From: Greg Kroah-Hartman Date: Fri, 21 Oct 2011 20:04:49 +0000 (+0200) Subject: 3.0 patches X-Git-Tag: v3.0.8~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59009f0f92eeae3a70f683f0bcf86ff29456114b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0 patches --- diff --git a/queue-3.0/alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch b/queue-3.0/alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch new file mode 100644 index 00000000000..1fbcf65fe36 --- /dev/null +++ b/queue-3.0/alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch @@ -0,0 +1,35 @@ +From 051a8cb6550d917225ead1cd008b5966350f6d53 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 Oct 2011 10:44:05 +0200 +Subject: ALSA: hda - Add position_fix quirk for Dell Inspiron 1010 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +commit 051a8cb6550d917225ead1cd008b5966350f6d53 upstream. + +The previous fix for the position-buffer check gives yet another +regression on a Dell laptop. The safest fix right now is to add a +static quirk for this device (and better to apply it for stable +kernels too). + +Reported-by: Éric Piel +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2352,6 +2352,7 @@ static struct snd_pci_quirk position_fix + SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), ++ SND_PCI_QUIRK(0x1028, 0x02c6, "Dell Inspiron 1010", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB), + SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), diff --git a/queue-3.0/alsa-hda-conexant-support-for-lenovo-t520-w520.patch b/queue-3.0/alsa-hda-conexant-support-for-lenovo-t520-w520.patch new file mode 100644 index 00000000000..bf6c4eb73d2 --- /dev/null +++ b/queue-3.0/alsa-hda-conexant-support-for-lenovo-t520-w520.patch @@ -0,0 +1,36 @@ +From ca201c096269ee2d40037fea96a59fd0695888c4 Mon Sep 17 00:00:00 2001 +From: Daniel Suchy +Date: Tue, 18 Oct 2011 11:09:44 +0200 +Subject: ALSA: HDA: conexant support for Lenovo T520/W520 + +From: Daniel Suchy + +commit ca201c096269ee2d40037fea96a59fd0695888c4 upstream. + +This is patch for Conexant codec of Intel HDA driver, adding new quirk +for Lenovo Thinkpad T520 and W520. Conexant autodetection works fine for +T520 (similar subsystem ID is used also in W520 model) and detects more +mixer features compared to generic (fallback) Lenovo quirk with +hardcoded options in Conexant codec. + +Patch was activelly tested with Linux 3.0.4, 3.0.6 and 3.0.7 without any +problems. + +Signed-off-by: Daniel Suchy +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -3097,6 +3097,7 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD), + SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS), + SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD), ++ SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520 & W520", CXT5066_AUTO), + SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD), + SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS), diff --git a/queue-3.0/crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch b/queue-3.0/crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch new file mode 100644 index 00000000000..b1c3e2ea314 --- /dev/null +++ b/queue-3.0/crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch @@ -0,0 +1,102 @@ +From 7ed47b7d142ec99ad6880bbbec51e9f12b3af74c Mon Sep 17 00:00:00 2001 +From: Nick Bowler +Date: Thu, 20 Oct 2011 14:16:55 +0200 +Subject: crypto: ghash - Avoid null pointer dereference if no key is set + +From: Nick Bowler + +commit 7ed47b7d142ec99ad6880bbbec51e9f12b3af74c upstream. + +The ghash_update function passes a pointer to gf128mul_4k_lle which will +be NULL if ghash_setkey is not called or if the most recent call to +ghash_setkey failed to allocate memory. This causes an oops. Fix this +up by returning an error code in the null case. + +This is trivially triggered from unprivileged userspace through the +AF_ALG interface by simply writing to the socket without setting a key. + +The ghash_final function has a similar issue, but triggering it requires +a memory allocation failure in ghash_setkey _after_ at least one +successful call to ghash_update. + + BUG: unable to handle kernel NULL pointer dereference at 00000670 + IP: [] gf128mul_4k_lle+0x23/0x60 [gf128mul] + *pde = 00000000 + Oops: 0000 [#1] PREEMPT SMP + Modules linked in: ghash_generic gf128mul algif_hash af_alg nfs lockd nfs_acl sunrpc bridge ipv6 stp llc + + Pid: 1502, comm: hashatron Tainted: G W 3.1.0-rc9-00085-ge9308cf #32 Bochs Bochs + EIP: 0060:[] EFLAGS: 00000202 CPU: 0 + EIP is at gf128mul_4k_lle+0x23/0x60 [gf128mul] + EAX: d69db1f0 EBX: d6b8ddac ECX: 00000004 EDX: 00000000 + ESI: 00000670 EDI: d6b8ddac EBP: d6b8ddc8 ESP: d6b8dda4 + DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 + Process hashatron (pid: 1502, ti=d6b8c000 task=d6810000 task.ti=d6b8c000) + Stack: + 00000000 d69db1f0 00000163 00000000 d6b8ddc8 c101a520 d69db1f0 d52aa000 + 00000ff0 d6b8dde8 d88d310f d6b8a3f8 d52aa000 00001000 d88d502c d6b8ddfc + 00001000 d6b8ddf4 c11676ed d69db1e8 d6b8de24 c11679ad d52aa000 00000000 + Call Trace: + [] ? kmap_atomic_prot+0x37/0xa6 + [] ghash_update+0x85/0xbe [ghash_generic] + [] crypto_shash_update+0x18/0x1b + [] shash_ahash_update+0x22/0x36 + [] shash_async_update+0xb/0xd + [] hash_sendpage+0xba/0xf2 [algif_hash] + [] kernel_sendpage+0x39/0x4e + [] ? 0xd88cdfff + [] sock_sendpage+0x37/0x3e + [] ? kernel_sendpage+0x4e/0x4e + [] pipe_to_sendpage+0x56/0x61 + [] splice_from_pipe_feed+0x58/0xcd + [] ? splice_from_pipe_begin+0x10/0x10 + [] __splice_from_pipe+0x36/0x55 + [] ? splice_from_pipe_begin+0x10/0x10 + [] splice_from_pipe+0x51/0x64 + [] ? default_file_splice_write+0x2c/0x2c + [] generic_splice_sendpage+0x13/0x15 + [] ? splice_from_pipe_begin+0x10/0x10 + [] do_splice_from+0x5d/0x67 + [] sys_splice+0x2bf/0x363 + [] ? sysenter_exit+0xf/0x16 + [] ? trace_hardirqs_on_caller+0x10e/0x13f + [] sysenter_do_call+0x12/0x32 + Code: 83 c4 0c 5b 5e 5f c9 c3 55 b9 04 00 00 00 89 e5 57 8d 7d e4 56 53 8d 5d e4 83 ec 18 89 45 e0 89 55 dc 0f b6 70 0f c1 e6 04 01 d6 a5 be 0f 00 00 00 4e 89 d8 e8 48 ff ff ff 8b 45 e0 89 da 0f + EIP: [] gf128mul_4k_lle+0x23/0x60 [gf128mul] SS:ESP 0068:d6b8dda4 + CR2: 0000000000000670 + ---[ end trace 4eaa2a86a8e2da24 ]--- + note: hashatron[1502] exited with preempt_count 1 + BUG: scheduling while atomic: hashatron/1502/0x10000002 + INFO: lockdep is turned off. + [...] + +Signed-off-by: Nick Bowler +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/ghash-generic.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/crypto/ghash-generic.c ++++ b/crypto/ghash-generic.c +@@ -67,6 +67,9 @@ static int ghash_update(struct shash_des + struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + u8 *dst = dctx->buffer; + ++ if (!ctx->gf128) ++ return -ENOKEY; ++ + if (dctx->bytes) { + int n = min(srclen, dctx->bytes); + u8 *pos = dst + (GHASH_BLOCK_SIZE - dctx->bytes); +@@ -119,6 +122,9 @@ static int ghash_final(struct shash_desc + struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + u8 *buf = dctx->buffer; + ++ if (!ctx->gf128) ++ return -ENOKEY; ++ + ghash_flush(ctx, dctx); + memcpy(dst, buf, GHASH_BLOCK_SIZE); + diff --git a/queue-3.0/series b/queue-3.0/series index 5b037c80d1e..8a939dc7d55 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -22,3 +22,6 @@ firewire-sbp2-fix-panic-after-rmmod-with-slow-targets.patch vfs-fix-automount-for-negative-autofs-dentries.patch mm-fix-race-between-mremap-and-removing-migration-entry.patch x25-prevent-skb-overreads-when-checking-call-user-data.patch +crypto-ghash-avoid-null-pointer-dereference-if-no-key-is-set.patch +alsa-hda-conexant-support-for-lenovo-t520-w520.patch +alsa-hda-add-position_fix-quirk-for-dell-inspiron-1010.patch