From: Greg Kroah-Hartman Date: Thu, 12 Jan 2012 23:10:16 +0000 (-0800) Subject: 3.0-stable patches X-Git-Tag: v3.1.10~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7f0552048dd5789efa50f9508f7f621cf51d5c8a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch mtd-mtdoops-skip-reading-initially-bad-blocks.patch mtdoops-fix-the-oops_page_used-array-size.patch mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch --- diff --git a/queue-3.0/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch b/queue-3.0/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch new file mode 100644 index 00000000000..9befe4a6252 --- /dev/null +++ b/queue-3.0/alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch @@ -0,0 +1,53 @@ +From 3a90274de3548ebb2aabfbf488cea8e275a73dc6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 10 Jan 2012 12:41:22 +0100 +Subject: ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs + +From: Takashi Iwai + +commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream. + +When an invalid NID is given, get_wcaps() returns zero as the error, +but get_wcaps_type() takes it as the normal value and returns a bogus +AC_WID_AUD_OUT value. This confuses the parser. + +With this patch, get_wcaps_type() returns -1 when value 0 is given, +i.e. an invalid NID is passed to get_wcaps(). + +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_local.h | 7 ++++++- + sound/pci/hda/hda_proc.c | 2 ++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_local.h ++++ b/sound/pci/hda/hda_local.h +@@ -474,7 +474,12 @@ static inline u32 get_wcaps(struct hda_c + } + + /* get the widget type from widget capability bits */ +-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT) ++static inline int get_wcaps_type(unsigned int wcaps) ++{ ++ if (!wcaps) ++ return -1; /* invalid type */ ++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT; ++} + + static inline unsigned int get_wcaps_channels(u32 wcaps) + { +--- a/sound/pci/hda/hda_proc.c ++++ b/sound/pci/hda/hda_proc.c +@@ -54,6 +54,8 @@ static const char *get_wid_type_name(uns + [AC_WID_BEEP] = "Beep Generator Widget", + [AC_WID_VENDOR] = "Vendor Defined Widget", + }; ++ if (wid_value == -1) ++ return "UNKNOWN Widget"; + wid_value &= 0xf; + if (names[wid_value]) + return names[wid_value]; diff --git a/queue-3.0/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch b/queue-3.0/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch new file mode 100644 index 00000000000..a0bad11f6a1 --- /dev/null +++ b/queue-3.0/alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch @@ -0,0 +1,36 @@ +From e7848163aa2a649d9065f230fadff80dc3519775 Mon Sep 17 00:00:00 2001 +From: Pavel Hofman +Date: Thu, 5 Jan 2012 23:05:18 +0100 +Subject: ALSA: ice1724 - Check for ac97 to avoid kernel oops + +From: Pavel Hofman + +commit e7848163aa2a649d9065f230fadff80dc3519775 upstream. + +Cards with identical PCI ids but no AC97 config in EEPROM do not have +the ac97 field initialized. We must check for this case to avoid kernel oops. + +Signed-off-by: Pavel Hofman +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/amp.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/sound/pci/ice1712/amp.c ++++ b/sound/pci/ice1712/amp.c +@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init + + static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice) + { +- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */ +- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000); ++ if (ice->ac97) ++ /* we use pins 39 and 41 of the VT1616 for left and right ++ read outputs */ ++ snd_ac97_write_cache(ice->ac97, 0x5a, ++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000); + return 0; + } + diff --git a/queue-3.0/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch b/queue-3.0/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch new file mode 100644 index 00000000000..2b4914d1b67 --- /dev/null +++ b/queue-3.0/alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch @@ -0,0 +1,51 @@ +From d0f3a2eb9062560bebca8b923424f3ca02a331ba Mon Sep 17 00:00:00 2001 +From: Karsten Wiese +Date: Fri, 30 Dec 2011 01:42:01 +0100 +Subject: ALSA: snd-usb-us122l: Delete calls to preempt_disable + +From: Karsten Wiese + +commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream. + +They are not needed here. + +Signed-off-by: Karsten Wiese +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usx2y/usb_stream.