From: Greg Kroah-Hartman Date: Mon, 6 Jan 2014 21:47:45 +0000 (-0800) Subject: 3.12-stable patches X-Git-Tag: v3.4.76~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=911bdd6558579a12050d6c02934ca73361d3e800;p=thirdparty%2Fkernel%2Fstable-queue.git 3.12-stable patches added patches: arm-sun7i-dt-fix-interrupt-trigger-types.patch gfs2-don-t-hold-s_umount-over-blkdev_put.patch gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch gfs2-fix-slab-memory-leak-in-gfs2_bufdata.patch gfs2-fix-use-after-free-race-when-calling-gfs2_remove_from_ail.patch gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch input-allocate-absinfo-data-when-setting-abs-capability.patch jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch memcg-fix-memcg_size-calculation.patch s390-3270-fix-allocation-of-tty3270_screen-structure.patch sh-always-link-in-helper-functions-extracted-from-libgcc.patch sh-pfc-fix-pinmux_gpio-macro.patch --- diff --git a/queue-3.12/arm-sun7i-dt-fix-interrupt-trigger-types.patch b/queue-3.12/arm-sun7i-dt-fix-interrupt-trigger-types.patch new file mode 100644 index 00000000000..dfb5d83a5b1 --- /dev/null +++ b/queue-3.12/arm-sun7i-dt-fix-interrupt-trigger-types.patch @@ -0,0 +1,135 @@ +From 378d0aee3b53bd8549b29dcc75f2bf47ee446e8f Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Tue, 10 Dec 2013 19:37:21 +0100 +Subject: ARM: sun7i: dt: Fix interrupt trigger types + +From: Maxime Ripard + +commit 378d0aee3b53bd8549b29dcc75f2bf47ee446e8f upstream. + +The Allwinner A20 uses the ARM GIC as its internal interrupts controller. The +GIC can work on several interrupt triggers, and the A20 was actually setting it +up to use a rising edge as a trigger, while it was actually a level high +trigger, leading to some interrupts that would be completely ignored if the +edge was missed. + +Signed-off-by: Maxime Ripard +Acked-by: Hans de Goede +Signed-off-by: Olof Johansson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sun7i-a20.dtsi | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -170,7 +170,7 @@ + emac: ethernet@01c0b000 { + compatible = "allwinner,sun4i-emac"; + reg = <0x01c0b000 0x1000>; +- interrupts = <0 55 1>; ++ interrupts = <0 55 4>; + clocks = <&ahb_gates 17>; + status = "disabled"; + }; +@@ -186,7 +186,7 @@ + pio: pinctrl@01c20800 { + compatible = "allwinner,sun7i-a20-pinctrl"; + reg = <0x01c20800 0x400>; +- interrupts = <0 28 1>; ++ interrupts = <0 28 4>; + clocks = <&apb0_gates 5>; + gpio-controller; + interrupt-controller; +@@ -230,12 +230,12 @@ + timer@01c20c00 { + compatible = "allwinner,sun4i-timer"; + reg = <0x01c20c00 0x90>; +- interrupts = <0 22 1>, +- <0 23 1>, +- <0 24 1>, +- <0 25 1>, +- <0 67 1>, +- <0 68 1>; ++ interrupts = <0 22 4>, ++ <0 23 4>, ++ <0 24 4>, ++ <0 25 4>, ++ <0 67 4>, ++ <0 68 4>; + clocks = <&osc24M>; + }; + +@@ -247,7 +247,7 @@ + uart0: serial@01c28000 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c28000 0x400>; +- interrupts = <0 1 1>; ++ interrupts = <0 1 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 16>; +@@ -257,7 +257,7 @@ + uart1: serial@01c28400 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c28400 0x400>; +- interrupts = <0 2 1>; ++ interrupts = <0 2 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 17>; +@@ -267,7 +267,7 @@ + uart2: serial@01c28800 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c28800 0x400>; +- interrupts = <0 3 1>; ++ interrupts = <0 3 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 18>; +@@ -277,7 +277,7 @@ + uart3: serial@01c28c00 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c28c00 0x400>; +- interrupts = <0 4 1>; ++ interrupts = <0 4 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 19>; +@@ -287,7 +287,7 @@ + uart4: serial@01c29000 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c29000 0x400>; +- interrupts = <0 17 1>; ++ interrupts = <0 17 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 20>; +@@ -297,7 +297,7 @@ + uart5: serial@01c29400 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c29400 0x400>; +- interrupts = <0 18 1>; ++ interrupts = <0 18 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 21>; +@@ -307,7 +307,7 @@ + uart6: serial@01c29800 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c29800 0x400>; +- interrupts = <0 19 1>; ++ interrupts = <0 19 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 22>; +@@ -317,7 +317,7 @@ + uart7: serial@01c29c00 { + compatible = "snps,dw-apb-uart"; + reg = <0x01c29c00 0x400>; +- interrupts = <0 20 1>; ++ interrupts = <0 20 4>; + reg-shift = <2>; + reg-io-width = <4>; + clocks = <&apb1_gates 23>; diff --git a/queue-3.12/gfs2-don-t-hold-s_umount-over-blkdev_put.patch b/queue-3.12/gfs2-don-t-hold-s_umount-over-blkdev_put.patch new file mode 100644 index 00000000000..be42ae9088f --- /dev/null +++ b/queue-3.12/gfs2-don-t-hold-s_umount-over-blkdev_put.patch @@ -0,0 +1,47 @@ +From dfe5b9ad83a63180f358b27d1018649a27b394a9 Mon Sep 17 00:00:00 2001 +From: Steven Whitehouse +Date: Fri, 6 Dec 2013 11:52:34 +0000 +Subject: GFS2: don't hold s_umount over blkdev_put + +From: Steven Whitehouse + +commit dfe5b9ad83a63180f358b27d1018649a27b394a9 upstream. + +This is a GFS2 version of Tejun's patch: +4f331f01b9c43bf001d3ffee578a97a1e0633eac +vfs: don't hold s_umount over close_bdev_exclusive() call + +In this case its blkdev_put itself that is the issue and this +patch uses the same solution of dropping and retaking s_umount. + +Reported-by: Tejun Heo +Reported-by: Al Viro +Signed-off-by: Steven Whitehouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/gfs2/ops_fstype.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -1366,8 +1366,18 @@ static struct dentry *gfs2_mount(struct + if (IS_ERR(s)) + goto error_bdev; + +- if (s->s_root) ++ if (s->s_root) { ++ /* ++ * s_umount nests inside bd_mutex during ++ * __invalidate_device(). blkdev_put() acquires ++ * bd_mutex and can't be called under s_umount. Drop ++ * s_umount temporarily. This is safe as we're ++ * holding an active reference. ++ */ ++ up_write(&s->s_umount); + blkdev_put(bdev, mode); ++ down_write(&s->s_umount); ++ } + + memset(&args, 0, sizeof(args)); + args.ar_quota = GFS2_QUOTA_DEFAULT; diff --git a/queue-3.12/gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch b/queue-3.12/gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch new file mode 100644 index 00000000000..4ce27ad9eaf --- /dev/null +++ b/queue-3.12/gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch @@ -0,0 +1,72 @@ +From dfd11184d894cd0a92397b25cac18831a1a6a5bc Mon Sep 17 00:00:00 2001 +From: Steven Whitehouse +Date: Wed, 18 Dec 2013 14:14:52 +0000 +Subject: GFS2: Fix incorrect invalidation for DIO/buffered I/O + +From: Steven Whitehouse + +commit dfd11184d894cd0a92397b25cac18831a1a6a5bc upstream. + +In patch 209806aba9d540dde3db0a5ce72307f85f33468f we allowed +local deferred locks to be granted against a cached exclusive +lock. That opened up a corner case which this patch now +fixes. + +The solution to the problem is to check whether we have cached +pages each time we do direct I/O and if so to unmap, flush +and invalidate those pages. Since the glock state machine +normally does that for us, mostly the code will be a no-op. + +Signed-off-by: Steven Whitehouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/gfs2/aops.