From d1c01e92e9de2df4ce343c3b6c8cfa695c27affa Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 17 Sep 2014 14:19:14 -0700 Subject: [PATCH] 3.10-stable patches added patches: carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch drm-tilcdc-fix-double-kfree.patch drm-tilcdc-fix-release-order-on-exit.patch drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch --- ...ith-wrong-type-when-using-full-speed.patch | 102 ++++++++++++++++++ queue-3.10/drm-tilcdc-fix-double-kfree.patch | 59 ++++++++++ ...drm-tilcdc-fix-release-order-on-exit.patch | 42 ++++++++ ...el-fix-dangling-sysfs-connector-node.patch | 58 ++++++++++ ...l-fix-leak-when-unloading-the-module.patch | 38 +++++++ ...ve-fix-dangling-sysfs-connector-node.patch | 59 ++++++++++ ...10-fix-dangling-sysfs-connector-node.patch | 37 +++++++ queue-3.10/series | 7 ++ 8 files changed, 402 insertions(+) create mode 100644 queue-3.10/carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch create mode 100644 queue-3.10/drm-tilcdc-fix-double-kfree.patch create mode 100644 queue-3.10/drm-tilcdc-fix-release-order-on-exit.patch create mode 100644 queue-3.10/drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch create mode 100644 queue-3.10/drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch create mode 100644 queue-3.10/drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch create mode 100644 queue-3.10/drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch diff --git a/queue-3.10/carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch b/queue-3.10/carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch new file mode 100644 index 00000000000..e6b9c100ee4 --- /dev/null +++ b/queue-3.10/carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch @@ -0,0 +1,102 @@ +From 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 Mon Sep 17 00:00:00 2001 +From: Ronald Wahl +Date: Thu, 7 Aug 2014 14:15:50 +0200 +Subject: carl9170: fix sending URBs with wrong type when using full-speed + +From: Ronald Wahl + +commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream. + +The driver assumes that endpoint 4 is always an interrupt endpoint. +Unfortunately the type differs between high-speed and full-speed +configurations while in the former case it is indeed an interrupt +endpoint this is not true for the latter case - here it is a bulk +endpoint. When sending URBs with the wrong type the kernel will +generate a warning message including backtrace. In this specific +case there will be a huge amount of warnings which can bring the system +to freeze. + +To fix this we are now sending URBs to endpoint 4 using the type +found in the endpoint descriptor. + +A side note: The carl9170 firmware currently specifies endpoint 4 as +interrupt endpoint even in the full-speed configuration but this has +no relevance because before this firmware is loaded the endpoint type +is as described above and after the firmware is running the stick is not +reenumerated and so the old descriptor is used. + +Signed-off-by: Ronald Wahl +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/carl9170/carl9170.h | 1 + drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++---- + 2 files changed, 28 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ath/carl9170/carl9170.h ++++ b/drivers/net/wireless/ath/carl9170/carl9170.h +@@ -253,6 +253,7 @@ struct ar9170 { + atomic_t rx_work_urbs; + atomic_t rx_pool_urbs; + kernel_ulong_t features; ++ bool usb_ep_cmd_is_bulk; + + /* firmware settings */ + struct completion fw_load_wait; +--- a/drivers/net/wireless/ath/carl9170/usb.c ++++ b/drivers/net/wireless/ath/carl9170/usb.c +@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a + goto err_free; + } + +- usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev, +- AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4, +- carl9170_usb_cmd_complete, ar, 1); ++ if (ar->usb_ep_cmd_is_bulk) ++ usb_fill_bulk_urb(urb, ar->udev, ++ usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD), ++ cmd, cmd->hdr.len + 4, ++ carl9170_usb_cmd_complete, ar); ++ else ++ usb_fill_int_urb(urb, ar->udev, ++ usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD), ++ cmd, cmd->hdr.len + 4, ++ carl9170_usb_cmd_complete, ar, 1); + + if (free_buf) + urb->transfer_flags |= URB_FREE_BUFFER; +@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2( + static int carl9170_usb_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { ++ struct usb_endpoint_descriptor *ep; + struct ar9170 *ar; + struct usb_device *udev; +- int err; ++ int i, err; + + err = usb_reset_device(interface_to_usbdev(intf)); + if (err) +@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb + ar->intf = intf; + ar->features = id->driver_info; + ++ /* We need to remember the type of endpoint 4 because it differs ++ * between high- and full-speed configuration. The high-speed ++ * configuration specifies it as interrupt and the full-speed ++ * configuration as bulk endpoint. This information is required ++ * later when sending urbs to that endpoint. ++ */ ++ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) { ++ ep = &intf->cur_altsetting->endpoint[i].desc; ++ ++ if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD && ++ usb_endpoint_dir_out(ep) && ++ usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK) ++ ar->usb_ep_cmd_is_bulk = true; ++ } ++ + usb_set_intfdata(intf, ar); + SET_IEEE80211_DEV(ar->hw, &intf->dev); + diff --git a/queue-3.10/drm-tilcdc-fix-double-kfree.patch b/queue-3.10/drm-tilcdc-fix-double-kfree.patch new file mode 100644 index 00000000000..b8db3b73873 --- /dev/null +++ b/queue-3.10/drm-tilcdc-fix-double-kfree.patch @@ -0,0 +1,59 @@ +From c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= +Date: Tue, 17 Jun 2014 11:17:09 -0300 +Subject: drm/tilcdc: fix double kfree +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= + +commit c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca upstream. + +display_timings_release calls kfree on the display_timings object passed +to it. Calling kfree after it is wrong. SLUB debug showed the following +warning: + + ============================================================================= + BUG kmalloc-64 (Tainted: G W ): Object already free + ----------------------------------------------------------------------------- + + Disabling lock debugging due to kernel taint + INFO: Allocated in of_get_display_timings+0x2c/0x214 age=601 cpu=0 + pid=884 + __slab_alloc.constprop.79+0x2e0/0x33c + kmem_cache_alloc+0xac/0xdc + of_get_display_timings+0x2c/0x214 + panel_probe+0x7c/0x314 [tilcdc] + platform_drv_probe+0x18/0x48 + [..snip..] + INFO: Freed in panel_destroy+0x18/0x3c [tilcdc] age=0 cpu=0 pid=907 + __slab_free+0x34/0x330 + panel_destroy+0x18/0x3c [tilcdc] + tilcdc_unload+0xd0/0x118 [tilcdc] + drm_dev_unregister+0x24/0x98 + [..snip..] + +Signed-off-by: Guido Martínez +Tested-by: Darren Etheridge +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tilcdc/tilcdc_panel.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +@@ -286,10 +286,8 @@ static void panel_destroy(struct tilcdc_ + { + struct panel_module *panel_mod = to_panel_module(mod); + +- if (panel_mod->timings) { ++ if (panel_mod->timings) + display_timings_release(panel_mod->timings); +- kfree(panel_mod->timings); +- } + + tilcdc_module_cleanup(mod); + kfree(panel_mod->info); diff --git a/queue-3.10/drm-tilcdc-fix-release-order-on-exit.patch b/queue-3.10/drm-tilcdc-fix-release-order-on-exit.patch new file mode 100644 index 00000000000..bece87d9369 --- /dev/null +++ b/queue-3.10/drm-tilcdc-fix-release-order-on-exit.patch @@ -0,0 +1,42 @@ +From eb565a2bbadc6a5030a6dbe58db1aa52453e7edf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= +Date: Tue, 17 Jun 2014 11:17:08 -0300 +Subject: drm/tilcdc: fix release order on exit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= + +commit eb565a2bbadc6a5030a6dbe58db1aa52453e7edf upstream. + +Unregister resources in the correct order on tilcdc_drm_fini, which is +the reverse order they were registered during tilcdc_drm_init. + +This also means unregistering the driver before releasing its resources. + +Signed-off-by: Guido Martínez +Tested-by: Darren Etheridge +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tilcdc/tilcdc_drv.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +@@ -597,10 +597,10 @@ static int __init tilcdc_drm_init(void) + static void __exit tilcdc_drm_fini(void) + { + DBG("fini"); +- tilcdc_tfp410_fini(); +- tilcdc_slave_fini(); +- tilcdc_panel_fini(); + platform_driver_unregister(&tilcdc_platform_driver); ++ tilcdc_panel_fini(); ++ tilcdc_slave_fini(); ++ tilcdc_tfp410_fini(); + } + + late_initcall(tilcdc_drm_init); diff --git a/queue-3.10/drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch b/queue-3.10/drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch new file mode 100644 index 00000000000..91a08b9948e --- /dev/null +++ b/queue-3.10/drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch @@ -0,0 +1,58 @@ +From e396900e649b0af31161634d87fe37076f46c12b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= +Date: Tue, 17 Jun 2014 11:17:04 -0300 +Subject: drm/tilcdc: panel: fix dangling sysfs connector node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= + +commit e396900e649b0af31161634d87fe37076f46c12b upstream. + +Add a drm_sysfs_connector_remove call when we destroy the panel to make +sure the connector node in sysfs gets deleted. + +This is required for proper unload and re-load of this driver as a +module. Without this, we would get a warning at re-load time like so: + + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 824 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74() + sysfs: cannot create duplicate filename '/class/drm/card0-LVDS-1' + Modules linked in: [...] + CPU: 0 PID: 824 Comm: modprobe Not tainted 3.15.0-rc4-00027-g6484f96-dirty #81 + [] (unwind_backtrace) from [] (show_stack+0x10/0x14) + [] (show_stack) from [] (warn_slowpath_common+0x68/0x88) + [] (warn_slowpath_common) from [] (warn_slowpath_fmt+0x30/0x40) + [] (warn_slowpath_fmt) from [] (sysfs_warn_dup+0x54/0x74) + [] (sysfs_warn_dup) from [] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8) + [] (sysfs_do_create_link_sd.isra.2) from [] (device_add+0x338/0x520) + [] (device_add) from [] (device_create_groups_vargs+0xa0/0xc4) + [] (device_create_groups_vargs) from [] (device_create+0x24/0x2c) + [] (device_create) from [] (drm_sysfs_connector_add+0x64/0x204) + [] (drm_sysfs_connector_add) from [] (panel_modeset_init+0xb8/0x134 [tilcdc]) + [] (panel_modeset_init [tilcdc]) from [] (tilcdc_load+0x214/0x4c0 [tilcdc]) + [] (tilcdc_load [tilcdc]) from [] (drm_dev_register+0xa4/0x104) + [ .. snip .. ] + ---[ end trace b2d09cd9578b0497 ]--- + [drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17 + +Signed-off-by: Guido Martínez +Tested-by: Darren Etheridge +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tilcdc/tilcdc_panel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c +@@ -151,6 +151,7 @@ struct panel_connector { + static void panel_connector_destroy(struct drm_connector *connector) + { + struct panel_connector *panel_connector = to_panel_connector(connector); ++ drm_sysfs_connector_remove(connector); + drm_connector_cleanup(connector); + kfree(panel_connector); + } diff --git a/queue-3.10/drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch b/queue-3.10/drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch new file mode 100644 index 00000000000..52549b483db --- /dev/null +++ b/queue-3.10/drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch @@ -0,0 +1,38 @@ +From 3a49012224ca9016658a831a327ff6a7fe5bb4f9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= +Date: Tue, 17 Jun 2014 11:17:07 -0300 +Subject: drm/tilcdc: panel: fix leak when unloading the module +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= + +commit 3a49012224ca9016658a831a327ff6a7fe5bb4f9 upstream. + +The driver did not unregister the allocated framebuffer, which caused +memory leaks (and memory manager WARNs) when unloading. Also, the +framebuffer device under /dev still existed after unloading. + +Add a call to drm_fbdev_cma_fini when unloading the module to prevent +both issues. + +Signed-off-by: Guido Martínez +Tested-by: Darren Etheridge +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +@@ -116,6 +116,7 @@ static int tilcdc_unload(struct drm_devi + struct tilcdc_drm_private *priv = dev->dev_private; + struct tilcdc_module *mod, *cur; + ++ drm_fbdev_cma_fini(priv->fbdev); + drm_kms_helper_poll_fini(dev); + drm_mode_config_cleanup(dev); + drm_vblank_cleanup(dev); diff --git a/queue-3.10/drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch b/queue-3.10/drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch new file mode 100644 index 00000000000..903d2698482 --- /dev/null +++ b/queue-3.10/drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch @@ -0,0 +1,59 @@ +From daa15b4cd1eee58eb1322062a3320b1dbe5dc96e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= +Date: Tue, 17 Jun 2014 11:17:05 -0300 +Subject: drm/tilcdc: slave: fix dangling sysfs connector node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= + +commit daa15b4cd1eee58eb1322062a3320b1dbe5dc96e upstream. + +Add a drm_sysfs_connector_remove call when we destroy the panel to make +sure the connector node in sysfs gets deleted. + +This is required for proper unload and re-load of this driver as a +module. Without this, we would get a warning at re-load time like so: + + tda998x 0-0070: found TDA19988 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 825 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74() + sysfs: cannot create duplicate filename '/class/drm/card0-HDMI-A-1' + Modules linked in: [..] + CPU: 0 PID: 825 Comm: modprobe Not tainted 3.15.0-rc4-00027-g9dcdef4 #82 + [] (unwind_backtrace) from [] (show_stack+0x10/0x14) + [] (show_stack) from [] (warn_slowpath_common+0x68/0x88) + [] (warn_slowpath_common) from [] (warn_slowpath_fmt+0x30/0x40) + [] (warn_slowpath_fmt) from [] (sysfs_warn_dup+0x54/0x74) + [] (sysfs_warn_dup) from [] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8) + [] (sysfs_do_create_link_sd.isra.2) from [] (device_add+0x338/0x520) + [] (device_add) from [] (device_create_groups_vargs+0xa0/0xc4) + [] (device_create_groups_vargs) from [] (device_create+0x24/0x2c) + [] (device_create) from [] (drm_sysfs_connector_add+0x64/0x204) + [] (drm_sysfs_connector_add) from [] (slave_modeset_init+0x120/0x1bc [tilcdc]) + [] (slave_modeset_init [tilcdc]) from [] (tilcdc_load+0x214/0x4c0 [tilcdc]) + [] (tilcdc_load [tilcdc]) from [] (drm_dev_register+0xa4/0x104) + [..snip..] + ---[ end trace 4df8d614936ebdee ]--- + [drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17 + +Signed-off-by: Guido Martínez +Tested-by: Darren Etheridge +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_slave.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_slave.c +@@ -142,6 +142,7 @@ struct slave_connector { + static void slave_connector_destroy(struct drm_connector *connector) + { + struct slave_connector *slave_connector = to_slave_connector(connector); ++ drm_sysfs_connector_remove(connector); + drm_connector_cleanup(connector); + kfree(slave_connector); + } diff --git a/queue-3.10/drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch b/queue-3.10/drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch new file mode 100644 index 00000000000..251a5a898d5 --- /dev/null +++ b/queue-3.10/drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch @@ -0,0 +1,37 @@ +From 16dcbdef404f4e87dab985494381939fe0a2d456 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= +Date: Tue, 17 Jun 2014 11:17:06 -0300 +Subject: drm/tilcdc: tfp410: fix dangling sysfs connector node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= + +commit 16dcbdef404f4e87dab985494381939fe0a2d456 upstream. + +Add a drm_sysfs_connector_remove call when we destroy the panel to make +sure the connector node in sysfs gets deleted. + +This is required for proper unload and re-load of this driver, otherwise +we will get a warning about a duplicate filename in sysfs. + +Signed-off-by: Guido Martínez +Tested-by: Darren Etheridge +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c +@@ -168,6 +168,7 @@ struct tfp410_connector { + static void tfp410_connector_destroy(struct drm_connector *connector) + { + struct tfp410_connector *tfp410_connector = to_tfp410_connector(connector); ++ drm_sysfs_connector_remove(connector); + drm_connector_cleanup(connector); + kfree(tfp410_connector); + } diff --git a/queue-3.10/series b/queue-3.10/series index e69de29bb2d..0c550aeefaa 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -0,0 +1,7 @@ +carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch +drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch +drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch +drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch +drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch +drm-tilcdc-fix-release-order-on-exit.patch +drm-tilcdc-fix-double-kfree.patch -- 2.47.3