From: Greg Kroah-Hartman Date: Tue, 15 Jan 2013 12:44:35 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.7.3~39 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b625e597f180c4c685934510e6e2d05e9d9a00bb;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: b43-fix-firmware-loading-when-driver-is-built-into-the-kernel.patch mac80211-fix-ibss-scanning.patch mac80211-use-del_timer_sync-for-final-sta-cleanup-timer-deletion.patch mwifiex-check-wait_event_interruptible-return-value.patch radeon-kms-force-rn50-chip-to-always-report-connected-on-analog-output.patch staging-comedi-comedi_test-fix-race-when-cancelling-command.patch staging-comedi-fix-minimum-ao-period-for-ni-625x-and-ni-628x.patch staging-comedi-prevent-auto-unconfig-of-manually-configured-devices.patch staging-r8712u-add-new-device-id.patch staging-speakup-avoid-out-of-range-access-in-synth_add.patch staging-speakup-avoid-out-of-range-access-in-synth_init.patch --- diff --git a/queue-3.4/b43-fix-firmware-loading-when-driver-is-built-into-the-kernel.patch b/queue-3.4/b43-fix-firmware-loading-when-driver-is-built-into-the-kernel.patch new file mode 100644 index 00000000000..8dc4735f4ab --- /dev/null +++ b/queue-3.4/b43-fix-firmware-loading-when-driver-is-built-into-the-kernel.patch @@ -0,0 +1,199 @@ +From 5e20a4b53094651d80f856ff55a916b999dbb57a Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Thu, 20 Dec 2012 15:55:01 -0600 +Subject: b43: Fix firmware loading when driver is built into the kernel + +From: Larry Finger + +commit 5e20a4b53094651d80f856ff55a916b999dbb57a upstream. + +Recent versions of udev cause synchronous firmware loading from the +probe routine to fail because the request to user space would time +out. The original fix for b43 (commit 6b6fa58) moved the firmware +load from the probe routine to a work queue, but it still used synchronous +firmware loading. This method is OK when b43 is built as a module; +however, it fails when the driver is compiled into the kernel. + +This version changes the code to load the initial firmware file +using request_firmware_nowait(). A completion event is used to +hold the work queue until that file is available. This driver +reads several firmware files - the remainder can be read synchronously. +On some test systems, the async read fails; however, a following synch +read works, thus the async failure falls through to the sync try. + +Reported-and-Tested by: Felix Janda +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/b43.h | 5 +++ + drivers/net/wireless/b43/main.c | 54 ++++++++++++++++++++++++++++++---------- + drivers/net/wireless/b43/main.h | 5 +-- + 3 files changed, 48 insertions(+), 16 deletions(-) + +--- a/drivers/net/wireless/b43/b43.h ++++ b/drivers/net/wireless/b43/b43.h +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + + #include "debugfs.h" +@@ -718,6 +719,10 @@ enum b43_firmware_file_type { + struct b43_request_fw_context { + /* The device we are requesting the fw for. */ + struct b43_wldev *dev; ++ /* a completion event structure needed if this call is asynchronous */ ++ struct completion fw_load_complete; ++ /* a pointer to the firmware object */ ++ const struct firmware *blob; + /* The type of firmware to request. */ + enum b43_firmware_file_type req_type; + /* Error messages for each firmware type. */ +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -2088,11 +2088,18 @@ static void b43_print_fw_helptext(struct + b43warn(wl, text); + } + ++static void b43_fw_cb(const struct firmware *firmware, void *context) ++{ ++ struct b43_request_fw_context *ctx = context; ++ ++ ctx->blob = firmware; ++ complete(&ctx->fw_load_complete); ++} ++ + int b43_do_request_fw(struct b43_request_fw_context *ctx, + const char *name, +- struct b43_firmware_file *fw) ++ struct b43_firmware_file *fw, bool async) + { +- const struct firmware *blob; + struct b43_fw_header *hdr; + u32 size; + int err; +@@ -2131,11 +2138,31 @@ int b43_do_request_fw(struct b43_request + B43_WARN_ON(1); + return -ENOSYS; + } +- err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev); ++ if (async) { ++ /* do this part asynchronously */ ++ init_completion(&ctx->fw_load_complete); ++ err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname, ++ ctx->dev->dev->dev, GFP_KERNEL, ++ ctx, b43_fw_cb); ++ if (err < 0) { ++ pr_err("Unable to load firmware\n"); ++ return err; ++ } ++ /* stall here until fw ready */ ++ wait_for_completion(&ctx->fw_load_complete); ++ if (ctx->blob) ++ goto fw_ready; ++ /* On some ARM systems, the async request will fail, but the next sync ++ * request works. For this reason, we dall through here ++ */ ++ } ++ err = request_firmware(&ctx->blob, ctx->fwname, ++ ctx->dev->dev->dev); + if (err == -ENOENT) { + snprintf(ctx->errors[ctx->req_type], + sizeof(ctx->errors[ctx->req_type]), +- "Firmware file \"%s\" not found\n", ctx->fwname); ++ "Firmware file \"%s\" not found\n", ++ ctx->fwname); + return err; + } else if (err) { + snprintf(ctx->errors[ctx->req_type], +@@ -2144,14 +2171,15 @@ int b43_do_request_fw(struct b43_request + ctx->fwname, err); + return err; + } +- if (blob->size < sizeof(struct b43_fw_header)) ++fw_ready: ++ if (ctx->blob->size < sizeof(struct b43_fw_header)) + goto err_format; +- hdr = (struct b43_fw_header *)(blob->data); ++ hdr = (struct b43_fw_header *)(ctx->blob->data); + switch (hdr->type) { + case B43_FW_TYPE_UCODE: + case B43_FW_TYPE_PCM: + size = be32_to_cpu(hdr->size); +- if (size != blob->size - sizeof(struct b43_fw_header)) ++ if (size != ctx->blob->size - sizeof(struct b43_fw_header)) + goto err_format; + /* fallthrough */ + case B43_FW_TYPE_IV: +@@ -2162,7 +2190,7 @@ int b43_do_request_fw(struct b43_request + goto err_format; + } + +- fw->data = blob; ++ fw->data = ctx->blob; + fw->filename = name; + fw->type = ctx->req_type; + +@@ -2172,7 +2200,7 @@ err_format: + snprintf(ctx->errors[ctx->req_type], + sizeof(ctx->errors[ctx->req_type]), + "Firmware file \"%s\" format error.\n", ctx->fwname); +- release_firmware(blob); ++ release_firmware(ctx->blob); + + return -EPROTO; + } +@@ -2223,7 +2251,7 @@ static int b43_try_request_fw(struct b43 + goto err_no_ucode; + } + } +- err = b43_do_request_fw(ctx, filename, &fw->ucode); ++ err = b43_do_request_fw(ctx, filename, &fw->ucode, true); + if (err) + goto err_load; + +@@ -2235,7 +2263,7 @@ static int b43_try_request_fw(struct b43 + else + goto err_no_pcm; + fw->pcm_request_failed = false; +- err = b43_do_request_fw(ctx, filename, &fw->pcm); ++ err = b43_do_request_fw(ctx, filename, &fw->pcm, false); + if (err == -ENOENT) { + /* We did not find a PCM file? Not fatal, but + * core rev <= 10 must do without hwcrypto then. */ +@@ -2296,7 +2324,7 @@ static int b43_try_request_fw(struct b43 + default: + goto err_no_initvals; + } +- err = b43_do_request_fw(ctx, filename, &fw->initvals); ++ err = b43_do_request_fw(ctx, filename, &fw->initvals, false); + if (err) + goto err_load; + +@@ -2355,7 +2383,7 @@ static int b43_try_request_fw(struct b43 + default: + goto err_no_initvals; + } +- err = b43_do_request_fw(ctx, filename, &fw->initvals_band); ++ err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false); + if (err) + goto err_load; + +--- a/drivers/net/wireless/b43/main.h ++++ b/drivers/net/wireless/b43/main.h +@@ -137,9 +137,8 @@ void b43_mac_phy_clock_set(struct b43_wl + + + struct b43_request_fw_context; +-int b43_do_request_fw(struct b43_request_fw_context *ctx, +- const char *name, +- struct b43_firmware_file *fw); ++int b43_do_request_fw(struct b43_request_fw_context *ctx, const char *name, ++ struct b43_firmware_file *fw, bool async); + void b43_do_release_fw(struct b43_firmware_file *fw); + + #endif /* B43_MAIN_H_ */ diff --git a/queue-3.4/mac80211-fix-ibss-scanning.patch b/queue-3.4/mac80211-fix-ibss-scanning.patch new file mode 100644 index 00000000000..8b24c40fe87 --- /dev/null +++ b/queue-3.4/mac80211-fix-ibss-scanning.patch @@ -0,0 +1,130 @@ +From 34bcf71502413f8903ade93746f2d0f04b937a78 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 11 Dec 2012 10:48:23 +0100 +Subject: mac80211: fix ibss scanning + +From: Stanislaw Gruszka + +commit 34bcf71502413f8903ade93746f2d0f04b937a78 upstream. + +Do not scan on no-IBSS and disabled channels in IBSS mode. Doing this +can trigger Microcode errors on iwlwifi and iwlegacy drivers. + +Also rename ieee80211_request_internal_scan() function since it is only +used in IBSS mode and simplify calling it from ieee80211_sta_find_ibss(). + +This patch should address: +https://bugzilla.redhat.com/show_bug.cgi?id=883414 +https://bugzilla.kernel.org/show_bug.cgi?id=49411 + +Reported-by: Jesse Kahtava +Reported-by: Mikko Rapeli +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ibss.c | 9 ++++----- + net/mac80211/ieee80211_i.h | 6 +++--- + net/mac80211/scan.c | 34 ++++++++++++++++++++++++---------- + 3 files changed, 31 insertions(+), 18 deletions(-) + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -664,8 +664,8 @@ static void ieee80211_sta_merge_ibss(str + printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other " + "IBSS networks with same SSID (merge)\n", sdata->name); + +- ieee80211_request_internal_scan(sdata, +- ifibss->ssid, ifibss->ssid_len, NULL); ++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len, ++ NULL); + } + + static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata) +@@ -772,9 +772,8 @@ static void ieee80211_sta_find_ibss(stru + printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to " + "join\n", sdata->name); + +- ieee80211_request_internal_scan(sdata, +- ifibss->ssid, ifibss->ssid_len, +- ifibss->fixed_channel ? ifibss->channel : NULL); ++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ++ ifibss->ssid_len, chan); + } else { + int interval = IEEE80211_SCAN_INTERVAL; + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1233,9 +1233,9 @@ void ieee80211_mesh_rx_queued_mgmt(struc + + /* scan/BSS handling */ + void ieee80211_scan_work(struct work_struct *work); +-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, +- const u8 *ssid, u8 ssid_len, +- struct ieee80211_channel *chan); ++int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata, ++ const u8 *ssid, u8 ssid_len, ++ struct ieee80211_channel *chan); + int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata, + struct cfg80211_scan_request *req); + void ieee80211_scan_cancel(struct ieee80211_local *local); +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -761,9 +761,9 @@ int ieee80211_request_scan(struct ieee80 + return res; + } + +-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, +- const u8 *ssid, u8 ssid_len, +- struct ieee80211_channel *chan) ++int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata, ++ const u8 *ssid, u8 ssid_len, ++ struct ieee80211_channel *chan) + { + struct ieee80211_local *local = sdata->local; + int ret = -EBUSY; +@@ -777,22 +777,36 @@ int ieee80211_request_internal_scan(stru + + /* fill internal scan request */ + if (!chan) { +- int i, nchan = 0; ++ int i, max_n; ++ int n_ch = 0; + + for (band = 0; band < IEEE80211_NUM_BANDS; band++) { + if (!local->hw.wiphy->bands[band]) + continue; +- for (i = 0; +- i < local->hw.wiphy->bands[band]->n_channels; +- i++) { +- local->int_scan_req->channels[nchan] = ++ ++ max_n = local->hw.wiphy->bands[band]->n_channels; ++ for (i = 0; i < max_n; i++) { ++ struct ieee80211_channel *tmp_ch = + &local->hw.wiphy->bands[band]->channels[i]; +- nchan++; ++ ++ if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS | ++ IEEE80211_CHAN_DISABLED)) ++ continue; ++ ++ local->int_scan_req->channels[n_ch] = tmp_ch; ++ n_ch++; + } + } + +- local->int_scan_req->n_channels = nchan; ++ if (WARN_ON_ONCE(n_ch == 0)) ++ goto unlock; ++ ++ local->int_scan_req->n_channels = n_ch; + } else { ++ if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS | ++ IEEE80211_CHAN_DISABLED))) ++ goto unlock; ++ + local->int_scan_req->channels[0] = chan; + local->int_scan_req->n_channels = 1; + } diff --git a/queue-3.4/mac80211-use-del_timer_sync-for-final-sta-cleanup-timer-deletion.patch b/queue-3.4/mac80211-use-del_timer_sync-for-final-sta-cleanup-timer-deletion.patch new file mode 100644 index 00000000000..1cdfeb9a0a0 --- /dev/null +++ b/queue-3.4/mac80211-use-del_timer_sync-for-final-sta-cleanup-timer-deletion.patch @@ -0,0 +1,35 @@ +From a56f992cdabc63f56b4b142885deebebf936ff76 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 13 Dec 2012 23:08:52 +0100 +Subject: mac80211: use del_timer_sync for final sta cleanup timer