From: Greg Kroah-Hartman Date: Fri, 27 Jun 2014 22:38:54 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.96~36 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fe4c1b28ab677b1ea24c42483bde8149cf9d6973;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: media-ivtv-fix-oops-when-no-firmware-is-loaded.patch media-stk1160-avoid-stack-allocated-buffer-for-control-urbs.patch usb-serial-fix-potential-runtime-pm-imbalance-at-device-remove.patch --- diff --git a/queue-3.10/media-ivtv-fix-oops-when-no-firmware-is-loaded.patch b/queue-3.10/media-ivtv-fix-oops-when-no-firmware-is-loaded.patch new file mode 100644 index 00000000000..2f71b31e6a9 --- /dev/null +++ b/queue-3.10/media-ivtv-fix-oops-when-no-firmware-is-loaded.patch @@ -0,0 +1,61 @@ +From deb29e90221a6d4417aa67be971613c353180331 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 5 May 2014 11:20:05 -0300 +Subject: media: ivtv: Fix Oops when no firmware is loaded + +From: Takashi Iwai + +commit deb29e90221a6d4417aa67be971613c353180331 upstream. + +When ivtv PCM device is accessed at the state where no firmware is +loaded, it oopses like: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 + IP: [] try_mailbox.isra.0+0x11/0x50 [ivtv] + Call Trace: + [] ivtv_api_call+0x160/0x6b0 [ivtv] + [] ivtv_api+0x16/0x40 [ivtv] + [] ivtv_vapi+0xac/0xc0 [ivtv] + [] ivtv_start_v4l2_encode_stream+0x19d/0x630 [ivtv] + [] snd_ivtv_pcm_capture_open+0x173/0x1c0 [ivtv_alsa] + [] snd_pcm_open_substream+0x51/0x100 [snd_pcm] + [] snd_pcm_open+0xb3/0x260 [snd_pcm] + [] snd_pcm_capture_open+0x37/0x50 [snd_pcm] + [] snd_open+0xa7/0x1e0 [snd] + [] chrdev_open+0x88/0x1d0 + [] do_dentry_open+0x1de/0x270 + [] do_last+0x1c3/0xec0 + [] path_openat+0xb6/0x670 + [] do_filp_open+0x35/0x80 + [] do_sys_open+0x129/0x210 + [] system_call_fastpath+0x1a/0x1f + +This patch adds the check of firmware at PCM open callback like other +open callbacks of this driver. + +Bugzilla: https://apibugzilla.novell.com/show_bug.cgi?id=875440 + +Signed-off-by: Takashi Iwai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c ++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c +@@ -159,6 +159,12 @@ static int snd_ivtv_pcm_capture_open(str + + /* Instruct the CX2341[56] to start sending packets */ + snd_ivtv_lock(itvsc); ++ ++ if (ivtv_init_on_first_open(itv)) { ++ snd_ivtv_unlock(itvsc); ++ return -ENXIO; ++ } ++ + s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM]; + + v4l2_fh_init(&item.fh, s->vdev); diff --git a/queue-3.10/media-stk1160-avoid-stack-allocated-buffer-for-control-urbs.patch b/queue-3.10/media-stk1160-avoid-stack-allocated-buffer-for-control-urbs.patch new file mode 100644 index 00000000000..8e486999478 --- /dev/null +++ b/queue-3.10/media-stk1160-avoid-stack-allocated-buffer-for-control-urbs.patch @@ -0,0 +1,70 @@ +From 85ac1a1772bb41da895bad83a81f6a62c8f293f6 Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Thu, 17 Apr 2014 09:28:20 -0300 +Subject: media: stk1160: Avoid stack-allocated buffer for control URBs + +From: Ezequiel Garcia + +commit 85ac1a1772bb41da895bad83a81f6a62c8f293f6 upstream. + +Currently stk1160_read_reg() uses a stack-allocated char to get the +read control value. This is wrong because usb_control_msg() requires +a kmalloc-ed buffer. + +This commit fixes such issue by kmalloc'ating a 1-byte buffer to receive +the read value. + +While here, let's remove the urb_buf array which was meant for a similar +purpose, but never really used. + +Cc: Alan Stern +Reported-by: Sander Eikelenboom +Signed-off-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/stk1160/stk1160-core.c | 10 +++++++++- + drivers/media/usb/stk1160/stk1160.h | 1 - + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -67,17 +67,25 @@ int stk1160_read_reg(struct stk1160 *dev + { + int ret; + int pipe = usb_rcvctrlpipe(dev->udev, 0); ++ u8 *buf; + + *value = 0; ++ ++ buf = kmalloc(sizeof(u8), GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; + ret = usb_control_msg(dev->udev, pipe, 0x00, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x00, reg, value, sizeof(u8), HZ); ++ 0x00, reg, buf, sizeof(u8), HZ); + if (ret < 0) { + stk1160_err("read failed on reg 0x%x (%d)\n", + reg, ret); ++ kfree(buf); + return ret; + } + ++ *value = *buf; ++ kfree(buf); + return 0; + } + +--- a/drivers/media/usb/stk1160/stk1160.h ++++ b/drivers/media/usb/stk1160/stk1160.h +@@ -143,7 +143,6 @@ struct stk1160 { + int num_alt; + + struct stk1160_isoc_ctl isoc_ctl; +- char urb_buf[255]; /* urb control msg buffer */ + + /* frame properties */ + int width; /* current frame width */ diff --git a/queue-3.10/series b/queue-3.10/series index dba3dc56bc1..970059123b4 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -37,3 +37,6 @@ usb-sierra-fix-urb-and-memory-leak-on-disconnect.patch usb-sierra-fix-remote-wakeup.patch usb-qcserial-add-netgear-aircard-341u.patch usb-qcserial-add-additional-sierra-wireless-qmi-devices.patch +usb-serial-fix-potential-runtime-pm-imbalance-at-device-remove.patch +media-ivtv-fix-oops-when-no-firmware-is-loaded.patch +media-stk1160-avoid-stack-allocated-buffer-for-control-urbs.patch diff --git a/queue-3.10/usb-serial-fix-potential-runtime-pm-imbalance-at-device-remove.patch b/queue-3.10/usb-serial-fix-potential-runtime-pm-imbalance-at-device-remove.patch new file mode 100644 index 00000000000..88cdcf006cb --- /dev/null +++ b/queue-3.10/usb-serial-fix-potential-runtime-pm-imbalance-at-device-remove.patch @@ -0,0 +1,65 @@ +From c14829fad88dbeda57253590695b85ba51270621 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 26 May 2014 19:23:33 +0200 +Subject: USB: serial: fix potential runtime pm imbalance at device remove + +From: Johan Hovold + +commit c14829fad88dbeda57253590695b85ba51270621 upstream. + +Only call usb_autopm_put_interface() if the corresponding +usb_autopm_get_interface() was successful. + +This prevents a potential runtime PM counter imbalance should +usb_autopm_get_interface() fail. Note that the USB PM usage counter is +reset when the interface is unbound, but that the runtime PM counter may +be left unbalanced. + +Also add comment on why we don't need to worry about racing +resume/suspend on autopm_get failures. + +Fixes: d5fd650cfc7f ("usb: serial: prevent suspend/resume from racing +against probe/remove") + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/bus.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/bus.c ++++ b/drivers/usb/serial/bus.c +@@ -98,13 +98,19 @@ static int usb_serial_device_remove(stru + struct usb_serial_port *port; + int retval = 0; + int minor; ++ int autopm_err; + + port = to_usb_serial_port(dev); + if (!port) + return -ENODEV; + +- /* make sure suspend/resume doesn't race against port_remove */ +- usb_autopm_get_interface(port->serial->interface); ++ /* ++ * Make sure suspend/resume doesn't race against port_remove. ++ * ++ * Note that no further runtime PM callbacks will be made if ++ * autopm_get fails. ++ */ ++ autopm_err = usb_autopm_get_interface(port->serial->interface); + + minor = port->number; + tty_unregister_device(usb_serial_tty_driver, minor); +@@ -118,7 +124,9 @@ static int usb_serial_device_remove(stru + dev_info(dev, "%s converter now disconnected from ttyUSB%d\n", + driver->description, minor); + +- usb_autopm_put_interface(port->serial->interface); ++ if (!autopm_err) ++ usb_autopm_put_interface(port->serial->interface); ++ + return retval; + } +