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/sound/usb/usx2y/usb_stream.c ++++ b/sound/usb/usx2y/usb_stream.c +@@ -674,7 +674,7 @@ dotry: + inurb->transfer_buffer_length = + inurb->number_of_packets * + inurb->iso_frame_desc[0].length; +- preempt_disable(); ++ + if (u == 0) { + int now; + struct usb_device *dev = inurb->dev; +@@ -686,19 +686,17 @@ dotry: + } + err = usb_submit_urb(inurb, GFP_ATOMIC); + if (err < 0) { +- preempt_enable(); + snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])" + " returned %i\n", u, err); + return err; + } + err = usb_submit_urb(outurb, GFP_ATOMIC); + if (err < 0) { +- preempt_enable(); + snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])" + " returned %i\n", u, err); + return err; + } +- preempt_enable(); ++ + if (inurb->start_frame != outurb->start_frame) { + snd_printd(KERN_DEBUG + "u[%i] start_frames differ in:%u out:%u\n", diff --git a/queue-3.0/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch b/queue-3.0/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch new file mode 100644 index 00000000000..7e3847cabf3 --- /dev/null +++ b/queue-3.0/drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch @@ -0,0 +1,50 @@ +From e74a8f2edb92cb690b467cea0ab652c509e9f624 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 10 Jan 2012 15:11:02 -0800 +Subject: drivers/rtc/interface.c: fix alarm rollover when day or month is out-of-range + +From: Ben Hutchings + +commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream. + +Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a +potential infinite loop. If an alarm time contains a wildcard month and +an invalid day (> 31), or a wildcard year and an invalid month (>= 12), +the loop searching for the next matching date will never terminate. Treat +the invalid values as wildcards. + +Fixes , + +Reported-by: leo weppelman +Reported-by: "P. van Gaans" +Signed-off-by: Ben Hutchings +Signed-off-by: Jonathan Nieder +Cc: Mark Brown +Cc: Marcelo Roberto Jimenez +Cc: Thomas Gleixner +Cc: John Stultz +Acked-by: Alessandro Zummo +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/interface.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -227,11 +227,11 @@ int __rtc_read_alarm(struct rtc_device * + alarm->time.tm_hour = now.tm_hour; + + /* For simplicity, only support date rollover for now */ +- if (alarm->time.tm_mday == -1) { ++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) { + alarm->time.tm_mday = now.tm_mday; + missing = day; + } +- if (alarm->time.tm_mon == -1) { ++ if ((unsigned)alarm->time.tm_mon >= 12) { + alarm->time.tm_mon = now.tm_mon; + if (missing == none) + missing = month; diff --git a/queue-3.0/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch b/queue-3.0/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch new file mode 100644 index 00000000000..83911b96e3d --- /dev/null +++ b/queue-3.0/drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch @@ -0,0 +1,38 @@ +From 28eebb703e28bc455ba704adb1026f76649b768c Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 3 Jan 2012 09:48:38 -0500 +Subject: drm/radeon/kms: disable writeback on pre-R300 asics + +From: Alex Deucher + +commit 28eebb703e28bc455ba704adb1026f76649b768c upstream. + +We often end up missing fences on older asics with +writeback enabled which leads to delays in the userspace +accel code, so just disable it by default on those asics. + +Reported-by: Helge Deller +Reported-by: Dave Airlie +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_device.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -223,8 +223,11 @@ int radeon_wb_init(struct radeon_device + if (radeon_no_wb == 1) + rdev->wb.enabled = false; + else { +- /* often unreliable on AGP */ + if (rdev->flags & RADEON_IS_AGP) { ++ /* often unreliable on AGP */ ++ rdev->wb.enabled = false; ++ } else if (rdev->family < CHIP_R300) { ++ /* often unreliable on pre-r300 */ + rdev->wb.enabled = false; + } else { + rdev->wb.enabled = true; diff --git a/queue-3.0/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch b/queue-3.0/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch new file mode 100644 index 00000000000..6eb86d46a08 --- /dev/null +++ b/queue-3.0/drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch @@ -0,0 +1,40 @@ +From 92db7f6c860b8190571a9dc1fcbc16d003422fe8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Fri, 23 Dec 2011 20:32:18 +0100 +Subject: drm/radeon/kms: workaround invalid AVI infoframe checksum issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream. + +This change was verified to fix both issues with no video I've +investigated. I've also checked checksum calculation with fglrx on: +RV620, HD54xx, HD5450, HD6310, HD6320. + +Signed-off-by: Rafał Miłecki +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/radeon/r600_hdmi.c ++++ b/drivers/gpu/drm/radeon/r600_hdmi.c +@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe( + frame[0xD] = (right_bar >> 8); + + r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame); ++ /* Our header values (type, version, length) should be alright, Intel ++ * is using the same. Checksum function also seems to be OK, it works ++ * fine for audio infoframe. However calculated value is always lower ++ * by 2 in comparison to fglrx. It breaks displaying anything in case ++ * of TVs that strictly check the checksum. Hack it manually here to ++ * workaround this issue. */ ++ frame[0x0] += 2; + + WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0, + frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24)); diff --git a/queue-3.0/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch b/queue-3.0/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch new file mode 100644 index 00000000000..bc18e96ae2a --- /dev/null +++ b/queue-3.0/ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch @@ -0,0 +1,71 @@ +From d50f2ab6f050311dbf7b8f5501b25f0bf64a439b Mon Sep 17 00:00:00 2001 +From: Xi Wang +Date: Tue, 10 Jan 2012 11:51:10 -0500 +Subject: ext4: fix undefined behavior in ext4_fill_flex_info() + +From: Xi Wang + +commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream. + +Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by +zero when trying to mount a corrupted file system") fixes CVE-2009-4307 +by performing a sanity check on s_log_groups_per_flex, since it can be +set to a bogus value by an attacker. + + sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex; + groups_per_flex = 1 << sbi->s_log_groups_per_flex; + + if (groups_per_flex < 2) { ... } + +This patch fixes two potential issues in the previous commit. + +1) The sanity check might only work on architectures like PowerPC. +On x86, 5 bits are used for the shifting amount. That means, given a +large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36 +is essentially 1 << 4 = 16, rather than 0. This will bypass the check, +leaving s_log_groups_per_flex and groups_per_flex inconsistent. + +2) The sanity check relies on undefined behavior, i.e., oversized shift. +A standard-confirming C compiler could rewrite the check in unexpected +ways. Consider the following equivalent form, assuming groups_per_flex +is unsigned for simplicity. + + groups_per_flex = 1 << sbi->s_log_groups_per_flex; + if (groups_per_flex == 0 || groups_per_flex == 1) { + +We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will +completely optimize away the check groups_per_flex == 0, leaving the +patched code as vulnerable as the original. GCC keeps the check, but +there is no guarantee that future versions will do the same. + +Signed-off-by: Xi Wang +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1957,17 +1957,16 @@ static int ext4_fill_flex_info(struct su + struct ext4_group_desc *gdp = NULL; + ext4_group_t flex_group_count; + ext4_group_t flex_group; +- int groups_per_flex = 0; ++ unsigned int groups_per_flex = 0; + size_t size; + int i; + + sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex; +- groups_per_flex = 1 << sbi->s_log_groups_per_flex; +- +- if (groups_per_flex < 2) { ++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) { + sbi->s_log_groups_per_flex = 0; + return 1; + } ++ groups_per_flex = 1 << sbi->s_log_groups_per_flex; + + /* We allocate both existing and potentially added groups */ + flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) + diff --git a/queue-3.0/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch b/queue-3.0/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch new file mode 100644 index 00000000000..cb9309e6de7 --- /dev/null +++ b/queue-3.0/mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch @@ -0,0 +1,82 @@ +From 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 7 Nov 2011 15:51:05 -0800 +Subject: mtd: mtd_blkdevs: don't increase 'open' count on error path + +From: Brian Norris + +commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream. + +Some error paths in mtd_blkdevs were fixed in the following commit: + + commit 94735ec4044a6d318b83ad3c5794e931ed168d10 + mtd: mtd_blkdevs: fix error path in blktrans_open + +But on these error paths, the block device's `dev->open' count is +already incremented before we check for errors. This meant that, while +the error path was handled correctly on the first time through +blktrans_open(), the device is erroneously considered already open on +the second time through. + +This problem can be seen, for instance, when a UBI volume is +simultaneously mounted as a UBIFS partition and read through its +corresponding gluebi mtdblockX device. This results in blktrans_open() +passing its error checks (with `dev->open > 0') without actually having +a handle on the device. Here's a summarized log of the actions and +results with nandsim: + + # modprobe nandsim + # modprobe mtdblock + # modprobe gluebi + # modprobe ubifs + # ubiattach /dev/ubi_ctrl -m 0 + ... + # ubimkvol /dev/ubi0 -N test -s 16MiB + ... + # mount -t ubifs ubi0:test /mnt + # ls /dev/mtdblock* + /dev/mtdblock0 /dev/mtdblock1 + # cat /dev/mtdblock1 > /dev/null + cat: can't open '/dev/mtdblock4': Device or resource busy + # cat /dev/mtdblock1 > /dev/null + + CPU 0 Unable to handle kernel paging request at virtual address + fffffff0, epc == 8031536c, ra == 8031f280 + Oops[#1]: + ... + Call Trace: + [<8031536c>] ubi_leb_read+0x14/0x164 + [<8031f280>] gluebi_read+0xf0/0x148 + [<802edba8>] mtdblock_readsect+0x64/0x198 + [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4 + [<8005be98>] kthread+0x88/0x90 + [<8000bc04>] kernel_thread_helper+0x10/0x18 + +Signed-off-by: Brian Norris +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtd_blkdevs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -215,7 +215,7 @@ static int blktrans_open(struct block_de + + mutex_lock(&dev->lock); + +- if (dev->open++) ++ if (dev->open) + goto unlock; + + kref_get(&dev->ref); +@@ -235,6 +235,7 @@ static int blktrans_open(struct block_de + goto error_release; + + unlock: ++ dev->open++; + mutex_unlock(&dev->lock); + blktrans_dev_put(dev); + return ret; diff --git a/queue-3.0/mtd-mtdoops-skip-reading-initially-bad-blocks.patch b/queue-3.0/mtd-mtdoops-skip-reading-initially-bad-blocks.patch new file mode 100644 index 00000000000..c42dabd646b --- /dev/null +++ b/queue-3.0/mtd-mtdoops-skip-reading-initially-bad-blocks.patch @@ -0,0 +1,34 @@ +From 3538c56329936c78f7d356889908790006d0124c Mon Sep 17 00:00:00 2001 +From: Roman Tereshonkov +Date: Fri, 2 Dec 2011 15:07:17 +0200 +Subject: mtd: mtdoops: skip reading initially bad blocks + +From: Roman Tereshonkov + +commit 3538c56329936c78f7d356889908790006d0124c upstream. + +Use block_isbad to check and skip the bad blocks reading. +This will allow to get rid of the read errors if bad blocks +are present initially. + +Signed-off-by: Roman Tereshonkov +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtdoops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mtd/mtdoops.c ++++ b/drivers/mtd/mtdoops.c +@@ -253,6 +253,9 @@ static void find_next_position(struct mt + size_t retlen; + + for (page = 0; page < cxt->oops_pages; page++) { ++ if (mtd->block_isbad && ++ mtd->block_isbad(mtd, page * record_size)) ++ continue; + /* Assume the page is used */ + mark_page_used(cxt, page); + ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE, diff --git a/queue-3.0/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch b/queue-3.0/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch new file mode 100644 index 00000000000..2f56c5a24a5 --- /dev/null +++ b/queue-3.0/mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch @@ -0,0 +1,57 @@ +From 2f4478ccff7df845dc9c0f8996a96373122c4417 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Tue, 29 Nov 2011 15:34:08 +0100 +Subject: mtd: tests: stresstest: bail out if device has not enough eraseblocks + +From: Wolfram Sang + +commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream. + +stresstest needs at least two eraseblocks. Bail out gracefully if that +condition is not met. Fixes the following 'division by zero' OOPS: + +[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64 +[ 619.120000] mtd_stresstest: scanning for bad eraseblocks +[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad +[ 619.130000] mtd_stresstest: doing operations +[ 619.130000] mtd_stresstest: 0 operations done +[ 619.140000] Division by zero in kernel. +... + +caused by + + /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */ + eb %= (ebcnt - 1); + +Signed-off-by: Wolfram Sang +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/tests/mtd_stresstest.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/tests/mtd_stresstest.c ++++ b/drivers/mtd/tests/mtd_stresstest.c +@@ -277,6 +277,12 @@ static int __init mtd_stresstest_init(vo + (unsigned long long)mtd->size, mtd->erasesize, + pgsize, ebcnt, pgcnt, mtd->oobsize); + ++ if (ebcnt < 2) { ++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n"); ++ err = -ENOSPC; ++ goto out_put_mtd; ++ } ++ + /* Read or write up 2 eraseblocks at a time */ + bufsize = mtd->erasesize * 2; + +@@ -315,6 +321,7 @@ out: + kfree(bbt); + vfree(writebuf); + vfree(readbuf); ++out_put_mtd: + put_mtd_device(mtd); + if (err) + printk(PRINT_PREF "error %d occurred\n", err); diff --git a/queue-3.0/mtdoops-fix-the-oops_page_used-array-size.patch b/queue-3.0/mtdoops-fix-the-oops_page_used-array-size.patch new file mode 100644 index 00000000000..f6837b6a9a9 --- /dev/null +++ b/queue-3.0/mtdoops-fix-the-oops_page_used-array-size.patch @@ -0,0 +1,37 @@ +From 556f063580db2953a7e53cd46b47724246320f60 Mon Sep 17 00:00:00 2001 +From: Roman Tereshonkov +Date: Tue, 29 Nov 2011 12:49:18 +0200 +Subject: mtdoops: fix the oops_page_used array size + +From: Roman Tereshonkov + +commit 556f063580db2953a7e53cd46b47724246320f60 upstream. + +The array of unsigned long pointed by oops_page_used is allocated +by vmalloc which requires the size to be in bytes. + +BITS_PER_LONG is equal to 32. +If we want to allocate memory for 32 pages with one bit per page then +32 / BITS_PER_LONG is equal to 1 byte that is 8 bits. +To fix it we need to multiply the result by sizeof(unsigned long) equal to 4. + +Signed-off-by: Roman Tereshonkov +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtdoops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/mtdoops.c ++++ b/drivers/mtd/mtdoops.c +@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mt + + /* oops_page_used is a bit field */ + cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages, +- BITS_PER_LONG)); ++ BITS_PER_LONG) * sizeof(unsigned long)); + if (!cxt->oops_page_used) { + printk(KERN_ERR "mtdoops: could not allocate page array\n"); + return; diff --git a/queue-3.0/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch b/queue-3.0/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch new file mode 100644 index 00000000000..1bd4fc55cee --- /dev/null +++ b/queue-3.0/radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch @@ -0,0 +1,65 @@ +From 3df96909b75835d487a9178761622b0cbd7310d4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Thu, 5 Jan 2012 18:42:17 +0100 +Subject: radeon: Fix disabling PCI bus mastering on big endian hosts. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream. + +It would previously write basically random bits to PCI configuration space... +Not very surprising that the GPU tended to stop responding completely. The +resulting MCE even froze the whole machine sometimes. + +Now resetting the GPU after a lockup has at least a fighting chance of +succeeding. + +Signed-off-by: Michel Dänzer +Reviewed-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/r100.c | 5 +++-- + drivers/gpu/drm/radeon/rs600.c | 4 ++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -2069,6 +2069,7 @@ bool r100_gpu_is_lockup(struct radeon_de + void r100_bm_disable(struct radeon_device *rdev) + { + u32 tmp; ++ u16 tmp16; + + /* disable bus mastering */ + tmp = RREG32(R_000030_BUS_CNTL); +@@ -2079,8 +2080,8 @@ void r100_bm_disable(struct radeon_devic + WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040); + tmp = RREG32(RADEON_BUS_CNTL); + mdelay(1); +- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp); +- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB); ++ pci_read_config_word(rdev->pdev, 0x4, &tmp16); ++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB); + mdelay(1); + } + +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device + + void rs600_bm_disable(struct radeon_device *rdev) + { +- u32 tmp; ++ u16 tmp; + + /* disable bus mastering */ +- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp); ++ pci_read_config_word(rdev->pdev, 0x4, &tmp); + pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB); + mdelay(1); + } diff --git a/queue-3.0/series b/queue-3.0/series new file mode 100644 index 00000000000..1921f3f3e43 --- /dev/null +++ b/queue-3.0/series @@ -0,0 +1,12 @@ +mtdoops-fix-the-oops_page_used-array-size.patch +mtd-mtdoops-skip-reading-initially-bad-blocks.patch +mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch +mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch +drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch +ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch +alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch +alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch +alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch +drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch +drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch +radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch