--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 15 06:05:14 2007
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Oct 2007 14:37:11 +0200
+Subject: ALSA: hda-codec - Add array terminator for dmic in STAC codec
+To: stable@kernel.org
+Message-ID: <s5habqk5zbc.wl%tiwai@suse.de>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+patch f6e9852ad05fa28301c83d4e2b082620de010358 in mainline.
+
+[ALSA] hda-codec - Add array terminator for dmic in STAC codec
+
+Reported by Jan-Marek Glogowski.
+
+The dmic array is passed to snd_hda_parse_pin_def_config() and
+should be zero-terminated.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -153,8 +153,9 @@ static hda_nid_t stac925x_dac_nids[1] =
+ 0x02,
+ };
+
+-static hda_nid_t stac925x_dmic_nids[1] = {
+- 0x15,
++#define STAC925X_NUM_DMICS 1
++static hda_nid_t stac925x_dmic_nids[STAC925X_NUM_DMICS + 1] = {
++ 0x15, 0
+ };
+
+ static hda_nid_t stac922x_adc_nids[2] = {
+@@ -181,8 +182,9 @@ static hda_nid_t stac9205_mux_nids[2] =
+ 0x19, 0x1a
+ };
+
+-static hda_nid_t stac9205_dmic_nids[2] = {
+- 0x17, 0x18,
++#define STAC9205_NUM_DMICS 2
++static hda_nid_t stac9205_dmic_nids[STAC9205_NUM_DMICS + 1] = {
++ 0x17, 0x18, 0
+ };
+
+ static hda_nid_t stac9200_pin_nids[8] = {
+@@ -1972,7 +1974,7 @@ static int patch_stac925x(struct hda_cod
+ case 0x83847633: /* STAC9202D */
+ case 0x83847636: /* STAC9251 */
+ case 0x83847637: /* STAC9251D */
+- spec->num_dmics = 1;
++ spec->num_dmics = STAC925X_NUM_DMICS;
+ spec->dmic_nids = stac925x_dmic_nids;
+ break;
+ default:
+@@ -2202,7 +2204,7 @@ static int patch_stac9205(struct hda_cod
+ spec->mux_nids = stac9205_mux_nids;
+ spec->num_muxes = ARRAY_SIZE(stac9205_mux_nids);
+ spec->dmic_nids = stac9205_dmic_nids;
+- spec->num_dmics = ARRAY_SIZE(stac9205_dmic_nids);
++ spec->num_dmics = STAC9205_NUM_DMICS;
+ spec->dmux_nid = 0x1d;
+
+ spec->init = stac9205_core_init;
--- /dev/null
+From 2a3988f6d2c5be9d02463097775d1c66a8290527 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Oct 2007 14:26:32 +0200
+Subject: ALSA: hdsp - Fix zero division
+Message-ID: <b28811ef0711061446q3eb7330cm31a4c57a9ed00cc3@mail.gmail.com>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+patch 2a3988f6d2c5be9d02463097775d1c66a8290527 in mainline.
+
+Fix zero-division bug in the calculation dds offset.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Cc: Maarten Bressers <mbressers@gmail.com>
+Cc: gentoo kernel <kernel@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/rme9652/hdsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -3108,6 +3108,9 @@ static int hdsp_dds_offset(struct hdsp *
+ unsigned int dds_value = hdsp->dds_value;
+ int system_sample_rate = hdsp->system_sample_rate;
+
++ if (!dds_value)
++ return 0;
++
+ n = DDS_NUMERATOR;
+ /*
+ * dds_value = n / rate
--- /dev/null
+From a7475906bc496456ded9e4b062f94067fb93057a Mon Sep 17 00:00:00 2001
+From: Manfred Spraul <manfred@colorfullife.com>
+Date: Wed, 17 Oct 2007 21:52:33 +0200
+Subject: forcedeth msi bugfix
+Message-ID: <4716A761.5040307@garzik.org>
+
+From: Manfred Spraul <manfred@colorfullife.com>
+
+patch a7475906bc496456ded9e4b062f94067fb93057a in mainline.
+
+pci_enable_msi() replaces the INTx irq number in pci_dev->irq with the
+new MSI irq number.
+The forcedeth driver did not update the copy in netdevice->irq and
+parts of the driver used the stale copy.
+See bugzilla.kernel.org, bug 9047.
+
+The patch
+- updates netdevice->irq
+- replaces all accesses to netdevice->irq with pci_dev->irq.
+
+The patch is against 2.6.23.1. IMHO suitable for both 2.6.23 and 2.6.24
+
+Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -987,7 +987,7 @@ static void nv_enable_irq(struct net_dev
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1003,7 +1003,7 @@ static void nv_disable_irq(struct net_de
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1600,7 +1600,7 @@ static void nv_do_rx_refill(unsigned lon
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -1618,7 +1618,7 @@ static void nv_do_rx_refill(unsigned lon
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -3556,10 +3556,12 @@ static int nv_request_irq(struct net_dev
+ if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+ if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+ np->msi_flags |= NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ if (request_irq(np->pci_dev->irq, handler, IRQF_SHARED, dev->name, dev) != 0) {
+ printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+ pci_disable_msi(np->pci_dev);
+ np->msi_flags &= ~NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ goto out_err;
+ }
+
+@@ -3622,7 +3624,7 @@ static void nv_do_nic_poll(unsigned long
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq_lockdep(dev->irq);
++ disable_irq_lockdep(np->pci_dev->irq);
+ mask = np->irqmask;
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+@@ -3640,6 +3642,8 @@ static void nv_do_nic_poll(unsigned long
+ }
+ np->nic_poll_irq = 0;
+
++ /* disable_irq() contains synchronize_irq, thus no irq handler can run now */
++
+ if (np->recover_error) {
+ np->recover_error = 0;
+ printk(KERN_INFO "forcedeth: MAC in recoverable error state\n");
+@@ -3676,7 +3680,6 @@ static void nv_do_nic_poll(unsigned long
+ }
+ }
+
+- /* FIXME: Do we need synchronize_irq(dev->irq) here? */
+
+ writel(mask, base + NvRegIrqMask);
+ pci_push(base);
+@@ -3689,7 +3692,7 @@ static void nv_do_nic_poll(unsigned long
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq_lockdep(dev->irq);
++ enable_irq_lockdep(np->pci_dev->irq);
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+ nv_nic_irq_rx(0, dev);
+@@ -4943,7 +4946,7 @@ static int nv_close(struct net_device *d
+ np->in_shutdown = 1;
+ spin_unlock_irq(&np->lock);
+ netif_poll_disable(dev);
+- synchronize_irq(dev->irq);
++ synchronize_irq(np->pci_dev->irq);
+
+ del_timer_sync(&np->oom_kick);
+ del_timer_sync(&np->nic_poll);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 16 15:28:18 2007
+From: HighPoint Linux Team <linux@highpoint-tech.com>
+Date: Tue, 16 Oct 2007 14:28:24 -0700
+Subject: hptiop: avoid buffer overflow when returning sense data
+To: James.Bottomley@steeleye.com
+Cc: akpm@linux-foundation.org, linux@highpoint-tech.com, stable@kernel.org, linux-scsi@vger.kernel.org
+Message-ID: <200710162128.l9GLSORo018187@imap1.linux-foundation.org>
+
+
+From: HighPoint Linux Team <linux@highpoint-tech.com>
+
+patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline.
+
+avoid buffer overflow when returning sense data.
+
+With current adapter firmware the driver is working but future firmware
+updates may return sense data larger than 96 bytes, causing overflow on
+scp->sense_buffer and a kernel crash.
+
+This fix should be backported to earlier kernels.
+
+Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
+Signed-off-by: James Bottomley <James.Bottomley@steeleye.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/hptiop.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/hptiop.c
++++ b/drivers/scsi/hptiop.c
+@@ -377,8 +377,9 @@ static void hptiop_host_request_callback
+ scp->result = SAM_STAT_CHECK_CONDITION;
+ memset(&scp->sense_buffer,
+ 0, sizeof(scp->sense_buffer));
+- memcpy(&scp->sense_buffer,
+- &req->sg_list, le32_to_cpu(req->dataxfer_length));
++ memcpy(&scp->sense_buffer, &req->sg_list,
++ min(sizeof(scp->sense_buffer),
++ le32_to_cpu(req->dataxfer_length)));
+ break;
+
+ default:
usb-kobil_sct-trivial-backport-to-fix-libct.patch
slub-fix-memory-leak-by-not-reusing-cpu_slab.patch
fix-compat-futex-hangs.patch
+alsa-hdsp-fix-zero-division.patch
+alsa-hda-codec-add-array-terminator-for-dmic-in-stac-codec.patch
+forcedeth-msi-bugfix.patch
+hptiop-avoid-buffer-overflow-when-returning-sense-data.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
