commit 9660cc51f80ab16b415b311f5f0ee8cdea496a7c Author: Greg Kroah-Hartman Date: Mon Apr 14 06:45:17 2014 -0700 Linux 3.4.87 commit 1436b3314b5582b5d370d276afacdfed9b8fbe99 Author: Mikulas Patocka Date: Wed Dec 11 19:39:19 2013 -0500 powernow-k6: reorder frequencies commit 22c73795b101597051924556dce019385a1e2fa0 upstream. This patch reorders reported frequencies from the highest to the lowest, just like in other frequency drivers. Signed-off-by: Mikulas Patocka Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 1acb634a8af5443c41141a02d710baa91d8ec82d Author: Mikulas Patocka Date: Wed Dec 11 19:38:53 2013 -0500 powernow-k6: correctly initialize default parameters commit d82b922a4acc1781d368aceac2f9da43b038cab2 upstream. The powernow-k6 driver used to read the initial multiplier from the powernow register. However, there is a problem with this: * If there was a frequency transition before, the multiplier read from the register corresponds to the current multiplier. * If there was no frequency transition since reset, the field in the register always reads as zero, regardless of the current multiplier that is set using switches on the mainboard and that the CPU is running at. The zero value corresponds to multiplier 4.5, so as a consequence, the powernow-k6 driver always assumes multiplier 4.5. For example, if we have 550MHz CPU with bus frequency 100MHz and multiplier 5.5, the powernow-k6 driver thinks that the multiplier is 4.5 and bus frequency is 122MHz. The powernow-k6 driver then sets the multiplier to 4.5, underclocking the CPU to 450MHz, but reports the current frequency as 550MHz. There is no reliable way how to read the initial multiplier. I modified the driver so that it contains a table of known frequencies (based on parameters of existing CPUs and some common overclocking schemes) and sets the multiplier according to the frequency. If the frequency is unknown (because of unusual overclocking or underclocking), the user must supply the bus speed and maximum multiplier as module parameters. This patch should be backported to all stable kernels. If it doesn't apply cleanly, change it, or ask me to change it. Signed-off-by: Mikulas Patocka Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit cccd0fd759fa4e1306173f5740cc4ba8566e1d65 Author: Mikulas Patocka Date: Wed Dec 11 19:38:32 2013 -0500 powernow-k6: disable cache when changing frequency commit e20e1d0ac02308e2211306fc67abcd0b2668fb8b upstream. I found out that a system with k6-3+ processor is unstable during network server load. The system locks up or the network card stops receiving. The reason for the instability is the CPU frequency scaling. During frequency transition the processor is in "EPM Stop Grant" state. The documentation says that the processor doesn't respond to inquiry requests in this state. Consequently, coherency of processor caches and bus master devices is not maintained, causing the system instability. This patch flushes the cache during frequency transition. It fixes the instability. Other minor changes: * u64 invalue changed to unsigned long because the variable is 32-bit * move the logic to set the multiplier to a separate function powernow_k6_set_cpu_multiplier * preserve lower 5 bits of the powernow port instead of 4 (the voltage field has 5 bits) * mask interrupts when reading the multiplier, so that the port is not open during other activity (running other kernel code with the port open shouldn't cause any misbehavior, but we should better be safe and keep the port closed) This patch should be backported to all stable kernels. If it doesn't apply cleanly, change it, or ask me to change it. Signed-off-by: Mikulas Patocka Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit c34cad873ff38096f8710ab318b486d4e40d4293 Author: Wei Yongjun Date: Fri Oct 25 06:34:03 2013 -0300 media: saa7164: fix return value check in saa7164_initdev() commit 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 upstream. In case of error, the function kthread_run() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by: Wei Yongjun Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 96ca9726343c0166dbdbe85c0d80a95c44a0c90a Author: Alexey Khoroshilov Date: Wed Jul 3 16:17:34 2013 -0300 media: hdpvr: fix iteration over uninitialized lists in hdpvr_probe() commit 2e923a0527ac439e135b9961e58d3acd876bba10 upstream. free_buff_list and rec_buff_list are initialized in the middle of hdpvr_probe(), but if something bad happens before that, error handling code calls hdpvr_delete(), which contains iteration over the lists (via hdpvr_free_buffers()). The patch moves the lists initialization to the beginning and by the way fixes goto label in error handling of registering videodev. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 092bc21ef043d7fb4515f54ccbd17d98a20e76fb Author: Hans Verkuil Date: Tue Mar 19 09:34:58 2013 -0300 media: hdpvr: register the video node at the end of probe commit 280847b532433ffe7a22795f926327805a127162 upstream. Video nodes can be used at once after registration, so make sure the full initialization is done before registering them. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename, context] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 9ef2f22482a5a89c8ddac55c79d81b26292e59bf Author: Soeren Moch Date: Wed Jun 5 21:26:23 2013 -0300 media: dmxdev: remove dvb_ringbuffer_flush() on writer side commit 414abbd2cd4c2618895f02ed3a76ec6647281436 upstream. In dvb_ringbuffer lock-less synchronizationof reader and writer threads is done with separateread and write pointers. Sincedvb_ringbuffer_flush() modifies the read pointer, this function must not be called from the writer thread. This patch removes the dvb_ringbuffer_flush() calls in the dmxdev ringbuffer write functions, this fixes Oopses "Unable to handle kernel paging request" I could observe for the call chaindvb_demux_read ->dvb_dmxdev_buffer_read -> dvb_ringbuffer_read_user -> __copy_to_user (the reader side of the ringbuffer). The flush calls at the write side are not necessary anyway since ringbuffer_flush is also called in dvb_dmxdev_buffer_read() when an error condition is set in the ringbuffer. This patch should also be applied to stable kernels. Signed-off-by: Soeren Moch Reviewed-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 915b4b0510b5f483fd46db9154c8dc1ee9e38ddf Author: Al Viro Date: Sun Dec 16 16:04:46 2012 -0300 media: omap_vout: find_vma() needs ->mmap_sem held commit 55ee64b30a38d688232e5eb2860467dddc493573 upstream. Walking rbtree while it's modified is a Bad Idea(tm); besides, the result of find_vma() can be freed just as it's getting returned to caller. Fortunately, it's easy to fix - just take ->mmap_sem a bit earlier (and don't bother with find_vma() at all if virtp >= PAGE_OFFSET - in that case we don't even look at its result). While we are at it, what prevents VIDIOC_PREPARE_BUF calling v4l_prepare_buf() -> (e.g) vb2_ioctl_prepare_buf() -> vb2_prepare_buf() -> __buf_prepare() -> __qbuf_userptr() -> vb2_vmalloc_get_userptr() -> find_vma(), AFAICS without having taken ->mmap_sem anywhere in process? The code flow is bloody convoluted and depends on a bunch of things done by initialization, so I certainly might've missed something... Signed-off-by: Al Viro Cc: Sakari Ailus Cc: Laurent Pinchart Cc: Archit Taneja Cc: Prabhakar Lad Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit ac871a8a93556bb96e6d11931c4568f60546c50f Author: Laurent Pinchart Date: Sat Nov 24 21:35:48 2012 -0300 media: v4l: Reset subdev v4l2_dev field to NULL if registration fails commit 317efce991620adc589b3005b9baed433dcb2a56 upstream. When subdev registration fails the subdev v4l2_dev field is left to a non-NULL value. Later calls to v4l2_device_unregister_subdev() will consider the subdev as registered and will module_put() the subdev module without any matching module_get(). Fix this by setting the subdev v4l2_dev field to NULL in v4l2_device_register_subdev() when the function fails. Signed-off-by: Laurent Pinchart Acked-by: Sylwester Nawrocki Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust context, filename] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 1b8904da5aa472afbc86ba1a1c297c9bad21eb47 Author: Jacob Schloss Date: Sun Dec 9 20:18:25 2012 -0300 media: gspca_kinect: add Kinect for Windows USB id commit 98fd485795db064d0885150e2c0c7f296d8fe06e upstream. Add the USB ID for the Kinect for Windows RGB camera so it can be used with the gspca_kinect driver. Signed-off-by: Jacob Schloss Signed-off-by: Antonio Ospite Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 8d4787e99c05d0084a3a7644d8e5c04711f28970 Author: Nithin Sujir Date: Mon Jun 3 09:19:34 2013 +0000 tg3: Add read dma workaround for 5720 commit 9bc297ea0622bb2a6b3abfa2fa84f0a3b86ef8c8 upstream. Commit 091f0ea30074bc43f9250961b3247af713024bc6 "tg3: Add New 5719 Read DMA workaround" added a workaround for TX DMA stall on the 5719. This workaround needs to be applied to the 5720 as well. Reported-by: Roland Dreier Tested-by: Roland Dreier Signed-off-by: Nithin Nayak Sujir Signed-off-by: Michael Chan Signed-off-by: David S. Miller [bwh: Backported to 3.2: use GET_ASIC_REV() instead of tg3_asic_rev()] Signed-off-by: Ben Hutchings [hq: Backproted to 3.4: Adjust context] Signed-off-by: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 9e6f42f742cb5973960a89c4e94197c6f95a238b Author: Nithin Sujir Date: Mon May 13 11:04:15 2013 +0000 tg3: Skip powering down function 0 on certain serdes devices commit 44f3b503c16425c8e9db4bbaa2fc9cd0c9d0ba91 upstream. On the 5718, 5719 and 5720 serdes devices, powering down function 0 results in all the other ports being powered down. Add code to skip function 0 power down. v2: - Modify tg3_phy_power_bug() function to use a switch instead of a complicated if statement. Suggested by Joe Perches. Signed-off-by: Michael Chan Signed-off-by: Nithin Nayak Sujir Signed-off-by: David S. Miller [bwh: Backported to 3.2: s/tg3_asic_rev\(tp\)/GET_ASIC_REV(tp->pci_chip_rev_id)/] Signed-off-by: Ben Hutchings [hq: Backported to 3.4: Adjust context] Signed-off-by: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 14a7213e5390cd3f2c0cc00bf4d8caf663479b8b Author: Mauro Carvalho Chehab Date: Thu Sep 20 12:09:30 2012 -0300 sb_edac: Avoid overflow errors at memory size calculation commit deb09ddaff1435f72dd598d38f9b58354c68a5ec upstream. Sandy bridge EDAC is calculating the memory size with overflow. Basically, the size field and the integer calculation is using 32 bits. More bits are needed, when the DIMM memories have high density. The net result is that memories are improperly reported there, when high-density DIMMs are used: EDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 0, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800 EDAC DEBUG: in drivers/edac/sb_edac.c, line at 591: mc#0: channel 1, dimm 0, -16384 Mb (-4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800 As the number of pages value is handled at the EDAC core as unsigned ints, the driver shows the 16 GB memories at sysfs interface as 16760832 MB! The fix is simple: calculate the number of pages as unsigned 64-bits integer. After the patch, the memory size (16 GB) is properly detected: EDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 0, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800 EDAC DEBUG: in drivers/edac/sb_edac.c, line at 592: mc#0: channel 1, dimm 0, 16384 Mb (4194304 pages) bank: 8, rank: 2, row: 0x10000, col: 0x800 Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: - Adjust context - Debug log function is debugf0(), not edac_dbg()] Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 82d16b39266179ca80f6b81b4084631ade240219 Author: Lauri Hintsala Date: Tue Jul 17 17:16:10 2012 +0300 mmc: mxs-mmc: fix deadlock caused by recursion loop commit fc108d24d3a6da63576a460e122fa1df0cbdea20 upstream. Release the lock before mmc_signal_sdio_irq is called by mxs_mmc_enable_sdio_irq. Backtrace: [ 65.470000] ============================================= [ 65.470000] [ INFO: possible recursive locking detected ] [ 65.470000] 3.5.0-rc5 #2 Not tainted [ 65.470000] --------------------------------------------- [ 65.470000] ksdioirqd/mmc0/73 is trying to acquire lock: [ 65.470000] (&(&host->lock)->rlock#2){-.-...}, at: [] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc] [ 65.470000] [ 65.470000] but task is already holding lock: [ 65.470000] (&(&host->lock)->rlock#2){-.-...}, at: [] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc] [ 65.470000] [ 65.470000] other info that might help us debug this: [ 65.470000] Possible unsafe locking scenario: [ 65.470000] [ 65.470000] CPU0 [ 65.470000] ---- [ 65.470000] lock(&(&host->lock)->rlock#2); [ 65.470000] lock(&(&host->lock)->rlock#2); [ 65.470000] [ 65.470000] *** DEADLOCK *** [ 65.470000] [ 65.470000] May be due to missing lock nesting notation [ 65.470000] [ 65.470000] 1 lock held by ksdioirqd/mmc0/73: [ 65.470000] #0: (&(&host->lock)->rlock#2){-.-...}, at: [] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc] [ 65.470000] [ 65.470000] stack backtrace: [ 65.470000] [] (unwind_backtrace+0x0/0xf4) from [] (__lock_acquire+0x14f8/0x1b98) [ 65.470000] [] (__lock_acquire+0x14f8/0x1b98) from [] (lock_acquire+0xa0/0x108) [ 65.470000] [] (lock_acquire+0xa0/0x108) from [] (_raw_spin_lock_irqsave+0x48/0x5c) [ 65.470000] [] (_raw_spin_lock_irqsave+0x48/0x5c) from [] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) [ 65.470000] [] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) [ 65.470000] [] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [] (sdio_irq_thread+0x1bc/0x274) [ 65.470000] [] (sdio_irq_thread+0x1bc/0x274) from [] (kthread+0x8c/0x98) [ 65.470000] [] (kthread+0x8c/0x98) from [] (kernel_thread_exit+0x0/0x8) [ 65.470000] BUG: spinlock lockup suspected on CPU#0, ksdioirqd/mmc0/73 [ 65.470000] lock: 0xc3358724, .magic: dead4ead, .owner: ksdioirqd/mmc0/73, .owner_cpu: 0 [ 65.470000] [] (unwind_backtrace+0x0/0xf4) from [] (do_raw_spin_lock+0x100/0x144) [ 65.470000] [] (do_raw_spin_lock+0x100/0x144) from [] (_raw_spin_lock_irqsave+0x50/0x5c) [ 65.470000] [] (_raw_spin_lock_irqsave+0x50/0x5c) from [] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) [ 65.470000] [] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) [ 65.470000] [] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [] (sdio_irq_thread+0x1bc/0x274) [ 65.470000] [] (sdio_irq_thread+0x1bc/0x274) from [] (kthread+0x8c/0x98) [ 65.470000] [] (kthread+0x8c/0x98) from [] (kernel_thread_exit+0x0/0x8) Reported-by: Attila Kinali Signed-off-by: Lauri Hintsala Acked-by: Shawn Guo Signed-off-by: Chris Ball [bwh: Backported to 3.2: - Adjust context - HW_SSP_STATUS is a simple rather than function-like macro] Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit faf100389a5479de77294b8ebe98ec4e775d6927 Author: Grazvydas Ignotas Date: Tue Aug 21 09:09:48 2012 +0300 OMAPFB: fix framebuffer console colors commit c1c52848cef52e157468b8879fc3cae23b6f3a99 upstream. omapfb does not currently set pseudo palette correctly for color depths above 16bpp, making red text invisible, command like echo -e '\e[0;31mRED' > /dev/tty1 will display nothing on framebuffer console in 24bpp mode. This is because temporary variable is declared incorrectly, fix it. Signed-off-by: Grazvydas Ignotas Signed-off-by: Tomi Valkeinen Signed-off-by: Florian Tobias Schandinat Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit c81c26ff163b5ea3b5f9bb7d6314b263f52fdcd0 Author: Nithin Sujir Date: Wed Jun 12 11:08:59 2013 -0700 tg3: Wait for boot code to finish after power on commit df465abfe06f7dc4f33f4a96d17f096e9e8ac917 upstream. Some systems that don't need wake-on-lan may choose to power down the chip on system standby. Upon resume, the power on causes the boot code to startup and initialize the hardware. On one new platform, this is causing the device to go into a bad state due to a race between the driver and boot code, once every several hundred resumes. The same race exists on open since we come up from a power on. This patch adds a wait for boot code signature at the beginning of tg3_init_hw() which is common to both cases. If there has not been a power-off or the boot code has already completed, the signature will be present and poll_fw() returns immediately. Also return immediately if the device does not have firmware. Signed-off-by: Nithin Nayak Sujir Signed-off-by: Michael Chan Signed-off-by: David S. Miller [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 29632805c3970db57874ed668d95f7233add49ca Author: Michael Chan Date: Sun Jul 29 19:15:43 2012 +0000 tg3: Add New 5719 Read DMA workaround commit 091f0ea30074bc43f9250961b3247af713024bc6 upstream. After Power-on-reset, the 5719's TX DMA length registers may contain uninitialized values and cause TX DMA to stall. Check for invalid values and set a register bit to flush the TX channels. The bit needs to be turned off after the DMA channels have been flushed. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 57591712825e050d0c70cd0526492de4d5ad2905 Author: Dan Carpenter Date: Thu Dec 12 08:05:33 2013 +0100 hwmon: Prevent some divide by zeros in FAN_TO_REG() commit 3806b45ba4655147a011df03242cc197ab986c43 upstream. The "rpm * div" operations can overflow here, so this patch adds an upper limit to rpm to prevent that. Jean Delvare helped me with this patch. Signed-off-by: Dan Carpenter Acked-by: Roger Lucas Signed-off-by: Jean Delvare [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit e4b2585a85e92c43e7eba3eef30bc59ccadfe158 Author: Henrik Rydberg Date: Wed Oct 2 19:15:03 2013 +0200 hwmon: (applesmc) Always read until end of data commit 25f2bd7f5add608c1d1405938f39c96927b275ca upstream. The crash reported and investigated in commit 5f4513 turned out to be caused by a change to the read interface on newer (2012) SMCs. Tests by Chris show that simply reading the data valid line is enough for the problem to go away. Additional tests show that the newer SMCs no longer wait for the number of requested bytes, but start sending data right away. Apparently the number of bytes to read is no longer specified as before, but instead found out by reading until end of data. Failure to read until end of data confuses the state machine, which eventually causes the crash. As a remedy, assuming bit0 is the read valid line, make sure there is nothing more to read before leaving the read function. Tested to resolve the original problem, and runtested on MBA3,1, MBP4,1, MBP8,2, MBP10,1, MBP10,2. The patch seems to have no effect on machines before 2012. Tested-by: Chris Murphy Signed-off-by: Henrik Rydberg Signed-off-by: Guenter Roeck [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 7aa8c170472be4ca4ac0ed65efb78fe758594cec Author: Guenter Roeck Date: Tue Oct 9 13:23:57 2012 -0700 hwmon: (coretemp) Add support for Atom CE4110/4150/4170 commit 1102dcab849313bd5a340b299b5cf61b518fbc0f upstream. TjMax for the CE4100 series of Atom CPUs was previously reported to be 110 degrees C. cpuinfo logs on the web show existing CPU types CE4110, CE4150, and CE4170, reported as "model name : Intel(R) Atom(TM) CPU CE41{1|5|7}0 @ 1.{2|6}0GHz" with model 28 (0x1c) and stepping 10 (0x0a). Add the three known variants to the tjmax table. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit b428b89b7efdda0d073e9aad7f685a126bb3472d Author: Guenter Roeck Date: Sun Jun 17 18:05:05 2012 +0200 hwmon: (coretemp) Improve support for TjMax detection on Atom CPUs commit 41e58a1f2b90c88d94b4bd84beb9927a4c2704e9 upstream. Atom CPUs don't have a register to retrieve TjMax. Detection so far was incomplete. Use the X86 model ID to improve it. Signed-off-by: Guenter Roeck Signed-off-by: Jean Delvare Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit 2a3c5038975c58343fd199d6795e462818726350 Author: Guenter Roeck Date: Sun Jun 17 18:05:05 2012 +0200 hwmon: (coretemp) Add support for Atom D2000 and N2000 series CPU models commit 5592906f8b01282ea3c2acaf641fd067ad4bb3dc upstream. Document the Atom series D2000 and N2000 (Cedar Trail) as being supported. List and set TjMax for those series. Cc: Fenghua Yu Cc: "R, Durgadoss" Signed-off-by: Guenter Roeck Signed-off-by: Jean Delvare Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit b32e4b1ae1207eb590e9dec2ace693b2577a9c68 Author: Jean Delvare Date: Sun Jun 17 18:05:05 2012 +0200 hwmon: (coretemp) Improve support of recent Atom CPU models commit fcc14ac1a86931f38da047cf8fb634c6db7b58bc upstream. Document the new Atom series (Tunnel Creek and Medfield) as being supported, and list TjMax for the Atom E600 series. Also enable the Atom tjmax heuristic for these Atom CPU models. Signed-off-by: Jean Delvare Reviewed-by: Guenter Roeck Cc: Alexander Stein Cc: Fenghua Yu Cc: "R, Durgadoss" Signed-off-by: Ben Hutchings Cc: Qiang Huang Signed-off-by: Greg Kroah-Hartman commit d454e9e10c6445c1b653309627260cbf7d8e86aa Author: Kailang Yang Date: Tue Nov 26 15:17:50 2013 +0800 ALSA: hda/realtek - Add support of ALC231 codec commit ba4c4d0a9021ab034554d532a98133d668b87599 upstream. It's compatible with ALC269. Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 296d59e61f0da68c408a47d48d61bfcc6dbfe8c4 Author: Takashi Iwai Date: Thu Nov 14 15:45:12 2013 +0100 ALSA: pcsp: Fix the order of input device unregistration commit 6408eac2665955343cd0e4bcd7d6237ce39611ed upstream. The current code may access to the already freed object. The input device must be accessed and unregistered before freeing the top level sound object. Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit a8d5c053a4082f3681f2e3d509e90ac95a973f9c Author: Anssi Hannula Date: Sun Sep 1 14:36:47 2013 +0300 ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA commit 18e391862cceaf43ddb8eb5cca05e1a83abdebaa upstream. hdmi_channel_allocation() tries to find a HDMI channel allocation that matches the number channels in the playback stream and contains only speakers that the HDMI sink has reported as available via EDID. If no such allocation is found, 0 (stereo audio) is used. Using CA 0 causes the audio causes the sink to discard everything except the first two channels (front left and front right). However, the sink may be capable of receiving more channels than it has speakers (and then perform downmix or discard the extra channels), in which case it is preferable to use a CA that contains extra channels than to use CA 0 which discards all the non-stereo channels. Additionally, it seems that HBR (HD) passthrough output does not work on Intel HDMI codecs when CA is set to 0 (possibly the codec zeroes channels not present in CA). This happens with all receivers that report a 5.1 speaker mask since a HBR stream is carried on 8 channels to the codec. Add a fallback in the CA selection so that the CA channel count at least matches the stream channel count, even if the stream contains channels not present in the sink speaker descriptor. Thanks to GrimGriefer at OpenELEC forums for discovering that changing the sink speaker mask allowed HBR output. Reported-by: GrimGriefer Reported-by: Ashecrow Reported-by: Frank Zafka Reported-by: Peter Frühberger Signed-off-by: Anssi Hannula Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 03017e73a1923f780be4033c73ab0377ab1f5447 Author: Torsten Schenk Date: Sun Aug 11 11:11:35 2013 +0200 ALSA: 6fire: make buffers DMA-able (midi) commit 4c2aee0032b70083dafebd733ed9c774633b2fa3 upstream. Patch makes midi output buffer DMA-able by allocating it separately. Signed-off-by: Torsten Schenk Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 825ca11070d84eba7fb0386996f9ce1e62b2e52e Author: Torsten Schenk Date: Sun Aug 11 11:11:19 2013 +0200 ALSA: 6fire: make buffers DMA-able (pcm) commit 5ece263f1d93fba8d992e67e3ab8a71acf674db9 upstream. Patch makes pcm buffers DMA-able by allocating each one separately. Signed-off-by: Torsten Schenk Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit a204372b13b39d840c95e5f7cc32a27a4f31b722 Author: Jussi Kivilinna Date: Tue Aug 6 14:53:24 2013 +0300 ALSA: 6fire: fix DMA issues with URB transfer_buffer usage commit ddb6b5a964371e8e52e696b2b258bda144c8bd3f upstream. Patch fixes 6fire not to use stack as URB transfer_buffer. URB buffers need to be DMA-able, which stack is not. Furthermore, transfer_buffer should not be allocated as part of larger device structure because DMA coherency issues and patch fixes this issue too. Signed-off-by: Jussi Kivilinna Tested-by: Torsten Schenk Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit c97105259b2691d182e53c854d9024e3740e75db Author: Dan Carpenter Date: Wed Jun 26 10:52:20 2013 +0300 ALSA: ak4xx-adda: info leak in ak4xxx_capture_source_info() commit bd5fe738e388ceaa32e5171481e0d3ec59f0ccfe upstream. "idx" is controled by the user and can be a negative offset into the input_names[] array. Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 775a5ddce6018428fd8143d519b9114a86fa4b60 Author: Torstein Hegge Date: Tue Mar 19 17:12:14 2013 +0100 ALSA: usb: Parse UAC2 extension unit like for UAC1 commit 61ac51301e6c6d4ed977d7674ce2b8e713619a9b upstream. UAC2_EXTENSION_UNIT_V2 differs from UAC1_EXTENSION_UNIT, but can be handled in the same way when parsing the unit. Otherwise parse_audio_unit() fails when it sees an extension unit on a UAC2 device. UAC2_EXTENSION_UNIT_V2 is outside the range allocated by UAC1. Signed-off-by: Torstein Hegge Acked-by: Daniel Mack Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit d47b372591bb5e87f6534b3d66cf7d029eed237f Author: Eldad Zack Date: Wed Nov 28 23:55:36 2012 +0100 ALSA: usb-audio: skip UAC2 EFFECT_UNIT commit 5dae5fd24071319bb67d3375217d5b0b6d16cb0b upstream. Current code mishandles the case where the device is a UAC2 and the bDescriptorSubtype is a UAC2 Effect Unit (0x07). It tries to parse it as a Processing Unit (which is similar to two other UAC1 units with overlapping subtypes), but since the structure is different (See: 4.7.2.10, 4.7.2.11 in UAC2 standard), the parsing is done incorrectly and prevents the device from initializing. For now, just ignore the unit. Signed-off-by: Eldad Zack Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit ff15138a16c56ff43adeea27f90d46f59b69dcfd Author: Aaron Plattner Date: Fri Jul 12 11:01:37 2013 -0700 ALSA: hda - Add another GPU codec ID to snd-hda commit d52392b1a80458c0510810789c7db4a39b88022a upstream. Vendor ID 0x10de0060 is used by a yet-to-be-named GPU chip. Reviewed-by: Andy Ritger Signed-off-by: Aaron Plattner Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 6f06d395828bbb4e27c4840368ff90956f2b5a42 Author: Aaron Plattner Date: Mon Jul 16 17:10:04 2012 -0700 ALSA: hda - Add new GPU codec ID to snd-hda commit 7ae48b56f8d9c836259bc02f3e2ea4962d6b5d1b upstream. Vendor ID 0x10de0051 is used by a yet-to-be-named GPU chip. Signed-off-by: Aaron Plattner Acked-by: Andy Ritger Reviewed-by: Daniel Dadap Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit ea76e8cc60034f984bedadb36d739a5f74b176a2 Author: Takashi Iwai Date: Tue Jun 18 16:14:22 2013 +0200 ALSA: hda - Cache the MUX selection for generic HDMI commit bddee96b5d0db869f47b195fe48c614ca824203c upstream. When a selection to a converter MUX is changed in hdmi_pcm_open(), it should be cached so that the given connection can be restored properly at PM resume. We need just to replace the corresponding snd_hda_codec_write() call with snd_hda_codec_write_cache(). Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit ace626985cb753d998f92d872df4b6d8573ab368 Author: Takashi Iwai Date: Mon Dec 9 14:53:36 2013 +0100 xhci: Limit the spurious wakeup fix only to HP machines commit 6962d914f317b119e0db7189199b21ec77a4b3e0 upstream. We've got regression reports that my previous fix for spurious wakeups after S5 on HP Haswell machines leads to the automatic reboot at shutdown on some machines. It turned out that the fix for one side triggers another BIOS bug in other side. So, it's exclusive. Since the original S5 wakeups have been confirmed only on HP machines, it'd be safer to apply it only to limited machines. As a wild guess, limiting to machines with HP PCI SSID should suffice. This patch should be backported to kernels as old as 3.12, that contain the commit 638298dc66ea36623dbc2757a24fc2c4ab41b016 "xhci: Fix spurious wakeups after S5 on Haswell". Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171 Signed-off-by: Takashi Iwai Signed-off-by: Sarah Sharp Tested-by: Reported-by: Niklas Schnelle Reported-by: Giorgos Reported-by: Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 630b5e0d7bb7f50234b82ab88f7a8427aae64bed Author: Takashi Iwai Date: Thu Sep 12 08:11:06 2013 +0200 xhci: Fix spurious wakeups after S5 on Haswell commit 638298dc66ea36623dbc2757a24fc2c4ab41b016 upstream. Haswell LynxPoint and LynxPoint-LP with the recent Intel BIOS show mysterious wakeups after shutdown occasionally. After discussing with BIOS engineers, they explained that the new BIOS expects that the wakeup sources are cleared and set to D3 for all wakeup devices when the system is going to sleep or power off, but the current xhci driver doesn't do this properly (partly intentionally). This patch introduces a new quirk, XHCI_SPURIOUS_WAKEUP, for fixing the spurious wakeups at S5 by calling xhci_reset() in the xhci shutdown ops as done in xhci_stop(), and setting the device to PCI D3 at shutdown and remove ops. The PCI D3 call is based on the initial fix patch by Oliver Neukum. [Note: Sarah changed the quirk name from XHCI_HSW_SPURIOUS_WAKEUP to XHCI_SPURIOUS_WAKEUP, since none of the other quirks have system names in them. Sarah also fixed a collision with a quirk submitted around the same time, by changing the xhci->quirks bit from 17 to 18.] This patch should be backported to kernels as old as 3.0, that contain the commit 1c12443ab8eba71a658fae4572147e56d1f84f66 "xhci: Add Lynx Point to list of Intel switchable hosts." Cc: Oliver Neukum Signed-off-by: Takashi Iwai Signed-off-by: Sarah Sharp [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit e4330c73f4e2cb8bf2755ea850f4a34569535a9a Author: Oliver Neukum Date: Mon Sep 30 15:50:54 2013 +0200 xhci: quirk for extra long delay for S4 commit 455f58925247e8a1a1941e159f3636ad6ee4c90b upstream. It has been reported that this chipset really cannot sleep without this extraordinary delay. This patch should be backported, in order to ensure this host functions under stable kernels. The last quirk for Fresco Logic hosts (commit bba18e33f25072ebf70fd8f7f0cdbf8cdb59a746 "xhci: Extend Fresco Logic MSI quirk.") was backported to stable kernels as old as 2.6.36. Signed-off-by: Oliver Neukum Signed-off-by: Sarah Sharp [bwh: Backported to 3.2: - Adjust context - Use xhci_dbg() instead of xhci_dbg_trace()] Signed-off-by: Ben Hutchings [yangyl: Backported to 3.4: Adjust context] Signed-off-by: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit da02a12066a280b546c71a492f47a7776e2b1d10 Author: Julius Werner Date: Tue Oct 15 17:45:00 2013 -0700 usb: hub: Clear Port Reset Change during init/resume commit e92aee330837e4911553761490a8fb843f2053a6 upstream. This patch adds the Port Reset Change flag to the set of bits that are preemptively cleared on init/resume of a hub. In theory this bit should never be set unexpectedly... in practice it can still happen if BIOS, SMM or ACPI code plays around with USB devices without cleaning up correctly. This is especially dangerous for XHCI root hubs, which don't generate any more Port Status Change Events until all change bits are cleared, so this is a good precaution to have (similar to how it's already done for the Warm Port Reset Change flag). Signed-off-by: Julius Werner Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.2: - Adjust context - s/usb_clear_port_feature/clear_port_feature/] Signed-off-by: Ben Hutchings [yangyl: Backported to 3.4: Adjust context] Signed-off-by: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 8fd2b471b5f13822cfcd3138f292a23962418a87 Author: James Ralston Date: Mon Nov 4 09:24:58 2013 -0800 ahci: Add Device IDs for Intel Wildcat Point-LP commit 9f961a5f6efc87a79571d7166257b36af28ffcfe upstream. This patch adds the AHCI-mode SATA Device IDs for the Intel Wildcat Point-LP PCH. Signed-off-by: James Ralston Signed-off-by: Tejun Heo Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 4af001a0d18b0f336e1d16b1bdb2c3f46d3d124f Author: Sarah Sharp Date: Mon Aug 5 13:36:00 2013 -0700 xhci: Don't enable/disable RWE on bus suspend/resume. commit f217c980ca980e3a645b7485ea5eae9a747f4945 upstream. The RWE bit of the USB 2.0 PORTPMSC register is supposed to enable remote wakeup for devices in the lower power link state L1. It has nothing to do with the device suspend remote wakeup from L2. The RWE bit is designed to be set once (when USB 2.0 LPM is enabled for the port) and cleared only when USB 2.0 LPM is disabled for the port. The xHCI bus suspend method was setting the RWE bit erroneously, and the bus resume method was clearing it. The xHCI 1.0 specification with errata up to Aug 12, 2012 says in section 