From: Greg Kroah-Hartman Date: Wed, 10 Oct 2012 07:39:37 +0000 (+0900) Subject: 3.0-stable patches X-Git-Tag: v3.0.46~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0979f5c4568dff7f857bad456a6ba25cf521b4cf;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: convert-properly-utf-8-to-utf-16.patch mtd-autcpu12-nvram-fix-compile-breakage.patch mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch mtd-nand-use-the-mirror-bbt-descriptor-when-reading-its-version.patch mtd-omap2-fix-module-loading.patch mtd-omap2-fix-omap_nand_remove-segfault.patch --- diff --git a/queue-3.0/convert-properly-utf-8-to-utf-16.patch b/queue-3.0/convert-properly-utf-8-to-utf-16.patch new file mode 100644 index 00000000000..fde707a1069 --- /dev/null +++ b/queue-3.0/convert-properly-utf-8-to-utf-16.patch @@ -0,0 +1,61 @@ +From fd3ba42c76d3d4b776120c2b24c1791e7bb3deb1 Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Tue, 7 Aug 2012 04:33:03 -0500 +Subject: Convert properly UTF-8 to UTF-16 + +From: Frediano Ziglio + +commit fd3ba42c76d3d4b776120c2b24c1791e7bb3deb1 upstream. + +wchar_t is currently 16bit so converting a utf8 encoded characters not +in plane 0 (>= 0x10000) to wchar_t (that is calling char2uni) lead to a +-EINVAL return. This patch detect utf8 in cifs_strtoUTF16 and add special +code calling utf8s_to_utf16s. + +Signed-off-by: Frediano Ziglio +Acked-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifs_unicode.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -203,6 +203,27 @@ cifs_strtoUCS(__le16 *to, const char *fr + int i; + wchar_t wchar_to; /* needed to quiet sparse */ + ++ /* special case for utf8 to handle no plane0 chars */ ++ if (!strcmp(codepage->charset, "utf8")) { ++ /* ++ * convert utf8 -> utf16, we assume we have enough space ++ * as caller should have assumed conversion does not overflow ++ * in destination len is length in wchar_t units (16bits) ++ */ ++ i = utf8s_to_utf16s(from, len, UTF16_LITTLE_ENDIAN, ++ (wchar_t *) to, len); ++ ++ /* if success terminate and exit */ ++ if (i >= 0) ++ goto success; ++ /* ++ * if fails fall back to UCS encoding as this ++ * function should not return negative values ++ * currently can fail only if source contains ++ * invalid encoded characters ++ */ ++ } ++ + for (i = 0; len && *from; i++, from += charlen, len -= charlen) { + charlen = codepage->char2uni(from, len, &wchar_to); + if (charlen < 1) { +@@ -215,6 +236,7 @@ cifs_strtoUCS(__le16 *to, const char *fr + put_unaligned_le16(wchar_to, &to[i]); + } + ++success: + put_unaligned_le16(0, &to[i]); + return i; + } diff --git a/queue-3.0/mtd-autcpu12-nvram-fix-compile-breakage.patch b/queue-3.0/mtd-autcpu12-nvram-fix-compile-breakage.patch new file mode 100644 index 00000000000..73c4bff4f48 --- /dev/null +++ b/queue-3.0/mtd-autcpu12-nvram-fix-compile-breakage.patch @@ -0,0 +1,73 @@ +From d1f55c680e5d021e7066f4461dd678d42af18898 Mon Sep 17 00:00:00 2001 +From: Alexander Shiyan +Date: Wed, 15 Aug 2012 20:28:05 +0400 +Subject: mtd: autcpu12-nvram: Fix compile breakage + +From: Alexander Shiyan + +commit d1f55c680e5d021e7066f4461dd678d42af18898 upstream. + +Update driver autcpu12-nvram.c so it compiles; map_read32/map_write32 +no longer exist in the kernel so the driver is totally broken. +Additionally, map_info name passed to simple_map_init is incorrect. + +Signed-off-by: Alexander Shiyan +Acked-by: Arnd Bergmann +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/maps/autcpu12-nvram.