--- /dev/null
+From 724ba8b30b044aa0d94b1cd374fc15806cdd6f18 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Mon, 15 Jan 2018 17:04:22 +0100
+Subject: console/dummy: leave .con_font_get set to NULL
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit 724ba8b30b044aa0d94b1cd374fc15806cdd6f18 upstream.
+
+When this method is set, the caller expects struct console_font fields
+to be properly initialized when it returns. Leave it unset otherwise
+nonsensical (leaked kernel stack) values are returned to user space.
+
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/console/dummycon.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/video/console/dummycon.c
++++ b/drivers/video/console/dummycon.c
+@@ -71,7 +71,6 @@ const struct consw dummy_con = {
+ .con_switch = DUMMY,
+ .con_blank = DUMMY,
+ .con_font_set = DUMMY,
+- .con_font_get = DUMMY,
+ .con_font_default = DUMMY,
+ .con_font_copy = DUMMY,
+ .con_set_palette = DUMMY,
--- /dev/null
+From 3a61b527b4e1f285d21b6e9e623dc45cf8bb391f Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sat, 27 Jan 2018 15:28:15 +0100
+Subject: drm/radeon: adjust tested variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+
+commit 3a61b527b4e1f285d21b6e9e623dc45cf8bb391f upstream.
+
+Check the variable that was most recently initialized.
+
+The semantic match that finds this problem is as follows:
+(http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression x, y, f, g, e, m;
+statement S1,S2,S3,S4;
+@@
+
+x = f(...);
+if (\(<+...x...+>\&e\)) S1 else S2
+(
+x = g(...);
+|
+m = g(...,&x,...);
+|
+y = g(...);
+*if (e)
+ S3 else S4
+)
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_uvd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -947,7 +947,7 @@ int radeon_uvd_calc_upll_dividers(struct
+ /* calc dclk divider with current vco freq */
+ dclk_div = radeon_uvd_calc_upll_post_div(vco_freq, dclk,
+ pd_min, pd_even);
+- if (vclk_div > pd_max)
++ if (dclk_div > pd_max)
+ break; /* vco is too big, it has to stop */
+
+ /* calc score with current vco freq */
--- /dev/null
+From 9f0372488cc9243018a812e8cfbf27de650b187b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?=
+ <ernesto.mnd.fernandez@gmail.com>
+Date: Thu, 11 Jan 2018 13:43:33 -0500
+Subject: ext4: correct documentation for grpid mount option
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+commit 9f0372488cc9243018a812e8cfbf27de650b187b upstream.
+
+The grpid option is currently described as being the same as nogrpid.
+
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/filesystems/ext4.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/filesystems/ext4.txt
++++ b/Documentation/filesystems/ext4.txt
+@@ -233,7 +233,7 @@ data_err=ignore(*) Just print an error m
+ data_err=abort Abort the journal if an error occurs in a file
+ data buffer in ordered mode.
+
+-grpid Give objects the same group ID as their creator.
++grpid New objects have the group ID of their parent.
+ bsdgroups
+
+ nogrpid (*) New objects have the group ID of their creator.
--- /dev/null
+From 06f29cc81f0350261f59643a505010531130eea0 Mon Sep 17 00:00:00 2001
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+Date: Wed, 10 Jan 2018 00:34:19 -0500
+Subject: ext4: save error to disk in __ext4_grp_locked_error()
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+commit 06f29cc81f0350261f59643a505010531130eea0 upstream.
+
+In the function __ext4_grp_locked_error(), __save_error_info()
+is called to save error info in super block block, but does not sync
+that information to disk to info the subsequence fsck after reboot.
+
+This patch writes the error information to disk. After this patch,
+I think there is no obvious EXT4 error handle branches which leads to
+"Remounting filesystem read-only" will leave the disk partition miss
+the subsequence fsck.
+
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -677,6 +677,7 @@ __acquires(bitlock)
+ }
+
+ ext4_unlock_group(sb, grp);
++ ext4_commit_super(sb, 1);
+ ext4_handle_error(sb);
+ /*
+ * We only get here in the ERRORS_RO case; relocking the group
arm-spear13xx-fix-dmas-cells.patch
arm-spear13xx-fix-spics-gpio-controller-s-warning.patch
alsa-seq-fix-regression-by-incorrect-ioctl_mutex-usages.patch
+drm-radeon-adjust-tested-variable.patch
+ext4-save-error-to-disk-in-__ext4_grp_locked_error.patch
+ext4-correct-documentation-for-grpid-mount-option.patch
+video-fbdev-atmel_lcdfb-fix-display-timings-lookup.patch
+console-dummy-leave-.con_font_get-set-to-null.patch
--- /dev/null
+From 9cb18db0701f6b74f0c45c23ad767b3ebebe37f6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 29 Dec 2017 19:48:43 +0100
+Subject: video: fbdev: atmel_lcdfb: fix display-timings lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 9cb18db0701f6b74f0c45c23ad767b3ebebe37f6 upstream.
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent display node was also prematurely
+freed.
+
+Note that the display and timings node references are never put after a
+successful dt-initialisation so the nodes would leak on later probe
+deferrals and on driver unbind.
+
+Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
+Cc: stable <stable@vger.kernel.org> # 3.13
+Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
+Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/atmel_lcdfb.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -1121,7 +1121,7 @@ static int atmel_lcdfb_of_init(struct at
+ goto put_display_node;
+ }
+
+- timings_np = of_find_node_by_name(display_np, "display-timings");
++ timings_np = of_get_child_by_name(display_np, "display-timings");
+ if (!timings_np) {
+ dev_err(dev, "failed to find display-timings node\n");
+ ret = -ENODEV;
+@@ -1142,6 +1142,12 @@ static int atmel_lcdfb_of_init(struct at
+ fb_add_videomode(&fb_vm, &info->modelist);
+ }
+
++ /*
++ * FIXME: Make sure we are not referencing any fields in display_np
++ * and timings_np and drop our references to them before returning to
++ * avoid leaking the nodes on probe deferral and driver unbind.
++ */
++
+ return 0;
+
+ put_timings_node:
projects / thirdparty / kernel / stable-queue.git / commitdiff
