--- /dev/null
+From e3455002d04276c256a531f7175dce0f7d1cb78a Mon Sep 17 00:00:00 2001
+From: Lee Jones <lee.jones@linaro.org>
+Date: Thu, 17 Jan 2013 14:21:53 +0000
+Subject: ab8500-chargalg: Only root should have write permission on sysfs file
+
+From: Lee Jones <lee.jones@linaro.org>
+
+commit e3455002d04276c256a531f7175dce0f7d1cb78a upstream.
+
+Only root should have write permission on sysfs file ab8500_chargalg/chargalg.
+
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/abx500_chargalg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/abx500_chargalg.c
++++ b/drivers/power/abx500_chargalg.c
+@@ -1698,7 +1698,7 @@ static ssize_t abx500_chargalg_sysfs_cha
+ static struct attribute abx500_chargalg_en_charger = \
+ {
+ .name = "chargalg",
+- .mode = S_IWUGO,
++ .mode = S_IWUSR,
+ };
+
+ static struct attribute *abx500_chargalg_chg[] = {
--- /dev/null
+From eeb0751c99522a4d1bbcc7b6bc1460cd07d07488 Mon Sep 17 00:00:00 2001
+From: "Rajanikanth H.V" <rajanikanth.hv@stericsson.com>
+Date: Wed, 23 Jan 2013 09:56:45 +0530
+Subject: ab8500_btemp: Demote initcall sequence
+
+From: "Rajanikanth H.V" <rajanikanth.hv@stericsson.com>
+
+commit eeb0751c99522a4d1bbcc7b6bc1460cd07d07488 upstream.
+
+Power supply subsystem creates thermal zone device for the property
+'POWER_SUPPLY_PROP_TEMP' which requires thermal subsystem to be ready
+before 'ab8500 battery temperature monitor' driver is initialized. ab8500
+btemp driver is initialized with subsys_initcall whereas thermal subsystem
+is initialized with fs_initcall which causes
+thermal_zone_device_register(...) to crash since the required structure
+'thermal_class' is not initialized yet:
+
+Unable to handle kernel NULL pointer dereference at virtual address 000000a4
+pgd = c0004000
+[000000a4] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+Modules linked in:
+CPU: 0 Tainted: G W (3.8.0-rc4-00001-g632fda8-dirty #1)
+PC is at _raw_spin_lock+0x18/0x54
+LR is at get_device_parent+0x50/0x1b8
+pc : [<c02f1dd0>] lr : [<c01cb248>] psr: 60000013
+sp : ef04bdc8 ip : 00000000 fp : c0446180
+r10: ef216e38 r9 : c03af5d0 r8 : ef275c18
+r7 : 00000000 r6 : c0476c14 r5 : ef275c18 r4 : ef095840
+r3 : ef04a000 r2 : 00000001 r1 : 00000000 r0 : 000000a4
+Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5787d Table: 0000404a DAC: 00000015
+Process swapper/0 (pid: 1, stack limit = 0xef04a238)
+Stack: (0xef04bdc8 to 0xef04c000)
+[...]
+[<c02f1dd0>] (_raw_spin_lock+0x18/0x54) from [<c01cb248>] (get_device_parent+0x50/0x1b8)
+[<c01cb248>] (get_device_parent+0x50/0x1b8) from [<c01cb8d8>] (device_add+0xa4/0x574)
+[<c01cb8d8>] (device_add+0xa4/0x574) from [<c020b91c>] (thermal_zone_device_register+0x118/0x938)
+[<c020b91c>] (thermal_zone_device_register+0x118/0x938) from [<c0202030>] (power_supply_register+0x170/0x1f8)
+[<c0202030>] (power_supply_register+0x170/0x1f8) from [<c02055ec>] (ab8500_btemp_probe+0x208/0x47c)
+[<c02055ec>] (ab8500_btemp_probe+0x208/0x47c) from [<c01cf0dc>] (platform_drv_probe+0x14/0x18)
+[<c01cf0dc>] (platform_drv_probe+0x14/0x18) from [<c01cde70>] (driver_probe_device+0x74/0x20c)
+[<c01cde70>] (driver_probe_device+0x74/0x20c) from [<c01ce094>] (__driver_attach+0x8c/0x90)
+[<c01ce094>] (__driver_attach+0x8c/0x90) from [<c01cc640>] (bus_for_each_dev+0x4c/0x80)
+[<c01cc640>] (bus_for_each_dev+0x4c/0x80) from [<c01cd6b4>] (bus_add_driver+0x16c/0x23c)
+[<c01cd6b4>] (bus_add_driver+0x16c/0x23c) from [<c01ce54c>] (driver_register+0x78/0x14c)
+[<c01ce54c>] (driver_register+0x78/0x14c) from [<c00086ac>] (do_one_initcall+0xfc/0x164)
+[<c00086ac>] (do_one_initcall+0xfc/0x164) from [<c02e89c8>] (kernel_init+0x120/0x2b8)
