--- /dev/null
+From 862474f8b46f6c1e600d4934e40ba40646c696ec Mon Sep 17 00:00:00 2001
+From: Olivier Sobrie <olivier@sobrie.be>
+Date: Tue, 11 Feb 2014 11:01:23 +0100
+Subject: can: kvaser_usb: check number of channels returned by HW
+
+From: Olivier Sobrie <olivier@sobrie.be>
+
+commit 862474f8b46f6c1e600d4934e40ba40646c696ec upstream.
+
+It is needed to check the number of channels returned by the HW because it
+cannot be greater than MAX_NET_DEVICES otherwise it will crash.
+
+Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -474,6 +474,8 @@ static int kvaser_usb_get_card_info(stru
+ return err;
+
+ dev->nchannels = msg.u.cardinfo.nchannels;
++ if (dev->nchannels > MAX_NET_DEVICES)
++ return -EINVAL;
+
+ return 0;
+ }
--- /dev/null
+From 500a91571f0a5d0d3242d83802ea2fd1faccc66e Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 15 Feb 2014 17:54:06 -0800
+Subject: hwmon: (max1668) Fix writing the minimum temperature
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 500a91571f0a5d0d3242d83802ea2fd1faccc66e upstream.
+
+When trying to set the minimum temperature, the driver was erroneously
+writing the maximum temperature into the chip.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/max1668.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/max1668.c
++++ b/drivers/hwmon/max1668.c
+@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct devic
+ data->temp_min[index] = clamp_val(temp/1000, -128, 127);
+ if (i2c_smbus_write_byte_data(client,
+ MAX1668_REG_LIML_WR(index),
+- data->temp_max[index]))
++ data->temp_min[index]))
+ count = -EIO;
+ mutex_unlock(&data->update_lock);
+
--- /dev/null
+From accb884b32e82f943340688c9cd30290531e73e0 Mon Sep 17 00:00:00 2001
+From: Chao Bi <chao.bi@intel.com>
+Date: Wed, 12 Feb 2014 21:27:25 +0200
+Subject: mei: set client's read_cb to NULL when flow control fails
+
+From: Chao Bi <chao.bi@intel.com>
+
+commit accb884b32e82f943340688c9cd30290531e73e0 upstream.
+
+In mei_cl_read_start(), if it fails to send flow control request, it
+will release "cl->read_cb" but forget to set pointer to NULL, leaving
+"cl->read_cb" still pointing to random memory, next time this client is
+operated like mei_release(), it has chance to refer to this wrong pointer.
+
+Fixes: PANIC at kfree in mei_release()
+
+[228781.826904] Call Trace:
+[228781.829737] [<c16249b8>] ? mei_cl_unlink+0x48/0xa0
+[228781.835283] [<c1624487>] mei_io_cb_free+0x17/0x30
+[228781.840733] [<c16265d8>] mei_release+0xa8/0x180
+[228781.845989] [<c135c610>] ? __fsnotify_parent+0xa0/0xf0
+[228781.851925] [<c1325a69>] __fput+0xd9/0x200
+[228781.856696] [<c1325b9d>] ____fput+0xd/0x10
+[228781.861467] [<c125cae1>] task_work_run+0x81/0xb0
+[228781.866821] [<c1242e53>] do_exit+0x283/0xa00
+[228781.871786] [<c1a82b36>] ? kprobe_flush_task+0x66/0xc0
+[228781.877722] [<c124eeb8>] ? __dequeue_signal+0x18/0x1a0
+[228781.883657] [<c124f072>] ? dequeue_signal+0x32/0x190
+[228781.889397] [<c1243744>] do_group_exit+0x34/0xa0
+[228781.894750] [<c12517b6>] get_signal_to_deliver+0x206/0x610
+[228781.901075] [<c12018d8>] do_signal+0x38/0x100
+[228781.906136] [<c1626d1c>] ? mei_read+0x42c/0x4e0
+[228781.911393] [<c12600a0>] ? wake_up_bit+0x30/0x30
+[228781.916745] [<c16268f0>] ? mei_poll+0x120/0x120
+[228781.922001] [<c1324be9>] ? vfs_read+0x89/0x160
+[228781.927158] [<c16268f0>] ? mei_poll+0x120/0x120
+[228781.932414] [<c133ca34>] ? fget_light+0x44/0xe0
+[228781.937670] [<c1324e58>] ? SyS_read+0x68/0x80
+[228781.942730] [<c12019f5>] do_notify_resume+0x55/0x70
+[228781.948376] [<c1a7de5d>] work_notifysig+0x29/0x30
+[228781.953827] [<c1a70000>] ? bad_area+0x5/0x3e
+
+Signed-off-by: Chao Bi <chao.bi@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -664,7 +664,6 @@ int mei_cl_read_start(struct mei_cl *cl,
+ goto err;
+
+ cb->fop_type = MEI_FOP_READ;
+- cl->read_cb = cb;
+ if (dev->hbuf_is_ready) {
+ dev->hbuf_is_ready = false;
+ if (mei_hbm_cl_flow_control_req(dev, cl)) {
+@@ -675,6 +674,9 @@ int mei_cl_read_start(struct mei_cl *cl,
+ } else {
+ list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
+ }
++
++ cl->read_cb = cb;
++
+ return rets;
+ err:
+ mei_io_cb_free(cb);
i7core_edac-fix-pci-device-reference-count.patch
acpi-video-filter-the-_bcl-table-for-duplicate-brightness-values.patch
acpi-processor-rework-processor-throttling-with-work_on_cpu.patch
+can-kvaser_usb-check-number-of-channels-returned-by-hw.patch
+usb-chipidea-need-to-mask-when-writting-endptflush-and-endptprime.patch
+usb-gadget-bcm63xx_udc-fix-build-failure-on-dma-channel-code.patch
+usb-serial-option-blacklist-interface-4-for-cinterion-phs8-and-pxs8.patch
+usb-ehci-fix-deadlock-when-threadirqs-option-is-used.patch
+usb-ftdi_sio-add-cressi-leonardo-pid.patch
+mei-set-client-s-read_cb-to-null-when-flow-control-fails.patch
+hwmon-max1668-fix-writing-the-minimum-temperature.patch
+workqueue-ensure-task-is-valid-across-kthread_stop.patch
--- /dev/null
+From 5bf5dbeda2454296f1984adfbfc8e6f5965ac389 Mon Sep 17 00:00:00 2001
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+Date: Wed, 19 Feb 2014 13:46:31 +0800
+Subject: usb: chipidea: need to mask when writting endptflush and endptprime
+
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+
+commit 5bf5dbeda2454296f1984adfbfc8e6f5965ac389 upstream.
+
+ENDPTFLUSH and ENDPTPRIME registers are set by software and clear
+by hardware. There is a bit for each endpoint. When we are setting
+a bit for an endpoint we should make sure we do not touch other
+endpoint bit. There is a race condition if the hardware clear the
+bit between the read and the write in hw_write.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Matthieu CASTET <matthieu.castet@parrot.com>
+Tested-by: Michael Grzeschik <mgrzeschik@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -103,7 +103,7 @@ static int hw_ep_flush(struct ci13xxx *c
+
+ do {
+ /* flush any pending transfer */
+- hw_write(ci, OP_ENDPTFLUSH, BIT(n), BIT(n));
++ hw_write(ci, OP_ENDPTFLUSH, ~0, BIT(n));
+ while (hw_read(ci, OP_ENDPTFLUSH, BIT(n)))
+ cpu_relax();
+ } while (hw_read(ci, OP_ENDPTSTAT, BIT(n)));
+@@ -203,7 +203,7 @@ static int hw_ep_prime(struct ci13xxx *c
+ if (is_ctrl && dir == RX && hw_read(ci, OP_ENDPTSETUPSTAT, BIT(num)))
+ return -EAGAIN;
+
+- hw_write(ci, OP_ENDPTPRIME, BIT(n), BIT(n));
++ hw_write(ci, OP_ENDPTPRIME, ~0, BIT(n));
+
+ while (hw_read(ci, OP_ENDPTPRIME, BIT(n)))
+ cpu_relax();
--- /dev/null
+From a1227f3c1030e96ebc51d677d2f636268845c5fb Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 19 Feb 2014 10:29:01 +0100
+Subject: usb: ehci: fix deadlock when threadirqs option is used
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit a1227f3c1030e96ebc51d677d2f636268845c5fb upstream.
+
+ehci_irq() and ehci_hrtimer_func() can deadlock on ehci->lock when
+threadirqs option is used. To prevent the deadlock use
+spin_lock_irqsave() in ehci_irq().
+
+This change can be reverted when hrtimer callbacks become threaded.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hcd.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -686,8 +686,15 @@ static irqreturn_t ehci_irq (struct usb_
+ struct ehci_hcd *ehci = hcd_to_ehci (hcd);
+ u32 status, masked_status, pcd_status = 0, cmd;
+ int bh;
++ unsigned long flags;
+
+- spin_lock (&ehci->lock);
++ /*
++ * For threadirqs option we use spin_lock_irqsave() variant to prevent
++ * deadlock with ehci hrtimer callback, because hrtimer callbacks run
++ * in interrupt context even when threadirqs is specified. We can go
++ * back to spin_lock() variant when hrtimer callbacks become threaded.
++ */
++ spin_lock_irqsave(&ehci->lock, flags);
+
+ status = ehci_readl(ehci, &ehci->regs->status);
+
+@@ -705,7 +712,7 @@ static irqreturn_t ehci_irq (struct usb_
+
+ /* Shared IRQ? */
+ if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
+- spin_unlock(&ehci->lock);
++ spin_unlock_irqrestore(&ehci->lock, flags);
+ return IRQ_NONE;
+ }
+
+@@ -823,7 +830,7 @@ dead:
+
+ if (bh)
+ ehci_work (ehci);
+- spin_unlock (&ehci->lock);
++ spin_unlock_irqrestore(&ehci->lock, flags);
+ if (pcd_status)
+ usb_hcd_poll_rh_status(hcd);
+ return IRQ_HANDLED;
--- /dev/null
+From 6dbd46c849e071e6afc1e0cad489b0175bca9318 Mon Sep 17 00:00:00 2001
+From: Joerg Dorchain <joerg@dorchain.net>
+Date: Fri, 21 Feb 2014 20:29:33 +0100
+Subject: USB: ftdi_sio: add Cressi Leonardo PID
+
+From: Joerg Dorchain <joerg@dorchain.net>
+
+commit 6dbd46c849e071e6afc1e0cad489b0175bca9318 upstream.
+
+Hello,
+
+the following patch adds an entry for the PID of a Cressi Leonardo
+diving computer interface to kernel 3.13.0.
+It is detected as FT232RL.
+Works with subsurface.
+
+Signed-off-by: Joerg Dorchain <joerg@dorchain.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -910,6 +910,8 @@ static struct usb_device_id id_table_com
+ /* Crucible Devices */
+ { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
++ /* Cressi Devices */
++ { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1320,3 +1320,9 @@
+ * Manufacturer: Smart GSM Team
+ */
+ #define FTDI_Z3X_PID 0x0011
++
++/*
++ * Product: Cressi PC Interface
++ * Manufacturer: Cressi
++ */
++#define FTDI_CRESSI_PID 0x87d0
--- /dev/null
+From 2d1f7af3d60dd09794e0738a915d272c6c27abc5 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Tue, 14 Jan 2014 15:36:29 -0800
+Subject: usb: gadget: bcm63xx_udc: fix build failure on DMA channel code
+
+From: Florian Fainelli <florian@openwrt.org>
+
+commit 2d1f7af3d60dd09794e0738a915d272c6c27abc5 upstream.
+
+Commit 3dc6475 ("bcm63xx_enet: add support Broadcom BCM6345 Ethernet")
+changed the ENETDMA[CS] macros such that they are no longer macros, but
+actual register offset definitions. The bcm63xx_udc driver was not
+updated, and as a result, causes the following build error to pop up:
+
+ CC drivers/usb/gadget/u_ether.o
+drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_write':
+drivers/usb/gadget/bcm63xx_udc.c:642:24: error: called object '0' is not
+a function
+drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_reset_channel':
+drivers/usb/gadget/bcm63xx_udc.c:698:46: error: called object '0' is not
+a function
+drivers/usb/gadget/bcm63xx_udc.c:700:49: error: called object '0' is not
+a function
+
+Fix this by updating usb_dmac_{read,write}l and usb_dmas_{read,write}l to
+take an extra channel argument, and use the channel width
+(ENETDMA_CHAN_WIDTH) to offset the register we want to access, hence
+doing again what the macro implicitely did for us.
+
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: Jonas Gorski <jogo@openwrt.org>
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/bcm63xx_udc.c | 58 +++++++++++++++++++++------------------
+ 1 file changed, 32 insertions(+), 26 deletions(-)
+
+--- a/drivers/usb/gadget/bcm63xx_udc.c
++++ b/drivers/usb/gadget/bcm63xx_udc.c
+@@ -361,24 +361,30 @@ static inline void usb_dma_writel(struct
+ bcm_writel(val, udc->iudma_regs + off);
+ }
+
+-static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off)
++static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off, int chan)
+ {
+- return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
++ return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+-static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
++static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
++ int chan)
+ {
+- bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
++ bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+-static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off)
++static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off, int chan)
+ {
+- return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
++ return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+-static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
++static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
++ int chan)
+ {
+- bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
++ bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+ static inline void set_clocks(struct bcm63xx_udc *udc, bool is_enabled)
+@@ -639,7 +645,7 @@ static void iudma_write(struct bcm63xx_u
+ } while (!last_bd);
+
+ usb_dmac_writel(udc, ENETDMAC_CHANCFG_EN_MASK,
+- ENETDMAC_CHANCFG_REG(iudma->ch_idx));
++ ENETDMAC_CHANCFG_REG, iudma->ch_idx);
+ }
+
+ /**
+@@ -695,9 +701,9 @@ static void iudma_reset_channel(struct b
+ bcm63xx_fifo_reset_ep(udc, max(0, iudma->ep_num));
+
+ /* stop DMA, then wait for the hardware to wrap up */
+- usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG(ch_idx));
++ usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG, ch_idx);
+
+- while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)) &
++ while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx) &
+ ENETDMAC_CHANCFG_EN_MASK) {
+ udelay(1);
+
+@@ -714,10 +720,10 @@ static void iudma_reset_channel(struct b
+ dev_warn(udc->dev, "forcibly halting IUDMA channel %d\n",
+ ch_idx);
+ usb_dmac_writel(udc, ENETDMAC_CHANCFG_BUFHALT_MASK,
+- ENETDMAC_CHANCFG_REG(ch_idx));
++ ENETDMAC_CHANCFG_REG, ch_idx);
+ }
+ }
+- usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG(ch_idx));
++ usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG, ch_idx);
+
+ /* don't leave "live" HW-owned entries for the next guy to step on */
+ for (d = iudma->bd_ring; d <= iudma->end_bd; d++)
+@@ -729,11 +735,11 @@ static void iudma_reset_channel(struct b
+
+ /* set up IRQs, UBUS burst size, and BD base for this channel */
+ usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
+- ENETDMAC_IRMASK_REG(ch_idx));
+- usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG(ch_idx));
++ ENETDMAC_IRMASK_REG, ch_idx);
++ usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG, ch_idx);
+
+- usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG(ch_idx));
+- usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG(ch_idx));
++ usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG, ch_idx);
++ usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG, ch_idx);
+ }
+
+ /**
+@@ -2036,7 +2042,7 @@ static irqreturn_t bcm63xx_udc_data_isr(
+ spin_lock(&udc->lock);
+
+ usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
+- ENETDMAC_IR_REG(iudma->ch_idx));
++ ENETDMAC_IR_REG, iudma->ch_idx);
+ bep = iudma->bep;
+ rc = iudma_read(udc, iudma);
+
+@@ -2176,18 +2182,18 @@ static int bcm63xx_iudma_dbg_show(struct
+ seq_printf(s, " [ep%d]:\n",
+ max_t(int, iudma_defaults[ch_idx].ep_num, 0));
+ seq_printf(s, " cfg: %08x; irqstat: %08x; irqmask: %08x; maxburst: %08x\n",
+- usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)),
+- usb_dmac_readl(udc, ENETDMAC_IR_REG(ch_idx)),
+- usb_dmac_readl(udc, ENETDMAC_IRMASK_REG(ch_idx)),
+- usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG(ch_idx)));
++ usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx),
++ usb_dmac_readl(udc, ENETDMAC_IR_REG, ch_idx),
++ usb_dmac_readl(udc, ENETDMAC_IRMASK_REG, ch_idx),
++ usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG, ch_idx));
+
+- sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG(ch_idx));
+- sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG(ch_idx));
++ sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG, ch_idx);
++ sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG, ch_idx);
+ seq_printf(s, " base: %08x; index: %04x_%04x; desc: %04x_%04x %08x\n",
+- usb_dmas_readl(udc, ENETDMAS_RSTART_REG(ch_idx)),
++ usb_dmas_readl(udc, ENETDMAS_RSTART_REG, ch_idx),
+ sram2 >> 16, sram2 & 0xffff,
+ sram3 >> 16, sram3 & 0xffff,
+- usb_dmas_readl(udc, ENETDMAS_SRAM4_REG(ch_idx)));
++ usb_dmas_readl(udc, ENETDMAS_SRAM4_REG, ch_idx));
+ seq_printf(s, " desc: %d/%d used", iudma->n_bds_used,
+ iudma->n_bds);
+
--- /dev/null
+From 12df84d4a80278a5b1abfec3206795291da52fc9 Mon Sep 17 00:00:00 2001
+From: Aleksander Morgado <aleksander@aleksander.es>
+Date: Wed, 12 Feb 2014 16:04:45 +0100
+Subject: USB: serial: option: blacklist interface 4 for Cinterion PHS8 and PXS8
+
+From: Aleksander Morgado <aleksander@aleksander.es>
+
+commit 12df84d4a80278a5b1abfec3206795291da52fc9 upstream.
+
+This interface is to be handled by the qmi_wwan driver.
+
+CC: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
+CC: Christian Schmiedl <christian.schmiedl@gemalto.com>
+CC: Nicolaus Colberg <nicolaus.colberg@gemalto.com>
+CC: David McCullough <david.mccullough@accelecon.com>
+Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1526,7 +1526,8 @@ static const struct usb_device_id option
+ /* Cinterion */
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
--- /dev/null
+From 5bdfff96c69a4d5ab9c49e60abf9e070ecd2acbb Mon Sep 17 00:00:00 2001
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+Date: Sat, 15 Feb 2014 22:02:28 +0800
+Subject: workqueue: ensure @task is valid across kthread_stop()
+
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+
+commit 5bdfff96c69a4d5ab9c49e60abf9e070ecd2acbb upstream.
+
+When a kworker should die, the kworkre is notified through WORKER_DIE
+flag instead of kthread_should_stop(). This, IIRC, is primarily to
+keep the test synchronized inside worker_pool lock. WORKER_DIE is
+first set while holding pool->lock, the lock is dropped and
+kthread_stop() is called.
+
+Unfortunately, this means that there's a slight chance that the target
+kworker may see WORKER_DIE before kthread_stop() finishes and exits
+and frees the target task before or during kthread_stop().
+
+Fix it by pinning the target task before setting WORKER_DIE and
+putting it after kthread_stop() is done.
+
+tj: Improved patch description and comment. Moved pinning above
+ WORKER_DIE for better signify what it's protecting.
+
+Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1823,6 +1823,12 @@ static void destroy_worker(struct worker
+ if (worker->flags & WORKER_IDLE)
+ pool->nr_idle--;
+
++ /*
++ * Once WORKER_DIE is set, the kworker may destroy itself at any
++ * point. Pin to ensure the task stays until we're done with it.
++ */
++ get_task_struct(worker->task);
++
+ list_del_init(&worker->entry);
+ worker->flags |= WORKER_DIE;
+
+@@ -1831,6 +1837,7 @@ static void destroy_worker(struct worker
+ spin_unlock_irq(&pool->lock);
+
+ kthread_stop(worker->task);
++ put_task_struct(worker->task);
+ kfree(worker);
+
+ spin_lock_irq(&pool->lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
