4.0-stable patches

added patches:
	acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch
	coredump-accept-any-write-method.patch
	sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch

diff --git a/queue-4.0/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch b/queue-4.0/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch
new file mode 100644 (file)
index 0000000..093fd29
--- /dev/null
+++ b/queue-4.0/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch
@@ -0,0 +1,86 @@
+From f254e3c57b9d952e987502aefa0804c177dd2503 Mon Sep 17 00:00:00 2001
+From: Lv Zheng <lv.zheng@intel.com>
+Date: Mon, 13 Apr 2015 11:48:18 +0800
+Subject: ACPICA: Tables: Change acpi_find_root_pointer() to use acpi_physical_address.
+
+From: Lv Zheng <lv.zheng@intel.com>
+
+commit f254e3c57b9d952e987502aefa0804c177dd2503 upstream.
+
+ACPICA commit 7d9fd64397d7c38899d3dc497525f6e6b044e0e3
+
+OSPMs like Linux expect an acpi_physical_address returning value from
+acpi_find_root_pointer(). This triggers warnings if sizeof (acpi_size) doesn't
+equal to sizeof (acpi_physical_address):
+  drivers/acpi/osl.c:275:3: warning: passing argument 1 of 'acpi_find_root_pointer' from incompatible pointer type [enabled by default]
+  In file included from include/acpi/acpi.h:64:0,
+                   from include/linux/acpi.h:36,
+                   from drivers/acpi/osl.c:41:
+  include/acpi/acpixf.h:433:1: note: expected 'acpi_size *' but argument is of type 'acpi_physical_address *'
+This patch corrects acpi_find_root_pointer().
+
+Link: https://github.com/acpica/acpica/commit/7d9fd643
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Dirk Behme <dirk.behme@gmail.com>
+Signed-off-by: George G. Davis <george_davis@mentor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/tbxfroot.c |    7 ++++---
+ include/acpi/acpixf.h          |   12 ++++++------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -142,7 +142,7 @@ acpi_status acpi_tb_validate_rsdp(struct
+  *
+  ******************************************************************************/
+ 
+-acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
++acpi_status __init acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+       u8 *table_ptr;
+       u8 *mem_rover;
+@@ -200,7 +200,8 @@ acpi_status __init acpi_find_root_pointe
+                       physical_address +=
+                           (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+ 
+-                      *table_address = physical_address;
++                      *table_address =
++                          (acpi_physical_address) physical_address;
+                       return_ACPI_STATUS(AE_OK);
+               }
+       }
+@@ -233,7 +234,7 @@ acpi_status __init acpi_find_root_pointe
+                   (ACPI_HI_RSDP_WINDOW_BASE +
+                    ACPI_PTR_DIFF(mem_rover, table_ptr));
+ 
+-              *table_address = physical_address;
++              *table_address = (acpi_physical_address) physical_address;
+               return_ACPI_STATUS(AE_OK);
+       }
+ 
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -431,13 +431,13 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init acpi_reallocate_root_table(void))
+ 
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init
+-                          acpi_find_root_pointer(acpi_size * rsdp_address))
+-
++                          acpi_find_root_pointer(acpi_physical_address *
++                                                 rsdp_address))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+-                          acpi_get_table_header(acpi_string signature,
+-                                                u32 instance,
+-                                                struct acpi_table_header
+-                                                *out_table_header))
++                           acpi_get_table_header(acpi_string signature,
++                                                 u32 instance,
++                                                 struct acpi_table_header
++                                                 *out_table_header))
+ ACPI_EXTERNAL_RETURN_STATUS(acpi_status
+                            acpi_get_table(acpi_string signature, u32 instance,
+                                           struct acpi_table_header

diff --git a/queue-4.0/coredump-accept-any-write-method.patch b/queue-4.0/coredump-accept-any-write-method.patch
new file mode 100644 (file)
index 0000000..ebc0f2f
--- /dev/null
+++ b/queue-4.0/coredump-accept-any-write-method.patch
@@ -0,0 +1,27 @@
+From 86cc05840a0da1afcb6b8151b53f3b606457c91b Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 3 Apr 2015 15:23:17 -0400
+Subject: coredump: accept any write method
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 86cc05840a0da1afcb6b8151b53f3b606457c91b upstream.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/coredump.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -657,7 +657,7 @@ void do_coredump(const siginfo_t *siginf
+                */
+               if (!uid_eq(inode->i_uid, current_fsuid()))
+                       goto close_fail;
+-              if (!cprm.file->f_op->write)
++              if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
+                       goto close_fail;
+               if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
+                       goto close_fail;

diff --git a/queue-4.0/series b/queue-4.0/series
index 002edea5a27257cf9ad4db074cdbb6649a4df1f3..bec10957fabb13c3ceb1761fe228b50b9a6118b7 100644 (file)
--- a/queue-4.0/series
+++ b/queue-4.0/series
@@ -52,3 +52,6 @@ mmc-card-don-t-access-rpmb-partitions-for-normal-read-write.patch
 mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch
 mmc-sh_mmcif-fix-timeout-value-for-command-request.patch
 arm-8307-1-psci-move-psci-firmware-calls-out-of-line.patch
+sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch
+coredump-accept-any-write-method.patch
+acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch

diff --git a/queue-4.0/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch b/queue-4.0/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch
new file mode 100644 (file)
index 0000000..7e3daad
--- /dev/null
+++ b/queue-4.0/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch
@@ -0,0 +1,83 @@
+From bc26d4d06e337ade069f33d3f4377593b24e6e36 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sat, 18 Apr 2015 02:53:25 +0300
+Subject: sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+commit bc26d4d06e337ade069f33d3f4377593b24e6e36 upstream.
+
+A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
+on /dev/sequencer with TMR_ECHO midi event.
+
+In this case the control flow is:
+sound_ioctl()
+-> case SND_DEV_SEQ:
+   case SND_DEV_SEQ2:
+     sequencer_ioctl()
+     -> case SNDCTL_SEQ_OUTOFBAND:
+          spin_lock_irqsave(&lock,flags);
+          play_event();
+          -> case EV_TIMING:
+               seq_timing_event()
+               -> case TMR_ECHO:
+                    seq_copy_to_input()
+                    -> spin_lock_irqsave(&lock,flags);
+
+It seems that spin_lock_irqsave() around play_event() is not necessary,
+because the only other call location in seq_startplay() makes the call
+without acquiring spinlock.
+
+So, the patch just removes spinlocks around play_event().
+By the way, it removes unreachable code in seq_timing_event(),
+since (seq_mode == SEQ_2) case is handled in the beginning.
+
+Compile tested only.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/oss/sequencer.c |   12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/sound/oss/sequencer.c
++++ b/sound/oss/sequencer.c
+@@ -681,13 +681,8 @@ static int seq_timing_event(unsigned cha
+                       break;
+ 
+               case TMR_ECHO:
+-                      if (seq_mode == SEQ_2)
+-                              seq_copy_to_input(event_rec, 8);
+-                      else
+-                      {
+-                              parm = (parm << 8 | SEQ_ECHO);
+-                              seq_copy_to_input((unsigned char *) &parm, 4);
+-                      }
++                      parm = (parm << 8 | SEQ_ECHO);
++                      seq_copy_to_input((unsigned char *) &parm, 4);
+                       break;
+ 
+               default:;
+@@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file
+       int mode = translate_mode(file);
+       struct synth_info inf;
+       struct seq_event_rec event_rec;
+-      unsigned long flags;
+       int __user *p = arg;
+ 
+       orig_dev = dev = dev >> 4;
+@@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file
+               case SNDCTL_SEQ_OUTOFBAND:
+                       if (copy_from_user(&event_rec, arg, sizeof(event_rec)))
+                               return -EFAULT;
+-                      spin_lock_irqsave(&lock,flags);
+                       play_event(event_rec.arr);
+-                      spin_unlock_irqrestore(&lock,flags);
+                       return 0;
+ 
+               case SNDCTL_MIDI_INFO: