linux.git/drivers, branch v3.14.29

mmc: sdhci: Fix sleep in atomic after inserting SD card

2015-01-16T14:59:34+00:00

commit 2836766a9d0bd02c66073f8dd44796e6cc23848d upstream.

Sleep in atomic context happened on Trats2 board after inserting or
removing SD card because mmc_gpio_get_cd() was called under spin lock.

Fix this by moving card detection earlier, before acquiring spin lock.
The mmc_gpio_get_cd() call does not have to be protected by spin lock
because it does not access any sdhci internal data.
The sdhci_do_get_cd() call access host flags (SDHCI_DEVICE_DEAD). After
moving it out side of spin lock it could theoretically race with driver
removal but still there is no actual protection against manual card
eject.

Dmesg after inserting SD card:
[   41.663414] BUG: sleeping function called from invalid context at drivers/gpio/gpiolib.c:1511
[   41.670469] in_atomic(): 1, irqs_disabled(): 128, pid: 30, name: kworker/u8:1
[   41.677580] INFO: lockdep is turned off.
[   41.681486] irq event stamp: 61972
[   41.684872] hardirqs last  enabled at (61971): [] _raw_spin_unlock_irq+0x24/0x5c
[   41.693118] hardirqs last disabled at (61972): [] _raw_spin_lock_irq+0x18/0x54
[   41.701190] softirqs last  enabled at (61648): [] __do_softirq+0x234/0x2c8
[   41.708914] softirqs last disabled at (61631): [] irq_exit+0xd0/0x114
[   41.716206] Preemption disabled at:[<  (null)>]   (null)
[   41.721500]
[   41.722985] CPU: 3 PID: 30 Comm: kworker/u8:1 Tainted: G        W      3.18.0-rc5-next-20141121 #883
[   41.732111] Workqueue: kmmcd mmc_rescan
[   41.735945] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[   41.743661] [] (show_stack) from [] (dump_stack+0x70/0xbc)
[   41.750867] [] (dump_stack) from [] (gpiod_get_raw_value_cansleep+0x18/0x30)
[   41.759628] [] (gpiod_get_raw_value_cansleep) from [] (mmc_gpio_get_cd+0x38/0x58)
[   41.768821] [] (mmc_gpio_get_cd) from [] (sdhci_request+0x50/0x1a4)
[   41.776808] [] (sdhci_request) from [] (mmc_start_request+0x138/0x268)
[   41.785051] [] (mmc_start_request) from [] (mmc_wait_for_req+0x58/0x1a0)
[   41.793469] [] (mmc_wait_for_req) from [] (mmc_wait_for_cmd+0x58/0x78)
[   41.801714] [] (mmc_wait_for_cmd) from [] (mmc_io_rw_direct_host+0x98/0x124)
[   41.810480] [] (mmc_io_rw_direct_host) from [] (sdio_reset+0x2c/0x64)
[   41.818641] [] (sdio_reset) from [] (mmc_rescan+0x254/0x2e4)
[   41.826028] [] (mmc_rescan) from [] (process_one_work+0x180/0x3f4)
[   41.833920] [] (process_one_work) from [] (worker_thread+0x34/0x4b0)
[   41.841991] [] (worker_thread) from [] (kthread+0xe4/0x104)
[   41.849285] [] (kthread) from [] (ret_from_fork+0x14/0x2c)
[   42.038276] mmc0: new high speed SDHC card at address 1234

Signed-off-by: Krzysztof Kozlowski 
Fixes: 94144a465dd0 ("mmc: sdhci: add get_cd() implementation")
Signed-off-by: Ulf Hansson 
Signed-off-by: Greg Kroah-Hartman

spi: fsl: Fix problem with multi message transfers

2015-01-16T14:59:34+00:00

commit 4302a59629f7a0bd70fd1605d2b558597517372a upstream.

When used via spidev with more than one messages to tranfer via
SPI_IOC_MESSAGE the current implementation would return with
-EINVAL, since bits_per_word and speed_hz are set in all
transfer structs. And in the 2nd loop status will stay at
-EINVAL as its not overwritten again via fsl_spi_setup_transfer().

This patch changes this behavious by first checking if one of
the messages uses different settings. If this is the case
the function will return with -EINVAL. If not, the messages
are transferred correctly.

Signed-off-by: Stefan Roese 
Signed-off-by: Mark Brown 
Cc: Esben Haabendal 
Signed-off-by: Greg Kroah-Hartman

ACPI / PM: Fix PM initialization for devices that are not present

2015-01-16T14:59:34+00:00

commit 1b1f3e1699a9886f1070f94171097ab4ccdbfc95 upstream.

If an ACPI device object whose _STA returns 0 (not present and not
functional) has _PR0 or _PS0, its power_manageable flag will be set
and acpi_bus_init_power() will return 0 for it.  Consequently, if
such a device object is passed to the ACPI device PM functions, they
will attempt to carry out the requested operation on the device,
although they should not do that for devices that are not present.

To fix that problem make acpi_bus_init_power() return an error code
for devices that are not present which will cause power_manageable to
be cleared for them as appropriate in acpi_bus_get_power_flags().
However, the lists of power resources should not be freed for the
device in that case, so modify acpi_bus_get_power_flags() to keep
those lists even if acpi_bus_init_power() returns an error.
Accordingly, when deciding whether or not the lists of power
resources need to be freed, acpi_free_power_resources_lists()
should check the power.flags.power_resources flag instead of
flags.power_manageable, so make that change too.

Furthermore, if acpi_bus_attach() sees that flags.initialized is
unset for the given device, it should reset the power management
settings of the device and re-initialize them from scratch instead
of relying on the previous settings (the device may have appeared
after being not present previously, for example), so make it use
the 'valid' flag of the D0 power state as the initial value of
flags.power_manageable for it and call acpi_bus_init_power() to
discover its current power state.

Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Mika Westerberg 
Signed-off-by: Greg Kroah-Hartman

mtd: tests: abort torturetest on erase errors

2015-01-16T14:59:33+00:00

commit 68f29815034e9dc9ed53cad85946c32b07adc8cc upstream.

The torture test should quit once it actually induces an error in the
flash. This step was accidentally removed during refactoring.

Without this fix, the torturetest just continues infinitely, or until
the maximum cycle count is reached. e.g.:

   ...
   [ 7619.218171] mtd_test: error -5 while erasing EB 100
   [ 7619.297981] mtd_test: error -5 while erasing EB 100
   [ 7619.377953] mtd_test: error -5 while erasing EB 100
   [ 7619.457998] mtd_test: error -5 while erasing EB 100
   [ 7619.537990] mtd_test: error -5 while erasing EB 100
   ...

Fixes: 6cf78358c94f ("mtd: mtd_torturetest: use mtd_test helpers")
Signed-off-by: Brian Norris 
Cc: Akinobu Mita 
Signed-off-by: Greg Kroah-Hartman

Drivers: hv: vmbus: Fix a race condition when unregistering a device

2015-01-16T14:59:32+00:00

commit 04a258c162a85c0f4ae56be67634dc43c9a4fa9b upstream.

When build with Debug the following crash is sometimes observed:
Call Trace:
 [] string+0x40/0x100
 [] vsnprintf+0x218/0x5e0
 [] ? trace_hardirqs_off+0xd/0x10
 [] vscnprintf+0x11/0x30
 [] vprintk+0xd0/0x5c0
 [] ? vmbus_process_rescind_offer+0x0/0x110 [hv_vmbus]
 [] printk+0x41/0x45
 [] vmbus_device_unregister+0x2c/0x40 [hv_vmbus]
 [] vmbus_process_rescind_offer+0x2b/0x110 [hv_vmbus]
...

This happens due to the following race: between 'if (channel->device_obj)' check
in vmbus_process_rescind_offer() and pr_debug() in vmbus_device_unregister() the
device can disappear. Fix the issue by taking an additional reference to the
device before proceeding to vmbus_device_unregister().

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Signed-off-by: Greg Kroah-Hartman

n_tty: Fix read_buf race condition, increment read_head after pushing data

2015-01-16T14:59:32+00:00

commit 8bfbe2de769afda051c56aba5450391670e769fc upstream.

Commit 19e2ad6a09f0c06dbca19c98e5f4584269d913dd ("n_tty: Remove overflow
tests from receive_buf() path") moved the increment of read_head into
the arguments list of read_buf_addr(). Function calls represent a
sequence point in C. Therefore read_head is incremented before the
character c is placed in the buffer. Since the circular read buffer is
a lock-less design since commit 6d76bd2618535c581f1673047b8341fd291abc67
("n_tty: Make N_TTY ldisc receive path lockless"), this creates a race
condition that leads to communication errors.

This patch modifies the code to increment read_head _after_ the data
is placed in the buffer and thus fixes the race for non-SMP machines.
To fix the problem for SMP machines, memory barriers must be added in
a separate patch.

Signed-off-by: Christian Riesch 
Signed-off-by: Greg Kroah-Hartman

serial: samsung: wait for transfer completion before clock disable

2015-01-16T14:59:32+00:00

commit 1ff383a4c3eda8893ec61b02831826e1b1f46b41 upstream.

This patch adds waiting until transmit buffer and shifter will be empty
before clock disabling.

Without this fix it's possible to have clock disabled while data was
not transmited yet, which causes unproper state of TX line and problems
in following data transfers.

Signed-off-by: Robert Baldyga 
Signed-off-by: Greg Kroah-Hartman

cdc-acm: memory leak in error case

2015-01-16T14:59:32+00:00

commit d908f8478a8d18e66c80a12adb27764920c1f1ca upstream.

If probe() fails not only the attributes need to be removed
but also the memory freed.

Reported-by: Ahmed Tamrawi 
Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

USB: cdc-acm: check for valid interfaces

2015-01-16T14:59:32+00:00

commit 403dff4e2c94f275e24fd85f40b2732ffec268a1 upstream.

We need to check that we have both a valid data and control inteface for both
types of headers (union and not union.)

References: https://bugzilla.kernel.org/show_bug.cgi?id=83551
Reported-by: Simon Schubert <2+kernel@0x2c.org>
Signed-off-by: Greg Kroah-Hartman

misc: genwqe: check for error from get_user_pages_fast()

2015-01-16T14:59:31+00:00

commit cf35d6e0475982667b0d2d318fb27be4b8849827 upstream.

`genwqe_user_vmap()` calls `get_user_pages_fast()` and if the return
value is less than the number of pages requested, it frees the pages and
returns an error (`-EFAULT`).  However, it fails to consider a negative
error return value from `get_user_pages_fast()`.  In that case, the test
`if (rc < m->nr_pages)` will be false (due to promotion of `rc` to a
large `unsigned int`) and the code will continue on to call
`genwqe_map_pages()` with an invalid list of page pointers.  Fix it by
bailing out if `get_user_pages_fast()` returns a negative error value.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman