From: Greg Kroah-Hartman Date: Fri, 17 Apr 2015 12:50:24 +0000 (+0200) Subject: 3.19-stable patches X-Git-Tag: v3.10.75~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c250839140eca82dc0f6d13aca1c1adda770b9a8;p=thirdparty%2Fkernel%2Fstable-queue.git 3.19-stable patches added patches: be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch cx23885-fix-querycap.patch ioctx_alloc-fix-vma-and-file-leak-on-failure.patch iscsi-target-fix-oops-when-adding-reject-pdu.patch media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch ocfs2-_really_-sync-the-right-range.patch revert-libceph-use-memalloc-flags-for-net-io.patch revert-pm-hibernate-avoid-unsafe-pages-in-e820-reserved-regions.patch sh_veu-v4l2_dev-wasn-t-set.patch soc-camera-fix-devm_kfree-in-soc_of_bind.patch vb2-fix-dma_dir-setting-for-dma-contig-mem-type.patch vb2-fix-unbalanced-warnings-when-calling-vb2_thread_stop.patch --- diff --git a/queue-3.19/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch b/queue-3.19/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch new file mode 100644 index 00000000000..ade59871ee9 --- /dev/null +++ b/queue-3.19/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch @@ -0,0 +1,34 @@ +From 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 Mon Sep 17 00:00:00 2001 +From: John Soni Jose +Date: Thu, 12 Feb 2015 06:45:47 +0530 +Subject: be2iscsi: Fix kernel panic when device initialization fails + +From: John Soni Jose + +commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream. + +Kernel panic was happening as iscsi_host_remove() was called on +a host which was not yet added. + +Signed-off-by: John Soni Jose +Reviewed-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/be2iscsi/be_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -5735,9 +5735,9 @@ free_port: + hba_free: + if (phba->msix_enabled) + pci_disable_msix(phba->pcidev); +- iscsi_host_remove(phba->shost); + pci_dev_put(phba->pcidev); + iscsi_host_free(phba->shost); ++ pci_set_drvdata(pcidev, NULL); + disable_pci: + pci_disable_device(pcidev); + return ret; diff --git a/queue-3.19/cx23885-fix-querycap.patch b/queue-3.19/cx23885-fix-querycap.patch new file mode 100644 index 00000000000..8bd7a964408 --- /dev/null +++ b/queue-3.19/cx23885-fix-querycap.patch @@ -0,0 +1,44 @@ +From 6b46211f0a3b18b2360275ac29c4d6bfdf7bc015 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sun, 8 Mar 2015 23:20:03 -0800 +Subject: [media] cx23885: fix querycap + +From: Hans Verkuil + +commit 6b46211f0a3b18b2360275ac29c4d6bfdf7bc015 upstream. + +cap->device_caps wasn't set in cx23885-417.c causing a warning from +the v4l2-core. + +Reported-by: Joseph Jasi +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/cx23885/cx23885-417.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/drivers/media/pci/cx23885/cx23885-417.c ++++ b/drivers/media/pci/cx23885/cx23885-417.c +@@ -1339,14 +1339,13 @@ static int vidioc_querycap(struct file * + strlcpy(cap->driver, dev->name, sizeof(cap->driver)); + strlcpy(cap->card, cx23885_boards[tsport->dev->board].name, + sizeof(cap->card)); +- sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci)); +- cap->capabilities = +- V4L2_CAP_VIDEO_CAPTURE | +- V4L2_CAP_READWRITE | +- V4L2_CAP_STREAMING | +- 0; ++ sprintf(cap->bus_info, "PCIe:%s", pci_name(dev->pci)); ++ cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE | ++ V4L2_CAP_STREAMING; + if (dev->tuner_type != TUNER_ABSENT) +- cap->capabilities |= V4L2_CAP_TUNER; ++ cap->device_caps |= V4L2_CAP_TUNER; ++ cap->capabilities = cap->device_caps | V4L2_CAP_VBI_CAPTURE | ++ V4L2_CAP_AUDIO | V4L2_CAP_DEVICE_CAPS; + + return 0; + } diff --git a/queue-3.19/ioctx_alloc-fix-vma-and-file-leak-on-failure.patch b/queue-3.19/ioctx_alloc-fix-vma-and-file-leak-on-failure.patch new file mode 100644 index 00000000000..ed5306f0185 --- /dev/null +++ b/queue-3.19/ioctx_alloc-fix-vma-and-file-leak-on-failure.patch @@ -0,0 +1,72 @@ +From deeb8525f9bcea60f5e86521880c1161de7a5829 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Mon, 6 Apr 2015 17:57:44 -0400 +Subject: ioctx_alloc(): fix vma (and file) leak on failure + +From: Al Viro + +commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream. + +If we fail past the aio_setup_ring(), we need to destroy the +mapping. We don't need to care about anybody having found ctx, +or added requests to it, since the last failure exit is exactly +the failure to make ctx visible to lookups. + +Reproducer (based on one by Joe Mario ): + +void count(char *p) +{ + char s[80]; + printf("%s: ", p); + fflush(stdout); + sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'", getpid()); + system(s); +} + +int main() +{ + io_context_t *ctx; + int created, limit, i, destroyed; + FILE *f; + + count("before"); + if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL) + perror("opening aio-max-nr"); + else if (fscanf(f, "%d", &limit) != 1) + fprintf(stderr, "can't parse aio-max-nr\n"); + else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL) + perror("allocating aio_context_t array"); + else { + for (i = 0, created = 0; i < limit; i++) { + if (io_setup(1000, ctx + created) == 0) + created++; + } + for (i = 0, destroyed = 0; i < created; i++) + if (io_destroy(ctx[i]) == 0) + destroyed++; + printf("created %d, failed %d, destroyed %d\n", + created, limit - created, destroyed); + count("after"); + } +} + +Found-by: Joe Mario +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/aio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -740,6 +740,9 @@ static struct kioctx *ioctx_alloc(unsign + err_cleanup: + aio_nr_sub(ctx->max_reqs); + err_ctx: ++ atomic_set(&ctx->dead, 1); ++ if (ctx->mmap_size) ++ vm_munmap(ctx->mmap_base, ctx->mmap_size); + aio_free_ring(ctx); + err: + mutex_unlock(&ctx->ring_lock); diff --git a/queue-3.19/iscsi-target-fix-oops-when-adding-reject-pdu.patch b/queue-3.19/iscsi-target-fix-oops-when-adding-reject-pdu.patch new file mode 100644 index 00000000000..73ca6880d88 --- /dev/null +++ b/queue-3.19/iscsi-target-fix-oops-when-adding-reject-pdu.patch @@ -0,0 +1,38 @@ +From b815fc12d4dd2b5586184fb4f867caff05a810d4 Mon Sep 17 00:00:00 2001 +From: Mike Christie +Date: Fri, 10 Apr 2015 02:47:27 -0500 +Subject: iscsi target: fix oops when adding reject pdu + +From: Mike Christie + +commit b815fc12d4dd2b5586184fb4f867caff05a810d4 upstream. + +This fixes a oops due to a double list add when adding a reject PDU for +iscsit_allocate_iovecs allocation failures. The cmd has already been +added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call +iscsit_reject_cmd. + +Note that for ERL0 the reject PDU is not actually sent, so this patch +is not completely tested. Just verified we do not oops. The problem is the +add reject functions return -1 which is returned all the way up to +iscsi_target_rx_thread which for ERL0 will drop the connection. + +Signed-off-by: Mike Christie +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1185,7 +1185,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn + * traditional iSCSI block I/O. + */ + if (iscsit_allocate_iovecs(cmd) < 0) { +- return iscsit_add_reject_cmd(cmd, ++ return iscsit_reject_cmd(cmd, + ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); + } + immed_data = cmd->immediate_data; diff --git a/queue-3.19/media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch b/queue-3.19/media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch new file mode 100644 index 00000000000..80d36031ace --- /dev/null +++ b/queue-3.19/media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch @@ -0,0 +1,34 @@ +From 05b676ab42f624425d5f6519276e506b812fa058 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Wed, 4 Mar 2015 05:55:21 -0800 +Subject: [media] media: s5p-mfc: fix mmap support for 64bit arch + +From: Marek Szyprowski + +commit 05b676ab42f624425d5f6519276e506b812fa058 upstream. + +TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it +should not be used for defining offset boundary for mmaping buffers for +CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on +the CAPTURE queue on 64bit architectures (like ARM64). + +Signed-off-by: Marek Szyprowski +Signed-off-by: Kamil Debski +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/s5p-mfc/s5p_mfc_common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h +@@ -29,7 +29,7 @@ + + /* Offset base used to differentiate between CAPTURE and OUTPUT + * while mmaping */ +-#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2) ++#define DST_QUEUE_OFF_BASE (1 << 30) + + #define MFC_BANK1_ALLOC_CTX 0 + #define MFC_BANK2_ALLOC_CTX 1 diff --git a/queue-3.19/ocfs2-_really_-sync-the-right-range.patch b/queue-3.19/ocfs2-_really_-sync-the-right-range.patch new file mode 100644 index 00000000000..068243be054 --- /dev/null +++ b/queue-3.19/ocfs2-_really_-sync-the-right-range.patch @@ -0,0 +1,60 @@ +From 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Wed, 8 Apr 2015 17:00:32 -0400 +Subject: ocfs2: _really_ sync the right range + +From: Al Viro + +commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream. + +"ocfs2 syncs the wrong range" had been broken; prior to it the +code was doing the wrong thing in case of O_APPEND, all right, +but _after_ it we were syncing the wrong range in 100% cases. +*ppos, aka iocb->ki_pos is incremented prior to that point, +so we are always doing sync on the area _after_ the one we'd +written to. + +Spotted by Joseph Qi back in January; +unfortunately, I'd missed his mail back then ;-/ + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/file.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2374,10 +2374,14 @@ out_dio: + /* buffered aio wouldn't have proper lock coverage today */ + BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT)); + ++ if (unlikely(written <= 0)) ++ goto no_sync; ++ + if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || + ((file->f_flags & O_DIRECT) && !direct_io)) { +- ret = filemap_fdatawrite_range(file->f_mapping, *ppos, +- *ppos + count - 1); ++ ret = filemap_fdatawrite_range(file->f_mapping, ++ iocb->ki_pos - written, ++ iocb->ki_pos - 1); + if (ret < 0) + written = ret; + +@@ -2388,10 +2392,12 @@ out_dio: + } + + if (!ret) +- ret = filemap_fdatawait_range(file->f_mapping, *ppos, +- *ppos + count - 1); ++ ret = filemap_fdatawait_range(file->f_mapping, ++ iocb->ki_pos - written, ++ iocb->ki_pos - 1); + } + ++no_sync: + /* + * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io + * function pointer which is called when o_direct io completes so that diff --git a/queue-3.19/revert-libceph-use-memalloc-flags-for-net-io.patch b/queue-3.19/revert-libceph-use-memalloc-flags-for-net-io.patch new file mode 100644 index 00000000000..83cc375b641 --- /dev/null +++ b/queue-3.19/revert-libceph-use-memalloc-flags-for-net-io.patch @@ -0,0 +1,88 @@ +From 6d7fdb0ab351b33d4c12d53fe44be030b90fc9d4 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Thu, 2 Apr 2015 14:40:58 +0300 +Subject: Revert "libceph: use memalloc flags for net IO" + +From: Ilya Dryomov + +commit 6d7fdb0ab351b33d4c12d53fe44be030b90fc9d4 upstream. + +This reverts commit 89baaa570ab0b476db09408d209578cfed700e9f. + +Dirty page throttling should be sufficient for us in the general case +so there is no need to use __GFP_MEMALLOC - it would be needed only in +the swap-over-rbd case, which we currently don't support. (It would +probably take approximately the commit that is being reverted to add +that support, but we would also need the "swap" option to distinguish +from the general case and make sure swap ceph_client-s aren't shared +with anything else.) See ceph-devel threads [1] and [2] for the +details of why enabling pfmemalloc reserves for all cases is a bad +thing. + +On top of potential system lockups related to drained emergency +reserves, this turned out to cause ceph lockups in case peers are on +the same host and communicating via loopback due to sk_filter() +dropping pfmemalloc skbs on the receiving side because the receiving +loopback socket is not tagged with SOCK_MEMALLOC. + +[1] "SOCK_MEMALLOC vs loopback" + http://www.spinics.net/lists/ceph-devel/msg22998.html +[2] "[PATCH] libceph: don't set memalloc flags in loopback case" + http://www.spinics.net/lists/ceph-devel/msg23392.html + +Conflicts: + net/ceph/messenger.c [ context: tcp_nodelay option ] + +Cc: Mike Christie +Cc: Mel Gorman +Cc: Sage Weil +Signed-off-by: Ilya Dryomov +Acked-by: Mike Christie +Acked-by: Mel Gorman +Signed-off-by: Greg Kroah-Hartman + +--- + net/ceph/messenger.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_ + IPPROTO_TCP, &sock); + if (ret) + return ret; +- sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC; ++ sock->sk->sk_allocation = GFP_NOFS; + + #ifdef CONFIG_LOCKDEP + lockdep_set_class(&sock->sk->sk_lock, &socket_class); +@@ -510,8 +510,6 @@ static int ceph_tcp_connect(struct ceph_ + return ret; + } + +- sk_set_memalloc(sock->sk); +- + con->sock = sock; + return 0; + } +@@ -2798,11 +2796,8 @@ static void con_work(struct work_struct + { + struct ceph_connection *con = container_of(work, struct ceph_connection, + work.work); +- unsigned long pflags = current->flags; + bool fault; + +- current->flags |= PF_MEMALLOC; +- + mutex_lock(&con->mutex); + while (true) { + int ret; +@@ -2856,8 +2851,6 @@ static void con_work(struct work_struct + con_fault_finish(con); + + con->ops->put(con); +- +- tsk_restore_flags(current, pflags, PF_MEMALLOC); + } + + /* diff --git a/queue-3.19/revert-pm-hibernate-avoid-unsafe-pages-in-e820-reserved-regions.patch b/queue-3.19/revert-pm-hibernate-avoid-unsafe-pages-in-e820-reserved-regions.patch new file mode 100644 index 00000000000..97cb786cb82 --- /dev/null +++ b/queue-3.19/revert-pm-hibernate-avoid-unsafe-pages-in-e820-reserved-regions.patch @@ -0,0 +1,62 @@ +From f82daee49c09cf6a99c28303d93438a2566e5552 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 7 Apr 2015 01:07:39 +0200 +Subject: Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions" + +From: "Rafael J. Wysocki" + +commit f82daee49c09cf6a99c28303d93438a2566e5552 upstream. + +Commit 84c91b7ae07c (PM / hibernate: avoid unsafe pages in e820 reserved +regions) is reported to make resume from hibernation on Lenovo x230 +unreliable, so revert it. + +We will revisit the issue the commit in question was supposed to fix +in the future. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=96111 +Reported-by: rhn +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/power/snapshot.c | 21 +-------------------- + 1 file changed, 1 insertion(+), 20 deletions(-) + +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -955,25 +955,6 @@ static void mark_nosave_pages(struct mem + } + } + +-static bool is_nosave_page(unsigned long pfn) +-{ +- struct nosave_region *region; +- +- list_for_each_entry(region, &nosave_regions, list) { +- if (pfn >= region->start_pfn && pfn < region->end_pfn) { +- pr_err("PM: %#010llx in e820 nosave region: " +- "[mem %#010llx-%#010llx]\n", +- (unsigned long long) pfn << PAGE_SHIFT, +- (unsigned long long) region->start_pfn << PAGE_SHIFT, +- ((unsigned long long) region->end_pfn << PAGE_SHIFT) +- - 1); +- return true; +- } +- } +- +- return false; +-} +- + /** + * create_basic_memory_bitmaps - create bitmaps needed for marking page + * frames that should not be saved and free page frames. The pointers +@@ -2039,7 +2020,7 @@ static int mark_unsafe_pages(struct memo + do { + pfn = memory_bm_next_pfn(bm); + if (likely(pfn != BM_END_OF_MAP)) { +- if (likely(pfn_valid(pfn)) && !is_nosave_page(pfn)) ++ if (likely(pfn_valid(pfn))) + swsusp_set_page_free(pfn_to_page(pfn)); + else + return -EFAULT; diff --git a/queue-3.19/series b/queue-3.19/series index 0ad0e6cf01a..d24fefeb2db 100644 --- a/queue-3.19/series +++ b/queue-3.19/series @@ -79,3 +79,15 @@ brcmfmac-disable-mbss-feature-for-bcm43362.patch iommu-vt-d-detach-domain-only-from-attached-iommus.patch rtlwifi-fix-iommu-mapping-leak-in-ap-mode.patch drivers-of-add-empty-ranges-quirk-for-pa-semi.patch +revert-pm-hibernate-avoid-unsafe-pages-in-e820-reserved-regions.patch +revert-libceph-use-memalloc-flags-for-net-io.patch +be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch +ocfs2-_really_-sync-the-right-range.patch +ioctx_alloc-fix-vma-and-file-leak-on-failure.patch +iscsi-target-fix-oops-when-adding-reject-pdu.patch +sh_veu-v4l2_dev-wasn-t-set.patch +media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch +cx23885-fix-querycap.patch +soc-camera-fix-devm_kfree-in-soc_of_bind.patch +vb2-fix-dma_dir-setting-for-dma-contig-mem-type.patch +vb2-fix-unbalanced-warnings-when-calling-vb2_thread_stop.patch diff --git a/queue-3.19/sh_veu-v4l2_dev-wasn-t-set.patch b/queue-3.19/sh_veu-v4l2_dev-wasn-t-set.patch new file mode 100644 index 00000000000..ef1583e7f8c --- /dev/null +++ b/queue-3.19/sh_veu-v4l2_dev-wasn-t-set.patch @@ -0,0 +1,31 @@ +From ab3120300be067a2d41a027c41db0b2c662ab200 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 10 Dec 2014 12:35:34 -0300 +Subject: [media] sh_veu: v4l2_dev wasn't set + +From: Hans Verkuil + +commit ab3120300be067a2d41a027c41db0b2c662ab200 upstream. + +The v4l2_dev field of struct video_device must be set correctly. +This was never done for this driver, so no video nodes were created +anymore. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/sh_veu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/sh_veu.c ++++ b/drivers/media/platform/sh_veu.c +@@ -1179,6 +1179,7 @@ static int sh_veu_probe(struct platform_ + } + + *vdev = sh_veu_videodev; ++ vdev->v4l2_dev = &veu->v4l2_dev; + spin_lock_init(&veu->lock); + mutex_init(&veu->fop_lock); + vdev->lock = &veu->fop_lock; diff --git a/queue-3.19/soc-camera-fix-devm_kfree-in-soc_of_bind.patch b/queue-3.19/soc-camera-fix-devm_kfree-in-soc_of_bind.patch new file mode 100644 index 00000000000..04c207be79a --- /dev/null +++ b/queue-3.19/soc-camera-fix-devm_kfree-in-soc_of_bind.patch @@ -0,0 +1,84 @@ +From 8e48a2d54c5d74ea3e9dc4c3b9037786bb447f36 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 19 Feb 2015 06:47:16 -0300 +Subject: [media] soc-camera: Fix devm_kfree() in soc_of_bind() + +From: Geert Uytterhoeven + +commit 8e48a2d54c5d74ea3e9dc4c3b9037786bb447f36 upstream. + +Unlike scan_async_group(), soc_of_bind() doesn't allocate its +soc_camera_async_client structure using devm_kzalloc(), but has it +embedded inside the soc_of_info structure. Hence on failure, it must +free the whole soc_of_info structure, and not just the embedded +soc_camera_async_client structure, as the latter causes a warning, and +may cause slab corruption: + + soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 1 at drivers/base/devres.c:887 devm_kfree+0x30/0x40() + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.19.0-shmobile-08386-g37feb0d093cb2d8e #128 + Hardware name: Generic R8A7791 (Flattened Device Tree) + Backtrace: + [] (dump_backtrace) from [] (show_stack+0x18/0x1c) + r6:c05a923b r5:00000009 r4:00000000 r3:00204140 + [] (show_stack) from [] (dump_stack+0x78/0x94) + [] (dump_stack) from [] (warn_slowpath_common+0x8c/0xb8) + r4:00000000 r3:00000000 + [] (warn_slowpath_common) from [] (warn_slowpath_null+0x24/0x2c) + r8:ee7d8214 r7:ed83b810 r6:ed83bc20 r5:fffffffa r4:ed83e510 + [] (warn_slowpath_null) from [] (devm_kfree+0x30/0x40) + [] (devm_kfree) from [] (soc_of_bind.isra.14+0x194/0x1d4) + [] (soc_of_bind.isra.14) from [] (soc_camera_host_register+0x208/0x31c) + r9:00000070 r8:ee7e05d0 r7:ee153210 r6:00000000 r5:ee7e0218 r4:ed83bc20 + [] (soc_camera_host_register) from [] (rcar_vin_probe+0x1f4/0x238) + r8:ee153200 r7:00000008 r6:ee153210 r5:ed83bc10 r4:c066319c r3:000000c0 + [] (rcar_vin_probe) from [] (platform_drv_probe+0x50/0xa0) + r10:00000000 r9:c0662fa8 r8:00000000 r7:c06a3700 r6:c0662fa8 r5:ee153210 + r4:00000000 + [] (platform_drv_probe) from [] (driver_probe_device+0xc4/0x208) + r6:c06a36f4 r5:00000000 r4:ee153210 r3:c025c2e4 + [] (driver_probe_device) from [] (__driver_attach+0x70/0x94) + r9:c066f9c0 r8:c0624a98 r7:c065b790 r6:c0662fa8 r5:ee153244 r4:ee153210 + [] (__driver_attach) from [] (bus_for_each_dev+0x74/0x98) + r6:c025b098 r5:c0662fa8 r4:00000000 r3:00000001 + [] (bus_for_each_dev) from [] (driver_attach+0x20/0x28) + r6:ed83c200 r5:00000000 r4:c0662fa8 + [] (driver_attach) from [] (bus_add_driver+0xdc/0x1c4) + [] (bus_add_driver) from [] (driver_register+0xa4/0xe8) + r7:c0624a98 r6:00000000 r5:c060b010 r4:c0662fa8 + [] (driver_register) from [] (__platform_driver_register+0x50/0x64) + r5:c060b010 r4:ed8394c0 + [] (__platform_driver_register) from [] (rcar_vin_driver_init+0x18/0x20) + [] (rcar_vin_driver_init) from [] (do_one_initcall+0x108/0x1b8) + [] (do_one_initcall) from [] (kernel_init_freeable+0x11c/0x1e4) + r9:c066f9c0 r8:c066f9c0 r7:c062eab0 r6:c06252c4 r5:000000ad r4:00000006 + [] (kernel_init_freeable) from [] (kernel_init+0x10/0xec) + r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c048c3c0 r4:00000000 + [] (kernel_init) from [] (ret_from_fork+0x14/0x34) + r4:00000000 r3:ee04e000 + ---[ end trace e3a984cc0335c8a0 ]--- + rcar_vin e6ef1000.video: group probe failed: -6 + +Fixes: 1ddc6a6caa94e1e1 ("[media] soc_camera: add support for dt binding soc_camera drivers") + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/soc_camera/soc_camera.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/soc_camera/soc_camera.c ++++ b/drivers/media/platform/soc_camera/soc_camera.c +@@ -1681,7 +1681,7 @@ eclkreg: + eaddpdev: + platform_device_put(sasc->pdev); + eallocpdev: +- devm_kfree(ici->v4l2_dev.dev, sasc); ++ devm_kfree(ici->v4l2_dev.dev, info); + dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret); + + return ret; diff --git a/queue-3.19/vb2-fix-dma_dir-setting-for-dma-contig-mem-type.patch b/queue-3.19/vb2-fix-dma_dir-setting-for-dma-contig-mem-type.patch new file mode 100644 index 00000000000..cbf46581a2e --- /dev/null +++ b/queue-3.19/vb2-fix-dma_dir-setting-for-dma-contig-mem-type.patch @@ -0,0 +1,38 @@ +From 4879785ed511083676f27a016c9ad6c46c8e5737 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Fri, 13 Feb 2015 04:42:37 -0300 +Subject: [media] vb2: Fix dma_dir setting for dma-contig mem type + +From: Sakari Ailus + +commit 4879785ed511083676f27a016c9ad6c46c8e5737 upstream. + +The last argument of vb2_dc_get_user_pages() is of type enum +dma_data_direction, but the caller, vb2_dc_get_userptr() passes a value +which is the result of comparison dma_dir == DMA_FROM_DEVICE. This results +in the write parameter to get_user_pages() being zero in all cases, i.e. +that the caller has no intent to write there. + +This was broken by patch "vb2: replace 'write' by 'dma_dir'". + +Signed-off-by: Sakari Ailus +Acked-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-dma-contig.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c ++++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c +@@ -632,8 +632,7 @@ static void *vb2_dc_get_userptr(void *al + } + + /* extract page list from userspace mapping */ +- ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, +- dma_dir == DMA_FROM_DEVICE); ++ ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, dma_dir); + if (ret) { + unsigned long pfn; + if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) { diff --git a/queue-3.19/vb2-fix-unbalanced-warnings-when-calling-vb2_thread_stop.patch b/queue-3.19/vb2-fix-unbalanced-warnings-when-calling-vb2_thread_stop.patch new file mode 100644 index 00000000000..4aa19c85996 --- /dev/null +++ b/queue-3.19/vb2-fix-unbalanced-warnings-when-calling-vb2_thread_stop.patch @@ -0,0 +1,67 @@ +From 0e661006370b7e7fb9ac9d94f9c3500a62cd559b Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Mon, 16 Feb 2015 07:49:07 -0300 +Subject: [media] vb2: fix 'UNBALANCED' warnings when calling vb2_thread_stop() + +From: Hans Verkuil + +commit 0e661006370b7e7fb9ac9d94f9c3500a62cd559b upstream. + +Stopping the vb2 thread (as used by several DVB devices) can result +in an 'UNBALANCED' warning such as this: + +vb2: counters for queue ffff880407ee9828: UNBALANCED! +vb2: setup: 1 start_streaming: 1 stop_streaming: 1 +vb2: wait_prepare: 249333 wait_finish: 249334 + +This is due to a race condition between stopping the thread and +calling vb2_internal_streamoff(). While I have not been able to deduce +the exact mechanism how this race condition can produce this warning, +I can see that the way the stream is stopped is likely to lead to a +race somewhere. + +This patch simplifies how this is done by first ensuring that the +thread is completely stopped before cleaning up the vb2 queue. It +does that by setting threadio->stop to true, followed by a call to +vb2_queue_error() which will wake up the thread. The thread sees that +'stop' is true and it will exit. + +The call to kthread_stop() waits until the thread has exited, and only +then is the queue cleaned up by calling __vb2_cleanup_fileio(). + +This is a much cleaner sequence and the warning has now disappeared. + +Reported-by: Jurgen Kramer +Tested-by: Jurgen Kramer +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-core.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -3230,18 +3230,13 @@ int vb2_thread_stop(struct vb2_queue *q) + + if (threadio == NULL) + return 0; +- call_void_qop(q, wait_finish, q); + threadio->stop = true; +- vb2_internal_streamoff(q, q->type); +- call_void_qop(q, wait_prepare, q); ++ /* Wake up all pending sleeps in the thread */ ++ vb2_queue_error(q); + err = kthread_stop(threadio->thread); +- q->fileio = NULL; +- fileio->req.count = 0; +- vb2_reqbufs(q, &fileio->req); +- kfree(fileio); ++ __vb2_cleanup_fileio(q); + threadio->thread = NULL; + kfree(threadio); +- q->fileio = NULL; + q->threadio = NULL; + return err; + }