From 13fc93a3bf471fa878b62ce113303e8ffb15da19 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 1 Mar 2016 10:54:11 -0800 Subject: [PATCH] 3.14-stable patches added patches: dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch gspca-ov534-topro-prevent-a-division-by-0.patch media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch tda1004x-only-update-the-frontend-properties-if-locked.patch --- ...fix-hung-bios-when-copy-error-occurs.patch | 135 ++++++++++++++++++ ...ta-remove-unused-variable-in-brb_pop.patch | 39 +++++ ...-ov534-topro-prevent-a-division-by-0.patch | 109 ++++++++++++++ ...e-can_inversion_auto-in-oneshot-mode.patch | 44 ++++++ queue-3.14/series | 5 + ...te-the-frontend-properties-if-locked.patch | 48 +++++++ 6 files changed, 380 insertions(+) create mode 100644 queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch create mode 100644 queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch create mode 100644 queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch create mode 100644 queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch create mode 100644 queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch diff --git a/queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch b/queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch new file mode 100644 index 00000000000..723e9203bad --- /dev/null +++ b/queue-3.14/dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch @@ -0,0 +1,135 @@ +From 385277bfb57faac44e92497104ba542cdd82d5fe Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 8 Jan 2016 19:07:55 -0500 +Subject: dm snapshot: fix hung bios when copy error occurs + +From: Mikulas Patocka + +commit 385277bfb57faac44e92497104ba542cdd82d5fe upstream. + +When there is an error copying a chunk dm-snapshot can incorrectly hold +associated bios indefinitely, resulting in hung IO. + +The function copy_callback sets pe->error if there was error copying the +chunk, and then calls complete_exception. complete_exception calls +pending_complete on error, otherwise it calls commit_exception with +commit_callback (and commit_callback calls complete_exception). + +The persistent exception store (dm-snap-persistent.c) assumes that calls +to prepare_exception and commit_exception are paired. +persistent_prepare_exception increases ps->pending_count and +persistent_commit_exception decreases it. + +If there is a copy error, persistent_prepare_exception is called but +persistent_commit_exception is not. This results in the variable +ps->pending_count never returning to zero and that causes some pending +exceptions (and their associated bios) to be held forever. + +Fix this by unconditionally calling commit_exception regardless of +whether the copy was successful. A new "valid" parameter is added to +commit_exception -- when the copy fails this parameter is set to zero so +that the chunk that failed to copy (and all following chunks) is not +recorded in the snapshot store. Also, remove commit_callback now that +it is merely a wrapper around pending_complete. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.h | 2 +- + drivers/md/dm-snap-persistent.c | 5 ++++- + drivers/md/dm-snap-transient.c | 4 ++-- + drivers/md/dm-snap.c | 20 +++++--------------- + 4 files changed, 12 insertions(+), 19 deletions(-) + +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -70,7 +70,7 @@ struct dm_exception_store_type { + * Update the metadata with this exception. + */ + void (*commit_exception) (struct dm_exception_store *store, +- struct dm_exception *e, ++ struct dm_exception *e, int valid, + void (*callback) (void *, int success), + void *callback_context); + +--- a/drivers/md/dm-snap-persistent.c ++++ b/drivers/md/dm-snap-persistent.c +@@ -700,7 +700,7 @@ static int persistent_prepare_exception( + } + + static void persistent_commit_exception(struct dm_exception_store *store, +- struct dm_exception *e, ++ struct dm_exception *e, int valid, + void (*callback) (void *, int success), + void *callback_context) + { +@@ -709,6 +709,9 @@ static void persistent_commit_exception( + struct core_exception ce; + struct commit_callback *cb; + ++ if (!valid) ++ ps->valid = 0; ++ + ce.old_chunk = e->old_chunk; + ce.new_chunk = e->new_chunk; + write_exception(ps, ps->current_committed++, &ce); +--- a/drivers/md/dm-snap-transient.c ++++ b/drivers/md/dm-snap-transient.c +@@ -52,12 +52,12 @@ static int transient_prepare_exception(s + } + + static void transient_commit_exception(struct dm_exception_store *store, +- struct dm_exception *e, ++ struct dm_exception *e, int valid, + void (*callback) (void *, int success), + void *callback_context) + { + /* Just succeed */ +- callback(callback_context, 1); ++ callback(callback_context, valid); + } + + static void transient_usage(struct dm_exception_store *store, +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1388,8 +1388,9 @@ static void __invalidate_snapshot(struct + dm_table_event(s->ti->table); + } + +-static void pending_complete(struct dm_snap_pending_exception *pe, int success) ++static void pending_complete(void *context, int success) + { ++ struct dm_snap_pending_exception *pe = context; + struct dm_exception *e; + struct dm_snapshot *s = pe->snap; + struct bio *origin_bios = NULL; +@@ -1460,24 +1461,13 @@ out: + free_pending_exception(pe); + } + +-static void commit_callback(void *context, int success) +-{ +- struct dm_snap_pending_exception *pe = context; +- +- pending_complete(pe, success); +-} +- + static void complete_exception(struct dm_snap_pending_exception *pe) + { + struct dm_snapshot *s = pe->snap; + +- if (unlikely(pe->copy_error)) +- pending_complete(pe, 0); +- +- else +- /* Update the metadata if we are persistent */ +- s->store->type->commit_exception(s->store, &pe->e, +- commit_callback, pe); ++ /* Update the metadata if we are persistent */ ++ s->store->type->commit_exception(s->store, &pe->e, !pe->copy_error, ++ pending_complete, pe); + } + + /* diff --git a/queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch b/queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch new file mode 100644 index 00000000000..165fc825c4b --- /dev/null +++ b/queue-3.14/dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch @@ -0,0 +1,39 @@ +From 512167788a6fe9481a33a3cce5f80b684631a1bb Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Mon, 14 Dec 2015 09:26:01 -0500 +Subject: dm space map metadata: remove unused variable in brb_pop() + +From: Mike Snitzer + +commit 512167788a6fe9481a33a3cce5f80b684631a1bb upstream. + +Remove the unused struct block_op pointer that was inadvertantly +introduced, via cut-and-paste of previous brb_op() code, as part of +commit 50dd842ad. + +(Cc'ing stable@ because commit 50dd842ad did) + +Fixes: 50dd842ad ("dm space map metadata: fix ref counting bug when bootstrapping a new space map") +Reported-by: David Binderman +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/persistent-data/dm-space-map-metadata.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -152,12 +152,9 @@ static int brb_peek(struct bop_ring_buff + + static int brb_pop(struct bop_ring_buffer *brb) + { +- struct block_op *bop; +- + if (brb_empty(brb)) + return -ENODATA; + +- bop = brb->bops + brb->begin; + brb->begin = brb_next(brb, brb->begin); + + return 0; diff --git a/queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch b/queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch new file mode 100644 index 00000000000..7fcfe2c95cd --- /dev/null +++ b/queue-3.14/gspca-ov534-topro-prevent-a-division-by-0.patch @@ -0,0 +1,109 @@ +From dcc7fdbec53a960588f2c40232db2c6466c09917 Mon Sep 17 00:00:00 2001 +From: Antonio Ospite +Date: Fri, 2 Oct 2015 17:33:13 -0300 +Subject: [media] gspca: ov534/topro: prevent a division by 0 + +From: Antonio Ospite + +commit dcc7fdbec53a960588f2c40232db2c6466c09917 upstream. + +v4l2-compliance sends a zeroed struct v4l2_streamparm in +v4l2-test-formats.cpp::testParmType(), and this results in a division by +0 in some gspca subdrivers: + + divide error: 0000 [#1] SMP + Modules linked in: gspca_ov534 gspca_main ... + CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1 + Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS + ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010 + task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000 + RIP: 0010:[] [] sd_set_streamparm+0x12/0x60 [gspca_ov534] + RSP: 0018:ffff880095c4fce8 EFLAGS: 00010296 + RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140 + RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000 + RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc + R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400 + R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000 + FS: 00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0 + Stack: + ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616 + ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000 + ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016 + Call Trace: + [] ? v4l_s_parm+0x21/0x50 [videodev] + [] ? vidioc_s_parm+0x4e/0x60 [gspca_main] + [] ? __video_do_ioctl+0x280/0x2f0 [videodev] + [] ? video_ioctl2+0x20/0x20 [videodev] + [] ? video_usercopy+0x319/0x4e0 [videodev] + [] ? page_add_new_anon_rmap+0x71/0xa0 + [] ? mem_cgroup_commit_charge+0x52/0x90 + [] ? handle_mm_fault+0xc18/0x1680 + [] ? v4l2_ioctl+0xac/0xd0 [videodev] + [] ? do_vfs_ioctl+0x28f/0x480 + [] ? SyS_ioctl+0x74/0x80 + [] ? entry_SYSCALL_64_fastpath+0x16/0x75 + Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00 + 00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 + 76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f + RIP [] sd_set_streamparm+0x12/0x60 [gspca_ov534] + RSP + ---[ end trace 279710c2c6c72080 ]--- + +Following what the doc says about a zeroed timeperframe (see +http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html): + + ... + To reset manually applications can just set this field to zero. + +fix the issue by resetting the frame rate to a default value in case of +an unusable timeperframe. + +The fix is done in the subdrivers instead of gspca.c because only the +subdrivers have notion of a default frame rate to reset the camera to. + +Signed-off-by: Antonio Ospite +Reviewed-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/gspca/ov534.c | 9 +++++++-- + drivers/media/usb/gspca/topro.c | 6 +++++- + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/gspca/ov534.c ++++ b/drivers/media/usb/gspca/ov534.c +@@ -1490,8 +1490,13 @@ static void sd_set_streamparm(struct gsp + struct v4l2_fract *tpf = &cp->timeperframe; + struct sd *sd = (struct sd *) gspca_dev; + +- /* Set requested framerate */ +- sd->frame_rate = tpf->denominator / tpf->numerator; ++ if (tpf->numerator == 0 || tpf->denominator == 0) ++ /* Set default framerate */ ++ sd->frame_rate = 30; ++ else ++ /* Set requested framerate */ ++ sd->frame_rate = tpf->denominator / tpf->numerator; ++ + if (gspca_dev->streaming) + set_frame_rate(gspca_dev); + +--- a/drivers/media/usb/gspca/topro.c ++++ b/drivers/media/usb/gspca/topro.c +@@ -4792,7 +4792,11 @@ static void sd_set_streamparm(struct gsp + struct v4l2_fract *tpf = &cp->timeperframe; + int fr, i; + +- sd->framerate = tpf->denominator / tpf->numerator; ++ if (tpf->numerator == 0 || tpf->denominator == 0) ++ sd->framerate = 30; ++ else ++ sd->framerate = tpf->denominator / tpf->numerator; ++ + if (gspca_dev->streaming) + setframerate(gspca_dev, v4l2_ctrl_g_ctrl(gspca_dev->exposure)); + diff --git a/queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch b/queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch new file mode 100644 index 00000000000..8168e990aa1 --- /dev/null +++ b/queue-3.14/media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch @@ -0,0 +1,44 @@ +From c9d57de6103e343f2d4e04ea8d9e417e10a24da7 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Mon, 31 Aug 2015 06:13:45 -0300 +Subject: [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode + +From: Malcolm Priestley + +commit c9d57de6103e343f2d4e04ea8d9e417e10a24da7 upstream. + +When in FE_TUNE_MODE_ONESHOT the frontend must report +the actual capabilities so user can take appropriate +action. + +With frontends that can't do auto inversion this is done +by dvb-core automatically so CAN_INVERSION_AUTO is valid. + +However, when in FE_TUNE_MODE_ONESHOT this is not true. + +So only set FE_CAN_INVERSION_AUTO in modes other than +FE_TUNE_MODE_ONESHOT + +Signed-off-by: Malcolm Priestley +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-core/dvb_frontend.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -2195,9 +2195,9 @@ static int dvb_frontend_ioctl_legacy(str + dev_dbg(fe->dvb->device, "%s: current delivery system on cache: %d, V3 type: %d\n", + __func__, c->delivery_system, fe->ops.info.type); + +- /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't +- * do it, it is done for it. */ +- info->caps |= FE_CAN_INVERSION_AUTO; ++ /* Set CAN_INVERSION_AUTO bit on in other than oneshot mode */ ++ if (!(fepriv->tune_mode_flags & FE_TUNE_MODE_ONESHOT)) ++ info->caps |= FE_CAN_INVERSION_AUTO; + err = 0; + break; + } diff --git a/queue-3.14/series b/queue-3.14/series index cc148faa9b2..4a22308adf5 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -91,3 +91,8 @@ s390-dasd-prevent-incorrect-length-error-under-z-vm-after-pav-changes.patch s390-dasd-fix-refcount-for-pav-reassignment.patch uml-flush-stdout-before-forking.patch uml-fix-hostfs-mknod.patch +media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch +gspca-ov534-topro-prevent-a-division-by-0.patch +tda1004x-only-update-the-frontend-properties-if-locked.patch +dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch +dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch diff --git a/queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch b/queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch new file mode 100644 index 00000000000..1feaa7f7044 --- /dev/null +++ b/queue-3.14/tda1004x-only-update-the-frontend-properties-if-locked.patch @@ -0,0 +1,48 @@ +From e8beb02343e7582980c6705816cd957cf4f74c7a Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Wed, 3 Feb 2016 17:33:48 -0200 +Subject: [media] tda1004x: only update the frontend properties if locked + +From: Mauro Carvalho Chehab + +commit e8beb02343e7582980c6705816cd957cf4f74c7a upstream. + +The tda1004x was updating the properties cache before locking. +If the device is not locked, the data at the registers are just +random values with no real meaning. + +This caused the driver to fail with libdvbv5, as such library +calls GET_PROPERTY from time to time, in order to return the +DVB stats. + +Tested with a saa7134 card 78: + ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862 + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/tda1004x.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/media/dvb-frontends/tda1004x.c ++++ b/drivers/media/dvb-frontends/tda1004x.c +@@ -903,9 +903,18 @@ static int tda1004x_get_fe(struct dvb_fr + { + struct dtv_frontend_properties *fe_params = &fe->dtv_property_cache; + struct tda1004x_state* state = fe->demodulator_priv; ++ int status; + + dprintk("%s\n", __func__); + ++ status = tda1004x_read_byte(state, TDA1004X_STATUS_CD); ++ if (status == -1) ++ return -EIO; ++ ++ /* Only update the properties cache if device is locked */ ++ if (!(status & 8)) ++ return 0; ++ + // inversion status + fe_params->inversion = INVERSION_OFF; + if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20) -- 2.47.3