From 933a7b6f3a272027f7ff2fddfb6bae6af90ffe31 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 30 Jan 2013 13:45:05 +0100 Subject: [PATCH] 3.4-stable patches added patches: alsa-hda-add-a-fixup-for-packard-bell-desktop-with-alc880.patch alsa-usb-audio-fix-invalid-length-check-for-rme-and-other-uac-2-devices.patch asoc-wm2200-correct-mixer-values-and-text.patch bluetooth-fix-incorrect-strncpy-in-hidp_setup_hid.patch edac-test-correct-variable-in-store-function.patch --- ...for-packard-bell-desktop-with-alc880.patch | 32 ++++++++++ ...heck-for-rme-and-other-uac-2-devices.patch | 58 +++++++++++++++++++ ...wm2200-correct-mixer-values-and-text.patch | 36 ++++++++++++ ...-incorrect-strncpy-in-hidp_setup_hid.patch | 43 ++++++++++++++ ...t-correct-variable-in-store-function.patch | 30 ++++++++++ queue-3.4/series | 5 ++ 6 files changed, 204 insertions(+) create mode 100644 queue-3.4/alsa-hda-add-a-fixup-for-packard-bell-desktop-with-alc880.patch create mode 100644 queue-3.4/alsa-usb-audio-fix-invalid-length-check-for-rme-and-other-uac-2-devices.patch create mode 100644 queue-3.4/asoc-wm2200-correct-mixer-values-and-text.patch create mode 100644 queue-3.4/bluetooth-fix-incorrect-strncpy-in-hidp_setup_hid.patch create mode 100644 queue-3.4/edac-test-correct-variable-in-store-function.patch diff --git a/queue-3.4/alsa-hda-add-a-fixup-for-packard-bell-desktop-with-alc880.patch b/queue-3.4/alsa-hda-add-a-fixup-for-packard-bell-desktop-with-alc880.patch new file mode 100644 index 00000000000..9820aa650a8 --- /dev/null +++ b/queue-3.4/alsa-hda-add-a-fixup-for-packard-bell-desktop-with-alc880.patch @@ -0,0 +1,32 @@ +From 0712eea349d8e2b6d0e44b94a752d999319027fb Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 23 Jan 2013 18:16:24 +0100 +Subject: ALSA: hda - Add a fixup for Packard-Bell desktop with ALC880 + +From: Takashi Iwai + +commit 0712eea349d8e2b6d0e44b94a752d999319027fb upstream. + +A Packard-Bell desktop machine gives no proper pin configuration from +BIOS. It's almost equivalent with the 6stack+fp standard config, just +take the existing fixup. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=901846 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4741,6 +4741,7 @@ static const struct snd_pci_quirk alc880 + SND_PCI_QUIRK(0x1584, 0x9077, "Uniwill P53", ALC880_FIXUP_VOL_KNOB), + SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810), + SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM), ++ SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST), + SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734), + SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU), + SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734), diff --git a/queue-3.4/alsa-usb-audio-fix-invalid-length-check-for-rme-and-other-uac-2-devices.patch b/queue-3.4/alsa-usb-audio-fix-invalid-length-check-for-rme-and-other-uac-2-devices.patch new file mode 100644 index 00000000000..41338599c25 --- /dev/null +++ b/queue-3.4/alsa-usb-audio-fix-invalid-length-check-for-rme-and-other-uac-2-devices.patch @@ -0,0 +1,58 @@ +From d56268fb108c7c21e19933588ca4d94652585183 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Thu, 29 Nov 2012 17:04:23 +0100 +Subject: ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices + +From: Clemens Ladisch + +commit d56268fb108c7c21e19933588ca4d94652585183 upstream. + +Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0) +forgot to adjust the length check for UAC 2.0 feature unit descriptors. +This would make the code abort on encountering a feature unit without +per-channel controls, and thus prevented the driver to work with any +device having such a unit, such as the RME Babyface or Fireface UCX. + +Reported-by: Florian Hanisch +Tested-by: Matthew Robbetts +Tested-by: Michael Beer +Cc: Daniel Mack +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1239,16 +1239,23 @@ static int parse_audio_feature_unit(stru + } + channels = (hdr->bLength - 7) / csize - 1; + bmaControls = hdr->bmaControls; ++ if (hdr->bLength < 7 + csize) { ++ snd_printk(KERN_ERR "usbaudio: unit %u: " ++ "invalid UAC_FEATURE_UNIT descriptor\n", ++ unitid); ++ return -EINVAL; ++ } + } else { + struct uac2_feature_unit_descriptor *ftr = _ftr; + csize = 4; + channels = (hdr->bLength - 6) / 4 - 1; + bmaControls = ftr->bmaControls; +- } +- +- if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) { +- snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid); +- return -EINVAL; ++ if (hdr->bLength < 6 + csize) { ++ snd_printk(KERN_ERR "usbaudio: unit %u: " ++ "invalid UAC_FEATURE_UNIT descriptor\n", ++ unitid); ++ return -EINVAL; ++ } + } + + /* parse the source unit */ diff --git a/queue-3.4/asoc-wm2200-correct-mixer-values-and-text.patch b/queue-3.4/asoc-wm2200-correct-mixer-values-and-text.patch new file mode 100644 index 00000000000..86b40097157 --- /dev/null +++ b/queue-3.4/asoc-wm2200-correct-mixer-values-and-text.patch @@ -0,0 +1,36 @@ +From a80cc734282805e15b5e023751a4d02f7ffbcc91 Mon Sep 17 00:00:00 2001 +From: Chris Rattray +Date: Tue, 15 Jan 2013 13:22:36 +0000 +Subject: ASoC: wm2200: correct mixer values and text + +From: Chris Rattray + +commit a80cc734282805e15b5e023751a4d02f7ffbcc91 upstream. + +Signed-off-by: Chris Rattray +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm2200.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/sound/soc/codecs/wm2200.c ++++ b/sound/soc/codecs/wm2200.c +@@ -897,8 +897,6 @@ static const char *wm2200_mixer_texts[] + "EQR", + "LHPF1", + "LHPF2", +- "LHPF3", +- "LHPF4", + "DSP1.1", + "DSP1.2", + "DSP1.3", +@@ -931,7 +929,6 @@ static int wm2200_mixer_values[] = { + 0x25, + 0x50, /* EQ */ + 0x51, +- 0x52, + 0x60, /* LHPF1 */ + 0x61, /* LHPF2 */ + 0x68, /* DSP1 */ diff --git a/queue-3.4/bluetooth-fix-incorrect-strncpy-in-hidp_setup_hid.patch b/queue-3.4/bluetooth-fix-incorrect-strncpy-in-hidp_setup_hid.patch new file mode 100644 index 00000000000..8fadc5d6971 --- /dev/null +++ b/queue-3.4/bluetooth-fix-incorrect-strncpy-in-hidp_setup_hid.patch @@ -0,0 +1,43 @@ +From 0a9ab9bdb3e891762553f667066190c1d22ad62b Mon Sep 17 00:00:00 2001 +From: Anderson Lizardo +Date: Sun, 6 Jan 2013 18:28:53 -0400 +Subject: Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() + +From: Anderson Lizardo + +commit 0a9ab9bdb3e891762553f667066190c1d22ad62b upstream. + +The length parameter should be sizeof(req->name) - 1 because there is no +guarantee that string provided by userspace will contain the trailing +'\0'. + +Can be easily reproduced by manually setting req->name to 128 non-zero +bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on +input subsystem: + +$ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name +AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af + +("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys" +field in struct hid_device due to overflow.) + +Signed-off-by: Anderson Lizardo +Acked-by: Marcel Holtmann +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hidp/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -949,7 +949,7 @@ static int hidp_setup_hid(struct hidp_se + hid->version = req->version; + hid->country = req->country; + +- strncpy(hid->name, req->name, 128); ++ strncpy(hid->name, req->name, sizeof(req->name) - 1); + strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64); + strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64); + diff --git a/queue-3.4/edac-test-correct-variable-in-store-function.patch b/queue-3.4/edac-test-correct-variable-in-store-function.patch new file mode 100644 index 00000000000..5ab5d20c275 --- /dev/null +++ b/queue-3.4/edac-test-correct-variable-in-store-function.patch @@ -0,0 +1,30 @@ +From 8024c4c0b1057d1cd811fc9c3f88f81de9729fcd Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 26 Jan 2013 10:49:24 +0300 +Subject: EDAC: Test correct variable in ->store function + +From: Dan Carpenter + +commit 8024c4c0b1057d1cd811fc9c3f88f81de9729fcd upstream. + +We're testing for ->show but calling ->store(). + +Signed-off-by: Dan Carpenter +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/edac_pci_sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/edac_pci_sysfs.c ++++ b/drivers/edac/edac_pci_sysfs.c +@@ -257,7 +257,7 @@ static ssize_t edac_pci_dev_store(struct + struct edac_pci_dev_attribute *edac_pci_dev; + edac_pci_dev = (struct edac_pci_dev_attribute *)attr; + +- if (edac_pci_dev->show) ++ if (edac_pci_dev->store) + return edac_pci_dev->store(edac_pci_dev->value, buffer, count); + return -EIO; + } diff --git a/queue-3.4/series b/queue-3.4/series index 05a729428e4..c57b20da806 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -17,3 +17,8 @@ mac80211-fix-ft-roaming.patch ath9k_htc-fix-memory-leak.patch ath9k-do-not-link-receive-buffers-during-flush.patch ath9k-fix-double-free-bug-on-beacon-generate-failure.patch +alsa-usb-audio-fix-invalid-length-check-for-rme-and-other-uac-2-devices.patch +alsa-hda-add-a-fixup-for-packard-bell-desktop-with-alc880.patch +edac-test-correct-variable-in-store-function.patch +asoc-wm2200-correct-mixer-values-and-text.patch +bluetooth-fix-incorrect-strncpy-in-hidp_setup_hid.patch -- 2.47.3