From 1acaa4b7f833807f9e95877b20fcadd9720f132d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 3 Oct 2014 13:36:29 -0700 Subject: [PATCH] 3.16-stable patches added patches: blk-mq-avoid-race-condition-with-uninitialized-requests.patch cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch cpufreq-release-policy-rwsem-on-error.patch crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch media-adv7604-fix-inverted-condition.patch media-af9033-feed-clock-to-rf-tuner.patch media-af9033-update-it9135-tuner-inittabs.patch media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch media-cx18-fix-kernel-oops-with-tda8290-tuner.patch media-em28xx-fix-vbi-handling-logic.patch media-it913x-init-tuner-on-attach.patch media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch nl80211-clear-skb-cb-before-passing-to-netlink.patch revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch --- ...ondition-with-uninitialized-requests.patch | 61 ++++++++++++ ...freq-suspend-resume-for-intel_pstate.patch | 61 ++++++++++++ ...pufreq-release-policy-rwsem-on-error.patch | 98 ++++++++++++++++++ ...r-ccp-before-registering-crypto-algs.patch | 95 ++++++++++++++++++ ...-bit-overflow-bug-in-buffer-i-o-code.patch | 73 ++++++++++++++ ...media-adv7604-fix-inverted-condition.patch | 31 ++++++ .../media-af9033-feed-clock-to-rf-tuner.patch | 46 +++++++++ ...-af9033-update-it9135-tuner-inittabs.patch | 93 +++++++++++++++++ ...dd-support-for-pctv-78e-and-pctv-79e.patch | 50 ++++++++++ ...8-fix-kernel-oops-with-tda8290-tuner.patch | 34 +++++++ .../media-em28xx-fix-vbi-handling-logic.patch | 38 +++++++ .../media-it913x-init-tuner-on-attach.patch | 46 +++++++++ ...dex-sanity-check-in-vb2_plane_cookie.patch | 31 ++++++ ...ate-check-when-start_streaming-fails.patch | 62 ++++++++++++ ...fp-mask-to-sg_alloc_table_from_pages.patch | 79 +++++++++++++++ ...ear-skb-cb-before-passing-to-netlink.patch | 50 ++++++++++ ...ces-stay-within-their-parents-bounds.patch | 99 +++++++++++++++++++ queue-3.16/series | 17 ++++ 18 files changed, 1064 insertions(+) create mode 100644 queue-3.16/blk-mq-avoid-race-condition-with-uninitialized-requests.patch create mode 100644 queue-3.16/cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch create mode 100644 queue-3.16/cpufreq-release-policy-rwsem-on-error.patch create mode 100644 queue-3.16/crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch create mode 100644 queue-3.16/fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch create mode 100644 queue-3.16/media-adv7604-fix-inverted-condition.patch create mode 100644 queue-3.16/media-af9033-feed-clock-to-rf-tuner.patch create mode 100644 queue-3.16/media-af9033-update-it9135-tuner-inittabs.patch create mode 100644 queue-3.16/media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch create mode 100644 queue-3.16/media-cx18-fix-kernel-oops-with-tda8290-tuner.patch create mode 100644 queue-3.16/media-em28xx-fix-vbi-handling-logic.patch create mode 100644 queue-3.16/media-it913x-init-tuner-on-attach.patch create mode 100644 queue-3.16/media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch create mode 100644 queue-3.16/media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch create mode 100644 queue-3.16/media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch create mode 100644 queue-3.16/nl80211-clear-skb-cb-before-passing-to-netlink.patch create mode 100644 queue-3.16/revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch diff --git a/queue-3.16/blk-mq-avoid-race-condition-with-uninitialized-requests.patch b/queue-3.16/blk-mq-avoid-race-condition-with-uninitialized-requests.patch new file mode 100644 index 00000000000..e8409ef643c --- /dev/null +++ b/queue-3.16/blk-mq-avoid-race-condition-with-uninitialized-requests.patch @@ -0,0 +1,61 @@ +From 683d0e126232d898a481daa3a4ca032c2b1a9660 Mon Sep 17 00:00:00 2001 +From: David Hildenbrand +Date: Thu, 18 Sep 2014 11:04:31 +0200 +Subject: blk-mq: Avoid race condition with uninitialized requests + +From: David Hildenbrand + +commit 683d0e126232d898a481daa3a4ca032c2b1a9660 upstream. + +This patch should fix the bug reported in +https://lkml.org/lkml/2014/9/11/249. + +We have to initialize at least the atomic_flags and the cmd_flags when +allocating storage for the requests. + +Otherwise blk_mq_timeout_check() might dereference uninitialized +pointers when racing with the creation of a request. + +Also move the reset of cmd_flags for the initializing code to the point +where a request is freed. So we will never end up with pending flush +request indicators that might trigger dereferences of invalid pointers +in blk_mq_timeout_check(). + +Signed-off-by: David Hildenbrand +Reported-by: Paulo De Rezende Pinatti +Tested-by: Paulo De Rezende Pinatti +Acked-by: Christian Borntraeger +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -219,7 +219,6 @@ __blk_mq_alloc_request(struct blk_mq_all + if (tag != BLK_MQ_TAG_FAIL) { + rq = data->hctx->tags->rqs[tag]; + +- rq->cmd_flags = 0; + if (blk_mq_tag_busy(data->hctx)) { + rq->cmd_flags = REQ_MQ_INFLIGHT; + atomic_inc(&data->hctx->nr_active); +@@ -274,6 +273,7 @@ static void __blk_mq_free_request(struct + + if (rq->cmd_flags & REQ_MQ_INFLIGHT) + atomic_dec(&hctx->nr_active); ++ rq->cmd_flags = 0; + + clear_bit(REQ_ATOM_STARTED, &rq->atomic_flags); + blk_mq_put_tag(hctx, tag, &ctx->last_tag); +@@ -1411,6 +1411,8 @@ static struct blk_mq_tags *blk_mq_init_r + left -= to_do * rq_size; + for (j = 0; j < to_do; j++) { + tags->rqs[i] = p; ++ tags->rqs[i]->atomic_flags = 0; ++ tags->rqs[i]->cmd_flags = 0; + if (set->ops->init_request) { + if (set->ops->init_request(set->driver_data, + tags->rqs[i], hctx_idx, i, diff --git a/queue-3.16/cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch b/queue-3.16/cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch new file mode 100644 index 00000000000..67f121c6726 --- /dev/null +++ b/queue-3.16/cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch @@ -0,0 +1,61 @@ +From 8e30444e153008e8eb3e74cbcb7a865bfcfb04a0 Mon Sep 17 00:00:00 2001 +From: Lan Tianyu +Date: Thu, 18 Sep 2014 15:03:07 +0800 +Subject: cpufreq: fix cpufreq suspend/resume for intel_pstate + +From: Lan Tianyu + +commit 8e30444e153008e8eb3e74cbcb7a865bfcfb04a0 upstream. + +Cpufreq core introduces cpufreq_suspended flag to let cpufreq sysfs nodes +across S2RAM/S2DISK. But the flag is only set in the cpufreq_suspend() +for cpufreq drivers which have target or target_index callback. This +skips intel_pstate driver. This patch is to set the flag before checking +target or target_index callback. + +Fixes: 2f0aea936360 (cpufreq: suspend governors on system suspend/hibernate) +Signed-off-by: Lan Tianyu +[rjw: Subject] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1666,6 +1666,8 @@ void cpufreq_suspend(void) + if (!cpufreq_driver) + return; + ++ cpufreq_suspended = true; ++ + if (!has_target()) + return; + +@@ -1680,8 +1682,6 @@ void cpufreq_suspend(void) + pr_err("%s: Failed to suspend driver: %p\n", __func__, + policy); + } +- +- cpufreq_suspended = true; + } + + /** +@@ -1697,13 +1697,13 @@ void cpufreq_resume(void) + if (!cpufreq_driver) + return; + ++ cpufreq_suspended = false; ++ + if (!has_target()) + return; + + pr_debug("%s: Resuming Governors\n", __func__); + +- cpufreq_suspended = false; +- + list_for_each_entry(policy, &cpufreq_policy_list, policy_list) { + if (cpufreq_driver->resume && cpufreq_driver->resume(policy)) + pr_err("%s: Failed to resume driver: %p\n", __func__, diff --git a/queue-3.16/cpufreq-release-policy-rwsem-on-error.patch b/queue-3.16/cpufreq-release-policy-rwsem-on-error.patch new file mode 100644 index 00000000000..d1112de1bc9 --- /dev/null +++ b/queue-3.16/cpufreq-release-policy-rwsem-on-error.patch @@ -0,0 +1,98 @@ +From 7106e02baed4a72fb23de56b02ad4d31daa74d95 Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Wed, 10 Sep 2014 10:12:08 -0400 +Subject: cpufreq: release policy->rwsem on error + +From: Prarit Bhargava + +commit 7106e02baed4a72fb23de56b02ad4d31daa74d95 upstream. + +While debugging a cpufreq-related hardware failure on a system I saw the +following lockdep warning: + + ========================= + [ BUG: held lock freed! ] 3.17.0-rc4+ #1 Tainted: G E + ------------------------- + insmod/2247 is freeing memory ffff88006e1b1400-ffff88006e1b17ff, with a lock still held there! + (&policy->rwsem){+.+...}, at: [] __cpufreq_add_dev.isra.21+0x47d/0xb80 + 3 locks held by insmod/2247: + #0: (subsys mutex#5){+.+.+.}, at: [] subsys_interface_register+0x69/0x120 + #1: (cpufreq_rwsem){.+.+.+}, at: [] __cpufreq_add_dev.isra.21+0x73/0xb80 + #2: (&policy->rwsem){+.+...}, at: [] __cpufreq_add_dev.isra.21+0x47d/0xb80 + + stack backtrace: + CPU: 0 PID: 2247 Comm: insmod Tainted: G E 3.17.0-rc4+ #1 + Hardware name: HP ProLiant MicroServer Gen8, BIOS J06 08/24/2013 + 0000000000000000 000000008f3063c4 ffff88006f87bb30 ffffffff8171b358 + ffff88006bcf3750 ffff88006f87bb68 ffffffff810e09e1 ffff88006e1b1400 + ffffea0001b86c00 ffffffff8156d327 ffff880073003500 0000000000000246 + Call Trace: + [] dump_stack+0x4d/0x66 + [] debug_check_no_locks_freed+0x171/0x180 + [] ? __cpufreq_add_dev.isra.21+0x427/0xb80 + [] kfree+0xab/0x2b0 + [] __cpufreq_add_dev.isra.21+0x427/0xb80 + [] ? _raw_spin_unlock+0x27/0x40 + [] ? pcc_cpufreq_do_osc+0x17f/0x17f [pcc_cpufreq] + [] cpufreq_add_dev+0xe/0x10 + [] subsys_interface_register+0xc1/0x120 + [] cpufreq_register_driver+0x112/0x340 + [] ? kfree+0xda/0x2b0 + [] ? pcc_cpufreq_do_osc+0x17f/0x17f [pcc_cpufreq] + [] pcc_cpufreq_init+0x4af/0xe81 [pcc_cpufreq] + [] ? pcc_cpufreq_do_osc+0x17f/0x17f [pcc_cpufreq] + [] do_one_initcall+0xd4/0x210 + [] ? __vunmap+0xd2/0x120 + [] load_module+0x1315/0x1b70 + [] ? store_uevent+0x70/0x70 + [] ? copy_module_from_fd.isra.44+0x129/0x180 + [] SyS_finit_module+0xa6/0xd0 + [] system_call_fastpath+0x16/0x1b + cpufreq: __cpufreq_add_dev: ->get() failed +insmod: ERROR: could not insert module pcc-cpufreq.ko: No such device + +The warning occurs in the __cpufreq_add_dev() code which does + + down_write(&policy->rwsem); + ... + if (cpufreq_driver->get && !cpufreq_driver->setpolicy) { + policy->cur = cpufreq_driver->get(policy->cpu); + if (!policy->cur) { + pr_err("%s: ->get() failed\n", __func__); + goto err_get_freq; + } + +If cpufreq_driver->get(policy->cpu) returns an error we execute the +code at err_get_freq, which does not up the policy->rwsem. This causes +the lockdep warning. + +Trivial patch to up the policy->rwsem in the error path. + +After the patch has been applied, and an error occurs in the +cpufreq_driver->get(policy->cpu) call we will now see + +cpufreq: __cpufreq_add_dev: ->get() failed +cpufreq: __cpufreq_add_dev: ->get() failed +modprobe: ERROR: could not insert 'pcc_cpufreq': No such device + +Fixes: 4e97b631f24c (cpufreq: Initialize governor for a new policy under policy->rwsem) +Signed-off-by: Prarit Bhargava +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1279,6 +1279,8 @@ err_get_freq: + per_cpu(cpufreq_cpu_data, j) = NULL; + write_unlock_irqrestore(&cpufreq_driver_lock, flags); + ++ up_write(&policy->rwsem); ++ + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + err_set_policy_cpu: diff --git a/queue-3.16/crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch b/queue-3.16/crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch new file mode 100644 index 00000000000..10344b21bdc --- /dev/null +++ b/queue-3.16/crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch @@ -0,0 +1,95 @@ +From c9f21cb6388898bfe69886d001316dae7ecc9a4b Mon Sep 17 00:00:00 2001 +From: Tom Lendacky +Date: Fri, 5 Sep 2014 10:31:09 -0500 +Subject: crypto: ccp - Check for CCP before registering crypto algs + +From: Tom Lendacky + +commit c9f21cb6388898bfe69886d001316dae7ecc9a4b upstream. + +If the ccp is built as a built-in module, then ccp-crypto (whether +built as a module or a built-in module) will be able to load and +it will register its crypto algorithms. If the system does not have +a CCP this will result in -ENODEV being returned whenever a command +is attempted to be queued by the registered crypto algorithms. + +Add an API, ccp_present(), that checks for the presence of a CCP +on the system. The ccp-crypto module can use this to determine if it +should register it's crypto alogorithms. + +Reported-by: Scot Doyle +Signed-off-by: Tom Lendacky +Tested-by: Scot Doyle +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccp/ccp-crypto-main.c | 4 ++++ + drivers/crypto/ccp/ccp-dev.c | 14 ++++++++++++++ + include/linux/ccp.h | 12 ++++++++++++ + 3 files changed, 30 insertions(+) + +--- a/drivers/crypto/ccp/ccp-crypto-main.c ++++ b/drivers/crypto/ccp/ccp-crypto-main.c +@@ -367,6 +367,10 @@ static int ccp_crypto_init(void) + { + int ret; + ++ ret = ccp_present(); ++ if (ret) ++ return ret; ++ + spin_lock_init(&req_queue_lock); + INIT_LIST_HEAD(&req_queue.cmds); + req_queue.backlog = &req_queue.cmds; +--- a/drivers/crypto/ccp/ccp-dev.c ++++ b/drivers/crypto/ccp/ccp-dev.c +@@ -53,6 +53,20 @@ static inline void ccp_del_device(struct + } + + /** ++ * ccp_present - check if a CCP device is present ++ * ++ * Returns zero if a CCP device is present, -ENODEV otherwise. ++ */ ++int ccp_present(void) ++{ ++ if (ccp_get_device()) ++ return 0; ++ ++ return -ENODEV; ++} ++EXPORT_SYMBOL_GPL(ccp_present); ++ ++/** + * ccp_enqueue_cmd - queue an operation for processing by the CCP + * + * @cmd: ccp_cmd struct to be processed +--- a/include/linux/ccp.h ++++ b/include/linux/ccp.h +@@ -27,6 +27,13 @@ struct ccp_cmd; + defined(CONFIG_CRYPTO_DEV_CCP_DD_MODULE) + + /** ++ * ccp_present - check if a CCP device is present ++ * ++ * Returns zero if a CCP device is present, -ENODEV otherwise. ++ */ ++int ccp_present(void); ++ ++/** + * ccp_enqueue_cmd - queue an operation for processing by the CCP + * + * @cmd: ccp_cmd struct to be processed +@@ -53,6 +60,11 @@ int ccp_enqueue_cmd(struct ccp_cmd *cmd) + + #else /* CONFIG_CRYPTO_DEV_CCP_DD is not enabled */ + ++static inline int ccp_present(void) ++{ ++ return -ENODEV; ++} ++ + static inline int ccp_enqueue_cmd(struct ccp_cmd *cmd) + { + return -ENODEV; diff --git a/queue-3.16/fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch b/queue-3.16/fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch new file mode 100644 index 00000000000..c37ab9dc80f --- /dev/null +++ b/queue-3.16/fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch @@ -0,0 +1,73 @@ +From f2d5a94436cc7cc0221b9a81bba2276a25187dd3 Mon Sep 17 00:00:00 2001 +From: Anton Altaparmakov +Date: Mon, 22 Sep 2014 01:53:03 +0100 +Subject: Fix nasty 32-bit overflow bug in buffer i/o code. + +From: Anton Altaparmakov + +commit f2d5a94436cc7cc0221b9a81bba2276a25187dd3 upstream. + +On 32-bit architectures, the legacy buffer_head functions are not always +handling the sector number with the proper 64-bit types, and will thus +fail on 4TB+ disks. + +Any code that uses __getblk() (and thus bread(), breadahead(), +sb_bread(), sb_breadahead(), sb_getblk()), and calls it using a 64-bit +block on a 32-bit arch (where "long" is 32-bit) causes an inifinite loop +in __getblk_slow() with an infinite stream of errors logged to dmesg +like this: + + __find_get_block_slow() failed. block=6740375944, b_blocknr=2445408648 + b_state=0x00000020, b_size=512 + device sda1 blocksize: 512 + +Note how in hex block is 0x191C1F988 and b_blocknr is 0x91C1F988 i.e. the +top 32-bits are missing (in this case the 0x1 at the top). + +This is because grow_dev_page() is broken and has a 32-bit overflow due +to shifting the page index value (a pgoff_t - which is just 32 bits on +32-bit architectures) left-shifted as the block number. But the top +bits to get lost as the pgoff_t is not type cast to sector_t / 64-bit +before the shift. + +This patch fixes this issue by type casting "index" to sector_t before +doing the left shift. + +Note this is not a theoretical bug but has been seen in the field on a +4TiB hard drive with logical sector size 512 bytes. + +This patch has been verified to fix the infinite loop problem on 3.17-rc5 +kernel using a 4TB disk image mounted using "-o loop". Without this patch +doing a "find /nt" where /nt is an NTFS volume causes the inifinite loop +100% reproducibly whilst with the patch it works fine as expected. + +Signed-off-by: Anton Altaparmakov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/buffer.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -1029,7 +1029,8 @@ grow_dev_page(struct block_device *bdev, + bh = page_buffers(page); + if (bh->b_size == size) { + end_block = init_page_buffers(page, bdev, +- index << sizebits, size); ++ (sector_t)index << sizebits, ++ size); + goto done; + } + if (!try_to_free_buffers(page)) +@@ -1050,7 +1051,8 @@ grow_dev_page(struct block_device *bdev, + */ + spin_lock(&inode->i_mapping->private_lock); + link_dev_buffers(page, bh); +- end_block = init_page_buffers(page, bdev, index << sizebits, size); ++ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits, ++ size); + spin_unlock(&inode->i_mapping->private_lock); + done: + ret = (block < end_block) ? 1 : -ENXIO; diff --git a/queue-3.16/media-adv7604-fix-inverted-condition.patch b/queue-3.16/media-adv7604-fix-inverted-condition.patch new file mode 100644 index 00000000000..d7539cf8d15 --- /dev/null +++ b/queue-3.16/media-adv7604-fix-inverted-condition.patch @@ -0,0 +1,31 @@ +From 77639ff2b3404a913b8037d230a384798b854bae Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Fri, 12 Sep 2014 06:02:02 -0300 +Subject: media: adv7604: fix inverted condition + +From: Hans Verkuil + +commit 77639ff2b3404a913b8037d230a384798b854bae upstream. + +The log_status function should show HDMI information, but the test checking for +an HDMI input was inverted. Fix this. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/adv7604.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2325,7 +2325,7 @@ static int adv7604_log_status(struct v4l + v4l2_info(sd, "HDCP keys read: %s%s\n", + (hdmi_read(sd, 0x04) & 0x20) ? "yes" : "no", + (hdmi_read(sd, 0x04) & 0x10) ? "ERROR" : ""); +- if (!is_hdmi(sd)) { ++ if (is_hdmi(sd)) { + bool audio_pll_locked = hdmi_read(sd, 0x04) & 0x01; + bool audio_sample_packet_detect = hdmi_read(sd, 0x18) & 0x01; + bool audio_mute = io_read(sd, 0x65) & 0x40; diff --git a/queue-3.16/media-af9033-feed-clock-to-rf-tuner.patch b/queue-3.16/media-af9033-feed-clock-to-rf-tuner.patch new file mode 100644 index 00000000000..b9db6e4b9b3 --- /dev/null +++ b/queue-3.16/media-af9033-feed-clock-to-rf-tuner.patch @@ -0,0 +1,46 @@ +From 9dc0f3fe3fe6b83b44e5920a0b143b4f96755b59 Mon Sep 17 00:00:00 2001 +From: Antti Palosaari +Date: Sat, 9 Aug 2014 01:03:14 -0300 +Subject: media: af9033: feed clock to RF tuner + +From: Antti Palosaari + +commit 9dc0f3fe3fe6b83b44e5920a0b143b4f96755b59 upstream. + +IT9135 RF tuner clock is coming from demodulator. We need enable it +early in demod init, before any tuner I/O. Currently it is enabled +by tuner driver itself, but it is too late and performance will be +reduced as some registers are not updated correctly. Clock is +disabled automatically when demod is put onto sleep. + +Cc: Bimow Chen +Signed-off-by: Antti Palosaari +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-frontends/af9033.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/media/dvb-frontends/af9033.c ++++ b/drivers/media/dvb-frontends/af9033.c +@@ -314,6 +314,19 @@ static int af9033_init(struct dvb_fronte + goto err; + } + ++ /* feed clock to RF tuner */ ++ switch (state->cfg.tuner) { ++ case AF9033_TUNER_IT9135_38: ++ case AF9033_TUNER_IT9135_51: ++ case AF9033_TUNER_IT9135_52: ++ case AF9033_TUNER_IT9135_60: ++ case AF9033_TUNER_IT9135_61: ++ case AF9033_TUNER_IT9135_62: ++ ret = af9033_wr_reg(state, 0x80fba8, 0x00); ++ if (ret < 0) ++ goto err; ++ } ++ + /* settings for TS interface */ + if (state->cfg.ts_mode == AF9033_TS_MODE_USB) { + ret = af9033_wr_reg_mask(state, 0x80f9a5, 0x00, 0x01); diff --git a/queue-3.16/media-af9033-update-it9135-tuner-inittabs.patch b/queue-3.16/media-af9033-update-it9135-tuner-inittabs.patch new file mode 100644 index 00000000000..9de7da86fa0 --- /dev/null +++ b/queue-3.16/media-af9033-update-it9135-tuner-inittabs.patch @@ -0,0 +1,93 @@ +From 0df6580c5fc115034de29aa52af5cf6bd83d37d8 Mon Sep 17 00:00:00 2001 +From: Bimow Chen +Date: Mon, 4 Aug 2014 23:31:46 -0300 +Subject: media: af9033: update IT9135 tuner inittabs + +From: Bimow Chen + +commit 0df6580c5fc115034de29aa52af5cf6bd83d37d8 upstream. + +Update IT9135 BX tuner config 60 and 61 inittabs. + +[crope@iki.fi: removed two reg writes from driver init itself] +Signed-off-by: Bimow Chen +Signed-off-by: Antti Palosaari +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Mauro Carvalho Chehab + +--- + drivers/media/dvb-frontends/af9033_priv.h | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/drivers/media/dvb-frontends/af9033_priv.h ++++ b/drivers/media/dvb-frontends/af9033_priv.h +@@ -1418,7 +1418,7 @@ static const struct reg_val tuner_init_i + { 0x800068, 0x0a }, + { 0x80006a, 0x03 }, + { 0x800070, 0x0a }, +- { 0x800071, 0x05 }, ++ { 0x800071, 0x0a }, + { 0x800072, 0x02 }, + { 0x800075, 0x8c }, + { 0x800076, 0x8c }, +@@ -1484,7 +1484,6 @@ static const struct reg_val tuner_init_i + { 0x800104, 0x02 }, + { 0x800105, 0xbe }, + { 0x800106, 0x00 }, +- { 0x800109, 0x02 }, + { 0x800115, 0x0a }, + { 0x800116, 0x03 }, + { 0x80011a, 0xbe }, +@@ -1510,7 +1509,6 @@ static const struct reg_val tuner_init_i + { 0x80014b, 0x8c }, + { 0x80014d, 0xac }, + { 0x80014e, 0xc6 }, +- { 0x80014f, 0x03 }, + { 0x800151, 0x1e }, + { 0x800153, 0xbc }, + { 0x800178, 0x09 }, +@@ -1522,9 +1520,10 @@ static const struct reg_val tuner_init_i + { 0x80018d, 0x5f }, + { 0x80018f, 0xa0 }, + { 0x800190, 0x5a }, +- { 0x80ed02, 0xff }, +- { 0x80ee42, 0xff }, +- { 0x80ee82, 0xff }, ++ { 0x800191, 0x00 }, ++ { 0x80ed02, 0x40 }, ++ { 0x80ee42, 0x40 }, ++ { 0x80ee82, 0x40 }, + { 0x80f000, 0x0f }, + { 0x80f01f, 0x8c }, + { 0x80f020, 0x00 }, +@@ -1699,7 +1698,6 @@ static const struct reg_val tuner_init_i + { 0x800104, 0x02 }, + { 0x800105, 0xc8 }, + { 0x800106, 0x00 }, +- { 0x800109, 0x02 }, + { 0x800115, 0x0a }, + { 0x800116, 0x03 }, + { 0x80011a, 0xc6 }, +@@ -1725,7 +1723,6 @@ static const struct reg_val tuner_init_i + { 0x80014b, 0x8c }, + { 0x80014d, 0xa8 }, + { 0x80014e, 0xc6 }, +- { 0x80014f, 0x03 }, + { 0x800151, 0x28 }, + { 0x800153, 0xcc }, + { 0x800178, 0x09 }, +@@ -1737,9 +1734,10 @@ static const struct reg_val tuner_init_i + { 0x80018d, 0x5f }, + { 0x80018f, 0xfb }, + { 0x800190, 0x5c }, +- { 0x80ed02, 0xff }, +- { 0x80ee42, 0xff }, +- { 0x80ee82, 0xff }, ++ { 0x800191, 0x00 }, ++ { 0x80ed02, 0x40 }, ++ { 0x80ee42, 0x40 }, ++ { 0x80ee82, 0x40 }, + { 0x80f000, 0x0f }, + { 0x80f01f, 0x8c }, + { 0x80f020, 0x00 }, diff --git a/queue-3.16/media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch b/queue-3.16/media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch new file mode 100644 index 00000000000..54951939334 --- /dev/null +++ b/queue-3.16/media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch @@ -0,0 +1,50 @@ +From a04646c045cab08a9e62b9be8f01ecbb0632d24e Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Tue, 5 Aug 2014 06:19:16 -0300 +Subject: media: af9035: new IDs: add support for PCTV 78e and PCTV 79e + +From: Malcolm Priestley + +commit a04646c045cab08a9e62b9be8f01ecbb0632d24e upstream. + +add the following IDs +USB_PID_PCTV_78E (0x025a) for PCTV 78e +USB_PID_PCTV_79E (0x0262) for PCTV 79e + +For these it9135 devices. + +Signed-off-by: Malcolm Priestley +Cc: Antti Palosaari +Signed-off-by: Antti Palosaari +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb-core/dvb-usb-ids.h | 2 ++ + drivers/media/usb/dvb-usb-v2/af9035.c | 4 ++++ + 2 files changed, 6 insertions(+) + +--- a/drivers/media/dvb-core/dvb-usb-ids.h ++++ b/drivers/media/dvb-core/dvb-usb-ids.h +@@ -279,6 +279,8 @@ + #define USB_PID_PCTV_400E 0x020f + #define USB_PID_PCTV_450E 0x0222 + #define USB_PID_PCTV_452E 0x021f ++#define USB_PID_PCTV_78E 0x025a ++#define USB_PID_PCTV_79E 0x0262 + #define USB_PID_REALTEK_RTL2831U 0x2831 + #define USB_PID_REALTEK_RTL2832U 0x2832 + #define USB_PID_TECHNOTREND_CONNECT_S2_3600 0x3007 +--- a/drivers/media/usb/dvb-usb-v2/af9035.c ++++ b/drivers/media/usb/dvb-usb-v2/af9035.c +@@ -1555,6 +1555,10 @@ static const struct usb_device_id af9035 + &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) }, + { DVB_USB_DEVICE(USB_VID_HAUPPAUGE, 0xf900, + &af9035_props, "Hauppauge WinTV-MiniStick 2", NULL) }, ++ { DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_78E, ++ &af9035_props, "PCTV 78e", RC_MAP_IT913X_V1) }, ++ { DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_79E, ++ &af9035_props, "PCTV 79e", RC_MAP_IT913X_V2) }, + { } + }; + MODULE_DEVICE_TABLE(usb, af9035_id_table); diff --git a/queue-3.16/media-cx18-fix-kernel-oops-with-tda8290-tuner.patch b/queue-3.16/media-cx18-fix-kernel-oops-with-tda8290-tuner.patch new file mode 100644 index 00000000000..a052d7df8ea --- /dev/null +++ b/queue-3.16/media-cx18-fix-kernel-oops-with-tda8290-tuner.patch @@ -0,0 +1,34 @@ +From 6a03dc92cc2edfa2257502557b9f714893987383 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Tue, 26 Aug 2014 02:59:53 -0300 +Subject: media: cx18: fix kernel oops with tda8290 tuner + +From: Hans Verkuil + +commit 6a03dc92cc2edfa2257502557b9f714893987383 upstream. + +This was caused by an uninitialized setup.config field. + +Based on a suggestion from Devin Heitmueller. + +Signed-off-by: Hans Verkuil +Thanks-to: Devin Heitmueller +Reported-by: Scott Robinson +Tested-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/cx18/cx18-driver.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/pci/cx18/cx18-driver.c ++++ b/drivers/media/pci/cx18/cx18-driver.c +@@ -1091,6 +1091,7 @@ static int cx18_probe(struct pci_dev *pc + setup.addr = ADDR_UNSET; + setup.type = cx->options.tuner; + setup.mode_mask = T_ANALOG_TV; /* matches TV tuners */ ++ setup.config = NULL; + if (cx->options.radio > 0) + setup.mode_mask |= T_RADIO; + setup.tuner_callback = (setup.type == TUNER_XC2028) ? diff --git a/queue-3.16/media-em28xx-fix-vbi-handling-logic.patch b/queue-3.16/media-em28xx-fix-vbi-handling-logic.patch new file mode 100644 index 00000000000..04ae61bd8c3 --- /dev/null +++ b/queue-3.16/media-em28xx-fix-vbi-handling-logic.patch @@ -0,0 +1,38 @@ +From c7854c2c5d692a329b4d9a9a73bcf36ae137ee7c Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Fri, 19 Sep 2014 13:02:12 -0300 +Subject: media: em28xx: fix VBI handling logic + +From: Mauro Carvalho Chehab + +commit c7854c2c5d692a329b4d9a9a73bcf36ae137ee7c upstream. + +When both VBI and video are streaming, and video stream is stopped, +a subsequent trial to restart it will fail, because S_FMT will +return -EBUSY. + +That prevents applications like zvbi to work properly. + +Please notice that, while this fix it fully for zvbi, the +best is to get rid of streaming_users and res_get logic as a hole. + +However, this single-line patch is better to be merged at -stable. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/em28xx/em28xx-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/em28xx/em28xx-video.c ++++ b/drivers/media/usb/em28xx/em28xx-video.c +@@ -1344,7 +1344,7 @@ static int vidioc_s_fmt_vid_cap(struct f + struct em28xx *dev = video_drvdata(file); + struct em28xx_v4l2 *v4l2 = dev->v4l2; + +- if (v4l2->streaming_users > 0) ++ if (vb2_is_busy(&v4l2->vb_vidq)) + return -EBUSY; + + vidioc_try_fmt_vid_cap(file, priv, f); diff --git a/queue-3.16/media-it913x-init-tuner-on-attach.patch b/queue-3.16/media-it913x-init-tuner-on-attach.patch new file mode 100644 index 00000000000..61bb75c033e --- /dev/null +++ b/queue-3.16/media-it913x-init-tuner-on-attach.patch @@ -0,0 +1,46 @@ +From 01b461bbe74b89da8941f4c95711777d87b9172e Mon Sep 17 00:00:00 2001 +From: Bimow Chen +Date: Tue, 5 Aug 2014 00:14:47 -0300 +Subject: media: it913x: init tuner on attach + +From: Bimow Chen + +commit 01b461bbe74b89da8941f4c95711777d87b9172e upstream. + +That register is needed to program very first in order to operate +correctly. + +[crope@iki.fi: returned sequence back, removed sleep, moved reg +write earlier to prevent populating tuner ops in case of failure] + +Signed-off-by: Bimow Chen +Signed-off-by: Antti Palosaari +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/tuners/tuner_it913x.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/media/tuners/tuner_it913x.c ++++ b/drivers/media/tuners/tuner_it913x.c +@@ -396,6 +396,7 @@ struct dvb_frontend *it913x_attach(struc + struct i2c_adapter *i2c_adap, u8 i2c_addr, u8 config) + { + struct it913x_state *state = NULL; ++ int ret; + + /* allocate memory for the internal state */ + state = kzalloc(sizeof(struct it913x_state), GFP_KERNEL); +@@ -425,6 +426,11 @@ struct dvb_frontend *it913x_attach(struc + state->tuner_type = config; + state->firmware_ver = 1; + ++ /* tuner RF initial */ ++ ret = it913x_wr_reg(state, PRO_DMOD, 0xec4c, 0x68); ++ if (ret < 0) ++ goto error; ++ + fe->tuner_priv = state; + memcpy(&fe->ops.tuner_ops, &it913x_tuner_ops, + sizeof(struct dvb_tuner_ops)); diff --git a/queue-3.16/media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch b/queue-3.16/media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch new file mode 100644 index 00000000000..824b4a019cd --- /dev/null +++ b/queue-3.16/media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch @@ -0,0 +1,31 @@ +From a9ae4692eda4b99f85757b15d60971ff78a0a0e2 Mon Sep 17 00:00:00 2001 +From: Zhaowei Yuan +Date: Thu, 21 Aug 2014 23:28:21 -0300 +Subject: media: vb2: fix plane index sanity check in vb2_plane_cookie() + +From: Zhaowei Yuan + +commit a9ae4692eda4b99f85757b15d60971ff78a0a0e2 upstream. + +It's also invalid when plane_no is equal to vb->num_planes + +Signed-off-by: Zhaowei Yuan +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1126,7 +1126,7 @@ EXPORT_SYMBOL_GPL(vb2_plane_vaddr); + */ + void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no) + { +- if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv) ++ if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv) + return NULL; + + return call_ptr_memop(vb, cookie, vb->planes[plane_no].mem_priv); diff --git a/queue-3.16/media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch b/queue-3.16/media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch new file mode 100644 index 00000000000..dc9ab3cebe3 --- /dev/null +++ b/queue-3.16/media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch @@ -0,0 +1,62 @@ +From bf3593d939520559774cbfee03ba5f314d909620 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Mon, 4 Aug 2014 07:14:14 -0300 +Subject: media: vb2: fix vb2 state check when start_streaming fails + +From: Hans Verkuil + +commit bf3593d939520559774cbfee03ba5f314d909620 upstream. + +Commit bd994ddb2a12a3ff48cd549ec82cdceaea9614df (vb2: Fix stream start and +buffer completion race) broke the buffer state check in vb2_buffer_done. + +So accept all three possible states there since I can no longer tell the +difference between vb2_buffer_done called from start_streaming or from +elsewhere. + +Instead add a WARN_ON at the end of start_streaming that will check whether +any buffers were added to the done list, since that implies that the wrong +state was used as well. + +Signed-off-by: Hans Verkuil +Acked-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-core.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1161,13 +1161,10 @@ void vb2_buffer_done(struct vb2_buffer * + if (WARN_ON(vb->state != VB2_BUF_STATE_ACTIVE)) + return; + +- if (!q->start_streaming_called) { +- if (WARN_ON(state != VB2_BUF_STATE_QUEUED)) +- state = VB2_BUF_STATE_QUEUED; +- } else if (WARN_ON(state != VB2_BUF_STATE_DONE && +- state != VB2_BUF_STATE_ERROR)) { +- state = VB2_BUF_STATE_ERROR; +- } ++ if (WARN_ON(state != VB2_BUF_STATE_DONE && ++ state != VB2_BUF_STATE_ERROR && ++ state != VB2_BUF_STATE_QUEUED)) ++ state = VB2_BUF_STATE_ERROR; + + #ifdef CONFIG_VIDEO_ADV_DEBUG + /* +@@ -1774,6 +1771,12 @@ static int vb2_start_streaming(struct vb + /* Must be zero now */ + WARN_ON(atomic_read(&q->owned_by_drv_count)); + } ++ /* ++ * If done_list is not empty, then start_streaming() didn't call ++ * vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED) but STATE_ERROR or ++ * STATE_DONE. ++ */ ++ WARN_ON(!list_empty(&q->done_list)); + return ret; + } + diff --git a/queue-3.16/media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch b/queue-3.16/media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch new file mode 100644 index 00000000000..0231dd768d6 --- /dev/null +++ b/queue-3.16/media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch @@ -0,0 +1,79 @@ +From 47bc59c52b005f546343c373370a7eec6a2b0f84 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Fri, 1 Aug 2014 09:18:50 -0300 +Subject: media: videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages + +From: Hans Verkuil + +commit 47bc59c52b005f546343c373370a7eec6a2b0f84 upstream. + +sg_alloc_table_from_pages() only allocates a sg_table, so it should just use +GFP_KERNEL, not gfp_flags. If gfp_flags contains __GFP_DMA32 then mm/sl[au]b.c +will call BUG_ON: + +[ 358.027515] ------------[ cut here ]------------ +[ 358.027546] kernel BUG at mm/slub.c:1416! +[ 358.027558] invalid opcode: 0000 [#1] PREEMPT SMP +[ 358.027576] Modules linked in: mt2131 s5h1409 tda8290 tuner cx25840 cx23885 btcx_risc altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core nouveau zr36067 videocodec v4l2_common videodev media x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci +[ 358.027712] CPU: 19 PID: 3654 Comm: cat Not tainted 3.16.0-rc6-telek #167 +[ 358.027723] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014 +[ 358.027741] task: ffff880897c7d960 ti: ffff88089b4d4000 task.ti: ffff88089b4d4000 +[ 358.027753] RIP: 0010:[] [] new_slab+0x280/0x320 +[ 358.027776] RSP: 0018:ffff88089b4d7ae8 EFLAGS: 00010002 +[ 358.027787] RAX: ffff880897c7d960 RBX: 0000000000000000 RCX: ffff88089b4d7b50 +[ 358.027798] RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88089f803b00 +[ 358.027809] RBP: ffff88089b4d7bb8 R08: 0000000000000000 R09: 0000000100400040 +[ 358.027821] R10: 0000160000000000 R11: ffff88109bc02c40 R12: 0000000000000001 +[ 358.027832] R13: ffff88089f8000c0 R14: ffff88089f803b00 R15: ffff8810bfcf4be0 +[ 358.027845] FS: 00007f83fe5c0700(0000) GS:ffff8810bfce0000(0000) knlGS:0000000000000000 +[ 358.027858] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 358.027868] CR2: 0000000001dfd568 CR3: 0000001097d5a000 CR4: 00000000000407e0 +[ 358.027878] Stack: +[ 358.027885] ffffffff81198860 ffff8810bfcf4be0 ffff880897c7d960 0000000000001b00 +[ 358.027905] ffff880897c7d960 0000000000000000 ffff8810bfcf4bf0 0000000000000000 +[ 358.027924] 0000000000000000 0000000100000100 ffffffff813ef84a 00000004ffffffff +[ 358.027944] Call Trace: +[ 358.027956] [] ? __slab_alloc+0x400/0x4e0 +[ 358.027973] [] ? sg_kmalloc+0x1a/0x30 +[ 358.027985] [] __kmalloc+0x127/0x150 +[ 358.027997] [] ? sg_kmalloc+0x1a/0x30 +[ 358.028009] [] sg_kmalloc+0x1a/0x30 +[ 358.028023] [] __sg_alloc_table+0x74/0x180 +[ 358.028035] [] ? sg_kfree+0x20/0x20 +[ 358.028048] [] sg_alloc_table+0x1f/0x60 +[ 358.028061] [] sg_alloc_table_from_pages+0x84/0x1f0 +[ 358.028077] [] vb2_dma_sg_alloc+0x159/0x230 [videobuf2_dma_sg] +[ 358.028095] [] __vb2_queue_alloc+0x10a/0x680 [videobuf2_core] +[ 358.028113] [] __reqbufs.isra.14+0x220/0x3e0 [videobuf2_core] +[ 358.028130] [] __vb2_init_fileio+0xbd/0x380 [videobuf2_core] +[ 358.028147] [] __vb2_perform_fileio+0x5b3/0x6e0 [videobuf2_core] +[ 358.028164] [] vb2_fop_read+0xb1/0x100 [videobuf2_core] +[ 358.028184] [] v4l2_read+0x65/0xb0 [videodev] +[ 358.028198] [] vfs_read+0x8f/0x170 +[ 358.028210] [] SyS_read+0x41/0xb0 +[ 358.028224] [] system_call_fastpath+0x16/0x1b +[ 358.028234] Code: 66 90 e9 dc fd ff ff 0f 1f 40 00 41 8b 4d 68 e9 d5 fe ff ff 0f 1f 80 00 00 00 00 f0 41 80 4d 00 40 e9 03 ff ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 44 89 c6 4c 89 45 d0 e8 0c 82 ff ff 48 +[ 358.028415] RIP [] new_slab+0x280/0x320 +[ 358.028432] RSP +[ 358.032208] ---[ end trace 6443240199c706e4 ]--- + +Signed-off-by: Hans Verkuil +Acked-by: Marek Szyprowski +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-dma-sg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c ++++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c +@@ -113,7 +113,7 @@ static void *vb2_dma_sg_alloc(void *allo + goto fail_pages_alloc; + + ret = sg_alloc_table_from_pages(&buf->sg_table, buf->pages, +- buf->num_pages, 0, size, gfp_flags); ++ buf->num_pages, 0, size, GFP_KERNEL); + if (ret) + goto fail_table_alloc; + diff --git a/queue-3.16/nl80211-clear-skb-cb-before-passing-to-netlink.patch b/queue-3.16/nl80211-clear-skb-cb-before-passing-to-netlink.patch new file mode 100644 index 00000000000..5229ec3e89c --- /dev/null +++ b/queue-3.16/nl80211-clear-skb-cb-before-passing-to-netlink.patch @@ -0,0 +1,50 @@ +From bd8c78e78d5011d8111bc2533ee73b13a3bd6c42 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 30 Jul 2014 14:55:26 +0200 +Subject: nl80211: clear skb cb before passing to netlink + +From: Johannes Berg + +commit bd8c78e78d5011d8111bc2533ee73b13a3bd6c42 upstream. + +In testmode and vendor command reply/event SKBs we use the +skb cb data to store nl80211 parameters between allocation +and sending. This causes the code for CONFIG_NETLINK_MMAP +to get confused, because it takes ownership of the skb cb +data when the SKB is handed off to netlink, and it doesn't +explicitly clear it. + +Clear the skb cb explicitly when we're done and before it +gets passed to netlink to avoid this issue. + +Reported-by: Assaf Azulay +Reported-by: David Spinadel +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6978,6 +6978,9 @@ void __cfg80211_send_event_skb(struct sk + struct nlattr *data = ((void **)skb->cb)[2]; + enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; + ++ /* clear CB data for netlink core to own from now on */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + nla_nest_end(skb, data); + genlmsg_end(skb, hdr); + +@@ -9300,6 +9303,9 @@ int cfg80211_vendor_cmd_reply(struct sk_ + void *hdr = ((void **)skb->cb)[1]; + struct nlattr *data = ((void **)skb->cb)[2]; + ++ /* clear CB data for netlink core to own from now on */ ++ memset(skb->cb, 0, sizeof(skb->cb)); ++ + if (WARN_ON(!rdev->cur_cmd_info)) { + kfree_skb(skb); + return -EINVAL; diff --git a/queue-3.16/revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch b/queue-3.16/revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch new file mode 100644 index 00000000000..c838a83f240 --- /dev/null +++ b/queue-3.16/revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch @@ -0,0 +1,99 @@ +From 12d8706963f073fffad16c7c24160ef20d9aeaff Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Fri, 19 Sep 2014 11:08:40 -0600 +Subject: Revert "PCI: Make sure bus number resources stay within their parents bounds" + +From: Bjorn Helgaas + +commit 12d8706963f073fffad16c7c24160ef20d9aeaff upstream. + +This reverts commit 1820ffdccb9b ("PCI: Make sure bus number resources stay +within their parents bounds") because it breaks some systems with LSI Logic +FC949ES Fibre Channel Adapters, apparently by exposing a defect in those +adapters. + +Dirk tested a Tyan VX50 (B4985) with this device that worked like this +prior to 1820ffdccb9b: + + bus: [bus 00-7f] on node 0 link 1 + ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-07]) + pci 0000:00:0e.0: PCI bridge to [bus 0a] + pci_bus 0000:0a: busn_res: can not insert [bus 0a] under [bus 00-07] (conflicts with (null) [bus 00-07]) + pci 0000:0a:00.0: [1000:0646] type 00 class 0x0c0400 (FC adapter) + +Note that the root bridge [bus 00-07] aperture is wrong; this is a BIOS +defect in the PCI0 _CRS method. But prior to 1820ffdccb9b, we didn't +enforce that aperture, and the FC adapter worked fine at 0a:00.0. + +After 1820ffdccb9b, we notice that 00:0e.0's aperture is not contained in +the root bridge's aperture, so we reconfigure it so it *is* contained: + + pci 0000:00:0e.0: bridge configuration invalid ([bus 0a-0a]), reconfiguring + pci 0000:00:0e.0: PCI bridge to [bus 06-07] + +This effectively moves the FC device from 0a:00.0 to 07:00.0, which should +be legal. But when we enumerate bus 06, the FC device doesn't respond, so +we don't find anything. This is probably a defect in the FC device. + +Possible fixes (due to Yinghai): + + 1) Add a quirk to fix the _CRS information based on what amd_bus.c read + from the hardware + + 2) Reset the FC device after we change its bus number + + 3) Revert 1820ffdccb9b + +Fix 1 would be relatively easy, but it does sweep the LSI FC issue under +the rug. We might want to reconfigure bus numbers in the future for some +other reason, e.g., hotplug, and then we could trip over this again. + +For that reason, I like fix 2, but we don't know whether it actually works, +and we don't have a patch for it yet. + +This revert is fix 3, which also sweeps the LSI FC issue under the rug. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=84281 +Reported-by: Dirk Gouders +Tested-by: Dirk Gouders +Signed-off-by: Bjorn Helgaas +CC: Yinghai Lu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/probe.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -775,7 +775,7 @@ int pci_scan_bridge(struct pci_bus *bus, + /* Check if setup is sensible at all */ + if (!pass && + (primary != bus->number || secondary <= bus->number || +- secondary > subordinate || subordinate > bus->busn_res.end)) { ++ secondary > subordinate)) { + dev_info(&dev->dev, "bridge configuration invalid ([bus %02x-%02x]), reconfiguring\n", + secondary, subordinate); + broken = 1; +@@ -849,8 +849,7 @@ int pci_scan_bridge(struct pci_bus *bus, + child = pci_add_new_bus(bus, dev, max+1); + if (!child) + goto out; +- pci_bus_insert_busn_res(child, max+1, +- bus->busn_res.end); ++ pci_bus_insert_busn_res(child, max+1, 0xff); + } + max++; + buses = (buses & 0xff000000) +@@ -909,11 +908,6 @@ int pci_scan_bridge(struct pci_bus *bus, + /* + * Set the subordinate bus number to its real value. + */ +- if (max > bus->busn_res.end) { +- dev_warn(&dev->dev, "max busn %02x is outside %pR\n", +- max, &bus->busn_res); +- max = bus->busn_res.end; +- } + pci_bus_update_busn_res_end(child, max); + pci_write_config_byte(dev, PCI_SUBORDINATE_BUS, max); + } diff --git a/queue-3.16/series b/queue-3.16/series index 507c5fba7df..d9f6d6bf982 100644 --- a/queue-3.16/series +++ b/queue-3.16/series @@ -309,3 +309,20 @@ revert-pci-don-t-scan-random-busses-in-pci_scan_bridge.patch vgaswitcheroo-add-vga_switcheroo_fini_domain_pm_ops.patch drm-nouveau-runpm-fix-module-unload.patch drm-radeon-px-fix-module-unload.patch +fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch +blk-mq-avoid-race-condition-with-uninitialized-requests.patch +crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch +nl80211-clear-skb-cb-before-passing-to-netlink.patch +revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch +cpufreq-release-policy-rwsem-on-error.patch +cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch +media-it913x-init-tuner-on-attach.patch +media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch +media-af9033-feed-clock-to-rf-tuner.patch +media-cx18-fix-kernel-oops-with-tda8290-tuner.patch +media-af9033-update-it9135-tuner-inittabs.patch +media-adv7604-fix-inverted-condition.patch +media-em28xx-fix-vbi-handling-logic.patch +media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch +media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch +media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch -- 2.47.3