--- /dev/null
+From 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 Mon Sep 17 00:00:00 2001
+From: John Soni Jose <sony.john-n@emulex.com>
+Date: Thu, 12 Feb 2015 06:45:47 +0530
+Subject: be2iscsi: Fix kernel panic when device initialization fails
+
+From: John Soni Jose <sony.john-n@emulex.com>
+
+commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream.
+
+Kernel panic was happening as iscsi_host_remove() was called on
+a host which was not yet added.
+
+Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/be2iscsi/be_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -5735,9 +5735,9 @@ free_port:
+ hba_free:
+ if (phba->msix_enabled)
+ pci_disable_msix(phba->pcidev);
+- iscsi_host_remove(phba->shost);
+ pci_dev_put(phba->pcidev);
+ iscsi_host_free(phba->shost);
++ pci_set_drvdata(pcidev, NULL);
+ disable_pci:
+ pci_disable_device(pcidev);
+ return ret;
--- /dev/null
+From 6b46211f0a3b18b2360275ac29c4d6bfdf7bc015 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Sun, 8 Mar 2015 23:20:03 -0800
+Subject: [media] cx23885: fix querycap
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 6b46211f0a3b18b2360275ac29c4d6bfdf7bc015 upstream.
+
+cap->device_caps wasn't set in cx23885-417.c causing a warning from
+the v4l2-core.
+
+Reported-by: Joseph Jasi <joe.yasi@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/cx23885/cx23885-417.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/pci/cx23885/cx23885-417.c
++++ b/drivers/media/pci/cx23885/cx23885-417.c
+@@ -1339,14 +1339,13 @@ static int vidioc_querycap(struct file *
+ strlcpy(cap->driver, dev->name, sizeof(cap->driver));
+ strlcpy(cap->card, cx23885_boards[tsport->dev->board].name,
+ sizeof(cap->card));
+- sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
+- cap->capabilities =
+- V4L2_CAP_VIDEO_CAPTURE |
+- V4L2_CAP_READWRITE |
+- V4L2_CAP_STREAMING |
+- 0;
++ sprintf(cap->bus_info, "PCIe:%s", pci_name(dev->pci));
++ cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE |
++ V4L2_CAP_STREAMING;
+ if (dev->tuner_type != TUNER_ABSENT)
+- cap->capabilities |= V4L2_CAP_TUNER;
++ cap->device_caps |= V4L2_CAP_TUNER;
++ cap->capabilities = cap->device_caps | V4L2_CAP_VBI_CAPTURE |
++ V4L2_CAP_AUDIO | V4L2_CAP_DEVICE_CAPS;
+
+ return 0;
+ }
--- /dev/null
+From deeb8525f9bcea60f5e86521880c1161de7a5829 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 6 Apr 2015 17:57:44 -0400
+Subject: ioctx_alloc(): fix vma (and file) leak on failure
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream.
+
+If we fail past the aio_setup_ring(), we need to destroy the
+mapping. We don't need to care about anybody having found ctx,
+or added requests to it, since the last failure exit is exactly
+the failure to make ctx visible to lookups.
+
+Reproducer (based on one by Joe Mario <jmario@redhat.com>):
+
+void count(char *p)
+{
+ char s[80];
+ printf("%s: ", p);
+ fflush(stdout);
+ sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'", getpid());
+ system(s);
+}
+
+int main()
+{
+ io_context_t *ctx;
+ int created, limit, i, destroyed;
+ FILE *f;
+
+ count("before");
+ if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL)
+ perror("opening aio-max-nr");
+ else if (fscanf(f, "%d", &limit) != 1)
+ fprintf(stderr, "can't parse aio-max-nr\n");
+ else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL)
+ perror("allocating aio_context_t array");
+ else {
+ for (i = 0, created = 0; i < limit; i++) {
+ if (io_setup(1000, ctx + created) == 0)
+ created++;
+ }
+ for (i = 0, destroyed = 0; i < created; i++)
+ if (io_destroy(ctx[i]) == 0)
+ destroyed++;
+ printf("created %d, failed %d, destroyed %d\n",
+ created, limit - created, destroyed);
+ count("after");
+ }
+}
+
+Found-by: Joe Mario <jmario@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/aio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -740,6 +740,9 @@ static struct kioctx *ioctx_alloc(unsign
+ err_cleanup:
+ aio_nr_sub(ctx->max_reqs);
+ err_ctx:
++ atomic_set(&ctx->dead, 1);
++ if (ctx->mmap_size)
++ vm_munmap(ctx->mmap_base, ctx->mmap_size);
+ aio_free_ring(ctx);
+ err:
+ mutex_unlock(&ctx->ring_lock);
--- /dev/null
+From b815fc12d4dd2b5586184fb4f867caff05a810d4 Mon Sep 17 00:00:00 2001
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Fri, 10 Apr 2015 02:47:27 -0500
+Subject: iscsi target: fix oops when adding reject pdu
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit b815fc12d4dd2b5586184fb4f867caff05a810d4 upstream.
+
+This fixes a oops due to a double list add when adding a reject PDU for
+iscsit_allocate_iovecs allocation failures. The cmd has already been
+added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call
+iscsit_reject_cmd.
+
+Note that for ERL0 the reject PDU is not actually sent, so this patch
+is not completely tested. Just verified we do not oops. The problem is the
+add reject functions return -1 which is returned all the way up to
+iscsi_target_rx_thread which for ERL0 will drop the connection.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1185,7 +1185,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn
+ * traditional iSCSI block I/O.
+ */
+ if (iscsit_allocate_iovecs(cmd) < 0) {
+- return iscsit_add_reject_cmd(cmd,
++ return iscsit_reject_cmd(cmd,
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+ immed_data = cmd->immediate_data;
--- /dev/null
+From 05b676ab42f624425d5f6519276e506b812fa058 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 4 Mar 2015 05:55:21 -0800
+Subject: [media] media: s5p-mfc: fix mmap support for 64bit arch
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 05b676ab42f624425d5f6519276e506b812fa058 upstream.
+
+TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it
+should not be used for defining offset boundary for mmaping buffers for
+CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on
+the CAPTURE queue on 64bit architectures (like ARM64).
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Kamil Debski <k.debski@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/s5p-mfc/s5p_mfc_common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+@@ -29,7 +29,7 @@
+
+ /* Offset base used to differentiate between CAPTURE and OUTPUT
+ * while mmaping */
+-#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
++#define DST_QUEUE_OFF_BASE (1 << 30)
+
+ #define MFC_BANK1_ALLOC_CTX 0
+ #define MFC_BANK2_ALLOC_CTX 1
--- /dev/null
+From 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Wed, 8 Apr 2015 17:00:32 -0400
+Subject: ocfs2: _really_ sync the right range
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream.
+
+"ocfs2 syncs the wrong range" had been broken; prior to it the
+code was doing the wrong thing in case of O_APPEND, all right,
+but _after_ it we were syncing the wrong range in 100% cases.
+*ppos, aka iocb->ki_pos is incremented prior to that point,
+so we are always doing sync on the area _after_ the one we'd
+written to.
+
+Spotted by Joseph Qi <joseph.qi@huawei.com> back in January;
+unfortunately, I'd missed his mail back then ;-/
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ocfs2/file.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2374,10 +2374,14 @@ out_dio:
+ /* buffered aio wouldn't have proper lock coverage today */
+ BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
+
++ if (unlikely(written <= 0))
++ goto no_sync;
++
+ if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+ ((file->f_flags & O_DIRECT) && !direct_io)) {
+- ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawrite_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ if (ret < 0)
+ written = ret;
+
+@@ -2388,10 +2392,12 @@ out_dio:
+ }
+
+ if (!ret)
+- ret = filemap_fdatawait_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawait_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ }
+
++no_sync:
+ /*
+ * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
+ * function pointer which is called when o_direct io completes so that
--- /dev/null
+From 6d7fdb0ab351b33d4c12d53fe44be030b90fc9d4 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Thu, 2 Apr 2015 14:40:58 +0300
+Subject: Revert "libceph: use memalloc flags for net IO"
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 6d7fdb0ab351b33d4c12d53fe44be030b90fc9d4 upstream.
+
+This reverts commit 89baaa570ab0b476db09408d209578cfed700e9f.
+
+Dirty page throttling should be sufficient for us in the general case
+so there is no need to use __GFP_MEMALLOC - it would be needed only in
+the swap-over-rbd case, which we currently don't support. (It would
+probably take approximately the commit that is being reverted to add
+that support, but we would also need the "swap" option to distinguish
+from the general case and make sure swap ceph_client-s aren't shared
+with anything else.) See ceph-devel threads [1] and [2] for the
+details of why enabling pfmemalloc reserves for all cases is a bad
+thing.
+
+On top of potential system lockups related to drained emergency
+reserves, this turned out to cause ceph lockups in case peers are on
+the same host and communicating via loopback due to sk_filter()
+dropping pfmemalloc skbs on the receiving side because the receiving
+loopback socket is not tagged with SOCK_MEMALLOC.
+
+[1] "SOCK_MEMALLOC vs loopback"
+ http://www.spinics.net/lists/ceph-devel/msg22998.html
+[2] "[PATCH] libceph: don't set memalloc flags in loopback case"
+ http://www.spinics.net/lists/ceph-devel/msg23392.html
+
+Conflicts:
+ net/ceph/messenger.c [ context: tcp_nodelay option ]
+
+Cc: Mike Christie <michaelc@cs.wisc.edu>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Sage Weil <sage@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Mike Christie <michaelc@cs.wisc.edu>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ceph/messenger.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_
+ IPPROTO_TCP, &sock);
+ if (ret)
+ return ret;
+- sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
++ sock->sk->sk_allocation = GFP_NOFS;
+
+ #ifdef CONFIG_LOCKDEP
+ lockdep_set_class(&sock->sk->sk_lock, &socket_class);
+@@ -510,8 +510,6 @@ static int ceph_tcp_connect(struct ceph_
+ return ret;
+ }
+
+- sk_set_memalloc(sock->sk);
+-
+ con->sock = sock;
+ return 0;
+ }
+@@ -2798,11 +2796,8 @@ static void con_work(struct work_struct
+ {
+ struct ceph_connection *con = container_of(work, struct ceph_connection,
+ work.work);
+- unsigned long pflags = current->flags;
+ bool fault;
+
+- current->flags |= PF_MEMALLOC;
+-
+ mutex_lock(&con->mutex);
+ while (true) {
+ int ret;
+@@ -2856,8 +2851,6 @@ static void con_work(struct work_struct
+ con_fault_finish(con);
+
+ con->ops->put(con);
+-
+- tsk_restore_flags(current, pflags, PF_MEMALLOC);
+ }
+
+ /*
--- /dev/null
+From f82daee49c09cf6a99c28303d93438a2566e5552 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 7 Apr 2015 01:07:39 +0200
+Subject: Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions"
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit f82daee49c09cf6a99c28303d93438a2566e5552 upstream.
+
+Commit 84c91b7ae07c (PM / hibernate: avoid unsafe pages in e820 reserved
+regions) is reported to make resume from hibernation on Lenovo x230
+unreliable, so revert it.
+
+We will revisit the issue the commit in question was supposed to fix
+in the future.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=96111
+Reported-by: rhn <kebuac.rhn@porcupinefactory.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/power/snapshot.c | 21 +--------------------
+ 1 file changed, 1 insertion(+), 20 deletions(-)
+
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -955,25 +955,6 @@ static void mark_nosave_pages(struct mem
+ }
+ }
+
+-static bool is_nosave_page(unsigned long pfn)
+-{
+- struct nosave_region *region;
+-
+- list_for_each_entry(region, &nosave_regions, list) {
+- if (pfn >= region->start_pfn && pfn < region->end_pfn) {
+- pr_err("PM: %#010llx in e820 nosave region: "
+- "[mem %#010llx-%#010llx]\n",
+- (unsigned long long) pfn << PAGE_SHIFT,
+- (unsigned long long) region->start_pfn << PAGE_SHIFT,
+- ((unsigned long long) region->end_pfn << PAGE_SHIFT)
+- - 1);
+- return true;
+- }
+- }
+-
+- return false;
+-}
+-
+ /**
+ * create_basic_memory_bitmaps - create bitmaps needed for marking page
+ * frames that should not be saved and free page frames. The pointers
+@@ -2039,7 +2020,7 @@ static int mark_unsafe_pages(struct memo
+ do {
+ pfn = memory_bm_next_pfn(bm);
+ if (likely(pfn != BM_END_OF_MAP)) {
+- if (likely(pfn_valid(pfn)) && !is_nosave_page(pfn))
++ if (likely(pfn_valid(pfn)))
+ swsusp_set_page_free(pfn_to_page(pfn));
+ else
+ return -EFAULT;
iommu-vt-d-detach-domain-only-from-attached-iommus.patch
rtlwifi-fix-iommu-mapping-leak-in-ap-mode.patch
drivers-of-add-empty-ranges-quirk-for-pa-semi.patch
+revert-pm-hibernate-avoid-unsafe-pages-in-e820-reserved-regions.patch
+revert-libceph-use-memalloc-flags-for-net-io.patch
+be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch
+ocfs2-_really_-sync-the-right-range.patch
+ioctx_alloc-fix-vma-and-file-leak-on-failure.patch
+iscsi-target-fix-oops-when-adding-reject-pdu.patch
+sh_veu-v4l2_dev-wasn-t-set.patch
+media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch
+cx23885-fix-querycap.patch
+soc-camera-fix-devm_kfree-in-soc_of_bind.patch
+vb2-fix-dma_dir-setting-for-dma-contig-mem-type.patch
+vb2-fix-unbalanced-warnings-when-calling-vb2_thread_stop.patch
--- /dev/null
+From ab3120300be067a2d41a027c41db0b2c662ab200 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Wed, 10 Dec 2014 12:35:34 -0300
+Subject: [media] sh_veu: v4l2_dev wasn't set
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit ab3120300be067a2d41a027c41db0b2c662ab200 upstream.
+
+The v4l2_dev field of struct video_device must be set correctly.
+This was never done for this driver, so no video nodes were created
+anymore.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/sh_veu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/sh_veu.c
++++ b/drivers/media/platform/sh_veu.c
+@@ -1179,6 +1179,7 @@ static int sh_veu_probe(struct platform_
+ }
+
+ *vdev = sh_veu_videodev;
++ vdev->v4l2_dev = &veu->v4l2_dev;
+ spin_lock_init(&veu->lock);
+ mutex_init(&veu->fop_lock);
+ vdev->lock = &veu->fop_lock;
--- /dev/null
+From 8e48a2d54c5d74ea3e9dc4c3b9037786bb447f36 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Thu, 19 Feb 2015 06:47:16 -0300
+Subject: [media] soc-camera: Fix devm_kfree() in soc_of_bind()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 8e48a2d54c5d74ea3e9dc4c3b9037786bb447f36 upstream.
+
+Unlike scan_async_group(), soc_of_bind() doesn't allocate its
+soc_camera_async_client structure using devm_kzalloc(), but has it
+embedded inside the soc_of_info structure. Hence on failure, it must
+free the whole soc_of_info structure, and not just the embedded
+soc_camera_async_client structure, as the latter causes a warning, and
+may cause slab corruption:
+
+ soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 1 at drivers/base/devres.c:887 devm_kfree+0x30/0x40()
+ CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.19.0-shmobile-08386-g37feb0d093cb2d8e #128
+ Hardware name: Generic R8A7791 (Flattened Device Tree)
+ Backtrace:
+ [<c0011e7c>] (dump_backtrace) from [<c0012024>] (show_stack+0x18/0x1c)
+ r6:c05a923b r5:00000009 r4:00000000 r3:00204140
+ [<c001200c>] (show_stack) from [<c048ed30>] (dump_stack+0x78/0x94)
+ [<c048ecb8>] (dump_stack) from [<c002687c>] (warn_slowpath_common+0x8c/0xb8)
+ r4:00000000 r3:00000000
+ [<c00267f0>] (warn_slowpath_common) from [<c0026980>] (warn_slowpath_null+0x24/0x2c)
+ r8:ee7d8214 r7:ed83b810 r6:ed83bc20 r5:fffffffa r4:ed83e510
+ [<c002695c>] (warn_slowpath_null) from [<c025e0cc>] (devm_kfree+0x30/0x40)
+ [<c025e09c>] (devm_kfree) from [<c032bbf4>] (soc_of_bind.isra.14+0x194/0x1d4)
+ [<c032ba60>] (soc_of_bind.isra.14) from [<c032c6b8>] (soc_camera_host_register+0x208/0x31c)
+ r9:00000070 r8:ee7e05d0 r7:ee153210 r6:00000000 r5:ee7e0218 r4:ed83bc20
+ [<c032c4b0>] (soc_camera_host_register) from [<c032e80c>] (rcar_vin_probe+0x1f4/0x238)
+ r8:ee153200 r7:00000008 r6:ee153210 r5:ed83bc10 r4:c066319c r3:000000c0
+ [<c032e618>] (rcar_vin_probe) from [<c025c334>] (platform_drv_probe+0x50/0xa0)
+ r10:00000000 r9:c0662fa8 r8:00000000 r7:c06a3700 r6:c0662fa8 r5:ee153210
+ r4:00000000
+ [<c025c2e4>] (platform_drv_probe) from [<c025af08>] (driver_probe_device+0xc4/0x208)
+ r6:c06a36f4 r5:00000000 r4:ee153210 r3:c025c2e4
+ [<c025ae44>] (driver_probe_device) from [<c025b108>] (__driver_attach+0x70/0x94)
+ r9:c066f9c0 r8:c0624a98 r7:c065b790 r6:c0662fa8 r5:ee153244 r4:ee153210
+ [<c025b098>] (__driver_attach) from [<c025984c>] (bus_for_each_dev+0x74/0x98)
+ r6:c025b098 r5:c0662fa8 r4:00000000 r3:00000001
+ [<c02597d8>] (bus_for_each_dev) from [<c025b1dc>] (driver_attach+0x20/0x28)
+ r6:ed83c200 r5:00000000 r4:c0662fa8
+ [<c025b1bc>] (driver_attach) from [<c025a00c>] (bus_add_driver+0xdc/0x1c4)
+ [<c0259f30>] (bus_add_driver) from [<c025b8f4>] (driver_register+0xa4/0xe8)
+ r7:c0624a98 r6:00000000 r5:c060b010 r4:c0662fa8
+ [<c025b850>] (driver_register) from [<c025ccd0>] (__platform_driver_register+0x50/0x64)
+ r5:c060b010 r4:ed8394c0
+ [<c025cc80>] (__platform_driver_register) from [<c060b028>] (rcar_vin_driver_init+0x18/0x20)
+ [<c060b010>] (rcar_vin_driver_init) from [<c05edde8>] (do_one_initcall+0x108/0x1b8)
+ [<c05edce0>] (do_one_initcall) from [<c05edfb4>] (kernel_init_freeable+0x11c/0x1e4)
+ r9:c066f9c0 r8:c066f9c0 r7:c062eab0 r6:c06252c4 r5:000000ad r4:00000006
+ [<c05ede98>] (kernel_init_freeable) from [<c048c3d0>] (kernel_init+0x10/0xec)
+ r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c048c3c0 r4:00000000
+ [<c048c3c0>] (kernel_init) from [<c000eba0>] (ret_from_fork+0x14/0x34)
+ r4:00000000 r3:ee04e000
+ ---[ end trace e3a984cc0335c8a0 ]---
+ rcar_vin e6ef1000.video: group probe failed: -6
+
+Fixes: 1ddc6a6caa94e1e1 ("[media] soc_camera: add support for dt binding soc_camera drivers")
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/soc_camera/soc_camera.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/soc_camera/soc_camera.c
++++ b/drivers/media/platform/soc_camera/soc_camera.c
+@@ -1681,7 +1681,7 @@ eclkreg:
+ eaddpdev:
+ platform_device_put(sasc->pdev);
+ eallocpdev:
+- devm_kfree(ici->v4l2_dev.dev, sasc);
++ devm_kfree(ici->v4l2_dev.dev, info);
+ dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret);
+
+ return ret;
--- /dev/null
+From 4879785ed511083676f27a016c9ad6c46c8e5737 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Fri, 13 Feb 2015 04:42:37 -0300
+Subject: [media] vb2: Fix dma_dir setting for dma-contig mem type
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit 4879785ed511083676f27a016c9ad6c46c8e5737 upstream.
+
+The last argument of vb2_dc_get_user_pages() is of type enum
+dma_data_direction, but the caller, vb2_dc_get_userptr() passes a value
+which is the result of comparison dma_dir == DMA_FROM_DEVICE. This results
+in the write parameter to get_user_pages() being zero in all cases, i.e.
+that the caller has no intent to write there.
+
+This was broken by patch "vb2: replace 'write' by 'dma_dir'".
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-dma-contig.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
++++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
+@@ -632,8 +632,7 @@ static void *vb2_dc_get_userptr(void *al
+ }
+
+ /* extract page list from userspace mapping */
+- ret = vb2_dc_get_user_pages(start, pages, n_pages, vma,
+- dma_dir == DMA_FROM_DEVICE);
++ ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, dma_dir);
+ if (ret) {
+ unsigned long pfn;
+ if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
--- /dev/null
+From 0e661006370b7e7fb9ac9d94f9c3500a62cd559b Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 16 Feb 2015 07:49:07 -0300
+Subject: [media] vb2: fix 'UNBALANCED' warnings when calling vb2_thread_stop()
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 0e661006370b7e7fb9ac9d94f9c3500a62cd559b upstream.
+
+Stopping the vb2 thread (as used by several DVB devices) can result
+in an 'UNBALANCED' warning such as this:
+
+vb2: counters for queue ffff880407ee9828: UNBALANCED!
+vb2: setup: 1 start_streaming: 1 stop_streaming: 1
+vb2: wait_prepare: 249333 wait_finish: 249334
+
+This is due to a race condition between stopping the thread and
+calling vb2_internal_streamoff(). While I have not been able to deduce
+the exact mechanism how this race condition can produce this warning,
+I can see that the way the stream is stopped is likely to lead to a
+race somewhere.
+
+This patch simplifies how this is done by first ensuring that the
+thread is completely stopped before cleaning up the vb2 queue. It
+does that by setting threadio->stop to true, followed by a call to
+vb2_queue_error() which will wake up the thread. The thread sees that
+'stop' is true and it will exit.
+
+The call to kthread_stop() waits until the thread has exited, and only
+then is the queue cleaned up by calling __vb2_cleanup_fileio().
+
+This is a much cleaner sequence and the warning has now disappeared.
+
+Reported-by: Jurgen Kramer <gtmkramer@xs4all.nl>
+Tested-by: Jurgen Kramer <gtmkramer@xs4all.nl>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -3230,18 +3230,13 @@ int vb2_thread_stop(struct vb2_queue *q)
+
+ if (threadio == NULL)
+ return 0;
+- call_void_qop(q, wait_finish, q);
+ threadio->stop = true;
+- vb2_internal_streamoff(q, q->type);
+- call_void_qop(q, wait_prepare, q);
++ /* Wake up all pending sleeps in the thread */
++ vb2_queue_error(q);
+ err = kthread_stop(threadio->thread);
+- q->fileio = NULL;
+- fileio->req.count = 0;
+- vb2_reqbufs(q, &fileio->req);
+- kfree(fileio);
++ __vb2_cleanup_fileio(q);
+ threadio->thread = NULL;
+ kfree(threadio);
+- q->fileio = NULL;
+ q->threadio = NULL;
+ return err;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
