1. 04 Feb, 2015 14 commits
  2. 02 Feb, 2015 5 commits
  3. 26 Jan, 2015 3 commits
  4. 23 Jan, 2015 3 commits
    • Chris Wilson's avatar
      drm/i915: Evict CS TLBs between batches · 37b1a635
      Chris Wilson authored
      commit c4d69da1 upstream.
      
      Running igt, I was encountering the invalid TLB bug on my 845g, despite
      that it was using the CS workaround. Examining the w/a buffer in the
      error state, showed that the copy from the user batch into the
      workaround itself was suffering from the invalid TLB bug (the first
      cacheline was broken with the first two words reversed). Time to try a
      fresh approach. This extends the workaround to write into each page of
      our scratch buffer in order to overflow the TLB and evict the invalid
      entries. This could be refined to only do so after we update the GTT,
      but for simplicity, we do it before each batch.
      
      I suspect this supersedes our current workaround, but for safety keep
      doing both.
      
      v2: The magic number shall be 2.
      
      This doesn't conclusively prove that it is the mythical TLB bug we've
      been trying to workaround for so long, that it requires touching a number
      of pages to prevent the corruption indicates to me that it is TLB
      related, but the corruption (the reversed cacheline) is more subtle than
      a TLB bug, where we would expect it to read the wrong page entirely.
      
      Oh well, it prevents a reliable hang for me and so probably for others
      as well.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      [ luis: backported to 3.16: adjusted context ]
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      37b1a635
    • Alexander Y. Fomichev's avatar
      net: fix creation adjacent device symlinks · 0e1ae67c
      Alexander Y. Fomichev authored
      commit 7ce64c79 upstream.
      
      __netdev_adjacent_dev_insert may add adjust device of different net
      namespace, without proper check it leads to emergence of broken
      sysfs links from/to devices in another namespace.
      Fix: rewrite netdev_adjacent_is_neigh_list macro as a function,
           move net_eq check into netdev_adjacent_is_neigh_list.
           (thanks David)
           related to: 4c75431aSigned-off-by: default avatarAlexander Fomichev <git.user@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Cc: Miquel van Smoorenburg <mikevs@xs4all.net>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      0e1ae67c
    • Alexander Y. Fomichev's avatar
      net: prevent of emerging cross-namespace symlinks · 99d65e7e
      Alexander Y. Fomichev authored
      commit 4c75431a upstream.
      
      Code manipulating sysfs symlinks on adjacent net_devices(s)
      currently doesn't take into account that devices potentially
      belong to different namespaces.
      
      This patch trying to fix an issue as follows:
      - check for net_ns before creating / deleting symlink.
        for now only netdev_adjacent_rename_links and
        __netdev_adjacent_dev_remove are affected, afaics
        __netdev_adjacent_dev_insert implies both net_devs
        belong to the same namespace.
      - Drop all existing symlinks to / from all adj_devs before
        switching namespace and recreate them just after.
      Signed-off-by: default avatarAlexander Y. Fomichev <git.user@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Cc: Miquel van Smoorenburg <mikevs@xs4all.net>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      99d65e7e
  5. 22 Jan, 2015 15 commits
    • Hannes Reinecke's avatar
      tcm_loop: Fixup tag handling · 576e0cda
      Hannes Reinecke authored
      commit 6375f890 upstream.
      
      The SCSI command tag is set to the tag assigned from the block
      layer, not the SCSI-II tag message. So we need to convert
      it into the correct SCSI-II tag message based on the
      device flags, not the tag value itself.
      Signed-off-by: default avatarHannes Reinecke <hare@suse.de>
      Reviewed-by: default avatarSagi Grimberg <sagig@mellanox.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      [ luis: backported to 3.16:
        - adjusted context, as commit 506787a2 ("tcm_loop: Fix wrong I_T
          nexus association") had already been applied to 3.16 ]
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      576e0cda
    • Tomeu Vizoso's avatar
      clk: Don't try to use a struct clk* after it could have been freed · cf211faf
      Tomeu Vizoso authored
      commit 10cdfe54 upstream.
      
      As __clk_release could call kfree on clk and then we wouldn't have a safe way
      of getting the module that owns the clock.
      Signed-off-by: default avatarTomeu Vizoso <tomeu.vizoso@collabora.com>
      Fixes: fcb0ee6a ("clk: Implement clk_unregister")
      Reviewed-by: default avatarStephen Boyd <sboyd@codeaurora.org>
      Signed-off-by: default avatarMichael Turquette <mturquette@linaro.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      cf211faf
    • Tyler Baker's avatar
      reset: sunxi: fix spinlock initialization · e3c75d41
      Tyler Baker authored
      commit 41544f9f upstream.
      
      Call spin_lock_init() before the spinlocks are used, both in early init
      and probe functions preventing a lockdep splat.
      
      I have been observing lockdep complaining [1] during boot on my a80 optimus [2]
      when CONFIG_PROVE_LOCKING has been enabled. This patch resolves the splat,
      and has been tested on a few other sunxi platforms without issue.
      
      [1] http://storage.kernelci.org/next/next-20150107/arm-multi_v7_defconfig+CONFIG_PROVE_LOCKING=y/lab-tbaker/boot-sun9i-a80-optimus.html
      [2] http://kernelci.org/boot/?a80-optimusSigned-off-by: default avatarTyler Baker <tyler.baker@linaro.org>
      Acked-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Signed-off-by: default avatarKevin Hilman <khilman@linaro.org>
      Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      e3c75d41
    • Steven Rostedt (Red Hat)'s avatar
      ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing · 7e232c4a
      Steven Rostedt (Red Hat) authored
      commit 237d28db upstream.
      
      If the function graph tracer traces a jprobe callback, the system will
      crash. This can easily be demonstrated by compiling the jprobe
      sample module that is in the kernel tree, loading it and running the
      function graph tracer.
      
       # modprobe jprobe_example.ko
       # echo function_graph > /sys/kernel/debug/tracing/current_tracer
       # ls
      
      The first two commands end up in a nice crash after the first fork.
      (do_fork has a jprobe attached to it, so "ls" just triggers that fork)
      
      The problem is caused by the jprobe_return() that all jprobe callbacks
      must end with. The way jprobes works is that the function a jprobe
      is attached to has a breakpoint placed at the start of it (or it uses
      ftrace if fentry is supported). The breakpoint handler (or ftrace callback)
      will copy the stack frame and change the ip address to return to the
      jprobe handler instead of the function. The jprobe handler must end
      with jprobe_return() which swaps the stack and does an int3 (breakpoint).
      This breakpoint handler will then put back the saved stack frame,
      simulate the instruction at the beginning of the function it added
      a breakpoint to, and then continue on.
      
      For function tracing to work, it hijakes the return address from the
      stack frame, and replaces it with a hook function that will trace
      the end of the call. This hook function will restore the return
      address of the function call.
      
      If the function tracer traces the jprobe handler, the hook function
      for that handler will not be called, and its saved return address
      will be used for the next function. This will result in a kernel crash.
      
      To solve this, pause function tracing before the jprobe handler is called
      and unpause it before it returns back to the function it probed.
      
      Some other updates:
      
      Used a variable "saved_sp" to hold kcb->jprobe_saved_sp. This makes the
      code look a bit cleaner and easier to understand (various tries to fix
      this bug required this change).
      
      Note, if fentry is being used, jprobes will change the ip address before
      the function graph tracer runs and it will not be able to trace the
      function that the jprobe is probing.
      
      Link: http://lkml.kernel.org/r/20150114154329.552437962@goodmis.orgAcked-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      7e232c4a
    • Amit Virdi's avatar
      usb: dwc3: gadget: Stop TRB preparation after limit is reached · 60f796c4
      Amit Virdi authored
      commit 39e60635 upstream.
      
      DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This
      means, the max TRBs that can be submitted for an EP is fixed to 32. Since the
      request queue for an EP is a linked list, any number of requests can be queued
      to it by the gadget layer.  However, the dwc3 driver must not submit TRBs more
      than the pool it has created for. This limit wasn't respected when SG was used
      resulting in submitting more than the max TRBs, eventually leading to
      non-transfer of the TRBs submitted over the max limit.
      
      Root cause:
      When SG is used, there are two loops iterating to prepare TRBs:
       - Outer loop over the request_list
       - Inner loop over the SG list
      The code was missing break to get out of the outer loop.
      
      Fixes: eeb720fb (usb: dwc3: gadget: add support for SG lists)
      Signed-off-by: default avatarAmit Virdi <amit.virdi@st.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      60f796c4
    • Amit Virdi's avatar
      usb: dwc3: gadget: Fix TRB preparation during SG · 2dc3856e
      Amit Virdi authored
      commit ec512fb8 upstream.
      
      When scatter gather (SG) is used, multiple TRBs are prepared from one DWC3
      request (dwc3_request). So while preparing TRBs, the 'last' flag should be set
      only when it is the last TRB being prepared from the last dwc3_request entry.
      
      The current implementation uses list_is_last to check if the dwc3_request is the
      last entry from the request_list. However, list_is_last returns false for the
      last entry too. This is because, while preparing the first TRB from a request,
      the function dwc3_prepare_one_trb modifies the request's next and prev pointers
      while moving the URB to req_queued. Hence, list_is_last always returns false no
      matter what.
      
      The correct way is not to access the modified pointers of dwc3_request but to
      use list_empty macro instead.
      
      Fixes: e5ba5ec8 (usb: dwc3: gadget: fix scatter gather implementation)
      Signed-off-by: default avatarAmit Virdi <amit.virdi@st.com>
      Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      2dc3856e
    • Mugunthan V N's avatar
      drivers: net: cpsw: fix multicast flush in dual emac mode · 34a3fe93
      Mugunthan V N authored
      commit 25906052 upstream.
      
      Since ALE table is a common resource for both the interfaces in Dual EMAC
      mode and while bringing up the second interface in cpsw_ndo_set_rx_mode()
      all the multicast entries added by the first interface is flushed out and
      only second interface multicast addresses are added. Fixing this by
      flushing multicast addresses based on dual EMAC port vlans which will not
      affect the other emac port multicast addresses.
      
      Fixes: d9ba8f9e (driver: net: ethernet: cpsw: dual emac interface implementation)
      Signed-off-by: default avatarMugunthan V N <mugunthanvnm@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      34a3fe93
    • Jisheng Zhang's avatar
      clk: berlin: bg2q: remove non-exist "smemc" gate clock · d8488915
      Jisheng Zhang authored
      commit b71e8ecd upstream.
      
      The "smemc" clock is removed on BG2Q SoCs. In fact, bit19 of clkenable
      register is for nfc. Current code use bit19 for non-exist "smemc"
      incorrectly, this prevents eMMC from working due to the sdhci's
      "core" clk is still gated.
      Signed-off-by: default avatarJisheng Zhang <jszhang@marvell.com>
      Signed-off-by: default avatarMichael Turquette <mturquette@linaro.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      d8488915
    • Boris Brezillon's avatar
      clk: at91: keep slow clk enabled to prevent system hang · eb601e47
      Boris Brezillon authored
      commit dca1a4b5 upstream.
      
      All slow clk users are not properly claiming it (get + prepare + enable)
      before using it.
      If all users properly claiming this clock release it, the clock is
      disabled, but faulty users still depends on it, and the system hangs.
      
      This fix prevents the slow clock from being disabled, and should solve the
      hanging issue, but offending drivers should be patched to properly claim
      this clock.
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
      Reported-by: default avatarBo Shen <voice.shen@atmel.com>
      Signed-off-by: default avatarMichael Turquette <mturquette@linaro.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      eb601e47
    • Krzysztof Kozlowski's avatar
      mmc: sdhci: Fix sleep in atomic after inserting SD card · 462dd2f9
      Krzysztof Kozlowski authored
      commit 2836766a upstream.
      
      Sleep in atomic context happened on Trats2 board after inserting or
      removing SD card because mmc_gpio_get_cd() was called under spin lock.
      
      Fix this by moving card detection earlier, before acquiring spin lock.
      The mmc_gpio_get_cd() call does not have to be protected by spin lock
      because it does not access any sdhci internal data.
      The sdhci_do_get_cd() call access host flags (SDHCI_DEVICE_DEAD). After
      moving it out side of spin lock it could theoretically race with driver
      removal but still there is no actual protection against manual card
      eject.
      
      Dmesg after inserting SD card:
      [   41.663414] BUG: sleeping function called from invalid context at drivers/gpio/gpiolib.c:1511
      [   41.670469] in_atomic(): 1, irqs_disabled(): 128, pid: 30, name: kworker/u8:1
      [   41.677580] INFO: lockdep is turned off.
      [   41.681486] irq event stamp: 61972
      [   41.684872] hardirqs last  enabled at (61971): [<c0490ee0>] _raw_spin_unlock_irq+0x24/0x5c
      [   41.693118] hardirqs last disabled at (61972): [<c04907ac>] _raw_spin_lock_irq+0x18/0x54
      [   41.701190] softirqs last  enabled at (61648): [<c0026fd4>] __do_softirq+0x234/0x2c8
      [   41.708914] softirqs last disabled at (61631): [<c00273a0>] irq_exit+0xd0/0x114
      [   41.716206] Preemption disabled at:[<  (null)>]   (null)
      [   41.721500]
      [   41.722985] CPU: 3 PID: 30 Comm: kworker/u8:1 Tainted: G        W      3.18.0-rc5-next-20141121 #883
      [   41.732111] Workqueue: kmmcd mmc_rescan
      [   41.735945] [<c0014d2c>] (unwind_backtrace) from [<c0011c80>] (show_stack+0x10/0x14)
      [   41.743661] [<c0011c80>] (show_stack) from [<c0489d14>] (dump_stack+0x70/0xbc)
      [   41.750867] [<c0489d14>] (dump_stack) from [<c0228b74>] (gpiod_get_raw_value_cansleep+0x18/0x30)
      [   41.759628] [<c0228b74>] (gpiod_get_raw_value_cansleep) from [<c03646e8>] (mmc_gpio_get_cd+0x38/0x58)
      [   41.768821] [<c03646e8>] (mmc_gpio_get_cd) from [<c036d378>] (sdhci_request+0x50/0x1a4)
      [   41.776808] [<c036d378>] (sdhci_request) from [<c0357934>] (mmc_start_request+0x138/0x268)
      [   41.785051] [<c0357934>] (mmc_start_request) from [<c0357cc8>] (mmc_wait_for_req+0x58/0x1a0)
      [   41.793469] [<c0357cc8>] (mmc_wait_for_req) from [<c0357e68>] (mmc_wait_for_cmd+0x58/0x78)
      [   41.801714] [<c0357e68>] (mmc_wait_for_cmd) from [<c0361c00>] (mmc_io_rw_direct_host+0x98/0x124)
      [   41.810480] [<c0361c00>] (mmc_io_rw_direct_host) from [<c03620f8>] (sdio_reset+0x2c/0x64)
      [   41.818641] [<c03620f8>] (sdio_reset) from [<c035a3d8>] (mmc_rescan+0x254/0x2e4)
      [   41.826028] [<c035a3d8>] (mmc_rescan) from [<c003a0e0>] (process_one_work+0x180/0x3f4)
      [   41.833920] [<c003a0e0>] (process_one_work) from [<c003a3bc>] (worker_thread+0x34/0x4b0)
      [   41.841991] [<c003a3bc>] (worker_thread) from [<c003fed8>] (kthread+0xe4/0x104)
      [   41.849285] [<c003fed8>] (kthread) from [<c000f268>] (ret_from_fork+0x14/0x2c)
      [   42.038276] mmc0: new high speed SDHC card at address 1234
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Fixes: 94144a46 ("mmc: sdhci: add get_cd() implementation")
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      462dd2f9
    • Thomas Petazzoni's avatar
      mmc: sdhci-pxav3: do the mbus window configuration after enabling clocks · d521c37b
      Thomas Petazzoni authored
      commit aa8165f9 upstream.
      
      In commit 5491ce3f ("mmc: sdhci-pxav3: add support for the Armada
      38x SDHCI controller"), the sdhci-pxav3 driver was extended to include
      support for the SDHCI controller found in the Armada 38x
      processor. This mainly involved adding some MBus window related
      configuration.
      
      However, this configuration is currently done too early in ->probe():
      it is done before clocks are enabled, while this configuration
      involves touching the registers of the controller, which will hang the
      SoC if the clock is disabled. It wasn't noticed until now because the
      bootloader typically leaves gatable clocks enabled, but in situations
      where we have a deferred probe (due to a CD GPIO that cannot be taken,
      for example), then the probe will be re-tried later, after a clock
      disable has been done in the exit path of the failed probe attempt of
      the device. This second probe() will hang the system due to the clock
      being disabled.
      
      This can for example be produced on Armada 385 GP, which has a CD GPIO
      connected to an I2C PCA9555. If the driver for the PCA9555 is not
      compiled into the kernel, then we will have the following sequence of
      events:
      
        1. The SDHCI probes
        2. It does the MBus configuration (which works, because the clock is
           left enabled by the bootloader)
        3. It enables the clock
        4. It tries to get the CD GPIO, which fails due to the driver being
           missing, so -EPROBE_DEFER is returned.
        5. Before returning -EPROBE_DEFER, the driver cleans up what was
           done, which includes disabling the clock.
        6. Later on, the SDHCI probe is tried again.
        7. It does the MBus configuration, which hangs because the clock is
           no longer enabled.
      
      This commit does the obvious fix of doing the MBus configuration after
      the clock has been enabled by the driver.
      
      Fixes: 5491ce3f ("mmc: sdhci-pxav3: add support for the Armada 38x SDHCI controller")
      Signed-off-by: default avatarThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      [ luis: backported to 3.16: adjusted context ]
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      d521c37b
    • Xiang Wang's avatar
      mmc: sdhci-pxav3: fix error handling of sdhci_add_host · 4af1ded4
      Xiang Wang authored
      commit 87d2163d upstream.
      
      Commit 0dcaa249 improved error
      handling of sdhci_add_host. However, "err_of_parse" and "err_cd_req"
      should be placed after "pm_runtime_disable(&pdev->dev)".
      Signed-off-by: default avatarXiang Wang <wangx@marvell.com>
      Acked-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      [ luis: 3.16-stable prereq for:
        aa8165f9 "mmc: sdhci-pxav3: do the mbus window configuration after enabling clocks" ]
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      4af1ded4
    • Johan Hovold's avatar
      USB: console: fix potential use after free · 2b78e4b7
      Johan Hovold authored
      commit 32a4bf2e upstream.
      
      Use tty kref to release the fake tty in usb_console_setup to avoid use
      after free if the underlying serial driver has acquired a reference.
      
      Note that using the tty destructor release_one_tty requires some more
      state to be initialised.
      
      Fixes: 4a90f09b ("tty: usb-serial krefs")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      2b78e4b7
    • Johan Hovold's avatar
      USB: console: fix uninitialised ldisc semaphore · 6b03e26e
      Johan Hovold authored
      commit d269d443 upstream.
      
      The USB console currently allocates a temporary fake tty which is used
      to pass terminal settings to the underlying serial driver.
      
      The tty struct is not fully initialised, something which can lead to a
      lockdep warning (or worse) if a serial driver tries to acquire a
      line-discipline reference:
      
      	usbserial: USB Serial support registered for pl2303
      	pl2303 1-2.1:1.0: pl2303 converter detected
      	usb 1-2.1: pl2303 converter now attached to ttyUSB0
      	INFO: trying to register non-static key.
      	the code is fine but needs lockdep annotation.
      	turning off the locking correctness validator.
      	CPU: 0 PID: 68 Comm: udevd Tainted: G        W      3.18.0-rc5 #10
      	[<c0016f04>] (unwind_backtrace) from [<c0013978>] (show_stack+0x20/0x24)
      	[<c0013978>] (show_stack) from [<c0449794>] (dump_stack+0x24/0x28)
      	[<c0449794>] (dump_stack) from [<c006f730>] (__lock_acquire+0x1e50/0x2004)
      	[<c006f730>] (__lock_acquire) from [<c0070128>] (lock_acquire+0xe4/0x18c)
      	[<c0070128>] (lock_acquire) from [<c027c6f8>] (ldsem_down_read_trylock+0x78/0x90)
      	[<c027c6f8>] (ldsem_down_read_trylock) from [<c027a1cc>] (tty_ldisc_ref+0x24/0x58)
      	[<c027a1cc>] (tty_ldisc_ref) from [<c0340760>] (usb_serial_handle_dcd_change+0x48/0xe8)
      	[<c0340760>] (usb_serial_handle_dcd_change) from [<bf000484>] (pl2303_read_int_callback+0x210/0x220 [pl2303])
      	[<bf000484>] (pl2303_read_int_callback [pl2303]) from [<c031624c>] (__usb_hcd_giveback_urb+0x80/0x140)
      	[<c031624c>] (__usb_hcd_giveback_urb) from [<c0316fc0>] (usb_giveback_urb_bh+0x98/0xd4)
      	[<c0316fc0>] (usb_giveback_urb_bh) from [<c0042e44>] (tasklet_hi_action+0x9c/0x108)
      	[<c0042e44>] (tasklet_hi_action) from [<c0042380>] (__do_softirq+0x148/0x42c)
      	[<c0042380>] (__do_softirq) from [<c00429cc>] (irq_exit+0xd8/0x114)
      	[<c00429cc>] (irq_exit) from [<c007ae58>] (__handle_domain_irq+0x84/0xdc)
      	[<c007ae58>] (__handle_domain_irq) from [<c000879c>] (omap_intc_handle_irq+0xd8/0xe0)
      	[<c000879c>] (omap_intc_handle_irq) from [<c0014544>] (__irq_svc+0x44/0x7c)
      	Exception stack(0xdf4e7f08 to 0xdf4e7f50)
      	7f00:                   debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c
      	7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50
      	7f40: c038ebc0 c038d74c 600f0013 ffffffff
      	[<c0014544>] (__irq_svc) from [<c038d74c>] (___sys_sendmsg.part.29+0x0/0x2e0)
      	[<c038d74c>] (___sys_sendmsg.part.29) from [<c038ec08>] (SyS_sendmsg+0x18/0x1c)
      	[<c038ec08>] (SyS_sendmsg) from [<c000fa00>] (ret_fast_syscall+0x0/0x48)
      	console [ttyUSB0] enabled
      
      Fixes: 36697529 ("tty: Replace ldisc locking with ldisc_sem")
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      6b03e26e
    • Songjun Wu's avatar
      usb: gadget: udc: atmel: fix possible oops when unloading module · 9d4a675d
      Songjun Wu authored
      commit 5fb694f9 upstream.
      
      When unloading the module 'g_hid.ko', the urb request will be dequeued and the
      completion routine will be excuted. If there is no urb packet, the urb request
      will not be added to the endpoint queue and the completion routine pointer in
      urb request is NULL.
      
      Accessing to this NULL function pointer will cause the Oops issue reported
      below.
      
      Add the code to check if the urb request is in the endpoint queue
      or not. If the urb request is not in the endpoint queue, a negative
      error code will be returned.
      
      Here is the Oops log:
      
      Unable to handle kernel NULL pointer dereference at virtual address 00000000
      pgd = dedf0000
      [00000000] *pgd=3ede5831, *pte=00000000, *ppte=00000000
      Internal error: Oops: 80000007 [#1] ARM
      Modules linked in: g_hid(-) usb_f_hid libcomposite
      CPU: 0 PID: 923 Comm: rmmod Not tainted 3.18.0+ #2
      Hardware name: Atmel SAMA5 (Device Tree)
      task: df6b1100 ti: dedf6000 task.ti: dedf6000
      PC is at 0x0
      LR is at usb_gadget_giveback_request+0xc/0x10
      pc : [<00000000>]    lr : [<c02ace88>]    psr: 60000093
      sp : dedf7eb0  ip : df572634  fp : 00000000
      r10: 00000000  r9 : df52e210  r8 : 60000013
      r7 : df6a9858  r6 : df52e210  r5 : df6a9858  r4 : df572600
      r3 : 00000000  r2 : ffffff98  r1 : df572600  r0 : df6a9868
      Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
      Control: 10c53c7d  Table: 3edf0059  DAC: 00000015
      Process rmmod (pid: 923, stack limit = 0xdedf6230)
      Stack: (0xdedf7eb0 to 0xdedf8000)
      7ea0:                                     00000000 c02adbbc df572580 deced608
      7ec0: df572600 df6a9868 df572634 c02aed3c df577c00 c01b8608 00000000 df6be27c
      7ee0: 00200200 00100100 bf0162f4 c000e544 dedf6000 00000000 00000000 bf010c00
      7f00: bf0162cc bf00159c 00000000 df572980 df52e218 00000001 df5729b8 bf0031d0
      [..]
      [<c02ace88>] (usb_gadget_giveback_request) from [<c02adbbc>] (request_complete+0x64/0x88)
      [<c02adbbc>] (request_complete) from [<c02aed3c>] (usba_ep_dequeue+0x70/0x128)
      [<c02aed3c>] (usba_ep_dequeue) from [<bf010c00>] (hidg_unbind+0x50/0x7c [usb_f_hid])
      [<bf010c00>] (hidg_unbind [usb_f_hid]) from [<bf00159c>] (remove_config.isra.6+0x98/0x9c [libcomposite])
      [<bf00159c>] (remove_config.isra.6 [libcomposite]) from [<bf0031d0>] (__composite_unbind+0x34/0x98 [libcomposite])
      [<bf0031d0>] (__composite_unbind [libcomposite]) from [<c02acee0>] (usb_gadget_remove_driver+0x50/0x78)
      [<c02acee0>] (usb_gadget_remove_driver) from [<c02ad570>] (usb_gadget_unregister_driver+0x64/0x94)
      [<c02ad570>] (usb_gadget_unregister_driver) from [<bf0160c0>] (hidg_cleanup+0x10/0x34 [g_hid])
      [<bf0160c0>] (hidg_cleanup [g_hid]) from [<c0056748>] (SyS_delete_module+0x118/0x19c)
      [<c0056748>] (SyS_delete_module) from [<c000e3c0>] (ret_fast_syscall+0x0/0x30)
      Code: bad PC value
      Signed-off-by: default avatarSongjun Wu <songjun.wu@atmel.com>
      [nicolas.ferre@atmel.com: reworked the commit message]
      Signed-off-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Fixes: 914a3f3b ("USB: add atmel_usba_udc driver")
      Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
      [ luis: backported to 3.16:
        - file rename: drivers/usb/gadget/udc/atmel_usba_udc.c ->
          drivers/usb/gadget/atmel_usba_udc.c ]
      Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
      9d4a675d