From 96ee544c60bb252520c933ff20a5873c532fc095 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 18 Mar 2013 10:21:18 -0700 Subject: [PATCH] 3.4-stable patches added patches: alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch hwmon-pmbus-ltc2978-fix-temperature-reporting.patch w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch --- ...error-handling-in-snd_seq_timer_open.patch | 74 +++++++++++++++++++ ...erminating-entry-for-pem__attributes.patch | 36 +++++++++ ...us-ltc2978-fix-temperature-reporting.patch | 69 +++++++++++++++++ queue-3.4/series | 4 + ...rch-is-called-from-netlink-connector.patch | 53 +++++++++++++ 5 files changed, 236 insertions(+) create mode 100644 queue-3.4/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch create mode 100644 queue-3.4/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch create mode 100644 queue-3.4/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch create mode 100644 queue-3.4/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch diff --git a/queue-3.4/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch b/queue-3.4/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch new file mode 100644 index 00000000000..b33585d8969 --- /dev/null +++ b/queue-3.4/alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch @@ -0,0 +1,74 @@ +From 66efdc71d95887b652a742a5dae51fa834d71465 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 8 Mar 2013 18:11:17 +0100 +Subject: ALSA: seq: Fix missing error handling in snd_seq_timer_open() + +From: Takashi Iwai + +commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream. + +snd_seq_timer_open() didn't catch the whole error path but let through +if the timer id is a slave. This may lead to Oops by accessing the +uninitialized pointer. + + BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae + IP: [] snd_seq_timer_open+0xe7/0x130 + PGD 785cd067 PUD 76964067 PMD 0 + Oops: 0002 [#4] SMP + CPU 0 + Pid: 4288, comm: trinity-child7 Tainted: G D W 3.9.0-rc1+ #100 Bochs Bochs + RIP: 0010:[] [] snd_seq_timer_open+0xe7/0x130 + RSP: 0018:ffff88006ece7d38 EFLAGS: 00010246 + RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000 + RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38 + RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe + R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 + R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007 + FS: 00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290) + Stack: + 0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d + 65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000 + ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520 + Call Trace: + [] ? trace_hardirqs_on+0xd/0x10 + [] snd_seq_queue_timer_open+0x29/0x70 + [] snd_seq_ioctl_set_queue_timer+0xda/0x120 + [] snd_seq_do_ioctl+0x9b/0xd0 + [] snd_seq_ioctl+0x10/0x20 + [] do_vfs_ioctl+0x522/0x570 + [] ? file_has_perm+0x83/0xa0 + [] ? trace_hardirqs_on+0xd/0x10 + [] sys_ioctl+0x5d/0xa0 + [] ? trace_hardirqs_on_thunk+0x3a/0x3f + [] system_call_fastpath+0x16/0x1b + +Reported-and-tested-by: Tommi Rantala +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_timer.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/core/seq/seq_timer.c ++++ b/sound/core/seq/seq_timer.c +@@ -290,10 +290,10 @@ int snd_seq_timer_open(struct snd_seq_qu + tid.device = SNDRV_TIMER_GLOBAL_SYSTEM; + err = snd_timer_open(&t, str, &tid, q->queue); + } +- if (err < 0) { +- snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err); +- return err; +- } ++ } ++ if (err < 0) { ++ snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err); ++ return err; + } + t->callback = snd_seq_timer_interrupt; + t->callback_data = q; diff --git a/queue-3.4/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch b/queue-3.4/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch new file mode 100644 index 00000000000..15640ce25d0 --- /dev/null +++ b/queue-3.4/hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch @@ -0,0 +1,36 @@ +From df069079c153d22adf6c28dcc0b1cf62bba75167 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Thu, 14 Mar 2013 16:27:18 +0800 +Subject: hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes + +From: Axel Lin + +commit df069079c153d22adf6c28dcc0b1cf62bba75167 upstream. + +Signed-off-by: Axel Lin +Acked-by: Jean Delvare +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lineage-pem.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwmon/lineage-pem.c ++++ b/drivers/hwmon/lineage-pem.c +@@ -421,6 +421,7 @@ static struct attribute *pem_input_attri + &sensor_dev_attr_in2_input.dev_attr.attr, + &sensor_dev_attr_curr1_input.dev_attr.attr, + &sensor_dev_attr_power1_input.dev_attr.attr, ++ NULL + }; + + static const struct attribute_group pem_input_group = { +@@ -431,6 +432,7 @@ static struct attribute *pem_fan_attribu + &sensor_dev_attr_fan1_input.dev_attr.attr, + &sensor_dev_attr_fan2_input.dev_attr.attr, + &sensor_dev_attr_fan3_input.dev_attr.attr, ++ NULL + }; + + static const struct attribute_group pem_fan_group = { diff --git a/queue-3.4/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch b/queue-3.4/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch new file mode 100644 index 00000000000..d312ae5bbfd --- /dev/null +++ b/queue-3.4/hwmon-pmbus-ltc2978-fix-temperature-reporting.patch @@ -0,0 +1,69 @@ +From 8c958c703ef8804093437959221951eaf0e1e664 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Thu, 21 Feb 2013 10:27:54 -0800 +Subject: hwmon: (pmbus/ltc2978) Fix temperature reporting + +From: Guenter Roeck + +commit 8c958c703ef8804093437959221951eaf0e1e664 upstream. + +On LTC2978, only READ_TEMPERATURE is supported. It reports +the internal junction temperature. This register is unpaged. + +On LTC3880, READ_TEMPERATURE and READ_TEMPERATURE2 are supported. +READ_TEMPERATURE is paged and reports external temperatures. +READ_TEMPERATURE2 is unpaged and reports the internal junction +temperature. + +Signed-off-by: Guenter Roeck +Acked-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/pmbus/ltc2978.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/pmbus/ltc2978.c ++++ b/drivers/hwmon/pmbus/ltc2978.c +@@ -59,7 +59,7 @@ enum chips { ltc2978, ltc3880 }; + struct ltc2978_data { + enum chips id; + int vin_min, vin_max; +- int temp_min, temp_max; ++ int temp_min, temp_max[2]; + int vout_min[8], vout_max[8]; + int iout_max[2]; + int temp2_max; +@@ -113,9 +113,10 @@ static int ltc2978_read_word_data_common + ret = pmbus_read_word_data(client, page, + LTC2978_MFR_TEMPERATURE_PEAK); + if (ret >= 0) { +- if (lin11_to_val(ret) > lin11_to_val(data->temp_max)) +- data->temp_max = ret; +- ret = data->temp_max; ++ if (lin11_to_val(ret) ++ > lin11_to_val(data->temp_max[page])) ++ data->temp_max[page] = ret; ++ ret = data->temp_max[page]; + } + break; + case PMBUS_VIRT_RESET_VOUT_HISTORY: +@@ -266,7 +267,7 @@ static int ltc2978_write_word_data(struc + break; + case PMBUS_VIRT_RESET_TEMP_HISTORY: + data->temp_min = 0x7bff; +- data->temp_max = 0x7c00; ++ data->temp_max[page] = 0x7c00; + ret = ltc2978_clear_peaks(client, page, data->id); + break; + default: +@@ -323,7 +324,8 @@ static int ltc2978_probe(struct i2c_clie + data->vin_min = 0x7bff; + data->vin_max = 0x7c00; + data->temp_min = 0x7bff; +- data->temp_max = 0x7c00; ++ for (i = 0; i < ARRAY_SIZE(data->temp_max); i++) ++ data->temp_max[i] = 0x7c00; + data->temp2_max = 0x7c00; + + switch (data->id) { diff --git a/queue-3.4/series b/queue-3.4/series index 1f3666be1f6..81dfe2358fb 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -15,3 +15,7 @@ serial-8250_pci-add-support-for-another-kind-of-netmos-technology-pci-9835-multi tty-serial-fix-typo-arch_s5p6450.patch tty-do-not-reset-master-s-packet-mode.patch perf-x86-fix-kernel-crash-with-pebs-bts-after-suspend-resume.patch +alsa-seq-fix-missing-error-handling-in-snd_seq_timer_open.patch +hwmon-pmbus-ltc2978-fix-temperature-reporting.patch +hwmon-lineage-pem-add-missing-terminating-entry-for-pem__attributes.patch +w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch diff --git a/queue-3.4/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch b/queue-3.4/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch new file mode 100644 index 00000000000..3aa0cd0bbec --- /dev/null +++ b/queue-3.4/w1-fix-oops-when-w1_search-is-called-from-netlink-connector.patch @@ -0,0 +1,53 @@ +From 9d1817cab2f030f6af360e961cc69bb1da8ad765 Mon Sep 17 00:00:00 2001 +From: Marcin Jurkowski +Date: Sat, 2 Mar 2013 14:50:15 +0100 +Subject: w1: fix oops when w1_search is called from netlink connector + +From: Marcin Jurkowski + +commit 9d1817cab2f030f6af360e961cc69bb1da8ad765 upstream. + +On Sat, Mar 02, 2013 at 10:45:10AM +0100, Sven Geggus wrote: +> This is the bad commit I found doing git bisect: +> 04f482faf50535229a5a5c8d629cf963899f857c is the first bad commit +> commit 04f482faf50535229a5a5c8d629cf963899f857c +> Author: Patrick McHardy +> Date: Mon Mar 28 08:39:36 2011 +0000 + +Good job. I was too lazy to bisect for bad commit;) + +Reading the code I found problematic kthread_should_stop call from netlink +connector which causes the oops. After applying a patch, I've been testing +owfs+w1 setup for nearly two days and it seems to work very reliable (no +hangs, no memleaks etc). +More detailed description and possible fix is given below: + +Function w1_search can be called from either kthread or netlink callback. +While the former works fine, the latter causes oops due to kthread_should_stop +invocation. + +This patch adds a check if w1_search is serving netlink command, skipping +kthread_should_stop invocation if so. + +Signed-off-by: Marcin Jurkowski +Acked-by: Evgeniy Polyakov +Cc: Josh Boyer +Tested-by: Sven Geggus +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/w1/w1.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -928,7 +928,8 @@ void w1_search(struct w1_master *dev, u8 + tmp64 = (triplet_ret >> 2); + rn |= (tmp64 << i); + +- if (kthread_should_stop()) { ++ /* ensure we're called from kthread and not by netlink callback */ ++ if (!dev->priv && kthread_should_stop()) { + dev_dbg(&dev->dev, "Abort w1_search\n"); + return; + } -- 2.47.3