3.0 patches

diff --git a/queue-3.0/alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch b/queue-3.0/alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch
new file mode 100644 (file)
index 0000000..1fbcf65
--- /dev/null
+++ b/queue-3.0/alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch
@@ -0,0 +1,35 @@
+From 051a8cb6550d917225ead1cd008b5966350f6d53 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 18 Oct 2011 10:44:05 +0200
+Subject: ALSA: hda - Add position_fix quirk for Dell Inspiron 1010
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 051a8cb6550d917225ead1cd008b5966350f6d53 upstream.
+
+The previous fix for the position-buffer check gives yet another
+regression on a Dell laptop.  The safest fix right now is to add a
+static quirk for this device (and better to apply it for stable
+kernels too).
+
+Reported-by: Éric Piel <Eric.Piel@tremplin-utc.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2352,6 +2352,7 @@ static struct snd_pci_quirk position_fix
+       SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
+       SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
+       SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
++      SND_PCI_QUIRK(0x1028, 0x02c6, "Dell Inspiron 1010", POS_FIX_LPIB),
+       SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB),
+       SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
+       SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),

diff --git a/queue-3.0/alsa-hda-conexant-support-for-lenovo-t520-w520.patch b/queue-3.0/alsa-hda-conexant-support-for-lenovo-t520-w520.patch
new file mode 100644 (file)
index 0000000..bf6c4eb
--- /dev/null
+++ b/queue-3.0/alsa-hda-conexant-support-for-lenovo-t520-w520.patch
@@ -0,0 +1,36 @@
+From ca201c096269ee2d40037fea96a59fd0695888c4 Mon Sep 17 00:00:00 2001
+From: Daniel Suchy <danny@danysek.cz>
+Date: Tue, 18 Oct 2011 11:09:44 +0200
+Subject: ALSA: HDA: conexant support for Lenovo T520/W520
+
+From: Daniel Suchy <danny@danysek.cz>
+
+commit ca201c096269ee2d40037fea96a59fd0695888c4 upstream.
+
+This is patch for Conexant codec of Intel HDA driver, adding new quirk
+for Lenovo Thinkpad T520 and W520. Conexant autodetection works fine for
+T520 (similar subsystem ID is used also in W520 model) and detects more
+mixer features compared to generic (fallback) Lenovo quirk with
+hardcoded options in Conexant codec.
+
+Patch was activelly tested with Linux 3.0.4, 3.0.6 and 3.0.7 without any
+problems.
+
+Signed-off-by: Daniel Suchy <danny@danysek.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3097,6 +3097,7 @@ static const struct snd_pci_quirk cxt506
+       SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD),
+       SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
+       SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
++      SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520 & W520", CXT5066_AUTO),
+       SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
+       SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
+       SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS),

diff --git a/queue-3.0/crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch b/queue-3.0/crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch
new file mode 100644 (file)
index 0000000..b1c3e2e
--- /dev/null
+++ b/queue-3.0/crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch
@@ -0,0 +1,102 @@
+From 7ed47b7d142ec99ad6880bbbec51e9f12b3af74c Mon Sep 17 00:00:00 2001
+From: Nick Bowler <nbowler@elliptictech.com>
+Date: Thu, 20 Oct 2011 14:16:55 +0200
+Subject: crypto: ghash - Avoid null pointer dereference if no key is set
+
+From: Nick Bowler <nbowler@elliptictech.com>
+
+commit 7ed47b7d142ec99ad6880bbbec51e9f12b3af74c upstream.
+
+The ghash_update function passes a pointer to gf128mul_4k_lle which will
+be NULL if ghash_setkey is not called or if the most recent call to
+ghash_setkey failed to allocate memory.  This causes an oops.  Fix this
+up by returning an error code in the null case.
+
+This is trivially triggered from unprivileged userspace through the
+AF_ALG interface by simply writing to the socket without setting a key.
+
+The ghash_final function has a similar issue, but triggering it requires
+a memory allocation failure in ghash_setkey _after_ at least one
+successful call to ghash_update.
+
+  BUG: unable to handle kernel NULL pointer dereference at 00000670
+  IP: [<d88c92d4>] gf128mul_4k_lle+0x23/0x60 [gf128mul]
+  *pde = 00000000
+  Oops: 0000 [#1] PREEMPT SMP
+  Modules linked in: ghash_generic gf128mul algif_hash af_alg nfs lockd nfs_acl sunrpc bridge ipv6 stp llc
+
+  Pid: 1502, comm: hashatron Tainted: G        W   3.1.0-rc9-00085-ge9308cf #32 Bochs Bochs
+  EIP: 0060:[<d88c92d4>] EFLAGS: 00000202 CPU: 0
+  EIP is at gf128mul_4k_lle+0x23/0x60 [gf128mul]
+  EAX: d69db1f0 EBX: d6b8ddac ECX: 00000004 EDX: 00000000
+  ESI: 00000670 EDI: d6b8ddac EBP: d6b8ddc8 ESP: d6b8dda4
+   DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+  Process hashatron (pid: 1502, ti=d6b8c000 task=d6810000 task.ti=d6b8c000)
+  Stack:
+   00000000 d69db1f0 00000163 00000000 d6b8ddc8 c101a520 d69db1f0 d52aa000
+   00000ff0 d6b8dde8 d88d310f d6b8a3f8 d52aa000 00001000 d88d502c d6b8ddfc
+   00001000 d6b8ddf4 c11676ed d69db1e8 d6b8de24 c11679ad d52aa000 00000000
+  Call Trace:
+   [<c101a520>] ? kmap_atomic_prot+0x37/0xa6
+   [<d88d310f>] ghash_update+0x85/0xbe [ghash_generic]
+   [<c11676ed>] crypto_shash_update+0x18/0x1b
+   [<c11679ad>] shash_ahash_update+0x22/0x36
+   [<c11679cc>] shash_async_update+0xb/0xd
+   [<d88ce0ba>] hash_sendpage+0xba/0xf2 [algif_hash]
+   [<c121b24c>] kernel_sendpage+0x39/0x4e
+   [<d88ce000>] ? 0xd88cdfff
+   [<c121b298>] sock_sendpage+0x37/0x3e
+   [<c121b261>] ? kernel_sendpage+0x4e/0x4e
+   [<c10b4dbc>] pipe_to_sendpage+0x56/0x61
+   [<c10b4e1f>] splice_from_pipe_feed+0x58/0xcd
+   [<c10b4d66>] ? splice_from_pipe_begin+0x10/0x10
+   [<c10b51f5>] __splice_from_pipe+0x36/0x55
+   [<c10b4d66>] ? splice_from_pipe_begin+0x10/0x10
+   [<c10b6383>] splice_from_pipe+0x51/0x64
+   [<c10b63c2>] ? default_file_splice_write+0x2c/0x2c
+   [<c10b63d5>] generic_splice_sendpage+0x13/0x15
+   [<c10b4d66>] ? splice_from_pipe_begin+0x10/0x10
+   [<c10b527f>] do_splice_from+0x5d/0x67
+   [<c10b6865>] sys_splice+0x2bf/0x363
+   [<c129373b>] ? sysenter_exit+0xf/0x16
+   [<c104dc1e>] ? trace_hardirqs_on_caller+0x10e/0x13f
+   [<c129370c>] sysenter_do_call+0x12/0x32
+  Code: 83 c4 0c 5b 5e 5f c9 c3 55 b9 04 00 00 00 89 e5 57 8d 7d e4 56 53 8d 5d e4 83 ec 18 89 45 e0 89 55 dc 0f b6 70 0f c1 e6 04 01 d6 <f3> a5 be 0f 00 00 00 4e 89 d8 e8 48 ff ff ff 8b 45 e0 89 da 0f
+  EIP: [<d88c92d4>] gf128mul_4k_lle+0x23/0x60 [gf128mul] SS:ESP 0068:d6b8dda4
+  CR2: 0000000000000670
+  ---[ end trace 4eaa2a86a8e2da24 ]---
+  note: hashatron[1502] exited with preempt_count 1
+  BUG: scheduling while atomic: hashatron/1502/0x10000002
+  INFO: lockdep is turned off.
+  [...]
+
+Signed-off-by: Nick Bowler <nbowler@elliptictech.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/ghash-generic.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/crypto/ghash-generic.c
++++ b/crypto/ghash-generic.c
+@@ -67,6 +67,9 @@ static int ghash_update(struct shash_des
+       struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+       u8 *dst = dctx->buffer;
+ 
++      if (!ctx->gf128)
++              return -ENOKEY;
++
+       if (dctx->bytes) {
+               int n = min(srclen, dctx->bytes);
+               u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes);
+@@ -119,6 +122,9 @@ static int ghash_final(struct shash_desc
+       struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+       u8 *buf = dctx->buffer;
+ 
++      if (!ctx->gf128)
++              return -ENOKEY;
++
+       ghash_flush(ctx, dctx);
+       memcpy(dst, buf, GHASH_BLOCK_SIZE);
+ 

diff --git a/queue-3.0/series b/queue-3.0/series
index 5b037c80d1eacebf0f44f86dfa67a60d799a595c..8a939dc7d550608c838227ca764116c8d1eb37ba 100644 (file)
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -22,3 +22,6 @@ firewire-sbp2-fix-panic-after-rmmod-with-slow-targets.patch
 vfs-fix-automount-for-negative-autofs-dentries.patch
 mm-fix-race-between-mremap-and-removing-migration-entry.patch
 x25-prevent-skb-overreads-when-checking-call-user-data.patch
+crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch
+alsa-hda-conexant-support-for-lenovo-t520-w520.patch
+alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch