From 6da27da5be76b443459e248e8d2174f37c0ed796 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 18 Mar 2013 10:21:23 -0700 Subject: [PATCH] 3.8-stable patches added patches: alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch arm-w1-gpio-fix-erroneous-gpio-requests.patch hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch hwmon-pmbus-ltc2978-fix-temperature-reporting.patch w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch w1-gpio-remove-erroneous-__exit-and-__exit_p.patch --- ...error-handling-in-snd_seq_timer_open.patch | 74 +++++++++++++++++++ ...-w1-gpio-fix-erroneous-gpio-requests.patch | 69 +++++++++++++++++ ...erminating-entry-for-pem__attributes.patch | 36 +++++++++ ...us-ltc2978-fix-temperature-reporting.patch | 69 +++++++++++++++++ queue-3.8/series | 6 ++ ...rch-is-called-from-netlink-connector.patch | 53 +++++++++++++ ...remove-erroneous-__exit-and-__exit_p.patch | 42 +++++++++++ 7 files changed, 349 insertions(+) create mode 100644 queue-3.8/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch create mode 100644 queue-3.8/arm-w1-gpio-fix-erroneous-gpio-requests.patch create mode 100644 queue-3.8/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch create mode 100644 queue-3.8/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch create mode 100644 queue-3.8/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch create mode 100644 queue-3.8/w1-gpio-remove-erroneous-__exit-and-__exit_p.patch diff --git a/queue-3.8/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch b/queue-3.8/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch new file mode 100644 index 00000000000..b33585d8969 --- /dev/null +++ b/queue-3.8/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch @@ -0,0 +1,74 @@ +From 66efdc71d95887b652a742a5dae51fa834d71465 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 8 Mar 2013 18:11:17 +0100 +Subject: ALSA: seq: Fix missing error handling in snd_seq_timer_open() + +From: Takashi Iwai + +commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream. + +snd_seq_timer_open() didn't catch the whole error path but let through +if the timer id is a slave. This may lead to Oops by accessing the +uninitialized pointer. + + BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae + IP: [] snd_seq_timer_open+0xe7/0x130 + PGD 785cd067 PUD 76964067 PMD 0 + Oops: 0002 [#4] SMP + CPU 0 + Pid: 4288, comm: trinity-child7 Tainted: G D W 3.9.0-rc1+ #100 Bochs Bochs + RIP: 0010:[] [] snd_seq_timer_open+0xe7/0x130 + RSP: 0018:ffff88006ece7d38 EFLAGS: 00010246 + RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000 + RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38 + RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe + R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 + R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007 + FS: 00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290) + Stack: + 0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d + 65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000 + ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520 + Call Trace: + [] ? trace_hardirqs_on+0xd/0x10 + [] snd_seq_queue_timer_open+0x29/0x70 + [] snd_seq_ioctl_set_queue_timer+0xda/0x120 + [] snd_seq_do_ioctl+0x9b/0xd0 + [] snd_seq_ioctl+0x10/0x20 + [] do_vfs_ioctl+0x522/0x570 + [] ? file_has_perm+0x83/0xa0 + [] ? trace_hardirqs_on+0xd/0x10 + [] sys_ioctl+0x5d/0xa0 + [] ? trace_hardirqs_on_thunk+0x3a/0x3f + [] system_call_fastpath+0x16/0x1b + +Reported-and-tested-by: Tommi Rantala +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_timer.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/core/seq/seq_timer.c ++++ b/sound/core/seq/seq_timer.c +@@ -290,10 +290,10 @@ int snd_seq_timer_open(struct snd_seq_qu + tid.device = SNDRV_TIMER_GLOBAL_SYSTEM; + err = snd_timer_open(&t, str, &tid, q->queue); + } +- if (err < 0) { +- snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err); +- return err; +- } ++ } ++ if (err < 0) { ++ snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err); ++ return err; + } + t->callback = snd_seq_timer_interrupt; + t->callback_data = q; diff --git a/queue-3.8/arm-w1-gpio-fix-erroneous-gpio-requests.patch b/queue-3.8/arm-w1-gpio-fix-erroneous-gpio-requests.patch new file mode 100644 index 00000000000..e439212e96a --- /dev/null +++ b/queue-3.8/arm-w1-gpio-fix-erroneous-gpio-requests.patch @@ -0,0 +1,69 @@ +From 2d798a3f20ae992b0b69a2b68c04ada397c32ed4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 12 Mar 2013 20:21:34 +0100 +Subject: ARM: w1-gpio: fix erroneous gpio requests + +From: Johan Hovold + +commit 2d798a3f20ae992b0b69a2b68c04ada397c32ed4 upstream. + +Fix regression introduced by commit d2323cf773 ("onewire: w1-gpio: add +ext_pullup_enable pin in platform data") which added a gpio entry to the +platform data, but did not add the required initialisers to the board +files using it. Consequently, the driver would request gpio 0 at probe, +which could break other uses of the corresponding pin. + +On AT91 requesting gpio 0 changes the pin muxing for PIOA0, which, for +instance, breaks SPI0 on at91sam9g20. + +Signed-off-by: Johan Hovold +Acked-by: Jean-Christophe PLAGNIOL-VILLARD +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-at91/board-foxg20.c | 1 + + arch/arm/mach-at91/board-stamp9g20.c | 1 + + arch/arm/mach-ixp4xx/vulcan-setup.c | 1 + + arch/arm/mach-pxa/raumfeld.c | 1 + + 4 files changed, 4 insertions(+) + +--- a/arch/arm/mach-at91/board-foxg20.c ++++ b/arch/arm/mach-at91/board-foxg20.c +@@ -176,6 +176,7 @@ static struct w1_gpio_platform_data w1_g + /* If you choose to use a pin other than PB16 it needs to be 3.3V */ + .pin = AT91_PIN_PB16, + .is_open_drain = 1, ++ .ext_pullup_enable_pin = -EINVAL, + }; + + static struct platform_device w1_device = { +--- a/arch/arm/mach-at91/board-stamp9g20.c ++++ b/arch/arm/mach-at91/board-stamp9g20.c +@@ -188,6 +188,7 @@ static struct spi_board_info portuxg20_s + static struct w1_gpio_platform_data w1_gpio_pdata = { + .pin = AT91_PIN_PA29, + .is_open_drain = 1, ++ .ext_pullup_enable_pin = -EINVAL, + }; + + static struct platform_device w1_device = { +--- a/arch/arm/mach-ixp4xx/vulcan-setup.c ++++ b/arch/arm/mach-ixp4xx/vulcan-setup.c +@@ -163,6 +163,7 @@ static struct platform_device vulcan_max + + static struct w1_gpio_platform_data vulcan_w1_gpio_pdata = { + .pin = 14, ++ .ext_pullup_enable_pin = -EINVAL, + }; + + static struct platform_device vulcan_w1_gpio = { +--- a/arch/arm/mach-pxa/raumfeld.c ++++ b/arch/arm/mach-pxa/raumfeld.c +@@ -505,6 +505,7 @@ static struct w1_gpio_platform_data w1_g + .pin = GPIO_ONE_WIRE, + .is_open_drain = 0, + .enable_external_pullup = w1_enable_external_pullup, ++ .ext_pullup_enable_pin = -EINVAL, + }; + + struct platform_device raumfeld_w1_gpio_device = { diff --git a/queue-3.8/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch b/queue-3.8/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch new file mode 100644 index 00000000000..e3b3b74f6f5 --- /dev/null +++ b/queue-3.8/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch @@ -0,0 +1,36 @@ +From df069079c153d22adf6c28dcc0b1cf62bba75167 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Thu, 14 Mar 2013 16:27:18 +0800 +Subject: hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes + +From: Axel Lin + +commit df069079c153d22adf6c28dcc0b1cf62bba75167 upstream. + +Signed-off-by: Axel Lin +Acked-by: Jean Delvare +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lineage-pem.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwmon/lineage-pem.c ++++ b/drivers/hwmon/lineage-pem.c +@@ -422,6 +422,7 @@ static struct attribute *pem_input_attri + &sensor_dev_attr_in2_input.dev_attr.attr, + &sensor_dev_attr_curr1_input.dev_attr.attr, + &sensor_dev_attr_power1_input.dev_attr.attr, ++ NULL + }; + + static const struct attribute_group pem_input_group = { +@@ -432,6 +433,7 @@ static struct attribute *pem_fan_attribu + &sensor_dev_attr_fan1_input.dev_attr.attr, + &sensor_dev_attr_fan2_input.dev_attr.attr, + &sensor_dev_attr_fan3_input.dev_attr.attr, ++ NULL + }; + + static const struct attribute_group pem_fan_group = { diff --git a/queue-3.8/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch b/queue-3.8/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch new file mode 100644 index 00000000000..d312ae5bbfd --- /dev/null +++ b/queue-3.8/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch @@ -0,0 +1,69 @@ +From 8c958c703ef8804093437959221951eaf0e1e664 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Thu, 21 Feb 2013 10:27:54 -0800 +Subject: hwmon: (pmbus/ltc2978) Fix temperature reporting + +From: Guenter Roeck + +commit 8c958c703ef8804093437959221951eaf0e1e664 upstream. + +On LTC2978, only READ_TEMPERATURE is supported. It reports +the internal junction temperature. This register is unpaged. + +On LTC3880, READ_TEMPERATURE and READ_TEMPERATURE2 are supported. +READ_TEMPERATURE is paged and reports external temperatures. +READ_TEMPERATURE2 is unpaged and reports the internal junction +temperature. + +Signed-off-by: Guenter Roeck +Acked-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/pmbus/ltc2978.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/pmbus/ltc2978.c ++++ b/drivers/hwmon/pmbus/ltc2978.c +@@ -59,7 +59,7 @@ enum chips { ltc2978, ltc3880 }; + struct ltc2978_data { + enum chips id; + int vin_min, vin_max; +- int temp_min, temp_max; ++ int temp_min, temp_max[2]; + int vout_min[8], vout_max[8]; + int iout_max[2]; + int temp2_max; +@@ -113,9 +113,10 @@ static int ltc2978_read_word_data_common + ret = pmbus_read_word_data(client, page, + LTC2978_MFR_TEMPERATURE_PEAK); + if (ret >= 0) { +- if (lin11_to_val(ret) > lin11_to_val(data->temp_max)) +- data->temp_max = ret; +- ret = data->temp_max; ++ if (lin11_to_val(ret) ++ > lin11_to_val(data->temp_max[page])) ++ data->temp_max[page] = ret; ++ ret = data->temp_max[page]; + } + break; + case PMBUS_VIRT_RESET_VOUT_HISTORY: +@@ -266,7 +267,7 @@ static int ltc2978_write_word_data(struc + break; + case PMBUS_VIRT_RESET_TEMP_HISTORY: + data->temp_min = 0x7bff; +- data->temp_max = 0x7c00; ++ data->temp_max[page] = 0x7c00; + ret = ltc2978_clear_peaks(client, page, data->id); + break; + default: +@@ -323,7 +324,8 @@ static int ltc2978_probe(struct i2c_clie + data->vin_min = 0x7bff; + data->vin_max = 0x7c00; + data->temp_min = 0x7bff; +- data->temp_max = 0x7c00; ++ for (i = 0; i < ARRAY_SIZE(data->temp_max); i++) ++ data->temp_max[i] = 0x7c00; + data->temp2_max = 0x7c00; + + switch (data->id) { diff --git a/queue-3.8/series b/queue-3.8/series index 255c88204f5..b92b946300f 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -27,3 +27,9 @@ tty-do-not-reset-master-s-packet-mode.patch fix-4-port-and-add-support-for-8-port-unknown-pci-serial-port-cards.patch arm-kirkwood-fix-to-retain-gbe-mac-addresses-for-dt-kernels.patch perf-x86-fix-kernel-crash-with-pebs-bts-after-suspend-resume.patch +alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch +arm-w1-gpio-fix-erroneous-gpio-requests.patch +hwmon-pmbus-ltc2978-fix-temperature-reporting.patch +hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch +w1-gpio-remove-erroneous-__exit-and-__exit_p.patch +w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch diff --git a/queue-3.8/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch b/queue-3.8/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch new file mode 100644 index 00000000000..71b57420b2a --- /dev/null +++ b/queue-3.8/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch @@ -0,0 +1,53 @@ +From 9d1817cab2f030f6af360e961cc69bb1da8ad765 Mon Sep 17 00:00:00 2001 +From: Marcin Jurkowski +Date: Sat, 2 Mar 2013 14:50:15 +0100 +Subject: w1: fix oops when w1_search is called from netlink connector + +From: Marcin Jurkowski + +commit 9d1817cab2f030f6af360e961cc69bb1da8ad765 upstream. + +On Sat, Mar 02, 2013 at 10:45:10AM +0100, Sven Geggus wrote: +> This is the bad commit I found doing git bisect: +> 04f482faf50535229a5a5c8d629cf963899f857c is the first bad commit +> commit 04f482faf50535229a5a5c8d629cf963899f857c +> Author: Patrick McHardy +> Date: Mon Mar 28 08:39:36 2011 +0000 + +Good job. I was too lazy to bisect for bad commit;) + +Reading the code I found problematic kthread_should_stop call from netlink +connector which causes the oops. After applying a patch, I've been testing +owfs+w1 setup for nearly two days and it seems to work very reliable (no +hangs, no memleaks etc). +More detailed description and possible fix is given below: + +Function w1_search can be called from either kthread or netlink callback. +While the former works fine, the latter causes oops due to kthread_should_stop +invocation. + +This patch adds a check if w1_search is serving netlink command, skipping +kthread_should_stop invocation if so. + +Signed-off-by: Marcin Jurkowski +Acked-by: Evgeniy Polyakov +Cc: Josh Boyer +Tested-by: Sven Geggus +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/w1/w1.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -924,7 +924,8 @@ void w1_search(struct w1_master *dev, u8 + tmp64 = (triplet_ret >> 2); + rn |= (tmp64 << i); + +- if (kthread_should_stop()) { ++ /* ensure we're called from kthread and not by netlink callback */ ++ if (!dev->priv && kthread_should_stop()) { + mutex_unlock(&dev->bus_mutex); + dev_dbg(&dev->dev, "Abort w1_search\n"); + return; diff --git a/queue-3.8/w1-gpio-remove-erroneous-__exit-and-__exit_p.patch b/queue-3.8/w1-gpio-remove-erroneous-__exit-and-__exit_p.patch new file mode 100644 index 00000000000..2d75c338e6d --- /dev/null +++ b/queue-3.8/w1-gpio-remove-erroneous-__exit-and-__exit_p.patch @@ -0,0 +1,42 @@ +From 01230551e7c2fb9a1c2519b356d703851049cbe0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 Mar 2013 11:07:59 +0100 +Subject: w1-gpio: remove erroneous __exit and __exit_p() + +From: Johan Hovold + +commit 01230551e7c2fb9a1c2519b356d703851049cbe0 upstream. + +Commit 8a1861d997 ("w1-gpio: Simplify & get rid of defines") changed +(apparently unknowingly) the driver to a hotpluggable platform-device +driver but did not not update the section markers for probe and remove +(to __devinit/exit, which have since been removed). A later commit fixed +the section mismatch for probe, but left remove marked with __exit. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/w1/masters/w1-gpio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/w1/masters/w1-gpio.c ++++ b/drivers/w1/masters/w1-gpio.c +@@ -158,7 +158,7 @@ static int w1_gpio_probe(struct platform + return err; + } + +-static int __exit w1_gpio_remove(struct platform_device *pdev) ++static int w1_gpio_remove(struct platform_device *pdev) + { + struct w1_bus_master *master = platform_get_drvdata(pdev); + struct w1_gpio_platform_data *pdata = pdev->dev.platform_data; +@@ -210,7 +210,7 @@ static struct platform_driver w1_gpio_dr + .of_match_table = of_match_ptr(w1_gpio_dt_ids), + }, + .probe = w1_gpio_probe, +- .remove = __exit_p(w1_gpio_remove), ++ .remove = w1_gpio_remove, + .suspend = w1_gpio_suspend, + .resume = w1_gpio_resume, + }; -- 2.47.3