From: Greg Kroah-Hartman Date: Wed, 18 Dec 2013 18:44:27 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.75~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=742fa01332b34bccc265982f04f2f1408d353bec;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: drivers-rtc-rtc-at91rm9200.c-correct-alarm-over-day-month-wrap.patch drm-i915-fix-pipe-csc-post-offset-calculation.patch powerpc-fix-pte-page-address-mismatch-in-pgtable-ctor-dtor.patch --- diff --git a/queue-3.10/drivers-rtc-rtc-at91rm9200.c-correct-alarm-over-day-month-wrap.patch b/queue-3.10/drivers-rtc-rtc-at91rm9200.c-correct-alarm-over-day-month-wrap.patch new file mode 100644 index 00000000000..36419ff22f0 --- /dev/null +++ b/queue-3.10/drivers-rtc-rtc-at91rm9200.c-correct-alarm-over-day-month-wrap.patch @@ -0,0 +1,33 @@ +From eb3c227289840eed95ddfb0516046f08d8993940 Mon Sep 17 00:00:00 2001 +From: Linus Pizunski +Date: Thu, 12 Dec 2013 17:12:23 -0800 +Subject: drivers/rtc/rtc-at91rm9200.c: correct alarm over day/month wrap + +From: Linus Pizunski + +commit eb3c227289840eed95ddfb0516046f08d8993940 upstream. + +Update month and day of month to the alarm month/day instead of current +day/month when setting the RTC alarm mask. + +Signed-off-by: Linus Pizunski +Signed-off-by: Nicolas Ferre +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-at91rm9200.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/rtc/rtc-at91rm9200.c ++++ b/drivers/rtc/rtc-at91rm9200.c +@@ -221,6 +221,8 @@ static int at91_rtc_setalarm(struct devi + + at91_alarm_year = tm.tm_year; + ++ tm.tm_mon = alrm->time.tm_mon; ++ tm.tm_mday = alrm->time.tm_mday; + tm.tm_hour = alrm->time.tm_hour; + tm.tm_min = alrm->time.tm_min; + tm.tm_sec = alrm->time.tm_sec; diff --git a/queue-3.10/drm-i915-fix-pipe-csc-post-offset-calculation.patch b/queue-3.10/drm-i915-fix-pipe-csc-post-offset-calculation.patch new file mode 100644 index 00000000000..29240457ea4 --- /dev/null +++ b/queue-3.10/drm-i915-fix-pipe-csc-post-offset-calculation.patch @@ -0,0 +1,35 @@ +From 32cf0cb0294814cb1ee5d8727e9aac0e9aa80d2e Mon Sep 17 00:00:00 2001 +From: Ville Syrjälä +Date: Thu, 28 Nov 2013 22:10:38 +0200 +Subject: drm/i915: Fix pipe CSC post offset calculation + +From: Ville Syrjälä + +commit 32cf0cb0294814cb1ee5d8727e9aac0e9aa80d2e upstream. + +We were miscalculating the pipe CSC post offset for the full->limited +range conversion. The resulting post offset was double what it was +supposed to be, which caused blacks to come out grey when using +limited range output on HSW+. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71769 +Tested-by: Lauri Mylläri +Signed-off-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -5225,7 +5225,7 @@ static void intel_set_pipe_csc(struct dr + uint16_t postoff = 0; + + if (intel_crtc->config.limited_color_range) +- postoff = (16 * (1 << 13) / 255) & 0x1fff; ++ postoff = (16 * (1 << 12) / 255) & 0x1fff; + + I915_WRITE(PIPE_CSC_POSTOFF_HI(pipe), postoff); + I915_WRITE(PIPE_CSC_POSTOFF_ME(pipe), postoff); diff --git a/queue-3.10/powerpc-fix-pte-page-address-mismatch-in-pgtable-ctor-dtor.patch b/queue-3.10/powerpc-fix-pte-page-address-mismatch-in-pgtable-ctor-dtor.patch new file mode 100644 index 00000000000..fe7e9bc368b --- /dev/null +++ b/queue-3.10/powerpc-fix-pte-page-address-mismatch-in-pgtable-ctor-dtor.patch @@ -0,0 +1,78 @@ +From cf77ee54362a245f9a01f240adce03a06c05eb68 Mon Sep 17 00:00:00 2001 +From: "Hong H. Pham" +Date: Sat, 7 Dec 2013 09:06:33 -0500 +Subject: powerpc: Fix PTE page address mismatch in pgtable ctor/dtor + +From: "Hong H. Pham" + +commit cf77ee54362a245f9a01f240adce03a06c05eb68 upstream. + +In pte_alloc_one(), pgtable_page_ctor() is passed an address that has +not been converted by page_address() to the newly allocated PTE page. + +When the PTE is freed, __pte_free_tlb() calls pgtable_page_dtor() +with an address to the PTE page that has been converted by page_address(). +The mismatch in the PTE's page address causes pgtable_page_dtor() to access +invalid memory, so resources for that PTE (such as the page lock) is not +properly cleaned up. + +On PPC32, only SMP kernels are affected. + +On PPC64, only SMP kernels with 4K page size are affected. + +This bug was introduced by commit d614bb041209fd7cb5e4b35e11a7b2f6ee8f62b8 +"powerpc: Move the pte free routines from common header". + +On a preempt-rt kernel, a spinlock is dynamically allocated for each +PTE in pgtable_page_ctor(). When the PTE is freed, calling +pgtable_page_dtor() with a mismatched page address causes a memory leak, +as the pointer to the PTE's spinlock is bogus. + +On mainline, there isn't any immediately obvious symptoms, but the +problem still exists here. + +Fixes: d614bb041209fd7c "powerpc: Move the pte free routes from common header" +Cc: Paul Mackerras +Cc: Aneesh Kumar K.V +Cc: Benjamin Herrenschmidt +Signed-off-by: Hong H. Pham +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/pgalloc-32.h | 6 ++---- + arch/powerpc/include/asm/pgalloc-64.h | 6 ++---- + 2 files changed, 4 insertions(+), 8 deletions(-) + +--- a/arch/powerpc/include/asm/pgalloc-32.h ++++ b/arch/powerpc/include/asm/pgalloc-32.h +@@ -84,10 +84,8 @@ static inline void pgtable_free_tlb(stru + static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table, + unsigned long address) + { +- struct page *page = page_address(table); +- + tlb_flush_pgtable(tlb, address); +- pgtable_page_dtor(page); +- pgtable_free_tlb(tlb, page, 0); ++ pgtable_page_dtor(table); ++ pgtable_free_tlb(tlb, page_address(table), 0); + } + #endif /* _ASM_POWERPC_PGALLOC_32_H */ +--- a/arch/powerpc/include/asm/pgalloc-64.h ++++ b/arch/powerpc/include/asm/pgalloc-64.h +@@ -144,11 +144,9 @@ static inline void pgtable_free_tlb(stru + static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table, + unsigned long address) + { +- struct page *page = page_address(table); +- + tlb_flush_pgtable(tlb, address); +- pgtable_page_dtor(page); +- pgtable_free_tlb(tlb, page, 0); ++ pgtable_page_dtor(table); ++ pgtable_free_tlb(tlb, page_address(table), 0); + } + + #else /* if CONFIG_PPC_64K_PAGES */ diff --git a/queue-3.10/series b/queue-3.10/series index 33c48ed991a..cdf5e9471ff 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -30,3 +30,6 @@ usb-serial-option-blacklist-interface-1-for-huawei-e173s-6.patch usb-option-support-new-huawei-devices.patch input-usbtouchscreen-separate-report-and-transmit-buffer-size-handling.patch media-af9035-fix-broken-i2c-and-usb-i-o.patch +powerpc-fix-pte-page-address-mismatch-in-pgtable-ctor-dtor.patch +drivers-rtc-rtc-at91rm9200.c-correct-alarm-over-day-month-wrap.patch +drm-i915-fix-pipe-csc-post-offset-calculation.patch