--- /dev/null
+From 4da63c6fc426023d1a20e45508c47d7d68c6a53d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Jul 2014 15:19:43 +0200
+Subject: ALSA: hda - Fix broken PM due to incomplete i915 initialization
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4da63c6fc426023d1a20e45508c47d7d68c6a53d upstream.
+
+When the initialization of Intel HDMI controller fails due to missing
+i915 kernel symbols (e.g. HD-audio is built in while i915 is module),
+the driver discontinues the probe. However, since the probe was done
+asynchronously, the driver object still remains, thus the relevant PM
+ops are still called at suspend/resume. This results in the bad access
+to the incomplete audio card object, eventually leads to Oops or stall
+at PM.
+
+This patch adds the missing checks of chip->init_failed flag at each
+PM callback in order to fix the problem above.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79561
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2930,7 +2930,7 @@ static int azx_suspend(struct device *de
+ struct azx *chip = card->private_data;
+ struct azx_pcm *p;
+
+- if (chip->disabled)
++ if (chip->disabled || chip->init_failed)
+ return 0;
+
+ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+@@ -2961,7 +2961,7 @@ static int azx_resume(struct device *dev
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+
+- if (chip->disabled)
++ if (chip->disabled || chip->init_failed)
+ return 0;
+
+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+@@ -2996,7 +2996,7 @@ static int azx_runtime_suspend(struct de
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+
+- if (chip->disabled)
++ if (chip->disabled || chip->init_failed)
+ return 0;
+
+ if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
+@@ -3022,7 +3022,7 @@ static int azx_runtime_resume(struct dev
+ struct hda_codec *codec;
+ int status;
+
+- if (chip->disabled)
++ if (chip->disabled || chip->init_failed)
+ return 0;
+
+ if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
+@@ -3057,7 +3057,7 @@ static int azx_runtime_idle(struct devic
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+
+- if (chip->disabled)
++ if (chip->disabled || chip->init_failed)
+ return 0;
+
+ if (!power_save_controller ||
--- /dev/null
+From caaf5ef9493f72390905f1e97b310b8906d32dac Mon Sep 17 00:00:00 2001
+From: Mengdong Lin <mengdong.lin@intel.com>
+Date: Tue, 11 Mar 2014 17:12:52 -0400
+Subject: ALSA: hda - initialize audio InfoFrame to be all zero
+
+From: Mengdong Lin <mengdong.lin@intel.com>
+
+commit caaf5ef9493f72390905f1e97b310b8906d32dac upstream.
+
+This patch initialized the local audio InfoFrame variable 'ai' to be all zero,
+thus the data bytes will indicate "Refer to Stream Header" by default.
+
+Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1062,6 +1062,7 @@ static void hdmi_pin_setup_infoframe(str
+ {
+ union audio_infoframe ai;
+
++ memset(&ai, 0, sizeof(ai));
+ if (conn_type == 0) { /* HDMI */
+ struct hdmi_audio_infoframe *hdmi_ai = &ai.hdmi;
+
--- /dev/null
+From 48439d501e3d9e8634bdc0c418e066870039599d Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@intel.com>
+Date: Mon, 23 Jun 2014 17:42:44 +0200
+Subject: Bluetooth: Ignore H5 non-link packets in non-active state
+
+From: Loic Poulain <loic.poulain@intel.com>
+
+commit 48439d501e3d9e8634bdc0c418e066870039599d upstream.
+
+When detecting a non-link packet, h5_reset_rx() frees the Rx skb.
+Not returning after that will cause the upcoming h5_rx_payload()
+call to dereference a now NULL Rx skb and trigger a kernel oops.
+
+Signed-off-by: Loic Poulain <loic.poulain@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/hci_h5.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -406,6 +406,7 @@ static int h5_rx_3wire_hdr(struct hci_ua
+ H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) {
+ BT_ERR("Non-link packet received in non-active state");
+ h5_reset_rx(h5);
++ return 0;
+ }
+
+ h5->rx_func = h5_rx_payload;
--- /dev/null
+From 9bd2d0dfe4714dd5d7c09a93a5c9ea9e14ceb3fc Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Mon, 7 Jul 2014 16:34:25 -0700
+Subject: Drivers: hv: util: Fix a bug in the KVP code
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit 9bd2d0dfe4714dd5d7c09a93a5c9ea9e14ceb3fc upstream.
+
+Add code to poll the channel since we process only one message
+at a time and the host may not interrupt us. Also increase the
+receive buffer size since some KVP messages are close to 8K bytes in size.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv_kvp.c | 14 ++++++++++++--
+ drivers/hv/hv_util.c | 2 +-
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/hv/hv_kvp.c
++++ b/drivers/hv/hv_kvp.c
+@@ -127,6 +127,15 @@ kvp_work_func(struct work_struct *dummy)
+ kvp_respond_to_host(NULL, HV_E_FAIL);
+ }
+
++static void poll_channel(struct vmbus_channel *channel)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&channel->inbound_lock, flags);
++ hv_kvp_onchannelcallback(channel);
++ spin_unlock_irqrestore(&channel->inbound_lock, flags);
++}
++
+ static int kvp_handle_handshake(struct hv_kvp_msg *msg)
+ {
+ int ret = 1;
+@@ -155,7 +164,7 @@ static int kvp_handle_handshake(struct h
+ kvp_register(dm_reg_value);
+ kvp_transaction.active = false;
+ if (kvp_transaction.kvp_context)
+- hv_kvp_onchannelcallback(kvp_transaction.kvp_context);
++ poll_channel(kvp_transaction.kvp_context);
+ }
+ return ret;
+ }
+@@ -568,6 +577,7 @@ response_done:
+
+ vmbus_sendpacket(channel, recv_buffer, buf_len, req_id,
+ VM_PKT_DATA_INBAND, 0);
++ poll_channel(channel);
+
+ }
+
+@@ -603,7 +613,7 @@ void hv_kvp_onchannelcallback(void *cont
+ return;
+ }
+
+- vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 2, &recvlen,
++ vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen,
+ &requestid);
+
+ if (recvlen > 0) {
+--- a/drivers/hv/hv_util.c
++++ b/drivers/hv/hv_util.c
+@@ -312,7 +312,7 @@ static int util_probe(struct hv_device *
+ (struct hv_util_service *)dev_id->driver_data;
+ int ret;
+
+- srv->recv_buffer = kmalloc(PAGE_SIZE * 2, GFP_KERNEL);
++ srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL);
+ if (!srv->recv_buffer)
+ return -ENOMEM;
+ if (srv->util_init) {
--- /dev/null
+From 233a01fa9c4c7c41238537e8db8434667ff28a2f Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Mon, 7 Jul 2014 15:28:51 +0200
+Subject: fuse: handle large user and group ID
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit 233a01fa9c4c7c41238537e8db8434667ff28a2f upstream.
+
+If the number in "user_id=N" or "group_id=N" mount options was larger than
+INT_MAX then fuse returned EINVAL.
+
+Fix this to handle all valid uid/gid values.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/inode.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -461,6 +461,17 @@ static const match_table_t tokens = {
+ {OPT_ERR, NULL}
+ };
+
++static int fuse_match_uint(substring_t *s, unsigned int *res)
++{
++ int err = -ENOMEM;
++ char *buf = match_strdup(s);
++ if (buf) {
++ err = kstrtouint(buf, 10, res);
++ kfree(buf);
++ }
++ return err;
++}
++
+ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev)
+ {
+ char *p;
+@@ -471,6 +482,7 @@ static int parse_fuse_opt(char *opt, str
+ while ((p = strsep(&opt, ",")) != NULL) {
+ int token;
+ int value;
++ unsigned uv;
+ substring_t args[MAX_OPT_ARGS];
+ if (!*p)
+ continue;
+@@ -494,18 +506,18 @@ static int parse_fuse_opt(char *opt, str
+ break;
+
+ case OPT_USER_ID:
+- if (match_int(&args[0], &value))
++ if (fuse_match_uint(&args[0], &uv))
+ return 0;
+- d->user_id = make_kuid(current_user_ns(), value);
++ d->user_id = make_kuid(current_user_ns(), uv);
+ if (!uid_valid(d->user_id))
+ return 0;
+ d->user_id_present = 1;
+ break;
+
+ case OPT_GROUP_ID:
+- if (match_int(&args[0], &value))
++ if (fuse_match_uint(&args[0], &uv))
+ return 0;
+- d->group_id = make_kgid(current_user_ns(), value);
++ d->group_id = make_kgid(current_user_ns(), uv);
+ if (!gid_valid(d->group_id))
+ return 0;
+ d->group_id_present = 1;
--- /dev/null
+From 154210ccb3a871e631bf39fdeb7a8731d98af87b Mon Sep 17 00:00:00 2001
+From: Anand Avati <avati@redhat.com>
+Date: Thu, 26 Jun 2014 20:21:57 -0400
+Subject: fuse: ignore entry-timeout on LOOKUP_REVAL
+
+From: Anand Avati <avati@redhat.com>
+
+commit 154210ccb3a871e631bf39fdeb7a8731d98af87b upstream.
+
+The following test case demonstrates the bug:
+
+ sh# mount -t glusterfs localhost:meta-test /mnt/one
+
+ sh# mount -t glusterfs localhost:meta-test /mnt/two
+
+ sh# echo stuff > /mnt/one/file; rm -f /mnt/two/file; echo stuff > /mnt/one/file
+ bash: /mnt/one/file: Stale file handle
+
+ sh# echo stuff > /mnt/one/file; rm -f /mnt/two/file; sleep 1; echo stuff > /mnt/one/file
+
+On the second open() on /mnt/one, FUSE would have used the old
+nodeid (file handle) trying to re-open it. Gluster is returning
+-ESTALE. The ESTALE propagates back to namei.c:filename_lookup()
+where lookup is re-attempted with LOOKUP_REVAL. The right
+behavior now, would be for FUSE to ignore the entry-timeout and
+and do the up-call revalidation. Instead FUSE is ignoring
+LOOKUP_REVAL, succeeding the revalidation (because entry-timeout
+has not passed), and open() is again retried on the old file
+handle and finally the ESTALE is going back to the application.
+
+Fix: if revalidation is happening with LOOKUP_REVAL, then ignore
+entry-timeout and always do the up-call.
+
+Signed-off-by: Anand Avati <avati@redhat.com>
+Reviewed-by: Niels de Vos <ndevos@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dir.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -198,7 +198,8 @@ static int fuse_dentry_revalidate(struct
+ inode = ACCESS_ONCE(entry->d_inode);
+ if (inode && is_bad_inode(inode))
+ goto invalid;
+- else if (time_before64(fuse_dentry_time(entry), get_jiffies_64())) {
++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
++ (flags & LOOKUP_REVAL)) {
+ int err;
+ struct fuse_entry_out outarg;
+ struct fuse_req *req;
--- /dev/null
+From 126b9d4365b110c157bc4cbc32540dfa66c9c85a Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Mon, 7 Jul 2014 15:28:50 +0200
+Subject: fuse: timeout comparison fix
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit 126b9d4365b110c157bc4cbc32540dfa66c9c85a upstream.
+
+As suggested by checkpatch.pl, use time_before64() instead of direct
+comparison of jiffies64 values.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dir.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -198,7 +198,7 @@ static int fuse_dentry_revalidate(struct
+ inode = ACCESS_ONCE(entry->d_inode);
+ if (inode && is_bad_inode(inode))
+ goto invalid;
+- else if (fuse_dentry_time(entry) < get_jiffies_64()) {
++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64())) {
+ int err;
+ struct fuse_entry_out outarg;
+ struct fuse_req *req;
+@@ -925,7 +925,7 @@ int fuse_update_attributes(struct inode
+ int err;
+ bool r;
+
+- if (fi->i_time < get_jiffies_64()) {
++ if (time_before64(fi->i_time, get_jiffies_64())) {
+ r = true;
+ err = fuse_do_getattr(inode, stat, file);
+ } else {
+@@ -1111,7 +1111,7 @@ static int fuse_permission(struct inode
+ ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
+ struct fuse_inode *fi = get_fuse_inode(inode);
+
+- if (fi->i_time < get_jiffies_64()) {
++ if (time_before64(fi->i_time, get_jiffies_64())) {
+ refreshed = true;
+
+ err = fuse_perm_getattr(inode, mask);
usb-check-if-port-status-is-equal-to-rxdetect.patch
usb-chipidea-udc-disable-auto-zlp-generation-on-ep0.patch
media-gspca_pac7302-add-new-usb-id-for-genius-i-look-317.patch
+alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch
+alsa-hda-initialize-audio-infoframe-to-be-all-zero.patch
+drivers-hv-util-fix-a-bug-in-the-kvp-code.patch
+bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch
+fuse-timeout-comparison-fix.patch
+fuse-handle-large-user-and-group-id.patch
+fuse-ignore-entry-timeout-on-lookup_reval.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
