From: Greg Kroah-Hartman Date: Mon, 6 Apr 2015 09:59:57 +0000 (+0200) Subject: 3.14-stable patches X-Git-Tag: v3.10.74~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4482c2906237a785ac8a22d18a6bc0ed725343e3;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: clockevents-sun5i-fix-setup_irq-init-sequence.patch clocksource-efm32-fix-a-null-pointer-dereference.patch regmap-regcache-rbtree-fix-present-bitmap-resize.patch tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch tcm_qla2xxx-fix-incorrect-use-of-__transport_register_session.patch --- diff --git a/queue-3.14/clockevents-sun5i-fix-setup_irq-init-sequence.patch b/queue-3.14/clockevents-sun5i-fix-setup_irq-init-sequence.patch new file mode 100644 index 00000000000..7709a93856b --- /dev/null +++ b/queue-3.14/clockevents-sun5i-fix-setup_irq-init-sequence.patch @@ -0,0 +1,48 @@ +From 1096be084ac59927158ce80ff1d31c33eed0e565 Mon Sep 17 00:00:00 2001 +From: Yongbae Park +Date: Tue, 3 Mar 2015 13:05:48 +0900 +Subject: clockevents: sun5i: Fix setup_irq init sequence + +From: Yongbae Park + +commit 1096be084ac59927158ce80ff1d31c33eed0e565 upstream. + +The interrupt is enabled before the handler is set. Even this bug +did not appear, it is potentially dangerous as it can lead to a +NULL pointer dereference. + +Fix the error by enabling the interrupt after +clockevents_config_and_register() is called. + +Signed-off-by: Yongbae Park +Signed-off-by: Daniel Lezcano +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clocksource/timer-sun5i.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/clocksource/timer-sun5i.c ++++ b/drivers/clocksource/timer-sun5i.c +@@ -172,10 +172,6 @@ static void __init sun5i_timer_init(stru + + ticks_per_jiffy = DIV_ROUND_UP(rate, HZ); + +- ret = setup_irq(irq, &sun5i_timer_irq); +- if (ret) +- pr_warn("failed to setup irq %d\n", irq); +- + /* Enable timer0 interrupt */ + val = readl(timer_base + TIMER_IRQ_EN_REG); + writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG); +@@ -185,6 +181,10 @@ static void __init sun5i_timer_init(stru + + clockevents_config_and_register(&sun5i_clockevent, rate, + TIMER_SYNC_TICKS, 0xffffffff); ++ ++ ret = setup_irq(irq, &sun5i_timer_irq); ++ if (ret) ++ pr_warn("failed to setup irq %d\n", irq); + } + CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer", + sun5i_timer_init); diff --git a/queue-3.14/clocksource-efm32-fix-a-null-pointer-dereference.patch b/queue-3.14/clocksource-efm32-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..816691611c1 --- /dev/null +++ b/queue-3.14/clocksource-efm32-fix-a-null-pointer-dereference.patch @@ -0,0 +1,46 @@ +From 7b8f10da3bf1056546133c9f54f49ce389fd95ab Mon Sep 17 00:00:00 2001 +From: Yongbae Park +Date: Tue, 3 Mar 2015 19:46:49 +0900 +Subject: clocksource: efm32: Fix a NULL pointer dereference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yongbae Park + +commit 7b8f10da3bf1056546133c9f54f49ce389fd95ab upstream. + +The initialisation of the efm32 clocksource first sets up the irq and only +after that initialises the data needed for irq handling. In case this +initialisation is delayed the irq handler would dereference a NULL pointer. + +I'm not aware of anything that could delay the process in such a way, but it's +better to be safe than sorry, so setup the irq only when the clock event device +is ready. + +Acked-by: Uwe Kleine-König +Signed-off-by: Yongbae Park +Signed-off-by: Daniel Lezcano +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clocksource/time-efm32.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clocksource/time-efm32.c ++++ b/drivers/clocksource/time-efm32.c +@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init( + clock_event_ddata.base = base; + clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ); + +- setup_irq(irq, &efm32_clock_event_irq); +- + clockevents_config_and_register(&clock_event_ddata.evtdev, + DIV_ROUND_CLOSEST(rate, 1024), + 0xf, 0xffff); + ++ setup_irq(irq, &efm32_clock_event_irq); ++ + return 0; + + err_get_irq: diff --git a/queue-3.14/regmap-regcache-rbtree-fix-present-bitmap-resize.patch b/queue-3.14/regmap-regcache-rbtree-fix-present-bitmap-resize.patch new file mode 100644 index 00000000000..15abe0ba884 --- /dev/null +++ b/queue-3.14/regmap-regcache-rbtree-fix-present-bitmap-resize.patch @@ -0,0 +1,37 @@ +From 328f494d95aac8bd4896aea2328bc281053bcb71 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Sat, 7 Mar 2015 17:10:01 +0100 +Subject: regmap: regcache-rbtree: Fix present bitmap resize + +From: Lars-Peter Clausen + +commit 328f494d95aac8bd4896aea2328bc281053bcb71 upstream. + +When inserting a new register into a block at the lower end the present +bitmap is currently shifted into the wrong direction. The effect of this is +that the bitmap becomes corrupted and registers which are present might be +reported as not present and vice versa. + +Fix this by shifting left rather than right. + +Fixes: 472fdec7380c("regmap: rbtree: Reduce number of nodes, take 2") +Reported-by: Daniel Baluta +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/regmap/regcache-rbtree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -313,7 +313,7 @@ static int regcache_rbtree_insert_to_blo + if (pos == 0) { + memmove(blk + offset * map->cache_word_size, + blk, rbnode->blklen * map->cache_word_size); +- bitmap_shift_right(present, present, offset, blklen); ++ bitmap_shift_left(present, present, offset, blklen); + } + + /* update the rbnode block, its size and the base register */ diff --git a/queue-3.14/series b/queue-3.14/series index 9ea2c4ae857..5c25adcf9ee 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -11,3 +11,8 @@ asoc-ak4641-fix-wrong-value-references-for-boolean-kctl.patch asoc-adav80x-fix-wrong-value-references-for-boolean-kctl.patch asoc-wm8955-fix-wrong-value-references-for-boolean-kctl.patch asoc-jz4740-remove-makefile-entry-for-removed-file.patch +clockevents-sun5i-fix-setup_irq-init-sequence.patch +regmap-regcache-rbtree-fix-present-bitmap-resize.patch +clocksource-efm32-fix-a-null-pointer-dereference.patch +tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch +tcm_qla2xxx-fix-incorrect-use-of-__transport_register_session.patch diff --git a/queue-3.14/tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch b/queue-3.14/tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch new file mode 100644 index 00000000000..e9b4cf1ab2d --- /dev/null +++ b/queue-3.14/tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch @@ -0,0 +1,47 @@ +From d556546e7ecd9fca199df4698943024d40044f8e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 25 Feb 2015 16:21:03 +0300 +Subject: tcm_fc: missing curly braces in ft_invl_hw_context() + +From: Dan Carpenter + +commit d556546e7ecd9fca199df4698943024d40044f8e upstream. + +This patch adds a missing set of conditional check braces in +ft_invl_hw_context() originally introduced by commit dcd998ccd +when handling DDP failures in ft_recv_write_data() code. + + commit dcd998ccdbf74a7d8fe0f0a44e85da1ed5975946 + Author: Kiran Patil + Date: Wed Aug 3 09:20:01 2011 +0000 + + tcm_fc: Handle DDP/SW fc_frame_payload_get failures in ft_recv_write_data + +Signed-off-by: Dan Carpenter +Cc: Kiran Patil +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/tcm_fc/tfc_io.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/target/tcm_fc/tfc_io.c ++++ b/drivers/target/tcm_fc/tfc_io.c +@@ -346,7 +346,7 @@ void ft_invl_hw_context(struct ft_cmd *c + ep = fc_seq_exch(seq); + if (ep) { + lport = ep->lp; +- if (lport && (ep->xid <= lport->lro_xid)) ++ if (lport && (ep->xid <= lport->lro_xid)) { + /* + * "ddp_done" trigger invalidation of HW + * specific DDP context +@@ -361,6 +361,7 @@ void ft_invl_hw_context(struct ft_cmd *c + * identified using ep->xid) + */ + cmd->was_ddp_setup = 0; ++ } + } + } + } diff --git a/queue-3.14/tcm_qla2xxx-fix-incorrect-use-of-__transport_register_session.patch b/queue-3.14/tcm_qla2xxx-fix-incorrect-use-of-__transport_register_session.patch new file mode 100644 index 00000000000..3cb7afb17f1 --- /dev/null +++ b/queue-3.14/tcm_qla2xxx-fix-incorrect-use-of-__transport_register_session.patch @@ -0,0 +1,39 @@ +From 75c3d0bf9caebb502e96683b2bc37f9692437e68 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Thu, 19 Mar 2015 22:25:16 -0700 +Subject: tcm_qla2xxx: Fix incorrect use of __transport_register_session + +From: Bart Van Assche + +commit 75c3d0bf9caebb502e96683b2bc37f9692437e68 upstream. + +This patch fixes the incorrect use of __transport_register_session() +in tcm_qla2xxx_check_initiator_node_acl() code, that does not perform +explicit se_tpg->session_lock when accessing se_tpg->tpg_sess_list +to add new se_sess nodes. + +Given that tcm_qla2xxx_check_initiator_node_acl() is not called with +qla_hw->hardware_lock held for all accesses of ->tpg_sess_list, the +code should be using transport_register_session() instead. + +Signed-off-by: Bart Van Assche +Cc: Giridhar Malavali +Cc: Quinn Tran +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/tcm_qla2xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -1515,7 +1515,7 @@ static int tcm_qla2xxx_check_initiator_n + /* + * Finally register the new FC Nexus with TCM + */ +- __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess); ++ transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess); + + return 0; + }