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/mtd/maps/autcpu12-nvram.c ++++ b/drivers/mtd/maps/autcpu12-nvram.c +@@ -43,7 +43,8 @@ struct map_info autcpu12_sram_map = { + + static int __init init_autcpu12_sram (void) + { +- int err, save0, save1; ++ map_word tmp, save0, save1; ++ int err; + + autcpu12_sram_map.virt = ioremap(0x12000000, SZ_128K); + if (!autcpu12_sram_map.virt) { +@@ -51,7 +52,7 @@ static int __init init_autcpu12_sram (vo + err = -EIO; + goto out; + } +- simple_map_init(&autcpu_sram_map); ++ simple_map_init(&autcpu12_sram_map); + + /* + * Check for 32K/128K +@@ -61,20 +62,22 @@ static int __init init_autcpu12_sram (vo + * Read and check result on ofs 0x0 + * Restore contents + */ +- save0 = map_read32(&autcpu12_sram_map,0); +- save1 = map_read32(&autcpu12_sram_map,0x10000); +- map_write32(&autcpu12_sram_map,~save0,0x10000); ++ save0 = map_read(&autcpu12_sram_map, 0); ++ save1 = map_read(&autcpu12_sram_map, 0x10000); ++ tmp.x[0] = ~save0.x[0]; ++ map_write(&autcpu12_sram_map, tmp, 0x10000); + /* if we find this pattern on 0x0, we have 32K size + * restore contents and exit + */ +- if ( map_read32(&autcpu12_sram_map,0) != save0) { +- map_write32(&autcpu12_sram_map,save0,0x0); ++ tmp = map_read(&autcpu12_sram_map, 0); ++ if (!map_word_equal(&autcpu12_sram_map, tmp, save0)) { ++ map_write(&autcpu12_sram_map, save0, 0x0); + goto map; + } + /* We have a 128K found, restore 0x10000 and set size + * to 128K + */ +- map_write32(&autcpu12_sram_map,save1,0x10000); ++ map_write(&autcpu12_sram_map, save1, 0x10000); + autcpu12_sram_map.size = SZ_128K; + + map: diff --git a/queue-3.0/mtd-nand-use-the-mirror-bbt-descriptor-when-reading-its-version.patch b/queue-3.0/mtd-nand-use-the-mirror-bbt-descriptor-when-reading-its-version.patch new file mode 100644 index 00000000000..37b66d80d28 --- /dev/null +++ b/queue-3.0/mtd-nand-use-the-mirror-bbt-descriptor-when-reading-its-version.patch @@ -0,0 +1,36 @@ +From 7bb9c75436212813b38700c34df4bbb6eb82debe Mon Sep 17 00:00:00 2001 +From: Shmulik Ladkani +Date: Sun, 10 Jun 2012 13:58:12 +0300 +Subject: mtd: nand: Use the mirror BBT descriptor when reading its version + +From: Shmulik Ladkani + +commit 7bb9c75436212813b38700c34df4bbb6eb82debe upstream. + +The code responsible for reading the version of the mirror bbt was +incorrectly using the descriptor of the main bbt. + +Pass the mirror bbt descriptor to 'scan_read_raw' when reading the +version of the mirror bbt. + +Signed-off-by: Shmulik Ladkani +Acked-by: Sebastian Andrzej Siewior +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_bbt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/nand_bbt.c ++++ b/drivers/mtd/nand/nand_bbt.c +@@ -429,7 +429,7 @@ static int read_abs_bbts(struct mtd_info + /* Read the mirror version, if available */ + if (md && (md->options & NAND_BBT_VERSION)) { + scan_read_raw(mtd, buf, (loff_t)md->pages[0] << this->page_shift, +- mtd->writesize, td); ++ mtd->writesize, md); + md->version[0] = buf[bbt_get_ver_offs(mtd, md)]; + printk(KERN_DEBUG "Bad block table at page %d, version 0x%02X\n", + md->pages[0], md->version[0]); diff --git a/queue-3.0/mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch b/queue-3.0/mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch new file mode 100644 index 00000000000..7c5e312d008 --- /dev/null +++ b/queue-3.0/mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch @@ -0,0 +1,34 @@ +From bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Wed, 12 Sep 2012 14:26:26 +0200 +Subject: mtd: nandsim: bugfix: fail if overridesize is too big + +From: Richard Genoud + +commit bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 upstream. + +If override size is too big, the module was actually loaded instead of +failing, because retval was not set. + +This lead to memory corruption with the use of the freed structs nandsim +and nand_chip. + +Signed-off-by: Richard Genoud +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nandsim.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mtd/nand/nandsim.c ++++ b/drivers/mtd/nand/nandsim.c +@@ -2355,6 +2355,7 @@ static int __init ns_init_module(void) + uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize; + if (new_size >> overridesize != nsmtd->erasesize) { + NS_ERR("overridesize is too big\n"); ++ retval = -EINVAL; + goto err_exit; + } + /* N.B. This relies on nand_scan not doing anything with the size before we change it */ diff --git a/queue-3.0/mtd-omap2-fix-module-loading.patch b/queue-3.0/mtd-omap2-fix-module-loading.patch new file mode 100644 index 00000000000..eb799a252d6 --- /dev/null +++ b/queue-3.0/mtd-omap2-fix-module-loading.patch @@ -0,0 +1,43 @@ +From 4d3d688da8e7016f15483e9319b41311e1db9515 Mon Sep 17 00:00:00 2001 +From: Andreas Bießmann +Date: Fri, 31 Aug 2012 13:35:42 +0200 +Subject: mtd: omap2: fix module loading + +From: Andreas Bießmann + +commit 4d3d688da8e7016f15483e9319b41311e1db9515 upstream. + +Unloading the omap2 nand driver missed to release the memory region which will +result in not being able to request it again if one want to load the driver +later on. + +This patch fixes following error when loading omap2 module after unloading: +---8<--- +~ $ rmmod omap2 +~ $ modprobe omap2 +[ 37.420928] omap2-nand: probe of omap2-nand.0 failed with error -16 +~ $ +--->8--- + +This error was introduced in 67ce04bf2746f8a1f8c2a104b313d20c63f68378 which +was the first commit of this driver. + +Signed-off-by: Andreas Bießmann +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/omap2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -1139,6 +1139,7 @@ static int omap_nand_remove(struct platf + /* Release NAND device, its internal structures and partitions */ + nand_release(&info->mtd); + iounmap(info->nand.IO_ADDR_R); ++ release_mem_region(info->phys_base, NAND_IO_SIZE); + kfree(info); + return 0; + } diff --git a/queue-3.0/mtd-omap2-fix-omap_nand_remove-segfault.patch b/queue-3.0/mtd-omap2-fix-omap_nand_remove-segfault.patch new file mode 100644 index 00000000000..c09087ee409 --- /dev/null +++ b/queue-3.0/mtd-omap2-fix-omap_nand_remove-segfault.patch @@ -0,0 +1,95 @@ +From 7d9b110269253b1d5858cfa57d68dfc7bf50dd77 Mon Sep 17 00:00:00 2001 +From: Andreas Bießmann +Date: Fri, 31 Aug 2012 13:35:41 +0200 +Subject: mtd: omap2: fix omap_nand_remove segfault + +From: Andreas Bießmann + +commit 7d9b110269253b1d5858cfa57d68dfc7bf50dd77 upstream. + +Do not kfree() the mtd_info; it is handled in the mtd subsystem and +already freed by nand_release(). Instead kfree() the struct +omap_nand_info allocated in omap_nand_probe which was not freed before. + +This patch fixes following error when unloading the omap2 module: + +---8<--- +~ $ rmmod omap2 +------------[ cut here ]------------ +kernel BUG at mm/slab.c:3126! +Internal error: Oops - BUG: 0 [#1] PREEMPT ARM +Modules linked in: omap2(-) +CPU: 0 Not tainted (3.6.0-rc3-00230-g155e36d-dirty #3) +PC is at cache_free_debugcheck+0x2d4/0x36c +LR is at kfree+0xc8/0x2ac +pc : [] lr : [] psr: 200d0193 +sp : c521fe08 ip : c0e8ef90 fp : c521fe5c +r10: bf0001fc r9 : c521e000 r8 : c0d99c8c +r7 : c661ebc0 r6 : c065d5a4 r5 : c65c4060 r4 : c78005c0 +r3 : 00000000 r2 : 00001000 r1 : c65c4000 r0 : 00000001 +Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +Control: 10c5387d Table: 86694019 DAC: 00000015 +Process rmmod (pid: 549, stack limit = 0xc521e2f0) +Stack: (0xc521fe08 to 0xc5220000) +fe00: c008a874 c00bf44c c515c6d0 200d0193 c65c4860 