From: Greg Kroah-Hartman Date: Thu, 6 Oct 2016 07:31:17 +0000 (+0200) Subject: 4.8-stable patches X-Git-Tag: v4.8.1~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b4a5fdc3a7068219f40147b417d70c5da89db36f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.8-stable patches added patches: alsa-hda-adding-one-more-alc255-pin-definition-for-headset-problem.patch revert-usbtmc-convert-to-devm_kzalloc.patch staging-fbtft-fix-bug-in-fbtft-core.patch usb-serial-cp210x-add-id-for-a-juniper-console.patch usb-usbip-vudc-fix-left-shift-overflow.patch --- diff --git a/queue-4.8/alsa-hda-adding-one-more-alc255-pin-definition-for-headset-problem.patch b/queue-4.8/alsa-hda-adding-one-more-alc255-pin-definition-for-headset-problem.patch new file mode 100644 index 00000000000..fb79a48a608 --- /dev/null +++ b/queue-4.8/alsa-hda-adding-one-more-alc255-pin-definition-for-headset-problem.patch @@ -0,0 +1,35 @@ +From 392c9da24a994f238c5d7ea611c6245be4617014 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Mon, 26 Sep 2016 10:59:38 +0800 +Subject: ALSA: hda - Adding one more ALC255 pin definition for headset problem + +From: Hui Wang + +commit 392c9da24a994f238c5d7ea611c6245be4617014 upstream. + +We have two new Dell laptop models, they have the same ALC255 pin +definition, but not in the pin quirk table yet, as a result, the +headset microphone can't work. After adding the definition in the +table, the headset microphone works well. + +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5846,6 +5846,10 @@ static const struct snd_hda_pin_quirk al + {0x14, 0x90170120}, + {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x14, 0x90170110}, ++ {0x1b, 0x02011020}, ++ {0x21, 0x0221101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x14, 0x90170130}, + {0x1b, 0x01014020}, + {0x21, 0x0221103f}), diff --git a/queue-4.8/revert-usbtmc-convert-to-devm_kzalloc.patch b/queue-4.8/revert-usbtmc-convert-to-devm_kzalloc.patch new file mode 100644 index 00000000000..0cc6e36c04d --- /dev/null +++ b/queue-4.8/revert-usbtmc-convert-to-devm_kzalloc.patch @@ -0,0 +1,45 @@ +From ab21b63e8aedfc73565dd9cdd51eb338341177cb Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Wed, 28 Sep 2016 11:48:44 +0200 +Subject: Revert "usbtmc: convert to devm_kzalloc" + +From: Greg Kroah-Hartman + +commit ab21b63e8aedfc73565dd9cdd51eb338341177cb upstream. + +This reverts commit e6c7efdcb76f11b04e3d3f71c8d764ab75c9423b. + +Turns out it was totally wrong. The memory is supposed to be bound to +the kref, as the original code was doing correctly, not the +device/driver binding as the devm_kzalloc() would cause. + +This fixes an oops when read would be called after the device was +unbound from the driver. + +Reported-by: Ladislav Michl +Cc: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usbtmc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -141,6 +141,7 @@ static void usbtmc_delete(struct kref *k + struct usbtmc_device_data *data = to_usbtmc_data(kref); + + usb_put_dev(data->usb_dev); ++ kfree(data); + } + + static int usbtmc_open(struct inode *inode, struct file *filp) +@@ -1379,7 +1380,7 @@ static int usbtmc_probe(struct usb_inter + + dev_dbg(&intf->dev, "%s called\n", __func__); + +- data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); ++ data = kmalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + diff --git a/queue-4.8/series b/queue-4.8/series index 755ed865bb8..bef97ea5fc9 100644 --- a/queue-4.8/series +++ b/queue-4.8/series @@ -1,3 +1,8 @@ arm64-debug-avoid-resetting-stepping-state-machine-when-tif_singlestep.patch using-bug_on-as-an-assert-is-_never_-acceptable.patch usb-misc-legousbtower-fix-null-pointer-deference.patch +staging-fbtft-fix-bug-in-fbtft-core.patch +usb-usbip-vudc-fix-left-shift-overflow.patch +usb-serial-cp210x-add-id-for-a-juniper-console.patch +revert-usbtmc-convert-to-devm_kzalloc.patch +alsa-hda-adding-one-more-alc255-pin-definition-for-headset-problem.patch diff --git a/queue-4.8/staging-fbtft-fix-bug-in-fbtft-core.patch b/queue-4.8/staging-fbtft-fix-bug-in-fbtft-core.patch new file mode 100644 index 00000000000..8a7db052a16 --- /dev/null +++ b/queue-4.8/staging-fbtft-fix-bug-in-fbtft-core.patch @@ -0,0 +1,37 @@ +From fc1e2c8ea85e109acf09e74789e9b852f6eed251 Mon Sep 17 00:00:00 2001 +From: Ksenija Stanojevic +Date: Sun, 2 Oct 2016 17:42:35 +0200 +Subject: Staging: fbtft: Fix bug in fbtft-core + +From: Ksenija Stanojevic + +commit fc1e2c8ea85e109acf09e74789e9b852f6eed251 upstream. + +Commit 367e8560e8d7a62d96e9b1d644028a3816e04206 introduced a bug +in fbtft-core where fps is always 0, this is because variable +update_time is not assigned correctly. + +Signed-off-by: Ksenija Stanojevic +Fixes: 367e8560e8d7 ("Staging: fbtbt: Replace timespec with ktime_t") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/fbtft/fbtft-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -391,11 +391,11 @@ static void fbtft_update_display(struct + + if (unlikely(timeit)) { + ts_end = ktime_get(); +- if (ktime_to_ns(par->update_time)) ++ if (!ktime_to_ns(par->update_time)) + par->update_time = ts_start; + +- par->update_time = ts_start; + fps = ktime_us_delta(ts_start, par->update_time); ++ par->update_time = ts_start; + fps = fps ? 1000000 / fps : 0; + + throughput = ktime_us_delta(ts_end, ts_start); diff --git a/queue-4.8/usb-serial-cp210x-add-id-for-a-juniper-console.patch b/queue-4.8/usb-serial-cp210x-add-id-for-a-juniper-console.patch new file mode 100644 index 00000000000..c976de394c2 --- /dev/null +++ b/queue-4.8/usb-serial-cp210x-add-id-for-a-juniper-console.patch @@ -0,0 +1,26 @@ +From decc5360f23e9efe0252094f47f57f254dcbb3a9 Mon Sep 17 00:00:00 2001 +From: Kyle Jones +Date: Fri, 23 Sep 2016 13:28:37 -0500 +Subject: USB: serial: cp210x: Add ID for a Juniper console + +From: Kyle Jones + +commit decc5360f23e9efe0252094f47f57f254dcbb3a9 upstream. + +Signed-off-by: Kyle Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -118,6 +118,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ ++ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ + { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ diff --git a/queue-4.8/usb-usbip-vudc-fix-left-shift-overflow.patch b/queue-4.8/usb-usbip-vudc-fix-left-shift-overflow.patch new file mode 100644 index 00000000000..18d3ba7c68c --- /dev/null +++ b/queue-4.8/usb-usbip-vudc-fix-left-shift-overflow.patch @@ -0,0 +1,49 @@ +From 238b7bd91b16d5a08326f858db42229b212e53d8 Mon Sep 17 00:00:00 2001 +From: Nicolas Iooss +Date: Tue, 23 Aug 2016 17:13:29 +0200 +Subject: usb: usbip: vudc: fix left shift overflow + +From: Nicolas Iooss + +commit 238b7bd91b16d5a08326f858db42229b212e53d8 upstream. + +In v_recv_cmd_submit(), urb_p->urb->pipe has the type unsigned int +(which is 32-bit long on x86_64) but 11<<30 results in a 34-bit integer. +Therefore the 2 leading bits are truncated and + + urb_p->urb->pipe &= ~(11 << 30); + +has the same meaning as + + urb_p->urb->pipe &= ~(3 << 30); + +This second statement seems to be how the code was intended to be +written, as PIPE_ constants have values between 0 and 3. + +The overflow has been detected with a clang warning: + + drivers/usb/usbip/vudc_rx.c:145:27: warning: signed shift result + (0x2C0000000) requires 35 bits to represent, but 'int' only has 32 + bits [-Wshift-overflow] + urb_p->urb->pipe &= ~(11 << 30); + ~~ ^ ~~ + +Fixes: 79c02cb1fd5c ("usbip: vudc: Add vudc_rx") +Signed-off-by: Nicolas Iooss +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/usbip/vudc_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/usbip/vudc_rx.c ++++ b/drivers/usb/usbip/vudc_rx.c +@@ -142,7 +142,7 @@ static int v_recv_cmd_submit(struct vudc + urb_p->urb->status = -EINPROGRESS; + + /* FIXME: more pipe setup to please usbip_common */ +- urb_p->urb->pipe &= ~(11 << 30); ++ urb_p->urb->pipe &= ~(3 << 30); + switch (urb_p->ep->type) { + case USB_ENDPOINT_XFER_BULK: + urb_p->urb->pipe |= (PIPE_BULK << 30);