--- /dev/null
+From 8bab797c6e5724a43b7666ad70860712365cdb71 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 9 May 2014 14:59:16 +0300
+Subject: applicom: dereferencing NULL on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8bab797c6e5724a43b7666ad70860712365cdb71 upstream.
+
+This is a static checker fix. The "dev" variable is always NULL after
+the while statement so we would be dereferencing a NULL pointer here.
+
+Fixes: 819a3eba4233 ('[PATCH] applicom: fix error handling')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/applicom.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/char/applicom.c
++++ b/drivers/char/applicom.c
+@@ -345,7 +345,6 @@ out:
+ free_irq(apbs[i].irq, &dummy);
+ iounmap(apbs[i].RamIO);
+ }
+- pci_disable_device(dev);
+ return ret;
+ }
+
--- /dev/null
+From 77c2f02edbeda9409a7cf3fd66233015820c213a Mon Sep 17 00:00:00 2001
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Fri, 16 May 2014 12:00:57 +0200
+Subject: ARM: OMAP: replace checks for CONFIG_USB_GADGET_OMAP
+
+From: Paul Bolle <pebolle@tiscali.nl>
+
+commit 77c2f02edbeda9409a7cf3fd66233015820c213a upstream.
+
+Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+apparently required that checks for CONFIG_USB_GADGET_OMAP would be
+replaced with checks for CONFIG_USB_OMAP. Do so now for the remaining
+checks for CONFIG_USB_GADGET_OMAP, even though these checks have
+basically been broken since v3.1.
+
+And, since we're touching this code, use the IS_ENABLED() macro, so
+things will now (hopefully) also work if USB_OMAP is modular.
+
+Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap1/board-h2.c | 2 +-
+ arch/arm/mach-omap1/board-h3.c | 2 +-
+ arch/arm/mach-omap1/board-innovator.c | 2 +-
+ arch/arm/mach-omap1/board-osk.c | 2 +-
+ drivers/usb/phy/phy-isp1301-omap.c | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mach-omap1/board-h2.c
++++ b/arch/arm/mach-omap1/board-h2.c
+@@ -346,7 +346,7 @@ static struct omap_usb_config h2_usb_con
+ /* usb1 has a Mini-AB port and external isp1301 transceiver */
+ .otg = 2,
+
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */
+ /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */
+ #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE)
+--- a/arch/arm/mach-omap1/board-h3.c
++++ b/arch/arm/mach-omap1/board-h3.c
+@@ -366,7 +366,7 @@ static struct omap_usb_config h3_usb_con
+ /* usb1 has a Mini-AB port and external isp1301 transceiver */
+ .otg = 2,
+
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */
+ #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE)
+ /* NONSTANDARD CABLE NEEDED (B-to-Mini-B) */
+--- a/arch/arm/mach-omap1/board-innovator.c
++++ b/arch/arm/mach-omap1/board-innovator.c
+@@ -312,7 +312,7 @@ static struct omap_usb_config h2_usb_con
+ /* usb1 has a Mini-AB port and external isp1301 transceiver */
+ .otg = 2,
+
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */
+ /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */
+ #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE)
+--- a/arch/arm/mach-omap1/board-osk.c
++++ b/arch/arm/mach-omap1/board-osk.c
+@@ -283,7 +283,7 @@ static struct omap_usb_config osk_usb_co
+ * be used, with a NONSTANDARD gender-bending cable/dongle, as
+ * a peripheral.
+ */
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .register_dev = 1,
+ .hmc_mode = 0,
+ #else
+--- a/drivers/usb/phy/phy-isp1301-omap.c
++++ b/drivers/usb/phy/phy-isp1301-omap.c
+@@ -1295,7 +1295,7 @@ isp1301_set_host(struct usb_otg *otg, st
+ return isp1301_otg_enable(isp);
+ return 0;
+
+-#elif !defined(CONFIG_USB_GADGET_OMAP)
++#elif !IS_ENABLED(CONFIG_USB_OMAP)
+ // FIXME update its refcount
+ otg->host = host;
+
--- /dev/null
+From e8edca6f7f92234202d6dd163c118ef495244d7c Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Fri, 30 May 2014 10:49:29 +0800
+Subject: block: virtio_blk: don't hold spin lock during world switch
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit e8edca6f7f92234202d6dd163c118ef495244d7c upstream.
+
+Firstly, it isn't necessary to hold lock of vblk->vq_lock
+when notifying hypervisor about queued I/O.
