--- /dev/null
+From 15439bde3af7ff88459ea2b5520b77312e958df2 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Fri, 5 Aug 2011 13:49:52 +0200
+Subject: ALSA: snd-usb-caiaq: Correct offset fields of outbound iso_frame_desc
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 15439bde3af7ff88459ea2b5520b77312e958df2 upstream.
+
+This fixes faulty outbount packets in case the inbound packets
+received from the hardware are fragmented and contain bogus input
+iso frames. The bug has been there for ages, but for some strange
+reasons, it was only triggered by newer machines in 64bit mode.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-and-tested-by: William Light <wrl@illest.net>
+Reported-by: Pedro Ribeiro <pedrib@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/caiaq/audio.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -614,6 +614,7 @@ static void read_completed(struct urb *u
+ struct snd_usb_caiaqdev *dev;
+ struct urb *out;
+ int frame, len, send_it = 0, outframe = 0;
++ size_t offset = 0;
+
+ if (urb->status || !info)
+ return;
+@@ -634,7 +635,8 @@ static void read_completed(struct urb *u
+ len = urb->iso_frame_desc[outframe].actual_length;
+ out->iso_frame_desc[outframe].length = len;
+ out->iso_frame_desc[outframe].actual_length = 0;
+- out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame;
++ out->iso_frame_desc[outframe].offset = offset;
++ offset += len;
+
+ if (len > 0) {
+ spin_lock(&dev->spinlock);
+@@ -650,7 +652,7 @@ static void read_completed(struct urb *u
+ }
+
+ if (send_it) {
+- out->number_of_packets = FRAMES_PER_URB;
++ out->number_of_packets = outframe;
+ out->transfer_flags = URB_ISO_ASAP;
+ usb_submit_urb(out, GFP_ATOMIC);
+ }
--- /dev/null
+From 6678050442e90a4e9511a9ed14b9bdfc5e393323 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 3 Aug 2011 17:36:48 +0900
+Subject: ASoC: Fix binding of WM8750 on Jive
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 6678050442e90a4e9511a9ed14b9bdfc5e393323 upstream.
+
+The I2C address is misformatted and would never match.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/samsung/jive_wm8750.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/samsung/jive_wm8750.c
++++ b/sound/soc/samsung/jive_wm8750.c
+@@ -131,7 +131,7 @@ static struct snd_soc_dai_link jive_dai
+ .cpu_dai_name = "s3c2412-i2s",
+ .codec_dai_name = "wm8750-hifi",
+ .platform_name = "samsung-audio",
+- .codec_name = "wm8750-codec.0-0x1a",
++ .codec_name = "wm8750-codec.0-001a",
+ .init = jive_wm8750_init,
+ .ops = &jive_ops,
+ };
--- /dev/null
+From a96edd59b2bc88b3d1ea47e0ba48076d65db9302 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 4 Aug 2011 16:44:42 -0600
+Subject: ASoC: Tegra: tegra_pcm_deallocate_dma_buffer: Don't OOPS
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit a96edd59b2bc88b3d1ea47e0ba48076d65db9302 upstream.
+
+Not all PCM devices have all sub-streams. Specifically, the SPDIF driver
+only supports playback and hence has no capture substream. Check whether
+a substream exists before dereferencing it, when de-allocating DMA
+buffers in tegra_pcm_deallocate_dma_buffer.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/tegra/tegra_pcm.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/tegra/tegra_pcm.c
++++ b/sound/soc/tegra/tegra_pcm.c
+@@ -309,9 +309,14 @@ static int tegra_pcm_preallocate_dma_buf
+
+ static void tegra_pcm_deallocate_dma_buffer(struct snd_pcm *pcm, int stream)
+ {
+- struct snd_pcm_substream *substream = pcm->streams[stream].substream;
+- struct snd_dma_buffer *buf = &substream->dma_buffer;
++ struct snd_pcm_substream *substream;
++ struct snd_dma_buffer *buf;
+
++ substream = pcm->streams[stream].substream;
++ if (!substream)
++ return;
++
++ buf = &substream->dma_buffer;
+ if (!buf->area)
+ return;
+
--- /dev/null
+From 29591ed4ac6fe00e3ff23b5be0cdc7016ef9c47e Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 4 Aug 2011 16:44:43 -0600
+Subject: ASoC: Tegra: wm8903 machine driver: Allow re-insertion of
+ module
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 29591ed4ac6fe00e3ff23b5be0cdc7016ef9c47e upstream.
+
+Two issues were preventing module snd-soc-tegra-wm8903.ko from being
+removed and re-inserted:
+
+a) The speaker-enable GPIO is hosted by the WM8903 chip. This GPIO must
+ be freed before snd_soc_unregister_card() is called, because that
+ triggers wm8903.c:wm8903_remove(), which calls gpiochip_remove(), which
+ then fails if any of the GPIOs are in use. To solve this, free all GPIOs
+ first, so the code doesn't care where they come from.
+
+b) We need to call snd_soc_jack_free_gpios() to match the call to
+ snd_soc_jack_add_gpios() during initialization. Without this, the
+ call to snd_soc_jack_add_gpios() fails during any subsequent modprobe
+ and initialization, since the GPIO and IRQ are already registered. In
+ turn, this causes the headphone state not to be monitored, so the
+ headphone is assumed not to be plugged in, and the audio path to it is
+ never enabled.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/tegra/tegra_wm8903.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/tegra/tegra_wm8903.c
++++ b/sound/soc/tegra/tegra_wm8903.c
+@@ -56,6 +56,7 @@
+ #define GPIO_HP_MUTE BIT(1)
+ #define GPIO_INT_MIC_EN BIT(2)
+ #define GPIO_EXT_MIC_EN BIT(3)
++#define GPIO_HP_DET BIT(4)
+
+ struct tegra_wm8903 {
+ struct tegra_asoc_utils_data util_data;
+@@ -304,6 +305,7 @@ static int tegra_wm8903_init(struct snd_
+ snd_soc_jack_add_gpios(&tegra_wm8903_hp_jack,
+ 1,
+ &tegra_wm8903_hp_jack_gpio);
++ machine->gpio_requested |= GPIO_HP_DET;
+ }
+
+ snd_soc_jack_new(codec, "Mic Jack", SND_JACK_MICROPHONE,
+@@ -429,10 +431,10 @@ static int __devexit tegra_wm8903_driver
+ struct tegra_wm8903 *machine = snd_soc_card_get_drvdata(card);
+ struct tegra_wm8903_platform_data *pdata = machine->pdata;
+
+- snd_soc_unregister_card(card);
+-
+- tegra_asoc_utils_fini(&machine->util_data);
+-
++ if (machine->gpio_requested & GPIO_HP_DET)
++ snd_soc_jack_free_gpios(&tegra_wm8903_hp_jack,
++ 1,
++ &tegra_wm8903_hp_jack_gpio);
+ if (machine->gpio_requested & GPIO_EXT_MIC_EN)
+ gpio_free(pdata->gpio_ext_mic_en);
+ if (machine->gpio_requested & GPIO_INT_MIC_EN)
+@@ -441,6 +443,11 @@ static int __devexit tegra_wm8903_driver
+ gpio_free(pdata->gpio_hp_mute);
+ if (machine->gpio_requested & GPIO_SPKR_EN)
+ gpio_free(pdata->gpio_spkr_en);
++ machine->gpio_requested = 0;
++
++ snd_soc_unregister_card(card);
++
++ tegra_asoc_utils_fini(&machine->util_data);
+
+ kfree(machine);
+
--- /dev/null
+From bdc71bc59231f5542af13b5061b9ab124d093050 Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Sun, 7 Aug 2011 19:36:07 -0400
+Subject: ath5k: fix error handling in ath5k_beacon_send
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit bdc71bc59231f5542af13b5061b9ab124d093050 upstream.
+
+This cleans up error handling for the beacon in case of dma mapping
+failure. We need to free the skb when dma mapping fails instead of
+nulling and leaking the pointer, and we should bail out to avoid
+giving the hardware the bad descriptor.
+
+Finally, we need to perform the null check after trying to update
+the beacon, or else beacons will never be sent after a single
+mapping failure.
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/base.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1748,6 +1748,8 @@ ath5k_beacon_setup(struct ath5k_softc *s
+
+ if (dma_mapping_error(sc->dev, bf->skbaddr)) {
+ ATH5K_ERR(sc, "beacon DMA mapping failed\n");
++ dev_kfree_skb_any(skb);
++ bf->skb = NULL;
+ return -EIO;
+ }
+
+@@ -1832,8 +1834,6 @@ ath5k_beacon_update(struct ieee80211_hw
+ ath5k_txbuf_free_skb(sc, avf->bbuf);
+ avf->bbuf->skb = skb;
+ ret = ath5k_beacon_setup(sc, avf->bbuf);
+- if (ret)
+- avf->bbuf->skb = NULL;
+ out:
+ return ret;
+ }
+@@ -1854,6 +1854,7 @@ ath5k_beacon_send(struct ath5k_softc *sc
+ struct ath5k_vif *avf;
+ struct ath5k_buf *bf;
+ struct sk_buff *skb;
++ int err;
+
+ ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON, "in beacon_send\n");
+
+@@ -1902,11 +1903,6 @@ ath5k_beacon_send(struct ath5k_softc *sc
+
+ avf = (void *)vif->drv_priv;
+ bf = avf->bbuf;
+- if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION ||
+- sc->opmode == NL80211_IFTYPE_MONITOR)) {
+- ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
+- return;
+- }
+
+ /*
+ * Stop any current dma and put the new frame on the queue.
+@@ -1920,8 +1916,17 @@ ath5k_beacon_send(struct ath5k_softc *sc
+
+ /* refresh the beacon for AP or MESH mode */
+ if (sc->opmode == NL80211_IFTYPE_AP ||
+- sc->opmode == NL80211_IFTYPE_MESH_POINT)
+- ath5k_beacon_update(sc->hw, vif);
++ sc->opmode == NL80211_IFTYPE_MESH_POINT) {
++ err = ath5k_beacon_update(sc->hw, vif);
++ if (err)
++ return;
++ }
++
++ if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION ||
++ sc->opmode == NL80211_IFTYPE_MONITOR)) {
++ ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf->skb);
++ return;
++ }
+
+ trace_ath5k_tx(sc, bf->skb, &sc->txqs[sc->bhalq]);
+
--- /dev/null
+From 66a89b2164e2d30661edbd1953eacf0594d8203a Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Tue, 9 Aug 2011 11:10:56 -0400
+Subject: hwmon: (ibmaem) add missing kfree
+
+From: Julia Lawall <julia@diku.dk>
+
+commit 66a89b2164e2d30661edbd1953eacf0594d8203a upstream.
+
+rs_resp is dynamically allocated in aem_read_sensor(), so it should be freed
+before exiting in every case. This collects the kfree and the return at
+the end of the function.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmaem.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -432,13 +432,15 @@ static int aem_read_sensor(struct aem_da
+ aem_send_message(ipmi);
+
+ res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
+- if (!res)
+- return -ETIMEDOUT;
++ if (!res) {
++ res = -ETIMEDOUT;
++ goto out;
++ }
+
+ if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
+ memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
+- kfree(rs_resp);
+- return -ENOENT;
++ res = -ENOENT;
++ goto out;
+ }
+
+ switch (size) {
+@@ -463,8 +465,11 @@ static int aem_read_sensor(struct aem_da
+ break;
+ }
+ }
++ res = 0;
+
+- return 0;
++out:
++ kfree(rs_resp);
++ return res;
+ }
+
+ /* Update AEM energy registers */
usb-option-driver-add-pid-for-vodafone-huawei-k4510.patch
usb-option-driver-add-pid-for-vodafone-huawei-k4511.patch
atm-br2864-sent-packets-truncated-in-vc-routed-mode.patch
+hwmon-ibmaem-add-missing-kfree.patch
+alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
+asoc-fix-binding-of-wm8750-on-jive.patch
+asoc-tegra-tegra_pcm_deallocate_dma_buffer-don-t-oops.patch
+asoc-tegra-wm8903-machine-driver-allow-re-insertion-of.patch
+ath5k-fix-error-handling-in-ath5k_beacon_send.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