+[<c02e89c8>] (kernel_init+0x120/0x2b8) from [<c000e358>] (ret_from_fork+0x14/0x3c)
+Code: e3c3303f e5932004 e2822001 e5832004 (e1903f9f)
+---[ end trace ed9df72941b5bada ]---
+
+Signed-off-by: Rajanikanth H.V <rajanikanth.hv@stericsson.com>
+Signed-off-by: Anton Vorontsov <anton@enomsg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/ab8500_btemp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/ab8500_btemp.c
++++ b/drivers/power/ab8500_btemp.c
+@@ -1123,7 +1123,7 @@ static void __exit ab8500_btemp_exit(voi
+ platform_driver_unregister(&ab8500_btemp_driver);
+ }
+
+-subsys_initcall_sync(ab8500_btemp_init);
++device_initcall(ab8500_btemp_init);
+ module_exit(ab8500_btemp_exit);
+
+ MODULE_LICENSE("GPL v2");
--- /dev/null
+From 66f2fda93b67fa744d406e6dcf443f67bac204b6 Mon Sep 17 00:00:00 2001
+From: Joseph Salisbury <joseph.salisbury@canonical.com>
+Date: Tue, 5 Feb 2013 00:16:29 +0000
+Subject: ACPI: Add DMI entry for Sony VGN-FW41E_H
+
+From: Joseph Salisbury <joseph.salisbury@canonical.com>
+
+commit 66f2fda93b67fa744d406e6dcf443f67bac204b6 upstream.
+
+This patch adds a quirk to allow the Sony VGN-FW41E_H to suspend/resume
+properly.
+
+References: http://bugs.launchpad.net/bugs/1113547
+Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sleep.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -177,6 +177,14 @@ static struct dmi_system_id __initdata a
+ },
+ {
+ .callback = init_nvs_nosave,
++ .ident = "Sony Vaio VGN-FW41E_H",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW41E_H"),
++ },
++ },
++ {
++ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VGN-FW21E",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
--- /dev/null
+From bde83b9a6b44c1e0fd872e57ecc869cfcf88538f Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sun, 2 Dec 2012 20:34:21 +1100
+Subject: bq27x00_battery: Fix bugs introduced with BQ27425 support
+
+From: NeilBrown <neilb@suse.de>
+
+commit bde83b9a6b44c1e0fd872e57ecc869cfcf88538f upstream.
+
+commit a66f59ba2e994bf70274ef0513e24e0e7ae20c63
+
+ bq27x00_battery: Add support for BQ27425 chip
+
+introduced 2 bugs.
+
+1/ 'chip' was set to BQ27425 unconditionally - breaking support for
+ other devices;
+
+2/ BQ27425 does not support cycle count, how the code still tries to
+ get the cycle count for BQ27425, and now does it twice for other chips.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Cc: Saranya Gopal <saranya.gopal@intel.com>
+Signed-off-by: Anton Vorontsov <anton@enomsg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/bq27x00_battery.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/power/bq27x00_battery.c
++++ b/drivers/power/bq27x00_battery.c
+@@ -448,7 +448,6 @@ static void bq27x00_update(struct bq27x0
+ cache.temperature = bq27x00_battery_read_temperature(di);
+ if (!is_bq27425)
+ cache.cycle_count = bq27x00_battery_read_cyct(di);
+- cache.cycle_count = bq27x00_battery_read_cyct(di);
+ cache.power_avg =
+ bq27x00_battery_read_pwr_avg(di, BQ27x00_POWER_AVG);
+
+@@ -696,7 +695,6 @@ static int bq27x00_powersupply_init(stru
+ int ret;
+
+ di->bat.type = POWER_SUPPLY_TYPE_BATTERY;
+- di->chip = BQ27425;
+ if (di->chip == BQ27425) {
+ di->bat.properties = bq27425_battery_props;
+ di->bat.num_properties = ARRAY_SIZE(bq27425_battery_props);
--- /dev/null
+From 71b5707e119653039e6e95213f00479668c79b75 Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizefan@huawei.com>
+Date: Thu, 24 Jan 2013 14:43:28 +0800
+Subject: cgroup: fix exit() vs rmdir() race
+
+From: Li Zefan <lizefan@huawei.com>
+
+commit 71b5707e119653039e6e95213f00479668c79b75 upstream.
+
+In cgroup_exit() put_css_set_taskexit() is called without any lock,
+which might lead to accessing a freed cgroup:
+
+thread1 thread2
+---------------------------------------------
+exit()
+ cgroup_exit()
+ put_css_set_taskexit()
+ atomic_dec(cgrp->count);
+ rmdir();
+ /* not safe !! */
+ check_for_release(cgrp);
+
+rcu_read_lock() can be used to make sure the cgroup is alive.
+
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cgroup.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -426,12 +426,20 @@ static void __put_css_set(struct css_set
+ struct cgroup *cgrp = link->cgrp;
+ list_del(&link->cg_link_list);
+ list_del(&link->cgrp_link_list);
++
++ /*
++ * We may not be holding cgroup_mutex, and if cgrp->count is
++ * dropped to 0 the cgroup can be destroyed at any time, hence
++ * rcu_read_lock is used to keep it alive.
++ */
++ rcu_read_lock();
+ if (atomic_dec_and_test(&cgrp->count) &&
+ notify_on_release(cgrp)) {
+ if (taskexit)
+ set_bit(CGRP_RELEASABLE, &cgrp->flags);
+ check_for_release(cgrp);
+ }
++ rcu_read_unlock();
+
+ kfree(link);
+ }
--- /dev/null
+From 63f43f55c9bbc14f76b582644019b8a07dc8219a Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizefan@huawei.com>
+Date: Fri, 25 Jan 2013 16:08:01 +0800
+Subject: cpuset: fix cpuset_print_task_mems_allowed() vs rename() race
+
+From: Li Zefan <lizefan@huawei.com>
+
+commit 63f43f55c9bbc14f76b582644019b8a07dc8219a upstream.
+
+rename() will change dentry->d_name. The result of this race can
+be worse than seeing partially rewritten name, but we might access
+a stale pointer because rename() will re-allocate memory to hold
+a longer name.
+
+It's safe in the protection of dentry->d_lock.
+
+v2: check NULL dentry before acquiring dentry lock.
+
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cpuset.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -2511,8 +2511,16 @@ void cpuset_print_task_mems_allowed(stru
+
+ dentry = task_cs(tsk)->css.cgroup->dentry;
+ spin_lock(&cpuset_buffer_lock);
+- snprintf(cpuset_name, CPUSET_NAME_LEN,
+- dentry ? (const char *)dentry->d_name.name : "/");
++
++ if (!dentry) {
++ strcpy(cpuset_name, "/");
++ } else {
++ spin_lock(&dentry->d_lock);
++ strlcpy(cpuset_name, (const char *)dentry->d_name.name,
++ CPUSET_NAME_LEN);
++ spin_unlock(&dentry->d_lock);
++ }
++
+ nodelist_scnprintf(cpuset_nodelist, CPUSET_NODELIST_LEN,
+ tsk->mems_allowed);
+ printk(KERN_INFO "%s cpuset=%s mems_allowed=%s\n",
--- /dev/null
+From 9f244e9cfd70c7c0f82d3c92ce772ab2a92d9f64 Mon Sep 17 00:00:00 2001
+From: Seiji Aguchi <seiji.aguchi@hds.com>
+Date: Fri, 11 Jan 2013 18:09:41 +0000
+Subject: pstore: Avoid deadlock in panic and emergency-restart path
+
+From: Seiji Aguchi <seiji.aguchi@hds.com>
+
+commit 9f244e9cfd70c7c0f82d3c92ce772ab2a92d9f64 upstream.
+
+[Issue]
+
+When pstore is in panic and emergency-restart paths, it may be blocked
+in those paths because it simply takes spin_lock.
+
+This is an example scenario which pstore may hang up in a panic path:
+
+ - cpuA grabs psinfo->buf_lock
+ - cpuB panics and calls smp_send_stop
+ - smp_send_stop sends IRQ to cpuA
+ - after 1 second, cpuB gives up on cpuA and sends an NMI instead
+ - cpuA is now in an NMI handler while still holding buf_lock
+ - cpuB is deadlocked
+
+This case may happen if a firmware has a bug and
+cpuA is stuck talking with it more than one second.
+
+Also, this is a similar scenario in an emergency-restart path:
+
+ - cpuA grabs psinfo->buf_lock and stucks in a firmware
+ - cpuB kicks emergency-restart via either sysrq-b or hangcheck timer.
+ And then, cpuB is deadlocked by taking psinfo->buf_lock again.
+
+[Solution]
+
+This patch avoids the deadlocking issues in both panic and emergency_restart
+paths by introducing a function, is_non_blocking_path(), to check if a cpu
+can be blocked in current path.
+
+With this patch, pstore is not blocked even if another cpu has
+taken a spin_lock, in those paths by changing from spin_lock_irqsave
+to spin_trylock_irqsave.
+
+In addition, according to a comment of emergency_restart() in kernel/sys.c,
+spin_lock shouldn't be taken in an emergency_restart path to avoid
+deadlock. This patch fits the comment below.
+
+<snip>
+/**
+ * emergency_restart - reboot the system
+ *
+ * Without shutting down any hardware or taking any locks
+ * reboot the system. This is called when we know we are in
+ * trouble so this is our best effort to reboot. This is
+ * safe to call in interrupt context.
+ */
+void emergency_restart(void)
+<snip>
+
+Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
+Acked-by: Don Zickus <dzickus@redhat.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Cc: CAI Qian <caiqian@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/pstore/platform.c | 35 +++++++++++++++++++++++++++++------
+ include/linux/pstore.h | 6 ++++++
+ 2 files changed, 35 insertions(+), 6 deletions(-)
+
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -96,6 +96,27 @@ static const char *get_reason_str(enum k
+ }
+ }
+
++bool pstore_cannot_block_path(enum kmsg_dump_reason reason)
++{
++ /*
++ * In case of NMI path, pstore shouldn't be blocked
++ * regardless of reason.
++ */
++ if (in_nmi())
++ return true;
++
++ switch (reason) {
++ /* In panic case, other cpus are stopped by smp_send_stop(). */
++ case KMSG_DUMP_PANIC:
++ /* Emergency restart shouldn't be blocked by spin lock. */
++ case KMSG_DUMP_EMERG:
++ return true;
++ default:
++ return false;
++ }
++}
++EXPORT_SYMBOL_GPL(pstore_cannot_block_path);
++
+ /*
+ * callback from kmsg_dump. (s2,l2) has the most recently
+ * written bytes, older bytes are in (s1,l1). Save as much
+@@ -114,10 +135,12 @@ static void pstore_dump(struct kmsg_dump
+
+ why = get_reason_str(reason);
+
+- if (in_nmi()) {
+- is_locked = spin_trylock(&psinfo->buf_lock);
+- if (!is_locked)
+- pr_err("pstore dump routine blocked in NMI, may corrupt error record\n");
++ if (pstore_cannot_block_path(reason)) {
++ is_locked = spin_trylock_irqsave(&psinfo->buf_lock, flags);
++ if (!is_locked) {
++ pr_err("pstore dump routine blocked in %s path, may corrupt error record\n"
++ , in_nmi() ? "NMI" : why);
++ }
+ } else
+ spin_lock_irqsave(&psinfo->buf_lock, flags);
+ oopscount++;
+@@ -143,9 +166,9 @@ static void pstore_dump(struct kmsg_dump
+ total += hsize + len;
+ part++;
+ }
+- if (in_nmi()) {
++ if (pstore_cannot_block_path(reason)) {
+ if (is_locked)
+- spin_unlock(&psinfo->buf_lock);
++ spin_unlock_irqrestore(&psinfo->buf_lock, flags);
+ } else
+ spin_unlock_irqrestore(&psinfo->buf_lock, flags);
+ }
+--- a/include/linux/pstore.h
++++ b/include/linux/pstore.h
+@@ -68,12 +68,18 @@ struct pstore_info {
+
+ #ifdef CONFIG_PSTORE
+ extern int pstore_register(struct pstore_info *);
++extern bool pstore_cannot_block_path(enum kmsg_dump_reason reason);
+ #else
+ static inline int
+ pstore_register(struct pstore_info *psi)
+ {
+ return -ENODEV;
+ }
++static inline bool
++pstore_cannot_block_path(enum kmsg_dump_reason reason)
++{
++ return false;
++}
+ #endif
+
+ #endif /*_LINUX_PSTORE_H*/
hid-clean-up-quirk-for-sony-rf-receivers.patch
fuse-don-t-warn-when-nlink-is-zero.patch
workqueue-consider-work-function-when-searching-for-busy-work-items.patch
+pstore-avoid-deadlock-in-panic-and-emergency-restart-path.patch
+cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch
+cgroup-fix-exit-vs-rmdir-race.patch
+bq27x00_battery-fix-bugs-introduced-with-bq27425-support.patch
+ab8500-chargalg-only-root-should-have-write-permission-on-sysfs-file.patch
+ab8500_btemp-demote-initcall-sequence.patch
+acpi-add-dmi-entry-for-sony-vgn-fw41e_h.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
