From: Greg Kroah-Hartman Date: Fri, 15 May 2015 19:48:14 +0000 (-0700) Subject: 4.0-stable patches X-Git-Tag: v3.10.79~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ed36ea92c74555ca4d2ffb8cb50d146a7e4cdb51;p=thirdparty%2Fkernel%2Fstable-queue.git 4.0-stable patches added patches: acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch coredump-accept-any-write-method.patch sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch --- diff --git a/queue-4.0/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch b/queue-4.0/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch new file mode 100644 index 00000000000..093fd29fe49 --- /dev/null +++ b/queue-4.0/acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch @@ -0,0 +1,86 @@ +From f254e3c57b9d952e987502aefa0804c177dd2503 Mon Sep 17 00:00:00 2001 +From: Lv Zheng +Date: Mon, 13 Apr 2015 11:48:18 +0800 +Subject: ACPICA: Tables: Change acpi_find_root_pointer() to use acpi_physical_address. + +From: Lv Zheng + +commit f254e3c57b9d952e987502aefa0804c177dd2503 upstream. + +ACPICA commit 7d9fd64397d7c38899d3dc497525f6e6b044e0e3 + +OSPMs like Linux expect an acpi_physical_address returning value from +acpi_find_root_pointer(). This triggers warnings if sizeof (acpi_size) doesn't +equal to sizeof (acpi_physical_address): + drivers/acpi/osl.c:275:3: warning: passing argument 1 of 'acpi_find_root_pointer' from incompatible pointer type [enabled by default] + In file included from include/acpi/acpi.h:64:0, + from include/linux/acpi.h:36, + from drivers/acpi/osl.c:41: + include/acpi/acpixf.h:433:1: note: expected 'acpi_size *' but argument is of type 'acpi_physical_address *' +This patch corrects acpi_find_root_pointer(). + +Link: https://github.com/acpica/acpica/commit/7d9fd643 +Signed-off-by: Lv Zheng +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Dirk Behme +Signed-off-by: George G. Davis +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/tbxfroot.c | 7 ++++--- + include/acpi/acpixf.h | 12 ++++++------ + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/acpi/acpica/tbxfroot.c ++++ b/drivers/acpi/acpica/tbxfroot.c +@@ -142,7 +142,7 @@ acpi_status acpi_tb_validate_rsdp(struct + * + ******************************************************************************/ + +-acpi_status __init acpi_find_root_pointer(acpi_size *table_address) ++acpi_status __init acpi_find_root_pointer(acpi_physical_address * table_address) + { + u8 *table_ptr; + u8 *mem_rover; +@@ -200,7 +200,8 @@ acpi_status __init acpi_find_root_pointe + physical_address += + (u32) ACPI_PTR_DIFF(mem_rover, table_ptr); + +- *table_address = physical_address; ++ *table_address = ++ (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + } +@@ -233,7 +234,7 @@ acpi_status __init acpi_find_root_pointe + (ACPI_HI_RSDP_WINDOW_BASE + + ACPI_PTR_DIFF(mem_rover, table_ptr)); + +- *table_address = physical_address; ++ *table_address = (acpi_physical_address) physical_address; + return_ACPI_STATUS(AE_OK); + } + +--- a/include/acpi/acpixf.h ++++ b/include/acpi/acpixf.h +@@ -431,13 +431,13 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_status + ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init acpi_reallocate_root_table(void)) + + ACPI_EXTERNAL_RETURN_STATUS(acpi_status __init +- acpi_find_root_pointer(acpi_size * rsdp_address)) +- ++ acpi_find_root_pointer(acpi_physical_address * ++ rsdp_address)) + ACPI_EXTERNAL_RETURN_STATUS(acpi_status +- acpi_get_table_header(acpi_string signature, +- u32 instance, +- struct acpi_table_header +- *out_table_header)) ++ acpi_get_table_header(acpi_string signature, ++ u32 instance, ++ struct acpi_table_header ++ *out_table_header)) + ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_get_table(acpi_string signature, u32 instance, + struct acpi_table_header diff --git a/queue-4.0/coredump-accept-any-write-method.patch b/queue-4.0/coredump-accept-any-write-method.patch new file mode 100644 index 00000000000..ebc0f2f76ba --- /dev/null +++ b/queue-4.0/coredump-accept-any-write-method.patch @@ -0,0 +1,27 @@ +From 86cc05840a0da1afcb6b8151b53f3b606457c91b Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Fri, 3 Apr 2015 15:23:17 -0400 +Subject: coredump: accept any write method + +From: Al Viro + +commit 86cc05840a0da1afcb6b8151b53f3b606457c91b upstream. + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/coredump.