--- /dev/null
+From d6de85e85edcc38c9edcde45a0a568818fcddc13 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 3 May 2012 12:22:06 +0200
+Subject: gpio: mpc8xxx: Prevent NULL pointer deref in demux handler
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit d6de85e85edcc38c9edcde45a0a568818fcddc13 upstream.
+
+commit cfadd838(powerpc/8xxx: Fix interrupt handling in MPC8xxx GPIO
+driver) added an unconditional call of chip->irq_eoi() to the demux
+handler.
+
+This leads to a NULL pointer derefernce on MPC512x platforms which use
+this driver as well.
+
+Make it conditional.
+
+Reported-by: Thomas Wucher <thwucher@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Felix Radensky <felix@embedded-sol.com>
+Cc: Kumar Gala <galak@kernel.crashing.org>
+Cc: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-mpc8xxx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -163,7 +163,8 @@ static void mpc8xxx_gpio_irq_cascade(uns
+ if (mask)
+ generic_handle_irq(irq_linear_revmap(mpc8xxx_gc->irq,
+ 32 - ffs(mask)));
+- chip->irq_eoi(&desc->irq_data);
++ if (chip->irq_eoi)
++ chip->irq_eoi(&desc->irq_data);
+ }
+
+ static void mpc8xxx_irq_unmask(struct irq_data *d)
--- /dev/null
+From 201a52bea928687b7557728b176ac4f8a37d5cbd Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 15 May 2012 11:47:47 +0300
+Subject: hvc_xen: NULL dereference on allocation failure
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 201a52bea928687b7557728b176ac4f8a37d5cbd upstream.
+
+If kzalloc() returns a NULL here, we pass a NULL to
+xencons_disconnect_backend() which will cause an Oops.
+
+Also I removed the __GFP_ZERO while I was at it since kzalloc() implies
+__GFP_ZERO.
+
+Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/hvc/hvc_xen.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -430,9 +430,9 @@ static int __devinit xencons_probe(struc
+ if (devid == 0)
+ return -ENODEV;
+
+- info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL | __GFP_ZERO);
++ info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
+ if (!info)
+- goto error_nomem;
++ return -ENOMEM;
+ dev_set_drvdata(&dev->dev, info);
+ info->xbdev = dev;
+ info->vtermno = xenbus_devid_to_vtermno(devid);
--- /dev/null
+From c284815debba2f14ee2fd07b1b4cc972ab116110 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Fri, 18 May 2012 15:31:12 +0100
+Subject: nouveau: nouveau_set_bo_placement takes TTM flags
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit c284815debba2f14ee2fd07b1b4cc972ab116110 upstream.
+
+This seems to be wrong to me, spotted while thinking about dma-buf.
+
+Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -1030,7 +1030,7 @@ nouveau_ttm_fault_reserve_notify(struct
+
+ nvbo->placement.fpfn = 0;
+ nvbo->placement.lpfn = dev_priv->fb_mappable_pages;
+- nouveau_bo_placement_set(nvbo, TTM_PL_VRAM, 0);
++ nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_VRAM, 0);
+ return nouveau_bo_validate(nvbo, false, true, false);
+ }
+
drm-i915-avoid-a-double-read-of-pch_iir-during-interrupt-handling.patch
drm-i915-use-hw-scheduler-for-fixed-function-shaders.patch
drm-i915-don-t-clobber-the-pipe-param-in-sanitize_modesetting.patch
+gpio-mpc8xxx-prevent-null-pointer-deref-in-demux-handler.patch
+spi-spi-fsl-spi-reference-correct-pdata-in.patch
+hvc_xen-null-dereference-on-allocation-failure.patch
+xen-do-not-map-the-same-gsi-twice-in-pvhvm-guests.patch
+nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch
--- /dev/null
+From 067aa4815a9bc12a569d8a06afef50ba5773afbf Mon Sep 17 00:00:00 2001
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Date: Fri, 11 May 2012 15:29:50 -0700
+Subject: spi/spi-fsl-spi: reference correct pdata in
+ fsl_spi_cs_control
+
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+
+commit 067aa4815a9bc12a569d8a06afef50ba5773afbf upstream.
+
+Commit 178db7d3, "spi: Fix device unregistration when unregistering
+the bus master", changed spi device initialization of dev.parent pointer
+to be the master's device pointer instead of his parent.
+
+This introduced a bug in spi-fsl-spi, since its usage of spi device
+pointer was not updated accordingly. This was later fixed by commit
+5039a86, "spi/mpc83xx: fix NULL pdata dereference bug", but it missed
+another spot on fsl_spi_cs_control function where we also need to update
+usage of spi device pointer. This change address that.
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-fsl-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -933,7 +933,7 @@ err:
+
+ static void fsl_spi_cs_control(struct spi_device *spi, bool on)
+ {
+- struct device *dev = spi->dev.parent;
++ struct device *dev = spi->dev.parent->parent;
+ struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(dev->platform_data);
+ u16 cs = spi->chip_select;
+ int gpio = pinfo->gpios[cs];
--- /dev/null
+From 68c2c39a76b094e9b2773e5846424ea674bf2c46 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Date: Mon, 21 May 2012 16:54:10 +0100
+Subject: xen: do not map the same GSI twice in PVHVM guests.
+
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+
+commit 68c2c39a76b094e9b2773e5846424ea674bf2c46 upstream.
+
+PV on HVM guests map GSIs into event channels. At restore time the
+event channels are resumed by restore_pirqs.
+
+Device drivers might try to register the same GSI again through ACPI at
+restore time, but the GSI has already been mapped and bound by
+restore_pirqs. This patch detects these situations and avoids
+ mapping the same GSI multiple times.
+
+Without this patch we get:
+(XEN) irq.c:2235: dom4: pirq 23 or emuirq 28 already mapped
+and waste a pirq.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/pci/xen.c | 4 ++++
+ drivers/xen/events.c | 5 +++--
+ include/xen/events.h | 3 +++
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -64,6 +64,10 @@ static int xen_register_pirq(u32 gsi, in
+ int shareable = 0;
+ char *name;
+
++ irq = xen_irq_from_gsi(gsi);
++ if (irq > 0)
++ return irq;
++
+ if (set_pirq)
+ pirq = gsi;
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -611,7 +611,7 @@ static void disable_pirq(struct irq_data
+ disable_dynirq(data);
+ }
+
+-static int find_irq_by_gsi(unsigned gsi)
++int xen_irq_from_gsi(unsigned gsi)
+ {
+ struct irq_info *info;
+
+@@ -625,6 +625,7 @@ static int find_irq_by_gsi(unsigned gsi)
+
+ return -1;
+ }
++EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+
+ /*
+ * Do not make any assumptions regarding the relationship between the
+@@ -644,7 +645,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gs
+
+ mutex_lock(&irq_mapping_update_lock);
+
+- irq = find_irq_by_gsi(gsi);
++ irq = xen_irq_from_gsi(gsi);
+ if (irq != -1) {
+ printk(KERN_INFO "xen_map_pirq_gsi: returning irq %d for gsi %u\n",
+ irq, gsi);
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -103,6 +103,9 @@ int xen_irq_from_pirq(unsigned pirq);
+ /* Return the pirq allocated to the irq. */
+ int xen_pirq_from_irq(unsigned irq);
+
++/* Return the irq allocated to the gsi */
++int xen_irq_from_gsi(unsigned gsi);
++
+ /* Determine whether to ignore this IRQ if it is passed to a guest. */
+ int xen_test_irq_shared(int irq);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
