--- /dev/null
+From 4c2aee0032b70083dafebd733ed9c774633b2fa3 Mon Sep 17 00:00:00 2001
+From: Torsten Schenk <torsten.schenk@zoho.com>
+Date: Sun, 11 Aug 2013 11:11:35 +0200
+Subject: ALSA: 6fire: make buffers DMA-able (midi)
+
+From: Torsten Schenk <torsten.schenk@zoho.com>
+
+commit 4c2aee0032b70083dafebd733ed9c774633b2fa3 upstream.
+
+Patch makes midi output buffer DMA-able by allocating it separately.
+
+Signed-off-by: Torsten Schenk <torsten.schenk@zoho.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/6fire/midi.c | 16 +++++++++++++++-
+ sound/usb/6fire/midi.h | 6 +-----
+ 2 files changed, 16 insertions(+), 6 deletions(-)
+
+--- a/sound/usb/6fire/midi.c
++++ b/sound/usb/6fire/midi.c
+@@ -19,6 +19,10 @@
+ #include "chip.h"
+ #include "comm.h"
+
++enum {
++ MIDI_BUFSIZE = 64
++};
++
+ static void usb6fire_midi_out_handler(struct urb *urb)
+ {
+ struct midi_runtime *rt = urb->context;
+@@ -156,6 +160,12 @@ int usb6fire_midi_init(struct sfire_chip
+ if (!rt)
+ return -ENOMEM;
+
++ rt->out_buffer = kzalloc(MIDI_BUFSIZE, GFP_KERNEL);
++ if (!rt->out_buffer) {
++ kfree(rt);
++ return -ENOMEM;
++ }
++
+ rt->chip = chip;
+ rt->in_received = usb6fire_midi_in_received;
+ rt->out_buffer[0] = 0x80; /* 'send midi' command */
+@@ -169,6 +179,7 @@ int usb6fire_midi_init(struct sfire_chip
+
+ ret = snd_rawmidi_new(chip->card, "6FireUSB", 0, 1, 1, &rt->instance);
+ if (ret < 0) {
++ kfree(rt->out_buffer);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX "unable to create midi.\n");
+ return ret;
+@@ -197,6 +208,9 @@ void usb6fire_midi_abort(struct sfire_ch
+
+ void usb6fire_midi_destroy(struct sfire_chip *chip)
+ {
+- kfree(chip->midi);
++ struct midi_runtime *rt = chip->midi;
++
++ kfree(rt->out_buffer);
++ kfree(rt);
+ chip->midi = NULL;
+ }
+--- a/sound/usb/6fire/midi.h
++++ b/sound/usb/6fire/midi.h
+@@ -16,10 +16,6 @@
+
+ #include "common.h"
+
+-enum {
+- MIDI_BUFSIZE = 64
+-};
+-
+ struct midi_runtime {
+ struct sfire_chip *chip;
+ struct snd_rawmidi *instance;
+@@ -32,7 +28,7 @@ struct midi_runtime {
+ struct snd_rawmidi_substream *out;
+ struct urb out_urb;
+ u8 out_serial; /* serial number of out packet */
+- u8 out_buffer[MIDI_BUFSIZE];
++ u8 *out_buffer;
+ int buffer_offset;
+
+ void (*in_received)(struct midi_runtime *rt, u8 *data, int length);
--- /dev/null
+From 5ece263f1d93fba8d992e67e3ab8a71acf674db9 Mon Sep 17 00:00:00 2001
+From: Torsten Schenk <torsten.schenk@zoho.com>
+Date: Sun, 11 Aug 2013 11:11:19 +0200
+Subject: ALSA: 6fire: make buffers DMA-able (pcm)
+
+From: Torsten Schenk <torsten.schenk@zoho.com>
+
+commit 5ece263f1d93fba8d992e67e3ab8a71acf674db9 upstream.
+
+Patch makes pcm buffers DMA-able by allocating each one separately.
+
+Signed-off-by: Torsten Schenk <torsten.schenk@zoho.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/6fire/pcm.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ sound/usb/6fire/pcm.h | 2 +-
+ 2 files changed, 41 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -580,6 +580,33 @@ static void usb6fire_pcm_init_urb(struct
+ urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB;
+ }
+
++static int usb6fire_pcm_buffers_init(struct pcm_runtime *rt)
++{
++ int i;
++
++ for (i = 0; i < PCM_N_URBS; i++) {
++ rt->out_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB
++ * PCM_MAX_PACKET_SIZE, GFP_KERNEL);
++ if (!rt->out_urbs[i].buffer)
++ return -ENOMEM;
++ rt->in_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB
++ * PCM_MAX_PACKET_SIZE, GFP_KERNEL);
++ if (!rt->in_urbs[i].buffer)
++ return -ENOMEM;
++ }
++ return 0;
++}
++
++static void usb6fire_pcm_buffers_destroy(struct pcm_runtime *rt)
++{
++ int i;
++
++ for (i = 0; i < PCM_N_URBS; i++) {
++ kfree(rt->out_urbs[i].buffer);
++ kfree(rt->in_urbs[i].buffer);
++ }
++}
++
+ int usb6fire_pcm_init(struct sfire_chip *chip)
+ {
+ int i;
+@@ -591,6 +618,13 @@ int usb6fire_pcm_init(struct sfire_chip
+ if (!rt)
+ return -ENOMEM;
+
++ ret = usb6fire_pcm_buffers_init(rt);
++ if (ret) {
++ usb6fire_pcm_buffers_destroy(rt);
++ kfree(rt);
++ return ret;
++ }
++
+ rt->chip = chip;
+ rt->stream_state = STREAM_DISABLED;
+ rt->rate = ARRAY_SIZE(rates);
+@@ -612,6 +646,7 @@ int usb6fire_pcm_init(struct sfire_chip
+
+ ret = snd_pcm_new(chip->card, "DMX6FireUSB", 0, 1, 1, &pcm);
+ if (ret < 0) {
++ usb6fire_pcm_buffers_destroy(rt);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX "cannot create pcm instance.\n");
+ return ret;
+@@ -627,6 +662,7 @@ int usb6fire_pcm_init(struct sfire_chip
+ snd_dma_continuous_data(GFP_KERNEL),
+ MAX_BUFSIZE, MAX_BUFSIZE);
+ if (ret) {
++ usb6fire_pcm_buffers_destroy(rt);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX
+ "error preallocating pcm buffers.\n");
+@@ -671,6 +707,9 @@ void usb6fire_pcm_abort(struct sfire_chi
+
+ void usb6fire_pcm_destroy(struct sfire_chip *chip)
+ {
+- kfree(chip->pcm);
++ struct pcm_runtime *rt = chip->pcm;
++
++ usb6fire_pcm_buffers_destroy(rt);
++ kfree(rt);
+ chip->pcm = NULL;
+ }
+--- a/sound/usb/6fire/pcm.h
++++ b/sound/usb/6fire/pcm.h
+@@ -32,7 +32,7 @@ struct pcm_urb {
+ struct urb instance;
+ struct usb_iso_packet_descriptor packets[PCM_N_PACKETS_PER_URB];
+ /* END DO NOT SEPARATE */
+- u8 buffer[PCM_N_PACKETS_PER_URB * PCM_MAX_PACKET_SIZE];
++ u8 *buffer;
+
+ struct pcm_urb *peer;
+ };
--- /dev/null
+From 1801928e0f99d94c55e33c584c5eb2ff5e246ee6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 16 Aug 2013 08:17:05 +0200
+Subject: ALSA: hda - Add a fixup for Gateway LT27
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1801928e0f99d94c55e33c584c5eb2ff5e246ee6 upstream.
+
+Gateway LT27 needs a fixup for the inverted digital mic.
+
+Reported-by: "Nathanael D. Noblet" <nathanael@gnat.ca>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4210,6 +4210,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+ SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
++ SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+ SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
--- /dev/null
+From db8a38e5063a4daf61252e65d47ab3495c705f4c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 9 Aug 2013 12:34:42 +0200
+Subject: ALSA: hda - Add pinfix for LG LW25 laptop
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit db8a38e5063a4daf61252e65d47ab3495c705f4c upstream.
+
+Correct the pins for a line-in and a headphone on LG LW25 laptop with
+ALC880 codec. Other pins seem fine.
+
+Reported-and-tested-by: Joonas Saarinen <jonskunator@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1027,6 +1027,7 @@ enum {
+ ALC880_FIXUP_GPIO2,
+ ALC880_FIXUP_MEDION_RIM,
+ ALC880_FIXUP_LG,
++ ALC880_FIXUP_LG_LW25,
+ ALC880_FIXUP_W810,
+ ALC880_FIXUP_EAPD_COEF,
+ ALC880_FIXUP_TCL_S700,
+@@ -1085,6 +1086,14 @@ static const struct hda_fixup alc880_fix
+ { }
+ }
+ },
++ [ALC880_FIXUP_LG_LW25] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x0181344f }, /* line-in */
++ { 0x1b, 0x0321403f }, /* headphone */
++ { }
++ }
++ },
+ [ALC880_FIXUP_W810] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -1337,6 +1346,7 @@ static const struct snd_pci_quirk alc880
+ SND_PCI_QUIRK(0x1854, 0x003b, "LG", ALC880_FIXUP_LG),
+ SND_PCI_QUIRK(0x1854, 0x005f, "LG P1 Express", ALC880_FIXUP_LG),
+ SND_PCI_QUIRK(0x1854, 0x0068, "LG w1", ALC880_FIXUP_LG),
++ SND_PCI_QUIRK(0x1854, 0x0077, "LG LW25", ALC880_FIXUP_LG_LW25),
+ SND_PCI_QUIRK(0x19db, 0x4188, "TCL S700", ALC880_FIXUP_TCL_S700),
+
+ /* Below is the copied entries from alc880_quirks.c.
--- /dev/null
+From f69910ddbd8c29391958cf82b598dd78fe5c8640 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 8 Aug 2013 09:32:37 +0200
+Subject: ALSA: hda - Fix missing mute controls for CX5051
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f69910ddbd8c29391958cf82b598dd78fe5c8640 upstream.
+
+We've added a fake mute control (setting the amp volume to zero) for
+CX5051 at commit [3868137e: ALSA: hda - Add a fake mute feature], but
+this feature was overlooked in the generic parser implementation. Now
+the driver lacks of mute controls on these codecs.
+
+The fix is just to check both AC_AMPCAP_MUTE and AC_AMPCAP_MIN_MUTE
+bits in each place checking the amp capabilities.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=59001
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_generic.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -519,7 +519,7 @@ static bool same_amp_caps(struct hda_cod
+ }
+
+ #define nid_has_mute(codec, nid, dir) \
+- check_amp_caps(codec, nid, dir, AC_AMPCAP_MUTE)
++ check_amp_caps(codec, nid, dir, (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE))
+ #define nid_has_volume(codec, nid, dir) \
+ check_amp_caps(codec, nid, dir, AC_AMPCAP_NUM_STEPS)
+
+@@ -621,7 +621,7 @@ static int get_amp_val_to_activate(struc
+ if (enable)
+ val = (caps & AC_AMPCAP_OFFSET) >> AC_AMPCAP_OFFSET_SHIFT;
+ }
+- if (caps & AC_AMPCAP_MUTE) {
++ if (caps & (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE)) {
+ if (!enable)
+ val |= HDA_AMP_MUTE;
+ }
+@@ -645,7 +645,7 @@ static unsigned int get_amp_mask_to_modi
+ {
+ unsigned int mask = 0xff;
+
+- if (caps & AC_AMPCAP_MUTE) {
++ if (caps & (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE)) {
+ if (is_ctl_associated(codec, nid, dir, idx, NID_PATH_MUTE_CTL))
+ mask &= ~0x80;
+ }
--- /dev/null
+From 140d37de62ffe8405282a1d6498f3b4099006384 Mon Sep 17 00:00:00 2001
+From: "Maksim A. Boyko" <maksboyko@yandex.ru>
+Date: Sat, 10 Aug 2013 12:20:02 +0400
+Subject: ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam C525
+
+From: "Maksim A. Boyko" <maksboyko@yandex.ru>
+
+commit 140d37de62ffe8405282a1d6498f3b4099006384 upstream.
+
+Add the volume control quirk for avoiding the kernel warning
+for the Logitech HD Webcam C525
+as in the similar commit 36691e1be6ec551eef4a5225f126a281f8c051c2
+for the Logitech HD Webcam C310.
+
+Reported-by: Maksim Boyko <maksim.a.boyko@gmail.com>
+Tested-by: Maksim Boyko <maksim.a.boyko@gmail.com>
+Signed-off-by: Maksim Boyko <maksim.a.boyko@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -888,6 +888,7 @@ static void volume_control_quirks(struct
+ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
++ case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
+ case USB_ID(0x046d, 0x0991):
+ /* Most audio usb devices lie about volume resolution.
+ * Most Logitech webcams have res = 384.
--- /dev/null
+From e2c98a8bba958045bde861fe1d66be54315c7790 Mon Sep 17 00:00:00 2001
+From: Brian Austin <brian.austin@cirrus.com>
+Date: Tue, 6 Aug 2013 12:57:21 -0500
+Subject: ASoC: cs42l52: Reorder Min/Max and update to SX_TLV for Beep Volume
+
+From: Brian Austin <brian.austin@cirrus.com>
+
+commit e2c98a8bba958045bde861fe1d66be54315c7790 upstream.
+
+Beep Volume Min/Max was backwards.
+Change to SOC_SONGLE_SX_TLV for correct volume representation
+
+Signed-off-by: Brian Austin <brian.austin@cirrus.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/cs42l52.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/cs42l52.c
++++ b/sound/soc/codecs/cs42l52.c
+@@ -451,7 +451,7 @@ static const struct snd_kcontrol_new cs4
+ SOC_ENUM("Beep Pitch", beep_pitch_enum),
+ SOC_ENUM("Beep on Time", beep_ontime_enum),
+ SOC_ENUM("Beep off Time", beep_offtime_enum),
+- SOC_SINGLE_TLV("Beep Volume", CS42L52_BEEP_VOL, 0, 0x1f, 0x07, hl_tlv),
++ SOC_SINGLE_SX_TLV("Beep Volume", CS42L52_BEEP_VOL, 0, 0x07, 0x1f, hl_tlv),
+ SOC_SINGLE("Beep Mixer Switch", CS42L52_BEEP_TONE_CTL, 5, 1, 1),
+ SOC_ENUM("Beep Treble Corner Freq", beep_treble_enum),
+ SOC_ENUM("Beep Bass Corner Freq", beep_bass_enum),
--- /dev/null
+From fe581391147cb3d738d961d0f1233d91a9e1113c Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Thu, 1 Aug 2013 18:30:38 +0200
+Subject: ASoC: dapm: Fix empty list check in dapm_new_mux()
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit fe581391147cb3d738d961d0f1233d91a9e1113c upstream.
+
+list_first_entry() will always return a valid pointer, even if the list is
+empty. So the check whether path is NULL will always be false. So we end up
+calling dapm_create_or_share_mixmux_kcontrol() with a path struct that points
+right in the middle of the widget struct and by trying to modify the path the
+widgets memory will become corrupted. Fix this by using list_emtpy() to check if
+the widget doesn't have any paths.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Tested-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -682,13 +682,14 @@ static int dapm_new_mux(struct snd_soc_d
+ return -EINVAL;
+ }
+
+- path = list_first_entry(&w->sources, struct snd_soc_dapm_path,
+- list_sink);
+- if (!path) {
++ if (list_empty(&w->sources)) {
+ dev_err(dapm->dev, "ASoC: mux %s has no paths\n", w->name);
+ return -EINVAL;
+ }
+
++ path = list_first_entry(&w->sources, struct snd_soc_dapm_path,
++ list_sink);
++
+ ret = dapm_create_or_share_mixmux_kcontrol(w, 0, path);
+ if (ret < 0)
+ return ret;
--- /dev/null
+From c90c0d7a96e634a73ef1580f1d20993606545647 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Wed, 14 Aug 2013 14:24:16 -0600
+Subject: ASoC: tegra: fix Tegra30 I2S capture parameter setup
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit c90c0d7a96e634a73ef1580f1d20993606545647 upstream.
+
+The Tegra30 I2S driver was writing the AHUB interface parameters to the
+playback path register rather than the capture path register. This
+caused the capture parameters not to be configured at all, so if
+capturing using non-HW-default parameters (e.g. 16-bit stereo rather
+than 8-bit mono) the audio would be corrupted.
+
+With this fixed, audio capture from an analog microphone works correctly
+on the Cardhu board.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/tegra/tegra30_i2s.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/tegra/tegra30_i2s.c
++++ b/sound/soc/tegra/tegra30_i2s.c
+@@ -228,7 +228,7 @@ static int tegra30_i2s_hw_params(struct
+ reg = TEGRA30_I2S_CIF_RX_CTRL;
+ } else {
+ val |= TEGRA30_AUDIOCIF_CTRL_DIRECTION_TX;
+- reg = TEGRA30_I2S_CIF_RX_CTRL;
++ reg = TEGRA30_I2S_CIF_TX_CTRL;
+ }
+
+ regmap_write(i2s->regmap, reg, val);
--- /dev/null
+From 74418edec915d0f446debebde08d170c7b8ba0ee Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 30 Jul 2013 10:11:25 +0200
+Subject: cfg80211: fix P2P GO interface teardown
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 74418edec915d0f446debebde08d170c7b8ba0ee upstream.
+
+When a P2P GO interface goes down, cfg80211 doesn't properly
+tear it down, leading to warnings later. Add the GO interface
+type to the enumeration to tear it down like AP interfaces.
+Otherwise, we leave it pending and mac80211's state can get
+very confused, leading to warnings later.
+
+Reported-by: Ilan Peer <ilan.peer@intel.com>
+Tested-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -876,6 +876,7 @@ void cfg80211_leave(struct cfg80211_regi
+ cfg80211_leave_mesh(rdev, dev);
+ break;
+ case NL80211_IFTYPE_AP:
++ case NL80211_IFTYPE_P2P_GO:
+ cfg80211_stop_ap(rdev, dev);
+ break;
+ default:
--- /dev/null
+From c319d50bfcf678c2857038276d9fab3c6646f3bf Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 30 Jul 2013 22:34:28 +0200
+Subject: nl80211: fix another nl80211_fam.attrbuf race
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit c319d50bfcf678c2857038276d9fab3c6646f3bf upstream.
+
+This is similar to the race Linus had reported, but in this case
+it's an older bug: nl80211_prepare_wdev_dump() uses the wiphy
+index in cb->args[0] as it is and thus parses the message over
+and over again instead of just once because 0 is the first valid
+wiphy index. Similar code in nl80211_testmode_dump() correctly
+offsets the wiphy_index by 1, do that here as well.
+
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/nl80211.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -471,10 +471,12 @@ static int nl80211_prepare_wdev_dump(str
+ goto out_unlock;
+ }
+ *rdev = wiphy_to_dev((*wdev)->wiphy);
+- cb->args[0] = (*rdev)->wiphy_idx;
++ /* 0 is the first index - add 1 to parse only once */
++ cb->args[0] = (*rdev)->wiphy_idx + 1;
+ cb->args[1] = (*wdev)->identifier;
+ } else {
+- struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
++ /* subtract the 1 again here */
++ struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
+ struct wireless_dev *tmp;
+
+ if (!wiphy) {
mac80211-continue-using-disabled-channels-while-connected.patch
can-pcan_usb-fix-wrong-memcpy-bytes-length.patch
genetlink-fix-family-dump-race.patch
+cfg80211-fix-p2p-go-interface-teardown.patch
+asoc-dapm-fix-empty-list-check-in-dapm_new_mux.patch
+asoc-cs42l52-reorder-min-max-and-update-to-sx_tlv-for-beep-volume.patch
+asoc-tegra-fix-tegra30-i2s-capture-parameter-setup.patch
+alsa-usb-audio-fix-invalid-volume-resolution-for-logitech-hd-webcam-c525.patch
+alsa-6fire-make-buffers-dma-able-pcm.patch
+alsa-6fire-make-buffers-dma-able-midi.patch
+alsa-hda-fix-missing-mute-controls-for-cx5051.patch
+alsa-hda-add-pinfix-for-lg-lw25-laptop.patch
+alsa-hda-add-a-fixup-for-gateway-lt27.patch
+nl80211-fix-another-nl80211_fam.attrbuf-race.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
