From: Greg Kroah-Hartman Date: Mon, 23 Sep 2013 21:21:09 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.97~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=57ef2d02ec92c9e8cd468fbdf640046ab84185bc;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: arm-pci-versatile-fix-smap-register-offsets.patch cifs-ensure-that-srv_mutex-is-held-when-dealing-with-ssocket-pointer.patch staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch usb-xhci-disable-runtime-pm-suspend-for-quirky-controllers.patch --- diff --git a/queue-3.0/arm-pci-versatile-fix-smap-register-offsets.patch b/queue-3.0/arm-pci-versatile-fix-smap-register-offsets.patch new file mode 100644 index 00000000000..9188f36eb88 --- /dev/null +++ b/queue-3.0/arm-pci-versatile-fix-smap-register-offsets.patch @@ -0,0 +1,40 @@ +From 99f2b130370b904ca5300079243fdbcafa2c708b Mon Sep 17 00:00:00 2001 +From: Peter Maydell +Date: Thu, 22 Aug 2013 17:47:50 +0100 +Subject: ARM: PCI: versatile: Fix SMAP register offsets + +From: Peter Maydell + +commit 99f2b130370b904ca5300079243fdbcafa2c708b upstream. + +The SMAP register offsets in the versatile PCI controller code were +all off by four. (This didn't have any observable bad effects +because on this board PHYS_OFFSET is zero, and (a) writing zero to +the flags register at offset 0x10 has no effect and (b) the reset +value of the SMAP register is zero anyway, so failing to write SMAP2 +didn't matter.) + +Signed-off-by: Peter Maydell +Reviewed-by: Linus Walleij +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-versatile/pci.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm/mach-versatile/pci.c ++++ b/arch/arm/mach-versatile/pci.c +@@ -43,9 +43,9 @@ + #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0) + #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4) + #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8) +-#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10) +-#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14) +-#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18) ++#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14) ++#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18) ++#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c) + #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc) + + #define DEVICE_ID_OFFSET 0x00 diff --git a/queue-3.0/cifs-ensure-that-srv_mutex-is-held-when-dealing-with-ssocket-pointer.patch b/queue-3.0/cifs-ensure-that-srv_mutex-is-held-when-dealing-with-ssocket-pointer.patch new file mode 100644 index 00000000000..8a7ebd2f4ce --- /dev/null +++ b/queue-3.0/cifs-ensure-that-srv_mutex-is-held-when-dealing-with-ssocket-pointer.patch @@ -0,0 +1,101 @@ +From 73e216a8a42c0ef3d08071705c946c38fdbe12b0 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Thu, 5 Sep 2013 08:38:10 -0400 +Subject: cifs: ensure that srv_mutex is held when dealing with ssocket pointer + +From: Jeff Layton + +commit 73e216a8a42c0ef3d08071705c946c38fdbe12b0 upstream. + +Oleksii reported that he had seen an oops similar to this: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000088 +IP: [] sock_sendmsg+0x93/0xd0 +PGD 0 +Oops: 0000 [#1] PREEMPT SMP +Modules linked in: ipt_MASQUERADE xt_REDIRECT xt_tcpudp iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack ip_tables x_tables carl9170 ath usb_storage f2fs nfnetlink_log nfnetlink md4 cifs dns_resolver hid_generic usbhid hid af_packet uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev rfcomm btusb bnep bluetooth qmi_wwan qcserial cdc_wdm usb_wwan usbnet usbserial mii snd_hda_codec_hdmi snd_hda_codec_realtek iwldvm mac80211 coretemp intel_powerclamp kvm_intel kvm iwlwifi snd_hda_intel cfg80211 snd_hda_codec xhci_hcd e1000e ehci_pci snd_hwdep sdhci_pci snd_pcm ehci_hcd microcode psmouse sdhci thinkpad_acpi mmc_core i2c_i801 pcspkr usbcore hwmon snd_timer snd_page_alloc snd ptp rfkill pps_core soundcore evdev usb_common vboxnetflt(O) vboxdrv(O)Oops#2 Part8 + loop tun binfmt_misc fuse msr acpi_call(O) ipv6 autofs4 +CPU: 0 PID: 21612 Comm: kworker/0:1 Tainted: G W O 3.10.1SIGN #28 +Hardware name: LENOVO 2306CTO/2306CTO, BIOS G2ET92WW (2.52 ) 02/22/2013 +Workqueue: cifsiod cifs_echo_request [cifs] +task: ffff8801e1f416f0 ti: ffff880148744000 task.ti: ffff880148744000 +RIP: 0010:[] [] sock_sendmsg+0x93/0xd0 +RSP: 0000:ffff880148745b00 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: ffff880148745b78 RCX: 0000000000000048 +RDX: ffff880148745c90 RSI: ffff880181864a00 RDI: ffff880148745b78 +RBP: ffff880148745c48 R08: 0000000000000048 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: ffff880181864a00 +R13: ffff880148745c90 R14: 0000000000000048 R15: 0000000000000048 +FS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000088 CR3: 000000020c42c000 CR4: 00000000001407b0 +Oops#2 Part7 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +Stack: + ffff880148745b30 ffffffff810c4af9 0000004848745b30 ffff880181864a00 + ffffffff81ffbc40 0000000000000000 ffff880148745c90 ffffffff810a5aab + ffff880148745bc0 ffffffff81ffbc40 ffff880148745b60 ffffffff815a9fb8 +Call Trace: + [] ? finish_task_switch+0x49/0xe0 + [] ? lock_timer_base.isra.36+0x2b/0x50 + [] ? _raw_spin_unlock_irqrestore+0x18/0x40 + [] ? try_to_del_timer_sync+0x4f/0x70 + [] ? _raw_spin_unlock_bh+0x1f/0x30 + [] kernel_sendmsg+0x37/0x50 + [] smb_send_kvec+0xd0/0x1d0 [cifs] + [] smb_send_rqst+0x83/0x1f0 [cifs] + [] cifs_call_async+0xec/0x1b0 [cifs] + [] ? free_rsp_buf+0x40/0x40 [cifs] +Oops#2 Part6 + [] SMB2_echo+0x8e/0xb0 [cifs] + [] cifs_echo_request+0x79/0xa0 [cifs] + [] process_one_work+0x173/0x4a0 + [] worker_thread+0x121/0x3a0 + [] ? manage_workers.isra.27+0x2b0/0x2b0 + [] kthread+0xc0/0xd0 + [] ? kthread_create_on_node+0x120/0x120 + [] ret_from_fork+0x7c/0xb0 + [] ? kthread_create_on_node+0x120/0x120 +Code: 84 24 b8 00 00 00 4c 89 f1 4c 89 ea 4c 89 e6 48 89 df 4c 89 60 18 48 c7 40 28 00 00 00 00 4c 89 68 30 44 89 70 14 49 8b 44 24 28 90 88 00 00 00 3d ef fd ff ff 74 10 48 8d 65 e0 5b 41 5c 41 + RIP [] sock_sendmsg+0x93/0xd0 + RSP +CR2: 0000000000000088 + +The client was in the middle of trying to send a frame when the +server->ssocket pointer got zeroed out. In most places, that we access +that pointer, the srv_mutex is held. There's only one spot that I see +that the server->ssocket pointer gets set and the srv_mutex isn't held. +This patch corrects that. + +The upstream bug report was here: + + https://bugzilla.kernel.org/show_bug.cgi?id=60557 + +Reported-by: Oleksii Shevchuk +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -158,6 +158,7 @@ cifs_reconnect(struct TCP_Server_Info *s + try_to_freeze(); + + /* we should try only the port we connected to before */ ++ mutex_lock(&server->srv_mutex); + rc = generic_ip_connect(server); + if (rc) { + cFYI(1, "reconnect error %d", rc); +@@ -169,6 +170,7 @@ cifs_reconnect(struct TCP_Server_Info *s + server->tcpStatus = CifsNeedNegotiate; + spin_unlock(&GlobalMid_Lock); + } ++ mutex_unlock(&server->srv_mutex); + } while (server->tcpStatus == CifsNeedReconnect); + + return rc; diff --git a/queue-3.0/series b/queue-3.0/series index daa46a3a48a..b04a34f74b6 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -2,3 +2,7 @@ scsi-sd-fix-potential-out-of-bounds-access.patch crypto-api-fix-race-condition-in-larval-lookup.patch powerpc-handle-unaligned-ldbrx-stdbrx.patch xen-gnt-prevent-adding-duplicate-gnt-callbacks.patch +arm-pci-versatile-fix-smap-register-offsets.patch +usb-xhci-disable-runtime-pm-suspend-for-quirky-controllers.patch +cifs-ensure-that-srv_mutex-is-held-when-dealing-with-ssocket-pointer.patch +staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch diff --git a/queue-3.0/staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch b/queue-3.0/staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch new file mode 100644 index 00000000000..a61db14067f --- /dev/null +++ b/queue-3.0/staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch @@ -0,0 +1,35 @@ +From 2c4283ca7cdcc6605859c836fc536fcd83a4525f Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 20 Aug 2013 11:57:35 +0300 +Subject: staging: comedi: dt282x: dt282x_ai_insn_read() always fails + +From: Dan Carpenter + +commit 2c4283ca7cdcc6605859c836fc536fcd83a4525f upstream. + +In dt282x_ai_insn_read() we call this macro like: +wait_for(!mux_busy(), comedi_error(dev, "timeout\n"); return -ETIME;); +Because the if statement doesn't have curly braces it means we always +return -ETIME and the function never succeeds. + +Signed-off-by: Dan Carpenter +Acked-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/dt282x.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/dt282x.c ++++ b/drivers/staging/comedi/drivers/dt282x.c +@@ -406,8 +406,9 @@ struct dt282x_private { + } \ + udelay(5); \ + } \ +- if (_i) \ ++ if (_i) { \ + b \ ++ } \ + } while (0) + + static int dt282x_attach(struct comedi_device *dev, diff --git a/queue-3.0/usb-xhci-disable-runtime-pm-suspend-for-quirky-controllers.patch b/queue-3.0/usb-xhci-disable-runtime-pm-suspend-for-quirky-controllers.patch new file mode 100644 index 00000000000..1eff7ee74bb --- /dev/null +++ b/queue-3.0/usb-xhci-disable-runtime-pm-suspend-for-quirky-controllers.patch @@ -0,0 +1,79 @@ +From c8476fb855434c733099079063990e5bfa7ecad6 Mon Sep 17 00:00:00 2001 +From: Shawn Nematbakhsh +Date: Mon, 19 Aug 2013 10:36:13 -0700 +Subject: usb: xhci: Disable runtime PM suspend for quirky controllers + +From: Shawn Nematbakhsh + +commit c8476fb855434c733099079063990e5bfa7ecad6 upstream. + +If a USB controller with XHCI_RESET_ON_RESUME goes to runtime suspend, +a reset will be performed upon runtime resume. Any previously suspended +devices attached to the controller will be re-enumerated at this time. +This will cause problems, for example, if an open system call on the +device triggered the resume (the open call will fail). + +Note that this change is only relevant when persist_enabled is not set +for USB devices. + +This patch should be backported to kernels as old as 3.0, that +contain the commit c877b3b2ad5cb9d4fe523c5496185cc328ff3ae9 "xhci: Add +reset on resume quirk for asrock p67 host". + +Signed-off-by: Shawn Nematbakhsh +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -2713,10 +2713,21 @@ void xhci_free_dev(struct usb_hcd *hcd, + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct xhci_virt_device *virt_dev; ++ struct device *dev = hcd->self.controller; + unsigned long flags; + u32 state; + int i, ret; + ++#ifndef CONFIG_USB_DEFAULT_PERSIST ++ /* ++ * We called pm_runtime_get_noresume when the device was attached. ++ * Decrement the counter here to allow controller to runtime suspend ++ * if no devices remain. ++ */ ++ if (xhci->quirks & XHCI_RESET_ON_RESUME) ++ pm_runtime_put_noidle(dev); ++#endif ++ + ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__); + /* If the host is halted due to driver unload, we still need to free the + * device. +@@ -2783,6 +2794,7 @@ static int xhci_reserve_host_control_ep_ + int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct device *dev = hcd->self.controller; + unsigned long flags; + int timeleft; + int ret; +@@ -2835,6 +2847,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, + goto disable_slot; + } + udev->slot_id = xhci->slot_id; ++ ++#ifndef CONFIG_USB_DEFAULT_PERSIST ++ /* ++ * If resetting upon resume, we can't put the controller into runtime ++ * suspend if there is a device attached. ++ */ ++ if (xhci->quirks & XHCI_RESET_ON_RESUME) ++ pm_runtime_get_noresume(dev); ++#endif ++ + /* Is this a LS or FS device under a HS hub? */ + /* Hub or peripherial? */ + return 1;