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -984,6 +984,7 @@ static ssize_t gfs2_direct_IO(int rw, st + { + struct file *file = iocb->ki_filp; + struct inode *inode = file->f_mapping->host; ++ struct address_space *mapping = inode->i_mapping; + struct gfs2_inode *ip = GFS2_I(inode); + struct gfs2_holder gh; + int rv; +@@ -1004,6 +1005,35 @@ static ssize_t gfs2_direct_IO(int rw, st + if (rv != 1) + goto out; /* dio not valid, fall back to buffered i/o */ + ++ /* ++ * Now since we are holding a deferred (CW) lock at this point, you ++ * might be wondering why this is ever needed. There is a case however ++ * where we've granted a deferred local lock against a cached exclusive ++ * glock. That is ok provided all granted local locks are deferred, but ++ * it also means that it is possible to encounter pages which are ++ * cached and possibly also mapped. So here we check for that and sort ++ * them out ahead of the dio. The glock state machine will take care of ++ * everything else. ++ * ++ * If in fact the cached glock state (gl->gl_state) is deferred (CW) in ++ * the first place, mapping->nr_pages will always be zero. ++ */ ++ if (mapping->nrpages) { ++ loff_t lstart = offset & (PAGE_CACHE_SIZE - 1); ++ loff_t len = iov_length(iov, nr_segs); ++ loff_t end = PAGE_ALIGN(offset + len) - 1; ++ ++ rv = 0; ++ if (len == 0) ++ goto out; ++ if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags)) ++ unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len); ++ rv = filemap_write_and_wait_range(mapping, lstart, end); ++ if (rv) ++ return rv; ++ truncate_inode_pages_range(mapping, lstart, end); ++ } ++ + rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov, + offset, nr_segs, gfs2_get_block_direct, + NULL, NULL, 0); diff --git a/queue-3.12/gfs2-fix-slab-memory-leak-in-gfs2_bufdata.patch b/queue-3.12/gfs2-fix-slab-memory-leak-in-gfs2_bufdata.patch new file mode 100644 index 00000000000..51bb3ed2887 --- /dev/null +++ b/queue-3.12/gfs2-fix-slab-memory-leak-in-gfs2_bufdata.patch @@ -0,0 +1,57 @@ +From 502be2a32f09f388e4ff34ef2e3ebcabbbb261da Mon Sep 17 00:00:00 2001 +From: Bob Peterson +Date: Fri, 13 Dec 2013 08:31:06 -0500 +Subject: GFS2: Fix slab memory leak in gfs2_bufdata + +From: Bob Peterson + +commit 502be2a32f09f388e4ff34ef2e3ebcabbbb261da upstream. + +This patch fixes a slab memory leak that sometimes can occur +for files with a very short lifespan. The problem occurs when +a dinode is deleted before it has gotten to the journal properly. +In the leak scenario, the bd object is pinned for journal +committment (queued to the metadata buffers queue: sd_log_le_buf) +but is subsequently unpinned and dequeued before it finds its way +to the ail or the revoke queue. In this rare circumstance, the bd +object needs to be freed from slab memory, or it is forgotten. +We have to be very careful how we do it, though, because +multiple processes can call gfs2_remove_from_journal. In order to +avoid double-frees, only the process that does the unpinning is +allowed to free the bd. + +Signed-off-by: Bob Peterson +Signed-off-by: Steven Whitehouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/gfs2/meta_io.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/gfs2/meta_io.c ++++ b/fs/gfs2/meta_io.c +@@ -258,6 +258,7 @@ void gfs2_remove_from_journal(struct buf + struct address_space *mapping = bh->b_page->mapping; + struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping); + struct gfs2_bufdata *bd = bh->b_private; ++ int was_pinned = 0; + + if (test_clear_buffer_pinned(bh)) { + trace_gfs2_pin(bd, 0); +@@ -273,12 +274,16 @@ void gfs2_remove_from_journal(struct buf + tr->tr_num_databuf_rm++; + } + tr->tr_touched = 1; ++ was_pinned = 1; + brelse(bh); + } + if (bd) { + spin_lock(&sdp->sd_ail_lock); + if (bd->bd_tr) { + gfs2_trans_add_revoke(sdp, bd); ++ } else if (was_pinned) { ++ bh->b_private = NULL; ++ kmem_cache_free(gfs2_bufdata_cachep, bd); + } + spin_unlock(&sdp->sd_ail_lock); + } diff --git a/queue-3.12/gfs2-fix-use-after-free-race-when-calling-gfs2_remove_from_ail.patch b/queue-3.12/gfs2-fix-use-after-free-race-when-calling-gfs2_remove_from_ail.patch new file mode 100644 index 00000000000..c6c0940b50b --- /dev/null +++ b/queue-3.12/gfs2-fix-use-after-free-race-when-calling-gfs2_remove_from_ail.patch @@ -0,0 +1,43 @@ +From 9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338 Mon Sep 17 00:00:00 2001 +From: Bob Peterson +Date: Tue, 10 Dec 2013 12:06:35 -0500 +Subject: GFS2: Fix use-after-free race when calling gfs2_remove_from_ail + +From: Bob Peterson + +commit 9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338 upstream. + +Function gfs2_remove_from_ail drops the reference on the bh via +brelse. This patch fixes a race condition whereby bh is deferenced +after the brelse when setting bd->bd_blkno = bh->b_blocknr; +Under certain rare circumstances, bh might be gone or reused, +and bd->bd_blkno is set to whatever that memory happens to be, +which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails +the test "bd->bd_blkno >= blkno" which causes it to never be freed. +The end result is that the bd is never freed from the bufdata cache, +which results in this error: +slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects + +Signed-off-by: Bob Peterson +Signed-off-by: Steven Whitehouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/gfs2/log.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sd + struct buffer_head *bh = bd->bd_bh; + struct gfs2_glock *gl = bd->bd_gl; + +- gfs2_remove_from_ail(bd); +- bd->bd_bh = NULL; + bh->b_private = NULL; + bd->bd_blkno = bh->b_blocknr; ++ gfs2_remove_from_ail(bd); /* drops ref on bh */ ++ bd->bd_bh = NULL; + bd->bd_ops = &gfs2_revoke_lops; + sdp->sd_log_num_revoke++; + atomic_inc(&gl->gl_revokes); diff --git a/queue-3.12/gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch b/queue-3.12/gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch new file mode 100644 index 00000000000..6335d8351d3 --- /dev/null +++ b/queue-3.12/gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch @@ -0,0 +1,42 @@ +From 4cc629b7a20945ce35628179180329b6bc9e552b Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Tue, 10 Dec 2013 15:19:03 -0800 +Subject: gpio: msm: Fix irq mask/unmask by writing bits instead of numbers + +From: Stephen Boyd + +commit 4cc629b7a20945ce35628179180329b6bc9e552b upstream. + +We should be writing bits here but instead we're writing the +numbers that correspond to the bits we want to write. Fix it by +wrapping the numbers in the BIT() macro. This fixes gpios acting +as interrupts. + +Signed-off-by: Stephen Boyd +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-msm-v2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-msm-v2.c ++++ b/drivers/gpio/gpio-msm-v2.c +@@ -252,7 +252,7 @@ static void msm_gpio_irq_mask(struct irq + + spin_lock_irqsave(&tlmm_lock, irq_flags); + writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio)); +- clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio)); ++ clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio)); + __clear_bit(gpio, msm_gpio.enabled_irqs); + spin_unlock_irqrestore(&tlmm_lock, irq_flags); + } +@@ -264,7 +264,7 @@ static void msm_gpio_irq_unmask(struct i + + spin_lock_irqsave(&tlmm_lock, irq_flags); + __set_bit(gpio, msm_gpio.enabled_irqs); +- set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio)); ++ set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio)); + writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio)); + spin_unlock_irqrestore(&tlmm_lock, irq_flags); + } diff --git a/queue-3.12/gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch b/queue-3.12/gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch new file mode 100644 index 00000000000..626dc29d0b7 --- /dev/null +++ b/queue-3.12/gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch @@ -0,0 +1,67 @@ +From f5837ec11f8cfa6d53ebc5806582771b2c9988c6 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Thu, 5 Dec 2013 11:23:35 +0200 +Subject: gpio: twl4030: Fix regression for twl gpio LED output + +From: Roger Quadros + +commit f5837ec11f8cfa6d53ebc5806582771b2c9988c6 upstream. + +Commit 0b2aa8be introduced a regression that causes failure +in setting LED GPO direction to OUT. + +This causes USB host probe failures for Beagleboard C4. + +platform usb_phy_gen_xceiv.2: Driver usb_phy_gen_xceiv requests probe deferral +hsusb2_vcc: Failed to request enable GPIO510: -22 +reg-fixed-voltage reg-fixed-voltage.0.auto: Failed to register regulator: -22 +reg-fixed-voltage: probe of reg-fixed-voltage.0.auto failed with error -22 + +direction_out/direction_in must return 0 if the operation succeeded. + +Also, don't update direction flag and output data if twl4030_set_gpio_direction() +failed inside twl_direction_out(); + +Signed-off-by: Roger Quadros +Acked-by: Tony Lindgren +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-twl4030.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/gpio/gpio-twl4030.c ++++ b/drivers/gpio/gpio-twl4030.c +@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_ + if (offset < TWL4030_GPIO_MAX) + ret = twl4030_set_gpio_direction(offset, 1); + else +- ret = -EINVAL; ++ ret = -EINVAL; /* LED outputs can't be set as input */ + + if (!ret) + priv->direction &= ~BIT(offset); +@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *ch + static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value) + { + struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip); +- int ret = -EINVAL; ++ int ret = 0; + + mutex_lock(&priv->mutex); +- if (offset < TWL4030_GPIO_MAX) ++ if (offset < TWL4030_GPIO_MAX) { + ret = twl4030_set_gpio_direction(offset, 0); ++ if (ret) { ++ mutex_unlock(&priv->mutex); ++ return ret; ++ } ++ } ++ ++ /* ++ * LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output ++ */ + + priv->direction |= BIT(offset); + mutex_unlock(&priv->mutex); diff --git a/queue-3.12/input-allocate-absinfo-data-when-setting-abs-capability.patch b/queue-3.12/input-allocate-absinfo-data-when-setting-abs-capability.patch new file mode 100644 index 00000000000..a0d543b6b0e --- /dev/null +++ b/queue-3.12/input-allocate-absinfo-data-when-setting-abs-capability.patch @@ -0,0 +1,34 @@ +From 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 26 Dec 2013 17:44:29 -0800 +Subject: Input: allocate absinfo data when setting ABS capability + +From: Dmitry Torokhov + +commit 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca upstream. + +We need to make sure we allocate absinfo data when we are setting one of +EV_ABS/ABS_XXX capabilities, otherwise we may bomb when we try to emit this +event. + +Rested-by: Paul Cercueil +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/input.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -1871,6 +1871,10 @@ void input_set_capability(struct input_d + break; + + case EV_ABS: ++ input_alloc_absinfo(dev); ++ if (!dev->absinfo) ++ return; ++ + __set_bit(code, dev->absbit); + break; + diff --git a/queue-3.12/jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch b/queue-3.12/jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch new file mode 100644 index 00000000000..cad70a7fd9b --- /dev/null +++ b/queue-3.12/jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch @@ -0,0 +1,61 @@ +From f6c07cad081ba222d63623d913aafba5586c1d2c Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Sun, 8 Dec 2013 21:12:59 -0500 +Subject: jbd2: don't BUG but return ENOSPC if a handle runs out of space + +From: Theodore Ts'o + +commit f6c07cad081ba222d63623d913aafba5586c1d2c upstream. + +If a handle runs out of space, we currently stop the kernel with a BUG +in jbd2_journal_dirty_metadata(). This makes it hard to figure out +what might be going on. So return an error of ENOSPC, so we can let +the file system layer figure out what is going on, to make it more +likely we can get useful debugging information). This should make it +easier to debug problems such as the one which was reported by: + + https://bugzilla.kernel.org/show_bug.cgi?id=44731 + +The only two callers of this function are ext4_handle_dirty_metadata() +and ocfs2_journal_dirty(). The ocfs2 function will trigger a +BUG_ON(), which means there will be no change in behavior. The ext4 +function will call ext4_error_inode() which will print the useful +debugging information and then handle the situation using ext4's error +handling mechanisms (i.e., which might mean halting the kernel or +remounting the file system read-only). + +Also, since both file systems already call WARN_ON(), drop the WARN_ON +from jbd2_journal_dirty_metadata() to avoid two stack traces from +being displayed. + +Signed-off-by: "Theodore Ts'o" +Cc: ocfs2-devel@oss.oracle.com +Acked-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/transaction.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1290,7 +1290,10 @@ int jbd2_journal_dirty_metadata(handle_t + * once a transaction -bzzz + */ + jh->b_modified = 1; +- J_ASSERT_JH(jh, handle->h_buffer_credits > 0); ++ if (handle->h_buffer_credits <= 0) { ++ ret = -ENOSPC; ++ goto out_unlock_bh; ++ } + handle->h_buffer_credits--; + } + +@@ -1373,7 +1376,6 @@ out_unlock_bh: + jbd2_journal_put_journal_head(jh); + out: + JBUFFER_TRACE(jh, "exit"); +- WARN_ON(ret); /* All errors are bugs, so dump the stack */ + return ret; + } + diff --git a/queue-3.12/memcg-fix-memcg_size-calculation.patch b/queue-3.12/memcg-fix-memcg_size-calculation.patch new file mode 100644 index 00000000000..772ed7256be --- /dev/null +++ b/queue-3.12/memcg-fix-memcg_size-calculation.patch @@ -0,0 +1,37 @@ +From 695c60830764945cf61a2cc623eb1392d137223e Mon Sep 17 00:00:00 2001 +From: Vladimir Davydov +Date: Thu, 2 Jan 2014 12:58:47 -0800 +Subject: memcg: fix memcg_size() calculation + +From: Vladimir Davydov + +commit 695c60830764945cf61a2cc623eb1392d137223e upstream. + +The mem_cgroup structure contains nr_node_ids pointers to +mem_cgroup_per_node objects, not the objects themselves. + +Signed-off-by: Vladimir Davydov +Acked-by: Michal Hocko +Cc: Glauber Costa +Cc: Johannes Weiner +Cc: Balbir Singh +Cc: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -337,7 +337,7 @@ struct mem_cgroup { + static size_t memcg_size(void) + { + return sizeof(struct mem_cgroup) + +- nr_node_ids * sizeof(struct mem_cgroup_per_node); ++ nr_node_ids * sizeof(struct mem_cgroup_per_node *); + } + + /* internal only representation about the status of kmem accounting. */ diff --git a/queue-3.12/s390-3270-fix-allocation-of-tty3270_screen-structure.patch b/queue-3.12/s390-3270-fix-allocation-of-tty3270_screen-structure.patch new file mode 100644 index 00000000000..17aa89d1295 --- /dev/null +++ b/queue-3.12/s390-3270-fix-allocation-of-tty3270_screen-structure.patch @@ -0,0 +1,36 @@ +From 36d9f4d3b68c7035ead3850dc85f310a579ed0eb Mon Sep 17 00:00:00 2001 +From: Martin Schwidefsky +Date: Wed, 18 Dec 2013 14:36:18 +0100 +Subject: s390/3270: fix allocation of tty3270_screen structure + +From: Martin Schwidefsky + +commit 36d9f4d3b68c7035ead3850dc85f310a579ed0eb upstream. + +The tty3270_alloc_screen function is called from tty3270_install with +swapped arguments, the number of columns instead of rows and vice versa. +The number of rows is typically smaller than the number of columns which +makes the screen array too big but the individual cell arrays for the +lines too small. Creating lines longer than the number of rows will +clobber the memory after the end of the cell array. +The fix is simple, call tty3270_alloc_screen with the correct argument +order. + +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/char/tty3270.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/char/tty3270.c ++++ b/drivers/s390/char/tty3270.c +@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_dr + return rc; + } + +- tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows); ++ tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols); + if (IS_ERR(tp->screen)) { + rc = PTR_ERR(tp->screen); + raw3270_put_view(&tp->view); diff --git a/queue-3.12/series b/queue-3.12/series index af1ccee57d2..c6209ff809d 100644 --- a/queue-3.12/series +++ b/queue-3.12/series @@ -121,3 +121,16 @@ mm-munlock-fix-a-bug-where-thp-tail-page-is-encountered.patch mm-munlock-fix-deadlock-in-__munlock_pagevec.patch mm-fix-use-after-free-in-sys_remap_file_pages.patch mm-memory-failure.c-transfer-page-count-from-head-page-to-tail-page-after-split-thp.patch +input-allocate-absinfo-data-when-setting-abs-capability.patch +gfs2-don-t-hold-s_umount-over-blkdev_put.patch +gfs2-fix-use-after-free-race-when-calling-gfs2_remove_from_ail.patch +gfs2-fix-slab-memory-leak-in-gfs2_bufdata.patch +gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch +memcg-fix-memcg_size-calculation.patch +arm-sun7i-dt-fix-interrupt-trigger-types.patch +s390-3270-fix-allocation-of-tty3270_screen-structure.patch +jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch +sh-pfc-fix-pinmux_gpio-macro.patch +gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch +gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch +sh-always-link-in-helper-functions-extracted-from-libgcc.patch diff --git a/queue-3.12/sh-always-link-in-helper-functions-extracted-from-libgcc.patch b/queue-3.12/sh-always-link-in-helper-functions-extracted-from-libgcc.patch new file mode 100644 index 00000000000..37d3eaca4d8 --- /dev/null +++ b/queue-3.12/sh-always-link-in-helper-functions-extracted-from-libgcc.patch @@ -0,0 +1,55 @@ +From 84ed8a99058e61567f495cc43118344261641c5f Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 18 Dec 2013 17:08:48 -0800 +Subject: sh: always link in helper functions extracted from libgcc + +From: Geert Uytterhoeven + +commit 84ed8a99058e61567f495cc43118344261641c5f upstream. + +E.g. landisk_defconfig, which has CONFIG_NTFS_FS=m: + + ERROR: "__ashrdi3" [fs/ntfs/ntfs.ko] undefined! + +For "lib-y", if no symbols in a compilation unit are referenced by other +units, the compilation unit will not be included in vmlinux. This +breaks modules that do reference those symbols. + +Use "obj-y" instead to fix this. + +http://kisskb.ellerman.id.au/kisskb/buildresult/8838077/ + +This doesn't fix all cases. There are others, e.g. udivsi3. +This is also not limited to sh, many architectures handle this in the +same way. + +A simple solution is to unconditionally include all helper functions. +A more complex solution is to make the choice of "lib-y" or "obj-y" depend +on CONFIG_MODULES: + + obj-$(CONFIG_MODULES) += ... + lib-y($CONFIG_MODULES) += ... + +Signed-off-by: Geert Uytterhoeven +Cc: Paul Mundt +Tested-by: Nobuhiro Iwamatsu +Reviewed-by: Nobuhiro Iwamatsu +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/lib/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sh/lib/Makefile ++++ b/arch/sh/lib/Makefile +@@ -6,7 +6,7 @@ lib-y = delay.o memmove.o memchr.o \ + checksum.o strlen.o div64.o div64-generic.o + + # Extracted from libgcc +-lib-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \ ++obj-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \ + ashlsi3.o ashrsi3.o ashiftrt.o lshrsi3.o \ + udiv_qrnnd.o + diff --git a/queue-3.12/sh-pfc-fix-pinmux_gpio-macro.patch b/queue-3.12/sh-pfc-fix-pinmux_gpio-macro.patch new file mode 100644 index 00000000000..91a8ac4c5dd --- /dev/null +++ b/queue-3.12/sh-pfc-fix-pinmux_gpio-macro.patch @@ -0,0 +1,34 @@ +From 8620f394c4f9abd13e4fdf927d9c2bbeda74cde7 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Tue, 26 Nov 2013 02:45:34 +0100 +Subject: sh-pfc: Fix PINMUX_GPIO macro + +From: Laurent Pinchart + +commit 8620f394c4f9abd13e4fdf927d9c2bbeda74cde7 upstream. + +Commit 7cbb0e55e27e ("sh-pfc: Don't duplicate argument to PINMUX_GPIO +macro") erronesouly modified the PINMUX_GPIO macro in a way that +resulted in all pins being named "name". Fix the macro to name the pins +correctly. + +Cc: stable@vger.kernel.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/sh-pfc/sh_pfc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/sh-pfc/sh_pfc.h ++++ b/drivers/pinctrl/sh-pfc/sh_pfc.h +@@ -254,7 +254,7 @@ struct sh_pfc_soc_info { + #define PINMUX_GPIO(_pin) \ + [GPIO_##_pin] = { \ + .pin = (u16)-1, \ +- .name = __stringify(name), \ ++ .name = __stringify(GPIO_##_pin), \ + .enum_id = _pin##_DATA, \ + } +