--- /dev/null
+From 52bba9809a954d72bc77773bd560b9724b495eb7 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Mon, 19 Jan 2015 09:57:13 +0000
+Subject: clk: Fix debugfs clk removal before inited
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 52bba9809a954d72bc77773bd560b9724b495eb7 upstream.
+
+Some of the clks can be registered & unregistered before the clk related debugfs
+entries are initialized at late_initcall. In the unregister path checking for only
+dentry before clk_debug_init() would lead dangling pointers in the debug clk list,
+because the list is already populated in register path and the clk pointer freed in
+unregister path.
+The side effect of not removing it from the list is either a null pointer
+dereference or if lucky to boot the system, the number of clk entries in
+debugfs disappear.
+
+We could add more checks like if (inited && !clk->dentry) but just removing
+the check for dentry made more sense as debugfs_remove_recursive() seems to be
+safe with null pointers. This will ensure that the unregistering clk would be
+removed from the debug list in all the code paths.
+
+Without this patch kernel would crash with log:
+Unable to handle kernel NULL pointer dereference at virtual address 00000000
+pgd = c0204000
+[00000000] *pgd=00000000
+Internal error: Oops: 5 [#1] SMP ARM
+Modules linked in:
+CPU: 1 PID: 1 Comm: swapper/0 Tainted: G B 3.19.0-rc3-00007-g412f9ba-dirty #840
+Hardware name: Qualcomm (Flattened Device Tree)
+task: ed948000 ti: ed944000 task.ti: ed944000
+PC is at strlen+0xc/0x40
+LR is at __create_file+0x64/0x1dc
+pc : [<c04ee604>] lr : [<c049f1c4>] psr: 60000013
+sp : ed945e40 ip : ed945e50 fp : ed945e4c
+r10: 00000000 r9 : c1006094 r8 : 00000000
+r7 : 000041ed r6 : 00000000 r5 : ed4af998 r4 : c11b5e28
+r3 : 00000000 r2 : ed945e38 r1 : a0000013 r0 : 00000000
+Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5787d Table: 8020406a DAC: 00000015
+Process swapper/0 (pid: 1, stack limit = 0xed944248)
+Stack: (0xed945e40 to 0xed946000)
+5e40: ed945e7c ed945e50 c049f1c4 c04ee604 c0fc2fa4 00000000 ecb748c0 c11c2b80
+5e60: c0beec04 0000011c c0fc2fa4 00000000 ed945e94 ed945e80 c049f3e0 c049f16c
+5e80: 00000000 00000000 ed945eac ed945e98 c08cbc50 c049f3c0 ecb748c0 c11c2b80
+5ea0: ed945ed4 ed945eb0 c0fc3080 c08cbc30 c0beec04 c107e1d8 ecdf0600 c107e1d8
+5ec0: c107e1d8 ecdf0600 ed945f54 ed945ed8 c0208ed4 c0fc2fb0 c026a784 c04ee628
+5ee0: ed945f0c ed945ef0 c0f5d600 c04ee604 c0f5d5ec ef7fcc7d c0b40ecc 0000011c
+5f00: ed945f54 ed945f10 c026a994 c0f5d5f8 c04ecc00 00000007 ef7fcc95 00000007
+5f20: c0e90744 c0dd0884 ed945f54 c106cde0 00000007 c117f8c0 0000011c c0f5d5ec
+5f40: c1006094 c100609c ed945f94 ed945f58 c0f5de34 c0208e50 00000007 00000007
+5f60: c0f5d5ec be9b5ae0 00000000 c117f8c0 c0af1680 00000000 00000000 00000000
+5f80: 00000000 00000000 ed945fac ed945f98 c0af169c c0f5dd2c ed944000 00000000
+5fa0: 00000000 ed945fb0 c020f298 c0af168c 00000000 00000000 00000000 00000000
+5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 ebcc6d33 bfffca73
+[<c04ee604>] (strlen) from [<c049f1c4>] (__create_file+0x64/0x1dc)
+[<c049f1c4>] (__create_file) from [<c049f3e0>] (debugfs_create_dir+0x2c/0x34)
+[<c049f3e0>] (debugfs_create_dir) from [<c08cbc50>] (clk_debug_create_one+0x2c/0x16c)
+[<c08cbc50>] (clk_debug_create_one) from [<c0fc3080>] (clk_debug_init+0xdc/0x144)
+[<c0fc3080>] (clk_debug_init) from [<c0208ed4>] (do_one_initcall+0x90/0x1e0)
+[<c0208ed4>] (do_one_initcall) from [<c0f5de34>] (kernel_init_freeable+0x114/0x1e0)
+[<c0f5de34>] (kernel_init_freeable) from [<c0af169c>] (kernel_init+0x1c/0xfc)
+[<c0af169c>] (kernel_init) from [<c020f298>] (ret_from_fork+0x14/0x3c)
+Code: c0b40ecc e1a0c00d e92dd800 e24cb004 (e5d02000)
+---[ end trace b940e45b5e25c1e7 ]---
+