deletion + +From: Johannes Berg + +commit a56f992cdabc63f56b4b142885deebebf936ff76 upstream. + +This is a very old bug, but there's nothing that prevents the +timer from running while the module is being removed when we +only do del_timer() instead of del_timer_sync(). + +The timer should normally not be running at this point, but +it's not clearly impossible (or we could just remove this.) + +Tested-by: Ben Greear +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/sta_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -844,7 +844,7 @@ void sta_info_init(struct ieee80211_loca + + void sta_info_stop(struct ieee80211_local *local) + { +- del_timer(&local->sta_cleanup); ++ del_timer_sync(&local->sta_cleanup); + sta_info_flush(local, NULL); + } + diff --git a/queue-3.4/mwifiex-check-wait_event_interruptible-return-value.patch b/queue-3.4/mwifiex-check-wait_event_interruptible-return-value.patch new file mode 100644 index 00000000000..3444512511b --- /dev/null +++ b/queue-3.4/mwifiex-check-wait_event_interruptible-return-value.patch @@ -0,0 +1,73 @@ +From 9c969d8ccb1e17bd20742f4ac9f00c1a64487234 Mon Sep 17 00:00:00 2001 +From: Bing Zhao +Date: Wed, 2 Jan 2013 16:07:35 -0800 +Subject: mwifiex: check wait_event_interruptible return value + +From: Bing Zhao + +commit 9c969d8ccb1e17bd20742f4ac9f00c1a64487234 upstream. + +wait_event_interruptible function returns -ERESTARTSYS if it's +interrupted by a signal. Driver should check the return value +and handle this case properly. + +In mwifiex_wait_queue_complete() routine, as we are now checking +wait_event_interruptible return value, the condition check is not +required. Also, we have removed mwifiex_cancel_pending_ioctl() +call to avoid a chance of sending second command to FW by other path +as soon as we clear current command node. FW can not handle two +commands simultaneously. + +Signed-off-by: Bing Zhao +Signed-off-by: Amitkumar Karwar +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/sta_ioctl.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c +@@ -53,7 +53,6 @@ int mwifiex_copy_mcast_addr(struct mwifi + */ + int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter) + { +- bool cancel_flag = false; + int status; + struct cmd_ctrl_node *cmd_queued; + +@@ -70,14 +69,11 @@ int mwifiex_wait_queue_complete(struct m + queue_work(adapter->workqueue, &adapter->main_work); + + /* Wait for completion */ +- wait_event_interruptible(adapter->cmd_wait_q.wait, +- *(cmd_queued->condition)); +- if (!*(cmd_queued->condition)) +- cancel_flag = true; +- +- if (cancel_flag) { +- mwifiex_cancel_pending_ioctl(adapter); +- dev_dbg(adapter->dev, "cmd cancel\n"); ++ status = wait_event_interruptible(adapter->cmd_wait_q.wait, ++ *(cmd_queued->condition)); ++ if (status) { ++ dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status); ++ return status; + } + + status = adapter->cmd_wait_q.status; +@@ -436,8 +432,11 @@ int mwifiex_enable_hs(struct mwifiex_ada + return false; + } + +- wait_event_interruptible(adapter->hs_activate_wait_q, +- adapter->hs_activate_wait_q_woken); ++ if (wait_event_interruptible(adapter->hs_activate_wait_q, ++ adapter->hs_activate_wait_q_woken)) { ++ dev_err(adapter->dev, "hs_activate_wait_q terminated\n"); ++ return false; ++ } + + return true; + } diff --git a/queue-3.4/radeon-kms-force-rn50-chip-to-always-report-connected-on-analog-output.patch b/queue-3.4/radeon-kms-force-rn50-chip-to-always-report-connected-on-analog-output.patch new file mode 100644 index 00000000000..b610592e8b6 --- /dev/null +++ b/queue-3.4/radeon-kms-force-rn50-chip-to-always-report-connected-on-analog-output.patch @@ -0,0 +1,38 @@ +From 51861d4eebc2ddc25c77084343d060fa79f6e291 Mon Sep 17 00:00:00 2001 +From: Jerome Glisse +Date: Tue, 8 Jan 2013 18:41:01 -0500 +Subject: radeon/kms: force rn50 chip to always report connected on analog output + +From: Jerome Glisse + +commit 51861d4eebc2ddc25c77084343d060fa79f6e291 upstream. + +Those rn50 chip are often connected to console remoting hw and load +detection often fails with those. Just don't try to load detect and +report connect. + +Signed-off-by: Jerome Glisse +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c ++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c +@@ -617,6 +617,14 @@ static enum drm_connector_status radeon_ + enum drm_connector_status found = connector_status_disconnected; + bool color = true; + ++ /* just don't bother on RN50 those chip are often connected to remoting ++ * console hw and often we get failure to load detect those. So to make ++ * everyone happy report the encoder as always connected. ++ */ ++ if (ASIC_IS_RN50(rdev)) { ++ return connector_status_connected; ++ } ++ + /* save the regs we need */ + vclk_ecp_cntl = RREG32_PLL(RADEON_VCLK_ECP_CNTL); + crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL); diff --git a/queue-3.4/series b/queue-3.4/series index dae46e5b892..46aca219332 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -77,3 +77,14 @@ udldrmfb-udl_get_edid-usb_control_msg-buffer-must-not-be-on-the-stack.patch udldrmfb-udl_get_edid-drop-unneeded-i.patch alsa-pxa27x-fix-ac97-cold-reset.patch alsa-pxa27x-fix-ac97-warm-reset.patch +staging-comedi-prevent-auto-unconfig-of-manually-configured-devices.patch +staging-comedi-fix-minimum-ao-period-for-ni-625x-and-ni-628x.patch +staging-comedi-comedi_test-fix-race-when-cancelling-command.patch +staging-r8712u-add-new-device-id.patch +staging-speakup-avoid-out-of-range-access-in-synth_init.patch +staging-speakup-avoid-out-of-range-access-in-synth_add.patch +radeon-kms-force-rn50-chip-to-always-report-connected-on-analog-output.patch +mac80211-fix-ibss-scanning.patch +mac80211-use-del_timer_sync-for-final-sta-cleanup-timer-deletion.patch +mwifiex-check-wait_event_interruptible-return-value.patch +b43-fix-firmware-loading-when-driver-is-built-into-the-kernel.patch diff --git a/queue-3.4/staging-comedi-comedi_test-fix-race-when-cancelling-command.patch b/queue-3.4/staging-comedi-comedi_test-fix-race-when-cancelling-command.patch new file mode 100644 index 00000000000..68f40e96c83 --- /dev/null +++ b/queue-3.4/staging-comedi-comedi_test-fix-race-when-cancelling-command.patch @@ -0,0 +1,45 @@ +From c0729eeefdcd76db338f635162bf0739fd2c5f6f Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 4 Jan 2013 11:33:21 +0000 +Subject: staging: comedi: comedi_test: fix race when cancelling command + +From: Ian Abbott + +commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream. + +Éric Piel reported a kernel oops in the "comedi_test" module. It was a +NULL pointer dereference within `waveform_ai_interrupt()` (actually a +timer function) that sometimes occurred when a running asynchronous +command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing +the device file). + +This seems to be a race between the caller of `waveform_ai_cancel()` +which on return from that function goes and tears down the running +command, and the timer function which uses the command. In particular, +`async->cmd.chanlist` gets freed (and the pointer set to NULL) by +`do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled +`waveform_ai_interrupt()` timer function will dereference that pointer +regardless, leading to the oops. + +Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()` +with `del_timer_sync()`. + +Signed-off-by: Ian Abbott +Reported-by: Éric Piel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/comedi_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/comedi_test.c ++++ b/drivers/staging/comedi/drivers/comedi_test.c +@@ -461,7 +461,7 @@ static int waveform_ai_cancel(struct com + struct comedi_subdevice *s) + { + devpriv->timer_running = 0; +- del_timer(&devpriv->timer); ++ del_timer_sync(&devpriv->timer); + return 0; + } + diff --git a/queue-3.4/staging-comedi-fix-minimum-ao-period-for-ni-625x-and-ni-628x.patch b/queue-3.4/staging-comedi-fix-minimum-ao-period-for-ni-625x-and-ni-628x.patch new file mode 100644 index 00000000000..22d1b5ce1b3 --- /dev/null +++ b/queue-3.4/staging-comedi-fix-minimum-ao-period-for-ni-625x-and-ni-628x.patch @@ -0,0 +1,103 @@ +From 34b55d8c48f4f76044d8f4d6ec3dc786cf210312 Mon Sep 17 00:00:00 2001 +From: Éric Piel +Date: Wed, 19 Dec 2012 13:03:13 +0100 +Subject: staging: comedi: fix minimum AO period for NI 625x and NI 628x + +From: Éric Piel + +commit 