--- /dev/null
+From c507de88f6a336bd7296c9ec0073b2d4af8b4f5e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 5 Jan 2015 13:27:33 +0100
+Subject: ALSA: hda - Fix wrong gpio_dir & gpio_mask hint setups for IDT/STAC codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c507de88f6a336bd7296c9ec0073b2d4af8b4f5e upstream.
+
+stac_store_hints() does utterly wrong for masking the values for
+gpio_dir and gpio_data, likely due to copy&paste errors. Fortunately,
+this feature is used very rarely, so the impact must be really small.
+
+Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -593,9 +593,9 @@ static void stac_store_hints(struct hda_
+ spec->gpio_mask;
+ }
+ if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
+- spec->gpio_mask &= spec->gpio_mask;
+- if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
+ spec->gpio_dir &= spec->gpio_mask;
++ if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
++ spec->gpio_data &= spec->gpio_mask;
+ if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
+ spec->eapd_mask &= spec->gpio_mask;
+ if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
--- /dev/null
+From 69eba10e606a80665f8573221fec589430d9d1cb Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 27 Nov 2014 01:34:43 +0300
+Subject: ALSA: hda - using uninitialized data
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 69eba10e606a80665f8573221fec589430d9d1cb upstream.
+
+In olden times the snd_hda_param_read() function always set "*start_id"
+but in 2007 we introduced a new return and it causes uninitialized data
+bugs in a couple of the callers: print_codec_info() and
+hdmi_parse_codec().
+
+Fixes: e8a7f136f5ed ('[ALSA] hda-intel - Improve HD-audio codec probing robustness')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_codec.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -338,8 +338,10 @@ int snd_hda_get_sub_nodes(struct hda_cod
+ unsigned int parm;
+
+ parm = snd_hda_param_read(codec, nid, AC_PAR_NODE_COUNT);
+- if (parm == -1)
++ if (parm == -1) {
++ *start_id = 0;
+ return 0;
++ }
+ *start_id = (parm >> 16) & 0x7fff;
+ return (int)(parm & 0x7fff);
+ }
--- /dev/null
+From d70a1b9893f820fdbcdffac408c909c50f2e6b43 Mon Sep 17 00:00:00 2001
+From: Jiri Jaburek <jjaburek@redhat.com>
+Date: Thu, 18 Dec 2014 02:03:19 +0100
+Subject: ALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam rPAC
+
+From: Jiri Jaburek <jjaburek@redhat.com>
+
+commit d70a1b9893f820fdbcdffac408c909c50f2e6b43 upstream.
+
+The Arcam rPAC seems to have the same problem - whenever anything
+(alsamixer, udevd, 3.9+ kernel from 60af3d037eb8c, ..) attempts to
+access mixer / control interface of the card, the firmware "locks up"
+the entire device, resulting in
+ SNDRV_PCM_IOCTL_HW_PARAMS failed (-5): Input/output error
+from alsa-lib.
+
+Other operating systems can somehow read the mixer (there seems to be
+playback volume/mute), but any manipulation is ignored by the device
+(which has hardware volume controls).
+
+Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer_maps.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -328,8 +328,11 @@ static struct usbmix_name_map gamecom780
+ {}
+ };
+
+-static const struct usbmix_name_map kef_x300a_map[] = {
+- { 10, NULL }, /* firmware locks up (?) when we try to access this FU */
++/* some (all?) SCMS USB3318 devices are affected by a firmware lock up
++ * when anything attempts to access FU 10 (control)
++ */
++static const struct usbmix_name_map scms_usb3318_map[] = {
++ { 10, NULL },
+ { 0 }
+ };
+
+@@ -425,8 +428,14 @@ static struct usbmix_ctl_map usbmix_ctl_
+ .map = ebox44_map,
+ },
+ {
++ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+- .map = kef_x300a_map,
++ .map = scms_usb3318_map,
++ },
++ {
++ /* Arcam rPAC */
++ .id = USB_ID(0x25c4, 0x0003),
++ .map = scms_usb3318_map,
+ },
+ { 0 } /* terminator */
+ };
--- /dev/null
+From bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 31 Oct 2014 11:13:07 -0600
+Subject: driver core: Fix unbalanced device reference in drivers_probe
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 upstream.
+
+bus_find_device_by_name() acquires a device reference which is never
+released. This results in an object leak, which on older kernels
+results in failure to release all resources of PCI devices. libvirt
+uses drivers_probe to re-attach devices to the host after assignment
+and is therefore a common trigger for this leak.
+
+Example:
+
+# cd /sys/bus/pci/
+# dmesg -C
+# echo 1 > devices/0000\:01\:00.0/sriov_numvfs
+# echo 0 > devices/0000\:01\:00.0/sriov_numvfs
+# dmesg | grep 01:10
+ pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent (null)
+ kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release
+ kobject: '0000:01:10.0': free name
+
+[kobject freed as expected]
+
+# dmesg -C
+# echo 1 > devices/0000\:01\:00.0/sriov_numvfs
+# echo 0000:01:10.0 > drivers_probe
+# echo 0 > devices/0000\:01\:00.0/sriov_numvfs
+# dmesg | grep 01:10
+ pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices'
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env
+ kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0'
+
+[no free]
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/bus.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -254,13 +254,15 @@ static ssize_t store_drivers_probe(struc
+ const char *buf, size_t count)
+ {
+ struct device *dev;
++ int err = -EINVAL;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+ if (!dev)
+ return -ENODEV;
+- if (bus_rescan_devices_helper(dev, NULL) != 0)
+- return -EINVAL;
+- return count;
++ if (bus_rescan_devices_helper(dev, NULL) == 0)
++ err = count;
++ put_device(dev);
++ return err;
+ }
+
+ static struct device *next_device(struct klist_iter *i)
--- /dev/null
+From cf35d6e0475982667b0d2d318fb27be4b8849827 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 6 Nov 2014 16:23:39 +0000
+Subject: misc: genwqe: check for error from get_user_pages_fast()
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit cf35d6e0475982667b0d2d318fb27be4b8849827 upstream.
+
+`genwqe_user_vmap()` calls `get_user_pages_fast()` and if the return
+value is less than the number of pages requested, it frees the pages and
+returns an error (`-EFAULT`). However, it fails to consider a negative
+error return value from `get_user_pages_fast()`. In that case, the test
+`if (rc < m->nr_pages)` will be false (due to promotion of `rc` to a
+large `unsigned int`) and the code will continue on to call
+`genwqe_map_pages()` with an invalid list of page pointers. Fix it by
+bailing out if `get_user_pages_fast()` returns a negative error value.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/genwqe/card_utils.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -490,6 +490,8 @@ int genwqe_user_vmap(struct genwqe_dev *
+ m->nr_pages,
+ 1, /* write by caller */
+ m->page_list); /* ptrs to pages */
++ if (rc < 0)
++ goto fail_get_user_pages;
+
+ /* assumption: get_user_pages can be killed by signals. */
+ if (rc < m->nr_pages) {
kvm-x86-drop-severity-of-generation-wraparound-message.patch
x86_64-vdso-fix-the-vdso-address-randomization-algorithm.patch
x86-vdso-use-asm-volatile-in-__getcpu.patch
+driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch
+misc-genwqe-check-for-error-from-get_user_pages_fast.patch
+alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch
+alsa-hda-using-uninitialized-data.patch
+alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
