From: Greg Kroah-Hartman Date: Fri, 11 Sep 2015 22:17:25 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v3.10.88~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d166104db827e6e5330bb6561b2f2e7399e44d75;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: alsa-hda-check-all-inputs-for-is_active_nid_for_any.patch alsa-hda-fix-path-power-activation.patch alsa-hda-fix-possible-null-dereference.patch alsa-hda-fix-the-white-noise-on-dell-laptop.patch alsa-hda-shutdown-cx20722-on-reboot-free-to-avoid-spurious-noises.patch alsa-usb-add-native-dsd-support-for-gustard-dac-x20u.patch alsa-usb-audio-fix-runtime-pm-unbalance.patch cpuset-use-trialcs-mems_allowed-as-a-temp-variable.patch input-gpio_keys_polled-request-gpio-pin-as-input.patch mac80211-fix-invalid-read-in-minstrel_sort_best_tp_rates.patch pci-don-t-use-64-bit-bus-addresses-on-pa-risc.patch target-iscsi-fix-double-free-of-a-tur-followed-by-a-solicited-nopout.patch --- diff --git a/queue-4.1/alsa-hda-check-all-inputs-for-is_active_nid_for_any.patch b/queue-4.1/alsa-hda-check-all-inputs-for-is_active_nid_for_any.patch new file mode 100644 index 00000000000..cdbcabe9c07 --- /dev/null +++ b/queue-4.1/alsa-hda-check-all-inputs-for-is_active_nid_for_any.patch @@ -0,0 +1,45 @@ +From 9d2b48f7304aafaefbf0794a556ab4e307929d24 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 24 Aug 2015 10:45:27 +0200 +Subject: ALSA: hda - Check all inputs for is_active_nid_for_any() + +From: Takashi Iwai + +commit 9d2b48f7304aafaefbf0794a556ab4e307929d24 upstream. + +The is_active_nid_for_any() function in the generic parser is supposed +to check all connections from/to the given widget, but the current +code checks only the first input connection (index = 0). + +This patch corrects the code to check all inputs by passing -1 to +index argument. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102521 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_generic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -671,7 +671,8 @@ static bool is_active_nid(struct hda_cod + } + for (i = 0; i < path->depth; i++) { + if (path->path[i] == nid) { +- if (dir == HDA_OUTPUT || path->idx[i] == idx) ++ if (dir == HDA_OUTPUT || idx == -1 || ++ path->idx[i] == idx) + return true; + break; + } +@@ -682,7 +683,7 @@ static bool is_active_nid(struct hda_cod + + /* check whether the NID is referred by any active paths */ + #define is_active_nid_for_any(codec, nid) \ +- is_active_nid(codec, nid, HDA_OUTPUT, 0) ++ is_active_nid(codec, nid, HDA_OUTPUT, -1) + + /* get the default amp value for the target state */ + static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid, diff --git a/queue-4.1/alsa-hda-fix-path-power-activation.patch b/queue-4.1/alsa-hda-fix-path-power-activation.patch new file mode 100644 index 00000000000..68f68b3ad9b --- /dev/null +++ b/queue-4.1/alsa-hda-fix-path-power-activation.patch @@ -0,0 +1,51 @@ +From c7cd0ef66aade29e37ee08821a0e195ee776c6e6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 24 Aug 2015 10:52:06 +0200 +Subject: ALSA: hda - Fix path power activation + +From: Takashi Iwai + +commit c7cd0ef66aade29e37ee08821a0e195ee776c6e6 upstream. + +The widget power-saving code tries to turn up/down the power of each +widget in the I/O paths that are modified at each jack plug/unplug. +The recent report revealed that the power activation leaves some +widgets unpowered after plugging. This is because +snd_hda_activate_path() turns on path->active flag at the end of the +function while the path power management is done before that. Then +it's regarded as if nothing is active, and the driver turns off the +power. + +The fix is simply to set the flag at the beginning of the function, +before trying to power up. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102521 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_generic.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -884,8 +884,7 @@ void snd_hda_activate_path(struct hda_co + struct hda_gen_spec *spec = codec->spec; + int i; + +- if (!enable) +- path->active = false; ++ path->active = enable; + + /* make sure the widget is powered up */ + if (enable && (spec->power_down_unused || codec->power_save_node)) +@@ -903,9 +902,6 @@ void snd_hda_activate_path(struct hda_co + if (has_amp_out(codec, path, i)) + activate_amp_out(codec, path, i, enable); + } +- +- if (enable) +- path->active = true; + } + EXPORT_SYMBOL_GPL(snd_hda_activate_path); + diff --git a/queue-4.1/alsa-hda-fix-possible-null-dereference.patch b/queue-4.1/alsa-hda-fix-possible-null-dereference.patch new file mode 100644 index 00000000000..26c1d1d9cbb --- /dev/null +++ b/queue-4.1/alsa-hda-fix-possible-null-dereference.patch @@ -0,0 +1,35 @@ +From c7e69ae6b4ff49edf50180c0a32f3dd9d7967e31 Mon Sep 17 00:00:00 2001 +From: Markus Osterhoff +Date: Mon, 24 Aug 2015 14:11:39 +0200 +Subject: ALSA: hda: fix possible NULL dereference + +From: Markus Osterhoff + +commit c7e69ae6b4ff49edf50180c0a32f3dd9d7967e31 upstream. + +After a for-loop was replaced by list_for_each_entry, see +Commit bbbc7e8502c9 ("ALSA: hda - Allocate hda_pcm objects dynamically"), +Commit 751e2216899c ("ALSA: hda: fix possible null dereference"), +a possible NULL pointer dereference has been introduced; this patch adds +the NULL check on pcm->pcm, while leaving a potentially superfluous +check on pcm itself untouched. + +Signed-off-by: Markus Osterhoff +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -3259,7 +3259,7 @@ static int add_std_chmaps(struct hda_cod + struct snd_pcm_chmap *chmap; + const struct snd_pcm_chmap_elem *elem; + +- if (!pcm || pcm->own_chmap || ++ if (!pcm || !pcm->pcm || pcm->own_chmap || + !hinfo->substreams) + continue; + elem = hinfo->chmap ? hinfo->chmap : snd_pcm_std_chmaps; diff --git a/queue-4.1/alsa-hda-fix-the-white-noise-on-dell-laptop.patch b/queue-4.1/alsa-hda-fix-the-white-noise-on-dell-laptop.patch new file mode 100644 index 00000000000..60fef5e779a --- /dev/null +++ b/queue-4.1/alsa-hda-fix-the-white-noise-on-dell-laptop.patch @@ -0,0 +1,36 @@ +From 7ccb0a9917a511de1d5f92980f26885484d9a914 Mon Sep 17 00:00:00 2001 +From: Woodrow Shen +Date: Thu, 13 Aug 2015 11:20:40 +0800 +Subject: ALSA: hda - Fix the white noise on Dell laptop + +From: Woodrow Shen + +commit 7ccb0a9917a511de1d5f92980f26885484d9a914 upstream. + +Dell laptop causes the white noise by login screen and headphone, +and the fixup function ALC292_FIXUP_DISABLE_AAMIX can eliminate this +noise. + +Codec: Realtek ALC3235 +Vendor Id: 0x10ec0293 +Subsystem Id: 0x102806db + +BugLink: https://bugs.launchpad.net/bugs/1484334 +Signed-off-by: Woodrow Shen +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5119,6 +5119,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX), ++ SND_PCI_QUIRK(0x1028, 0x06db, "Dell", ALC292_FIXUP_DISABLE_AAMIX), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/queue-4.1/alsa-hda-shutdown-cx20722-on-reboot-free-to-avoid-spurious-noises.patch b/queue-4.1/alsa-hda-shutdown-cx20722-on-reboot-free-to-avoid-spurious-noises.patch new file mode 100644 index 00000000000..a8c46d84445 --- /dev/null +++ b/queue-4.1/alsa-hda-shutdown-cx20722-on-reboot-free-to-avoid-spurious-noises.patch @@ -0,0 +1,62 @@ +From f6b28e4ded45bb91bc4cd115d55e35badedfce5f Mon Sep 17 00:00:00 2001 +From: David Henningsson +Date: Fri, 21 Aug 2015 09:42:35 +0200 +Subject: ALSA: hda - Shutdown CX20722 on reboot/free to avoid spurious noises + +From: David Henningsson + +commit f6b28e4ded45bb91bc4cd115d55e35badedfce5f upstream. + +On shutdown/reboot of CX20722, first shut down all EAPDs, then +shut down the afg node to D3. + +Failure to do so can lead to spurious noises from the internal speaker +directly after reboot (and before the codec is reinitialized again, i e +in BIOS setup or GRUB menus). + +BugLink: https://bugs.launchpad.net/bugs/1487345 +Signed-off-by: David Henningsson +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -200,12 +200,33 @@ static int cx_auto_init(struct hda_codec + return 0; + } + +-#define cx_auto_free snd_hda_gen_free ++static void cx_auto_reboot_notify(struct hda_codec *codec) ++{ ++ struct conexant_spec *spec = codec->spec; ++ ++ if (codec->core.vendor_id != 0x14f150f2) ++ return; ++ ++ /* Turn the CX20722 codec into D3 to avoid spurious noises ++ from the internal speaker during (and after) reboot */ ++ cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false); ++ ++ snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3); ++ snd_hda_codec_write(codec, codec->core.afg, 0, ++ AC_VERB_SET_POWER_STATE, AC_PWRST_D3); ++} ++ ++static void cx_auto_free(struct hda_codec *codec) ++{ ++ cx_auto_reboot_notify(codec); ++ snd_hda_gen_free(codec); ++} + + static const struct hda_codec_ops cx_auto_patch_ops = { + .build_controls = cx_auto_build_controls, + .build_pcms = snd_hda_gen_build_pcms, + .init = cx_auto_init, ++ .reboot_notify = cx_auto_reboot_notify, + .free = cx_auto_free, + .unsol_event = snd_hda_jack_unsol_event, + #ifdef CONFIG_PM diff --git a/queue-4.1/alsa-usb-add-native-dsd-support-for-gustard-dac-x20u.patch b/queue-4.1/alsa-usb-add-native-dsd-support-for-gustard-dac-x20u.patch new file mode 100644 index 00000000000..8ce5ff36a7a --- /dev/null +++ b/queue-4.1/alsa-usb-add-native-dsd-support-for-gustard-dac-x20u.patch @@ -0,0 +1,29 @@ +From 9544f8b6e2ee9ed02d2322ff018837b185f51d45 Mon Sep 17 00:00:00 2001 +From: Jurgen Kramer +Date: Fri, 21 Aug 2015 09:48:35 +0200 +Subject: ALSA: usb: Add native DSD support for Gustard DAC-X20U + +From: Jurgen Kramer + +commit 9544f8b6e2ee9ed02d2322ff018837b185f51d45 upstream. + +This patch adds native DSD support for the Gustard DAC-X20U. + +Signed-off-by: Jurgen Kramer +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1268,6 +1268,7 @@ u64 snd_usb_interface_dsd_format_quirks( + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; + ++ case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */ + case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ + case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */ + if (fp->altsetting == 3) diff --git a/queue-4.1/alsa-usb-audio-fix-runtime-pm-unbalance.patch b/queue-4.1/alsa-usb-audio-fix-runtime-pm-unbalance.patch new file mode 100644 index 00000000000..2a3ad980d40 --- /dev/null +++ b/queue-4.1/alsa-usb-audio-fix-runtime-pm-unbalance.patch @@ -0,0 +1,38 @@ +From 9003ebb13f61e8c78a641e0dda7775183ada0625 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 19 Aug 2015 07:20:14 +0200 +Subject: ALSA: usb-audio: Fix runtime PM unbalance + +From: Takashi Iwai + +commit 9003ebb13f61e8c78a641e0dda7775183ada0625 upstream. + +The fix for deadlock in PM in commit [1ee23fe07ee8: ALSA: usb-audio: +Fix deadlocks at resuming] introduced a new check of in_pm flag. +However, the brainless patch author evaluated it in a wrong way +(logical AND instead of logical OR), thus usb_autopm_get_interface() +is wrongly called at probing, leading to unbalance of runtime PM +refcount. + +This patch fixes it by correcting the logic. + +Reported-by: Hans Yang +Fixes: 1ee23fe07ee8 ('ALSA: usb-audio: Fix deadlocks at resuming') +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -638,7 +638,7 @@ int snd_usb_autoresume(struct snd_usb_au + int err = -ENODEV; + + down_read(&chip->shutdown_rwsem); +- if (chip->probing && chip->in_pm) ++ if (chip->probing || chip->in_pm) + err = 0; + else if (!chip->shutdown) + err = usb_autopm_get_interface(chip->pm_intf); diff --git a/queue-4.1/cpuset-use-trialcs-mems_allowed-as-a-temp-variable.patch b/queue-4.1/cpuset-use-trialcs-mems_allowed-as-a-temp-variable.patch new file mode 100644 index 00000000000..a524c09f7cf --- /dev/null +++ b/queue-4.1/cpuset-use-trialcs-mems_allowed-as-a-temp-variable.patch @@ -0,0 +1,62 @@ +From 24ee3cf89bef04e8bc23788aca4e029a3f0f06d9 Mon Sep 17 00:00:00 2001 +From: Alban Crequy +Date: Thu, 6 Aug 2015 16:21:05 +0200 +Subject: cpuset: use trialcs->mems_allowed as a temp variable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alban Crequy + +commit 24ee3cf89bef04e8bc23788aca4e029a3f0f06d9 upstream. + +The comment says it's using trialcs->mems_allowed as a temp variable but +it didn't match the code. Change the code to match the comment. + +This fixes an issue when writing in cpuset.mems when a sub-directory +exists: we need to write several times for the information to persist: + +| root@alban:/sys/fs/cgroup/cpuset# mkdir footest9 +| root@alban:/sys/fs/cgroup/cpuset# cd footest9 +| root@alban:/sys/fs/cgroup/cpuset/footest9# mkdir aa +| root@alban:/sys/fs/cgroup/cpuset/footest9# cat cpuset.mems +| +| root@alban:/sys/fs/cgroup/cpuset/footest9# echo 0 > cpuset.mems +| root@alban:/sys/fs/cgroup/cpuset/footest9# cat cpuset.mems +| +| root@alban:/sys/fs/cgroup/cpuset/footest9# echo 0 > cpuset.mems +| root@alban:/sys/fs/cgroup/cpuset/footest9# cat cpuset.mems +| 0 +| root@alban:/sys/fs/cgroup/cpuset/footest9# cat aa/cpuset.mems +| +| root@alban:/sys/fs/cgroup/cpuset/footest9# echo 0 > aa/cpuset.mems +| root@alban:/sys/fs/cgroup/cpuset/footest9# cat aa/cpuset.mems +| 0 +| root@alban:/sys/fs/cgroup/cpuset/footest9# + +This should help to fix the following issue in Docker: +https://github.com/opencontainers/runc/issues/133 +In some conditions, a Docker container needs to be started twice in +order to work. + +Signed-off-by: Alban Crequy +Tested-by: Iago López Galeiras +Acked-by: Li Zefan +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cpuset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -1223,7 +1223,7 @@ static int update_nodemask(struct cpuset + spin_unlock_irq(&callback_lock); + + /* use trialcs->mems_allowed as a temp variable */ +- update_nodemasks_hier(cs, &cs->mems_allowed); ++ update_nodemasks_hier(cs, &trialcs->mems_allowed); + done: + return retval; + } diff --git a/queue-4.1/input-gpio_keys_polled-request-gpio-pin-as-input.patch b/queue-4.1/input-gpio_keys_polled-request-gpio-pin-as-input.patch new file mode 100644 index 00000000000..b282767b750 --- /dev/null +++ b/queue-4.1/input-gpio_keys_polled-request-gpio-pin-as-input.patch @@ -0,0 +1,36 @@ +From 1ae5ddb6f8837558928a1a694c7b8af7f09fdd21 Mon Sep 17 00:00:00 2001 +From: Vincent Pelletier +Date: Thu, 20 Aug 2015 12:00:19 -0700 +Subject: Input: gpio_keys_polled - request GPIO pin as input. + +From: Vincent Pelletier + +commit 1ae5ddb6f8837558928a1a694c7b8af7f09fdd21 upstream. + +GPIOF_IN flag was lost in: +Commit 633a21d80b4a("input: gpio_keys_polled: Add support for GPIO +descriptors"). + +Without this flag, legacy code path (for non-descriptor GPIO declarations) +would configure GPIO as output (0 meaning GPIOF_DIR_OUT | GPIOF_INIT_LOW). + +Signed-off-by: Vincent Pelletier +Reviewed-by: Mika Westerberg +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/gpio_keys_polled.