From: Greg Kroah-Hartman Date: Fri, 1 Mar 2013 19:14:35 +0000 (-0800) Subject: 3.8-stable patches X-Git-Tag: v3.8.2~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fa0b57a75ea11371cd0e8abce60c44f0b344d07d;p=thirdparty%2Fkernel%2Fstable-queue.git 3.8-stable patches added patches: ab8500_btemp-demote-initcall-sequence.patch ab8500-chargalg-only-root-should-have-write-permission-on-sysfs-file.patch acpi-add-dmi-entry-for-sony-vgn-fw41e_h.patch bq27x00_battery-fix-bugs-introduced-with-bq27425-support.patch cgroup-fix-exit-vs-rmdir-race.patch cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch pstore-avoid-deadlock-in-panic-and-emergency-restart-path.patch --- diff --git a/queue-3.8/ab8500-chargalg-only-root-should-have-write-permission-on-sysfs-file.patch b/queue-3.8/ab8500-chargalg-only-root-should-have-write-permission-on-sysfs-file.patch new file mode 100644 index 00000000000..a8e2cf09d2e --- /dev/null +++ b/queue-3.8/ab8500-chargalg-only-root-should-have-write-permission-on-sysfs-file.patch @@ -0,0 +1,29 @@ +From e3455002d04276c256a531f7175dce0f7d1cb78a Mon Sep 17 00:00:00 2001 +From: Lee Jones +Date: Thu, 17 Jan 2013 14:21:53 +0000 +Subject: ab8500-chargalg: Only root should have write permission on sysfs file + +From: Lee Jones + +commit e3455002d04276c256a531f7175dce0f7d1cb78a upstream. + +Only root should have write permission on sysfs file ab8500_chargalg/chargalg. + +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/abx500_chargalg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/abx500_chargalg.c ++++ b/drivers/power/abx500_chargalg.c +@@ -1698,7 +1698,7 @@ static ssize_t abx500_chargalg_sysfs_cha + static struct attribute abx500_chargalg_en_charger = \ + { + .name = "chargalg", +- .mode = S_IWUGO, ++ .mode = S_IWUSR, + }; + + static struct attribute *abx500_chargalg_chg[] = { diff --git a/queue-3.8/ab8500_btemp-demote-initcall-sequence.patch b/queue-3.8/ab8500_btemp-demote-initcall-sequence.patch new file mode 100644 index 00000000000..5ca8a6fe83b --- /dev/null +++ b/queue-3.8/ab8500_btemp-demote-initcall-sequence.patch @@ -0,0 +1,71 @@ +From eeb0751c99522a4d1bbcc7b6bc1460cd07d07488 Mon Sep 17 00:00:00 2001 +From: "Rajanikanth H.V" +Date: Wed, 23 Jan 2013 09:56:45 +0530 +Subject: ab8500_btemp: Demote initcall sequence + +From: "Rajanikanth H.V" + +commit eeb0751c99522a4d1bbcc7b6bc1460cd07d07488 upstream. + +Power supply subsystem creates thermal zone device for the property +'POWER_SUPPLY_PROP_TEMP' which requires thermal subsystem to be ready +before 'ab8500 battery temperature monitor' driver is initialized. ab8500 +btemp driver is initialized with subsys_initcall whereas thermal subsystem +is initialized with fs_initcall which causes +thermal_zone_device_register(...) to crash since the required structure +'thermal_class' is not initialized yet: + +Unable to handle kernel NULL pointer dereference at virtual address 000000a4 +pgd = c0004000 +[000000a4] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT SMP ARM +Modules linked in: +CPU: 0 Tainted: G W (3.8.0-rc4-00001-g632fda8-dirty #1) +PC is at _raw_spin_lock+0x18/0x54 +LR is at get_device_parent+0x50/0x1b8 +pc : [] lr : [] psr: 60000013 +sp : ef04bdc8 ip : 00000000 fp : c0446180 +r10: ef216e38 r9 : c03af5d0 r8 : ef275c18 +r7 : 00000000 r6 : c0476c14 r5 : ef275c18 r4 : ef095840 +r3 : ef04a000 r2 : 00000001 r1 : 00000000 r0 : 000000a4 +Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 10c5787d Table: 0000404a DAC: 00000015 +Process swapper/0 (pid: 1, stack limit = 0xef04a238) +Stack: (0xef04bdc8 to 0xef04c000) +[...] +[] (_raw_spin_lock+0x18/0x54) from [] (get_device_parent+0x50/0x1b8) +[] (get_device_parent+0x50/0x1b8) from [] (device_add+0xa4/0x574) +[] (device_add+0xa4/0x574) from [] (thermal_zone_device_register+0x118/0x938) +[] (thermal_zone_device_register+0x118/0x938) from [] (power_supply_register+0x170/0x1f8) +[] (power_supply_register+0x170/0x1f8) from [] (ab8500_btemp_probe+0x208/0x47c) +[] (ab8500_btemp_probe+0x208/0x47c) from [] (platform_drv_probe+0x14/0x18) +[] (platform_drv_probe+0x14/0x18) from [] (driver_probe_device+0x74/0x20c) +[] (driver_probe_device+0x74/0x20c) from [] (__driver_attach+0x8c/0x90) +[] (__driver_attach+0x8c/0x90) from [] (bus_for_each_dev+0x4c/0x80) +[] (bus_for_each_dev+0x4c/0x80) from [] (bus_add_driver+0x16c/0x23c) +[] (bus_add_driver+0x16c/0x23c) from [] (driver_register+0x78/0x14c) +[] (driver_register+0x78/0x14c) from [] (do_one_initcall+0xfc/0x164) +[] (do_one_initcall+0xfc/0x164) from [] (kernel_init+0x120/0x2b8) +[] (kernel_init+0x120/0x2b8) from [] (ret_from_fork+0x14/0x3c) +Code: e3c3303f e5932004 e2822001 e5832004 (e1903f9f) +---[ end trace ed9df72941b5bada ]--- + +Signed-off-by: Rajanikanth H.V +Signed-off-by: Anton Vorontsov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/ab8500_btemp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/ab8500_btemp.c ++++ b/drivers/power/ab8500_btemp.c +@@ -1123,7 +1123,7 @@ static void __exit ab8500_btemp_exit(voi + platform_driver_unregister(&ab8500_btemp_driver); + } + +-subsys_initcall_sync(ab8500_btemp_init); ++device_initcall(ab8500_btemp_init); + module_exit(ab8500_btemp_exit); + + MODULE_LICENSE("GPL v2"); diff --git a/queue-3.8/acpi-add-dmi-entry-for-sony-vgn-fw41e_h.patch b/queue-3.8/acpi-add-dmi-entry-for-sony-vgn-fw41e_h.patch new file mode 100644 index 00000000000..4b7f4051fb7 --- /dev/null +++ b/queue-3.8/acpi-add-dmi-entry-for-sony-vgn-fw41e_h.patch @@ -0,0 +1,38 @@ +From 66f2fda93b67fa744d406e6dcf443f67bac204b6 Mon Sep 17 00:00:00 2001 +From: Joseph Salisbury +Date: Tue, 5 Feb 2013 00:16:29 +0000 +Subject: ACPI: Add DMI entry for Sony VGN-FW41E_H + +From: Joseph Salisbury + +commit 66f2fda93b67fa744d406e6dcf443f67bac204b6 upstream. + +This patch adds a quirk to allow the Sony VGN-FW41E_H to suspend/resume +properly. + +References: http://bugs.launchpad.net/bugs/1113547 +Signed-off-by: Joseph Salisbury +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sleep.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -177,6 +177,14 @@ static struct dmi_system_id __initdata a + }, + { + .callback = init_nvs_nosave, ++ .ident = "Sony Vaio VGN-FW41E_H", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW41E_H"), ++ }, ++ }, ++ { ++ .callback = init_nvs_nosave, + .ident = "Sony Vaio VGN-FW21E", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), diff --git a/queue-3.8/bq27x00_battery-fix-bugs-introduced-with-bq27425-support.patch b/queue-3.8/bq27x00_battery-fix-bugs-introduced-with-bq27425-support.patch new file mode 100644 index 00000000000..91ab19282d2 --- /dev/null +++ b/queue-3.8/bq27x00_battery-fix-bugs-introduced-with-bq27425-support.patch @@ -0,0 +1,48 @@ +From bde83b9a6b44c1e0fd872e57ecc869cfcf88538f Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Sun, 2 Dec 2012 20:34:21 +1100 +Subject: bq27x00_battery: Fix bugs introduced with BQ27425 support + +From: NeilBrown + +commit bde83b9a6b44c1e0fd872e57ecc869cfcf88538f upstream. + +commit a66f59ba2e994bf70274ef0513e24e0e7ae20c63 + + bq27x00_battery: Add support for BQ27425 chip + +introduced 2 bugs. + +1/ 'chip' was set to BQ27425 unconditionally - breaking support for + other devices; + +2/ BQ27425 does not support cycle count, how the code still tries to + get the cycle count for BQ27425, and now does it twice for other chips. + +Signed-off-by: NeilBrown +Cc: Saranya Gopal +Signed-off-by: Anton Vorontsov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/bq27x00_battery.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/power/bq27x00_battery.c ++++ b/drivers/power/bq27x00_battery.c +@@ -448,7 +448,6 @@ static void bq27x00_update(struct bq27x0 + cache.temperature = bq27x00_battery_read_temperature(di); + if (!is_bq27425) + cache.cycle_count = bq27x00_battery_read_cyct(di); +- cache.cycle_count = bq27x00_battery_read_cyct(di); + cache.power_avg = + bq27x00_battery_read_pwr_avg(di, BQ27x00_POWER_AVG); + +@@ -696,7 +695,6 @@ static int bq27x00_powersupply_init(stru + int ret; + + di->bat.type = POWER_SUPPLY_TYPE_BATTERY; +- di->chip = BQ27425; + if (di->chip == BQ27425) { + di->bat.properties = bq27425_battery_props; + di->bat.num_properties = ARRAY_SIZE(bq27425_battery_props); diff --git a/queue-3.8/cgroup-fix-exit-vs-rmdir-race.patch b/queue-3.8/cgroup-fix-exit-vs-rmdir-race.patch new file mode 100644 index 00000000000..05652f02ca3 --- /dev/null +++ b/queue-3.8/cgroup-fix-exit-vs-rmdir-race.patch @@ -0,0 +1,55 @@ +From 71b5707e119653039e6e95213f00479668c79b75 Mon Sep 17 00:00:00 2001 +From: Li Zefan +Date: Thu, 24 Jan 2013 14:43:28 +0800 +Subject: cgroup: fix exit() vs rmdir() race + +From: Li Zefan + +commit 71b5707e119653039e6e95213f00479668c79b75 upstream. + +In cgroup_exit() put_css_set_taskexit() is called without any lock, +which might lead to accessing a freed cgroup: + +thread1 thread2 +--------------------------------------------- +exit() + cgroup_exit() + put_css_set_taskexit() + atomic_dec(cgrp->count); + rmdir(); + /* not safe !! */ + check_for_release(cgrp); + +rcu_read_lock() can be used to make sure the cgroup is alive. + +Signed-off-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -426,12 +426,20 @@ static void __put_css_set(struct css_set + struct cgroup *cgrp = link->cgrp; + list_del(&link->cg_link_list); + list_del(&link->cgrp_link_list); ++ ++ /* ++ * We may not be holding cgroup_mutex, and if cgrp->count is ++ * dropped to 0 the cgroup can be destroyed at any time, hence ++ * rcu_read_lock is used to keep it alive. ++ */ ++ rcu_read_lock(); + if (atomic_dec_and_test(&cgrp->count) && + notify_on_release(cgrp)) { + if (taskexit) + set_bit(CGRP_RELEASABLE, &cgrp->flags); + check_for_release(cgrp); + } ++ rcu_read_unlock(); + + kfree(link); + } diff --git a/queue-3.8/cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch b/queue-3.8/cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch new file mode 100644 index 00000000000..e48cdaba295 --- /dev/null +++ b/queue-3.8/cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch @@ -0,0 +1,47 @@ +From 63f43f55c9bbc14f76b582644019b8a07dc8219a Mon Sep 17 00:00:00 2001 +From: Li Zefan +Date: Fri, 25 Jan 2013 16:08:01 +0800 +Subject: cpuset: fix cpuset_print_task_mems_allowed() vs rename() race + +From: Li Zefan + +commit 63f43f55c9bbc14f76b582644019b8a07dc8219a upstream. + +rename() will change dentry->d_name. The result of this race can +be worse than seeing partially rewritten name, but we might access +a stale pointer because rename() will re-allocate memory to hold +a longer name. + +It's safe in the protection of dentry->d_lock. + +v2: check NULL dentry before acquiring dentry lock. + +Signed-off-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cpuset.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2511,8 +2511,16 @@ void cpuset_print_task_mems_allowed(stru + + dentry = task_cs(tsk)->css.cgroup->dentry; + spin_lock(&cpuset_buffer_lock); +- snprintf(cpuset_name, CPUSET_NAME_LEN, +- dentry ? (const char *)dentry->d_name.name : "/"); ++ ++ if (!dentry) { ++ strcpy(cpuset_name, "/"); ++ } else { ++ spin_lock(&dentry->d_lock); ++ strlcpy(cpuset_name, (const char *)dentry->d_name.name, ++ CPUSET_NAME_LEN); ++ spin_unlock(&dentry->d_lock); ++ } ++ + nodelist_scnprintf(cpuset_nodelist, CPUSET_NODELIST_LEN, + tsk->mems_allowed); + printk(KERN_INFO "%s cpuset=%s mems_allowed=%s\n", diff --git a/queue-3.8/pstore-avoid-deadlock-in-panic-and-emergency-restart-path.patch b/queue-3.8/pstore-avoid-deadlock-in-panic-and-emergency-restart-path.patch new file mode 100644 index 00000000000..9e2b2d03603 --- /dev/null +++ b/queue-3.8/pstore-avoid-deadlock-in-panic-and-emergency-restart-path.patch @@ -0,0 +1,149 @@ +From 9f244e9cfd70c7c0f82d3c92ce772ab2a92d9f64 Mon Sep 17 00:00:00 2001 +From: Seiji Aguchi +Date: Fri, 11 Jan 2013 18:09:41 +0000 +Subject: pstore: Avoid deadlock in panic and emergency-restart path + +From: Seiji Aguchi + +commit 9f244e9cfd70c7c0f82d3c92ce772ab2a92d9f64 upstream. + +[Issue] + +When pstore is in panic and emergency-restart paths, it may be blocked +in those paths because it simply takes spin_lock. + +This is an example scenario which pstore may hang up in a panic path: + + - cpuA grabs psinfo->buf_lock + - cpuB panics and calls smp_send_stop + - smp_send_stop sends IRQ to cpuA + - after 1 second, cpuB gives up on cpuA and sends an NMI instead + - cpuA is now in an NMI handler while still holding buf_lock + - cpuB is deadlocked + +This case may happen if a firmware has a bug and +cpuA is stuck talking with it more than one second. + +Also, this is a similar scenario in an emergency-restart path: + + - cpuA grabs psinfo->buf_lock and stucks in a firmware + - cpuB kicks emergency-restart via either sysrq-b or hangcheck timer. + And then, cpuB is deadlocked by taking psinfo->buf_lock again. + +[Solution] + +This patch avoids the deadlocking issues in both panic and emergency_restart +paths by introducing a function, is_non_blocking_path(), to check if a cpu +can be blocked in current path. + +With this patch, pstore is not blocked even if another cpu has +taken a spin_lock, in those paths by changing from spin_lock_irqsave +to spin_trylock_irqsave. + +In addition, according to a comment of emergency_restart() in kernel/sys.c, +spin_lock shouldn't be taken in an emergency_restart path to avoid +deadlock. This patch fits the comment below. + + +/** + * emergency_restart - reboot the system + * + * Without shutting down any hardware or taking any locks + * reboot the system. This is called when we know we are in + * trouble so this is our best effort to reboot. This is + * safe to call in interrupt context. + */ +void emergency_restart(void) + + +Signed-off-by: Seiji Aguchi +Acked-by: Don Zickus +Signed-off-by: Tony Luck +Cc: CAI Qian +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pstore/platform.c | 35 +++++++++++++++++++++++++++++------ + include/linux/pstore.h | 6 ++++++ + 2 files changed, 35 insertions(+), 6 deletions(-) + +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -96,6 +96,27 @@ static const char *get_reason_str(enum k + } + } + ++bool pstore_cannot_block_path(enum kmsg_dump_reason reason) ++{ ++ /* ++ * In case of NMI path, pstore shouldn't be blocked ++ * regardless of reason. ++ */ ++ if (in_nmi()) ++ return true; ++ ++ switch (reason) { ++ /* In panic case, other cpus are stopped by smp_send_stop(). */ ++ case KMSG_DUMP_PANIC: ++ /* Emergency restart shouldn't be blocked by spin lock. */ ++ case KMSG_DUMP_EMERG: ++ return true; ++ default: ++ return false; ++ } ++} ++EXPORT_SYMBOL_GPL(pstore_cannot_block_path); ++ + /* + * callback from kmsg_dump. (s2,l2) has the most recently + * written bytes, older bytes are in (s1,l1). Save as much +@@ -114,10 +135,12 @@ static void pstore_dump(struct kmsg_dump + + why = get_reason_str(reason); + +- if (in_nmi()) { +- is_locked = spin_trylock(&psinfo->buf_lock); +- if (!is_locked) +- pr_err("pstore dump routine blocked in NMI, may corrupt error record\n"); ++ if (pstore_cannot_block_path(reason)) { ++ is_locked = spin_trylock_irqsave(&psinfo->buf_lock, flags); ++ if (!is_locked) { ++ pr_err("pstore dump routine blocked in %s path, may corrupt error record\n" ++ , in_nmi() ? "NMI" : why); ++ } + } else + spin_lock_irqsave(&psinfo->buf_lock, flags); + oopscount++; +@@ -143,9 +166,9 @@ static void pstore_dump(struct kmsg_dump + total += hsize + len; + part++; + } +- if (in_nmi()) { ++ if (pstore_cannot_block_path(reason)) { + if (is_locked) +- spin_unlock(&psinfo->buf_lock); ++ spin_unlock_irqrestore(&psinfo->buf_lock, flags); + } else + spin_unlock_irqrestore(&psinfo->buf_lock, flags); + } +--- a/include/linux/pstore.h ++++ b/include/linux/pstore.h +@@ -68,12 +68,18 @@ struct pstore_info { + + #ifdef CONFIG_PSTORE + extern int pstore_register(struct pstore_info *); ++extern bool pstore_cannot_block_path(enum kmsg_dump_reason reason); + #else + static inline int + pstore_register(struct pstore_info *psi) + { + return -ENODEV; + } ++static inline bool ++pstore_cannot_block_path(enum kmsg_dump_reason reason) ++{ ++ return false; ++} + #endif + + #endif /*_LINUX_PSTORE_H*/ diff --git a/queue-3.8/series b/queue-3.8/series index cb76e1cf577..5bdb9ce0fab 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -58,3 +58,10 @@ hid-add-support-for-sony-rf-receiver-with-usb-product-id-0x0374.patch hid-clean-up-quirk-for-sony-rf-receivers.patch fuse-don-t-warn-when-nlink-is-zero.patch workqueue-consider-work-function-when-searching-for-busy-work-items.patch +pstore-avoid-deadlock-in-panic-and-emergency-restart-path.patch +cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch +cgroup-fix-exit-vs-rmdir-race.patch +bq27x00_battery-fix-bugs-introduced-with-bq27425-support.patch +ab8500-chargalg-only-root-should-have-write-permission-on-sysfs-file.patch +ab8500_btemp-demote-initcall-sequence.patch +acpi-add-dmi-entry-for-sony-vgn-fw41e_h.patch