c515c240 +fe20: c521fe3c c521fe30 c008a9c0 c008a854 c521fe5c c65c4860 c78005c0 bf0001fc +fe40: c780ff40 a00d0113 c521e000 00000000 c521fe84 c521fe60 c0112efc c01122d8 +fe60: c65c4860 c0673778 c06737ac 00000000 00070013 00000000 c521fe9c c521fe88 +fe80: bf0001fc c0112e40 c0673778 bf001ca8 c521feac c521fea0 c02ca11c bf0001ac +fea0: c521fec4 c521feb0 c02c82c4 c02ca100 c0673778 bf001ca8 c521fee4 c521fec8 +fec0: c02c8dd8 c02c8250 00000000 bf001ca8 bf001ca8 c0804ee0 c521ff04 c521fee8 +fee0: c02c804c c02c8d20 bf001924 00000000 bf001ca8 c521e000 c521ff1c c521ff08 +ff00: c02c950c c02c7fbc bf001d48 00000000 c521ff2c c521ff20 c02ca3a4 c02c94b8 +ff20: c521ff3c c521ff30 bf001938 c02ca394 c521ffa4 c521ff40 c009beb4 bf001930 +ff40: c521ff6c 70616d6f b6fe0032 c0014f84 70616d6f b6fe0032 00000081 60070010 +ff60: c521ff84 c521ff70 c008e1f4 c00bf328 0001a004 70616d6f c521ff94 0021ff88 +ff80: c008e368 0001a004 70616d6f b6fe0032 00000081 c0015028 00000000 c521ffa8 +ffa0: c0014dc0 c009bcd0 0001a004 70616d6f bec2ab38 00000880 bec2ab38 00000880 +ffc0: 0001a004 70616d6f b6fe0032 00000081 00000319 00000000 b6fe1000 00000000 +ffe0: bec2ab30 bec2ab20 00019f00 b6f539c0 60070010 bec2ab38 aaaaaaaa aaaaaaaa +Backtrace: +[] (cache_free_debugcheck+0x0/0x36c) from [] (kfree+0xc8/0x2ac) +[] (kfree+0x0/0x2ac) from [] (omap_nand_remove+0x5c/0x64 [omap2]) +[] (omap_nand_remove+0x0/0x64 [omap2]) from [] (platform_drv_remove+0x28/0x2c) + r5:bf001ca8 r4:c0673778 +[] (platform_drv_remove+0x0/0x2c) from [] (__device_release_driver+0x80/0xdc) +[] (__device_release_driver+0x0/0xdc) from [] (driver_detach+0xc4/0xc8) + r5:bf001ca8 r4:c0673778 +[] (driver_detach+0x0/0xc8) from [] (bus_remove_driver+0x9c/0x104) + r6:c0804ee0 r5:bf001ca8 r4:bf001ca8 r3:00000000 +[] (bus_remove_driver+0x0/0x104) from [] (driver_unregister+0x60/0x80) + r6:c521e000 r5:bf001ca8 r4:00000000 r3:bf001924 +[] (driver_unregister+0x0/0x80) from [] (platform_driver_unregister+0x1c/0x20) + r5:00000000 r4:bf001d48 +[] (platform_driver_unregister+0x0/0x20) from [] (omap_nand_driver_exit+0x14/0x1c [omap2]) +[] (omap_nand_driver_exit+0x0/0x1c [omap2]) from [] (sys_delete_module+0x1f0/0x2ec) +[] (sys_delete_module+0x0/0x2ec) from [] (ret_fast_syscall+0x0/0x48) + r8:c0015028 r7:00000081 r6:b6fe0032 r5:70616d6f r4:0001a004 +Code: e1a00005 eb0d9172 e7f001f2 e7f001f2 (e7f001f2) +---[ end trace 6a30b24d8c0cc2ee ]--- +Segmentation fault +--->8--- + +This error was introduced in 67ce04bf2746f8a1f8c2a104b313d20c63f68378 which +was the first commit of this driver. + +Signed-off-by: Andreas Bießmann +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/omap2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -1139,7 +1139,7 @@ static int omap_nand_remove(struct platf + /* Release NAND device, its internal structures and partitions */ + nand_release(&info->mtd); + iounmap(info->nand.IO_ADDR_R); +- kfree(&info->mtd); ++ kfree(info); + return 0; + } + diff --git a/queue-3.0/series b/queue-3.0/series index 7b1574980fb..a3f8341af68 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -77,3 +77,9 @@ mempolicy-fix-a-race-in-shared_policy_replace.patch mempolicy-fix-refcount-leak-in-mpol_set_shared_policy.patch mempolicy-fix-a-memory-corruption-by-refcount-imbalance-in-alloc_pages_vma.patch cpu-hotplug-cpusets-suspend-don-t-modify-cpusets-during-suspend-resume.patch +mtd-autcpu12-nvram-fix-compile-breakage.patch +mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch +mtd-nand-use-the-mirror-bbt-descriptor-when-reading-its-version.patch +mtd-omap2-fix-omap_nand_remove-segfault.patch +mtd-omap2-fix-module-loading.patch +convert-properly-utf-8-to-utf-16.patch