+Fixes: 6314b6796e3c "clk: Don't hold prepare_lock across debugfs creation"
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Michael Turquette <mturquette@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -343,13 +343,9 @@ unlock:
+ static void clk_debug_unregister(struct clk *clk)
+ {
+ mutex_lock(&clk_debug_lock);
+- if (!clk->dentry)
+- goto out;
+-
+ hlist_del_init(&clk->debug_node);
+ debugfs_remove_recursive(clk->dentry);
+ clk->dentry = NULL;
+-out:
+ mutex_unlock(&clk_debug_lock);
+ }
+
--- /dev/null
+From 3dccfecdb867fe35b305a4e493ef5652b7d9d4cb Mon Sep 17 00:00:00 2001
+From: Soren Brinkmann <soren.brinkmann@xilinx.com>
+Date: Tue, 27 Jan 2015 11:05:27 -0800
+Subject: clk: zynq: Force CPU_2X clock to be ungated
+
+From: Soren Brinkmann <soren.brinkmann@xilinx.com>
+
+commit 3dccfecdb867fe35b305a4e493ef5652b7d9d4cb upstream.
+
+The CPU_2X clock does not have a classical in-kernel user, but is,
+amongst other things, required for OCM and debug access. Make sure this
+clock is not mistakenly disabled during boot up by enabling it in the
+platform's clock driver.
+
+Fixes: 0ee52b157b8e 'clk: zynq: Add clock controller driver'
+Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
+Signed-off-by: Michael Turquette <mturquette@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/zynq/clkc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/zynq/clkc.c
++++ b/drivers/clk/zynq/clkc.c
+@@ -303,6 +303,7 @@ static void __init zynq_clk_setup(struct
+ clks[cpu_2x] = clk_register_gate(NULL, clk_output_name[cpu_2x],
+ "cpu_2x_div", CLK_IGNORE_UNUSED, SLCR_ARM_CLK_CTRL,
+ 26, 0, &armclk_lock);
++ clk_prepare_enable(clks[cpu_2x]);
+
+ clk = clk_register_fixed_factor(NULL, "cpu_1x_div", "cpu_div", 0, 1,
+ 4 + 2 * tmp);
--- /dev/null
+From f76a610a8b4b6280eaedf48f3af9d5d74e418b66 Mon Sep 17 00:00:00 2001
+From: Minh Duc Tran <MinhDuc.Tran@Emulex.Com>
+Date: Mon, 9 Feb 2015 18:54:09 +0000
+Subject: fixed invalid assignment of 64bit mask to host dma_boundary for scatter gather segment boundary limit.
+
+From: Minh Duc Tran <MinhDuc.Tran@Emulex.Com>
+
+commit f76a610a8b4b6280eaedf48f3af9d5d74e418b66 upstream.
+
+In reference to bug https://bugzilla.redhat.com/show_bug.cgi?id=1097141
+Assert is seen with AMD cpu whenever calling pci_alloc_consistent.
+
+[ 29.406183] ------------[ cut here ]------------
+[ 29.410505] kernel BUG at lib/iommu-helper.c:13!
+
+Signed-off-by: Minh Tran <minh.tran@emulex.com>
+Fixes: 6733b39a1301b0b020bbcbf3295852e93e624cb1
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/be2iscsi/be_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -586,7 +586,6 @@ static struct beiscsi_hba *beiscsi_hba_a
+ "beiscsi_hba_alloc - iscsi_host_alloc failed\n");
+ return NULL;
+ }
+- shost->dma_boundary = pcidev->dma_mask;
+ shost->max_id = BE2_MAX_SESSIONS;
+ shost->max_channel = 0;
+ shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
ib-core-properly-handle-registration-of-on-demand-paging-mrs-after-dereg.patch
ib-core-when-marshaling-ucma-path-from-user-space-clear-unused-fields.patch
nilfs2-fix-potential-memory-overrun-on-inode.patch
+wd719x-add-missing-.module-to-wd719x_template.patch
+fixed-invalid-assignment-of-64bit-mask-to-host-dma_boundary-for-scatter-gather-segment-boundary-limit.patch
+clk-zynq-force-cpu_2x-clock-to-be-ungated.patch
+clk-fix-debugfs-clk-removal-before-inited.patch
+sunxi-clk-set-sun6i-pll1-n_start-1.patch
+staging-comedi-comedi_compat32.c-fix-comedi_cmd-copy-back.patch
--- /dev/null
+From 42b8ce6f55facfa101462e694d33fc6bca471138 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Tue, 27 Jan 2015 18:16:51 +0000
+Subject: staging: comedi: comedi_compat32.c: fix COMEDI_CMD copy back
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 42b8ce6f55facfa101462e694d33fc6bca471138 upstream.
+
+`do_cmd_ioctl()` in "comedi_fops.c" handles the `COMEDI_CMD` ioctl.
+This returns `-EAGAIN` if it has copied a modified `struct comedi_cmd`
+back to user-space. (This occurs when the low-level Comedi driver's
+`do_cmdtest()` handler returns non-zero to indicate a problem with the
+contents of the `struct comedi_cmd`, or when the `struct comedi_cmd` has
+the `CMDF_BOGUS` flag set.)
+
+`compat_cmd()` in "comedi_compat32.c" handles the 32-bit compatible
+version of the `COMEDI_CMD` ioctl. Currently, it never copies a 32-bit
+compatible version of `struct comedi_cmd` back to user-space, which is
+at odds with the way the regular `COMEDI_CMD` ioctl is handled. To fix
+it, change `compat_cmd()` to copy a 32-bit compatible version of the
+`struct comedi_cmd` back to user-space when the main ioctl handler
+returns `-EAGAIN`.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_compat32.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/comedi_compat32.c
++++ b/drivers/staging/comedi/comedi_compat32.c
+@@ -262,7 +262,7 @@ static int compat_cmd(struct file *file,
+ {
+ struct comedi_cmd __user *cmd;
+ struct comedi32_cmd_struct __user *cmd32;
+- int rc;
++ int rc, err;
+
+ cmd32 = compat_ptr(arg);
+ cmd = compat_alloc_user_space(sizeof(*cmd));
+@@ -271,7 +271,15 @@ static int compat_cmd(struct file *file,
+ if (rc)
+ return rc;
+
+- return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
++ rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
++ if (rc == -EAGAIN) {
++ /* Special case: copy cmd back to user. */
++ err = put_compat_cmd(cmd32, cmd);
++ if (err)
++ rc = err;
++ }
++
++ return rc;
+ }
+
+ /* Handle 32-bit COMEDI_CMDTEST ioctl. */
--- /dev/null
+From 76820fcf7aa5a418b69cb7bed31b62d1feb1d6ad Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 24 Jan 2015 12:56:32 +0100
+Subject: sunxi: clk: Set sun6i-pll1 n_start = 1
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 76820fcf7aa5a418b69cb7bed31b62d1feb1d6ad upstream.
+
+For all pll-s on sun6i n == 0 means use a multiplier of 1, rather then 0 as
+it means on sun4i / sun5i / sun7i. n_start = 1 is already correctly set
+for sun6i pll6, but was missing for pll1, this commit fixes this.
+
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/sunxi/clk-sunxi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -413,6 +413,7 @@ static struct clk_factors_config sun6i_a
+ .kwidth = 2,
+ .mshift = 0,
+ .mwidth = 2,
++ .n_start = 1,
+ };
+
+ static struct clk_factors_config sun8i_a23_pll1_config = {
--- /dev/null
+From 2ecf8e0ae28cb22d434e628c351c6193fd75fafa Mon Sep 17 00:00:00 2001
+From: Ondrej Zary <linux@rainbow-software.org>
+Date: Mon, 9 Feb 2015 13:38:21 +0100
+Subject: wd719x: add missing .module to wd719x_template
+
+From: Ondrej Zary <linux@rainbow-software.org>
+
+commit 2ecf8e0ae28cb22d434e628c351c6193fd75fafa upstream.
+
+wd719x_template is missing the .module field, causing module refcount
+not to work, allowing to rmmod the driver while in use (mounted filesystem),
+causing an oops.
+
+Set .module to THIS_MODULE to fix the problem.
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/wd719x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/wd719x.c
++++ b/drivers/scsi/wd719x.c
+@@ -870,6 +870,7 @@ fail_free_params:
+ }
+
+ static struct scsi_host_template wd719x_template = {
++ .module = THIS_MODULE,
+ .name = "Western Digital 719x",
+ .queuecommand = wd719x_queuecommand,
+ .eh_abort_handler = wd719x_abort,
projects / thirdparty / kernel / stable-queue.git / commitdiff
