From: Greg Kroah-Hartman Date: Wed, 14 Jan 2015 00:29:41 +0000 (-0800) Subject: 3.14-stable patches X-Git-Tag: v3.10.65~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aa8eda85db5c8d332434477c661c60edc04c6ffd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch alsa-hda-using-uninitialized-data.patch alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch misc-genwqe-check-for-error-from-get_user_pages_fast.patch --- diff --git a/queue-3.14/alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch b/queue-3.14/alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch new file mode 100644 index 00000000000..696af67116b --- /dev/null +++ b/queue-3.14/alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch @@ -0,0 +1,35 @@ +From c507de88f6a336bd7296c9ec0073b2d4af8b4f5e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 5 Jan 2015 13:27:33 +0100 +Subject: ALSA: hda - Fix wrong gpio_dir & gpio_mask hint setups for IDT/STAC codecs + +From: Takashi Iwai + +commit c507de88f6a336bd7296c9ec0073b2d4af8b4f5e upstream. + +stac_store_hints() does utterly wrong for masking the values for +gpio_dir and gpio_data, likely due to copy&paste errors. Fortunately, +this feature is used very rarely, so the impact must be really small. + +Reported-by: Rasmus Villemoes +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -593,9 +593,9 @@ static void stac_store_hints(struct hda_ + spec->gpio_mask; + } + if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir)) +- spec->gpio_mask &= spec->gpio_mask; +- if (get_int_hint(codec, "gpio_data", &spec->gpio_data)) + spec->gpio_dir &= spec->gpio_mask; ++ if (get_int_hint(codec, "gpio_data", &spec->gpio_data)) ++ spec->gpio_data &= spec->gpio_mask; + if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask)) + spec->eapd_mask &= spec->gpio_mask; + if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute)) diff --git a/queue-3.14/alsa-hda-using-uninitialized-data.patch b/queue-3.14/alsa-hda-using-uninitialized-data.patch new file mode 100644 index 00000000000..85956081b4f --- /dev/null +++ b/queue-3.14/alsa-hda-using-uninitialized-data.patch @@ -0,0 +1,37 @@ +From 69eba10e606a80665f8573221fec589430d9d1cb Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 27 Nov 2014 01:34:43 +0300 +Subject: ALSA: hda - using uninitialized data + +From: Dan Carpenter + +commit 69eba10e606a80665f8573221fec589430d9d1cb upstream. + +In olden times the snd_hda_param_read() function always set "*start_id" +but in 2007 we introduced a new return and it causes uninitialized data +bugs in a couple of the callers: print_codec_info() and +hdmi_parse_codec(). + +Fixes: e8a7f136f5ed ('[ALSA] hda-intel - Improve HD-audio codec probing robustness') +Signed-off-by: Dan Carpenter +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_codec.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -338,8 +338,10 @@ int snd_hda_get_sub_nodes(struct hda_cod + unsigned int parm; + + parm = snd_hda_param_read(codec, nid, AC_PAR_NODE_COUNT); +- if (parm == -1) ++ if (parm == -1) { ++ *start_id = 0; + return 0; ++ } + *start_id = (parm >> 16) & 0x7fff; + return (int)(parm & 0x7fff); + } diff --git a/queue-3.14/alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch b/queue-3.14/alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch new file mode 100644 index 00000000000..00d51c7b5a6 --- /dev/null +++ b/queue-3.14/alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch @@ -0,0 +1,60 @@ +From d70a1b9893f820fdbcdffac408c909c50f2e6b43 Mon Sep 17 00:00:00 2001 +From: Jiri Jaburek +Date: Thu, 18 Dec 2014 02:03:19 +0100 +Subject: ALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam rPAC + +From: Jiri Jaburek + +commit d70a1b9893f820fdbcdffac408c909c50f2e6b43 upstream. + +The Arcam rPAC seems to have the same problem - whenever anything +(alsamixer, udevd, 3.9+ kernel from 60af3d037eb8c, ..) attempts to +access mixer / control interface of the card, the firmware "locks up" +the entire device, resulting in + SNDRV_PCM_IOCTL_HW_PARAMS failed (-5): Input/output error +from alsa-lib. + +Other operating systems can somehow read the mixer (there seems to be +playback volume/mute), but any manipulation is ignored by the device +(which has hardware volume controls). + +Signed-off-by: Jiri Jaburek +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer_maps.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -328,8 +328,11 @@ static struct usbmix_name_map gamecom780 + {} + }; + +-static const struct usbmix_name_map kef_x300a_map[] = { +- { 10, NULL }, /* firmware locks up (?) when we try to access this FU */ ++/* some (all?) SCMS USB3318 devices are affected by a firmware lock up ++ * when anything attempts to access FU 10 (control) ++ */ ++static const struct usbmix_name_map scms_usb3318_map[] = { ++ { 10, NULL }, + { 0 } + }; + +@@ -425,8 +428,14 @@ static struct usbmix_ctl_map usbmix_ctl_ + .map = ebox44_map, + }, + { ++ /* KEF X300A */ + .id = USB_ID(0x27ac, 0x1000), +- .map = kef_x300a_map, ++ .map = scms_usb3318_map, ++ }, ++ { ++ /* Arcam rPAC */ ++ .id = USB_ID(0x25c4, 0x0003), ++ .map = scms_usb3318_map, + }, + { 0 } /* terminator */ + }; diff --git a/queue-3.14/driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch b/queue-3.14/driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch new file mode 100644 index 00000000000..6a41583ebcc --- /dev/null +++ b/queue-3.14/driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch @@ -0,0 +1,80 @@ +From bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 Mon Sep 17 00:00:00 2001 +From: Alex Williamson +Date: Fri, 31 Oct 2014 11:13:07 -0600 +Subject: driver core: Fix unbalanced device reference in drivers_probe + +From: Alex Williamson + +commit bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 upstream. + +bus_find_device_by_name() acquires a device reference which is never +released. This results in an object leak, which on older kernels +results in failure to release all resources of PCI devices. libvirt +uses drivers_probe to re-attach devices to the host after assignment +and is therefore a common trigger for this leak. + +Example: + +# cd /sys/bus/pci/ +# dmesg -C +# echo 1 > devices/0000\:01\:00.0/sriov_numvfs +# echo 0 > devices/0000\:01\:00.0/sriov_numvfs +# dmesg | grep 01:10 + pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000 + kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices' + kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env + kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' + kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env + kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' + kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env + kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' + kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent (null) + kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release + kobject: '0000:01:10.0': free name + +[kobject freed as expected] + +# dmesg -C +# echo 1 > devices/0000\:01\:00.0/sriov_numvfs +# echo 0000:01:10.0 > drivers_probe +# echo 0 > devices/0000\:01\:00.0/sriov_numvfs +# dmesg | grep 01:10 + pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000 + kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices' + kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env + kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' + kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env + kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' + kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env + kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' + +[no free] + +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/bus.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -254,13 +254,15 @@ static ssize_t store_drivers_probe(struc + const char *buf, size_t count) + { + struct device *dev; ++ int err = -EINVAL; + + dev = bus_find_device_by_name(bus, NULL, buf); + if (!dev) + return -ENODEV; +- if (bus_rescan_devices_helper(dev, NULL) != 0) +- return -EINVAL; +- return count; ++ if (bus_rescan_devices_helper(dev, NULL) == 0) ++ err = count; ++ put_device(dev); ++ return err; + } + + static struct device *next_device(struct klist_iter *i) diff --git a/queue-3.14/misc-genwqe-check-for-error-from-get_user_pages_fast.patch b/queue-3.14/misc-genwqe-check-for-error-from-get_user_pages_fast.patch new file mode 100644 index 00000000000..34a94407583 --- /dev/null +++ b/queue-3.14/misc-genwqe-check-for-error-from-get_user_pages_fast.patch @@ -0,0 +1,36 @@ +From cf35d6e0475982667b0d2d318fb27be4b8849827 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Thu, 6 Nov 2014 16:23:39 +0000 +Subject: misc: genwqe: check for error from get_user_pages_fast() + +From: Ian Abbott + +commit cf35d6e0475982667b0d2d318fb27be4b8849827 upstream. + +`genwqe_user_vmap()` calls `get_user_pages_fast()` and if the return +value is less than the number of pages requested, it frees the pages and +returns an error (`-EFAULT`). However, it fails to consider a negative +error return value from `get_user_pages_fast()`. In that case, the test +`if (rc < m->nr_pages)` will be false (due to promotion of `rc` to a +large `unsigned int`) and the code will continue on to call +`genwqe_map_pages()` with an invalid list of page pointers. Fix it by +bailing out if `get_user_pages_fast()` returns a negative error value. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/genwqe/card_utils.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/genwqe/card_utils.c ++++ b/drivers/misc/genwqe/card_utils.c +@@ -490,6 +490,8 @@ int genwqe_user_vmap(struct genwqe_dev * + m->nr_pages, + 1, /* write by caller */ + m->page_list); /* ptrs to pages */ ++ if (rc < 0) ++ goto fail_get_user_pages; + + /* assumption: get_user_pages can be killed by signals. */ + if (rc < m->nr_pages) { diff --git a/queue-3.14/series b/queue-3.14/series index fe23465ad97..aaed5673078 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -33,3 +33,8 @@ hid-add-a-new-id-0x501a-for-genius-mousepen-i608x.patch kvm-x86-drop-severity-of-generation-wraparound-message.patch x86_64-vdso-fix-the-vdso-address-randomization-algorithm.patch x86-vdso-use-asm-volatile-in-__getcpu.patch +driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch +misc-genwqe-check-for-error-from-get_user_pages_fast.patch +alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch +alsa-hda-using-uninitialized-data.patch +alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch