dev->dev, "Abort w1_search\n");
+ return;
--- /dev/null
+From 01230551e7c2fb9a1c2519b356d703851049cbe0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Fri, 8 Mar 2013 11:07:59 +0100
+Subject: w1-gpio: remove erroneous __exit and __exit_p()
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 01230551e7c2fb9a1c2519b356d703851049cbe0 upstream.
+
+Commit 8a1861d997 ("w1-gpio: Simplify & get rid of defines") changed
+(apparently unknowingly) the driver to a hotpluggable platform-device
+driver but did not not update the section markers for probe and remove
+(to __devinit/exit, which have since been removed). A later commit fixed
+the section mismatch for probe, but left remove marked with __exit.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/w1/masters/w1-gpio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/w1/masters/w1-gpio.c
++++ b/drivers/w1/masters/w1-gpio.c
+@@ -158,7 +158,7 @@ static int w1_gpio_probe(struct platform
+ return err;
+ }
+
+-static int __exit w1_gpio_remove(struct platform_device *pdev)
++static int w1_gpio_remove(struct platform_device *pdev)
+ {
+ struct w1_bus_master *master = platform_get_drvdata(pdev);
+ struct w1_gpio_platform_data *pdata = pdev->dev.platform_data;
+@@ -210,7 +210,7 @@ static struct platform_driver w1_gpio_dr
+ .of_match_table = of_match_ptr(w1_gpio_dt_ids),
+ },
+ .probe = w1_gpio_probe,
+- .remove = __exit_p(w1_gpio_remove),
++ .remove = w1_gpio_remove,
+ .suspend = w1_gpio_suspend,
+ .resume = w1_gpio_resume,
+ };
projects / thirdparty / kernel / stable-queue.git / commitdiff
