From: Greg Kroah-Hartman Date: Fri, 28 Sep 2012 00:13:35 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.44~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8474fc621e98c332fcf13d1f9e0816acecb37141;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: spi-mpc83xx-fix-null-pdata-dereference-bug.patch spi-spi-fsl-spi-reference-correct-pdata-in-fsl_spi_cs_control.patch ubi-fix-a-horrible-memory-deallocation-bug.patch --- diff --git a/queue-3.0/series b/queue-3.0/series index 29585449202..861f9f67653 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -120,3 +120,6 @@ squashfs-fix-mount-time-sanity-check-for-corrupted-superblock.patch mmc-sd-handle-sd3.0-cards-not-supporting-uhs-i-bus-speed-mode.patch mmc-prevent-1.8v-switch-for-sd-hosts-that-don-t-support-uhs-modes.patch e1000e-disable-aspm-l1-on-82574.patch +ubi-fix-a-horrible-memory-deallocation-bug.patch +spi-mpc83xx-fix-null-pdata-dereference-bug.patch +spi-spi-fsl-spi-reference-correct-pdata-in-fsl_spi_cs_control.patch diff --git a/queue-3.0/spi-mpc83xx-fix-null-pdata-dereference-bug.patch b/queue-3.0/spi-mpc83xx-fix-null-pdata-dereference-bug.patch new file mode 100644 index 00000000000..ae6c88e6f21 --- /dev/null +++ b/queue-3.0/spi-mpc83xx-fix-null-pdata-dereference-bug.patch @@ -0,0 +1,41 @@ +From 5039a86973cd35bdb2f64d28ee12f13fe2bb5a4c Mon Sep 17 00:00:00 2001 +From: Kenth Eriksson +Date: Fri, 30 Mar 2012 17:05:30 +0200 +Subject: spi/mpc83xx: fix NULL pdata dereference bug + +From: Kenth Eriksson + +commit 5039a86973cd35bdb2f64d28ee12f13fe2bb5a4c upstream. + +Commit 178db7d3, "spi: Fix device unregistration when unregistering +the bus master", changed device initialization to be children of the +bus master, not children of the bus masters parent device. The pdata +pointer used in fsl_spi_chipselect must updated to reflect the changed +initialization. + +Signed-off-by: Kenth Eriksson +Acked-by: Joakim Tjernlund +Signed-off-by: Grant Likely +Cc: Alfredo Capella +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi_fsl_spi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi_fsl_spi.c ++++ b/drivers/spi/spi_fsl_spi.c +@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct s + static void fsl_spi_chipselect(struct spi_device *spi, int value) + { + struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master); +- struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data; ++ struct fsl_spi_platform_data *pdata; + bool pol = spi->mode & SPI_CS_HIGH; + struct spi_mpc8xxx_cs *cs = spi->controller_state; + ++ pdata = spi->dev.parent->parent->platform_data; ++ + if (value == BITBANG_CS_INACTIVE) { + if (pdata->cs_control) + pdata->cs_control(spi, !pol); diff --git a/queue-3.0/spi-spi-fsl-spi-reference-correct-pdata-in-fsl_spi_cs_control.patch b/queue-3.0/spi-spi-fsl-spi-reference-correct-pdata-in-fsl_spi_cs_control.patch new file mode 100644 index 00000000000..ecf8bf1ebb7 --- /dev/null +++ b/queue-3.0/spi-spi-fsl-spi-reference-correct-pdata-in-fsl_spi_cs_control.patch @@ -0,0 +1,40 @@ +From 067aa4815a9bc12a569d8a06afef50ba5773afbf Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski +Date: Fri, 11 May 2012 15:29:50 -0700 +Subject: spi/spi-fsl-spi: reference correct pdata in fsl_spi_cs_control + +From: Herton Ronaldo Krzesinski + +commit 067aa4815a9bc12a569d8a06afef50ba5773afbf upstream. + +Commit 178db7d3, "spi: Fix device unregistration when unregistering +the bus master", changed spi device initialization of dev.parent pointer +to be the master's device pointer instead of his parent. + +This introduced a bug in spi-fsl-spi, since its usage of spi device +pointer was not updated accordingly. This was later fixed by commit +5039a86, "spi/mpc83xx: fix NULL pdata dereference bug", but it missed +another spot on fsl_spi_cs_control function where we also need to update +usage of spi device pointer. This change address that. + +Signed-off-by: Herton Ronaldo Krzesinski +Acked-by: Joakim Tjernlund +Signed-off-by: Grant Likely +Cc: Alfredo Capella +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi_fsl_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi_fsl_spi.c ++++ b/drivers/spi/spi_fsl_spi.c +@@ -936,7 +936,7 @@ err: + + static void fsl_spi_cs_control(struct spi_device *spi, bool on) + { +- struct device *dev = spi->dev.parent; ++ struct device *dev = spi->dev.parent->parent; + struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(dev->platform_data); + u16 cs = spi->chip_select; + int gpio = pinfo->gpios[cs]; diff --git a/queue-3.0/ubi-fix-a-horrible-memory-deallocation-bug.patch b/queue-3.0/ubi-fix-a-horrible-memory-deallocation-bug.patch new file mode 100644 index 00000000000..f90eb38eae4 --- /dev/null +++ b/queue-3.0/ubi-fix-a-horrible-memory-deallocation-bug.patch @@ -0,0 +1,53 @@ +From richard.genoud@gmail.com Thu Sep 27 17:06:43 2012 +From: Artem Bityutskiy +Date: Wed, 12 Sep 2012 09:03:23 +0200 +Subject: UBI: fix a horrible memory deallocation bug +To: stable@vger.kernel.org +Cc: Artem Bityutskiy , Richard Genoud +Message-ID: <1347433403-32224-1-git-send-email-richard.genoud@gmail.com> + +From: Artem Bityutskiy + +commit 78b495c39add820ab66ab897af9bd77a5f2e91f6 upstream + +UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when +freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened +only when we were doing auto-format, so many systems were unaffected. However, +there are still many users affected. + +It is strange, but the system did not crash and nothing bad happened when +the SLUB memory allocator was used. However, in case of SLOB we observed an +crash right away. + +This problem was introduced in 2.6.39 by commit +"6c1e875 UBI: add slab cache for ubi_scan_leb objects" + +Reported-by: Richard Genoud +Signed-off-by: Artem Bityutskiy +Signed-off-by: Richard Genoud +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/vtbl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/ubi/vtbl.c ++++ b/drivers/mtd/ubi/vtbl.c +@@ -356,7 +356,7 @@ retry: + */ + err = ubi_scan_add_used(ubi, si, new_seb->pnum, new_seb->ec, + vid_hdr, 0); +- kfree(new_seb); ++ kmem_cache_free(si->scan_leb_slab, new_seb); + ubi_free_vid_hdr(ubi, vid_hdr); + return err; + +@@ -369,7 +369,7 @@ write_error: + list_add(&new_seb->u.list, &si->erase); + goto retry; + } +- kfree(new_seb); ++ kmem_cache_free(si->scan_leb_slab, new_seb); + out_free: + ubi_free_vid_hdr(ubi, vid_hdr); + return err;