From: Greg Kroah-Hartman Date: Fri, 25 May 2012 06:03:07 +0000 (+0900) Subject: 3.3-stable patches X-Git-Tag: v3.0.33~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=141bf128abc45b33e735b76e4fb6fdd7b336d346;p=thirdparty%2Fkernel%2Fstable-queue.git 3.3-stable patches added patches: gpio-mpc8xxx-prevent-null-pointer-deref-in-demux-handler.patch nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch spi-spi-fsl-spi-reference-correct-pdata-in.patch xen-do-not-map-the-same-gsi-twice-in-pvhvm-guests.patch --- diff --git a/queue-3.3/gpio-mpc8xxx-prevent-null-pointer-deref-in-demux-handler.patch b/queue-3.3/gpio-mpc8xxx-prevent-null-pointer-deref-in-demux-handler.patch new file mode 100644 index 00000000000..a4977617ca2 --- /dev/null +++ b/queue-3.3/gpio-mpc8xxx-prevent-null-pointer-deref-in-demux-handler.patch @@ -0,0 +1,42 @@ +From d6de85e85edcc38c9edcde45a0a568818fcddc13 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Thu, 3 May 2012 12:22:06 +0200 +Subject: gpio: mpc8xxx: Prevent NULL pointer deref in demux handler + +From: Thomas Gleixner + +commit d6de85e85edcc38c9edcde45a0a568818fcddc13 upstream. + +commit cfadd838(powerpc/8xxx: Fix interrupt handling in MPC8xxx GPIO +driver) added an unconditional call of chip->irq_eoi() to the demux +handler. + +This leads to a NULL pointer derefernce on MPC512x platforms which use +this driver as well. + +Make it conditional. + +Reported-by: Thomas Wucher +Signed-off-by: Thomas Gleixner +Cc: Felix Radensky +Cc: Kumar Gala +Cc: Grant Likely +Signed-off-by: Grant Likely +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-mpc8xxx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -163,7 +163,8 @@ static void mpc8xxx_gpio_irq_cascade(uns + if (mask) + generic_handle_irq(irq_linear_revmap(mpc8xxx_gc->irq, + 32 - ffs(mask))); +- chip->irq_eoi(&desc->irq_data); ++ if (chip->irq_eoi) ++ chip->irq_eoi(&desc->irq_data); + } + + static void mpc8xxx_irq_unmask(struct irq_data *d) diff --git a/queue-3.3/nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch b/queue-3.3/nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch new file mode 100644 index 00000000000..448a5ffded5 --- /dev/null +++ b/queue-3.3/nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch @@ -0,0 +1,30 @@ +From c284815debba2f14ee2fd07b1b4cc972ab116110 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Fri, 18 May 2012 15:31:12 +0100 +Subject: nouveau: nouveau_set_bo_placement takes TTM flags + +From: Dave Airlie + +commit c284815debba2f14ee2fd07b1b4cc972ab116110 upstream. + +This seems to be wrong to me, spotted while thinking about dma-buf. + +Reviewed-by: Ben Skeggs +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_bo.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c +@@ -1035,7 +1035,7 @@ nouveau_ttm_fault_reserve_notify(struct + + nvbo->placement.fpfn = 0; + nvbo->placement.lpfn = dev_priv->fb_mappable_pages; +- nouveau_bo_placement_set(nvbo, TTM_PL_VRAM, 0); ++ nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_VRAM, 0); + return nouveau_bo_validate(nvbo, false, true, false); + } + diff --git a/queue-3.3/series b/queue-3.3/series index 8d588c3dc32..17c001a8872 100644 --- a/queue-3.3/series +++ b/queue-3.3/series @@ -67,3 +67,7 @@ b43legacy-fix-error-due-to-mmio-access-with-ssb-unpowered.patch drm-i915-avoid-a-double-read-of-pch_iir-during-interrupt-handling.patch drm-i915-use-hw-scheduler-for-fixed-function-shaders.patch drm-i915-don-t-clobber-the-pipe-param-in-sanitize_modesetting.patch +gpio-mpc8xxx-prevent-null-pointer-deref-in-demux-handler.patch +spi-spi-fsl-spi-reference-correct-pdata-in.patch +xen-do-not-map-the-same-gsi-twice-in-pvhvm-guests.patch +nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch diff --git a/queue-3.3/spi-spi-fsl-spi-reference-correct-pdata-in.patch b/queue-3.3/spi-spi-fsl-spi-reference-correct-pdata-in.patch new file mode 100644 index 00000000000..753e345748b --- /dev/null +++ b/queue-3.3/spi-spi-fsl-spi-reference-correct-pdata-in.patch @@ -0,0 +1,40 @@ +From 067aa4815a9bc12a569d8a06afef50ba5773afbf Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski +Date: Fri, 11 May 2012 15:29:50 -0700 +Subject: spi/spi-fsl-spi: reference correct pdata in + fsl_spi_cs_control + +From: Herton Ronaldo Krzesinski + +commit 067aa4815a9bc12a569d8a06afef50ba5773afbf upstream. + +Commit 178db7d3, "spi: Fix device unregistration when unregistering +the bus master", changed spi device initialization of dev.parent pointer +to be the master's device pointer instead of his parent. + +This introduced a bug in spi-fsl-spi, since its usage of spi device +pointer was not updated accordingly. This was later fixed by commit +5039a86, "spi/mpc83xx: fix NULL pdata dereference bug", but it missed +another spot on fsl_spi_cs_control function where we also need to update +usage of spi device pointer. This change address that. + +Signed-off-by: Herton Ronaldo Krzesinski +Acked-by: Joakim Tjernlund +Signed-off-by: Grant Likely +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-fsl-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -931,7 +931,7 @@ err: + + static void fsl_spi_cs_control(struct spi_device *spi, bool on) + { +- struct device *dev = spi->dev.parent; ++ struct device *dev = spi->dev.parent->parent; + struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(dev->platform_data); + u16 cs = spi->chip_select; + int gpio = pinfo->gpios[cs]; diff --git a/queue-3.3/xen-do-not-map-the-same-gsi-twice-in-pvhvm-guests.patch b/queue-3.3/xen-do-not-map-the-same-gsi-twice-in-pvhvm-guests.patch new file mode 100644 index 00000000000..ab643065f1e --- /dev/null +++ b/queue-3.3/xen-do-not-map-the-same-gsi-twice-in-pvhvm-guests.patch @@ -0,0 +1,84 @@ +From 68c2c39a76b094e9b2773e5846424ea674bf2c46 Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Mon, 21 May 2012 16:54:10 +0100 +Subject: xen: do not map the same GSI twice in PVHVM guests. + +From: Stefano Stabellini + +commit 68c2c39a76b094e9b2773e5846424ea674bf2c46 upstream. + +PV on HVM guests map GSIs into event channels. At restore time the +event channels are resumed by restore_pirqs. + +Device drivers might try to register the same GSI again through ACPI at +restore time, but the GSI has already been mapped and bound by +restore_pirqs. This patch detects these situations and avoids + mapping the same GSI multiple times. + +Without this patch we get: +(XEN) irq.c:2235: dom4: pirq 23 or emuirq 28 already mapped +and waste a pirq. + +Signed-off-by: Stefano Stabellini +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/pci/xen.c | 4 ++++ + drivers/xen/events.c | 5 +++-- + include/xen/events.h | 3 +++ + 3 files changed, 10 insertions(+), 2 deletions(-) + +--- a/arch/x86/pci/xen.c ++++ b/arch/x86/pci/xen.c +@@ -64,6 +64,10 @@ static int xen_register_pirq(u32 gsi, in + int shareable = 0; + char *name; + ++ irq = xen_irq_from_gsi(gsi); ++ if (irq > 0) ++ return irq; ++ + if (set_pirq) + pirq = gsi; + +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -604,7 +604,7 @@ static void disable_pirq(struct irq_data + disable_dynirq(data); + } + +-static int find_irq_by_gsi(unsigned gsi) ++int xen_irq_from_gsi(unsigned gsi) + { + struct irq_info *info; + +@@ -618,6 +618,7 @@ static int find_irq_by_gsi(unsigned gsi) + + return -1; + } ++EXPORT_SYMBOL_GPL(xen_irq_from_gsi); + + /* + * Do not make any assumptions regarding the relationship between the +@@ -637,7 +638,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gs + + mutex_lock(&irq_mapping_update_lock); + +- irq = find_irq_by_gsi(gsi); ++ irq = xen_irq_from_gsi(gsi); + if (irq != -1) { + printk(KERN_INFO "xen_map_pirq_gsi: returning irq %d for gsi %u\n", + irq, gsi); +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -103,6 +103,9 @@ int xen_irq_from_pirq(unsigned pirq); + /* Return the pirq allocated to the irq. */ + int xen_pirq_from_irq(unsigned irq); + ++/* Return the irq allocated to the gsi */ ++int xen_irq_from_gsi(unsigned gsi); ++ + /* Determine whether to ignore this IRQ if it is passed to a guest. */ + int xen_test_irq_shared(int irq); +