--- /dev/null
+From deb29e90221a6d4417aa67be971613c353180331 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 5 May 2014 11:20:05 -0300
+Subject: media: ivtv: Fix Oops when no firmware is loaded
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit deb29e90221a6d4417aa67be971613c353180331 upstream.
+
+When ivtv PCM device is accessed at the state where no firmware is
+loaded, it oopses like:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
+ IP: [<ffffffffa049a881>] try_mailbox.isra.0+0x11/0x50 [ivtv]
+ Call Trace:
+ [<ffffffffa049aa20>] ivtv_api_call+0x160/0x6b0 [ivtv]
+ [<ffffffffa049af86>] ivtv_api+0x16/0x40 [ivtv]
+ [<ffffffffa049b10c>] ivtv_vapi+0xac/0xc0 [ivtv]
+ [<ffffffffa049d40d>] ivtv_start_v4l2_encode_stream+0x19d/0x630 [ivtv]
+ [<ffffffffa0530653>] snd_ivtv_pcm_capture_open+0x173/0x1c0 [ivtv_alsa]
+ [<ffffffffa04526f1>] snd_pcm_open_substream+0x51/0x100 [snd_pcm]
+ [<ffffffffa0452853>] snd_pcm_open+0xb3/0x260 [snd_pcm]
+ [<ffffffffa0452a37>] snd_pcm_capture_open+0x37/0x50 [snd_pcm]
+ [<ffffffffa033f557>] snd_open+0xa7/0x1e0 [snd]
+ [<ffffffff8118a628>] chrdev_open+0x88/0x1d0
+ [<ffffffff811840be>] do_dentry_open+0x1de/0x270
+ [<ffffffff81193a73>] do_last+0x1c3/0xec0
+ [<ffffffff81194826>] path_openat+0xb6/0x670
+ [<ffffffff81195b65>] do_filp_open+0x35/0x80
+ [<ffffffff81185449>] do_sys_open+0x129/0x210
+ [<ffffffff815b782d>] system_call_fastpath+0x1a/0x1f
+
+This patch adds the check of firmware at PCM open callback like other
+open callbacks of this driver.
+
+Bugzilla: https://apibugzilla.novell.com/show_bug.cgi?id=875440
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -159,6 +159,12 @@ static int snd_ivtv_pcm_capture_open(str
+
+ /* Instruct the CX2341[56] to start sending packets */
+ snd_ivtv_lock(itvsc);
++
++ if (ivtv_init_on_first_open(itv)) {
++ snd_ivtv_unlock(itvsc);
++ return -ENXIO;
++ }
++
+ s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+
+ v4l2_fh_init(&item.fh, s->vdev);
--- /dev/null
+From 85ac1a1772bb41da895bad83a81f6a62c8f293f6 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+Date: Thu, 17 Apr 2014 09:28:20 -0300
+Subject: media: stk1160: Avoid stack-allocated buffer for control URBs
+
+From: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+
+commit 85ac1a1772bb41da895bad83a81f6a62c8f293f6 upstream.
+
+Currently stk1160_read_reg() uses a stack-allocated char to get the
+read control value. This is wrong because usb_control_msg() requires
+a kmalloc-ed buffer.
+
+This commit fixes such issue by kmalloc'ating a 1-byte buffer to receive
+the read value.
+
+While here, let's remove the urb_buf array which was meant for a similar
+purpose, but never really used.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/stk1160/stk1160-core.c | 10 +++++++++-
+ drivers/media/usb/stk1160/stk1160.h | 1 -
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/stk1160/stk1160-core.c
++++ b/drivers/media/usb/stk1160/stk1160-core.c
+@@ -67,17 +67,25 @@ int stk1160_read_reg(struct stk1160 *dev
+ {
+ int ret;
+ int pipe = usb_rcvctrlpipe(dev->udev, 0);
++ u8 *buf;
+
+ *value = 0;
++
++ buf = kmalloc(sizeof(u8), GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+ ret = usb_control_msg(dev->udev, pipe, 0x00,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x00, reg, value, sizeof(u8), HZ);
++ 0x00, reg, buf, sizeof(u8), HZ);
+ if (ret < 0) {
+ stk1160_err("read failed on reg 0x%x (%d)\n",
+ reg, ret);
++ kfree(buf);
+ return ret;
+ }
+
++ *value = *buf;
++ kfree(buf);
+ return 0;
+ }
+
+--- a/drivers/media/usb/stk1160/stk1160.h
++++ b/drivers/media/usb/stk1160/stk1160.h
+@@ -143,7 +143,6 @@ struct stk1160 {
+ int num_alt;
+
+ struct stk1160_isoc_ctl isoc_ctl;
+- char urb_buf[255]; /* urb control msg buffer */
+
+ /* frame properties */
+ int width; /* current frame width */
usb-sierra-fix-remote-wakeup.patch
usb-qcserial-add-netgear-aircard-341u.patch
usb-qcserial-add-additional-sierra-wireless-qmi-devices.patch
+usb-serial-fix-potential-runtime-pm-imbalance-at-device-remove.patch
+media-ivtv-fix-oops-when-no-firmware-is-loaded.patch
+media-stk1160-avoid-stack-allocated-buffer-for-control-urbs.patch
--- /dev/null
+From c14829fad88dbeda57253590695b85ba51270621 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 26 May 2014 19:23:33 +0200
+Subject: USB: serial: fix potential runtime pm imbalance at device remove
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit c14829fad88dbeda57253590695b85ba51270621 upstream.
+
+Only call usb_autopm_put_interface() if the corresponding
+usb_autopm_get_interface() was successful.
+
+This prevents a potential runtime PM counter imbalance should
+usb_autopm_get_interface() fail. Note that the USB PM usage counter is
+reset when the interface is unbound, but that the runtime PM counter may
+be left unbalanced.
+
+Also add comment on why we don't need to worry about racing
+resume/suspend on autopm_get failures.
+
+Fixes: d5fd650cfc7f ("usb: serial: prevent suspend/resume from racing
+against probe/remove")
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/bus.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/bus.c
++++ b/drivers/usb/serial/bus.c
+@@ -97,13 +97,19 @@ static int usb_serial_device_remove(stru
+ struct usb_serial_port *port;
+ int retval = 0;
+ int minor;
++ int autopm_err;
+
+ port = to_usb_serial_port(dev);
+ if (!port)
+ return -ENODEV;
+
+- /* make sure suspend/resume doesn't race against port_remove */
+- usb_autopm_get_interface(port->serial->interface);
++ /*
++ * Make sure suspend/resume doesn't race against port_remove.
++ *
++ * Note that no further runtime PM callbacks will be made if
++ * autopm_get fails.
++ */
++ autopm_err = usb_autopm_get_interface(port->serial->interface);
+
+ minor = port->minor;
+ tty_unregister_device(usb_serial_tty_driver, minor);
+@@ -117,7 +123,9 @@ static int usb_serial_device_remove(stru
+ dev_info(dev, "%s converter now disconnected from ttyUSB%d\n",
+ driver->description, minor);
+
+- usb_autopm_put_interface(port->serial->interface);
++ if (!autopm_err)
++ usb_autopm_put_interface(port->serial->interface);
++
+ return retval;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
