]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.17-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 7 Dec 2014 06:23:10 +0000 (22:23 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 7 Dec 2014 06:23:10 +0000 (22:23 -0800)
added patches:
drivers-input-evdev.c-don-t-kfree-a-vmalloc-address.patch
drm-i915-more-cautious-with-pch-fifo-underruns.patch
drm-i915-unlock-panel-even-when-lvds-is-disabled.patch
drm-nouveau-gf116-remove-copy1-engine.patch
drm-radeon-ignore-radeon_gem_gtt_wc-on-32-bit-x86.patch
drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch
fat-fix-oops-on-corrupted-vfat-fs.patch
i2c-cadence-set-the-hardware-time-out-register-to-maximum-value.patch
i2c-davinci-generate-stp-always-when-nack-is-received.patch
i2c-omap-fix-i207-errata-handling.patch
i2c-omap-fix-nack-and-arbitration-lost-irq-handling.patch
media-rc-core-fix-toggle-handling-in-the-rc6-decoder.patch
media-s2255drv-fix-payload-size-for-jpg-mjpeg.patch
media-smiapp-only-some-selection-targets-are-settable.patch
mm-fix-anon_vma_clone-error-treatment.patch
mm-fix-swapoff-hang-after-page-migration-and-fork.patch
mm-frontswap-invalidate-expired-data-on-a-dup-store-failure.patch
mm-vmpressure.c-fix-race-in-vmpressure_work_fn.patch
nouveau-move-the-hotplug-ignore-to-correct-place.patch
of-fdt-memblock_reserve-memreserve-regions-in-the-case-of-partial-overlap.patch
slab-fix-nodeid-bounds-check-for-non-contiguous-node-ids.patch
x86-use-objdump-instead-of-plain-objdump.patch
xen-netfront-remove-bugs-on-paged-skb-data-which-crosses-a-page-boundary.patch

24 files changed:
queue-3.17/drivers-input-evdev.c-don-t-kfree-a-vmalloc-address.patch [new file with mode: 0644]
queue-3.17/drm-i915-more-cautious-with-pch-fifo-underruns.patch [new file with mode: 0644]
queue-3.17/drm-i915-unlock-panel-even-when-lvds-is-disabled.patch [new file with mode: 0644]
queue-3.17/drm-nouveau-gf116-remove-copy1-engine.patch [new file with mode: 0644]
queue-3.17/drm-radeon-ignore-radeon_gem_gtt_wc-on-32-bit-x86.patch [new file with mode: 0644]
queue-3.17/drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch [new file with mode: 0644]
queue-3.17/fat-fix-oops-on-corrupted-vfat-fs.patch [new file with mode: 0644]
queue-3.17/i2c-cadence-set-the-hardware-time-out-register-to-maximum-value.patch [new file with mode: 0644]
queue-3.17/i2c-davinci-generate-stp-always-when-nack-is-received.patch [new file with mode: 0644]
queue-3.17/i2c-omap-fix-i207-errata-handling.patch [new file with mode: 0644]
queue-3.17/i2c-omap-fix-nack-and-arbitration-lost-irq-handling.patch [new file with mode: 0644]
queue-3.17/media-rc-core-fix-toggle-handling-in-the-rc6-decoder.patch [new file with mode: 0644]
queue-3.17/media-s2255drv-fix-payload-size-for-jpg-mjpeg.patch [new file with mode: 0644]
queue-3.17/media-smiapp-only-some-selection-targets-are-settable.patch [new file with mode: 0644]
queue-3.17/mm-fix-anon_vma_clone-error-treatment.patch [new file with mode: 0644]
queue-3.17/mm-fix-swapoff-hang-after-page-migration-and-fork.patch [new file with mode: 0644]
queue-3.17/mm-frontswap-invalidate-expired-data-on-a-dup-store-failure.patch [new file with mode: 0644]
queue-3.17/mm-vmpressure.c-fix-race-in-vmpressure_work_fn.patch [new file with mode: 0644]
queue-3.17/nouveau-move-the-hotplug-ignore-to-correct-place.patch [new file with mode: 0644]
queue-3.17/of-fdt-memblock_reserve-memreserve-regions-in-the-case-of-partial-overlap.patch [new file with mode: 0644]
queue-3.17/series
queue-3.17/slab-fix-nodeid-bounds-check-for-non-contiguous-node-ids.patch [new file with mode: 0644]
queue-3.17/x86-use-objdump-instead-of-plain-objdump.patch [new file with mode: 0644]
queue-3.17/xen-netfront-remove-bugs-on-paged-skb-data-which-crosses-a-page-boundary.patch [new file with mode: 0644]

diff --git a/queue-3.17/drivers-input-evdev.c-don-t-kfree-a-vmalloc-address.patch b/queue-3.17/drivers-input-evdev.c-don-t-kfree-a-vmalloc-address.patch
new file mode 100644 (file)
index 0000000..cae85da
--- /dev/null
@@ -0,0 +1,37 @@
+From 92788ac1eb06e69a822de45e2a8a63fa45eb5be2 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 2 Dec 2014 15:59:31 -0800
+Subject: drivers/input/evdev.c: don't kfree() a vmalloc address
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 92788ac1eb06e69a822de45e2a8a63fa45eb5be2 upstream.
+
+If kzalloc() failed and then evdev_open_device() fails, evdev_open()
+will pass a vmalloc'ed pointer to kfree.
+
+This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where
+there was a crash in kfree().
+
+Reported-by: Christian Casteyde <casteyde.christian@free.fr>
+Belatedly-Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: Henrik Rydberg <rydberg@euromail.se>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/evdev.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -421,7 +421,7 @@ static int evdev_open(struct inode *inod
+  err_free_client:
+       evdev_detach_client(evdev, client);
+-      kfree(client);
++      kvfree(client);
+       return error;
+ }
diff --git a/queue-3.17/drm-i915-more-cautious-with-pch-fifo-underruns.patch b/queue-3.17/drm-i915-more-cautious-with-pch-fifo-underruns.patch
new file mode 100644 (file)
index 0000000..b41bf06
--- /dev/null
@@ -0,0 +1,57 @@
+From b68362278af94e1171f5be9d4e44988601fb0439 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 24 Nov 2014 17:02:45 +0100
+Subject: drm/i915: More cautious with pch fifo underruns
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit b68362278af94e1171f5be9d4e44988601fb0439 upstream.
+
+Apparently PCH fifo underruns are tricky, we have plenty reports that
+we see the occasional underrun (especially at boot-up).
+
+So for a change let's see what happens when we don't re-enable pch
+fifo underrun reporting when the pipe is disabled. This means that the
+kernel can't catch pch fifo underruns when they happen (except when
+all pipes are on on the pch). But we'll still catch underruns when
+disabling the pipe again. So not a terrible reduction in test
+coverage.
+
+Since the DRM_ERROR is new and hence a regression plan B would be to
+revert it back to a debug output. Which would be a lot worse than this
+hack for underrun test coverage in the wild. See the referenced
+discussions for more.
