From: Greg Kroah-Hartman Date: Sat, 19 Sep 2015 03:33:46 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.10.89~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c4a4db24ea806c12615cd7517badd62154945f9b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: auxdisplay-ks0108-fix-refcount.patch devres-fix-devres_get.patch of-address-don-t-loop-forever-in-of_find_matching_node_by_address.patch xtensa-fix-kernel-register-spilling.patch xtensa-fix-threadptr-reload-on-return-to-userspace.patch --- diff --git a/queue-3.10/auxdisplay-ks0108-fix-refcount.patch b/queue-3.10/auxdisplay-ks0108-fix-refcount.patch new file mode 100644 index 00000000000..6017934a96b --- /dev/null +++ b/queue-3.10/auxdisplay-ks0108-fix-refcount.patch @@ -0,0 +1,33 @@ +From bab383de3b84e584b0f09227151020b2a43dc34c Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee +Date: Mon, 20 Jul 2015 17:27:21 +0530 +Subject: auxdisplay: ks0108: fix refcount + +From: Sudip Mukherjee + +commit bab383de3b84e584b0f09227151020b2a43dc34c upstream. + +parport_find_base() will implicitly do parport_get_port() which +increases the refcount. Then parport_register_device() will again +increment the refcount. But while unloading the module we are only +doing parport_unregister_device() decrementing the refcount only once. +We add an parport_put_port() to neutralize the effect of +parport_get_port(). + +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/auxdisplay/ks0108.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/auxdisplay/ks0108.c ++++ b/drivers/auxdisplay/ks0108.c +@@ -139,6 +139,7 @@ static int __init ks0108_init(void) + + ks0108_pardevice = parport_register_device(ks0108_parport, KS0108_NAME, + NULL, NULL, NULL, PARPORT_DEV_EXCL, NULL); ++ parport_put_port(ks0108_parport); + if (ks0108_pardevice == NULL) { + printk(KERN_ERR KS0108_NAME ": ERROR: " + "parport didn't register new device\n"); diff --git a/queue-3.10/devres-fix-devres_get.patch b/queue-3.10/devres-fix-devres_get.patch new file mode 100644 index 00000000000..2dfefc4daf6 --- /dev/null +++ b/queue-3.10/devres-fix-devres_get.patch @@ -0,0 +1,36 @@ +From 64526370d11ce8868ca495723d595b61e8697fbf Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Wed, 15 Jul 2015 10:29:00 +0900 +Subject: devres: fix devres_get() + +From: Masahiro Yamada + +commit 64526370d11ce8868ca495723d595b61e8697fbf upstream. + +Currently, devres_get() passes devres_free() the pointer to devres, +but devres_free() should be given with the pointer to resource data. + +Fixes: 9ac7849e35f7 ("devres: device resource management") +Signed-off-by: Masahiro Yamada +Acked-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/devres.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/base/devres.c ++++ b/drivers/base/devres.c +@@ -296,10 +296,10 @@ void * devres_get(struct device *dev, vo + if (!dr) { + add_dr(dev, &new_dr->node); + dr = new_dr; +- new_dr = NULL; ++ new_res = NULL; + } + spin_unlock_irqrestore(&dev->devres_lock, flags); +- devres_free(new_dr); ++ devres_free(new_res); + + return dr->data; + } diff --git a/queue-3.10/of-address-don-t-loop-forever-in-of_find_matching_node_by_address.patch b/queue-3.10/of-address-don-t-loop-forever-in-of_find_matching_node_by_address.patch new file mode 100644 index 00000000000..b8526b6717c --- /dev/null +++ b/queue-3.10/of-address-don-t-loop-forever-in-of_find_matching_node_by_address.patch @@ -0,0 +1,41 @@ +From 3a496b00b6f90c41bd21a410871dfc97d4f3c7ab Mon Sep 17 00:00:00 2001 +From: David Daney +Date: Wed, 19 Aug 2015 13:17:47 -0700 +Subject: of/address: Don't loop forever in of_find_matching_node_by_address(). + +From: David Daney + +commit 3a496b00b6f90c41bd21a410871dfc97d4f3c7ab upstream. + +If the internal call to of_address_to_resource() fails, we end up +looping forever in of_find_matching_node_by_address(). This can be +caused by a defective device tree, or calling with an incorrect +matches argument. + +Fix by calling of_find_matching_node() unconditionally at the end of +the loop. + +Signed-off-by: David Daney +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/of/address.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -629,10 +629,10 @@ struct device_node *of_find_matching_nod + struct resource res; + + while (dn) { +- if (of_address_to_resource(dn, 0, &res)) +- continue; +- if (res.start == base_address) ++ if (!of_address_to_resource(dn, 0, &res) && ++ res.start == base_address) + return dn; ++ + dn = of_find_matching_node(dn, matches); + } + diff --git a/queue-3.10/series b/queue-3.10/series index 67ef3a6cd8f..fba0ddeb437 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -11,3 +11,8 @@ usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch serial-8250-don-t-bind-to-smsc-ircc-ir-port.patch crypto-ghash-clmulni-specify-context-size-for-ghash-async-algorithm.patch hid-usbhid-fix-the-check-for-hid_reset_pending-in-hid_io_error.patch +xtensa-fix-threadptr-reload-on-return-to-userspace.patch +xtensa-fix-kernel-register-spilling.patch +devres-fix-devres_get.patch +auxdisplay-ks0108-fix-refcount.patch +of-address-don-t-loop-forever-in-of_find_matching_node_by_address.patch diff --git a/queue-3.10/xtensa-fix-kernel-register-spilling.patch b/queue-3.10/xtensa-fix-kernel-register-spilling.patch new file mode 100644 index 00000000000..b8d9351178f --- /dev/null +++ b/queue-3.10/xtensa-fix-kernel-register-spilling.patch @@ -0,0 +1,98 @@ +From 77d6273e79e3a86552fcf10cdd31a69b46ed2ce6 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Thu, 16 Jul 2015 10:41:02 +0300 +Subject: xtensa: fix kernel register spilling + +From: Max Filippov + +commit 77d6273e79e3a86552fcf10cdd31a69b46ed2ce6 upstream. + +call12 can't be safely used as the first call in the inline function, +because the compiler does not extend the stack frame of the bounding +function accordingly, which may result in corruption of local variables. + +If a call needs to be done, do call8 first followed by call12. + +For pure assembly code in _switch_to increase stack frame size of the +bounding function. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/include/asm/traps.h | 29 +++++++++++++++++++---------- + arch/xtensa/kernel/entry.S | 4 ++-- + 2 files changed, 21 insertions(+), 12 deletions(-) + +--- a/arch/xtensa/include/asm/traps.h ++++ b/arch/xtensa/include/asm/traps.h +@@ -24,30 +24,39 @@ static inline void spill_registers(void) + { + #if XCHAL_NUM_AREGS > 16 + __asm__ __volatile__ ( +- " call12 1f\n" ++ " call8 1f\n" + " _j 2f\n" + " retw\n" + " .align 4\n" + "1:\n" ++#if XCHAL_NUM_AREGS == 32 ++ " _entry a1, 32\n" ++ " addi a8, a0, 3\n" ++ " _entry a1, 16\n" ++ " mov a12, a12\n" ++ " retw\n" ++#else + " _entry a1, 48\n" +- " addi a12, a0, 3\n" +-#if XCHAL_NUM_AREGS > 32 +- " .rept (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n" ++ " call12 1f\n" ++ " retw\n" ++ " .align 4\n" ++ "1:\n" ++ " .rept (" __stringify(XCHAL_NUM_AREGS) " - 16) / 12\n" + " _entry a1, 48\n" + " mov a12, a0\n" + " .endr\n" +-#endif +- " _entry a1, 48\n" ++ " _entry a1, 16\n" + #if XCHAL_NUM_AREGS % 12 == 0 +- " mov a8, a8\n" +-#elif XCHAL_NUM_AREGS % 12 == 4 + " mov a12, a12\n" +-#elif XCHAL_NUM_AREGS % 12 == 8 ++#elif XCHAL_NUM_AREGS % 12 == 4 + " mov a4, a4\n" ++#elif XCHAL_NUM_AREGS % 12 == 8 ++ " mov a8, a8\n" + #endif + " retw\n" ++#endif + "2:\n" +- : : : "a12", "a13", "memory"); ++ : : : "a8", "a9", "memory"); + #else + __asm__ __volatile__ ( + " mov a12, a12\n" +--- a/arch/xtensa/kernel/entry.S ++++ b/arch/xtensa/kernel/entry.S +@@ -1934,7 +1934,7 @@ ENDPROC(system_call) + mov a12, a0 + .endr + #endif +- _entry a1, 48 ++ _entry a1, 16 + #if XCHAL_NUM_AREGS % 12 == 0 + mov a8, a8 + #elif XCHAL_NUM_AREGS % 12 == 4 +@@ -1958,7 +1958,7 @@ ENDPROC(system_call) + + ENTRY(_switch_to) + +- entry a1, 16 ++ entry a1, 48 + + mov a11, a3 # and 'next' (a3) + diff --git a/queue-3.10/xtensa-fix-threadptr-reload-on-return-to-userspace.patch b/queue-3.10/xtensa-fix-threadptr-reload-on-return-to-userspace.patch new file mode 100644 index 00000000000..8f736b32269 --- /dev/null +++ b/queue-3.10/xtensa-fix-threadptr-reload-on-return-to-userspace.patch @@ -0,0 +1,39 @@ +From 4229fb12a03e5da5882b420b0aa4a02e77447b86 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Sat, 4 Jul 2015 15:27:39 +0300 +Subject: xtensa: fix threadptr reload on return to userspace + +From: Max Filippov + +commit 4229fb12a03e5da5882b420b0aa4a02e77447b86 upstream. + +Userspace return code may skip restoring THREADPTR register if there are +no registers that need to be zeroed. This leads to spurious failures in +libc NPTL tests. + +Always restore THREADPTR on return to userspace. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/kernel/entry.S | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/xtensa/kernel/entry.S ++++ b/arch/xtensa/kernel/entry.S +@@ -549,12 +549,13 @@ user_exception_exit: + * (if we have restored WSBITS-1 frames). + */ + ++2: + #if XCHAL_HAVE_THREADPTR + l32i a3, a1, PT_THREADPTR + wur a3, threadptr + #endif + +-2: j common_exception_exit ++ j common_exception_exit + + /* This is the kernel exception exit. + * We avoided to do a MOVSP when we entered the exception, but we