34b55d8c48f4f76044d8f4d6ec3dc786cf210312 upstream. + +The minimum period was set to 357 ns, while the divider for these boards is 50 +ns. This prevented to output at maximum speed as ni_ao_cmdtest() would return +357 but would not accept it. + +Not sure why it was set to 357 ns (this was done before the git history, +which starts 5 years ago). My guess is that it comes from reading the +specification stating a 2.8 MHz rate (~ 357 ns). The latest +specification states a 2.86 MHz rate (~ 350 ns), which makes a lot +more sense. + +Tested on a pci-6251. + +Signed-off-by: Éric Piel +Acked-By: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/ni_pcimio.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/staging/comedi/drivers/ni_pcimio.c ++++ b/drivers/staging/comedi/drivers/ni_pcimio.c +@@ -1023,7 +1023,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_625x_ao, + .reg_type = ni_reg_625x, + .ao_unipolar = 0, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 8, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1042,7 +1042,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_625x_ao, + .reg_type = ni_reg_625x, + .ao_unipolar = 0, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 8, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1061,7 +1061,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_625x_ao, + .reg_type = ni_reg_625x, + .ao_unipolar = 0, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 8, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1097,7 +1097,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_625x_ao, + .reg_type = ni_reg_625x, + .ao_unipolar = 0, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 32, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1116,7 +1116,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_625x_ao, + .reg_type = ni_reg_625x, + .ao_unipolar = 0, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 32, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1152,7 +1152,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_628x_ao, + .reg_type = ni_reg_628x, + .ao_unipolar = 1, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 8, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1171,7 +1171,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_628x_ao, + .reg_type = ni_reg_628x, + .ao_unipolar = 1, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 8, + .caldac = {caldac_none}, + .has_8255 = 0, +@@ -1207,7 +1207,7 @@ static const struct ni_board_struct ni_b + .ao_range_table = &range_ni_M_628x_ao, + .reg_type = ni_reg_628x, + .ao_unipolar = 1, +- .ao_speed = 357, ++ .ao_speed = 350, + .num_p0_dio_channels = 32, + .caldac = {caldac_none}, + .has_8255 = 0, diff --git a/queue-3.4/staging-comedi-prevent-auto-unconfig-of-manually-configured-devices.patch b/queue-3.4/staging-comedi-prevent-auto-unconfig-of-manually-configured-devices.patch new file mode 100644 index 00000000000..7390739214b --- /dev/null +++ b/queue-3.4/staging-comedi-prevent-auto-unconfig-of-manually-configured-devices.patch @@ -0,0 +1,48 @@ +From 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Tue, 4 Dec 2012 15:59:55 +0000 +Subject: staging: comedi: prevent auto-unconfig of manually configured devices + +From: Ian Abbott + +commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c upstream. + +When a low-level comedi driver auto-configures a device, a `struct +comedi_dev_file_info` is allocated (as well as a `struct +comedi_device`) by `comedi_alloc_board_minor()`. A pointer to the +hardware `struct device` is stored as a cookie in the `struct +comedi_dev_file_info`. When the low-level comedi driver +auto-unconfigures the device, `comedi_auto_unconfig()` uses the cookie +to find the `struct comedi_dev_file_info` so it can detach the comedi +device from the driver, clean it up and free it. + +A problem arises if the user manually unconfigures and reconfigures the +comedi device using the `COMEDI_DEVCONFIG` ioctl so that is no longer +associated with the original hardware device. The problem is that the +cookie is not cleared, so that a call to `comedi_auto_unconfig()` from +the low-level driver will still find it, detach it, clean it up and free +it. + +Stop this problem occurring by always clearing the `hardware_device` +cookie in the `struct comedi_dev_file_info` whenever the +`COMEDI_DEVCONFIG` ioctl call is successful. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -138,6 +138,9 @@ static long comedi_unlocked_ioctl(struct + if (cmd == COMEDI_DEVCONFIG) { + rc = do_devconfig_ioctl(dev, + (struct comedi_devconfig __user *)arg); ++ if (rc == 0) ++ /* Evade comedi_auto_unconfig(). */ ++ dev_file_info->hardware_device = NULL; + goto done; + } + diff --git a/queue-3.4/staging-r8712u-add-new-device-id.patch b/queue-3.4/staging-r8712u-add-new-device-id.patch new file mode 100644 index 00000000000..adb86d7c87f --- /dev/null +++ b/queue-3.4/staging-r8712u-add-new-device-id.patch @@ -0,0 +1,32 @@ +From da849a92d3bafaf24d770e971c2c9e5c3f60b5d1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sat, 29 Dec 2012 11:36:53 -0600 +Subject: staging: r8712u: Add new device ID + +From: Larry Finger + +commit da849a92d3bafaf24d770e971c2c9e5c3f60b5d1 upstream. + +The ISY IWL 1000 USB WLAN stick with USB ID 050d:11f1 is a clone of +the Belkin F7D1101 V1 device. + +Reported-by: Thomas Hartmann +Signed-off-by: Larry Finger +Cc: Thomas Hartmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/usb_intf.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -66,6 +66,8 @@ static struct usb_device_id rtl871x_usb_ + {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */ + /* Belkin */ + {USB_DEVICE(0x050D, 0x945A)}, ++ /* ISY IWL - Belkin clone */ ++ {USB_DEVICE(0x050D, 0x11F1)}, + /* Corega */ + {USB_DEVICE(0x07AA, 0x0047)}, + /* D-Link */ diff --git a/queue-3.4/staging-speakup-avoid-out-of-range-access-in-synth_add.patch b/queue-3.4/staging-speakup-avoid-out-of-range-access-in-synth_add.patch new file mode 100644 index 00000000000..26b556d4554 --- /dev/null +++ b/queue-3.4/staging-speakup-avoid-out-of-range-access-in-synth_add.patch @@ -0,0 +1,30 @@ +From 6102c48bd421074a33e102f2ebda3724e8d275f9 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Mon, 7 Jan 2013 22:03:51 +0100 +Subject: staging: speakup: avoid out-of-range access in synth_add() + +From: Samuel Thibault + +commit 6102c48bd421074a33e102f2ebda3724e8d275f9 upstream. + +Check that array index is in-bounds before accessing the synths[] array. + +Signed-off-by: Samuel Thibault +Cc: Nickolai Zeldovich +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/speakup/synth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/speakup/synth.c ++++ b/drivers/staging/speakup/synth.c +@@ -423,7 +423,7 @@ int synth_add(struct spk_synth *in_synth + int i; + int status = 0; + mutex_lock(&spk_mutex); +- for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++) ++ for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++) + /* synth_remove() is responsible for rotating the array down */ + if (in_synth == synths[i]) { + mutex_unlock(&spk_mutex); diff --git a/queue-3.4/staging-speakup-avoid-out-of-range-access-in-synth_init.patch b/queue-3.4/staging-speakup-avoid-out-of-range-access-in-synth_init.patch new file mode 100644 index 00000000000..0cd3e613d8e --- /dev/null +++ b/queue-3.4/staging-speakup-avoid-out-of-range-access-in-synth_init.patch @@ -0,0 +1,30 @@ +From ae428655b826f2755a8101b27beda42a275ef8ad Mon Sep 17 00:00:00 2001 +From: Nickolai Zeldovich +Date: Sat, 5 Jan 2013 14:17:45 -0500 +Subject: staging: speakup: avoid out-of-range access in synth_init() + +From: Nickolai Zeldovich + +commit ae428655b826f2755a8101b27beda42a275ef8ad upstream. + +Check that array index is in-bounds before accessing the synths[] array. + +Signed-off-by: Nickolai Zeldovich +Cc: Samuel Thibault +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/speakup/synth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/speakup/synth.c ++++ b/drivers/staging/speakup/synth.c +@@ -342,7 +342,7 @@ int synth_init(char *synth_name) + + mutex_lock(&spk_mutex); + /* First, check if we already have it loaded. */ +- for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++) ++ for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++) + if (strcmp(synths[i]->name, synth_name) == 0) + synth = synths[i]; +