+
+Secondly, virtqueue_notify() will cause world switch and
+it may take long time on some hypervisors(such as, qemu-arm),
+so it isn't good to hold the lock and block other vCPUs.
+
+On arm64 quad core VM(qemu-kvm), the patch can increase I/O
+performance a lot with VIRTIO_RING_F_EVENT_IDX enabled:
+ - without the patch: 14K IOPS
+ - with the patch: 34K IOPS
+
+fio script:
+ [global]
+ direct=1
+ bsrange=4k-4k
+ timeout=10
+ numjobs=4
+ ioengine=libaio
+ iodepth=64
+
+ filename=/dev/vdc
+ group_reporting=1
+
+ [f1]
+ rw=randread
+
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: virtualization@lists.linux-foundation.org
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Acked-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/virtio_blk.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -159,6 +159,7 @@ static int virtio_queue_rq(struct blk_mq
+ unsigned int num;
+ const bool last = (req->cmd_flags & REQ_END) != 0;
+ int err;
++ bool notify = false;
+
+ BUG_ON(req->nr_phys_segments + 2 > vblk->sg_elems);
+
+@@ -211,10 +212,12 @@ static int virtio_queue_rq(struct blk_mq
+ return BLK_MQ_RQ_QUEUE_ERROR;
+ }
+
+- if (last)
+- virtqueue_kick(vblk->vq);
+-
++ if (last && virtqueue_kick_prepare(vblk->vq))
++ notify = true;
+ spin_unlock_irqrestore(&vblk->vq_lock, flags);
++
++ if (notify)
++ virtqueue_notify(vblk->vq);
+ return BLK_MQ_RQ_QUEUE_OK;
+ }
+
--- /dev/null
+From 12adef5b49e98eb181b4163c36e2998169e1379b Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Wed, 9 Apr 2014 11:56:09 +0200
+Subject: extcon: max14577: Fix probe failure on successful work queue
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 12adef5b49e98eb181b4163c36e2998169e1379b upstream.
+
+In probe the driver queued delayed work for cable detection and
+returned the result of queue_delayed_work() call. However the return
+value of queue_delayed_work() does not indicate an error and in normal
+condition it returns true which means successful work queue.
+This effectively resulted in probe failure:
+[ 2.088204] max14577-muic: probe of max77836-muic failed with error 1
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: 962e56bfcf0b ("extcon: max14577: Add extcon-max14577 driver...")
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/extcon/extcon-max14577.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/extcon/extcon-max14577.c
++++ b/drivers/extcon/extcon-max14577.c
+@@ -710,13 +710,8 @@ static int max14577_muic_probe(struct pl
+ * driver should notify cable state to upper layer.
+ */
+ INIT_DELAYED_WORK(&info->wq_detcable, max14577_muic_detect_cable_wq);
+- ret = queue_delayed_work(system_power_efficient_wq, &info->wq_detcable,
++ queue_delayed_work(system_power_efficient_wq, &info->wq_detcable,
+ delay_jiffies);
+- if (ret < 0) {
+- dev_err(&pdev->dev,
+- "failed to schedule delayed work for cable detect\n");
+- goto err_extcon;
+- }
+
+ return ret;
+
--- /dev/null
+From 369afd4ba22f5b8de0c9229b6e62b3f9e2207034 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Fri, 18 Apr 2014 16:47:30 +0200
+Subject: extcon: max14577: Properly handle regmap_irq_get_virq error
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 369afd4ba22f5b8de0c9229b6e62b3f9e2207034 upstream.
+
+The regmap_irq_get_virq may return 0 or -EINVAL on error. Fail the probe
+in both situations.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/extcon/extcon-max14577.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/extcon/extcon-max14577.c
++++ b/drivers/extcon/extcon-max14577.c
+@@ -650,7 +650,7 @@ static int max14577_muic_probe(struct pl
+ unsigned int virq = 0;
+
+ virq = regmap_irq_get_virq(max14577->irq_data, muic_irq->irq);
+- if (!virq)
++ if (virq <= 0)
+ return -EINVAL;
+ muic_irq->virq = virq;
+
--- /dev/null
+From d5653f2b7304f05eeb45d84f123cf02f840b8537 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Wed, 9 Apr 2014 15:20:12 +0200
+Subject: extcon: max77693: Fix two NULL pointer exceptions on missing pdata
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit d5653f2b7304f05eeb45d84f123cf02f840b8537 upstream.
+
+Fix NULL pointer exceptions when platform data is not supplied.
+
+Trace of one exception:
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+pgd = c0004000
+[00000008] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+Modules linked in:
+CPU: 2 PID: 1 Comm: swapper/0 Not tainted 3.14.0-12045-gead5dd4687a6-dirty #1628
+task: eea80000 ti: eea88000 task.ti: eea88000
+PC is at max77693_muic_probe+0x27c/0x528
+LR is at regmap_write+0x50/0x60
+pc : [<c041d1c8>] lr : [<c02eba60>] psr: 20000113
+sp : eea89e38 ip : 00000000 fp : c098a834
+r10: ee1a5a10 r9 : 00000005 r8 : c098a83c
+r7 : 0000000a r6 : c098a774 r5 : 00000005 r4 : eeb006d0
+r3 : c0697bd8 r2 : 00000000 r1 : 00000001 r0 : 00000000
+Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5387d Table: 4000404a DAC: 00000015
+Process swapper/0 (pid: 1, stack limit = 0xeea88240)
+Stack: (0xeea89e38 to 0xeea8a000)
+9e20: c08499fc eeb006d0
+9e40: 00000000 00000000 c0915f98 00000001 00000000 ee1a5a10 c098a730 c09a88b8
+9e60: 00000000 c098a730 c0915f98 00000000 00000000 c02d6aa0 c02d6a88 ee1a5a10
+9e80: c0a712c8 c02d54e4 00001204 c0628b00 ee1a5a10 c098a730 ee1a5a44 00000000
+9ea0: eea88000 c02d57b4 00000000 c098a730 c02d5728 c02d3a24 ee813e5c eeb9d534
+9ec0: c098a730 ee22f700 c097c720 c02d4b14 c08174ec c098a730 00000006 c098a730
+9ee0: 00000006 c092fd30 c09b8500 c02d5df8 00000000 c093cbb8 00000006 c0008928
+9f00: 000000c3 ef7fc785 00000000 ef7fc794 00000000 c08af968 00000072 eea89f30
+9f20: ef7fc85e c065f198 000000c3 c003e87c 00000003 00000000 c092fd3c 00000000
+9f40: c08af618 c0826d58 00000006 00000006 c0956f58 c093cbb8 00000006 c092fd30
+9f60: c09b8500 000000c3 c092fd3c c08e8510 00000000 c08e8bb0 00000006 00000006
+9f80: c08e8510 c0c0c0c0 00000000 c0628fac 00000000 00000000 00000000 00000000
+9fa0: 00000000 c0628fb4 00000000 c000f038 00000000 00000000 00000000 00000000
+9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 c0c0c0c0 c0c0c0c0
+[<c041d1c8>] (max77693_muic_probe) from [<c02d6aa0>] (platform_drv_probe+0x18/0x48)
+[<c02d6aa0>] (platform_drv_probe) from [<c02d54e4>] (driver_probe_device+0x140/0x384)
+[<c02d54e4>] (driver_probe_device) from [<c02d57b4>] (__driver_attach+0x8c/0x90)
+[<c02d57b4>] (__driver_attach) from [<c02d3a24>] (bus_for_each_dev+0x54/0x88)
+[<c02d3a24>] (bus_for_each_dev) from [<c02d4b14>] (bus_add_driver+0xe8/0x204)
+[<c02d4b14>] (bus_add_driver) from [<c02d5df8>] (driver_register+0x78/0xf4)
+[<c02d5df8>] (driver_register) from [<c0008928>] (do_one_initcall+0xc4/0x174)
+[<c0008928>] (do_one_initcall) from [<c08e8bb0>] (kernel_init_freeable+0xfc/0x1c8)
+[<c08e8bb0>] (kernel_init_freeable) from [<c0628fb4>] (kernel_init+0x8/0xec)
+[<c0628fb4>] (kernel_init) from [<c000f038>] (ret_from_fork+0x14/0x3c)
+Code: caffffe7 e59d200c e3550001 b3a05001 (e5923008)
+---[ end trace 85db969ce011bde7 ]---
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: 190d7cfc8632
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/extcon/extcon-max77693.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/extcon/extcon-max77693.c
++++ b/drivers/extcon/extcon-max77693.c
+@@ -1193,7 +1193,7 @@ static int max77693_muic_probe(struct pl
+
+
+ /* Initialize MUIC register by using platform data or default data */
+- if (pdata->muic_data) {
++ if (pdata && pdata->muic_data) {
+ init_data = pdata->muic_data->init_data;
+ num_init_data = pdata->muic_data->num_init_data;
+ } else {
+@@ -1226,7 +1226,7 @@ static int max77693_muic_probe(struct pl
+ = init_data[i].data;
+ }
+
+- if (pdata->muic_data) {
++ if (pdata && pdata->muic_data) {
+ struct max77693_muic_platform_data *muic_pdata
+ = pdata->muic_data;
+
--- /dev/null
+From dfee4111febf3d9ef3a640b2cd6205c75f4e7e3d Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Wed, 9 Apr 2014 15:20:14 +0200
+Subject: extcon: max8997: Fix NULL pointer exception on missing pdata
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit dfee4111febf3d9ef3a640b2cd6205c75f4e7e3d upstream.
+
+Fix NULL pointer exception when platform data is not supplied. The
+driver dereferenced pdata pointer where it could be NULL.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: 810d601f07c
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/extcon/extcon-max8997.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -715,7 +715,7 @@ static int max8997_muic_probe(struct pla
+ goto err_irq;
+ }
+
+- if (pdata->muic_pdata) {
++ if (pdata && pdata->muic_pdata) {
+ struct max8997_muic_platform_data *muic_pdata
+ = pdata->muic_pdata;
+
--- /dev/null
+From 98dbeadaf050335df8655d8d9be7a324b6cd896e Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 18 Apr 2014 10:46:45 +0100
+Subject: imx-drm: fix hdmi hotplug detection initial state
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 98dbeadaf050335df8655d8d9be7a324b6cd896e upstream.
+
+The initial state at boot is assumed to be disconnected, and we hope
+to receive an interrupt to update the status. Let's be more explicit
+about the current state - reading the PHY status register tells us
+the current level of the hotplug signal, which we can report back in
+the _detect() method.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/imx-drm/imx-hdmi.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/imx-drm/imx-hdmi.c
++++ b/drivers/staging/imx-drm/imx-hdmi.c
+@@ -120,8 +120,6 @@ struct imx_hdmi {
+ struct clk *isfr_clk;
+ struct clk *iahb_clk;
+
+- enum drm_connector_status connector_status;
+-
+ struct hdmi_data_info hdmi_data;
+ int vic;
+
+@@ -1382,7 +1380,9 @@ static enum drm_connector_status imx_hdm
+ {
+ struct imx_hdmi *hdmi = container_of(connector, struct imx_hdmi,
+ connector);
+- return hdmi->connector_status;
++
++ return hdmi_readb(hdmi, HDMI_PHY_STAT0) & HDMI_PHY_HPD ?
++ connector_status_connected : connector_status_disconnected;
+ }
+
+ static int imx_hdmi_connector_get_modes(struct drm_connector *connector)
+@@ -1524,7 +1524,6 @@ static irqreturn_t imx_hdmi_irq(int irq,
+
+ hdmi_modb(hdmi, 0, HDMI_PHY_HPD, HDMI_PHY_POL0);
+
+- hdmi->connector_status = connector_status_connected;
+ imx_hdmi_poweron(hdmi);
+ } else {
+ dev_dbg(hdmi->dev, "EVENT=plugout\n");
+@@ -1532,7 +1531,6 @@ static irqreturn_t imx_hdmi_irq(int irq,
+ hdmi_modb(hdmi, HDMI_PHY_HPD, HDMI_PHY_HPD,
+ HDMI_PHY_POL0);
+
+- hdmi->connector_status = connector_status_disconnected;
+ imx_hdmi_poweroff(hdmi);
+ }
+ drm_helper_hpd_irq_event(hdmi->connector.dev);
+@@ -1606,7 +1604,6 @@ static int imx_hdmi_bind(struct device *
+ return -ENOMEM;
+
+ hdmi->dev = dev;
+- hdmi->connector_status = connector_status_disconnected;
+ hdmi->sample_rate = 48000;
+ hdmi->ratio = 100;
+
--- /dev/null
+From 98c3b32229f2685c13436b652b8959c99dfc5a31 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Antoine=20T=C3=A9nart?= <antoine.tenart@free-electrons.com>
+Date: Mon, 12 May 2014 14:56:28 +0200
+Subject: phy: exynos-mipi-video: fix check on array index
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Antoine=20T=C3=A9nart?= <antoine.tenart@free-electrons.com>
+
+commit 98c3b32229f2685c13436b652b8959c99dfc5a31 upstream.
+
+The phys array is of size EXYNOS_MIPI_PHYS_NUM. Trying to access the
+index EXYNOS_MIPI_PHYS_NUM should return an error.
+
+Fixes: 069d2e26e9d6 "phy: Add driver for Exynos MIPI CSIS/DSIM DPHYs"
+
+Signed-off-by: Antoine Ténart <antoine.tenart@free-electrons.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/phy-exynos-mipi-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/phy-exynos-mipi-video.c
++++ b/drivers/phy/phy-exynos-mipi-video.c
+@@ -101,7 +101,7 @@ static struct phy *exynos_mipi_video_phy
+ {
+ struct exynos_mipi_video_phy *state = dev_get_drvdata(dev);
+
+- if (WARN_ON(args->args[0] > EXYNOS_MIPI_PHYS_NUM))
++ if (WARN_ON(args->args[0] >= EXYNOS_MIPI_PHYS_NUM))
+ return ERR_PTR(-ENODEV);
+
+ return state->phys[args->args[0]].phy;
--- /dev/null
+From 7fa21dd8bd191564a195291161d6b43db5d9c350 Mon Sep 17 00:00:00 2001
+From: Stephen Chivers <schivers@csc.com>
+Date: Wed, 14 May 2014 08:04:39 +1000
+Subject: printk/of_serial: fix serial console cessation part way through boot.
+
+From: Stephen Chivers <schivers@csc.com>
+
+commit 7fa21dd8bd191564a195291161d6b43db5d9c350 upstream.
+
+Commit 5f5c9ae56c38942623f69c3e6dc6ec78e4da2076
+"serial_core: Unregister console in uart_remove_one_port()"
+fixed a crash where a serial port was removed but
+not deregistered as a console.
+
+There is a side effect of that commit for platforms having serial consoles
+and of_serial configured (CONFIG_SERIAL_OF_PLATFORM). The serial console
+is disabled midway through the boot process.
+
+This cessation of the serial console affects PowerPC computers
+such as the MVME5100 and SAM440EP.
+
+The sequence is:
+
+ bootconsole [udbg0] enabled
+ ....
+ serial8250/16550 driver initialises and registers its UARTS,
+ one of these is the serial console.
+ console [ttyS0] enabled
+ ....
+ of_serial probes "platform" devices, registering them as it goes.
+ One of these is the serial console.
+ console [ttyS0] disabled.
+
+The disabling of the serial console is due to:
+
+ a. unregister_console in printk not clearing the
+ CONS_ENABLED bit in the console flags,
+ even though it has announced that the console is disabled; and
+
+ b. of_platform_serial_probe in of_serial not setting the port type
+ before it registers with serial8250_register_8250_port.
+
+This patch ensures that the serial console is re-enabled when of_serial
+registers a serial port that corresponds to the designated console.
+
+===
+The above failure was identified in Linux-3.15-rc2.
+
+Tested using MVME5100 and SAM440EP PowerPC computers with
+kernels built from Linux-3.15-rc5 and tty-next.
+
+The continued operation of the serial console is vital for computers
+such as the MVME5100 as that Single Board Computer does not
+have any grapical/display hardware.
+
+Signed-off-by: Stephen Chivers <schivers@csc.com>
+Tested-by: Stephen Chivers <schivers@csc.com>
+Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> [unregister_console]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/of_serial.c | 1 +
+ kernel/printk/printk.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -173,6 +173,7 @@ static int of_platform_serial_probe(stru
+ {
+ struct uart_8250_port port8250;
+ memset(&port8250, 0, sizeof(port8250));
++ port.type = port_type;
+ port8250.port = port;
+
+ if (port.fifosize)
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2413,6 +2413,7 @@ int unregister_console(struct console *c
+ if (console_drivers != NULL && console->flags & CON_CONSDEV)
+ console_drivers->flags |= CON_CONSDEV;
+
++ console->flags &= ~CON_ENABLED;
+ console_unlock();
+ console_sysfs_notify();
+ return res;
--- /dev/null
+From ffd07de65ef5315053ea16356cd533b7f47c17e9 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Fri, 23 May 2014 17:16:53 -0700
+Subject: staging/mt29f_spinand: Terminate of match table
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit ffd07de65ef5315053ea16356cd533b7f47c17e9 upstream.
+
+Failure to terminate this match table can lead to boot failures
+depending on where the compiler places the match table.
+
+Cc: Kamlakant Patel <kamlakant.patel@broadcom.com>
+Cc: Mona Anonuevo <manonuevo@micron.com>
+Cc: linux-mtd@lists.infradead.org
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/mt29f_spinand/mt29f_spinand.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
++++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
+@@ -924,6 +924,7 @@ static int spinand_remove(struct spi_dev
+
+ static const struct of_device_id spinand_dt[] = {
+ { .compatible = "spinand,mt29f", },
++ {}
+ };
+
+ /*
--- /dev/null
+From 9dbd79aeb9842144d9a114a979a12c0949ee11eb Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 7 Apr 2014 09:31:21 +0300
+Subject: Staging: rtl8188eu: overflow in update_sta_support_rate()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 9dbd79aeb9842144d9a114a979a12c0949ee11eb upstream.
+
+The ->SupportedRates[] array has NDIS_802_11_LENGTH_RATES_EX (16)
+elements. Since "ie_len" comes from then network and can go up to 255
+then it means we should add a range check to prevent memory corruption.
+
+Fixes: d6846af679e0 ('staging: r8188eu: Add files for new driver - part 7')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/core/rtw_wlan_util.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
++++ b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
+@@ -1599,13 +1599,18 @@ int update_sta_support_rate(struct adapt
+ pIE = (struct ndis_802_11_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+ if (pIE == NULL)
+ return _FAIL;
++ if (ie_len > NDIS_802_11_LENGTH_RATES_EX)
++ return _FAIL;
+
+ memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
+ supportRateNum = ie_len;
+
+ pIE = (struct ndis_802_11_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+- if (pIE)
++ if (pIE) {
++ if (supportRateNum + ie_len > NDIS_802_11_LENGTH_RATES_EX)
++ return _FAIL;
+ memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
++ }
+
+ return _SUCCESS;
+ }
--- /dev/null
+From d3921a03a89acb1b9ca599590c0131c89f8737d8 Mon Sep 17 00:00:00 2001
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Mon, 26 May 2014 21:47:11 +0200
+Subject: staging: tidspbridge: check for CONFIG_SND_OMAP_SOC_MCBSP
+
+From: Paul Bolle <pebolle@tiscali.nl>
+
+commit d3921a03a89acb1b9ca599590c0131c89f8737d8 upstream.
+
+Commit d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP")
+removed the Kconfig symbol OMAP_MCBSP. It left two checks for
+CONFIG_OMAP_MCBSP untouched.
+
+Convert these to checks for CONFIG_SND_OMAP_SOC_MCBSP. That must be
+correct, since that re-enables calls to functions that are all found in
+sound/soc/omap/mcbsp.c. And that file is built only if
+CONFIG_SND_OMAP_SOC_MCBSP is defined.
+
+Fixes: d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/tidspbridge/core/dsp-clock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/tidspbridge/core/dsp-clock.c
++++ b/drivers/staging/tidspbridge/core/dsp-clock.c
+@@ -226,7 +226,7 @@ int dsp_clk_enable(enum dsp_clk_id clk_i
+ case GPT_CLK:
+ status = omap_dm_timer_start(timer[clk_id - 1]);
+ break;
+-#ifdef CONFIG_OMAP_MCBSP
++#ifdef CONFIG_SND_OMAP_SOC_MCBSP
+ case MCBSP_CLK:
+ omap_mcbsp_request(MCBSP_ID(clk_id));
+ omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC);
+@@ -302,7 +302,7 @@ int dsp_clk_disable(enum dsp_clk_id clk_
+ case GPT_CLK:
+ status = omap_dm_timer_stop(timer[clk_id - 1]);
+ break;
+-#ifdef CONFIG_OMAP_MCBSP
++#ifdef CONFIG_SND_OMAP_SOC_MCBSP
+ case MCBSP_CLK:
+ omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PRCM_SRC);
+ omap_mcbsp_free(MCBSP_ID(clk_id));
--- /dev/null
+From 687ef9817df7ed960d14575b9033dde3d04631fe Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Wed, 16 Apr 2014 10:30:33 -0500
+Subject: usb: dwc3: gadget: clear stall when disabling endpoint
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit 687ef9817df7ed960d14575b9033dde3d04631fe upstream.
+
+so it seems like DWC3 IP doesn't clear stalls
+automatically when we disable an endpoint, because
+of that, we _must_ make sure stalls are cleared
+before clearing the proper bit in DALEPENA register.
+
+Reported-by: Johannes Stezenbach <js@sig21.net>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -604,6 +604,10 @@ static int __dwc3_gadget_ep_disable(stru
+
+ dwc3_remove_requests(dwc, dep);
+
++ /* make sure HW endpoint isn't stalled */
++ if (dep->flags & DWC3_EP_STALL)
++ __dwc3_gadget_ep_set_halt(dep, 0);
++
+ reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
+ reg &= ~DWC3_DALEPENA_EP(dep->number);
+ dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
--- /dev/null
+From b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 3 Jun 2014 11:00:27 -0400
+Subject: USB: EHCI: avoid BIOS handover on the HASEE E200
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b upstream.
+
+Leandro Liptak reports that his HASEE E200 computer hangs when we ask
+the BIOS to hand over control of the EHCI host controller. This
+definitely sounds like a bug in the BIOS, but at the moment there is
+no way to fix it.
+
+This patch works around the problem by avoiding the handoff whenever
+the motherboard and BIOS version match those of Leandro's computer.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Leandro Liptak <leandroliptak@gmail.com>
+Tested-by: Leandro Liptak <leandroliptak@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -656,6 +656,14 @@ static const struct dmi_system_id ehci_d
+ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
+ },
+ },
++ {
++ /* HASEE E200 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HASEE"),
++ DMI_MATCH(DMI_BOARD_NAME, "E210"),
++ DMI_MATCH(DMI_BIOS_VERSION, "6.00"),
++ },
++ },
+ { }
+ };
+
+@@ -665,9 +673,14 @@ static void ehci_bios_handoff(struct pci
+ {
+ int try_handoff = 1, tried_handoff = 0;
+
+- /* The Pegatron Lucid tablet sporadically waits for 98 seconds trying
+- * the handoff on its unused controller. Skip it. */
+- if (pdev->vendor == 0x8086 && pdev->device == 0x283a) {
++ /*
++ * The Pegatron Lucid tablet sporadically waits for 98 seconds trying
++ * the handoff on its unused controller. Skip it.
++ *
++ * The HASEE E200 hangs when the semaphore is set (bugzilla #77021).
++ */
++ if (pdev->vendor == 0x8086 && (pdev->device == 0x283a ||
++ pdev->device == 0x27cc)) {
+ if (dmi_check_system(ehci_dmi_nohandoff_table))
+ try_handoff = 0;
+ }
--- /dev/null
+From d30f2065d6da377cc76771aca5a9850cfca8723b Mon Sep 17 00:00:00 2001
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Mon, 26 May 2014 23:37:09 +0200
+Subject: usb: gadget: rename CONFIG_USB_GADGET_PXA25X
+
+From: Paul Bolle <pebolle@tiscali.nl>
+
+commit d30f2065d6da377cc76771aca5a9850cfca8723b upstream.
+
+Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+basically renamed the Kconfig symbol USB_GADGET_PXA25X to USB_PXA25X. It
+did not rename the related macros in use at that time. Commit
+c0a39151a405 ("ARM: pxa: fix inconsistent CONFIG_USB_PXA27X") did so for
+all but one macro. Rename that last macro too now.
+
+Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/inode.c
++++ b/drivers/usb/gadget/inode.c
+@@ -1501,7 +1501,7 @@ gadgetfs_setup (struct usb_gadget *gadge
+ }
+ break;
+
+-#ifndef CONFIG_USB_GADGET_PXA25X
++#ifndef CONFIG_USB_PXA25X
+ /* PXA automagically handles this request too */
+ case USB_REQ_GET_CONFIGURATION:
+ if (ctrl->bRequestType != 0x80)
--- /dev/null
+From 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 3 Jun 2014 11:11:34 -0400
+Subject: USB: usbtest: add a timeout for scatter-gather tests
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 upstream.
+
+In usbtest, tests 5 - 8 use the scatter-gather library in usbcore
+without any sort of timeout. If there's a problem in the gadget or
+host controller being tested, the test can hang.
+
+This patch adds a 10-second timeout to the tests, so that they will
+fail gracefully with an ETIMEDOUT error instead of hanging.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Huang Rui <ray.huang@amd.com>
+Tested-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -7,7 +7,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/scatterlist.h>
+ #include <linux/mutex.h>
+-
++#include <linux/timer.h>
+ #include <linux/usb.h>
+
+ #define SIMPLE_IO_TIMEOUT 10000 /* in milliseconds */
+@@ -484,6 +484,14 @@ alloc_sglist(int nents, int max, int var
+ return sg;
+ }
+
++static void sg_timeout(unsigned long _req)
++{
++ struct usb_sg_request *req = (struct usb_sg_request *) _req;
++
++ req->status = -ETIMEDOUT;
++ usb_sg_cancel(req);
++}
++
+ static int perform_sglist(
+ struct usbtest_dev *tdev,
+ unsigned iterations,
+@@ -495,6 +503,9 @@ static int perform_sglist(
+ {
+ struct usb_device *udev = testdev_to_usbdev(tdev);
+ int retval = 0;
++ struct timer_list sg_timer;
++
++ setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
+
+ while (retval == 0 && iterations-- > 0) {
+ retval = usb_sg_init(req, udev, pipe,
+@@ -505,7 +516,10 @@ static int perform_sglist(
+
+ if (retval)
+ break;
++ mod_timer(&sg_timer, jiffies +
++ msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
+ usb_sg_wait(req);
++ del_timer_sync(&sg_timer);
+ retval = req->status;
+
+ /* FIXME check resulting data pattern */
--- /dev/null
+From e4d58f5dcb7d7be45df8def31881ebfae99c75da Mon Sep 17 00:00:00 2001
+From: Huang Rui <ray.huang@amd.com>
+Date: Mon, 26 May 2014 10:55:36 +0800
+Subject: usb: usbtest: fix unlink write error with pattern 1
+
+From: Huang Rui <ray.huang@amd.com>
+
+commit e4d58f5dcb7d7be45df8def31881ebfae99c75da upstream.
+
+TEST 12 and TEST 24 unlinks the URB write request for N times. When
+host and gadget both initialize pattern 1 (mod 63) data series to
+transfer, the gadget side will complain the wrong data which is not
+expected. Because in host side, usbtest doesn't fill the data buffer
+as mod 63 and this patch fixed it.
+
+[20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
+[20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
+[20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last
+[20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
+[20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0
+[20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
+[20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active
+[20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy
+[20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete
+[20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0
+[20285.491431] zero gadget: bad OUT byte, buf[1] = 0
+[20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000
+[20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0
+[20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512
+[20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
+[20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
+[20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last
+[20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
+[20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0
+
+Signed-off-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1320,6 +1320,11 @@ static int unlink1(struct usbtest_dev *d
+ urb->context = &completion;
+ urb->complete = unlink1_callback;
+
++ if (usb_pipeout(urb->pipe)) {
++ simple_fill_buf(urb);
++ urb->transfer_flags |= URB_ZERO_PACKET;
++ }
++
+ /* keep the endpoint busy. there are lots of hc/hcd-internal
+ * states, and testing should get to all of them over time.
+ *
+@@ -1450,6 +1455,11 @@ static int unlink_queued(struct usbtest_
+ unlink_queued_callback, &ctx);
+ ctx.urbs[i]->transfer_dma = buf_dma;
+ ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
++
++ if (usb_pipeout(ctx.urbs[i]->pipe)) {
++ simple_fill_buf(ctx.urbs[i]);
++ ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
++ }
+ }
+
+ /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
--- /dev/null
+From a0f104644ec27ce5bbb36e950eb426dba9a3ad44 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Wed, 7 May 2014 01:26:04 +0400
+Subject: w1: do not unlock unheld list_mutex in __w1_remove_master_device()
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+commit a0f104644ec27ce5bbb36e950eb426dba9a3ad44 upstream.
+
+w1_process_callbacks() expects to be called with dev->list_mutex held,
+but it is the fact only in w1_process(). __w1_remove_master_device()
+calls w1_process_callbacks() after it releases list_mutex.
+
+The patch fixes __w1_remove_master_device() to acquire list_mutex
+for w1_process_callbacks().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: David Fries <david@fries.net>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/w1/w1.c | 2 ++
+ drivers/w1/w1_int.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -1078,6 +1078,8 @@ static void w1_search_process(struct w1_
+ * w1_process_callbacks() - execute each dev->async_list callback entry
+ * @dev: w1_master device
+ *
++ * The w1 master list_mutex must be held.
++ *
+ * Return: 1 if there were commands to executed 0 otherwise
+ */
+ int w1_process_callbacks(struct w1_master *dev)
+--- a/drivers/w1/w1_int.c
++++ b/drivers/w1/w1_int.c
+@@ -219,9 +219,13 @@ void __w1_remove_master_device(struct w1
+
+ if (msleep_interruptible(1000))
+ flush_signals(current);
++ mutex_lock(&dev->list_mutex);
+ w1_process_callbacks(dev);
++ mutex_unlock(&dev->list_mutex);
+ }
++ mutex_lock(&dev->list_mutex);
+ w1_process_callbacks(dev);
++ mutex_unlock(&dev->list_mutex);
+
+ memset(&msg, 0, sizeof(msg));
+ msg.id.mst.id = dev->id;
projects / thirdparty / kernel / stable-queue.git / commitdiff
