From 448e87229a5105a8fc6981bbac7ea4a0f9614184 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 12 Mar 2013 13:51:00 -0700 Subject: [PATCH] 3.8-stable patches added patches: arm-kirkwood-of_serial-fix-clock-gating-by-removing-clock-frequency.patch arm-mxs_defconfig-make-usb-host-functional-again.patch fix-compat_rw_copy_check_uvector-misuse-in-aio-readv-writev-and-security-keys.patch gpio-mvebu-add-clk-support-to-prevent-lockup.patch keys-fix-race-with-concurrent-install_user_keyrings.patch powerpc-apply-early-paca-fixups-to-boot_paca-and-the-boot-cpu-s-paca.patch rtc-rtc-mv-add-support-for-clk-to-avoid-lockups.patch vfs-fix-pipe-counter-breakage.patch --- ...k-gating-by-removing-clock-frequency.patch | 239 ++++++++++++++++++ ...onfig-make-usb-host-functional-again.patch | 32 +++ ...n-aio-readv-writev-and-security-keys.patch | 127 ++++++++++ ...bu-add-clk-support-to-prevent-lockup.patch | 74 ++++++ ...ith-concurrent-install_user_keyrings.patch | 72 ++++++ ...to-boot_paca-and-the-boot-cpu-s-paca.patch | 68 +++++ ...add-support-for-clk-to-avoid-lockups.patch | 125 +++++++++ queue-3.8/series | 8 + queue-3.8/vfs-fix-pipe-counter-breakage.patch | 42 +++ 9 files changed, 787 insertions(+) create mode 100644 queue-3.8/arm-kirkwood-of_serial-fix-clock-gating-by-removing-clock-frequency.patch create mode 100644 queue-3.8/arm-mxs_defconfig-make-usb-host-functional-again.patch create mode 100644 queue-3.8/fix-compat_rw_copy_check_uvector-misuse-in-aio-readv-writev-and-security-keys.patch create mode 100644 queue-3.8/gpio-mvebu-add-clk-support-to-prevent-lockup.patch create mode 100644 queue-3.8/keys-fix-race-with-concurrent-install_user_keyrings.patch create mode 100644 queue-3.8/powerpc-apply-early-paca-fixups-to-boot_paca-and-the-boot-cpu-s-paca.patch create mode 100644 queue-3.8/rtc-rtc-mv-add-support-for-clk-to-avoid-lockups.patch create mode 100644 queue-3.8/vfs-fix-pipe-counter-breakage.patch diff --git a/queue-3.8/arm-kirkwood-of_serial-fix-clock-gating-by-removing-clock-frequency.patch b/queue-3.8/arm-kirkwood-of_serial-fix-clock-gating-by-removing-clock-frequency.patch new file mode 100644 index 00000000000..220c6c3d75b --- /dev/null +++ b/queue-3.8/arm-kirkwood-of_serial-fix-clock-gating-by-removing-clock-frequency.patch @@ -0,0 +1,239 @@ +From 93fff4ce19f9978cc1c59db42760717477939249 Mon Sep 17 00:00:00 2001 +From: Jason Cooper +Date: Tue, 29 Jan 2013 20:36:43 +0000 +Subject: ARM: kirkwood: of_serial: fix clock gating by removing clock-frequency + +From: Jason Cooper + +commit 93fff4ce19f9978cc1c59db42760717477939249 upstream. + +When DT support for kirkwood was first introduced, there was no clock +infrastructure. As a result, we had to manually pass the +clock-frequency to the driver from the device node. + +Unfortunately, on kirkwood, with minimal config or all module configs, +clock-frequency breaks booting because of_serial doesn't consume the +gate_clk when clock-frequency is defined. + +The end result on kirkwood is that runit gets gated, and then the boot +fails when the kernel tries to write to the serial port. + +Fix the issue by removing the clock-frequency parameter from all +kirkwood dts files. + +Booted on dreamplug without earlyprintk and successfully logged in via +ttyS0. + +Reported-by: Simon Baatz +Tested-by: Simon Baatz +Signed-off-by: Jason Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/kirkwood-dns320.dts | 2 -- + arch/arm/boot/dts/kirkwood-dns325.dts | 1 - + arch/arm/boot/dts/kirkwood-dockstar.dts | 1 - + arch/arm/boot/dts/kirkwood-dreamplug.dts | 1 - + arch/arm/boot/dts/kirkwood-goflexnet.dts | 1 - + arch/arm/boot/dts/kirkwood-ib62x0.dts | 1 - + arch/arm/boot/dts/kirkwood-iconnect.dts | 1 - + arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts | 1 - + arch/arm/boot/dts/kirkwood-km_kirkwood.dts | 1 - + arch/arm/boot/dts/kirkwood-lschlv2.dts | 1 - + arch/arm/boot/dts/kirkwood-lsxhl.dts | 1 - + arch/arm/boot/dts/kirkwood-mplcec4.dts | 1 - + arch/arm/boot/dts/kirkwood-ns2-common.dtsi | 1 - + arch/arm/boot/dts/kirkwood-nsa310.dts | 1 - + arch/arm/boot/dts/kirkwood-openblocks_a6.dts | 2 -- + arch/arm/boot/dts/kirkwood-topkick.dts | 1 - + arch/arm/boot/dts/kirkwood.dtsi | 2 -- + 17 files changed, 20 deletions(-) + +--- a/arch/arm/boot/dts/kirkwood-dns320.dts ++++ b/arch/arm/boot/dts/kirkwood-dns320.dts +@@ -42,12 +42,10 @@ + + ocp@f1000000 { + serial@12000 { +- clock-frequency = <166666667>; + status = "okay"; + }; + + serial@12100 { +- clock-frequency = <166666667>; + status = "okay"; + }; + }; +--- a/arch/arm/boot/dts/kirkwood-dns325.dts ++++ b/arch/arm/boot/dts/kirkwood-dns325.dts +@@ -50,7 +50,6 @@ + }; + }; + serial@12000 { +- clock-frequency = <200000000>; + status = "okay"; + }; + }; +--- a/arch/arm/boot/dts/kirkwood-dockstar.dts ++++ b/arch/arm/boot/dts/kirkwood-dockstar.dts +@@ -37,7 +37,6 @@ + }; + }; + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-dreamplug.dts ++++ b/arch/arm/boot/dts/kirkwood-dreamplug.dts +@@ -38,7 +38,6 @@ + }; + }; + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-goflexnet.dts ++++ b/arch/arm/boot/dts/kirkwood-goflexnet.dts +@@ -73,7 +73,6 @@ + }; + }; + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts ++++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts +@@ -51,7 +51,6 @@ + }; + }; + serial@12000 { +- clock-frequency = <200000000>; + status = "okay"; + }; + +--- a/arch/arm/boot/dts/kirkwood-iconnect.dts ++++ b/arch/arm/boot/dts/kirkwood-iconnect.dts +@@ -78,7 +78,6 @@ + }; + }; + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts ++++ b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts +@@ -115,7 +115,6 @@ + }; + + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-km_kirkwood.dts ++++ b/arch/arm/boot/dts/kirkwood-km_kirkwood.dts +@@ -34,7 +34,6 @@ + }; + + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-lschlv2.dts ++++ b/arch/arm/boot/dts/kirkwood-lschlv2.dts +@@ -13,7 +13,6 @@ + + ocp@f1000000 { + serial@12000 { +- clock-frequency = <166666667>; + status = "okay"; + }; + }; +--- a/arch/arm/boot/dts/kirkwood-lsxhl.dts ++++ b/arch/arm/boot/dts/kirkwood-lsxhl.dts +@@ -13,7 +13,6 @@ + + ocp@f1000000 { + serial@12000 { +- clock-frequency = <200000000>; + status = "okay"; + }; + }; +--- a/arch/arm/boot/dts/kirkwood-mplcec4.dts ++++ b/arch/arm/boot/dts/kirkwood-mplcec4.dts +@@ -91,7 +91,6 @@ + }; + + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-ns2-common.dtsi ++++ b/arch/arm/boot/dts/kirkwood-ns2-common.dtsi +@@ -23,7 +23,6 @@ + }; + + serial@12000 { +- clock-frequency = <166666667>; + status = "okay"; + }; + +--- a/arch/arm/boot/dts/kirkwood-nsa310.dts ++++ b/arch/arm/boot/dts/kirkwood-nsa310.dts +@@ -18,7 +18,6 @@ + ocp@f1000000 { + + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-openblocks_a6.dts ++++ b/arch/arm/boot/dts/kirkwood-openblocks_a6.dts +@@ -18,12 +18,10 @@ + + ocp@f1000000 { + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + + serial@12100 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood-topkick.dts ++++ b/arch/arm/boot/dts/kirkwood-topkick.dts +@@ -17,7 +17,6 @@ + + ocp@f1000000 { + serial@12000 { +- clock-frequency = <200000000>; + status = "ok"; + }; + +--- a/arch/arm/boot/dts/kirkwood.dtsi ++++ b/arch/arm/boot/dts/kirkwood.dtsi +@@ -59,7 +59,6 @@ + reg-shift = <2>; + interrupts = <33>; + clocks = <&gate_clk 7>; +- /* set clock-frequency in board dts */ + status = "disabled"; + }; + +@@ -69,7 +68,6 @@ + reg-shift = <2>; + interrupts = <34>; + clocks = <&gate_clk 7>; +- /* set clock-frequency in board dts */ + status = "disabled"; + }; + diff --git a/queue-3.8/arm-mxs_defconfig-make-usb-host-functional-again.patch b/queue-3.8/arm-mxs_defconfig-make-usb-host-functional-again.patch new file mode 100644 index 00000000000..4258f8298fa --- /dev/null +++ b/queue-3.8/arm-mxs_defconfig-make-usb-host-functional-again.patch @@ -0,0 +1,32 @@ +From f6c49da98dd6eacb85034d21d16e1428e03e190f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 27 Feb 2013 14:03:58 -0300 +Subject: ARM: mxs_defconfig: Make USB host functional again + +From: Fabio Estevam + +commit f6c49da98dd6eacb85034d21d16e1428e03e190f upstream. + +commit 09f6ffde2e (USB: EHCI: fix build error by making ChipIdea host a normal +EHCI driver) introduced CONFIG_USB_EHCI_HCD as a dependency for USB_CHIPIDEA_HOST. + +Select CONFIG_USB_EHCI_HCD, so that USB host can be functional again. + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/configs/mxs_defconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/configs/mxs_defconfig ++++ b/arch/arm/configs/mxs_defconfig +@@ -118,6 +118,7 @@ CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_FONTS=y + CONFIG_LOGO=y + CONFIG_USB=y ++CONFIG_USB_EHCI_HCD=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_HOST=y + CONFIG_USB_STORAGE=y diff --git a/queue-3.8/fix-compat_rw_copy_check_uvector-misuse-in-aio-readv-writev-and-security-keys.patch b/queue-3.8/fix-compat_rw_copy_check_uvector-misuse-in-aio-readv-writev-and-security-keys.patch new file mode 100644 index 00000000000..8389b463080 --- /dev/null +++ b/queue-3.8/fix-compat_rw_copy_check_uvector-misuse-in-aio-readv-writev-and-security-keys.patch @@ -0,0 +1,127 @@ +From 8aec0f5d4137532de14e6554fd5dd201ff3a3c49 Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Mon, 25 Feb 2013 10:20:36 -0500 +Subject: Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys + +From: Mathieu Desnoyers + +commit 8aec0f5d4137532de14e6554fd5dd201ff3a3c49 upstream. + +Looking at mm/process_vm_access.c:process_vm_rw() and comparing it to +compat_process_vm_rw() shows that the compatibility code requires an +explicit "access_ok()" check before calling +compat_rw_copy_check_uvector(). The same difference seems to appear when +we compare fs/read_write.c:do_readv_writev() to +fs/compat.c:compat_do_readv_writev(). + +This subtle difference between the compat and non-compat requirements +should probably be debated, as it seems to be error-prone. In fact, +there are two others sites that use this function in the Linux kernel, +and they both seem to get it wrong: + +Now shifting our attention to fs/aio.c, we see that aio_setup_iocb() +also ends up calling compat_rw_copy_check_uvector() through +aio_setup_vectored_rw(). Unfortunately, the access_ok() check appears to +be missing. Same situation for +security/keys/compat.c:compat_keyctl_instantiate_key_iov(). + +I propose that we add the access_ok() check directly into +compat_rw_copy_check_uvector(), so callers don't have to worry about it, +and it therefore makes the compat call code similar to its non-compat +counterpart. Place the access_ok() check in the same location where +copy_from_user() can trigger a -EFAULT error in the non-compat code, so +the ABI behaviors are alike on both compat and non-compat. + +While we are here, fix compat_do_readv_writev() so it checks for +compat_rw_copy_check_uvector() negative return values. + +And also, fix a memory leak in compat_keyctl_instantiate_key_iov() error +handling. + +Acked-by: Linus Torvalds +Acked-by: Al Viro +Signed-off-by: Mathieu Desnoyers +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat.c | 15 +++++++-------- + mm/process_vm_access.c | 8 -------- + security/keys/compat.c | 4 ++-- + 3 files changed, 9 insertions(+), 18 deletions(-) + +--- a/fs/compat.c ++++ b/fs/compat.c +@@ -558,6 +558,10 @@ ssize_t compat_rw_copy_check_uvector(int + } + *ret_pointer = iov; + ++ ret = -EFAULT; ++ if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector))) ++ goto out; ++ + /* + * Single unix specification: + * We should -EINVAL if an element length is not >= 0 and fitting an +@@ -1080,17 +1084,12 @@ static ssize_t compat_do_readv_writev(in + if (!file->f_op) + goto out; + +- ret = -EFAULT; +- if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector))) +- goto out; +- +- tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs, ++ ret = compat_rw_copy_check_uvector(type, uvector, nr_segs, + UIO_FASTIOV, iovstack, &iov); +- if (tot_len == 0) { +- ret = 0; ++ if (ret <= 0) + goto out; +- } + ++ tot_len = ret; + ret = rw_verify_area(type, file, pos, tot_len); + if (ret < 0) + goto out; +--- a/mm/process_vm_access.c ++++ b/mm/process_vm_access.c +@@ -429,12 +429,6 @@ compat_process_vm_rw(compat_pid_t pid, + if (flags != 0) + return -EINVAL; + +- if (!access_ok(VERIFY_READ, lvec, liovcnt * sizeof(*lvec))) +- goto out; +- +- if (!access_ok(VERIFY_READ, rvec, riovcnt * sizeof(*rvec))) +- goto out; +- + if (vm_write) + rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt, + UIO_FASTIOV, iovstack_l, +@@ -459,8 +453,6 @@ free_iovecs: + kfree(iov_r); + if (iov_l != iovstack_l) + kfree(iov_l); +- +-out: + return rc; + } + +--- a/security/keys/compat.c ++++ b/security/keys/compat.c +@@ -40,12 +40,12 @@ static long compat_keyctl_instantiate_ke + ARRAY_SIZE(iovstack), + iovstack, &iov); + if (ret < 0) +- return ret; ++ goto err; + if (ret == 0) + goto no_payload_free; + + ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid); +- ++err: + if (iov != iovstack) + kfree(iov); + return ret; diff --git a/queue-3.8/gpio-mvebu-add-clk-support-to-prevent-lockup.patch b/queue-3.8/gpio-mvebu-add-clk-support-to-prevent-lockup.patch new file mode 100644 index 00000000000..55b1e0b2e22 --- /dev/null +++ b/queue-3.8/gpio-mvebu-add-clk-support-to-prevent-lockup.patch @@ -0,0 +1,74 @@ +From de88747f514a4e0cca416a8871de2302f4f77790 Mon Sep 17 00:00:00 2001 +From: Andrew Lunn +Date: Sun, 3 Feb 2013 11:34:26 +0100 +Subject: gpio: mvebu: Add clk support to prevent lockup + +From: Andrew Lunn + +commit de88747f514a4e0cca416a8871de2302f4f77790 upstream. + +The kirkwood SoC GPIO cores use the runit clock. Add code to +clk_prepare_enable() runit, otherwise there is a danger of locking up +the SoC by accessing the GPIO registers when runit clock is not +ticking. + +Reported-by: Simon Baatz +Signed-off-by: Andrew Lunn +Tested-by: Simon Baatz +Acked-by: Linus Walleij +Signed-off-by: Jason Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/kirkwood.dtsi | 2 ++ + drivers/gpio/gpio-mvebu.c | 7 +++++++ + 2 files changed, 9 insertions(+) + +--- a/arch/arm/boot/dts/kirkwood.dtsi ++++ b/arch/arm/boot/dts/kirkwood.dtsi +@@ -38,6 +38,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + interrupts = <35>, <36>, <37>, <38>; ++ clocks = <&gate_clk 7>; + }; + + gpio1: gpio@10140 { +@@ -49,6 +50,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + interrupts = <39>, <40>, <41>; ++ clocks = <&gate_clk 7>; + }; + + serial@12000 { +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -41,6 +41,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -495,6 +496,7 @@ static int mvebu_gpio_probe(struct platf + struct resource *res; + struct irq_chip_generic *gc; + struct irq_chip_type *ct; ++ struct clk *clk; + unsigned int ngpios; + int soc_variant; + int i, cpu, id; +@@ -528,6 +530,11 @@ static int mvebu_gpio_probe(struct platf + return id; + } + ++ clk = devm_clk_get(&pdev->dev, NULL); ++ /* Not all SoCs require a clock.*/ ++ if (!IS_ERR(clk)) ++ clk_prepare_enable(clk); ++ + mvchip->soc_variant = soc_variant; + mvchip->chip.label = dev_name(&pdev->dev); + mvchip->chip.dev = &pdev->dev; diff --git a/queue-3.8/keys-fix-race-with-concurrent-install_user_keyrings.patch b/queue-3.8/keys-fix-race-with-concurrent-install_user_keyrings.patch new file mode 100644 index 00000000000..5d6d4779e35 --- /dev/null +++ b/queue-3.8/keys-fix-race-with-concurrent-install_user_keyrings.patch @@ -0,0 +1,72 @@ +From 0da9dfdd2cd9889201bc6f6f43580c99165cd087 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 12 Mar 2013 16:44:31 +1100 +Subject: keys: fix race with concurrent install_user_keyrings() + +From: David Howells + +commit 0da9dfdd2cd9889201bc6f6f43580c99165cd087 upstream. + +This fixes CVE-2013-1792. + +There is a race in install_user_keyrings() that can cause a NULL pointer +dereference when called concurrently for the same user if the uid and +uid-session keyrings are not yet created. It might be possible for an +unprivileged user to trigger this by calling keyctl() from userspace in +parallel immediately after logging in. + +Assume that we have two threads both executing lookup_user_key(), both +looking for KEY_SPEC_USER_SESSION_KEYRING. + + THREAD A THREAD B + =============================== =============================== + ==>call install_user_keyrings(); + if (!cred->user->session_keyring) + ==>call install_user_keyrings() + ... + user->uid_keyring = uid_keyring; + if (user->uid_keyring) + return 0; + <== + key = cred->user->session_keyring [== NULL] + user->session_keyring = session_keyring; + atomic_inc(&key->usage); [oops] + +At the point thread A dereferences cred->user->session_keyring, thread B +hasn't updated user->session_keyring yet, but thread A assumes it is +populated because install_user_keyrings() returned ok. + +The race window is really small but can be exploited if, for example, +thread B is interrupted or preempted after initializing uid_keyring, but +before doing setting session_keyring. + +This couldn't be reproduced on a stock kernel. However, after placing +systemtap probe on 'user->session_keyring = session_keyring;' that +introduced some delay, the kernel could be crashed reliably. + +Fix this by checking both pointers before deciding whether to return. +Alternatively, the test could be done away with entirely as it is checked +inside the mutex - but since the mutex is global, that may not be the best +way. + +Signed-off-by: David Howells +Reported-by: Mateusz Guzik +Signed-off-by: Andrew Morton +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/process_keys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/keys/process_keys.c ++++ b/security/keys/process_keys.c +@@ -57,7 +57,7 @@ int install_user_keyrings(void) + + kenter("%p{%u}", user, uid); + +- if (user->uid_keyring) { ++ if (user->uid_keyring && user->session_keyring) { + kleave(" = 0 [exist]"); + return 0; + } diff --git a/queue-3.8/powerpc-apply-early-paca-fixups-to-boot_paca-and-the-boot-cpu-s-paca.patch b/queue-3.8/powerpc-apply-early-paca-fixups-to-boot_paca-and-the-boot-cpu-s-paca.patch new file mode 100644 index 00000000000..3b6d04d45d8 --- /dev/null +++ b/queue-3.8/powerpc-apply-early-paca-fixups-to-boot_paca-and-the-boot-cpu-s-paca.patch @@ -0,0 +1,68 @@ +From 25e138149c19fa0680147b825be475f5fd57f155 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Tue, 12 Feb 2013 14:44:50 +0000 +Subject: powerpc: Apply early paca fixups to boot_paca and the boot cpu's paca + +From: Michael Ellerman + +commit 25e138149c19fa0680147b825be475f5fd57f155 upstream. + +In commit 466921c we added a hack to set the paca data_offset to zero so +that per-cpu accesses would work on the boot cpu prior to per-cpu areas +being setup. This fixed a problem with lockdep touching per-cpu areas +very early in boot. + +However if we combine CONFIG_LOCK_STAT=y with any of the PPC_EARLY_DEBUG +options, we can hit the same problem in udbg_early_init(). To avoid that +we need to set the data_offset of the boot_paca also. So factor out the +fixup logic and call it for both the boot_paca, and "the paca of the +boot cpu". + +Signed-off-by: Michael Ellerman +Tested-by: Geoff Levand +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/setup_64.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -156,6 +156,15 @@ early_param("smt-enabled", early_smt_ena + #define check_smt_enabled() + #endif /* CONFIG_SMP */ + ++/** Fix up paca fields required for the boot cpu */ ++static void fixup_boot_paca(void) ++{ ++ /* The boot cpu is started */ ++ get_paca()->cpu_start = 1; ++ /* Allow percpu accesses to work until we setup percpu data */ ++ get_paca()->data_offset = 0; ++} ++ + /* + * Early initialization entry point. This is called by head.S + * with MMU translation disabled. We rely on the "feature" of +@@ -185,6 +194,7 @@ void __init early_setup(unsigned long dt + /* Assume we're on cpu 0 for now. Don't write to the paca yet! */ + initialise_paca(&boot_paca, 0); + setup_paca(&boot_paca); ++ fixup_boot_paca(); + + /* Initialize lockdep early or else spinlocks will blow */ + lockdep_init(); +@@ -205,11 +215,7 @@ void __init early_setup(unsigned long dt + + /* Now we know the logical id of our boot cpu, setup the paca. */ + setup_paca(&paca[boot_cpuid]); +- +- /* Fix up paca fields required for the boot cpu */ +- get_paca()->cpu_start = 1; +- /* Allow percpu accesses to "work" until we setup percpu data */ +- get_paca()->data_offset = 0; ++ fixup_boot_paca(); + + /* Probe the machine type */ + probe_machine(); diff --git a/queue-3.8/rtc-rtc-mv-add-support-for-clk-to-avoid-lockups.patch b/queue-3.8/rtc-rtc-mv-add-support-for-clk-to-avoid-lockups.patch new file mode 100644 index 00000000000..f1f6d825fca --- /dev/null +++ b/queue-3.8/rtc-rtc-mv-add-support-for-clk-to-avoid-lockups.patch @@ -0,0 +1,125 @@ +From 89c58c198b252f2bc20657fdd72a2aea788c435c Mon Sep 17 00:00:00 2001 +From: Andrew Lunn +Date: Sun, 3 Feb 2013 12:32:06 +0100 +Subject: rtc: rtc-mv: Add support for clk to avoid lockups + +From: Andrew Lunn + +commit 89c58c198b252f2bc20657fdd72a2aea788c435c upstream. + +The Marvell RTC on Kirkwood makes use of the runit clock. Ensure the +driver clk_prepare_enable() this clock, otherwise there is a danger +the SoC will lockup when accessing RTC registers with the clock +disabled. + +Reported-by: Simon Baatz +Signed-off-by: Andrew Lunn +Tested-by: Simon Baatz +Signed-off-by: Jason Cooper +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/kirkwood.dtsi | 1 + + drivers/rtc/rtc-mv.c | 28 ++++++++++++++++++++++++---- + 2 files changed, 25 insertions(+), 4 deletions(-) + +--- a/arch/arm/boot/dts/kirkwood.dtsi ++++ b/arch/arm/boot/dts/kirkwood.dtsi +@@ -75,6 +75,7 @@ + compatible = "marvell,kirkwood-rtc", "marvell,orion-rtc"; + reg = <0x10300 0x20>; + interrupts = <53>; ++ clocks = <&gate_clk 7>; + }; + + spi@10600 { +--- a/drivers/rtc/rtc-mv.c ++++ b/drivers/rtc/rtc-mv.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -41,6 +42,7 @@ struct rtc_plat_data { + struct rtc_device *rtc; + void __iomem *ioaddr; + int irq; ++ struct clk *clk; + }; + + static int mv_rtc_set_time(struct device *dev, struct rtc_time *tm) +@@ -221,6 +223,7 @@ static int mv_rtc_probe(struct platform_ + struct rtc_plat_data *pdata; + resource_size_t size; + u32 rtc_time; ++ int ret = 0; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) +@@ -239,11 +242,17 @@ static int mv_rtc_probe(struct platform_ + if (!pdata->ioaddr) + return -ENOMEM; + ++ pdata->clk = devm_clk_get(&pdev->dev, NULL); ++ /* Not all SoCs require a clock.*/ ++ if (!IS_ERR(pdata->clk)) ++ clk_prepare_enable(pdata->clk); ++ + /* make sure the 24 hours mode is enabled */ + rtc_time = readl(pdata->ioaddr + RTC_TIME_REG_OFFS); + if (rtc_time & RTC_HOURS_12H_MODE) { + dev_err(&pdev->dev, "24 Hours mode not supported.\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + /* make sure it is actually functional */ +@@ -252,7 +261,8 @@ static int mv_rtc_probe(struct platform_ + rtc_time = readl(pdata->ioaddr + RTC_TIME_REG_OFFS); + if (rtc_time == 0x01000000) { + dev_err(&pdev->dev, "internal RTC not ticking\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto out; + } + } + +@@ -268,8 +278,10 @@ static int mv_rtc_probe(struct platform_ + } else + pdata->rtc = rtc_device_register(pdev->name, &pdev->dev, + &mv_rtc_ops, THIS_MODULE); +- if (IS_ERR(pdata->rtc)) +- return PTR_ERR(pdata->rtc); ++ if (IS_ERR(pdata->rtc)) { ++ ret = PTR_ERR(pdata->rtc); ++ goto out; ++ } + + if (pdata->irq >= 0) { + writel(0, pdata->ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS); +@@ -282,6 +294,11 @@ static int mv_rtc_probe(struct platform_ + } + + return 0; ++out: ++ if (!IS_ERR(pdata->clk)) ++ clk_disable_unprepare(pdata->clk); ++ ++ return ret; + } + + static int __exit mv_rtc_remove(struct platform_device *pdev) +@@ -292,6 +309,9 @@ static int __exit mv_rtc_remove(struct p + device_init_wakeup(&pdev->dev, 0); + + rtc_device_unregister(pdata->rtc); ++ if (!IS_ERR(pdata->clk)) ++ clk_disable_unprepare(pdata->clk); ++ + return 0; + } + diff --git a/queue-3.8/series b/queue-3.8/series index d4d44a0719e..95f95f77830 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -81,3 +81,11 @@ mfd-rtsx-fix-issue-that-booting-os-with-sd-card-inserted.patch crypto-user-fix-info-leaks-in-report-api.patch acer-wmi-avoid-the-warning-of-devices-may-be-used-uninitialized.patch usbnet-smsc95xx-fix-suspend-failure.patch +keys-fix-race-with-concurrent-install_user_keyrings.patch +fix-compat_rw_copy_check_uvector-misuse-in-aio-readv-writev-and-security-keys.patch +vfs-fix-pipe-counter-breakage.patch +rtc-rtc-mv-add-support-for-clk-to-avoid-lockups.patch +gpio-mvebu-add-clk-support-to-prevent-lockup.patch +arm-mxs_defconfig-make-usb-host-functional-again.patch +arm-kirkwood-of_serial-fix-clock-gating-by-removing-clock-frequency.patch +powerpc-apply-early-paca-fixups-to-boot_paca-and-the-boot-cpu-s-paca.patch diff --git a/queue-3.8/vfs-fix-pipe-counter-breakage.patch b/queue-3.8/vfs-fix-pipe-counter-breakage.patch new file mode 100644 index 00000000000..e77c94ae540 --- /dev/null +++ b/queue-3.8/vfs-fix-pipe-counter-breakage.patch @@ -0,0 +1,42 @@ +From a930d8790552658140d7d0d2e316af4f0d76a512 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Tue, 12 Mar 2013 02:59:49 +0000 +Subject: vfs: fix pipe counter breakage + +From: Al Viro + +commit a930d8790552658140d7d0d2e316af4f0d76a512 upstream. + +If you open a pipe for neither read nor write, the pipe code will not +add any usage counters to the pipe, causing the 'struct pipe_inode_info" +to be potentially released early. + +That doesn't normally matter, since you cannot actually use the pipe, +but the pipe release code - particularly fasync handling - still expects +the actual pipe infrastructure to all be there. And rather than adding +NULL pointer checks, let's just disallow this case, the same way we +already do for the named pipe ("fifo") case. + +This is ancient going back to pre-2.4 days, and until trinity, nobody +naver noticed. + +Reported-by: Dave Jones +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pipe.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -863,6 +863,9 @@ pipe_rdwr_open(struct inode *inode, stru + { + int ret = -ENOENT; + ++ if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE))) ++ return -EINVAL; ++ + mutex_lock(&inode->i_mutex); + + if (inode->i_pipe) { -- 2.47.3