--- /dev/null
+From 1f7c6658962fa1260c1658d681bd6bb0c746b99a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Mar 2016 16:44:55 +0100
+Subject: ALSA: hda - Fix unconditional GPIO toggle via automute
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream.
+
+Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically
+depending on the jack plug state. This works fine for the auto-mute
+mode where the speaker gets muted upon the HP jack plug. OTOH, when
+the auto-mute mode is off, this turns off the EAPD unexpectedly
+depending on the jack state, which results in the silent speaker
+output.
+
+This patch fixes the silent speaker output issue by setting GPIO bits
+constantly when the auto-mute mode is off.
+
+Reported-and-tested-by: moosotc@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -177,8 +177,12 @@ static void cs_automute(struct hda_codec
+ snd_hda_gen_update_outputs(codec);
+
+ if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
+- spec->gpio_data = spec->gen.hp_jack_present ?
+- spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ if (spec->gen.automute_speaker)
++ spec->gpio_data = spec->gen.hp_jack_present ?
++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
++ else
++ spec->gpio_data =
++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
+ snd_hda_codec_write(codec, 0x01, 0,
+ AC_VERB_SET_GPIO_DATA, spec->gpio_data);
+ }
--- /dev/null
+From 4061db03dd71d195b9973ee466f6ed32f6a3fc16 Mon Sep 17 00:00:00 2001
+From: "Vittorio Gambaletta (VittGam)" <linuxbugs@vittgam.net>
+Date: Sun, 13 Mar 2016 22:19:34 +0100
+Subject: ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
+
+From: Vittorio Gambaletta (VittGam) <linuxbugs@vittgam.net>
+
+commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.
+
+The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41
+will often fail, so add a quirk entry to fix it.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
+Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/intel8x0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -2884,6 +2884,7 @@ static void intel8x0_measure_ac97_clock(
+
+ static struct snd_pci_quirk intel8x0_clock_list[] = {
+ SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
+ SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
+ SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
+ SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),
--- /dev/null
+From f8b11260a445169989d01df75d35af0f56178f95 Mon Sep 17 00:00:00 2001
+From: Eric Wheeler <git@linux.ewheeler.net>
+Date: Mon, 7 Mar 2016 15:17:50 -0800
+Subject: bcache: fix cache_set_flush() NULL pointer dereference on OOM
+
+From: Eric Wheeler <git@linux.ewheeler.net>
+
+commit f8b11260a445169989d01df75d35af0f56178f95 upstream.
+
+When bch_cache_set_alloc() fails to kzalloc the cache_set, the
+asyncronous closure handling tries to dereference a cache_set that
+hadn't yet been allocated inside of cache_set_flush() which is called
+by __cache_set_unregister() during cleanup. This appears to happen only
+during an OOM condition on bcache_register.
+
+Signed-off-by: Eric Wheeler <bcache@linux.ewheeler.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1388,6 +1388,9 @@ static void cache_set_flush(struct closu
+ struct btree *b;
+ unsigned i;
+
++ if (!c)
++ closure_return(cl);
++
+ bch_cache_accounting_destroy(&c->accounting);
+
+ kobject_put(&c->internal);
--- /dev/null
+From c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Wed, 9 Mar 2016 23:47:25 -0500
+Subject: jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream.
+
+On umount path, jbd2_journal_destroy() writes latest transaction ID
+(->j_tail_sequence) to be used at next mount.
+
+The bug is that ->j_tail_sequence is not holding latest transaction ID
+in some cases. So, at next mount, there is chance to conflict with
+remaining (not overwritten yet) transactions.
+
+ mount (id=10)
+ write transaction (id=11)
+ write transaction (id=12)
+ umount (id=10) <= the bug doesn't write latest ID
+
+ mount (id=10)
+ write transaction (id=11)
+ crash
+
+ mount
+ [recovery process]
+ transaction (id=11)
+ transaction (id=12) <= valid transaction ID, but old commit
+ must not replay
+
+Like above, this bug become the cause of recovery failure, or FS
+corruption.
+
+So why ->j_tail_sequence doesn't point latest ID?
+
+Because if checkpoint transactions was reclaimed by memory pressure
+(i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated.
+(And another case is, __jbd2_journal_clean_checkpoint_list() is called
+with empty transaction.)
+
+So in above cases, ->j_tail_sequence is not pointing latest
+transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not
+done too.
+
+So, to fix this problem with minimum changes, this patch updates
+->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes,
+some optimizations would be possible to avoid unnecessary REQ_FLUSH
+for example though.)
+
+BTW,
+
+ journal->j_tail_sequence =
+ ++journal->j_transaction_sequence;
+
+Increment of ->j_transaction_sequence seems to be unnecessary, but
+ext3 does this.
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/journal.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1423,11 +1423,12 @@ out:
+ /**
+ * jbd2_mark_journal_empty() - Mark on disk journal as empty.
+ * @journal: The journal to update.
++ * @write_op: With which operation should we write the journal sb
+ *
+ * Update a journal's dynamic superblock fields to show that journal is empty.
+ * Write updated superblock to disk waiting for IO to complete.
+ */
+-static void jbd2_mark_journal_empty(journal_t *journal)
++static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
+
+@@ -1445,7 +1446,7 @@ static void jbd2_mark_journal_empty(jour
+ sb->s_start = cpu_to_be32(0);
+ read_unlock(&journal->j_state_lock);
+
+- jbd2_write_superblock(journal, WRITE_FUA);
++ jbd2_write_superblock(journal, write_op);
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+@@ -1730,7 +1731,13 @@ int jbd2_journal_destroy(journal_t *jour
+ if (journal->j_sb_buffer) {
+ if (!is_journal_aborted(journal)) {
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++
++ write_lock(&journal->j_state_lock);
++ journal->j_tail_sequence =
++ ++journal->j_transaction_sequence;
++ write_unlock(&journal->j_state_lock);
++
++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ } else
+ err = -EIO;
+@@ -1991,7 +1998,7 @@ int jbd2_journal_flush(journal_t *journa
+ * the magic code for a fully-recovered superblock. Any future
+ * commits of data to the journal will restore the current
+ * s_start value. */
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ write_lock(&journal->j_state_lock);
+ J_ASSERT(!journal->j_running_transaction);
+@@ -2037,7 +2044,7 @@ int jbd2_journal_wipe(journal_t *journal
+ if (write) {
+ /* Lock to make assertions happy... */
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_mark_journal_empty(journal);
++ jbd2_mark_journal_empty(journal, WRITE_FUA);
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ }
+
adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch
bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch
media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch
+alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch
+alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch
+jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch
+bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch
+watchdog-rc32434_wdt-fix-ioctl-error-handling.patch
--- /dev/null
+From 10e7ac22cdd4d211cef99afcb9371b70cb175be6 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Sun, 28 Feb 2016 17:44:09 +0200
+Subject: watchdog: rc32434_wdt: fix ioctl error handling
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream.
+
+Calling return copy_to_user(...) in an ioctl will not do the right thing
+if there's a pagefault: copy_to_user returns the number of bytes not
+copied in this case.
+
+Fix up watchdog/rc32434_wdt to do
+ return copy_to_user(...)) ? -EFAULT : 0;
+
+instead.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/rc32434_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/rc32434_wdt.c
++++ b/drivers/watchdog/rc32434_wdt.c
+@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct fil
+ return -EINVAL;
+ /* Fall through */
+ case WDIOC_GETTIMEOUT:
+- return copy_to_user(argp, &timeout, sizeof(int));
++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0;
+ default:
+ return -ENOTTY;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
