From: Greg Kroah-Hartman Date: Thu, 30 Jul 2015 19:16:44 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v4.1.4~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=93a74644e8af9fa3af54a06e8cad5ab8d8650c8e;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: dm-btree-remove-fix-bug-in-redistribute3.patch dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch drm-add-a-check-for-x-y-in-drm_mode_setcrtc.patch drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch drm-radeon-don-t-flush-the-gart-tlb-if-rdev-gart.ptr-null.patch drm-radeon-take-the-mode_config-mutex-when-dealing-with-hpds-v2.patch mmc-block-add-missing-mmc_blk_put-in-power_ro_lock_show.patch --- diff --git a/queue-3.10/dm-btree-remove-fix-bug-in-redistribute3.patch b/queue-3.10/dm-btree-remove-fix-bug-in-redistribute3.patch new file mode 100644 index 00000000000..bb6dc99dd46 --- /dev/null +++ b/queue-3.10/dm-btree-remove-fix-bug-in-redistribute3.patch @@ -0,0 +1,48 @@ +From 4c7e309340ff85072e96f529582d159002c36734 Mon Sep 17 00:00:00 2001 +From: Dennis Yang +Date: Fri, 26 Jun 2015 15:25:48 +0100 +Subject: dm btree remove: fix bug in redistribute3 + +From: Dennis Yang + +commit 4c7e309340ff85072e96f529582d159002c36734 upstream. + +redistribute3() shares entries out across 3 nodes. Some entries were +being moved the wrong way, breaking the ordering. This manifested as a +BUG() in dm-btree-remove.c:shift() when entries were removed from the +btree. + +For additional context see: +https://www.redhat.com/archives/dm-devel/2015-May/msg00113.html + +Signed-off-by: Dennis Yang +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/persistent-data/dm-btree-remove.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/md/persistent-data/dm-btree-remove.c ++++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btre + + if (s < 0 && nr_center < -s) { + /* not enough in central node */ +- shift(left, center, nr_center); +- s = nr_center - target; ++ shift(left, center, -nr_center); ++ s += nr_center; + shift(left, right, s); + nr_right += s; + } else +@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btre + if (s > 0 && nr_center < s) { + /* not enough in central node */ + shift(center, right, nr_center); +- s = target - nr_center; ++ s -= nr_center; + shift(left, right, s); + nr_left -= s; + } else diff --git a/queue-3.10/dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch b/queue-3.10/dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch new file mode 100644 index 00000000000..5ff4cd9964d --- /dev/null +++ b/queue-3.10/dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch @@ -0,0 +1,32 @@ +From 1c7518794a3647eb345d59ee52844e8a40405198 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Fri, 3 Jul 2015 14:51:32 +0100 +Subject: dm btree: silence lockdep lock inversion in dm_btree_del() + +From: Joe Thornber + +commit 1c7518794a3647eb345d59ee52844e8a40405198 upstream. + +Allocate memory using GFP_NOIO when deleting a btree. dm_btree_del() +can be called via an ioctl and we don't want to recurse into the FS or +block layer. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/persistent-data/dm-btree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -240,7 +240,7 @@ int dm_btree_del(struct dm_btree_info *i + int r; + struct del_stack *s; + +- s = kmalloc(sizeof(*s), GFP_KERNEL); ++ s = kmalloc(sizeof(*s), GFP_NOIO); + if (!s) + return -ENOMEM; + s->tm = info->tm; diff --git a/queue-3.10/drm-add-a-check-for-x-y-in-drm_mode_setcrtc.patch b/queue-3.10/drm-add-a-check-for-x-y-in-drm_mode_setcrtc.patch new file mode 100644 index 00000000000..c7b3db5fd5d --- /dev/null +++ b/queue-3.10/drm-add-a-check-for-x-y-in-drm_mode_setcrtc.patch @@ -0,0 +1,42 @@ +From 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 Mon Sep 17 00:00:00 2001 +From: Zhao Junwang +Date: Tue, 7 Jul 2015 17:08:35 +0800 +Subject: drm: add a check for x/y in drm_mode_setcrtc + +From: Zhao Junwang + +commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream. + +legacy setcrtc ioctl does take a 32 bit value which might indeed +overflow + +the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't +needed any more with this + +v2: -polish the annotation according to Daniel's comment + +Cc: Daniel Vetter +Signed-off-by: Zhao Junwang +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_crtc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -1955,8 +1955,11 @@ int drm_mode_setcrtc(struct drm_device * + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; + +- /* For some reason crtc x/y offsets are signed internally. */ +- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX) ++ /* ++ * Universal plane src offsets are only 16.16, prevent havoc for ++ * drivers using universal plane code internally. ++ */ ++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) + return -ERANGE; + + drm_modeset_lock_all(dev); diff --git a/queue-3.10/drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch b/queue-3.10/drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch new file mode 100644 index 00000000000..5e755c95837 --- /dev/null +++ b/queue-3.10/drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch @@ -0,0 +1,34 @@ +From 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Wed, 3 Jun 2015 12:09:09 +0100 +Subject: drm/qxl: Do not cause spice-server to clean our objects + +From: Frediano Ziglio + +commit 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 upstream. + +If objects are moved back from system memory to VRAM (and spice id +created again) memory is already initialized so we need to set flag +to not clear memory. +If you don't do it after a while using desktop many images turns to +black or transparents. + +Signed-off-by: Frediano Ziglio +Reviewed-by: Dave Airlie +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/qxl/qxl_cmd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/qxl/qxl_cmd.c ++++ b/drivers/gpu/drm/qxl/qxl_cmd.c +@@ -500,6 +500,7 @@ int qxl_hw_surface_alloc(struct qxl_devi + + cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release); + cmd->type = QXL_SURFACE_CMD_CREATE; ++ cmd->flags = QXL_SURF_FLAG_KEEP_DATA; + cmd->u.surface_create.format = surf->surf.format; + cmd->u.surface_create.width = surf->surf.width; + cmd->u.surface_create.height = surf->surf.height; diff --git a/queue-3.10/drm-radeon-don-t-flush-the-gart-tlb-if-rdev-gart.ptr-null.patch b/queue-3.10/drm-radeon-don-t-flush-the-gart-tlb-if-rdev-gart.ptr-null.patch new file mode 100644 index 00000000000..e9b45965c24 --- /dev/null +++ b/queue-3.10/drm-radeon-don-t-flush-the-gart-tlb-if-rdev-gart.ptr-null.patch @@ -0,0 +1,56 @@ +From 233709d2cd6bbaaeda0aeb8d11f6ca7f98563b39 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Fri, 3 Jul 2015 10:02:27 +0900 +Subject: drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= + +commit 233709d2cd6bbaaeda0aeb8d11f6ca7f98563b39 upstream. + +This can be the case when the GPU is powered off, e.g. via vgaswitcheroo +or runpm. When the GPU is powered up again, radeon_gart_table_vram_pin +flushes the TLB after setting rdev->gart.ptr to non-NULL. + +Fixes panic on powering off R7xx GPUs. + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61529 +Reviewed-by: Christian König +Signed-off-by: Michel Dänzer +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_gart.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_gart.c ++++ b/drivers/gpu/drm/radeon/radeon_gart.c +@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_de + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + } + + /** +@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_devic + } + } + } +- mb(); +- radeon_gart_tlb_flush(rdev); ++ if (rdev->gart.ptr) { ++ mb(); ++ radeon_gart_tlb_flush(rdev); ++ } + return 0; + } + diff --git a/queue-3.10/drm-radeon-take-the-mode_config-mutex-when-dealing-with-hpds-v2.patch b/queue-3.10/drm-radeon-take-the-mode_config-mutex-when-dealing-with-hpds-v2.patch new file mode 100644 index 00000000000..4872f0e6042 --- /dev/null +++ b/queue-3.10/drm-radeon-take-the-mode_config-mutex-when-dealing-with-hpds-v2.patch @@ -0,0 +1,35 @@ +From 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 15 May 2015 11:48:52 -0400 +Subject: drm/radeon: take the mode_config mutex when dealing with hpds (v2) + +From: Alex Deucher + +commit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream. + +Since we are messing with state in the worker. + +v2: drop the changes in the mst worker + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c +@@ -73,10 +73,12 @@ static void radeon_hotplug_work_func(str + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_connector *connector; + ++ mutex_lock(&mode_config->mutex); + if (mode_config->num_connector) { + list_for_each_entry(connector, &mode_config->connector_list, head) + radeon_connector_hotplug(connector); + } ++ mutex_unlock(&mode_config->mutex); + /* Just fire off a uevent and let userspace tell us what to do */ + drm_helper_hpd_irq_event(dev); + } diff --git a/queue-3.10/mmc-block-add-missing-mmc_blk_put-in-power_ro_lock_show.patch b/queue-3.10/mmc-block-add-missing-mmc_blk_put-in-power_ro_lock_show.patch new file mode 100644 index 00000000000..581b78d75ca --- /dev/null +++ b/queue-3.10/mmc-block-add-missing-mmc_blk_put-in-power_ro_lock_show.patch @@ -0,0 +1,32 @@ +From 9098f84cced870f54d8c410dd2444cfa61467fa0 Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Thu, 16 Jul 2015 15:50:45 +0200 +Subject: mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() + +From: Tomas Winkler + +commit 9098f84cced870f54d8c410dd2444cfa61467fa0 upstream. + +Enclosing mmc_blk_put() is missing in power_ro_lock_show() sysfs handler, +let's add it. + +Fixes: add710eaa886 ("mmc: boot partition ro lock support") +Signed-off-by: Tomas Winkler +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/block.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -202,6 +202,8 @@ static ssize_t power_ro_lock_show(struct + + ret = snprintf(buf, PAGE_SIZE, "%d\n", locked); + ++ mmc_blk_put(md); ++ + return ret; + } + diff --git a/queue-3.10/series b/queue-3.10/series index 7c30bf6782a..1ee83bfde97 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -46,3 +46,10 @@ usb-devio-fix-a-condition-in-async_completed.patch usb-cp210x-add-id-for-aruba-networks-controllers.patch usb-option-add-2020-4000-id.patch usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch +dm-btree-remove-fix-bug-in-redistribute3.patch +dm-btree-silence-lockdep-lock-inversion-in-dm_btree_del.patch +mmc-block-add-missing-mmc_blk_put-in-power_ro_lock_show.patch +drm-qxl-do-not-cause-spice-server-to-clean-our-objects.patch +drm-radeon-take-the-mode_config-mutex-when-dealing-with-hpds-v2.patch +drm-radeon-don-t-flush-the-gart-tlb-if-rdev-gart.ptr-null.patch +drm-add-a-check-for-x-y-in-drm_mode_setcrtc.patch