--- /dev/null
+From a36c2638380c0a4676647a1f553b70b20d3ebce1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 22 Dec 2017 10:45:07 +0100
+Subject: ALSA: hda: Drop useless WARN_ON()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a36c2638380c0a4676647a1f553b70b20d3ebce1 upstream.
+
+Since the commit 97cc2ed27e5a ("ALSA: hda - Fix yet another i915
+pointer leftover in error path") cleared hdac_acomp pointer, the
+WARN_ON() non-NULL check in snd_hdac_i915_register_notifier() may give
+a false-positive warning, as the function gets called no matter
+whether the component is registered or not. For fixing it, let's get
+rid of the spurious WARN_ON().
+
+Fixes: 97cc2ed27e5a ("ALSA: hda - Fix yet another i915 pointer leftover in error path")
+Reported-by: Kouta Okamoto <kouta.okamoto@toshiba.co.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/hda/hdac_i915.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -319,7 +319,7 @@ static int hdac_component_master_match(s
+ */
+ int snd_hdac_i915_register_notifier(const struct i915_audio_component_audio_ops *aops)
+ {
+- if (WARN_ON(!hdac_acomp))
++ if (!hdac_acomp)
+ return -ENODEV;
+
+ hdac_acomp->audio_ops = aops;
--- /dev/null
+From 285d5ddcffafa5d5e68c586f4c9eaa8b24a2897d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 22 Dec 2017 11:17:45 +0800
+Subject: ALSA: hda - fix headset mic detection issue on a Dell machine
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 285d5ddcffafa5d5e68c586f4c9eaa8b24a2897d upstream.
+
+It has the codec alc256, and add its pin definition to pin quirk
+table to let it apply ALC255_FIXUP_DELL1_MIC_NO_PRESENCE.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5972,6 +5972,11 @@ static const struct snd_hda_pin_quirk al
+ {0x1b, 0x01011020},
+ {0x21, 0x02211010}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x12, 0x90a60130},
++ {0x14, 0x90170110},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60160},
+ {0x14, 0x90170120},
+ {0x21, 0x02211030}),
--- /dev/null
+From bc6476d6c1edcb9b97621b5131bd169aa81f27db Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Nov 2017 12:12:55 +0100
+Subject: ASoC: da7218: fix fix child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit bc6476d6c1edcb9b97621b5131bd169aa81f27db upstream.
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent codec node was also prematurely freed.
+
+Fixes: 4d50934abd22 ("ASoC: da7218: Add da7218 codec driver")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/da7218.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/da7218.c
++++ b/sound/soc/codecs/da7218.c
+@@ -2519,7 +2519,7 @@ static struct da7218_pdata *da7218_of_to
+ }
+
+ if (da7218->dev_id == DA7218_DEV_ID) {
+- hpldet_np = of_find_node_by_name(np, "da7218_hpldet");
++ hpldet_np = of_get_child_by_name(np, "da7218_hpldet");
+ if (!hpldet_np)
+ return pdata;
+
--- /dev/null
+From 695b78b548d8a26288f041e907ff17758df9e1d5 Mon Sep 17 00:00:00 2001
+From: "Maciej S. Szmigiero" <mail@maciej.szmigiero.name>
+Date: Mon, 20 Nov 2017 23:14:55 +0100
+Subject: ASoC: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure
+
+From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+
+commit 695b78b548d8a26288f041e907ff17758df9e1d5 upstream.
+
+AC'97 ops (register read / write) need SSI regmap and clock, so they have
+to be set after them.
+
+We also need to set these ops back to NULL if we fail the probe.
+
+Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/fsl_ssi.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -1467,12 +1467,6 @@ static int fsl_ssi_probe(struct platform
+ sizeof(fsl_ssi_ac97_dai));
+
+ fsl_ac97_data = ssi_private;
+-
+- ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev);
+- if (ret) {
+- dev_err(&pdev->dev, "could not set AC'97 ops\n");
+- return ret;
+- }
+ } else {
+ /* Initialize this copy of the CPU DAI driver structure */
+ memcpy(&ssi_private->cpu_dai_drv, &fsl_ssi_dai_template,
+@@ -1583,6 +1577,14 @@ static int fsl_ssi_probe(struct platform
+ return ret;
+ }
+
++ if (fsl_ssi_is_ac97(ssi_private)) {
++ ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev);
++ if (ret) {
++ dev_err(&pdev->dev, "could not set AC'97 ops\n");
++ goto error_ac97_ops;
++ }
++ }
++
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_ssi_component,
+ &ssi_private->cpu_dai_drv, 1);
+ if (ret) {
+@@ -1666,6 +1668,10 @@ error_sound_card:
+ fsl_ssi_debugfs_remove(&ssi_private->dbg_stats);
+
+ error_asoc_register:
++ if (fsl_ssi_is_ac97(ssi_private))
++ snd_soc_set_ac97_ops(NULL);
++
++error_ac97_ops:
+ if (ssi_private->soc->imx)
+ fsl_ssi_imx_clean(pdev, ssi_private);
+
--- /dev/null
+From 737e0b7b67bdfe24090fab2852044bb283282fc5 Mon Sep 17 00:00:00 2001
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Wed, 29 Nov 2017 15:32:46 -0600
+Subject: ASoC: tlv320aic31xx: Fix GPIO1 register definition
+
+From: Andrew F. Davis <afd@ti.com>
+
+commit 737e0b7b67bdfe24090fab2852044bb283282fc5 upstream.
+
+GPIO1 control register is number 51, fix this here.
+
+Fixes: bafcbfe429eb ("ASoC: tlv320aic31xx: Make the register values human readable")
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tlv320aic31xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/tlv320aic31xx.h
++++ b/sound/soc/codecs/tlv320aic31xx.h
+@@ -115,7 +115,7 @@ struct aic31xx_pdata {
+ /* INT2 interrupt control */
+ #define AIC31XX_INT2CTRL AIC31XX_REG(0, 49)
+ /* GPIO1 control */
+-#define AIC31XX_GPIO1 AIC31XX_REG(0, 50)
++#define AIC31XX_GPIO1 AIC31XX_REG(0, 51)
+
+ #define AIC31XX_DACPRB AIC31XX_REG(0, 60)
+ /* ADC Instruction Set Register */
--- /dev/null
+From 15f8c5f2415bfac73f33a14bcd83422bcbfb5298 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Nov 2017 12:12:56 +0100
+Subject: ASoC: twl4030: fix child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 15f8c5f2415bfac73f33a14bcd83422bcbfb5298 upstream.
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent codec node was also prematurely freed,
+while the child node was leaked.
+
+Fixes: 2d6d649a2e0f ("ASoC: twl4030: Support for DT booted kernel")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/twl4030.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/twl4030.c
++++ b/sound/soc/codecs/twl4030.c
+@@ -232,7 +232,7 @@ static struct twl4030_codec_data *twl403
+ struct twl4030_codec_data *pdata = dev_get_platdata(codec->dev);
+ struct device_node *twl4030_codec_node = NULL;
+
+- twl4030_codec_node = of_find_node_by_name(codec->dev->parent->of_node,
++ twl4030_codec_node = of_get_child_by_name(codec->dev->parent->of_node,
+ "codec");
+
+ if (!pdata && twl4030_codec_node) {
+@@ -241,9 +241,11 @@ static struct twl4030_codec_data *twl403
+ GFP_KERNEL);
+ if (!pdata) {
+ dev_err(codec->dev, "Can not allocate memory\n");
++ of_node_put(twl4030_codec_node);
+ return NULL;
+ }
+ twl4030_setup_pdata_of(pdata, twl4030_codec_node);
++ of_node_put(twl4030_codec_node);
+ }
+
+ return pdata;
--- /dev/null
+From 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Fri, 8 Dec 2017 16:15:20 +0000
+Subject: ASoC: wm_adsp: Fix validation of firmware and coeff lengths
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+commit 50dd2ea8ef67a1617e0c0658bcbec4b9fb03b936 upstream.
+
+The checks for whether another region/block header could be present
+are subtracting the size from the current offset. Obviously we should
+instead subtract the offset from the size.
+
+The checks for whether the region/block data fit in the file are
+adding the data size to the current offset and header size, without
+checking for integer overflow. Rearrange these so that overflow is
+impossible.
+
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm_adsp.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1465,7 +1465,7 @@ static int wm_adsp_load(struct wm_adsp *
+ le64_to_cpu(footer->timestamp));
+
+ while (pos < firmware->size &&
+- pos - firmware->size > sizeof(*region)) {
++ sizeof(*region) < firmware->size - pos) {
+ region = (void *)&(firmware->data[pos]);
+ region_name = "Unknown";
+ reg = 0;
+@@ -1526,8 +1526,8 @@ static int wm_adsp_load(struct wm_adsp *
+ regions, le32_to_cpu(region->len), offset,
+ region_name);
+
+- if ((pos + le32_to_cpu(region->len) + sizeof(*region)) >
+- firmware->size) {
++ if (le32_to_cpu(region->len) >
++ firmware->size - pos - sizeof(*region)) {
+ adsp_err(dsp,
+ "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+ file, regions, region_name,
+@@ -1992,7 +1992,7 @@ static int wm_adsp_load_coeff(struct wm_
+
+ blocks = 0;
+ while (pos < firmware->size &&
+- pos - firmware->size > sizeof(*blk)) {
++ sizeof(*blk) < firmware->size - pos) {
+ blk = (void *)(&firmware->data[pos]);
+
+ type = le16_to_cpu(blk->type);
+@@ -2066,8 +2066,8 @@ static int wm_adsp_load_coeff(struct wm_
+ }
+
+ if (reg) {
+- if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) >
+- firmware->size) {
++ if (le32_to_cpu(blk->len) >
++ firmware->size - pos - sizeof(*blk)) {
+ adsp_err(dsp,
+ "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+ file, blocks, region_name,
--- /dev/null
+From f55688c45442bc863f40ad678c638785b26cdce6 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Mon, 18 Dec 2017 13:10:00 -0800
+Subject: iw_cxgb4: Only validate the MSN for successful completions
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+commit f55688c45442bc863f40ad678c638785b26cdce6 upstream.
+
+If the RECV CQE is in error, ignore the MSN check. This was causing
+recvs that were flushed into the sw cq to be completed with the wrong
+status (BAD_MSN instead of FLUSHED).
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb4/cq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -575,10 +575,10 @@ static int poll_cq(struct t4_wq *wq, str
+ ret = -EAGAIN;
+ goto skip_cqe;
+ }
+- if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) {
++ if (unlikely(!CQE_STATUS(hw_cqe) &&
++ CQE_WRID_MSN(hw_cqe) != wq->rq.msn)) {
+ t4_set_wq_in_error(wq);
+- hw_cqe->header |= htonl(CQE_STATUS_V(T4_ERR_MSN));
+- goto proc_cqe;
++ hw_cqe->header |= cpu_to_be32(CQE_STATUS_V(T4_ERR_MSN));
+ }
+ goto proc_cqe;
+ }
--- /dev/null
+From 45d8b80c2ac5d21cd1e2954431fb676bc2b1e099 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 22 Dec 2017 20:32:35 -0500
+Subject: ring-buffer: Mask out the info bits when returning buffer page length
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 45d8b80c2ac5d21cd1e2954431fb676bc2b1e099 upstream.
+
+Two info bits were added to the "commit" part of the ring buffer data page
+when returned to be consumed. This was to inform the user space readers that
+events have been missed, and that the count may be stored at the end of the
+page.
+
+What wasn't handled, was the splice code that actually called a function to
+return the length of the data in order to zero out the rest of the page
+before sending it up to user space. These data bits were returned with the
+length making the value negative, and that negative value was not checked.
+It was compared to PAGE_SIZE, and only used if the size was less than
+PAGE_SIZE. Luckily PAGE_SIZE is unsigned long which made the compare an
+unsigned compare, meaning the negative size value did not end up causing a
+large portion of memory to be randomly zeroed out.
+
+Fixes: 66a8cb95ed040 ("ring-buffer: Add place holder recording of dropped events")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -280,6 +280,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data
+ /* Missed count stored at end */
+ #define RB_MISSED_STORED (1 << 30)
+
++#define RB_MISSED_FLAGS (RB_MISSED_EVENTS|RB_MISSED_STORED)
++
+ struct buffer_data_page {
+ u64 time_stamp; /* page time stamp */
+ local_t commit; /* write committed index */
+@@ -331,7 +333,9 @@ static void rb_init_page(struct buffer_d
+ */
+ size_t ring_buffer_page_len(void *page)
+ {
+- return local_read(&((struct buffer_data_page *)page)->commit)
++ struct buffer_data_page *bpage = page;
++
++ return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS)
+ + BUF_PAGE_HDR_SIZE;
+ }
+
tracing-remove-extra-zeroing-out-of-the-ring-buffer-page.patch
tracing-fix-possible-double-free-on-failure-of-allocating-trace-buffer.patch
tracing-fix-crash-when-it-fails-to-alloc-ring-buffer.patch
+ring-buffer-mask-out-the-info-bits-when-returning-buffer-page-length.patch
+iw_cxgb4-only-validate-the-msn-for-successful-completions.patch
+asoc-wm_adsp-fix-validation-of-firmware-and-coeff-lengths.patch
+asoc-da7218-fix-fix-child-node-lookup.patch
+asoc-fsl_ssi-ac-97-ops-need-regmap-clock-and-cleaning-up-on-failure.patch
+asoc-twl4030-fix-child-node-lookup.patch
+asoc-tlv320aic31xx-fix-gpio1-register-definition.patch
+alsa-hda-drop-useless-warn_on.patch
+alsa-hda-fix-headset-mic-detection-issue-on-a-dell-machine.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
