From: Greg Kroah-Hartman Date: Sun, 10 Apr 2016 00:59:23 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v4.5.1~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c039805f87dde489d158cb969ce781af80fdd1ca;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch watchdog-rc32434_wdt-fix-ioctl-error-handling.patch --- diff --git a/queue-3.14/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch b/queue-3.14/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch new file mode 100644 index 00000000000..afe70654f97 --- /dev/null +++ b/queue-3.14/alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch @@ -0,0 +1,44 @@ +From 1f7c6658962fa1260c1658d681bd6bb0c746b99a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Mar 2016 16:44:55 +0100 +Subject: ALSA: hda - Fix unconditional GPIO toggle via automute + +From: Takashi Iwai + +commit 1f7c6658962fa1260c1658d681bd6bb0c746b99a upstream. + +Cirrus HD-audio driver may adjust GPIO pins for EAPD dynamically +depending on the jack plug state. This works fine for the auto-mute +mode where the speaker gets muted upon the HP jack plug. OTOH, when +the auto-mute mode is off, this turns off the EAPD unexpectedly +depending on the jack state, which results in the silent speaker +output. + +This patch fixes the silent speaker output issue by setting GPIO bits +constantly when the auto-mute mode is off. + +Reported-and-tested-by: moosotc@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_cirrus.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -177,8 +177,12 @@ static void cs_automute(struct hda_codec + snd_hda_gen_update_outputs(codec); + + if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) { +- spec->gpio_data = spec->gen.hp_jack_present ? +- spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ if (spec->gen.automute_speaker) ++ spec->gpio_data = spec->gen.hp_jack_present ? ++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ else ++ spec->gpio_data = ++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker; + snd_hda_codec_write(codec, 0x01, 0, + AC_VERB_SET_GPIO_DATA, spec->gpio_data); + } diff --git a/queue-3.14/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch b/queue-3.14/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch new file mode 100644 index 00000000000..42fce38cff0 --- /dev/null +++ b/queue-3.14/alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch @@ -0,0 +1,31 @@ +From 4061db03dd71d195b9973ee466f6ed32f6a3fc16 Mon Sep 17 00:00:00 2001 +From: "Vittorio Gambaletta (VittGam)" +Date: Sun, 13 Mar 2016 22:19:34 +0100 +Subject: ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41. + +From: Vittorio Gambaletta (VittGam) + +commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream. + +The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41 +will often fail, so add a quirk entry to fix it. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087 +Signed-off-by: Vittorio Gambaletta +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/intel8x0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -2884,6 +2884,7 @@ static void intel8x0_measure_ac97_clock( + + static struct snd_pci_quirk intel8x0_clock_list[] = { + SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), ++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), + SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), + SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), + SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), diff --git a/queue-3.14/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch b/queue-3.14/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch new file mode 100644 index 00000000000..fa153f5ba29 --- /dev/null +++ b/queue-3.14/bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch @@ -0,0 +1,34 @@ +From f8b11260a445169989d01df75d35af0f56178f95 Mon Sep 17 00:00:00 2001 +From: Eric Wheeler +Date: Mon, 7 Mar 2016 15:17:50 -0800 +Subject: bcache: fix cache_set_flush() NULL pointer dereference on OOM + +From: Eric Wheeler + +commit f8b11260a445169989d01df75d35af0f56178f95 upstream. + +When bch_cache_set_alloc() fails to kzalloc the cache_set, the +asyncronous closure handling tries to dereference a cache_set that +hadn't yet been allocated inside of cache_set_flush() which is called +by __cache_set_unregister() during cleanup. This appears to happen only +during an OOM condition on bcache_register. + +Signed-off-by: Eric Wheeler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bcache/super.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1388,6 +1388,9 @@ static void cache_set_flush(struct closu + struct btree *b; + unsigned i; + ++ if (!c) ++ closure_return(cl); ++ + bch_cache_accounting_destroy(&c->accounting); + + kobject_put(&c->internal); diff --git a/queue-3.14/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch b/queue-3.14/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch new file mode 100644 index 00000000000..9fd321fd0a9 --- /dev/null +++ b/queue-3.14/jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch @@ -0,0 +1,124 @@ +From c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi +Date: Wed, 9 Mar 2016 23:47:25 -0500 +Subject: jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path + +From: OGAWA Hirofumi + +commit c0a2ad9b50dd80eeccd73d9ff962234590d5ec93 upstream. + +On umount path, jbd2_journal_destroy() writes latest transaction ID +(->j_tail_sequence) to be used at next mount. + +The bug is that ->j_tail_sequence is not holding latest transaction ID +in some cases. So, at next mount, there is chance to conflict with +remaining (not overwritten yet) transactions. + + mount (id=10) + write transaction (id=11) + write transaction (id=12) + umount (id=10) <= the bug doesn't write latest ID + + mount (id=10) + write transaction (id=11) + crash + + mount + [recovery process] + transaction (id=11) + transaction (id=12) <= valid transaction ID, but old commit + must not replay + +Like above, this bug become the cause of recovery failure, or FS +corruption. + +So why ->j_tail_sequence doesn't point latest ID? + +Because if checkpoint transactions was reclaimed by memory pressure +(i.e. bdev_try_to_free_page()), then ->j_tail_sequence is not updated. +(And another case is, __jbd2_journal_clean_checkpoint_list() is called +with empty transaction.) + +So in above cases, ->j_tail_sequence is not pointing latest +transaction ID at umount path. Plus, REQ_FLUSH for checkpoint is not +done too. + +So, to fix this problem with minimum changes, this patch updates +->j_tail_sequence, and issue REQ_FLUSH. (With more complex changes, +some optimizations would be possible to avoid unnecessary REQ_FLUSH +for example though.) + +BTW, + + journal->j_tail_sequence = + ++journal->j_transaction_sequence; + +Increment of ->j_transaction_sequence seems to be unnecessary, but +ext3 does this. + +Signed-off-by: OGAWA Hirofumi +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1423,11 +1423,12 @@ out: + /** + * jbd2_mark_journal_empty() - Mark on disk journal as empty. + * @journal: The journal to update. ++ * @write_op: With which operation should we write the journal sb + * + * Update a journal's dynamic superblock fields to show that journal is empty. + * Write updated superblock to disk waiting for IO to complete. + */ +-static void jbd2_mark_journal_empty(journal_t *journal) ++static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; + +@@ -1445,7 +1446,7 @@ static void jbd2_mark_journal_empty(jour + sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- jbd2_write_superblock(journal, WRITE_FUA); ++ jbd2_write_superblock(journal, write_op); + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +@@ -1730,7 +1731,13 @@ int jbd2_journal_destroy(journal_t *jour + if (journal->j_sb_buffer) { + if (!is_journal_aborted(journal)) { + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ ++ write_lock(&journal->j_state_lock); ++ journal->j_tail_sequence = ++ ++journal->j_transaction_sequence; ++ write_unlock(&journal->j_state_lock); ++ ++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -1991,7 +1998,7 @@ int jbd2_journal_flush(journal_t *journa + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + write_lock(&journal->j_state_lock); + J_ASSERT(!journal->j_running_transaction); +@@ -2037,7 +2044,7 @@ int jbd2_journal_wipe(journal_t *journal + if (write) { + /* Lock to make assertions happy... */ + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + diff --git a/queue-3.14/series b/queue-3.14/series index 142b344c39c..8f7e58f5f5b 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -42,3 +42,8 @@ saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch +alsa-intel8x0-add-clock-quirk-entry-for-ad1981b-on-ibm-thinkpad-x41.patch +alsa-hda-fix-unconditional-gpio-toggle-via-automute.patch +jbd2-fix-fs-corruption-possibility-in-jbd2_journal_destroy-on-umount-path.patch +bcache-fix-cache_set_flush-null-pointer-dereference-on-oom.patch +watchdog-rc32434_wdt-fix-ioctl-error-handling.patch diff --git a/queue-3.14/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch b/queue-3.14/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch new file mode 100644 index 00000000000..c171b8f1f88 --- /dev/null +++ b/queue-3.14/watchdog-rc32434_wdt-fix-ioctl-error-handling.patch @@ -0,0 +1,38 @@ +From 10e7ac22cdd4d211cef99afcb9371b70cb175be6 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Sun, 28 Feb 2016 17:44:09 +0200 +Subject: watchdog: rc32434_wdt: fix ioctl error handling + +From: Michael S. Tsirkin + +commit 10e7ac22cdd4d211cef99afcb9371b70cb175be6 upstream. + +Calling return copy_to_user(...) in an ioctl will not do the right thing +if there's a pagefault: copy_to_user returns the number of bytes not +copied in this case. + +Fix up watchdog/rc32434_wdt to do + return copy_to_user(...)) ? -EFAULT : 0; + +instead. + +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/rc32434_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct fil + return -EINVAL; + /* Fall through */ + case WDIOC_GETTIMEOUT: +- return copy_to_user(argp, &timeout, sizeof(int)); ++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; + default: + return -ENOTTY; + }