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/keyboard/gpio_keys_polled.c ++++ b/drivers/input/keyboard/gpio_keys_polled.c +@@ -246,7 +246,7 @@ static int gpio_keys_polled_probe(struct + * convert it to descriptor. + */ + if (!button->gpiod && gpio_is_valid(button->gpio)) { +- unsigned flags = 0; ++ unsigned flags = GPIOF_IN; + + if (button->active_low) + flags |= GPIOF_ACTIVE_LOW; diff --git a/queue-4.1/mac80211-fix-invalid-read-in-minstrel_sort_best_tp_rates.patch b/queue-4.1/mac80211-fix-invalid-read-in-minstrel_sort_best_tp_rates.patch new file mode 100644 index 00000000000..014a98c5b12 --- /dev/null +++ b/queue-4.1/mac80211-fix-invalid-read-in-minstrel_sort_best_tp_rates.patch @@ -0,0 +1,44 @@ +From f5eeb5fa191fd7b634cbc4883ac58f3b2184dbc5 Mon Sep 17 00:00:00 2001 +From: Adrien Schildknecht +Date: Tue, 28 Jul 2015 10:30:16 +0200 +Subject: mac80211: fix invalid read in minstrel_sort_best_tp_rates() + +From: Adrien Schildknecht + +commit f5eeb5fa191fd7b634cbc4883ac58f3b2184dbc5 upstream. + +At the last iteration of the loop, j may equal zero and thus +tp_list[j - 1] causes an invalid read. +Change the logic of the loop so that j - 1 is always >= 0. + +Signed-off-by: Adrien Schildknecht +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rc80211_minstrel.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/mac80211/rc80211_minstrel.c ++++ b/net/mac80211/rc80211_minstrel.c +@@ -92,14 +92,15 @@ int minstrel_get_tp_avg(struct minstrel_ + static inline void + minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list) + { +- int j = MAX_THR_RATES; +- struct minstrel_rate_stats *tmp_mrs = &mi->r[j - 1].stats; ++ int j; ++ struct minstrel_rate_stats *tmp_mrs; + struct minstrel_rate_stats *cur_mrs = &mi->r[i].stats; + +- while (j > 0 && (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) > +- minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))) { +- j--; ++ for (j = MAX_THR_RATES; j > 0; --j) { + tmp_mrs = &mi->r[tp_list[j - 1]].stats; ++ if (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) <= ++ minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma)) ++ break; + } + + if (j < MAX_THR_RATES - 1) diff --git a/queue-4.1/pci-don-t-use-64-bit-bus-addresses-on-pa-risc.patch b/queue-4.1/pci-don-t-use-64-bit-bus-addresses-on-pa-risc.patch new file mode 100644 index 00000000000..16c5a0f33c6 --- /dev/null +++ b/queue-4.1/pci-don-t-use-64-bit-bus-addresses-on-pa-risc.patch @@ -0,0 +1,42 @@ +From 45ea2a5fed6dacb9bb0558d8b21eacc1c45d5bb4 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Thu, 20 Aug 2015 00:08:15 -0500 +Subject: PCI: Don't use 64-bit bus addresses on PA-RISC + +From: Bjorn Helgaas + +commit 45ea2a5fed6dacb9bb0558d8b21eacc1c45d5bb4 upstream. + +Meelis and Helge reported that 3a9ad0b4fdcd ("PCI: Add pci_bus_addr_t") +caused HPMCs on A500 and hangs on rp5470. + +PA-RISC does not set ARCH_DMA_ADDR_T_64BIT, even for 64-bit kernels, so +prior to 3a9ad0b4fdcd, we always used 32-bit PCI addresses. After +3a9ad0b4fdcd, we do use 64-bit PCI addresses in 64-bit kernels, and +apparently there's some PA-RISC problem related to them. + +Fixes: 3a9ad0b4fdcd ("PCI: Add pci_bus_addr_t") +Link: http://lkml.kernel.org/r/alpine.LRH.2.11.1507260929000.30065@math.ut.ee +Reported-by: Meelis Roos +Reported-by: Helge Deller +Tested-by: Helge Deller +Based-on-idea-by: Yinghai Lu +Signed-off-by: Bjorn Helgaas +Acked-by: Yinghai Lu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/Kconfig ++++ b/drivers/pci/Kconfig +@@ -2,7 +2,7 @@ + # PCI configuration + # + config PCI_BUS_ADDR_T_64BIT +- def_bool y if (ARCH_DMA_ADDR_T_64BIT || 64BIT) ++ def_bool y if (ARCH_DMA_ADDR_T_64BIT || (64BIT && !PARISC)) + depends on PCI + + config PCI_MSI diff --git a/queue-4.1/series b/queue-4.1/series index 89d756ad823..579da2edc92 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -44,3 +44,15 @@ crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch revert-libata-eh-set-information-field-for-autosense.patch revert-libata-implement-support-for-sense-data-reporting.patch revert-libata-implement-ncq-autosense.patch +cpuset-use-trialcs-mems_allowed-as-a-temp-variable.patch +alsa-usb-audio-fix-runtime-pm-unbalance.patch +alsa-hda-fix-the-white-noise-on-dell-laptop.patch +alsa-usb-add-native-dsd-support-for-gustard-dac-x20u.patch +alsa-hda-shutdown-cx20722-on-reboot-free-to-avoid-spurious-noises.patch +alsa-hda-check-all-inputs-for-is_active_nid_for_any.patch +alsa-hda-fix-path-power-activation.patch +alsa-hda-fix-possible-null-dereference.patch +mac80211-fix-invalid-read-in-minstrel_sort_best_tp_rates.patch +target-iscsi-fix-double-free-of-a-tur-followed-by-a-solicited-nopout.patch +pci-don-t-use-64-bit-bus-addresses-on-pa-risc.patch +input-gpio_keys_polled-request-gpio-pin-as-input.patch diff --git a/queue-4.1/target-iscsi-fix-double-free-of-a-tur-followed-by-a-solicited-nopout.patch b/queue-4.1/target-iscsi-fix-double-free-of-a-tur-followed-by-a-solicited-nopout.patch new file mode 100644 index 00000000000..88272d8bf42 --- /dev/null +++ b/queue-4.1/target-iscsi-fix-double-free-of-a-tur-followed-by-a-solicited-nopout.patch @@ -0,0 +1,47 @@ +From 9547308bda296b6f69876c840a0291fcfbeddbb8 Mon Sep 17 00:00:00 2001 +From: Alexei Potashnik +Date: Tue, 21 Jul 2015 15:07:56 -0700 +Subject: target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT + +From: Alexei Potashnik + +commit 9547308bda296b6f69876c840a0291fcfbeddbb8 upstream. + +Make sure all non-READ SCSI commands get targ_xfer_tag initialized +to 0xffffffff, not just WRITEs. + +Double-free of a TUR cmd object occurs under the following scenario: + +1. TUR received (targ_xfer_tag is uninitialized and left at 0) +2. TUR status sent +3. First unsolicited NOPIN is sent to initiator (gets targ_xfer_tag of 0) +4. NOPOUT for NOPIN (with TTT=0) arrives + - its ExpStatSN acks TUR status, TUR is queued for removal + - LIO tries to find NOPIN with TTT=0, but finds the same TUR instead, + TUR is queued for removal for the 2nd time + +(Drop unbalanced conditional bracket usage - nab) + +Signed-off-by: Alexei Potashnik +Signed-off-by: Spencer Baugh +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -968,9 +968,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_c + cmd->cmd_flags |= ICF_NON_IMMEDIATE_UNSOLICITED_DATA; + + conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt; +- if (hdr->flags & ISCSI_FLAG_CMD_READ) { ++ if (hdr->flags & ISCSI_FLAG_CMD_READ) + cmd->targ_xfer_tag = session_get_next_ttt(conn->sess); +- } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE) ++ else + cmd->targ_xfer_tag = 0xFFFFFFFF; + cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); + cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);