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -657,7 +657,7 @@ void do_coredump(const siginfo_t *siginf + */ + if (!uid_eq(inode->i_uid, current_fsuid())) + goto close_fail; +- if (!cprm.file->f_op->write) ++ if (!(cprm.file->f_mode & FMODE_CAN_WRITE)) + goto close_fail; + if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file)) + goto close_fail; diff --git a/queue-4.0/series b/queue-4.0/series index 002edea5a27..bec10957fab 100644 --- a/queue-4.0/series +++ b/queue-4.0/series @@ -52,3 +52,6 @@ mmc-card-don-t-access-rpmb-partitions-for-normal-read-write.patch mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch mmc-sh_mmcif-fix-timeout-value-for-command-request.patch arm-8307-1-psci-move-psci-firmware-calls-out-of-line.patch +sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch +coredump-accept-any-write-method.patch +acpica-tables-change-acpi_find_root_pointer-to-use-acpi_physical_address.patch diff --git a/queue-4.0/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch b/queue-4.0/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch new file mode 100644 index 00000000000..7e3daad8257 --- /dev/null +++ b/queue-4.0/sound-oss-fix-deadlock-in-sequencer_ioctl-sndctl_seq_outofband.patch @@ -0,0 +1,83 @@ +From bc26d4d06e337ade069f33d3f4377593b24e6e36 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Sat, 18 Apr 2015 02:53:25 +0300 +Subject: sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND) + +From: Alexey Khoroshilov + +commit bc26d4d06e337ade069f33d3f4377593b24e6e36 upstream. + +A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND) +on /dev/sequencer with TMR_ECHO midi event. + +In this case the control flow is: +sound_ioctl() +-> case SND_DEV_SEQ: + case SND_DEV_SEQ2: + sequencer_ioctl() + -> case SNDCTL_SEQ_OUTOFBAND: + spin_lock_irqsave(&lock,flags); + play_event(); + -> case EV_TIMING: + seq_timing_event() + -> case TMR_ECHO: + seq_copy_to_input() + -> spin_lock_irqsave(&lock,flags); + +It seems that spin_lock_irqsave() around play_event() is not necessary, +because the only other call location in seq_startplay() makes the call +without acquiring spinlock. + +So, the patch just removes spinlocks around play_event(). +By the way, it removes unreachable code in seq_timing_event(), +since (seq_mode == SEQ_2) case is handled in the beginning. + +Compile tested only. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Takashi Iwai +Cc: Willy Tarreau +Signed-off-by: Greg Kroah-Hartman + +--- + sound/oss/sequencer.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/sound/oss/sequencer.c ++++ b/sound/oss/sequencer.c +@@ -681,13 +681,8 @@ static int seq_timing_event(unsigned cha + break; + + case TMR_ECHO: +- if (seq_mode == SEQ_2) +- seq_copy_to_input(event_rec, 8); +- else +- { +- parm = (parm << 8 | SEQ_ECHO); +- seq_copy_to_input((unsigned char *) &parm, 4); +- } ++ parm = (parm << 8 | SEQ_ECHO); ++ seq_copy_to_input((unsigned char *) &parm, 4); + break; + + default:; +@@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file + int mode = translate_mode(file); + struct synth_info inf; + struct seq_event_rec event_rec; +- unsigned long flags; + int __user *p = arg; + + orig_dev = dev = dev >> 4; +@@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file + case SNDCTL_SEQ_OUTOFBAND: + if (copy_from_user(&event_rec, arg, sizeof(event_rec))) + return -EFAULT; +- spin_lock_irqsave(&lock,flags); + play_event(event_rec.arr); +- spin_unlock_irqrestore(&lock,flags); + return 0; + + case SNDCTL_MIDI_INFO: