From: Greg Kroah-Hartman Date: Wed, 23 Jul 2014 00:20:27 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.4.100~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f622871fdf0860ce5d7d9a898ea0e01a96d74fb2;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch alsa-hda-initialize-audio-infoframe-to-be-all-zero.patch bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch drivers-hv-util-fix-a-bug-in-the-kvp-code.patch fuse-handle-large-user-and-group-id.patch fuse-ignore-entry-timeout-on-lookup_reval.patch fuse-timeout-comparison-fix.patch --- diff --git a/queue-3.14/alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch b/queue-3.14/alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch new file mode 100644 index 00000000000..54553f8db66 --- /dev/null +++ b/queue-3.14/alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch @@ -0,0 +1,75 @@ +From 4da63c6fc426023d1a20e45508c47d7d68c6a53d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Jul 2014 15:19:43 +0200 +Subject: ALSA: hda - Fix broken PM due to incomplete i915 initialization + +From: Takashi Iwai + +commit 4da63c6fc426023d1a20e45508c47d7d68c6a53d upstream. + +When the initialization of Intel HDMI controller fails due to missing +i915 kernel symbols (e.g. HD-audio is built in while i915 is module), +the driver discontinues the probe. However, since the probe was done +asynchronously, the driver object still remains, thus the relevant PM +ops are still called at suspend/resume. This results in the bad access +to the incomplete audio card object, eventually leads to Oops or stall +at PM. + +This patch adds the missing checks of chip->init_failed flag at each +PM callback in order to fix the problem above. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79561 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2930,7 +2930,7 @@ static int azx_suspend(struct device *de + struct azx *chip = card->private_data; + struct azx_pcm *p; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); +@@ -2961,7 +2961,7 @@ static int azx_resume(struct device *dev + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) +@@ -2996,7 +2996,7 @@ static int azx_runtime_suspend(struct de + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME)) +@@ -3022,7 +3022,7 @@ static int azx_runtime_resume(struct dev + struct hda_codec *codec; + int status; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME)) +@@ -3057,7 +3057,7 @@ static int azx_runtime_idle(struct devic + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!power_save_controller || diff --git a/queue-3.14/alsa-hda-initialize-audio-infoframe-to-be-all-zero.patch b/queue-3.14/alsa-hda-initialize-audio-infoframe-to-be-all-zero.patch new file mode 100644 index 00000000000..211feb06329 --- /dev/null +++ b/queue-3.14/alsa-hda-initialize-audio-infoframe-to-be-all-zero.patch @@ -0,0 +1,30 @@ +From caaf5ef9493f72390905f1e97b310b8906d32dac Mon Sep 17 00:00:00 2001 +From: Mengdong Lin +Date: Tue, 11 Mar 2014 17:12:52 -0400 +Subject: ALSA: hda - initialize audio InfoFrame to be all zero + +From: Mengdong Lin + +commit caaf5ef9493f72390905f1e97b310b8906d32dac upstream. + +This patch initialized the local audio InfoFrame variable 'ai' to be all zero, +thus the data bytes will indicate "Refer to Stream Header" by default. + +Signed-off-by: Mengdong Lin +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1062,6 +1062,7 @@ static void hdmi_pin_setup_infoframe(str + { + union audio_infoframe ai; + ++ memset(&ai, 0, sizeof(ai)); + if (conn_type == 0) { /* HDMI */ + struct hdmi_audio_infoframe *hdmi_ai = &ai.hdmi; + diff --git a/queue-3.14/bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch b/queue-3.14/bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch new file mode 100644 index 00000000000..8b038982bd4 --- /dev/null +++ b/queue-3.14/bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch @@ -0,0 +1,31 @@ +From 48439d501e3d9e8634bdc0c418e066870039599d Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Mon, 23 Jun 2014 17:42:44 +0200 +Subject: Bluetooth: Ignore H5 non-link packets in non-active state + +From: Loic Poulain + +commit 48439d501e3d9e8634bdc0c418e066870039599d upstream. + +When detecting a non-link packet, h5_reset_rx() frees the Rx skb. +Not returning after that will cause the upcoming h5_rx_payload() +call to dereference a now NULL Rx skb and trigger a kernel oops. + +Signed-off-by: Loic Poulain +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/hci_h5.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -406,6 +406,7 @@ static int h5_rx_3wire_hdr(struct hci_ua + H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) { + BT_ERR("Non-link packet received in non-active state"); + h5_reset_rx(h5); ++ return 0; + } + + h5->rx_func = h5_rx_payload; diff --git a/queue-3.14/drivers-hv-util-fix-a-bug-in-the-kvp-code.patch b/queue-3.14/drivers-hv-util-fix-a-bug-in-the-kvp-code.patch new file mode 100644 index 00000000000..54e516c8126 --- /dev/null +++ b/queue-3.14/drivers-hv-util-fix-a-bug-in-the-kvp-code.patch @@ -0,0 +1,76 @@ +From 9bd2d0dfe4714dd5d7c09a93a5c9ea9e14ceb3fc Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Mon, 7 Jul 2014 16:34:25 -0700 +Subject: Drivers: hv: util: Fix a bug in the KVP code + +From: "K. Y. Srinivasan" + +commit 9bd2d0dfe4714dd5d7c09a93a5c9ea9e14ceb3fc upstream. + +Add code to poll the channel since we process only one message +at a time and the host may not interrupt us. Also increase the +receive buffer size since some KVP messages are close to 8K bytes in size. + +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_kvp.c | 14 ++++++++++++-- + drivers/hv/hv_util.c | 2 +- + 2 files changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -127,6 +127,15 @@ kvp_work_func(struct work_struct *dummy) + kvp_respond_to_host(NULL, HV_E_FAIL); + } + ++static void poll_channel(struct vmbus_channel *channel) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&channel->inbound_lock, flags); ++ hv_kvp_onchannelcallback(channel); ++ spin_unlock_irqrestore(&channel->inbound_lock, flags); ++} ++ + static int kvp_handle_handshake(struct hv_kvp_msg *msg) + { + int ret = 1; +@@ -155,7 +164,7 @@ static int kvp_handle_handshake(struct h + kvp_register(dm_reg_value); + kvp_transaction.active = false; + if (kvp_transaction.kvp_context) +- hv_kvp_onchannelcallback(kvp_transaction.kvp_context); ++ poll_channel(kvp_transaction.kvp_context); + } + return ret; + } +@@ -568,6 +577,7 @@ response_done: + + vmbus_sendpacket(channel, recv_buffer, buf_len, req_id, + VM_PKT_DATA_INBAND, 0); ++ poll_channel(channel); + + } + +@@ -603,7 +613,7 @@ void hv_kvp_onchannelcallback(void *cont + return; + } + +- vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 2, &recvlen, ++ vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen, + &requestid); + + if (recvlen > 0) { +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -312,7 +312,7 @@ static int util_probe(struct hv_device * + (struct hv_util_service *)dev_id->driver_data; + int ret; + +- srv->recv_buffer = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); ++ srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL); + if (!srv->recv_buffer) + return -ENOMEM; + if (srv->util_init) { diff --git a/queue-3.14/fuse-handle-large-user-and-group-id.patch b/queue-3.14/fuse-handle-large-user-and-group-id.patch new file mode 100644 index 00000000000..1793c932220 --- /dev/null +++ b/queue-3.14/fuse-handle-large-user-and-group-id.patch @@ -0,0 +1,72 @@ +From 233a01fa9c4c7c41238537e8db8434667ff28a2f Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 7 Jul 2014 15:28:51 +0200 +Subject: fuse: handle large user and group ID + +From: Miklos Szeredi + +commit 233a01fa9c4c7c41238537e8db8434667ff28a2f upstream. + +If the number in "user_id=N" or "group_id=N" mount options was larger than +INT_MAX then fuse returned EINVAL. + +Fix this to handle all valid uid/gid values. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/inode.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -461,6 +461,17 @@ static const match_table_t tokens = { + {OPT_ERR, NULL} + }; + ++static int fuse_match_uint(substring_t *s, unsigned int *res) ++{ ++ int err = -ENOMEM; ++ char *buf = match_strdup(s); ++ if (buf) { ++ err = kstrtouint(buf, 10, res); ++ kfree(buf); ++ } ++ return err; ++} ++ + static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) + { + char *p; +@@ -471,6 +482,7 @@ static int parse_fuse_opt(char *opt, str + while ((p = strsep(&opt, ",")) != NULL) { + int token; + int value; ++ unsigned uv; + substring_t args[MAX_OPT_ARGS]; + if (!*p) + continue; +@@ -494,18 +506,18 @@ static int parse_fuse_opt(char *opt, str + break; + + case OPT_USER_ID: +- if (match_int(&args[0], &value)) ++ if (fuse_match_uint(&args[0], &uv)) + return 0; +- d->user_id = make_kuid(current_user_ns(), value); ++ d->user_id = make_kuid(current_user_ns(), uv); + if (!uid_valid(d->user_id)) + return 0; + d->user_id_present = 1; + break; + + case OPT_GROUP_ID: +- if (match_int(&args[0], &value)) ++ if (fuse_match_uint(&args[0], &uv)) + return 0; +- d->group_id = make_kgid(current_user_ns(), value); ++ d->group_id = make_kgid(current_user_ns(), uv); + if (!gid_valid(d->group_id)) + return 0; + d->group_id_present = 1; diff --git a/queue-3.14/fuse-ignore-entry-timeout-on-lookup_reval.patch b/queue-3.14/fuse-ignore-entry-timeout-on-lookup_reval.patch new file mode 100644 index 00000000000..372f45351e3 --- /dev/null +++ b/queue-3.14/fuse-ignore-entry-timeout-on-lookup_reval.patch @@ -0,0 +1,54 @@ +From 154210ccb3a871e631bf39fdeb7a8731d98af87b Mon Sep 17 00:00:00 2001 +From: Anand Avati +Date: Thu, 26 Jun 2014 20:21:57 -0400 +Subject: fuse: ignore entry-timeout on LOOKUP_REVAL + +From: Anand Avati + +commit 154210ccb3a871e631bf39fdeb7a8731d98af87b upstream. + +The following test case demonstrates the bug: + + sh# mount -t glusterfs localhost:meta-test /mnt/one + + sh# mount -t glusterfs localhost:meta-test /mnt/two + + sh# echo stuff > /mnt/one/file; rm -f /mnt/two/file; echo stuff > /mnt/one/file + bash: /mnt/one/file: Stale file handle + + sh# echo stuff > /mnt/one/file; rm -f /mnt/two/file; sleep 1; echo stuff > /mnt/one/file + +On the second open() on /mnt/one, FUSE would have used the old +nodeid (file handle) trying to re-open it. Gluster is returning +-ESTALE. The ESTALE propagates back to namei.c:filename_lookup() +where lookup is re-attempted with LOOKUP_REVAL. The right +behavior now, would be for FUSE to ignore the entry-timeout and +and do the up-call revalidation. Instead FUSE is ignoring +LOOKUP_REVAL, succeeding the revalidation (because entry-timeout +has not passed), and open() is again retried on the old file +handle and finally the ESTALE is going back to the application. + +Fix: if revalidation is happening with LOOKUP_REVAL, then ignore +entry-timeout and always do the up-call. + +Signed-off-by: Anand Avati +Reviewed-by: Niels de Vos +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -198,7 +198,8 @@ static int fuse_dentry_revalidate(struct + inode = ACCESS_ONCE(entry->d_inode); + if (inode && is_bad_inode(inode)) + goto invalid; +- else if (time_before64(fuse_dentry_time(entry), get_jiffies_64())) { ++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || ++ (flags & LOOKUP_REVAL)) { + int err; + struct fuse_entry_out outarg; + struct fuse_req *req; diff --git a/queue-3.14/fuse-timeout-comparison-fix.patch b/queue-3.14/fuse-timeout-comparison-fix.patch new file mode 100644 index 00000000000..c9992aeb3a5 --- /dev/null +++ b/queue-3.14/fuse-timeout-comparison-fix.patch @@ -0,0 +1,48 @@ +From 126b9d4365b110c157bc4cbc32540dfa66c9c85a Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 7 Jul 2014 15:28:50 +0200 +Subject: fuse: timeout comparison fix + +From: Miklos Szeredi + +commit 126b9d4365b110c157bc4cbc32540dfa66c9c85a upstream. + +As suggested by checkpatch.pl, use time_before64() instead of direct +comparison of jiffies64 values. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -198,7 +198,7 @@ static int fuse_dentry_revalidate(struct + inode = ACCESS_ONCE(entry->d_inode); + if (inode && is_bad_inode(inode)) + goto invalid; +- else if (fuse_dentry_time(entry) < get_jiffies_64()) { ++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64())) { + int err; + struct fuse_entry_out outarg; + struct fuse_req *req; +@@ -925,7 +925,7 @@ int fuse_update_attributes(struct inode + int err; + bool r; + +- if (fi->i_time < get_jiffies_64()) { ++ if (time_before64(fi->i_time, get_jiffies_64())) { + r = true; + err = fuse_do_getattr(inode, stat, file); + } else { +@@ -1111,7 +1111,7 @@ static int fuse_permission(struct inode + ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) { + struct fuse_inode *fi = get_fuse_inode(inode); + +- if (fi->i_time < get_jiffies_64()) { ++ if (time_before64(fi->i_time, get_jiffies_64())) { + refreshed = true; + + err = fuse_perm_getattr(inode, mask); diff --git a/queue-3.14/series b/queue-3.14/series index ab67dc8dfe9..d8fd541c5e0 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -1,3 +1,10 @@ usb-check-if-port-status-is-equal-to-rxdetect.patch usb-chipidea-udc-disable-auto-zlp-generation-on-ep0.patch media-gspca_pac7302-add-new-usb-id-for-genius-i-look-317.patch +alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch +alsa-hda-initialize-audio-infoframe-to-be-all-zero.patch +drivers-hv-util-fix-a-bug-in-the-kvp-code.patch +bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch +fuse-timeout-comparison-fix.patch +fuse-handle-large-user-and-group-id.patch +fuse-ignore-entry-timeout-on-lookup_reval.patch