From: Greg Kroah-Hartman Date: Wed, 2 Oct 2013 16:02:45 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.0.99~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2cb6518bb03955314c7f706c4b7c1578dd27d4d8;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: mei-bus-stop-wait-for-read-during-cl-state-transition.patch mei-cancel-stall-timers-in-mei_reset.patch mei-make-me-client-counters-less-error-prone.patch serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch serial-tegra-fix-tty-kref-leak.patch tty-fix-sigttou-not-sent-with-tcflush.patch --- diff --git a/queue-3.10/mei-bus-stop-wait-for-read-during-cl-state-transition.patch b/queue-3.10/mei-bus-stop-wait-for-read-during-cl-state-transition.patch new file mode 100644 index 00000000000..c323903dd5c --- /dev/null +++ b/queue-3.10/mei-bus-stop-wait-for-read-during-cl-state-transition.patch @@ -0,0 +1,84 @@ +From e2b31644e999e8bfe3efce880fb32840299abf41 Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Mon, 2 Sep 2013 13:29:46 +0300 +Subject: mei: bus: stop wait for read during cl state transition + +From: Tomas Winkler + +commit e2b31644e999e8bfe3efce880fb32840299abf41 upstream. + +Bus layer omitted check for client state transition while waiting +for read completion +The client state transition may occur for example as result +of firmware initiated reset + +Add mei_cl_is_transitioning wrapper to reduce the code +repetition.: + +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/bus.c | 5 ++++- + drivers/misc/mei/client.h | 6 ++++++ + drivers/misc/mei/main.c | 11 ++++------- + 3 files changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -295,10 +295,13 @@ int __mei_cl_recv(struct mei_cl *cl, u8 + + if (cl->reading_state != MEI_READ_COMPLETE && + !waitqueue_active(&cl->rx_wait)) { ++ + mutex_unlock(&dev->device_lock); + + if (wait_event_interruptible(cl->rx_wait, +- (MEI_READ_COMPLETE == cl->reading_state))) { ++ cl->reading_state == MEI_READ_COMPLETE || ++ mei_cl_is_transitioning(cl))) { ++ + if (signal_pending(current)) + return -EINTR; + return -ERESTARTSYS; +--- a/drivers/misc/mei/client.h ++++ b/drivers/misc/mei/client.h +@@ -76,6 +76,12 @@ static inline bool mei_cl_cmp_id(const s + (cl1->host_client_id == cl2->host_client_id) && + (cl1->me_client_id == cl2->me_client_id); + } ++static inline bool mei_cl_is_transitioning(struct mei_cl *cl) ++{ ++ return (MEI_FILE_INITIALIZING == cl->state || ++ MEI_FILE_DISCONNECTED == cl->state || ++ MEI_FILE_DISCONNECTING == cl->state); ++} + + + int mei_cl_flow_ctrl_creds(struct mei_cl *cl); +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -262,19 +262,16 @@ static ssize_t mei_read(struct file *fil + mutex_unlock(&dev->device_lock); + + if (wait_event_interruptible(cl->rx_wait, +- (MEI_READ_COMPLETE == cl->reading_state || +- MEI_FILE_INITIALIZING == cl->state || +- MEI_FILE_DISCONNECTED == cl->state || +- MEI_FILE_DISCONNECTING == cl->state))) { ++ MEI_READ_COMPLETE == cl->reading_state || ++ mei_cl_is_transitioning(cl))) { ++ + if (signal_pending(current)) + return -EINTR; + return -ERESTARTSYS; + } + + mutex_lock(&dev->device_lock); +- if (MEI_FILE_INITIALIZING == cl->state || +- MEI_FILE_DISCONNECTED == cl->state || +- MEI_FILE_DISCONNECTING == cl->state) { ++ if (mei_cl_is_transitioning(cl)) { + rets = -EBUSY; + goto out; + } diff --git a/queue-3.10/mei-cancel-stall-timers-in-mei_reset.patch b/queue-3.10/mei-cancel-stall-timers-in-mei_reset.patch new file mode 100644 index 00000000000..b92ef9bcb87 --- /dev/null +++ b/queue-3.10/mei-cancel-stall-timers-in-mei_reset.patch @@ -0,0 +1,44 @@ +From 4a704575cc1afb3b848f096778fa9b8d7b3d5813 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Mon, 2 Sep 2013 13:29:47 +0300 +Subject: mei: cancel stall timers in mei_reset + +From: Alexander Usyskin + +commit 4a704575cc1afb3b848f096778fa9b8d7b3d5813 upstream. + +Unset init_clients_timer and amthif_stall_timers +in mei_reset in order to cancel timer ticking and hence +avoid recursive reset calls. + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/amthif.c | 1 + + drivers/misc/mei/init.c | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/drivers/misc/mei/amthif.c ++++ b/drivers/misc/mei/amthif.c +@@ -57,6 +57,7 @@ void mei_amthif_reset_params(struct mei_ + dev->iamthif_ioctl = false; + dev->iamthif_state = MEI_IAMTHIF_IDLE; + dev->iamthif_timer = 0; ++ dev->iamthif_stall_timer = 0; + } + + /** +--- a/drivers/misc/mei/init.c ++++ b/drivers/misc/mei/init.c +@@ -164,6 +164,9 @@ void mei_reset(struct mei_device *dev, i + memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg)); + } + ++ /* we're already in reset, cancel the init timer */ ++ dev->init_clients_timer = 0; ++ + dev->me_clients_num = 0; + dev->rd_msg_hdr = 0; + dev->wd_pending = false; diff --git a/queue-3.10/mei-make-me-client-counters-less-error-prone.patch b/queue-3.10/mei-make-me-client-counters-less-error-prone.patch new file mode 100644 index 00000000000..785728d33c1 --- /dev/null +++ b/queue-3.10/mei-make-me-client-counters-less-error-prone.patch @@ -0,0 +1,76 @@ +From 1aee351a739153529fbb98ee461777b2abd5e1c9 Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Mon, 2 Sep 2013 13:29:45 +0300 +Subject: mei: make me client counters less error prone + +From: Tomas Winkler + +commit 1aee351a739153529fbb98ee461777b2abd5e1c9 upstream. + +1. u8 counters are prone to hard to detect overflow: + make them unsigned long to match bit_ functions argument type + +2. don't check me_clients_num for negativity, it is unsigned. + +3. init all the me client counters from one place + +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hbm.c | 10 ++++++---- + drivers/misc/mei/mei_dev.h | 6 +++--- + 2 files changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/misc/mei/hbm.c ++++ b/drivers/misc/mei/hbm.c +@@ -35,11 +35,15 @@ static void mei_hbm_me_cl_allocate(struc + struct mei_me_client *clients; + int b; + ++ dev->me_clients_num = 0; ++ dev->me_client_presentation_num = 0; ++ dev->me_client_index = 0; ++ + /* count how many ME clients we have */ + for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX) + dev->me_clients_num++; + +- if (dev->me_clients_num <= 0) ++ if (dev->me_clients_num == 0) + return; + + kfree(dev->me_clients); +@@ -221,7 +225,7 @@ static int mei_hbm_prop_req(struct mei_d + struct hbm_props_request *prop_req; + const size_t len = sizeof(struct hbm_props_request); + unsigned long next_client_index; +- u8 client_num; ++ unsigned long client_num; + + + client_num = dev->me_client_presentation_num; +@@ -650,8 +654,6 @@ void mei_hbm_dispatch(struct mei_device + if (dev->dev_state == MEI_DEV_INIT_CLIENTS && + dev->hbm_state == MEI_HBM_ENUM_CLIENTS) { + dev->init_clients_timer = 0; +- dev->me_client_presentation_num = 0; +- dev->me_client_index = 0; + mei_hbm_me_cl_allocate(dev); + dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES; + +--- a/drivers/misc/mei/mei_dev.h ++++ b/drivers/misc/mei/mei_dev.h +@@ -402,9 +402,9 @@ struct mei_device { + struct mei_me_client *me_clients; /* Note: memory has to be allocated */ + DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX); + DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX); +- u8 me_clients_num; +- u8 me_client_presentation_num; +- u8 me_client_index; ++ unsigned long me_clients_num; ++ unsigned long me_client_presentation_num; ++ unsigned long me_client_index; + + struct mei_cl wd_cl; + enum mei_wd_states wd_state; diff --git a/queue-3.10/serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch b/queue-3.10/serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch new file mode 100644 index 00000000000..98894baaf3c --- /dev/null +++ b/queue-3.10/serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch @@ -0,0 +1,38 @@ +From 19b85cfb190eb9980eaf416bff96aef4159a430e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Sep 2013 12:50:50 +0200 +Subject: serial: pch_uart: fix tty-kref leak in dma-rx path + +From: Johan Hovold + +commit 19b85cfb190eb9980eaf416bff96aef4159a430e upstream. + +Fix tty_kref leak when tty_buffer_request room fails in dma-rx path. + +Note that the tty ref isn't really needed anymore, but as the leak has +always been there, fixing it before removing should makes it easier to +backport the fix. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/pch_uart.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -658,11 +658,12 @@ static int dma_push_rx(struct eg20t_port + dev_warn(port->dev, "Rx overrun: dropping %u bytes\n", + size - room); + if (!room) +- return room; ++ goto out; + + tty_insert_flip_string(tport, sg_virt(&priv->sg_rx), size); + + port->icount.rx += room; ++out: + tty_kref_put(tty); + + return room; diff --git a/queue-3.10/serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch b/queue-3.10/serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch new file mode 100644 index 00000000000..a3dafd6e8ab --- /dev/null +++ b/queue-3.10/serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch @@ -0,0 +1,30 @@ +From fc0919c68cb2f75bb1af759315f9d7e2a9443c28 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Sep 2013 12:50:49 +0200 +Subject: serial: pch_uart: fix tty-kref leak in rx-error path + +From: Johan Hovold + +commit fc0919c68cb2f75bb1af759315f9d7e2a9443c28 upstream. + +Fix tty-kref leak introduced by commit 384e301e ("pch_uart: fix a +deadlock when pch_uart as console") which never put its tty reference. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/pch_uart.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -1071,6 +1071,8 @@ static void pch_uart_err_ir(struct eg20t + if (tty == NULL) { + for (i = 0; error_msg[i] != NULL; i++) + dev_err(&priv->pdev->dev, error_msg[i]); ++ } else { ++ tty_kref_put(tty); + } + } + diff --git a/queue-3.10/serial-tegra-fix-tty-kref-leak.patch b/queue-3.10/serial-tegra-fix-tty-kref-leak.patch new file mode 100644 index 00000000000..ef5761a9154 --- /dev/null +++ b/queue-3.10/serial-tegra-fix-tty-kref-leak.patch @@ -0,0 +1,39 @@ +From cfd29aa0e81b791985e8428e6507e80e074e6730 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Sep 2013 12:50:48 +0200 +Subject: serial: tegra: fix tty-kref leak + +From: Johan Hovold + +commit cfd29aa0e81b791985e8428e6507e80e074e6730 upstream. + +Fix potential tty-kref leak in stop_rx path. + +Signed-off-by: Johan Hovold +Tested-by: Stephen Warren +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/serial-tegra.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -726,7 +726,7 @@ static irqreturn_t tegra_uart_isr(int ir + static void tegra_uart_stop_rx(struct uart_port *u) + { + struct tegra_uart_port *tup = to_tegra_uport(u); +- struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port); ++ struct tty_struct *tty; + struct tty_port *port = &u->state->port; + struct dma_tx_state state; + unsigned long ier; +@@ -738,6 +738,8 @@ static void tegra_uart_stop_rx(struct ua + if (!tup->rx_in_progress) + return; + ++ tty = tty_port_tty_get(&tup->uport.state->port); ++ + tegra_uart_wait_sym_time(tup, 1); /* wait a character interval */ + + ier = tup->ier_shadow; diff --git a/queue-3.10/series b/queue-3.10/series index ebcfe96d9d5..40ad80a5e45 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -12,3 +12,10 @@ bcache-fix-flushes-in-writeback-mode.patch x86-reboot-add-quirk-to-make-dell-c6100-use-reboot-pci-automatically.patch tools-lib-lk-uninclude-linux-magic.h-in-debugfs.c.patch x86-efi-don-t-map-boot-services-on-i386.patch +mei-make-me-client-counters-less-error-prone.patch +mei-bus-stop-wait-for-read-during-cl-state-transition.patch +mei-cancel-stall-timers-in-mei_reset.patch +tty-fix-sigttou-not-sent-with-tcflush.patch +serial-tegra-fix-tty-kref-leak.patch +serial-pch_uart-fix-tty-kref-leak-in-rx-error-path.patch +serial-pch_uart-fix-tty-kref-leak-in-dma-rx-path.patch diff --git a/queue-3.10/tty-fix-sigttou-not-sent-with-tcflush.patch b/queue-3.10/tty-fix-sigttou-not-sent-with-tcflush.patch new file mode 100644 index 00000000000..b01e166403c --- /dev/null +++ b/queue-3.10/tty-fix-sigttou-not-sent-with-tcflush.patch @@ -0,0 +1,37 @@ +From 5cec7bf699c61d14f0538345076480bb8c8ebfbb Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Wed, 25 Sep 2013 20:13:04 -0400 +Subject: tty: Fix SIGTTOU not sent with tcflush() + +From: Peter Hurley + +commit 5cec7bf699c61d14f0538345076480bb8c8ebfbb upstream. + +Commit 'e7f3880cd9b98c5bf9391ae7acdec82b75403776' + tty: Fix recursive deadlock in tty_perform_flush() +introduced a regression where tcflush() does not generate +SIGTTOU for background process groups. + +Make sure ioctl(TCFLSH) calls tty_check_change() when +invoked from the line discipline. + +Reported-by: Oleg Nesterov +Signed-off-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_ioctl.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -1201,6 +1201,9 @@ int n_tty_ioctl_helper(struct tty_struct + } + return 0; + case TCFLSH: ++ retval = tty_check_change(tty); ++ if (retval) ++ return retval; + return __tty_perform_flush(tty, arg); + default: + /* Try the mode commands */