--- /dev/null
+From aeb4b88ec0a948efce8e3a23a8f964d3560a7308 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Nov 2011 12:28:38 +0100
+Subject: ALSA: hda - Don't add elements of other codecs to vmaster slave
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit aeb4b88ec0a948efce8e3a23a8f964d3560a7308 upstream.
+
+When a virtual mater control is created, the driver looks for slave
+elements from the assigned card instance. But this may include the
+elements of other codecs when multiple codecs are on the same HD-audio
+bus. This works at the first time, but it'll give Oops when it's once
+freed and re-created via reconfig sysfs.
+
+This patch changes the element-look-up strategy to limit only to the
+mixer elements of the same codec.
+
+Reported-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_codec.c | 60 +++++++++++++++++++++++++++++-----------------
+ 1 file changed, 39 insertions(+), 21 deletions(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2187,6 +2187,39 @@ int snd_hda_codec_reset(struct hda_codec
+ return 0;
+ }
+
++typedef int (*map_slave_func_t)(void *, struct snd_kcontrol *);
++
++/* apply the function to all matching slave ctls in the mixer list */
++static int map_slaves(struct hda_codec *codec, const char * const *slaves,
++ map_slave_func_t func, void *data)
++{
++ struct hda_nid_item *items;
++ const char * const *s;
++ int i, err;
++
++ items = codec->mixers.list;
++ for (i = 0; i < codec->mixers.used; i++) {
++ struct snd_kcontrol *sctl = items[i].kctl;
++ if (!sctl || !sctl->id.name ||
++ sctl->id.iface != SNDRV_CTL_ELEM_IFACE_MIXER)
++ continue;
++ for (s = slaves; *s; s++) {
++ if (!strcmp(sctl->id.name, *s)) {
++ err = func(data, sctl);
++ if (err)
++ return err;
++ break;
++ }
++ }
++ }
++ return 0;
++}
++
++static int check_slave_present(void *data, struct snd_kcontrol *sctl)
++{
++ return 1;
++}
++
+ /**
+ * snd_hda_add_vmaster - create a virtual master control and add slaves
+ * @codec: HD-audio codec
+@@ -2207,12 +2240,10 @@ int snd_hda_add_vmaster(struct hda_codec
+ unsigned int *tlv, const char * const *slaves)
+ {
+ struct snd_kcontrol *kctl;
+- const char * const *s;
+ int err;
+
+- for (s = slaves; *s && !snd_hda_find_mixer_ctl(codec, *s); s++)
+- ;
+- if (!*s) {
++ err = map_slaves(codec, slaves, check_slave_present, NULL);
++ if (err != 1) {
+ snd_printdd("No slave found for %s\n", name);
+ return 0;
+ }
+@@ -2223,23 +2254,10 @@ int snd_hda_add_vmaster(struct hda_codec
+ if (err < 0)
+ return err;
+
+- for (s = slaves; *s; s++) {
+- struct snd_kcontrol *sctl;
+- int i = 0;
+- for (;;) {
+- sctl = _snd_hda_find_mixer_ctl(codec, *s, i);
+- if (!sctl) {
+- if (!i)
+- snd_printdd("Cannot find slave %s, "
+- "skipped\n", *s);
+- break;
+- }
+- err = snd_ctl_add_slave(kctl, sctl);
+- if (err < 0)
+- return err;
+- i++;
+- }
+- }
++ err = map_slaves(codec, slaves, (map_slave_func_t)snd_ctl_add_slave,
++ kctl);
++ if (err < 0)
++ return err;
+ return 0;
+ }
+ EXPORT_SYMBOL_HDA(snd_hda_add_vmaster);
--- /dev/null
+From 8eeea521d9d0fa6afd62df8c6e6566ee946117fa Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 4 Nov 2011 15:52:31 +0000
+Subject: ASoC: Don't use wm8994->control_data in wm8994_readable_register()
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 8eeea521d9d0fa6afd62df8c6e6566ee946117fa upstream.
+
+The field is no longer initialised so this will crash if running on
+wm8958.
+
+Reported-by: Thomas Abraham <thomas.abraham@linaro.org>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -56,7 +56,7 @@ static int wm8994_retune_mobile_base[] =
+ static int wm8994_readable(struct snd_soc_codec *codec, unsigned int reg)
+ {
+ struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+- struct wm8994 *control = wm8994->control_data;
++ struct wm8994 *control = codec->control_data;
+
+ switch (reg) {
+ case WM8994_GPIO_1:
--- /dev/null
+From 14660ccd599dc7bd6ecef17408bd76dc853f9b77 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Mon, 31 Oct 2011 23:16:21 -0700
+Subject: drm/i915: Fix object refcount leak on mmappable size limit error path.
+
+From: Eric Anholt <eric@anholt.net>
+
+commit 14660ccd599dc7bd6ecef17408bd76dc853f9b77 upstream.
+
+I've been seeing memory leaks on my system in the form of large
+(300-400MB) GEM objects created by now-dead processes laying around
+clogging up memory. I usually notice when it gets to about 1.2GB of
+them. Hopefully this clears up the issue, but I just found this bug
+by inspection.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1475,7 +1475,7 @@ i915_gem_mmap_gtt(struct drm_file *file,
+
+ if (obj->base.size > dev_priv->mm.gtt_mappable_end) {
+ ret = -E2BIG;
+- goto unlock;
++ goto out;
+ }
+
+ if (obj->madv != I915_MADV_WILLNEED) {
--- /dev/null
+From 5e60ee780e792efe6dce97eceb110b1d30bab850 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Fri, 9 Sep 2011 14:16:42 +0200
+Subject: drm/nouveau: initialize chan->fence.lock before use
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 5e60ee780e792efe6dce97eceb110b1d30bab850 upstream.
+
+Fence lock needs to be initialized before any call to nouveau_channel_put
+because it calls nouveau_channel_idle->nouveau_fence_update which uses
+fence lock.
+
+BUG: spinlock bad magic on CPU#0, test/24134
+ lock: ffff88019f90dba8, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
+Pid: 24134, comm: test Not tainted 3.0.0-nv+ #800
+Call Trace:
+ spin_bug+0x9c/0xa3
+ do_raw_spin_lock+0x29/0x13c
+ _raw_spin_lock+0x1e/0x22
+ nouveau_fence_update+0x2d/0xf1
+ nouveau_channel_idle+0x22/0xa0
+ nouveau_channel_put_unlocked+0x84/0x1bd
+ nouveau_channel_put+0x20/0x24
+ nouveau_channel_alloc+0x4ec/0x585
+ nouveau_ioctl_fifo_alloc+0x50/0x130
+ drm_ioctl+0x289/0x361
+ do_vfs_ioctl+0x4dd/0x52c
+ sys_ioctl+0x42/0x65
+ system_call_fastpath+0x16/0x1b
+
+It's easily triggerable from userspace.
+
+Additionally remove double initialization of chan->fence.pending.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_channel.c | 1 +
+ drivers/gpu/drm/nouveau/nouveau_fence.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_channel.c
++++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
+@@ -159,6 +159,7 @@ nouveau_channel_alloc(struct drm_device
+ INIT_LIST_HEAD(&chan->nvsw.vbl_wait);
+ INIT_LIST_HEAD(&chan->nvsw.flip);
+ INIT_LIST_HEAD(&chan->fence.pending);
++ spin_lock_init(&chan->fence.lock);
+
+ /* Allocate DMA push buffer */
+ chan->pushbuf_bo = nouveau_channel_user_pushbuf_alloc(dev);
+--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
+@@ -542,8 +542,6 @@ nouveau_fence_channel_init(struct nouvea
+ return ret;
+ }
+
+- INIT_LIST_HEAD(&chan->fence.pending);
+- spin_lock_init(&chan->fence.lock);
+ atomic_set(&chan->fence.last_sequence_irq, 0);
+ return 0;
+ }
--- /dev/null
+From 091264f0bc12419560ac64fcef4567809d611658 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 8 Nov 2011 10:09:58 -0500
+Subject: drm/radeon/kms: make an aux failure debug only
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 091264f0bc12419560ac64fcef4567809d611658 upstream.
+
+Can happen when there is no DP panel attached, confusing
+users. Make it debug only.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -283,7 +283,7 @@ int radeon_dp_i2c_aux_ch(struct i2c_adap
+ }
+ }
+
+- DRM_ERROR("aux i2c too many retries, giving up\n");
++ DRM_DEBUG_KMS("aux i2c too many retries, giving up\n");
+ return -EREMOTEIO;
+ }
+
--- /dev/null
+alsa-hda-don-t-add-elements-of-other-codecs-to-vmaster-slave.patch
+virtio-pci-fix-use-after-free.patch
+asoc-don-t-use-wm8994-control_data-in-wm8994_readable_register.patch
+sh-fix-cached-uncaced-address-calculation-in-29bit-mode.patch
+drm-i915-fix-object-refcount-leak-on-mmappable-size-limit-error-path.patch
+drm-nouveau-initialize-chan-fence.lock-before-use.patch
+drm-radeon-kms-make-an-aux-failure-debug-only.patch
--- /dev/null
+From dfd3b596fbbfa48b8e7966ef996d587157554b69 Mon Sep 17 00:00:00 2001
+From: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+Date: Fri, 4 Nov 2011 22:13:50 +0900
+Subject: sh: Fix cached/uncaced address calculation in 29bit mode
+
+From: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+
+commit dfd3b596fbbfa48b8e7966ef996d587157554b69 upstream.
+
+In the case of 29bit mode, CAC/UNCAC_ADDR does not return a right address.
+This revises this problem by using P1SEGADDR and P2SEGADDR in 29bit mode.
+
+Reported-by: Yutaro Ebihara <ebiharaml@si-linux.co.jp>
+Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+Tested-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/include/asm/page.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/sh/include/asm/page.h
++++ b/arch/sh/include/asm/page.h
+@@ -141,8 +141,13 @@ typedef struct page *pgtable_t;
+ #endif /* !__ASSEMBLY__ */
+
+ #ifdef CONFIG_UNCACHED_MAPPING
++#if defined(CONFIG_29BIT)
++#define UNCAC_ADDR(addr) P2SEGADDR(addr)
++#define CAC_ADDR(addr) P1SEGADDR(addr)
++#else
+ #define UNCAC_ADDR(addr) ((addr) - PAGE_OFFSET + uncached_start)
+ #define CAC_ADDR(addr) ((addr) - uncached_start + PAGE_OFFSET)
++#endif
+ #else
+ #define UNCAC_ADDR(addr) ((addr))
+ #define CAC_ADDR(addr) ((addr))
--- /dev/null
+From 72103bd1285211440621f2c46f4fce377584de54 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Mon, 7 Nov 2011 18:37:05 +0200
+Subject: virtio-pci: fix use after free
+
+From: "Michael S. Tsirkin" <mst@redhat.com>
+
+commit 72103bd1285211440621f2c46f4fce377584de54 upstream.
+
+Commit 31a3ddda166cda86d2b5111e09ba4bda5239fae6 introduced
+a use after free in virtio-pci. The main issue is
+that the release method signals removal of the virtio device,
+while remove signals removal of the pci device.
+
+For example, on driver removal or hot-unplug,
+virtio_pci_release_dev is called before virtio_pci_remove.
+We then might get a crash as virtio_pci_remove tries to use the
+device freed by virtio_pci_release_dev.
+
+We allocate/free all resources together with the
+pci device, so we can leave the release method empty.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_pci.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -590,11 +590,11 @@ static struct virtio_config_ops virtio_p
+
+ static void virtio_pci_release_dev(struct device *_d)
+ {
+- struct virtio_device *dev = container_of(_d, struct virtio_device,
+- dev);
+- struct virtio_pci_device *vp_dev = to_vp_device(dev);
+-
+- kfree(vp_dev);
++ /*
++ * No need for a release method as we allocate/free
++ * all devices together with the pci devices.
++ * Provide an empty one to avoid getting a warning from core.
++ */
+ }
+
+ /* the PCI probing function */
+@@ -682,6 +682,7 @@ static void __devexit virtio_pci_remove(
+ pci_iounmap(pci_dev, vp_dev->ioaddr);
+ pci_release_regions(pci_dev);
+ pci_disable_device(pci_dev);
++ kfree(vp_dev);
+ }
+
+ #ifdef CONFIG_PM
projects / thirdparty / kernel / stable-queue.git / commitdiff