+
+References: http://mid.gmane.org/CA+gsUGRfGe3t4NcjdeA=qXysrhLY3r4CEu7z4bjTwxi1uOfy+g@mail.gmail.com
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85898
+References: https://bugs.freedesktop.org/show_bug.cgi?id=85898
+References: https://bugs.freedesktop.org/show_bug.cgi?id=86233
+References: https://bugs.freedesktop.org/show_bug.cgi?id=86478
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Tested-by: lu hua <huax.lu@intel.com>
+Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4209,7 +4209,6 @@ static void ironlake_crtc_disable(struct
+               ironlake_fdi_disable(crtc);
+               ironlake_disable_pch_transcoder(dev_priv, pipe);
+-              intel_set_pch_fifo_underrun_reporting(dev, pipe, true);
+               if (HAS_PCH_CPT(dev)) {
+                       /* disable TRANS_DP_CTL */
+@@ -4274,7 +4273,6 @@ static void haswell_crtc_disable(struct
+       if (intel_crtc->config.has_pch_encoder) {
+               lpt_disable_pch_transcoder(dev_priv);
+-              intel_set_pch_fifo_underrun_reporting(dev, TRANSCODER_A, true);
+               intel_ddi_fdi_disable(crtc);
+       }
diff --git a/queue-3.17/drm-i915-unlock-panel-even-when-lvds-is-disabled.patch b/queue-3.17/drm-i915-unlock-panel-even-when-lvds-is-disabled.patch
new file mode 100644 (file)
index 0000000..453801f
--- /dev/null
@@ -0,0 +1,70 @@
+From b0616c5306b342ceca07044dbc4f917d95c4f825 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 1 Dec 2014 17:56:54 +0100
+Subject: drm/i915: Unlock panel even when LVDS is disabled
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit b0616c5306b342ceca07044dbc4f917d95c4f825 upstream.
+
+Otherwise we'll have backtraces in assert_panel_unlocked because the
+BIOS locks the register. In the reporter's case this regression was
+introduced in
+
+commit c31407a3672aaebb4acddf90944a114fa5c8af7b
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date:   Thu Oct 18 21:07:01 2012 +0100
+
+    drm/i915: Add no-lvds quirk for Supermicro X7SPA-H
+
+Reported-by: Alexey Orishko <alexey.orishko@gmail.com>
+Cc: Alexey Orishko <alexey.orishko@gmail.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Francois Tigeot <ftigeot@wolfpond.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Tested-by: Alexey Orishko <alexey.orishko@gmail.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c |   22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -900,6 +900,17 @@ void intel_lvds_init(struct drm_device *
+       int pipe;
+       u8 pin;
++      /*
++       * Unlock registers and just leave them unlocked. Do this before
++       * checking quirk lists to avoid bogus WARNINGs.
++       */
++      if (HAS_PCH_SPLIT(dev)) {
++              I915_WRITE(PCH_PP_CONTROL,
++                         I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
++      } else {
++              I915_WRITE(PP_CONTROL,
++                         I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
++      }
+       if (!intel_lvds_supported(dev))
+               return;
+@@ -1098,17 +1109,6 @@ out:
+       lvds_encoder->a3_power = I915_READ(lvds_encoder->reg) &
+                                LVDS_A3_POWER_MASK;
+-      /*
+-       * Unlock registers and just
+-       * leave them unlocked
+-       */
+-      if (HAS_PCH_SPLIT(dev)) {
+-              I915_WRITE(PCH_PP_CONTROL,
+-                         I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+-      } else {
+-              I915_WRITE(PP_CONTROL,
+-                         I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
+-      }
+       lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
+       if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
+               DRM_DEBUG_KMS("lid notifier registration failed\n");
diff --git a/queue-3.17/drm-nouveau-gf116-remove-copy1-engine.patch b/queue-3.17/drm-nouveau-gf116-remove-copy1-engine.patch
new file mode 100644 (file)
index 0000000..cec9895
--- /dev/null
@@ -0,0 +1,37 @@
+From 226d63a1addea8cbe8fc671978e62dc84927b046 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sun, 30 Nov 2014 12:56:18 -0500
+Subject: drm/nouveau/gf116: remove copy1 engine
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 226d63a1addea8cbe8fc671978e62dc84927b046 upstream.
+
+Indications are that no GF116's actually have a copy engine there, but
+actually have the decompression engine. This engine can be made to do
+copies, but that should be done separately.
+
+Unclear why this didn't turn up on all GF116's, but perhaps the
+non-mobile ones came with enough VRAM to not trigger ttm migrations in
+test scenarios.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=85465
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=59168
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/core/engine/device/nvc0.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
++++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+@@ -212,7 +212,6 @@ nvc0_identify(struct nouveau_device *dev
+               device->oclass[NVDEV_ENGINE_BSP    ] = &nvc0_bsp_oclass;
+               device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
+               device->oclass[NVDEV_ENGINE_COPY0  ] = &nvc0_copy0_oclass;
+-              device->oclass[NVDEV_ENGINE_COPY1  ] = &nvc0_copy1_oclass;
+               device->oclass[NVDEV_ENGINE_DISP   ] =  nva3_disp_oclass;
+               device->oclass[NVDEV_ENGINE_PERFMON] = &nvc0_perfmon_oclass;
+               break;
diff --git a/queue-3.17/drm-radeon-ignore-radeon_gem_gtt_wc-on-32-bit-x86.patch b/queue-3.17/drm-radeon-ignore-radeon_gem_gtt_wc-on-32-bit-x86.patch
new file mode 100644 (file)
index 0000000..8b85580
--- /dev/null
@@ -0,0 +1,37 @@
+From a08b588e4199e4200d26027ffcdf3ab2fa906412 Mon Sep 17 00:00:00 2001
+From: Michel Dänzer <michel.daenzer@amd.com>
+Date: Thu, 27 Nov 2014 18:00:54 +0900
+Subject: drm/radeon: Ignore RADEON_GEM_GTT_WC on 32-bit x86
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit a08b588e4199e4200d26027ffcdf3ab2fa906412 upstream.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=84627
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_object.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -187,6 +187,13 @@ int radeon_bo_create(struct radeon_devic
+       if (!(rdev->flags & RADEON_IS_PCIE))
+               bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
++#ifdef CONFIG_X86_32
++      /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
++       * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
++       */
++      bo->flags &= ~RADEON_GEM_GTT_WC;
++#endif
++
+       radeon_ttm_placement_from_domain(bo, domain);
+       /* Kernel allocation are uninterruptible */
+       down_read(&rdev->pm.mclk_lock);
diff --git a/queue-3.17/drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch b/queue-3.17/drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch
new file mode 100644 (file)
index 0000000..740e235
--- /dev/null
@@ -0,0 +1,133 @@
+From f5475cc43c899e33098d4db44b7c5e710f16589d Mon Sep 17 00:00:00 2001
+From: Petr Mladek <pmladek@suse.cz>
+Date: Thu, 27 Nov 2014 16:57:21 +0100
+Subject: drm/radeon: kernel panic in drm_calc_vbltimestamp_from_scanoutpos with 3.18.0-rc6
+
+From: Petr Mladek <pmladek@suse.cz>
+
+commit f5475cc43c899e33098d4db44b7c5e710f16589d upstream.
+
+I was unable too boot 3.18.0-rc6 because of the following kernel
+panic in drm_calc_vbltimestamp_from_scanoutpos():
+
+    [drm] Initialized drm 1.1.0 20060810
+    [drm] radeon kernel modesetting enabled.
+    [drm] initializing kernel modesetting (RV100 0x1002:0x515E 0x15D9:0x8080).
+    [drm] register mmio base: 0xC8400000
+    [drm] register mmio size: 65536
+    radeon 0000:0b:01.0: VRAM: 128M 0x00000000D0000000 - 0x00000000D7FFFFFF (16M used)
+    radeon 0000:0b:01.0: GTT: 512M 0x00000000B0000000 - 0x00000000CFFFFFFF
+    [drm] Detected VRAM RAM=128M, BAR=128M
+    [drm] RAM width 16bits DDR
+    [TTM] Zone  kernel: Available graphics memory: 3829346 kiB
+    [TTM] Zone   dma32: Available graphics memory: 2097152 kiB
+    [TTM] Initializing pool allocator
+    [TTM] Initializing DMA pool allocator
+    [drm] radeon: 16M of VRAM memory ready
+    [drm] radeon: 512M of GTT memory ready.
+    [drm] GART: num cpu pages 131072, num gpu pages 131072
+    [drm] PCI GART of 512M enabled (table at 0x0000000037880000).
+    radeon 0000:0b:01.0: WB disabled
+    radeon 0000:0b:01.0: fence driver on ring 0 use gpu addr 0x00000000b0000000 and cpu addr 0xffff8800bbbfa000
+    [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
+    [drm] Driver supports precise vblank timestamp query.
+    [drm] radeon: irq initialized.
+    [drm] Loading R100 Microcode
+    radeon 0000:0b:01.0: Direct firmware load for radeon/R100_cp.bin failed with error -2
+    radeon_cp: Failed to load firmware "radeon/R100_cp.bin"
+    [drm:r100_cp_init] *ERROR* Failed to load firmware!
+    radeon 0000:0b:01.0: failed initializing CP (-2).
+    radeon 0000:0b:01.0: Disabling GPU acceleration
+    [drm] radeon: cp finalized
+    BUG: unable to handle kernel NULL pointer dereference at 000000000000025c
+    IP: [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320
+    PGD 0
+    Oops: 0000 [#1] SMP
+    Modules linked in:
+    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc6-4-default #2649
+    Hardware name: Supermicro X7DB8/X7DB8, BIOS 6.00 07/26/2006
+    task: ffff880234da2010 ti: ffff880234da4000 task.ti: ffff880234da4000
+    RIP: 0010:[<ffffffff8150423b>]  [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320
+    RSP: 0000:ffff880234da7918  EFLAGS: 00010086
+    RAX: ffffffff81557890 RBX: 0000000000000000 RCX: ffff880234da7a48
+    RDX: ffff880234da79f4 RSI: 0000000000000000 RDI: ffff880232e15000
+    RBP: ffff880234da79b8 R08: 0000000000000000 R09: 0000000000000000
+    R10: 000000000000000a R11: 0000000000000001 R12: ffff880232dda1c0
+    R13: ffff880232e1518c R14: 0000000000000292 R15: ffff880232e15000
+    FS:  0000000000000000(0000) GS:ffff88023fc40000(0000) knlGS:0000000000000000
+    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+    CR2: 000000000000025c CR3: 0000000002014000 CR4: 00000000000007e0
+    Stack:
+     ffff880234da79d8 0000000000000286 ffff880232dcbc00 0000000000002480
+     ffff880234da7958 0000000000000296 ffff880234da7998 ffffffff8151b51d
+     ffff880234da7a48 0000000032dcbeb0 ffff880232dcbc00 ffff880232dcbc58
+    Call Trace:
+     [<ffffffff8151b51d>] ? drm_vma_offset_remove+0x1d/0x110
+     [<ffffffff8152dc98>] radeon_get_vblank_timestamp_kms+0x38/0x60
+     [<ffffffff8152076a>] ? ttm_bo_release_list+0xba/0x180
+     [<ffffffff81503751>] drm_get_last_vbltimestamp+0x41/0x70
+     [<ffffffff81503933>] vblank_disable_and_save+0x73/0x1d0
+     [<ffffffff81106b2f>] ? try_to_del_timer_sync+0x4f/0x70
+     [<ffffffff81505245>] drm_vblank_cleanup+0x65/0xa0
+     [<ffffffff815604fa>] radeon_irq_kms_fini+0x1a/0x70
+     [<ffffffff8156c07e>] r100_init+0x26e/0x410
+     [<ffffffff8152ae3e>] radeon_device_init+0x7ae/0xb50
+     [<ffffffff8152d57f>] radeon_driver_load_kms+0x8f/0x210
+     [<ffffffff81506965>] drm_dev_register+0xb5/0x110
+     [<ffffffff8150998f>] drm_get_pci_dev+0x8f/0x200
+     [<ffffffff815291cd>] radeon_pci_probe+0xad/0xe0
+     [<ffffffff8141a365>] local_pci_probe+0x45/0xa0
+     [<ffffffff8141b741>] pci_device_probe+0xd1/0x130
+     [<ffffffff81633dad>] driver_probe_device+0x12d/0x3e0
+     [<ffffffff8163413b>] __driver_attach+0x9b/0xa0
+     [<ffffffff816340a0>] ? __device_attach+0x40/0x40
+     [<ffffffff81631cd3>] bus_for_each_dev+0x63/0xa0
+     [<ffffffff8163378e>] driver_attach+0x1e/0x20
+     [<ffffffff81633390>] bus_add_driver+0x180/0x240
+     [<ffffffff81634914>] driver_register+0x64/0xf0
+     [<ffffffff81419cac>] __pci_register_driver+0x4c/0x50
+     [<ffffffff81509bf5>] drm_pci_init+0xf5/0x120
+     [<ffffffff821dc871>] ? ttm_init+0x6a/0x6a
+     [<ffffffff821dc908>] radeon_init+0x97/0xb5
+     [<ffffffff810002fc>] do_one_initcall+0xbc/0x1f0
+     [<ffffffff810e3278>] ? __wake_up+0x48/0x60
+     [<ffffffff8218e256>] kernel_init_freeable+0x18a/0x215
+     [<ffffffff8218d983>] ? initcall_blacklist+0xc0/0xc0
+     [<ffffffff818a78f0>] ? rest_init+0x80/0x80
+     [<ffffffff818a78fe>] kernel_init+0xe/0xf0
+     [<ffffffff818c0c3c>] ret_from_fork+0x7c/0xb0
+     [<ffffffff818a78f0>] ? rest_init+0x80/0x80
+    Code: 45 ac 0f 88 a8 01 00 00 3b b7 d0 01 00 00 49 89 ff 0f 83 99 01 00 00 48 8b 47 20 48 8b 80 88 00 00 00 48 85 c0 0f 84 cd 01 00 00 <41> 8b b1 5c 02 00 00 41 8b 89 58 02 00 00 89 75 98 41 8b b1 60
+    RIP  [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320
+     RSP <ffff880234da7918>
+    CR2: 000000000000025c
+    ---[ end trace ad2c0aadf48e2032 ]---
+    Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
+
+It has helped me to add a NULL pointer check that was suggested at
+http://lists.freedesktop.org/archives/dri-devel/2014-October/070663.html
+
+I am not familiar with the code. But the change looks sane
+and we need something fast at this stage of 3.18 development.
+
+Suggested-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Petr Mladek <pmladek@suse.cz>
+Tested-by: Petr Mladek <pmladek@suse.cz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_kms.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -795,6 +795,8 @@ int radeon_get_vblank_timestamp_kms(stru
+       /* Get associated drm_crtc: */
+       drmcrtc = &rdev->mode_info.crtcs[crtc]->base;
++      if (!drmcrtc)
++              return -EINVAL;
+       /* Helper routine in DRM core does all the work: */
+       return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
diff --git a/queue-3.17/fat-fix-oops-on-corrupted-vfat-fs.patch b/queue-3.17/fat-fix-oops-on-corrupted-vfat-fs.patch
new file mode 100644 (file)
index 0000000..11ca05c
--- /dev/null
@@ -0,0 +1,94 @@
+From 1ead0e79bfedd4b563b8ea7c585ca3884b0c89a7 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Tue, 2 Dec 2014 15:59:37 -0800
+Subject: fat: fix oops on corrupted vfat fs
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 1ead0e79bfedd4b563b8ea7c585ca3884b0c89a7 upstream.
+
+a) don't bother with ->d_time for positives - we only check it for
+   negatives anyway.
+
+b) make sure to set it at unlink and rmdir time - at *that* point
+   soon-to-be negative dentry matches then-current directory contents
+
+c) don't go into renaming of old alias in vfat_lookup() unless it
+   has the same parent (which it will, unless we are seeing corrupted
+   image)
+
+[hirofumi@mail.parknet.co.jp: make change minimum, don't call d_move() for dir]
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fat/namei_vfat.c |   20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/fs/fat/namei_vfat.c
++++ b/fs/fat/namei_vfat.c
+@@ -736,7 +736,12 @@ static struct dentry *vfat_lookup(struct
+       }
+       alias = d_find_alias(inode);
+-      if (alias && !vfat_d_anon_disconn(alias)) {
++      /*
++       * Checking "alias->d_parent == dentry->d_parent" to make sure
++       * FS is not corrupted (especially double linked dir).
++       */
++      if (alias && alias->d_parent == dentry->d_parent &&
++          !vfat_d_anon_disconn(alias)) {
+               /*
+                * This inode has non anonymous-DCACHE_DISCONNECTED
+                * dentry. This means, the user did ->lookup() by an
+@@ -755,12 +760,9 @@ static struct dentry *vfat_lookup(struct
+ out:
+       mutex_unlock(&MSDOS_SB(sb)->s_lock);
+-      dentry->d_time = dentry->d_parent->d_inode->i_version;
+-      dentry = d_splice_alias(inode, dentry);
+-      if (dentry)
+-              dentry->d_time = dentry->d_parent->d_inode->i_version;
+-      return dentry;
+-
++      if (!inode)
++              dentry->d_time = dir->i_version;
++      return d_splice_alias(inode, dentry);
+ error:
+       mutex_unlock(&MSDOS_SB(sb)->s_lock);
+       return ERR_PTR(err);
+@@ -793,7 +795,6 @@ static int vfat_create(struct inode *dir
+       inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
+       /* timestamp is already written, so mark_inode_dirty() is unneeded. */
+-      dentry->d_time = dentry->d_parent->d_inode->i_version;
+       d_instantiate(dentry, inode);
+ out:
+       mutex_unlock(&MSDOS_SB(sb)->s_lock);
+@@ -824,6 +825,7 @@ static int vfat_rmdir(struct inode *dir,
+       clear_nlink(inode);
+       inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
+       fat_detach(inode);
++      dentry->d_time = dir->i_version;
+ out:
+       mutex_unlock(&MSDOS_SB(sb)->s_lock);
+@@ -849,6 +851,7 @@ static int vfat_unlink(struct inode *dir
+       clear_nlink(inode);
+       inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
+       fat_detach(inode);
++      dentry->d_time = dir->i_version;
+ out:
+       mutex_unlock(&MSDOS_SB(sb)->s_lock);
+@@ -889,7 +892,6 @@ static int vfat_mkdir(struct inode *dir,
+       inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
+       /* timestamp is already written, so mark_inode_dirty() is unneeded. */
+-      dentry->d_time = dentry->d_parent->d_inode->i_version;
+       d_instantiate(dentry, inode);
+       mutex_unlock(&MSDOS_SB(sb)->s_lock);
diff --git a/queue-3.17/i2c-cadence-set-the-hardware-time-out-register-to-maximum-value.patch b/queue-3.17/i2c-cadence-set-the-hardware-time-out-register-to-maximum-value.patch
new file mode 100644 (file)
index 0000000..c11c99d
--- /dev/null
@@ -0,0 +1,52 @@
+From 681d15a0f527af7ab3a783e1037de86fbcb136ac Mon Sep 17 00:00:00 2001
+From: Vishnu Motghare <vishnum@xilinx.com>
+Date: Wed, 3 Dec 2014 18:05:25 +0530
+Subject: i2c: cadence: Set the hardware time-out register to maximum value
+
+From: Vishnu Motghare <vishnum@xilinx.com>
+
+commit 681d15a0f527af7ab3a783e1037de86fbcb136ac upstream.
+
+Cadence I2C controller has bug wherein it generates invalid read transactions
+after timeout in master receiver mode. This driver does not use the HW
+timeout and this interrupt is disabled but the feature itself cannot be
+disabled. Hence, this patch writes the maximum value (0xFF) to this register.
+This is one of the workarounds to this bug and it will not avoid the issue
+completely but reduces the chances of error.
+
+Signed-off-by: Vishnu Motghare <vishnum@xilinx.com>
+Signed-off-by: Harini Katakam <harinik@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-cadence.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -111,6 +111,8 @@
+ #define CDNS_I2C_DIVA_MAX     4
+ #define CDNS_I2C_DIVB_MAX     64
++#define CDNS_I2C_TIMEOUT_MAX  0xFF
++
+ #define cdns_i2c_readreg(offset)       readl_relaxed(id->membase + offset)
+ #define cdns_i2c_writereg(val, offset) writel_relaxed(val, id->membase + offset)
+@@ -852,6 +854,15 @@ static int cdns_i2c_probe(struct platfor
+               goto err_clk_dis;
+       }
++      /*
++       * Cadence I2C controller has a bug wherein it generates
++       * invalid read transaction after HW timeout in master receiver mode.
++       * HW timeout is not used by this driver and the interrupt is disabled.
++       * But the feature itself cannot be disabled. Hence maximum value
++       * is written to this register to reduce the chances of error.
++       */
++      cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
++
+       dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
+                id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
diff --git a/queue-3.17/i2c-davinci-generate-stp-always-when-nack-is-received.patch b/queue-3.17/i2c-davinci-generate-stp-always-when-nack-is-received.patch
new file mode 100644 (file)
index 0000000..ea8f65e
--- /dev/null
@@ -0,0 +1,65 @@
+From 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Mon, 1 Dec 2014 17:34:04 +0200
+Subject: i2c: davinci: generate STP always when NACK is received
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 upstream.
+
+According to I2C specification the NACK should be handled as follows:
+"When SDA remains HIGH during this ninth clock pulse, this is defined as the Not
+Acknowledge signal. The master can then generate either a STOP condition to
+abort the transfer, or a repeated START condition to start a new transfer."
+[I2C spec Rev. 6, 3.1.6: http://www.nxp.com/documents/user_manual/UM10204.pdf]
+
+Currently the Davinci i2c driver interrupts the transfer on receipt of a
+NACK but fails to send a STOP in some situations and so makes the bus
+stuck until next I2C IP reset (idle/enable).
+
+For example, the issue will happen during SMBus read transfer which
+consists from two i2c messages write command/address and read data:
+
+S Slave Address Wr A Command Code A Sr Slave Address Rd A D1..Dn A P
+<--- write -----------------------> <--- read --------------------->
+
+The I2C client device will send NACK if it can't recognize "Command Code"
+and it's expected from I2C master to generate STP in this case.
+But now, Davinci i2C driver will just exit with -EREMOTEIO and STP will
+not be generated.
+
+Hence, fix it by generating Stop condition (STP) always when NACK is received.
+
+This patch fixes Davinci I2C in the same way it was done for OMAP I2C
+commit cda2109a26eb ("i2c: omap: query STP always when NACK is received").
+
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reported-by: Hein Tibosch <hein_tibosch@yahoo.es>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-davinci.c |    8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -411,11 +411,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter
+       if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
+               if (msg->flags & I2C_M_IGNORE_NAK)
+                       return msg->len;
+-              if (stop) {
+-                      w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
+-                      w |= DAVINCI_I2C_MDR_STP;
+-                      davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+-              }
++              w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
++              w |= DAVINCI_I2C_MDR_STP;
++              davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+               return -EREMOTEIO;
+       }
+       return -EIO;
diff --git a/queue-3.17/i2c-omap-fix-i207-errata-handling.patch b/queue-3.17/i2c-omap-fix-i207-errata-handling.patch
new file mode 100644 (file)
index 0000000..fb52957
--- /dev/null
@@ -0,0 +1,53 @@
+From ccfc866356674cb3a61829d239c685af6e85f197 Mon Sep 17 00:00:00 2001
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Fri, 21 Nov 2014 04:16:51 +0400
+Subject: i2c: omap: fix i207 errata handling
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+commit ccfc866356674cb3a61829d239c685af6e85f197 upstream.
+
+commit 6d9939f651419a63e091105663821f9c7d3fec37 (i2c: omap: split out [XR]DR
+and [XR]RDY) changed the way how errata i207 (I2C: RDR Flag May Be Incorrectly
+Set) get handled. 6d9939f6514 code doesn't correspond to workaround provided by
+errata.
+
+According to errata ISR must filter out spurious RDR before data read not after.
+ISR must read RXSTAT to get number of bytes available to read. Because RDR
+could be set while there could no data in the receive FIFO.
+
+Restored pre 6d9939f6514 way of handling errata.
+
+Found by code review. Real impact haven't seen.
+Tested on Beagleboard XM C.
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Fixes: 6d9939f651419a63e09110 i2c: omap: split out [XR]DR and [XR]RDY
+Tested-by: Felipe Balbi <balbi@ti.com>
+Reviewed-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-omap.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -956,11 +956,13 @@ omap_i2c_isr_thread(int this_irq, void *
+                       if (dev->fifo_size)
+                               num_bytes = dev->buf_len;
+-                      omap_i2c_receive_data(dev, num_bytes, true);
+-
+-                      if (dev->errata & I2C_OMAP_ERRATA_I207)
++                      if (dev->errata & I2C_OMAP_ERRATA_I207) {
+                               i2c_omap_errata_i207(dev, stat);
++                              num_bytes = (omap_i2c_read_reg(dev,
++                                      OMAP_I2C_BUFSTAT_REG) >> 8) & 0x3F;
++                      }
++                      omap_i2c_receive_data(dev, num_bytes, true);
+                       omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR);
+                       continue;
+               }
diff --git a/queue-3.17/i2c-omap-fix-nack-and-arbitration-lost-irq-handling.patch b/queue-3.17/i2c-omap-fix-nack-and-arbitration-lost-irq-handling.patch
new file mode 100644 (file)
index 0000000..81ff9fd
--- /dev/null
@@ -0,0 +1,70 @@
+From 27caca9d2e01c92b26d0690f065aad093fea01c7 Mon Sep 17 00:00:00 2001
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Tue, 18 Nov 2014 21:00:58 +0400
+Subject: i2c: omap: fix NACK and Arbitration Lost irq handling
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+commit 27caca9d2e01c92b26d0690f065aad093fea01c7 upstream.
+
+commit 1d7afc95946487945cc7f5019b41255b72224b70 (i2c: omap: ack IRQ in parts)
+changed the interrupt handler to complete transfers without clearing
+XRDY (AL case) and ARDY (NACK case) flags. XRDY or ARDY interrupts will be
+fired again. As a result, ISR keep processing transfer after it was already
+complete (from the driver code point of view).
+
+A didn't see real impacts of the 1d7afc9, but it is really bad idea to
+have ISR running on user data after transfer was complete.
+
+It looks, what 1d7afc9 violate TI specs in what how AL and NACK should be
+handled (see Note 1, sprugn4r, Figure 17-31 and Figure 17-32).
+
+According to specs (if I understood correctly), in case of NACK and AL driver
+must reset NACK, AL, ARDY, RDR, and RRDY (Master Receive Mode), and
+NACK, AL, ARDY, and XDR (Master Transmitter Mode).
+
+All that is done down the code under the if condition:
+if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK | OMAP_I2C_STAT_AL)) ...
+
+The patch restore pre 1d7afc9 logic of handling NACK and AL interrupts, so
+no interrupts is fired after ISR informs the rest of driver what transfer
+complete.
+
+Note: instead of removing break under NACK case, we could just replace 'break'
+with 'continue' and allow NACK transfer to finish using ARDY event. I found
+that NACK and ARDY bits usually set together. That case confirm TI wiki:
+http://processors.wiki.ti.com/index.php/I2C_Tips#Detecting_and_handling_NACK
+
+In order if someone interested in the event traces for NACK and AL cases,
+I sent them to mailing list.
+
+Tested on Beagleboard XM C.
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Fixes: 1d7afc9 i2c: omap: ack IRQ in parts
+Acked-by: Felipe Balbi <balbi@ti.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-omap.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -926,14 +926,12 @@ omap_i2c_isr_thread(int this_irq, void *
+               if (stat & OMAP_I2C_STAT_NACK) {
+                       err |= OMAP_I2C_STAT_NACK;
+                       omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK);
+-                      break;
+               }
+               if (stat & OMAP_I2C_STAT_AL) {
+                       dev_err(dev->dev, "Arbitration lost\n");
+                       err |= OMAP_I2C_STAT_AL;
+                       omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL);
+-                      break;
+               }
+               /*
diff --git a/queue-3.17/media-rc-core-fix-toggle-handling-in-the-rc6-decoder.patch b/queue-3.17/media-rc-core-fix-toggle-handling-in-the-rc6-decoder.patch
new file mode 100644 (file)
index 0000000..2b4f277
--- /dev/null
@@ -0,0 +1,39 @@
+From d2a74581390d8e5ed09b12c9d4736847d918dfa6 Mon Sep 17 00:00:00 2001
+From: David Härdeman <david@hardeman.nu>
+Date: Thu, 20 Nov 2014 18:09:54 -0300
+Subject: media: rc-core: fix toggle handling in the rc6 decoder
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Härdeman <david@hardeman.nu>
+
+commit d2a74581390d8e5ed09b12c9d4736847d918dfa6 upstream.
+
+The toggle bit shouldn't be cleared before the toggle value is calculated.
+
+This should probably go into 3.17.x as well.
+
+Fixes: 120703f9eb32 ([media] rc-core: document the protocol type)
+
+Tested-by: Stephan Raue <mailinglists@openelec.tv>
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/ir-rc6-decoder.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/ir-rc6-decoder.c
++++ b/drivers/media/rc/ir-rc6-decoder.c
+@@ -259,8 +259,8 @@ again:
+                       case 32:
+                               if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) {
+                                       protocol = RC_TYPE_RC6_MCE;
+-                                      scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
+                                       toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK);
++                                      scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
+                               } else {
+                                       protocol = RC_BIT_RC6_6A_32;
+                                       toggle = 0;
diff --git a/queue-3.17/media-s2255drv-fix-payload-size-for-jpg-mjpeg.patch b/queue-3.17/media-s2255drv-fix-payload-size-for-jpg-mjpeg.patch
new file mode 100644 (file)
index 0000000..97eaf55
--- /dev/null
@@ -0,0 +1,32 @@
+From 1f391217ad8d7cd7b1e48e6e2abf49970cd91d18 Mon Sep 17 00:00:00 2001
+From: sensoray-dev <linux-dev@sensoray.com>
+Date: Mon, 17 Nov 2014 19:50:36 -0300
+Subject: media: s2255drv: fix payload size for JPG, MJPEG
+
+From: sensoray-dev <linux-dev@sensoray.com>
+
+commit 1f391217ad8d7cd7b1e48e6e2abf49970cd91d18 upstream.
+
+length is the size of the buffer, not the payload. That's set using
+vb2_set_plane_payload().
+
+Signed-off-by: Dean Anderson <linux-dev@sensoray.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/s2255/s2255drv.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/s2255/s2255drv.c
++++ b/drivers/media/usb/s2255/s2255drv.c
+@@ -632,7 +632,7 @@ static void s2255_fillbuff(struct s2255_
+                       break;
+               case V4L2_PIX_FMT_JPEG:
+               case V4L2_PIX_FMT_MJPEG:
+-                      buf->vb.v4l2_buf.length = jpgsize;
++                      vb2_set_plane_payload(&buf->vb, 0, jpgsize);
+                       memcpy(vbuf, tmpbuf, jpgsize);
+                       break;
+               case V4L2_PIX_FMT_YUV422P:
diff --git a/queue-3.17/media-smiapp-only-some-selection-targets-are-settable.patch b/queue-3.17/media-smiapp-only-some-selection-targets-are-settable.patch
new file mode 100644 (file)
index 0000000..67cba70
--- /dev/null
@@ -0,0 +1,33 @@
+From b31eb901c4e5eeef4c83c43dfbc7fe0d4348cb21 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@iki.fi>
+Date: Thu, 6 Nov 2014 17:49:45 -0300
+Subject: media: smiapp: Only some selection targets are settable
+
+From: Sakari Ailus <sakari.ailus@iki.fi>
+
+commit b31eb901c4e5eeef4c83c43dfbc7fe0d4348cb21 upstream.
+
+Setting a non-settable selection target caused BUG() to be called. The check
+for valid selections only takes the selection target into account, but does
+not tell whether it may be set, or only get. Fix the issue by simply
+returning an error to the user.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/smiapp/smiapp-core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2133,7 +2133,7 @@ static int smiapp_set_selection(struct v
+               ret = smiapp_set_compose(subdev, fh, sel);
+               break;
+       default:
+-              BUG();
++              ret = -EINVAL;
+       }
+       mutex_unlock(&sensor->mutex);
diff --git a/queue-3.17/mm-fix-anon_vma_clone-error-treatment.patch b/queue-3.17/mm-fix-anon_vma_clone-error-treatment.patch
new file mode 100644 (file)
index 0000000..fdcf25a
--- /dev/null
@@ -0,0 +1,90 @@
+From c4ea95d7cd08d9ffd7fa75e6c5e0332d596dd11e Mon Sep 17 00:00:00 2001
+From: Daniel Forrest <dan.forrest@ssec.wisc.edu>
+Date: Tue, 2 Dec 2014 15:59:42 -0800
+Subject: mm: fix anon_vma_clone() error treatment
+
+From: Daniel Forrest <dan.forrest@ssec.wisc.edu>
+
+commit c4ea95d7cd08d9ffd7fa75e6c5e0332d596dd11e upstream.
+
+Andrew Morton noticed that the error return from anon_vma_clone() was
+being dropped and replaced with -ENOMEM (which is not itself a bug
+because the only error return value from anon_vma_clone() is -ENOMEM).
+
+I did an audit of callers of anon_vma_clone() and discovered an actual
+bug where the error return was being lost.  In __split_vma(), between
+Linux 3.11 and 3.12 the code was changed so the err variable is used
+before the call to anon_vma_clone() and the default initial value of
+-ENOMEM is overwritten.  So a failure of anon_vma_clone() will return
+success since err at this point is now zero.
+
+Below is a patch which fixes this bug and also propagates the error
+return value from anon_vma_clone() in all cases.
+
+Fixes: ef0855d334e1 ("mm: mempolicy: turn vma_set_policy() into vma_dup_policy()")
+Signed-off-by: Daniel Forrest <dan.forrest@ssec.wisc.edu>
+Reviewed-by: Michal Hocko <mhocko@suse.cz>
+Cc: Konstantin Khlebnikov <koct9i@gmail.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Tim Hartrick <tim@edgecast.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/mmap.c |   10 +++++++---
+ mm/rmap.c |    6 ++++--
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -752,8 +752,11 @@ again:                    remove_next = 1 + (end > next->
+                * shrinking vma had, to cover any anon pages imported.
+                */
+               if (exporter && exporter->anon_vma && !importer->anon_vma) {
+-                      if (anon_vma_clone(importer, exporter))
+-                              return -ENOMEM;
++                      int error;
++
++                      error = anon_vma_clone(importer, exporter);
++                      if (error)
++                              return error;
+                       importer->anon_vma = exporter->anon_vma;
+               }
+       }
+@@ -2453,7 +2456,8 @@ static int __split_vma(struct mm_struct
+       if (err)
+               goto out_free_vma;
+-      if (anon_vma_clone(new, vma))
++      err = anon_vma_clone(new, vma);
++      if (err)
+               goto out_free_mpol;
+       if (new->vm_file)
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct
+ {
+       struct anon_vma_chain *avc;
+       struct anon_vma *anon_vma;
++      int error;
+       /* Don't bother if the parent process has no anon_vma here. */
+       if (!pvma->anon_vma)
+@@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct
+        * First, attach the new VMA to the parent VMA's anon_vmas,
+        * so rmap can find non-COWed pages in child processes.
+        */
+-      if (anon_vma_clone(vma, pvma))
+-              return -ENOMEM;
++      error = anon_vma_clone(vma, pvma);
++      if (error)
++              return error;
+       /* Then add our own anon_vma. */
+       anon_vma = anon_vma_alloc();
diff --git a/queue-3.17/mm-fix-swapoff-hang-after-page-migration-and-fork.patch b/queue-3.17/mm-fix-swapoff-hang-after-page-migration-and-fork.patch
new file mode 100644 (file)
index 0000000..e91246f
--- /dev/null
@@ -0,0 +1,70 @@
+From 2022b4d18a491a578218ce7a4eca8666db895a73 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Tue, 2 Dec 2014 15:59:39 -0800
+Subject: mm: fix swapoff hang after page migration and fork
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 2022b4d18a491a578218ce7a4eca8666db895a73 upstream.
+
+I've been seeing swapoff hangs in recent testing: it's cycling around
+trying unsuccessfully to find an mm for some remaining pages of swap.
+
+I have been exercising swap and page migration more heavily recently,
+and now notice a long-standing error in copy_one_pte(): it's trying to
+add dst_mm to swapoff's mmlist when it finds a swap entry, but is doing
+so even when it's a migration entry or an hwpoison entry.
+
+Which wouldn't matter much, except it adds dst_mm next to src_mm,
+assuming src_mm is already on the mmlist: which may not be so.  Then if
+pages are later swapped out from dst_mm, swapoff won't be able to find
+where to replace them.
+
+There's already a !non_swap_entry() test for stats: move that up before
+the swap_duplicate() and the addition to mmlist.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Cc: Kelley Nielsen <kelleynnn@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memory.c |   24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -815,20 +815,20 @@ copy_one_pte(struct mm_struct *dst_mm, s
+               if (!pte_file(pte)) {
+                       swp_entry_t entry = pte_to_swp_entry(pte);
+-                      if (swap_duplicate(entry) < 0)
+-                              return entry.val;
++                      if (likely(!non_swap_entry(entry))) {
++                              if (swap_duplicate(entry) < 0)
++                                      return entry.val;
+-                      /* make sure dst_mm is on swapoff's mmlist. */
+-                      if (unlikely(list_empty(&dst_mm->mmlist))) {
+-                              spin_lock(&mmlist_lock);
+-                              if (list_empty(&dst_mm->mmlist))
+-                                      list_add(&dst_mm->mmlist,
+-                                               &src_mm->mmlist);
+-                              spin_unlock(&mmlist_lock);
+-                      }
+-                      if (likely(!non_swap_entry(entry)))
++                              /* make sure dst_mm is on swapoff's mmlist. */
++                              if (unlikely(list_empty(&dst_mm->mmlist))) {
++                                      spin_lock(&mmlist_lock);
++                                      if (list_empty(&dst_mm->mmlist))
++                                              list_add(&dst_mm->mmlist,
++                                                       &src_mm->mmlist);
++                                      spin_unlock(&mmlist_lock);
++                              }
+                               rss[MM_SWAPENTS]++;
+-                      else if (is_migration_entry(entry)) {
++                      } else if (is_migration_entry(entry)) {
+                               page = migration_entry_to_page(entry);
+                               if (PageAnon(page))
diff --git a/queue-3.17/mm-frontswap-invalidate-expired-data-on-a-dup-store-failure.patch b/queue-3.17/mm-frontswap-invalidate-expired-data-on-a-dup-store-failure.patch
new file mode 100644 (file)
index 0000000..f6f4bff
--- /dev/null
@@ -0,0 +1,50 @@
+From fb993fa1a2f669215fa03a09eed7848f2663e336 Mon Sep 17 00:00:00 2001
+From: Weijie Yang <weijie.yang@samsung.com>
+Date: Tue, 2 Dec 2014 15:59:25 -0800
+Subject: mm: frontswap: invalidate expired data on a dup-store failure
+
+From: Weijie Yang <weijie.yang@samsung.com>
+
+commit fb993fa1a2f669215fa03a09eed7848f2663e336 upstream.
+
+If a frontswap dup-store failed, it should invalidate the expired page
+in the backend, or it could trigger some data corruption issue.
+Such as:
+ 1. use zswap as the frontswap backend with writeback feature
+ 2. store a swap page(version_1) to entry A, success
+ 3. dup-store a newer page(version_2) to the same entry A, fail
+ 4. use __swap_writepage() write version_2 page to swapfile, success
+ 5. zswap do shrink, writeback version_1 page to swapfile
+ 6. version_2 page is overwrited by version_1, data corrupt.
+
+This patch fixes this issue by invalidating expired data immediately
+when meet a dup-store failure.
+
+Signed-off-by: Weijie Yang <weijie.yang@samsung.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Seth Jennings <sjennings@variantweb.net>
+Cc: Dan Streetman <ddstreet@ieee.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Bob Liu <bob.liu@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/frontswap.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/frontswap.c
++++ b/mm/frontswap.c
+@@ -244,8 +244,10 @@ int __frontswap_store(struct page *page)
+                 the (older) page from frontswap
+                */
+               inc_frontswap_failed_stores();
+-              if (dup)
++              if (dup) {
+                       __frontswap_clear(sis, offset);
++                      frontswap_ops->invalidate_page(type, offset);
++              }
+       }
+       if (frontswap_writethrough_enabled)
+               /* report failure so swap also writes to swap device */
diff --git a/queue-3.17/mm-vmpressure.c-fix-race-in-vmpressure_work_fn.patch b/queue-3.17/mm-vmpressure.c-fix-race-in-vmpressure_work_fn.patch
new file mode 100644 (file)
index 0000000..6cb88d7
--- /dev/null
@@ -0,0 +1,51 @@
+From 91b57191cfd152c02ded0745250167d0263084f8 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 2 Dec 2014 15:59:28 -0800
+Subject: mm/vmpressure.c: fix race in vmpressure_work_fn()
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 91b57191cfd152c02ded0745250167d0263084f8 upstream.
+
+In some android devices, there will be a "divide by zero" exception.
+vmpr->scanned could be zero before spin_lock(&vmpr->sr_lock).
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=88051
+
+[akpm@linux-foundation.org: neaten]
+Reported-by: ji_ang <ji_ang@163.com>
+Cc: Anton Vorontsov <anton.vorontsov@linaro.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmpressure.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/mm/vmpressure.c
++++ b/mm/vmpressure.c
+@@ -165,6 +165,7 @@ static void vmpressure_work_fn(struct wo
+       unsigned long scanned;
+       unsigned long reclaimed;
++      spin_lock(&vmpr->sr_lock);
+       /*
+        * Several contexts might be calling vmpressure(), so it is
+        * possible that the work was rescheduled again before the old
+@@ -173,11 +174,12 @@ static void vmpressure_work_fn(struct wo
+        * here. No need for any locks here since we don't care if
+        * vmpr->reclaimed is in sync.
+        */
+-      if (!vmpr->scanned)
++      scanned = vmpr->scanned;
++      if (!scanned) {
++              spin_unlock(&vmpr->sr_lock);
+               return;
++      }
+-      spin_lock(&vmpr->sr_lock);
+-      scanned = vmpr->scanned;
+       reclaimed = vmpr->reclaimed;
+       vmpr->scanned = 0;
+       vmpr->reclaimed = 0;
diff --git a/queue-3.17/nouveau-move-the-hotplug-ignore-to-correct-place.patch b/queue-3.17/nouveau-move-the-hotplug-ignore-to-correct-place.patch
new file mode 100644 (file)
index 0000000..d194aab
--- /dev/null
@@ -0,0 +1,39 @@
+From 8b62c8c6df08ca567c78afa51aa7bbc554cede06 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Tue, 2 Dec 2014 16:27:25 +1000
+Subject: nouveau: move the hotplug ignore to correct place.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 8b62c8c6df08ca567c78afa51aa7bbc554cede06 upstream.
+
+Introduced in b440bde74f, however it was added to
+the wrong function in nouveau.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=86011
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_drm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -626,7 +626,6 @@ int nouveau_pmops_suspend(struct device
+       pci_save_state(pdev);
+       pci_disable_device(pdev);
+-      pci_ignore_hotplug(pdev);
+       pci_set_power_state(pdev, PCI_D3hot);
+       return 0;
+ }
+@@ -930,6 +929,7 @@ static int nouveau_pmops_runtime_suspend
+       ret = nouveau_do_suspend(drm_dev, true);
+       pci_save_state(pdev);
+       pci_disable_device(pdev);
++      pci_ignore_hotplug(pdev);
+       pci_set_power_state(pdev, PCI_D3cold);
+       drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
+       return ret;
diff --git a/queue-3.17/of-fdt-memblock_reserve-memreserve-regions-in-the-case-of-partial-overlap.patch b/queue-3.17/of-fdt-memblock_reserve-memreserve-regions-in-the-case-of-partial-overlap.patch
new file mode 100644 (file)
index 0000000..96b3867
--- /dev/null
@@ -0,0 +1,51 @@
+From 094cb98179f19b75acf9ff471daabf3948ce98e6 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ian.campbell@citrix.com>
+Date: Tue, 25 Nov 2014 15:05:13 +0000
+Subject: of/fdt: memblock_reserve /memreserve/ regions in the case of partial overlap
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 094cb98179f19b75acf9ff471daabf3948ce98e6 upstream.
+
+memblock_is_region_reserved() returns true in the case of a partial
+overlap, meaning that the current code fails to reserve the
+non-overlapping portion.
+
+This call was introduced as part of d1552ce449eb "of/fdt: move
+memreserve and dtb memory reservations into core" which went into
+v3.16.
+
+I observed this causing a Midway system with a buggy fdt (the header
+declares itself to be larger than it really is) failing to boot
+because the over-inflated size of the fdt was causing it to seem to
+run into the swapper_pg_dir region, meaning the DT wasn't reserved.
+The symptoms were failing to find an disks or network and failing to
+boot.
+
+However given the ambiguity of whether things like the initrd are
+covered by /memreserve/ and similar I think it is best to also
+register the region rather than just ignoring it.
+
+Since memblock_reserve() handles overlaps just fine lets just warn and
+carry on.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Grant Likely <grant.likely@linaro.org>
+Cc: Rob Herring <robh+dt@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/fdt.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -964,8 +964,6 @@ void __init __weak early_init_dt_add_mem
+ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+                                       phys_addr_t size, bool nomap)
+ {
+-      if (memblock_is_region_reserved(base, size))
+-              return -EBUSY;
+       if (nomap)
+               return memblock_remove(base, size);
+       return memblock_reserve(base, size);
index 6732429cacc66f5af0784623620284a73e06a8d7..96a22f087db6327cf1d99c3c88cf73c25bdb4905 100644 (file)
@@ -17,3 +17,7 @@ drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6
 of-fdt-memblock_reserve-memreserve-regions-in-the-case-of-partial-overlap.patch
 drm-i915-more-cautious-with-pch-fifo-underruns.patch
 drm-i915-unlock-panel-even-when-lvds-is-disabled.patch
+x86-use-objdump-instead-of-plain-objdump.patch
+media-rc-core-fix-toggle-handling-in-the-rc6-decoder.patch
+media-s2255drv-fix-payload-size-for-jpg-mjpeg.patch
+media-smiapp-only-some-selection-targets-are-settable.patch
diff --git a/queue-3.17/slab-fix-nodeid-bounds-check-for-non-contiguous-node-ids.patch b/queue-3.17/slab-fix-nodeid-bounds-check-for-non-contiguous-node-ids.patch
new file mode 100644 (file)
index 0000000..74adcf5
--- /dev/null
@@ -0,0 +1,58 @@
+From 7c3fbbdd04a681a1992ad6a3d7a36a63ff668753 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Tue, 2 Dec 2014 15:59:48 -0800
+Subject: slab: fix nodeid bounds check for non-contiguous node IDs
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 7c3fbbdd04a681a1992ad6a3d7a36a63ff668753 upstream.
+
+The bounds check for nodeid in ____cache_alloc_node gives false
+positives on machines where the node IDs are not contiguous, leading to
+a panic at boot time.  For example, on a POWER8 machine the node IDs are
+typically 0, 1, 16 and 17.  This means that num_online_nodes() returns
+4, so when ____cache_alloc_node is called with nodeid = 16 the VM_BUG_ON
+triggers, like this:
+
+  kernel BUG at /home/paulus/kernel/kvm/mm/slab.c:3079!
+  Call Trace:
+    .____cache_alloc_node+0x5c/0x270 (unreliable)
+    .kmem_cache_alloc_node_trace+0xdc/0x360
+    .init_list+0x3c/0x128
+    .kmem_cache_init+0x1dc/0x258
+    .start_kernel+0x2a0/0x568
+    start_here_common+0x20/0xa8
+
+To fix this, we instead compare the nodeid with MAX_NUMNODES, and
+additionally make sure it isn't negative (since nodeid is an int).  The
+check is there mainly to protect the array dereference in the get_node()
+call in the next line, and the array being dereferenced is of size
+MAX_NUMNODES.  If the nodeid is in range but invalid (for example if the
+node is off-line), the BUG_ON in the next line will catch that.
+
+Fixes: 14e50c6a9bc2 ("mm: slab: Verify the nodeid passed to ____cache_alloc_node")
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+Reviewed-by: Pekka Enberg <penberg@kernel.org>
+Acked-by: David Rientjes <rientjes@google.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/slab.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3108,7 +3108,7 @@ static void *____cache_alloc_node(struct
+       void *obj;
+       int x;
+-      VM_BUG_ON(nodeid > num_online_nodes());
++      VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES);
+       n = get_node(cachep, nodeid);
+       BUG_ON(!n);
diff --git a/queue-3.17/x86-use-objdump-instead-of-plain-objdump.patch b/queue-3.17/x86-use-objdump-instead-of-plain-objdump.patch
new file mode 100644 (file)
index 0000000..22fa195
--- /dev/null
@@ -0,0 +1,45 @@
+From e2e68ae688b0a3766cd75aedf4ed4e39be402009 Mon Sep 17 00:00:00 2001
+From: Chris Clayton <chris2553@googlemail.com>
+Date: Sat, 22 Nov 2014 09:51:10 +0000
+Subject: x86: Use $(OBJDUMP) instead of plain objdump
+
+From: Chris Clayton <chris2553@googlemail.com>
+
+commit e2e68ae688b0a3766cd75aedf4ed4e39be402009 upstream.
+
+commit e6023367d779 'x86, kaslr: Prevent .bss from overlaping initrd'
+broke the cross compile of x86. It added a objdump invocation, which
+invokes the host native objdump and ignores an active cross tool
+chain.
+
+Use $(OBJDUMP) instead which takes the CROSS_COMPILE prefix into
+account.
+
+[ tglx: Massage changelog and use $(OBJDUMP) ]
+
+Fixes: e6023367d779 'x86, kaslr: Prevent .bss from overlaping initrd'
+Signed-off-by: Chris Clayton <chris2553@googlemail.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+Cc: Junjie Mao <eternal.n08@gmail.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/r/54705C8E.1080400@googlemail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/boot/compressed/Makefile |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -75,7 +75,7 @@ suffix-$(CONFIG_KERNEL_XZ)   := xz
+ suffix-$(CONFIG_KERNEL_LZO)   := lzo
+ suffix-$(CONFIG_KERNEL_LZ4)   := lz4
+-RUN_SIZE = $(shell objdump -h vmlinux | \
++RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
+            perl $(srctree)/arch/x86/tools/calc_run_size.pl)
+ quiet_cmd_mkpiggy = MKPIGGY $@
+       cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
diff --git a/queue-3.17/xen-netfront-remove-bugs-on-paged-skb-data-which-crosses-a-page-boundary.patch b/queue-3.17/xen-netfront-remove-bugs-on-paged-skb-data-which-crosses-a-page-boundary.patch
new file mode 100644 (file)
index 0000000..827253f
--- /dev/null
@@ -0,0 +1,48 @@
+From 8d609725d4357f499e2103e46011308b32f53513 Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Tue, 25 Nov 2014 20:28:24 -0600
+Subject: xen-netfront: Remove BUGs on paged skb data which crosses a page boundary
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 8d609725d4357f499e2103e46011308b32f53513 upstream.
+
+These BUGs can be erroneously triggered by frags which refer to
+tail pages within a compound page. The data in these pages may
+overrun the hardware page while still being contained within the
+compound page, but since compound_order() evaluates to 0 for tail
+pages the assertion fails. The code already iterates through
+subsequent pages correctly in this scenario, so the BUGs are
+unnecessary and can be removed.
+
+Fixes: f36c374782e4 ("xen/netfront: handle compound page fragments on transmit")
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Reviewed-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/xen-netfront.c |    5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_
+               len = skb_frag_size(frag);
+               offset = frag->page_offset;
+-              /* Data must not cross a page boundary. */
+-              BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
+-
+               /* Skip unused frames from start of page */
+               page += offset >> PAGE_SHIFT;
+               offset &= ~PAGE_MASK;
+@@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_
+               while (len > 0) {
+                       unsigned long bytes;
+-                      BUG_ON(offset >= PAGE_SIZE);
+-
+                       bytes = PAGE_SIZE - offset;
+                       if (bytes > len)
+                               bytes = len;