From: Greg Kroah-Hartman Date: Fri, 15 May 2015 19:48:11 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.10.79~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8cc35763920a28cc069812b2b6fe403a3b856f46;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch --- diff --git a/queue-3.14/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch b/queue-3.14/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch new file mode 100644 index 00000000000..7065dfe7ee2 --- /dev/null +++ b/queue-3.14/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch @@ -0,0 +1,75 @@ +From f254e3c57b9d952e987502aefa0804c177dd2503 Mon Sep 17 00:00:00 2001 +From: Lv Zheng +Date: Mon, 13 Apr 2015 11:48:18 +0800 +Subject: ACPICA: Tables: Change acpi_find_root_pointer() to use acpi_physical_address. + +From: Lv Zheng + +commit f254e3c57b9d952e987502aefa0804c177dd2503 upstream. + +ACPICA commit 7d9fd64397d7c38899d3dc497525f6e6b044e0e3 + +OSPMs like Linux expect an acpi_physical_address returning value from +acpi_find_root_pointer(). This triggers warnings if sizeof (acpi_size) doesn't +equal to sizeof (acpi_physical_address): + drivers/acpi/osl.c:275:3: warning: passing argument 1 of 'acpi_find_root_pointer' from incompatible pointer type [enabled by default] + In file included from include/acpi/acpi.h:64:0, + from include/linux/acpi.h:36, + from drivers/acpi/osl.c:41: + include/acpi/acpixf.h:433:1: note: expected 'acpi_size *' but argument is of type 'acpi_physical_address *' +This patch corrects acpi_find_root_pointer(). + +Link: https://github.com/acpica/acpica/commit/7d9fd643 +Signed-off-by: Lv Zheng +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Dirk Behme +Signed-off-by: George G. Davis +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/tbxfroot.c | 7 ++++--- + include/acpi/acpixf.h | 2 +- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/acpica/tbxfroot.c ++++ b/drivers/acpi/acpica/tbxfroot.c +@@ -111,7 +111,7 @@ acpi_status acpi_tb_validate_rsdp(struct + * + ******************************************************************************/ + +-acpi_status __init acpi_find_root_pointer(acpi_size *table_address) ++acpi_status __init acpi_find_root_pointer(acpi_physical_address * table_address) + { + u8 *table_ptr; + u8 *mem_rover; +@@ -169,7 +169,8 @@ acpi_status __init acpi_find_root_pointe + physical_address += + (u32) ACPI_PTR_DIFF(mem_rover, table_ptr); + +- *table_address = physical_address; ++ *table_address = ++ (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + } +@@ -202,7 +203,7 @@ acpi_status __init acpi_find_root_pointe + (ACPI_HI_RSDP_WINDOW_BASE + + ACPI_PTR_DIFF(mem_rover, table_ptr)); + +- *table_address = physical_address; ++ *table_address = (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -175,7 +175,7 @@ acpi_status __init acpi_load_tables(void + */ + acpi_status __init acpi_reallocate_root_table(void); + +-acpi_status __init acpi_find_root_pointer(acpi_size *rsdp_address); ++acpi_status __init acpi_find_root_pointer(acpi_physical_address * rsdp_address); + + acpi_status acpi_unload_table_id(acpi_owner_id id); + diff --git a/queue-3.14/series b/queue-3.14/series index 25fd65ac6d2..b35ed4da091 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -28,3 +28,5 @@ pinctrl-don-t-just-pretend-to-protect-pinctrl_maps-do-it-for-real.patch mmc-card-don-t-access-rpmb-partitions-for-normal-read-write.patch mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch mmc-sh_mmcif-fix-timeout-value-for-command-request.patch +sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch +acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch diff --git a/queue-3.14/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch b/queue-3.14/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch new file mode 100644 index 00000000000..d7491e9375b --- /dev/null +++ b/queue-3.14/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch @@ -0,0 +1,83 @@ +From bc26d4d06e337ade069f33d3f4377593b24e6e36 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Sat, 18 Apr 2015 02:53:25 +0300 +Subject: sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND) + +From: Alexey Khoroshilov + +commit bc26d4d06e337ade069f33d3f4377593b24e6e36 upstream. + +A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND) +on /dev/sequencer with TMR_ECHO midi event. + +In this case the control flow is: +sound_ioctl() +-> case SND_DEV_SEQ: + case SND_DEV_SEQ2: + sequencer_ioctl() + -> case SNDCTL_SEQ_OUTOFBAND: + spin_lock_irqsave(&lock,flags); + play_event(); + -> case EV_TIMING: + seq_timing_event() + -> case TMR_ECHO: + seq_copy_to_input() + -> spin_lock_irqsave(&lock,flags); + +It seems that spin_lock_irqsave() around play_event() is not necessary, +because the only other call location in seq_startplay() makes the call +without acquiring spinlock. + +So, the patch just removes spinlocks around play_event(). +By the way, it removes unreachable code in seq_timing_event(), +since (seq_mode == SEQ_2) case is handled in the beginning. + +Compile tested only. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Takashi Iwai +Cc: Willy Tarreau +Signed-off-by: Greg Kroah-Hartman + +--- + sound/oss/sequencer.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/sound/oss/sequencer.c ++++ b/sound/oss/sequencer.c +@@ -683,13 +683,8 @@ static int seq_timing_event(unsigned cha + break; + + case TMR_ECHO: +- if (seq_mode == SEQ_2) +- seq_copy_to_input(event_rec, 8); +- else +- { +- parm = (parm << 8 | SEQ_ECHO); +- seq_copy_to_input((unsigned char *) &parm, 4); +- } ++ parm = (parm << 8 | SEQ_ECHO); ++ seq_copy_to_input((unsigned char *) &parm, 4); + break; + + default:; +@@ -1330,7 +1325,6 @@ int sequencer_ioctl(int dev, struct file + int mode = translate_mode(file); + struct synth_info inf; + struct seq_event_rec event_rec; +- unsigned long flags; + int __user *p = arg; + + orig_dev = dev = dev >> 4; +@@ -1485,9 +1479,7 @@ int sequencer_ioctl(int dev, struct file + case SNDCTL_SEQ_OUTOFBAND: + if (copy_from_user(&event_rec, arg, sizeof(event_rec))) + return -EFAULT; +- spin_lock_irqsave(&lock,flags); + play_event(event_rec.arr); +- spin_unlock_irqrestore(&lock,flags); + return 0; + + case SNDCTL_MIDI_INFO: