--- /dev/null
+From 41002f8dd5938d5ad1d008ce5bfdbfe47fa7b4e8 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 12 Jul 2012 22:47:37 +0200
+Subject: hwmon: (it87) Preserve configuration register bits on init
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 41002f8dd5938d5ad1d008ce5bfdbfe47fa7b4e8 upstream.
+
+We were accidentally losing one bit in the configuration register on
+device initialization. It was reported to freeze one specific system
+right away. Properly preserve all bits we don't explicitly want to
+change in order to prevent that.
+
+Reported-by: Stevie Trujillo <stevie.trujillo@gmail.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/it87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -2157,7 +2157,7 @@ static void __devinit it87_init_device(s
+
+ /* Start monitoring */
+ it87_write_value(data, IT87_REG_CONFIG,
+- (it87_read_value(data, IT87_REG_CONFIG) & 0x36)
++ (it87_read_value(data, IT87_REG_CONFIG) & 0x3e)
+ | (update_vbat ? 0x41 : 0x01));
+ }
+
--- /dev/null
+From a7deca6fa79d5c65575532e780f3c93f6bf8ddad Mon Sep 17 00:00:00 2001
+From: David Dillow <dave@thedillows.org>
+Date: Mon, 18 Jun 2012 00:15:21 -0300
+Subject: media: cx231xx: don't DMA to random addresses
+
+From: David Dillow <dave@thedillows.org>
+
+commit a7deca6fa79d5c65575532e780f3c93f6bf8ddad upstream.
+
+Commit 7a6f6c29d264cdd2fe0eb3d923217eed5f0ad134 (cx231xx: use
+URB_NO_TRANSFER_DMA_MAP) was intended to avoid mapping the DMA buffer
+for URB twice. This works for the URBs allocated with usb_alloc_urb(),
+as those are allocated from cohernent DMA pools, but the flag was also
+added for the VBI and audio URBs, which have a manually allocated area.
+This leaves the random trash in the structure after allocation as the
+DMA address, corrupting memory and preventing VBI and audio from
+working. Letting the USB core map the buffers solves the problem.
+
+Signed-off-by: David Dillow <dave@thedillows.org>
+Cc: Sri Deevi <srinivasa.deevi@conexant.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/video/cx231xx/cx231xx-audio.c | 4 ++--
+ drivers/media/video/cx231xx/cx231xx-vbi.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/video/cx231xx/cx231xx-audio.c
++++ b/drivers/media/video/cx231xx/cx231xx-audio.c
+@@ -307,7 +307,7 @@ static int cx231xx_init_audio_isoc(struc
+ urb->context = dev;
+ urb->pipe = usb_rcvisocpipe(dev->udev,
+ dev->adev.end_point_addr);
+- urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
++ urb->transfer_flags = URB_ISO_ASAP;
+ urb->transfer_buffer = dev->adev.transfer_buffer[i];
+ urb->interval = 1;
+ urb->complete = cx231xx_audio_isocirq;
+@@ -368,7 +368,7 @@ static int cx231xx_init_audio_bulk(struc
+ urb->context = dev;
+ urb->pipe = usb_rcvbulkpipe(dev->udev,
+ dev->adev.end_point_addr);
+- urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
++ urb->transfer_flags = 0;
+ urb->transfer_buffer = dev->adev.transfer_buffer[i];
+ urb->complete = cx231xx_audio_bulkirq;
+ urb->transfer_buffer_length = sb_size;
+--- a/drivers/media/video/cx231xx/cx231xx-vbi.c
++++ b/drivers/media/video/cx231xx/cx231xx-vbi.c
+@@ -452,7 +452,7 @@ int cx231xx_init_vbi_isoc(struct cx231xx
+ return -ENOMEM;
+ }
+ dev->vbi_mode.bulk_ctl.urb[i] = urb;
+- urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
++ urb->transfer_flags = 0;
+
+ dev->vbi_mode.bulk_ctl.transfer_buffer[i] =
+ kzalloc(sb_size, GFP_KERNEL);
--- /dev/null
+From 8d657eb3b43861064d36241e88d9d61c709f33f0 Mon Sep 17 00:00:00 2001
+From: Dave Jones <davej@redhat.com>
+Date: Fri, 13 Jul 2012 13:35:36 -0400
+Subject: Remove easily user-triggerable BUG from generic_setlease
+
+From: Dave Jones <davej@redhat.com>
+
+commit 8d657eb3b43861064d36241e88d9d61c709f33f0 upstream.
+
+This can be trivially triggered from userspace by passing in something unexpected.
+
+ kernel BUG at fs/locks.c:1468!
+ invalid opcode: 0000 [#1] SMP
+ RIP: 0010:generic_setlease+0xc2/0x100
+ Call Trace:
+ __vfs_setlease+0x35/0x40
+ fcntl_setlease+0x76/0x150
+ sys_fcntl+0x1c6/0x810
+ system_call_fastpath+0x1a/0x1f
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/locks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp,
+ case F_WRLCK:
+ return generic_add_lease(filp, arg, flp);
+ default:
+- BUG();
++ return -EINVAL;
+ }
+ }
+ EXPORT_SYMBOL(generic_setlease);
projects / thirdparty / kernel / stable-queue.git / commitdiff