4.23.5.1.1.1 "Hardware Controlled LPM": "While Hardware USB2 LPM is enabled, software shall not modify the HIRDBESL or RWE fields of the USB2 PORTPMSC register..." If we have previously enabled USB 2.0 LPM for a device, that means when the USB 2.0 bus is resumed, we violate the xHCI specification by clearing RWE. It also means that after a bus resume, the host would think remote wakeup is disabled from L1 for ports with USB 2.0 Link PM enabled, which is not what we want. This patch should be backported to kernels as old as 3.2, that contain the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set USB2 hardware LPM". That was the first kernel that supported USB 2.0 Link PM. Signed-off-by: Sarah Sharp [bwh: Backported to 3.2: deleted code was cosmetically different] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 86726b075298b4fe4874017d65e801b7b0735438 Author: Seth Heasley Date: Wed Jun 19 16:36:45 2013 -0700 ahci: AHCI-mode SATA patch for Intel Coleto Creek DeviceIDs commit 1cfc7df3de10c40ed459e13cce6de616023bf41c upstream. This patch adds the AHCI-mode SATA DeviceIDs for the Intel Coleto Creek PCH. Signed-off-by: Seth Heasley Signed-off-by: Tejun Heo Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 72c84d5151850dd71dc9fb867b87d84b48c0da0d Author: James Ralston Date: Fri Feb 8 17:34:47 2013 -0800 ahci: Add Device IDs for Intel Wellsburg PCH commit 151743fd8dfb02956c5184b5f4f0f42677eb75bc upstream. This patch adds the AHCI-mode SATA Device IDs for the Intel Wellsburg PCH Signed-off-by: James Ralston Signed-off-by: Jeff Garzik Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit a5b22446b082b697d75bda3453e7b3db7820be80 Author: Colin Leitner Date: Tue Nov 5 18:02:34 2013 +0100 USB: ftdi_sio: fixed handling of unsupported CSIZE setting commit 8704211f65a2106ba01b6ac9727cdaf9ca11594c upstream. FTDI UARTs support only 7 or 8 data bits. Until now the ftdi_sio driver would only report this limitation for CS6 to dmesg and fail to reflect this fact to tcgetattr. This patch reverts the unsupported CSIZE setting and reports the fact with less severance to dmesg for both CS5 and CS6. To test the patch it's sufficient to call stty -F /dev/ttyUSB0 cs5 which will succeed without the patch and report an error with the patch applied. As an additional fix this patch ensures that the control request will always include a data bit size. Signed-off-by: Colin Leitner Signed-off-by: Johan Hovold [bwh: Backported to 3.2: - Old code is cosmetically different - s/ddev/\&port->dev/] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit e157f561e1c1bcf61768b5a57195539d2d549e46 Author: Thomas Pugliese Date: Wed Oct 23 14:44:29 2013 -0500 usb: wusbcore: change WA_SEGS_MAX to a legal value commit f74b75e7f920c700636cccca669c7d16d12e9202 upstream. change WA_SEGS_MAX to a number that is legal according to the WUSB spec. Signed-off-by: Thomas Pugliese [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit bec174d1d20ae54ab697b7b8623e2d6f4fd934e4 Author: Thomas Pugliese Date: Wed Oct 23 14:44:26 2013 -0500 usb: wusbcore: set the RPIPE wMaxPacketSize value correctly commit 7b6bc07ab554e929c85d51b3d5b26cf7f12c6a3b upstream. For isochronous endpoints, set the RPIPE wMaxPacketSize value using wOverTheAirPacketSize from the endpoint companion descriptor instead of wMaxPacketSize from the normal endpoint descriptor. Signed-off-by: Thomas Pugliese [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 080d2258d7ebdb0c8fee29e543d1f5a268879bc6 Author: David Cohen Date: Thu Sep 26 13:01:44 2013 -0700 usb: dwc3: add support for Merrifield commit 85601f8cf67c56a561a6dd5e130e65fdc179047d upstream. Add PCI id for Intel Merrifield Signed-off-by: David Cohen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 36269ba86beca84ee770f9de7622fa25791d23fa Author: Heikki Krogerus Date: Tue Sep 17 10:38:13 2013 +0300 usb: dwc3: pci: add support for BayTrail commit b62cd96de3161dfb125a769030eec35a4cab3d3a upstream. Add PCI id for Intel BayTrail. Signed-off-by: Heikki Krogerus Signed-off-by: Felipe Balbi Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 9e5f97bb07a4048d388d81e8c26b2e6d15973bf3 Author: Sarah Sharp Date: Mon Sep 30 17:26:29 2013 +0300 usb: Disable USB 2.0 Link PM before device reset. commit dcc01c0864823f91c3bf3ffca6613e2351702b87 upstream. Before the USB core resets a device, we need to disable the L1 timeout for the roothub, if USB 2.0 Link PM is enabled. Otherwise the port may transition into L1 in between descriptor fetches, before we know if the USB device descriptors changed. LPM will be re-enabled after the full device descriptors are fetched, and we can confirm the device still supports USB 2.0 LPM after the reset. We don't need to wait for the USB device to exit L1 before resetting the device, since the xHCI roothub port diagrams show a transition to the Reset state from any of the Ux states (see Figure 34 in the 2012-08-14 xHCI specification update). This patch should be backported to kernels as old as 3.2, that contain the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set USB2 hardware LPM". That was the first commit to enable USB 2.0 hardware-driven Link Power Management. Signed-off-by: Sarah Sharp [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 5077a93421ec087d51b6666bcbbaf51b7c2c05b6 Author: Alan Stern Date: Tue Sep 24 15:45:25 2013 -0400 USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd commit f875fdbf344b9fde207f66b392c40845dd7e5aa6 upstream. Since uhci-hcd, ehci-hcd, and xhci-hcd support runtime PM, the .pm field in their pci_driver structures should be protected by CONFIG_PM rather than CONFIG_PM_SLEEP. The corresponding change has already been made for ohci-hcd. Without this change, controllers won't do runtime suspend if system suspend or hibernation isn't enabled. Signed-off-by: Alan Stern CC: Sarah Sharp Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 701a7a17dfdb34700fd3c5fa58249f16bb628f83 Author: Alan Stern Date: Fri Aug 30 10:46:00 2013 -0400 USB: fix build error when CONFIG_PM_SLEEP isn't enabled commit 9d8924297cd9c256c23c02abae40202563452453 upstream. This patch fixes a build error that occurs when CONFIG_PM is enabled and CONFIG_PM_SLEEP isn't: >> drivers/usb/host/ohci-pci.c:294:10: error: 'usb_hcd_pci_pm_ops' undeclared here (not in a function) .pm = &usb_hcd_pci_pm_ops Since the usb_hcd_pci_pm_ops structure is defined and used when CONFIG_PM is enabled, its declaration should not be protected by CONFIG_PM_SLEEP. Signed-off-by: Alan Stern Reported-by: kbuild test robot Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit b50bbe0c033b3ba2ea880da64dbd3771d008cf8d Author: Alan Stern Date: Mon Aug 26 15:01:40 2013 -0400 USB: OHCI: Allow runtime PM without system sleep commit 69820e01aa756b8d228143d997f71523c1e97984 upstream. Since ohci-hcd supports runtime PM, the .pm field in its pci_driver structure should be protected by CONFIG_PM rather than CONFIG_PM_SLEEP. Without this change, OHCI controllers won't do runtime suspend if system suspend or hibernation isn't enabled. Signed-off-by: Alan Stern Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 26693c1730687729f2ba5b849442382688aa7cec Author: Johan Hovold Date: Tue Aug 13 13:27:35 2013 +0200 USB: keyspan: fix null-deref at disconnect and release commit ff8a43c10f1440f07a5faca0c1556921259f7f76 upstream. Make sure to fail properly if the device is not accepted during attach in order to avoid null-pointer derefs (of missing interface private data) at disconnect or release. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit b51317e897a02c617b4ea446e62cbb807924fbdd Author: Johan Hovold Date: Sun Aug 11 16:49:23 2013 +0200 USB: ti_usb_3410_5052: fix big-endian firmware handling commit e877dd2f2581628b7119df707d4cf03d940cff49 upstream. Fix endianess bugs in firmware handling introduced by commits cb7a7c6a ("ti_usb_3410_5052: add Multi-Tech modem support") and 05a3d905 ("ti_usb_3410_5052: support alternate firmware") which made the driver use the wrong firmware for certain devices on big-endian machines. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 7890e19c24abea4cd412e260c2c7c6eeb18ea8a3 Author: Johan Hovold Date: Sun Aug 11 16:49:22 2013 +0200 USB: adutux: fix big-endian device-type reporting commit d482b9d558602a9cacab063b1c8779f9b5214da7 upstream. Make sure the reported device-type on big-endian machines is the same as on little-endian ones. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit a6d2de9c1ea7cbac8944de86f1d5d8f7cd0415eb Author: Johan Hovold Date: Fri Jul 26 11:55:17 2013 +0200 USB: mos7840: fix race in register handling commit d8a083cc746664916d9d36ed9e4d08a29525f245 upstream. Fix race in mos7840_get_reg which unconditionally manipulated the control urb (which may already be in use) by adding a control-urb busy flag. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 6ff428d609c9840354d12e51961e965ec087a04e Author: Johan Hovold Date: Mon Jul 1 14:03:33 2013 +0200 USB: mos7840: fix memory leak in open commit 5f8a2e68b679b41cc8e9b642f2f5aa45dd678641 upstream. Allocated urbs and buffers were never freed on errors in open. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 8dc18301f5182ff47a3d2be364ca4d068efb575f Author: Johan Hovold Date: Mon Jun 10 18:29:38 2013 +0200 USB: pl2303: fix device initialisation at open commit 2d8f4447b58bba5f8cb895c07690434c02307eaf upstream. Do not use uninitialised termios data to determine when to configure the device at open. This also prevents stack data from leaking to userspace in the OOM error path. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: tty_struct::termios is a pointer, not a struct] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 9b5627d834131ed6c047bf7d9dc5e0aeeb769a86 Author: Johan Hovold Date: Mon Jun 10 18:29:39 2013 +0200 USB: spcp8x5: fix device initialisation at open commit 5e4211f1c47560c36a8b3d4544dfd866dcf7ccd0 upstream. Do not use uninitialised termios data to determine when to configure the device at open. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: tty_struct::termios is a pointer, not a struct] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit e63aec99ab0022cb5e469b387a912225a548bc97 Author: Richard Weinberger Date: Fri May 24 12:01:51 2013 +0200 USB: serial: Add Option GTM681W to qcserial device table. commit 8a2f132a01c2dd4c3905fa560f92019761ed72b1 upstream. The Option GTM681W uses a qualcomm chip and can be served by the qcserial device driver. Signed-off-by: Richard Weinberger [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit fba59fb18395c16c923f19d38c61c8afe3d30ccf Author: George Cherian Date: Mon May 27 14:35:49 2013 +0530 usb: dwc3: gadget: free trb pool only from epnum 2 commit 5bf8fae33d14cc5c3c53a926f9079f92c8b082b0 upstream. we never allocate a TRB pool for physical endpoints 0 and 1 so trying to free it (a invalid TRB pool pointer) will lead us in a warning while removing dwc3.ko module. In order to fix the situation, all we have to do is skip dwc3_free_trb_pool() for physical endpoints 0 and 1 just as we while deleting endpoints from the endpoints list. Signed-off-by: George Cherian Signed-off-by: Felipe Balbi [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 5dc179c6c808df1e7fd86a6472064af824fc9d58 Author: Adrian Thomasset Date: Wed Apr 24 11:37:35 2013 +0100 USB: ftdi_sio: enable two UART ports on ST Microconnect Lite commit 71d9a2b95fc9c9474d46d764336efd7a5a805555 upstream. The FT4232H used in the ST Micro Connect Lite has four hi-speed UART ports. The first two ports are reserved for the JTAG interface. We enable by default ports 2 and 3 as UARTs (where port 2 is a conventional RS-232 UART) Signed-off-by: Adrian Thomasset [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit cebd154bd43fee9cc7f1a20757119c5be2a99043 Author: Ming Lei Date: Tue Mar 26 10:49:55 2013 +0800 USB: serial: fix hang when opening port commit eba0e3c3a0ba7b96f01cbe997680f6a4401a0bfc upstream. Johan's 'fix use-after-free in TIOCMIWAIT' patchset[1] introduces one bug which can cause kernel hang when opening port. This patch initialized the 'port->delta_msr_wait' waitqueue head to fix the bug which is introduced in 3.9-rc4. [1], http://marc.info/?l=linux-usb&m=136368139627876&w=2 Signed-off-by: Ming Lei Acked-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 98458abe19dc414cddd1c5fb0b5b1b1095de3240 Author: Johan Hovold Date: Tue Mar 19 09:21:26 2013 +0100 USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT commit 3668b9c17765cacf411effc4fc6e44099ac30800 upstream. commit fc98ab873aa3dbe783ce56a2ffdbbe7c7609521a upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit e0aa06045823f4bf350a4efc40c387a53bab661b Author: Johan Hovold Date: Tue Mar 19 09:21:25 2013 +0100 USB: ssu100: fix use-after-free in TIOCMIWAIT commit 43a66b4c417ad15f6d2f632ce67ad195bdf999e8 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit c53e9784c85caf596b0c4a48b011d2b025eff290 Author: Johan Hovold Date: Tue Mar 19 09:21:24 2013 +0100 USB: spcp8x5: fix use-after-free in TIOCMIWAIT commit d1baabc8006fd238ad8da4d734dc815a8de02362 upstream. commit dbcea7615d8d7d58f6ff49d2c5568113f70effe9 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context, indentation] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit efa1c86aa7224628127a97876fcb16a5a00b3a0d Author: Johan Hovold Date: Tue Mar 19 09:21:22 2013 +0100 USB: pl2303: fix use-after-free in TIOCMIWAIT commit 40509ca982c00c4b70fc00be887509feca0bff15 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 0ae5c6018de3aeba4d359c3c5d3624dca03a76a8 Author: Johan Hovold Date: Tue Mar 19 09:21:21 2013 +0100 USB: oti6858: fix use-after-free in TIOCMIWAIT commit 8edfdab37157d2683e51b8be5d3d5697f66a9f7b upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context, indentation] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit ced638acd331f22d6015b318d9059aea4c1b4306 Author: Johan Hovold Date: Tue Mar 19 09:21:20 2013 +0100 USB: mos7840: fix use-after-free in TIOCMIWAIT commit a14430db686b8e459e1cf070a6ecf391515c9ab9 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit ee2470d27c32373a514c6eccb63ec5589bcffd5c Author: Johan Hovold Date: Tue Mar 19 09:21:19 2013 +0100 USB: mos7840: fix broken TIOCMIWAIT commit e670c6af12517d08a403487b1122eecf506021cf upstream. Make sure waiting processes are woken on modem-status changes. Currently processes are only woken on termios changes regardless of whether the modem status has changed. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 23a88561251edc6ef7f72b32f360be84397ec566 Author: Johan Hovold Date: Tue Mar 19 09:21:18 2013 +0100 USB: mct_u232: fix use-after-free in TIOCMIWAIT commit cf1d24443677a0758cfa88ca40f24858b89261c0 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit fad70e4c2dd6bc7c8cb9c3a61cb1dafad96a359e Author: Johan Hovold Date: Tue Mar 19 09:21:17 2013 +0100 USB: io_ti: fix use-after-free in TIOCMIWAIT commit 7b2459690584f239650a365f3411ba2ec1c6d1e0 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 25b6e4637943d52412c14093726e3c750e403514 Author: Johan Hovold Date: Tue Mar 19 09:21:16 2013 +0100 USB: io_edgeport: fix use-after-free in TIOCMIWAIT commit 333576255d4cfc53efd056aad438568184b36af6 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 6929b79f07d57ddb86cb9083a5aac6c5f2c7ee0b Author: Johan Hovold Date: Tue Mar 19 09:21:15 2013 +0100 USB: ftdi_sio: fix use-after-free in TIOCMIWAIT commit 71ccb9b01981fabae27d3c98260ea4613207618e upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. When switching to tty ports, some lifetime assumptions were changed. Specifically, close can now be called before the final tty reference is dropped as part of hangup at device disconnect. Even with the ftdi private-data refcounting this means that the port private data can be freed while a process is sleeping on modem-status changes and thus cannot be relied on to detect disconnects when woken up. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit ee49ee869ce7af67ba38a1e989dd4d7670393d0c Author: Johan Hovold Date: Tue Mar 19 09:21:13 2013 +0100 USB: cypress_m8: fix use-after-free in TIOCMIWAIT commit 356050d8b1e526db093e9d2c78daf49d6bf418e3 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Also remove bogus test for private data pointer being NULL as it is never assigned in the loop. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit d7bb322e3170a179899823b5e63d434d4324b486 Author: Johan Hovold Date: Tue Mar 19 09:21:12 2013 +0100 USB: ch341: fix use-after-free in TIOCMIWAIT commit fa1e11d5231c001c80a479160b5832933c5d35fb upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit ffc687e350fa607e42c8c7b44e198f39265c6ad9 Author: Johan Hovold Date: Tue Mar 19 09:21:11 2013 +0100 USB: ark3116: fix use-after-free in TIOCMIWAIT commit 5018860321dc7a9e50a75d5f319bc981298fb5b7 upstream. Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 017f42518a72858f4332572a963be4212e0ee795 Author: Johan Hovold Date: Tue Mar 19 09:21:10 2013 +0100 USB: serial: add modem-status-change wait queue commit e5b33dc9d16053c2ae4c2c669cf008829530364b upstream. Add modem-status-change wait queue to struct usb_serial_port that subdrivers can use to implement TIOCMIWAIT. Currently subdrivers use a private wait queue which may have been released when waking up after device disconnected. Note that we're adding a new wait queue rather than reusing the tty-port one as we do not want to get woken up at hangup (yet). Signed-off-by: Johan Hovold Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit cae4d9a21738dce33a18f533c703b42f59e55244 Author: David Henningsson Date: Mon Apr 2 15:40:27 2012 +0200 ALSA: hda - Fix internal mic for Lenovo Ideapad U300s commit 18dcd3044e4c4b3ab6341c98e8d0e81e0d58d5e3 upstream. The internal mic input is phase inverted on one channel. To avoid people in userspace summing the channels together and get zero result, use a separate mixer control for the inverted channel. BugLink: https://bugs.launchpad.net/bugs/903853 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai [wml: Backported to 3.4: - Adjust context - one more enum value CXT_PINCFG_LENOVO_TP410 - Change both invocations of apply_pin_fixup()] Signed-off-by: Weng Meiling commit 88e7e71df070e9d863f9378a0c00be70e821708a Author: Takashi Iwai Date: Fri Dec 14 10:22:35 2012 +0100 ALSA: hda - Always turn on pins for HDMI/DP commit 6169b673618bf0b2518ce413b54925782a603f06 upstream. We've seen the broken HDMI *video* output on some machines with GM965, and the debugging session pointed that the culprit is the disabled audio output pins. Toggling these pins dynamically on demand caused flickering of HDMI TV. This patch changes the behavior to keep the pin ON constantly. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=51421 Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 98a50ba04e6c85474af0c6b34b74659afdfdfda4 Author: David Henningsson Date: Wed Dec 19 09:44:47 2012 +0100 Revert "ALSA: hda - Shut up pins at power-saving mode with Conexnat codecs" commit 7ed4165e2d01bdbbb4c1086eb73eadf0f64cbbf0 upstream. This reverts commit 697c373e34613609cb5450f98b91fefb6e910588. The original patch was meant to remove clicking, but in fact caused even more clicking instead. Thanks to c4pp4 for doing most of the work with this bug. BugLink: https://bugs.launchpad.net/bugs/886975 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 4aab66f1da53a7bf5edb4b245ee20db40424d909 Author: Takashi Iwai Date: Thu May 10 08:54:23 2012 +0200 ALSA: hda - Add Conexant CX20751/2/3/4 codec support commit 61d648fb4726f8a89c07cd1904f9c2e11bf26df5 upstream. These are almost compatible with the older Conexant codecs. Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 6f812bef6cd1102d9edc473062d924d8d7c54219 Author: Takashi Iwai Date: Tue Jan 29 18:07:22 2013 +0100 ALSA: hda - Fix non-snoop page handling commit 9ddf1aeb2134e72275c97a2c6ff2e3eb04f2f27a upstream. For non-snoop mode, we fiddle with the page attributes of CORB/RIRB and the position buffer, but also the ring buffers. The problem is that the current code blindly assumes that the buffer is contiguous. However, the ring buffers may be SG-buffers, thus a wrong vmapped address is passed there, leading to Oops. This patch fixes the handling for SG-buffers. Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=800701 Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: open-code snd_pcm_get_dma_buf()] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 760ae1d191c247b1e0c837b9701dd3da5db69f11 Author: Takashi Iwai Date: Mon Feb 4 10:28:15 2013 +0100 ALSA: aloop: Fix Oops while PM resume commit edac894389f9c9de2a1368c78809c824b343f3a5 upstream. snd-aloop driver has no proper PM implementation, thus the PM resume may trigger Oops due to leftover timer instance. This patch adds the missing suspend/resume implementation. Reported-and-tested-by: El boulangero Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit cd25cf8987bc5a34b70056c2c3e2a54accd34bb7 Author: Calvin Owens Date: Fri Apr 12 22:33:59 2013 -0500 ALSA: usb: Add quirk for 192KHz recording on E-Mu devices commit 1539d4f82ad534431cc67935e8e442ccf107d17d upstream. When recording at 176.2KHz or 192Khz, the device adds a 32-bit length header to the capture packets, which obviously needs to be ignored for recording to work properly. Userspace expected: L0 L1 L2 R0 R1 R2 ...but actually got: R2 L0 L1 L2 R0 R1 Also, the last byte of the length header being interpreted as L0 of the first sample caused spikes every 0.5ms, resulting in a loud 16KHz tone (about the highest 'B' on a piano) being present throughout captures. Tested at all sample rates on an E-Mu 0404USB, and tested for regressions on a generic USB headset. Signed-off-by: Calvin Owens Signed-off-by: Takashi Iwai [bwh: Backported to 3.2: adjust filenames, context] Signed-off-by: Ben Hutchings Cc: Weng Meiling Signed-off-by: Greg Kroah-Hartman commit 8cb6708d75c2999d99d245dc6a42375ae602f8ce Author: Laurent Pinchart Date: Thu Jul 19 12:39:14 2012 +0200 usb: Add USB_QUIRK_RESET_RESUME for all Logitech UVC webcams commit e387ef5c47ddeaeaa3cbdc54424cdb7a28dae2c0 upstream. Most Logitech UVC webcams (both early models that don't advertise UVC compatibility and newer UVC-advertised devices) require the RESET_RESUME quirk. Instead of listing each and every model, match the devices based on the UVC interface information. Signed-off-by: Laurent Pinchart Acked-by: Alan Stern [bwh: Adjust context to apply after 3.2.38] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit a85e474e00d762b1a20d912c003daa64c42cc74e Author: Laurent Pinchart Date: Thu Jul 19 12:39:13 2012 +0200 usb: Add quirk detection based on interface information commit 80da2e0df5af700518611b7d1cc4fc9945bcaf95 upstream. When a whole class of devices (possibly from a specific vendor, or across multiple vendors) require a quirk, explictly listing all devices in the class make the quirks table unnecessarily large. Fix this by allowing matching devices based on interface information. Signed-off-by: Laurent Pinchart Acked-by: Alan Stern Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 96ff7eff36f9f756726dbde657b020cd4469de8d Author: Andreas Fleig Date: Wed Dec 5 16:17:49 2012 +0100 USB: Add device quirk for Microsoft VX700 webcam commit bc009eca8d539162f7271c2daf0ab5e9e3bb90a0 upstream. Add device quirk for Microsoft Lifecam VX700 v2.0 webcams. Fixes squeaking noise of the microphone. Signed-off-by: Andreas Fleig [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit d19046a87a3888f9a3a542337cda0f3a07b40fdd Author: Alan Stern Date: Thu Nov 8 10:17:01 2012 -0500 USB: EHCI: bugfix: urb->hcpriv should not be NULL commit 2656a9abcf1ec8dd5fee6a75d6997a0f2fa0094e upstream. This patch (as1632b) fixes a bug in ehci-hcd. The USB core uses urb->hcpriv to determine whether or not an URB is active; host controller drivers are supposed to set this pointer to a non-NULL value when an URB is queued. However ehci-hcd sets it to NULL for isochronous URBs, which defeats the check in usbcore. In itself this isn't a big deal. But people have recently found that certain sequences of actions will cause the snd-usb-audio driver to reuse URBs without waiting for them to complete. In the absence of proper checking by usbcore, the URBs get added to their endpoint list twice. This leads to list corruption and a system freeze. The patch makes ehci-hcd assign a meaningful value to urb->hcpriv for isochronous URBs. Improving robustness always helps. Signed-off-by: Alan Stern Reported-by: Artem S. Tashkinov Reported-by: Christof Meerwald [bwh: Backported to 3.2: - Adjust context - Also use usb_pipetype() to work out whether we should call qh_put()] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 6c2e0026cb5ab9d87c6b8a57fcf3d15ada8ed043 Author: Rajkumar Manoharan Date: Thu Oct 25 17:11:31 2012 +0530 ath9k_hw: Enable hw PLL power save for AR9462 commit 1680260226a8fd2aab590319da83ad8e610da9bd upstream. This reduced the power consumption to half in full and network sleep. Cc: Paul Stewart Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville [bwh: Backported to 3.2: - INIT_INI_ARRAY macro requires an explicit size argument - Remove the now-redundant macro PCIE_PLL_ON_CREQ_DIS_L1_2P0] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 2fcb3316cf2b3c242ac6ec0706454d50eb4c9240 Author: Sujith Manoharan Date: Wed Dec 26 12:27:39 2012 +0530 ath9k_hw: Fix RX gain initvals for AR9485 commit a796a1dd5da9645ad77aa687d1a890ecd63ab5a6 upstream. Populate iniModesRxGain with the correct initvals array for AR9485 v1.1 Signed-off-by: Sujith Manoharan Signed-off-by: John W. Linville [bwh: Backported to 3.2: - Adjust context - INIT_INI_ARRAY takes additional size and columns arguments] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit bea8bffc581dfbcac065bffafdcab96bb28bd1bb Author: Felix Fietkau Date: Sun Jan 20 21:55:21 2013 +0100 ath9k_hw: fix chain swap setting when setting rx chainmask to 5 commit 959f049dfb62b517cbb3dd48ed2fb7d9c713ce16 upstream. commit 24171dd92096fc370b195f3f6bdc0798855dc3f9 upstream. Chain swapping should only be enabled when the EEPROM chainmask is set to 5, regardless of what the runtime chainmask is. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville [bwh: Backported to 3.2: keep the special case for AR_SREV_9462 here] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit aa7640d05305a2cbdd93dcfcd3d7cd54e59a803f Author: Felix Fietkau Date: Fri Feb 22 21:37:25 2013 +0100 ath9k_htc: fix signal strength handling issues commit 838f427955dcfd16858b0108ce29029da0d56a4e upstream. The ath9k commit 2ef167557c0a26c88162ecffb017bfcc51eb7b29 (ath9k: fix signal strength reporting issues) fixed an issue where the reported per-frame signal strength reported to mac80211 was being overwritten with an internal average. The same issue is also present in ath9k_htc. In addition to preventing the driver from overwriting the value, this commit also ensures that the internal average (which is used for ANI) only tracks beacons of the AP that we're connected to. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville [bwh: Backported to 3.2: use compare_ether_addr() instead of ether_addr_equal(), with opposite sense] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 8daeba03c4cfeaa8bc482bdfed044bc387d838fe Author: Sujith Manoharan Date: Mon Jun 10 13:49:38 2013 +0530 ath9k_hw: Assign default xlna config for AR9485 commit 30d5b709da23f4ab9836c7f66d2d2e780a69cf12 upstream. For AR9485 boards with XLNA, the default gpio config is not set correctly, fix this. Signed-off-by: Sujith Manoharan Signed-off-by: John W. Linville [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 2e6fe08c10419a609bc9a64ab5818ea522debad6 Author: Rajkumar Manoharan Date: Fri Oct 12 14:07:24 2012 +0530 ath9k: fill channel mode in caldata commit 77d848372875d2e4cbdbf07030f0e08cab5e7f4d upstream. It is useful to have channel mode in caldata to find out whether operaing channel is in HT40/20 when we are currently on offchannel. It will be used by BTCOEX to enable/disable concurrent tx mechanism later. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit eceee0ba4e042a0f27bbbd82b0dc4c5b0959880a Author: Sujith Manoharan Date: Mon Jun 10 13:49:39 2013 +0530 ath9k: Fix noisefloor calibration commit 696df78509d1f81b651dd98ecdc1aecab616db6b upstream. The commits, "ath9k: Fix regression in channelwidth switch at the same channel" "ath9k: Fix invalid noisefloor reading due to channel update" attempted to fix noisefloor calibration when a channel switch happens due to HT20/HT40 bandwidth change. This is causing invalid readings resulting in messages like: "ath: phy16: NF[0] (-45) > MAX (-95), correcting to MAX". This results in an incorrect noise being used initially for reporting the signal level of received packets, until NF calibration is done and the history buffer is updated via the ANI timer, which happens much later. When a bandwidth change happens, it is appropriate to reset the internal history data for the channel. Do this correctly in the reset() routine by checking the "chanmode" variable. Cc: Rajkumar Manoharan Signed-off-by: Sujith Manoharan Signed-off-by: John W. Linville [bwh: Backported to 3.2: adjust context, indentation] Signed-off-by: Ben Hutchings Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 562c41b16c74779615db9c8cbbf01339f3a73fac Author: Will Deacon Date: Thu Jul 25 11:44:48 2013 +0100 ARM: 7791/1: a.out: remove partial a.out support commit acfdd4b1f7590d02e9bae3b73bdbbc4a31b05d38 upstream. a.out support on ARM requires that argc, argv and envp are passed in r0-r2 respectively, which requires hacking load_aout_binary to prevent argc being clobbered by the return code. Whilst mainline kernels do set the registers up in start_thread, the aout loader has never carried the hack in mainline. Initialising the registers in this way actually goes against the libc expectations for ELF binaries, where argc, argv and envp are passed on the stack, with r0 being used to hold a pointer to an exit function for cleaning up after the dynamic linker if required. If the pointer is NULL, then it is ignored. When execing an ELF binary, Linux currently zeroes r0, then sets it to argc and then finally clobbers it with the return value of the execve syscall, so we actually end up with: r0 = 0 stack[0] = argc r1 = stack[1] = argv r2 = stack[2] = envp libc treats r1 and r2 as undefined. The clobbering of r0 by sys_execve works for user-spawned threads, but when executing an ELF binary from a kernel thread (via call_usermodehelper), the execve is performed on the ret_from_fork path, which restores r0 from the saved pt_regs, resulting in argc being presented to the C library. This has horrible consequences when the application exits, since we have an exit function registered using argc, resulting in a jump to hyperspace. This patch solves the problem by removing the partial a.out support from arch/arm/ altogether. Cc: Ashish Sangwan Signed-off-by: Will Deacon Signed-off-by: Russell King [bwh: Backported to 3.2: - Adjust context - Adjust uapi filename] Signed-off-by: Ben Hutchings [yangyl: Backported to 3.4: Adjust context] Signed-off-by: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit f3e650df41db32aeb319d4531cc9df6fba4e3c9a Author: Nicolas Pitre Date: Tue Jan 15 18:51:32 2013 +0100 ARM: 7628/1: head.S: map one extra section for the ATAG/DTB area commit 6f16f4998f98e42e3f2dedf663cfb691ff0324af upstream. We currently use a temporary 1MB section aligned to a 1MB boundary for mapping the provided device tree until the final page table is created. However, if the device tree happens to cross that 1MB boundary, the end of it remains unmapped and the kernel crashes when it attempts to access it. Given no restriction on the location of that DTB, it could end up with only a few bytes mapped at the end of a section. Solve this issue by mapping two consecutive sections. Signed-off-by: Nicolas Pitre Tested-by: Sascha Hauer Tested-by: Tomasz Figa Signed-off-by: Russell King [bwh: Backported to 3.2: - Adjust context - The mapping is not conditional; drop the 'ne' suffixes] Signed-off-by: Ben Hutchings [yangyl: Backported to 3.4: Adjust context] Signed-off-by: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit f993888a1a433264656aad615d17d37e8474dad0 Author: Arnaud Patard (Rtp) Date: Thu Jul 26 12:15:46 2012 +0200 ARM: Orion: Set eth packet size csum offload limit commit 58569aee5a1a5dcc25c34a0a2ed9a377874e6b05 upstream. The mv643xx ethernet controller limits the packet size for the TX checksum offloading. This patch sets this limits for Kirkwood and Dove which have smaller limits that the default. As a side note, this patch is an updated version of a patch sent some years ago: http://lists.infradead.org/pipermail/linux-arm-kernel/2010-June/017320.html which seems to have been lost. Signed-off-by: Arnaud Patard Signed-off-by: Jason Cooper [bwh: Backported to 3.2: adjust for the extra two parameters of orion_ge0{0,1}_init()] Signed-off-by: Ben Hutchings [yangyl: Backported to 3.4: Adjust context] Signed-off-by: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit e1d3e024ab67c29b1602d9d05310a215b35066e7 Author: Sergei Ianovich Date: Tue Dec 10 08:39:15 2013 +0400 ARM: pxa: prevent PXA270 occasional reboot freezes commit ff88b4724fde18056a4c539f7327389aec0f4c2d upstream. Erratum 71 of PXA270M Processor Family Specification Update (April 19, 2010) explains that watchdog reset time is just 8us insead of 10ms in EMTS. If SDRAM is not reset, it causes memory bus congestion and the device hangs. We put SDRAM in selfresh mode before watchdog reset, removing potential freezes. Without this patch PXA270-based ICP DAS LP-8x4x hangs after up to 40 reboots. With this patch it has successfully rebooted 500 times. Signed-off-by: Sergei Ianovich Tested-by: Marek Vasut Signed-off-by: Haojian Zhuang Signed-off-by: Olof Johansson [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 0045ba111325a68bf287b68956e9716cc797f4fd Author: Russell King Date: Thu Nov 28 21:55:41 2013 +0000 ARM: footbridge: fix VGA initialisation commit 43659222e7a0113912ed02f6b2231550b3e471ac upstream. It's no good setting vga_base after the VGA console has been initialised, because if we do that we get this: Unable to handle kernel paging request at virtual address 000b8000 pgd = c0004000 [000b8000] *pgd=07ffc831, *pte=00000000, *ppte=00000000 0Internal error: Oops: 5017 [#1] ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 3.12.0+ #49 task: c03e2974 ti: c03d8000 task.ti: c03d8000 PC is at vgacon_startup+0x258/0x39c LR is at request_resource+0x10/0x1c pc : [] lr : [] psr: 60000053 sp : c03d9f68 ip : 000b8000 fp : c03d9f8c r10: 000055aa r9 : 4401a103 r8 : ffffaa55 r7 : c03e357c r6 : c051b460 r5 : 000000ff r4 : 000c0000 r3 : 000b8000 r2 : c03e0514 r1 : 00000000 r0 : c0304971 Flags: nZCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment kernel which is an access to the 0xb8000 without the PCI offset required to make it work. Fixes: cc22b4c18540 ("ARM: set vga memory base at run-time") Signed-off-by: Russell King [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit cbac9bda67f107ec39383d936380ffe9f5f67cdc Author: Arnd Bergmann Date: Fri May 31 22:50:47 2013 +0100 ARM: 7743/1: compressed/head.S: work around new binutils warning commit da94a829305f1c217cfdf6771cb1faca0917e3b9 upstream. In August 2012, Matthew Gretton-Dann checked a change into binutils labelled "Error on obsolete & warn on deprecated registers", apparently as part of ARMv8 support. Apparently, this was supposed to emit the message "Warning: This coprocessor register access is deprecated in ARMv8" when using certain mcr/mrc instructions and building for ARMv8. Unfortunately, the message that is actually emitted appears to be '(null)', which is less helpful in comparison. Even more unfortunately, this is biting us on every single kernel build with a new gas, because arch/arm/boot/compressed/head.S and some other files in that directory are built with -march=all since kernel commit 80cec14a8 "[ARM] Add -march=all to assembly file build in arch/arm/boot/compressed" back in v2.6.28. This patch reverts Russell's nice solution and instead marks the head.S file to be built for armv7-a, which fortunately lets us build all instructions in that file without warnings even on the broken binutils. Without this patch, building anything results in: arch/arm/boot/compressed/head.S: Assembler messages: arch/arm/boot/compressed/head.S:565: Warning: (null) arch/arm/boot/compressed/head.S:676: Warning: (null) arch/arm/boot/compressed/head.S:698: Warning: (null) arch/arm/boot/compressed/head.S:722: Warning: (null) arch/arm/boot/compressed/head.S:726: Warning: (null) arch/arm/boot/compressed/head.S:957: Warning: (null) arch/arm/boot/compressed/head.S:996: Warning: (null) arch/arm/boot/compressed/head.S:997: Warning: (null) arch/arm/boot/compressed/head.S:1027: Warning: (null) arch/arm/boot/compressed/head.S:1035: Warning: (null) arch/arm/boot/compressed/head.S:1046: Warning: (null) arch/arm/boot/compressed/head.S:1060: Warning: (null) arch/arm/boot/compressed/head.S:1092: Warning: (null) arch/arm/boot/compressed/head.S:1094: Warning: (null) arch/arm/boot/compressed/head.S:1095: Warning: (null) arch/arm/boot/compressed/head.S:1102: Warning: (null) arch/arm/boot/compressed/head.S:1134: Warning: (null) Signed-off-by: Arnd Bergmann Cc: Matthew Gretton-Dann Signed-off-by: Russell King [bwh: Backported to 3.2: - Adjust context - Remove definition of asflags-y as it is now empty] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit c9925863935ad8bb5f575224849b2d5d173c4dd1 Author: Arnd Bergmann Date: Fri May 31 22:49:22 2013 +0100 ARM: 7742/1: topology: export cpu_topology commit 92bdd3f5eba299b33c2f4407977d6fa2e2a6a0da upstream. The cpu_topology symbol is required by any driver using the topology interfaces, which leads to a couple of build errors: ERROR: "cpu_topology" [drivers/net/ethernet/sfc/sfc.ko] undefined! ERROR: "cpu_topology" [drivers/cpufreq/arm_big_little.ko] undefined! ERROR: "cpu_topology" [drivers/block/mtip32xx/mtip32xx.ko] undefined! The obvious solution is to export this symbol. Signed-off-by: Arnd Bergmann Acked-by: Will Deacon Cc: Nicolas Pitre Cc: Vincent Guittot Signed-off-by: Russell King Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 9e07754a3e9402b539de79ecb0587978b1423230 Author: Linus Walleij Date: Fri Apr 26 15:29:55 2013 +0200 ARM: u300: fix ages old copy/paste bug commit 0259d9eb30d003af305626db2d8332805696e60d upstream. The UART1 is on the fast AHB bridge, not on the slow bus. Acked-by: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit b39ebf7795a101d3159fdca519994a42f8b1ee71 Author: Arnd Bergmann Date: Mon Jan 14 12:49:02 2013 +0000 ARM: w90x900: fix legacy assembly syntax commit fa5ce5f94c0f2bfa41ba68d2d2524298e1fc405e upstream. New ARM binutils don't allow extraneous whitespace inside of brackets, which causes this error on all mach-w90x900 defconfigs: arch/arm/kernel/entry-armv.S: Assembler messages: arch/arm/kernel/entry-armv.S:214: Error: ARM register expected -- `ldr r0,[ r6,#(0x10C)]' arch/arm/kernel/entry-armv.S:214: Error: ARM register expected -- `ldr r0,[ r6,#(0x110)]' arch/arm/kernel/entry-armv.S:430: Error: ARM register expected -- `ldr r0,[ r6,#(0x10C)]' arch/arm/kernel/entry-armv.S:430: Error: ARM register expected -- `ldr r0,[ r6,#(0x110)]' This removes the whitespace in order to build the kernel again. Signed-off-by: Arnd Bergmann Cc: Wan ZongShun Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 26b9386b0228d0760b0c9649bd9c952ebcee3fa0 Author: Shawn Guo Date: Wed Aug 22 21:46:39 2012 +0800 ARM: dts: imx51-babbage: fix esdhc cd/wp properties commit a46d2619d7180bda12bad2bf15bbd0731dfc2dcf upstream. The binding doc and dts use properties "fsl,{cd,wp}-internal" while esdhc driver uses "fsl,{cd,wp}-controller". Fix binding doc and dts to get them match driver code. Reported-by: Chris Ball Signed-off-by: Shawn Guo Acked-by: Chris Ball Signed-off-by: Ben Hutchings Cc: Yang Yingliang Signed-off-by: Greg Kroah-Hartman commit 7c5b2352dbd302fa2940973af841ba9be39502f6 Author: Manoj Chourasia Date: Mon Jul 22 15:33:13 2013 +0530 HID: hidraw: correctly deallocate memory on device disconnect commit 212a871a3934beccf43431608c27ed2e05a476ec upstream. This changes puts the commit 4fe9f8e203f back in place with the fixes for slab corruption because of the commit. When a device is unplugged, wait for all processes that have opened the device to close before deallocating the device. This commit was solving kernel crash because of the corruption in rb tree of vmalloc. The rootcause was the device data pointer was geting excessed after the memory associated with hidraw was freed. The commit 4fe9f8e203f was buggy as it was also freeing the hidraw first and then calling delete operation on the list associated with that hidraw leading to slab corruption. Signed-off-by: Manoj Chourasia Tested-by: Peter Wu Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 30817a87476f44c2d4fe499b300b6ff0b703d527 Author: Jiri Kosina Date: Mon Mar 18 15:50:10 2013 +0100 HID: usbhid: fix build problem commit 570637dc8eeb2faba06228d497ff40bb019bcc93 upstream. Fix build problem caused by typo introduced by 620ae90ed8 ("HID: usbhid: quirk for MSI GX680R led panel"). Reported-by: fengguang.wu@intel.com Signed-off-by: Jiri Kosina [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit ec6cd0f6f485d5d7330c965fb39e0692247b2f89 Author: Josh Boyer Date: Mon Mar 18 09:47:02 2013 -0400 HID: usbhid: quirk for MSI GX680R led panel commit 620ae90ed8ca8b6e40cb9e10279b4f5ef9f0ab81 upstream. This keyboard backlight device causes a 10 second delay to boot. Add it to the quirk list with HID_QUIRK_NO_INIT_REPORTS. This fixes Red Hat bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=907221 Signed-off-by: Josh Boyer Signed-off-by: Jiri Kosina [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 7d02a653f15789bc32043bab3edf90b2a5210b26 Author: Fernando Luis Vazquez Cao Date: Tue Jan 22 15:20:38 2013 +0900 HID: clean up quirk for Sony RF receivers commit 99d249021abd4341771523ed8dd7946276103432 upstream. Document what the fix-up is does and make it more robust by ensuring that it is only applied to the USB interface that corresponds to the mouse (sony_report_fixup() is called once per interface during probing). Cc: linux-input@vger.kernel.org Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Fernando Luis Vazquez Cao Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 8d49f9035ffc7c256626cb05441571ad730e9663 Author: Fernando Luis Vazquez Cao Date: Tue Jan 15 19:40:48 2013 +0900 HID: add support for Sony RF receiver with USB product id 0x0374 commit a464918419f94a0043d2f549d6defb4c3f69f68a upstream. Some Vaio desktop computers, among them the VGC-LN51JGB multimedia PC, have a RF receiver, multi-interface USB device 054c:0374, that is used to connect a wireless keyboard and a wireless mouse. The keyboard works flawlessly, but the mouse (VGP-WMS3 in my case) does not seem to be generating any pointer events. The problem is that the mouse pointer is wrongly declared as a constant non-data variable in the report descriptor (see lsusb and usbhid-dump output below), with the consequence that it is ignored by the HID code. Add this device to the have-special-driver list and fix up the report descriptor in the Sony-specific driver which happens to already have a fixup for a similar firmware bug. # lsusb -vd 054C:0374 Bus 003 Device 002: ID 054c:0374 Sony Corp. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x054c Sony Corp. idProduct 0x0374 iSerial 0 [...] Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 1 Boot Interface Subclass bInterfaceProtocol 2 Mouse iInterface 2 RF Receiver [...] Report Descriptor: (length is 100) [...] Item(Global): Usage Page, data= [ 0x01 ] 1 Generic Desktop Controls Item(Local ): Usage, data= [ 0x30 ] 48 Direction-X Item(Local ): Usage, data= [ 0x31 ] 49 Direction-Y Item(Global): Report Count, data= [ 0x02 ] 2 Item(Global): Report Size, data= [ 0x08 ] 8 Item(Global): Logical Minimum, data= [ 0x81 ] 129 Item(Global): Logical Maximum, data= [ 0x7f ] 127 Item(Main ): Input, data= [ 0x07 ] 7 Constant Variable Relative No_Wrap Linear Preferred_State No_Null_Position Non_Volatile Bitfield # usbhid-dump 003:002:001:DESCRIPTOR 1357910009.758544 05 01 09 02 A1 01 05 01 09 02 A1 02 85 01 09 01 A1 00 05 09 19 01 29 05 95 05 75 01 15 00 25 01 81 02 75 03 95 01 81 01 05 01 09 30 09 31 95 02 75 08 15 81 25 7F 81 07 A1 02 85 01 09 38 35 00 45 00 15 81 25 7F 95 01 75 08 81 06 C0 A1 02 85 01 05 0C 15 81 25 7F 95 01 75 08 0A 38 02 81 06 C0 C0 C0 C0 Cc: linux-input@vger.kernel.org Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Fernando Luis Vazquez Cao Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 1daa6fc04f1bf8b5573eb9d29d5e9791d15172f7 Author: Alexey Kaminsky Date: Mon Apr 23 18:02:18 2012 +0200 HID: apple: Add Apple wireless keyboard 2011 ANSI PID commit 0a97e1e9f9a6765e6243030ac42b04694f3f3647 upstream. Signed-off-by: Alexey Kaminsky Signed-off-by: Jiri Kosina [bwh: Backported to 3.2: add the device ID to hid-ids.h] Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 7fc19240123296c99b003806fe75cfb19c0ad54a Author: Alexey Khoroshilov Date: Wed Aug 15 23:31:45 2012 +0400 HID: hidraw: improve error handling in hidraw_init() commit bcb4a75bde3821cecb17a71d287abfd6ef9bd68d upstream. Several improvements in error handling: - do not report success if alloc_chrdev_region() failed - check for error code of cdev_add() - use unregister_chrdev_region() instead of unregister_chrdev() if class_create() failed Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit a6cec16f2227453df9143e47ac008301d6966e93 Author: Matthieu CASTET Date: Thu Jun 28 16:51:56 2012 +0200 HID: hidraw: fix list->buffer memleak commit 4c7b417ecb756e85dfc955b0e7a04fd45585533e upstream. If we don't read fast enough hidraw device, hidraw_report_event will cycle and we will leak list->buffer. Also list->buffer are not free on release. After this patch, kmemleak report nothing. Signed-off-by: Matthieu CASTET Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 32bb39f80ffb6b63c78b418bec35a2ce1fc0abe1 Author: Jiri Kosina Date: Mon Apr 30 10:39:17 2012 +0200 HID: fix return value of hidraw_report_event() when !CONFIG_HIDRAW commit d6d7c873529abd622897cad5e36f1fd7d82f5110 upstream. Commit b6787242f327 ("HID: hidraw: add proper error handling to raw event reporting") forgot to update the static inline version of hidraw_report_event() for the case when CONFIG_HIDRAW is unset. Fix that up. Reported-by: Stephen Rothwell Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 588256df90f26647828489e45d82b72e97d624e9 Author: Jiri Kosina Date: Fri Apr 27 00:56:08 2012 +0200 HID: hidraw: add proper error handling to raw event reporting commit b6787242f32700377d3da3b8d788ab3928bab849 upstream. If kmemdup() in hidraw_report_event() fails, we are not propagating this fact properly. Let hidraw_report_event() and hid_report_raw_event() return an error value to the caller. Reported-by: Oliver Neukum Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings Cc: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit f11c6f07cb7d33abb503e87909aba80c8605d141 Author: Benjamin Tissoires Date: Wed Sep 11 21:56:58 2013 +0200 HID: multitouch: validate indexes details commit 8821f5dc187bdf16cfb32ef5aa8c3035273fa79a upstream. When working on report indexes, always validate that they are in bounds. Without this, a HID device could report a malicious feature report that could trick the driver into a heap overflow: [ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500 ... [ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten Note that we need to change the indexes from s8 to s16 as they can be between -1 and 255. CVE-2013-2897 Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Acked-by: Kees Cook Signed-off-by: Jiri Kosina [bwh: Backported to 3.2: mt_device::{cc,cc_value,inputmode}_index do not exist and the corresponding indices do not need to be validated. mt_device::maxcontact_report_id does not exist either. So all we need to do is to widen mt_device::inputmode.] Signed-off-by: Ben Hutchings [yjw: Backport to 3.4: maxcontact_report_id exists, need to be validated] Signed-off-by: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 9588aaee5106ef803958fcd1bb72395d71b2f88b Author: Benjamin Tissoires Date: Wed Sep 11 21:56:57 2013 +0200 HID: validate feature and input report details commit cc6b54aa54bf40b762cab45a9fc8aa81653146eb upstream. When dealing with usage_index, be sure to properly use unsigned instead of int to avoid overflows. When working on report fields, always validate that their report_counts are in bounds. Without this, a HID device could report a malicious feature report that could trick the driver into a heap overflow: [ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500 ... [ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2897 Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Acked-by: Kees Cook Signed-off-by: Jiri Kosina [bwh: Backported to 3.2: - Drop inapplicable changes to hid_usage::usage_index initialisation and to hid_report_raw_event() - Adjust context in report_features() Signed-off-by: Ben Hutchings [yijingwang: Backported to 3.4: context adjust] Signed-off-by: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 474363f4e49812cda182af925cfeb43c4619369d Author: Nicholas Santos Date: Fri Dec 28 22:07:02 2012 -0500 HID: usbhid: quirk for Formosa IR receiver commit 320cde19a4e8f122b19d2df7a5c00636e11ca3fb upstream. Patch to add the Formosa Industrial Computing, Inc. Infrared Receiver [IR605A/Q] to hid-ids.h and hid-quirks.c. This IR receiver causes about a 10 second timeout when the usbhid driver attempts to initialze the device. Adding this device to the quirks list with HID_QUIRK_NO_INIT_REPORTS removes the delay. Signed-off-by: Nicholas Santos [jkosina@suse.cz: fix ordering] Signed-off-by: Jiri Kosina Signed-off-by: Nicholas Santos [jkosina@suse.cz: fix ordering] Signed-off-by: Jiri Kosina Signed-off-by: Ben Hutchings [yjw: Backported to 3.4: adjust context] Signed-off-by: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 0d601687bfc8c0dc9ef7fa242c91a18b9a0fee25 Author: Marek Vasut Date: Sun Aug 5 23:57:15 2012 +0200 HID: add quirk for Freescale i.MX28 ROM recovery commit 2843b673d03421e0e73cf061820d1db328f7c8eb upstream. The USB recovery mode present in i.MX28 ROM emulates USB HID. It needs this quirk to behave properly. Signed-off-by: Marek Vasut Cc: Chen Peter Cc: Greg KH Cc: Jiri Kosina [jkosina@suse.cz: fix alphabetical ordering] Signed-off-by: Jiri Kosina [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings [yjw: Backported to 3.4: adjust context] Signed-off-by: Yijing Wang Signed-off-by: Greg Kroah-Hartman commit 6535fb1535c0053ac22c2ed5c20b9465f30a523e Author: Konrad Rzeszutek Wilk Date: Thu Aug 16 22:06:55 2012 +0200 intel_idle: Check cpu_idle_get_driver() for NULL before dereferencing it. commit 3735d524da64b70b41c764359da36f88aded3610 upstream. If the machine is booted without any cpu_idle driver set (b/c disable_cpuidle() has been called) we should follow other users of cpu_idle API and check the return value for NULL before using it. Reported-and-tested-by: Mark van Dijk Suggested-by: Jan Beulich Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Rafael J. Wysocki Cc: Daniel Kiper Signed-off-by: Greg Kroah-Hartman commit 23a5a7a2dafd877ec853b4c7debf6d726d10f9b9 Author: Paul Moore Date: Wed Mar 19 16:46:18 2014 -0400 selinux: correctly label /proc inodes in use before the policy is loaded commit f64410ec665479d7b4b77b7519e814253ed0f686 upstream. This patch is based on an earlier patch by Eric Paris, he describes the problem below: "If an inode is accessed before policy load it will get placed on a list of inodes to be initialized after policy load. After policy load we call inode_doinit() which calls inode_doinit_with_dentry() on all inodes accessed before policy load. In the case of inodes in procfs that means we'll end up at the bottom where it does: /* Default to the fs superblock SID. */ isec->sid = sbsec->sid; if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) { if (opt_dentry) { isec->sclass = inode_mode_to_security_class(...) rc = selinux_proc_get_sid(opt_dentry, isec->sclass, &sid); if (rc) goto out_unlock; isec->sid = sid; } } Since opt_dentry is null, we'll never call selinux_proc_get_sid() and will leave the inode labeled with the label on the superblock. I believe a fix would be to mimic the behavior of xattrs. Look for an alias of the inode. If it can't be found, just leave the inode uninitialized (and pick it up later) if it can be found, we should be able to call selinux_proc_get_sid() ..." On a system exhibiting this problem, you will notice a lot of files in /proc with the generic "proc_t" type (at least the ones that were accessed early in the boot), for example: # ls -Z /proc/sys/kernel/shmmax | awk '{ print $4 " " $5 }' system_u:object_r:proc_t:s0 /proc/sys/kernel/shmmax However, with this patch in place we see the expected result: # ls -Z /proc/sys/kernel/shmmax | awk '{ print $4 " " $5 }' system_u:object_r:sysctl_kernel_t:s0 /proc/sys/kernel/shmmax Cc: Eric Paris Signed-off-by: Paul Moore Acked-by: Eric Paris Signed-off-by: Greg Kroah-Hartman commit cd59fb14918a6b20c1ac8be121fa6397b97b00cb Author: George Spelvin Date: Tue Feb 12 02:27:20 2013 -0500 pps: Fix a use-after free bug when unregistering a source. commit d953e0e837e65ecc1ddaa4f9560f7925878a0de6 upstream. Remove the cdev from the system (with cdev_del) *before* deallocating it (in pps_device_destruct, called via kobject_put from device_destroy). Also prevent deallocating a device with open file handles. A better long-term fix is probably to remove the cdev from the pps_device entirely, and instead have all devices reference one global cdev. Then the deallocation ordering becomes simpler. But that's more complex and invasive change, so we leave that for later. Signed-off-by: George Spelvin Acked-by: Rodolfo Giometti Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 0965dca06d3659d7cdab7a7e40694affc21be3c9 Author: George Spelvin Date: Sun Feb 10 04:41:56 2013 -0500 pps: Use pps_lookup_dev to reduce ldisc coupling commit 03a7ffe4e542310838bac70ef85acc17536b6d7c upstream. Now that N_TTY uses tty->disc_data for its private data, 'subclass' ldiscs cannot use ->disc_data for their own private data. (This is a regression is v3.8-rc1) Use pps_lookup_dev to associate the tty with the pps source instead. This fixes a crashing regression in 3.8-rc1. Signed-off-by: George Spelvin Acked-by: Rodolfo Giometti Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 71a521898740fc57b062dddd9cff51c9e835cd43 Author: George Spelvin Date: Sun Feb 10 04:08:32 2013 -0500 pps: Add pps_lookup_dev() function commit 513b032c98b4b9414aa4e9b4a315cb1bf0380101 upstream. The PPS serial line discipline wants to attach a PPS device to a tty without changing the tty code to add a struct pps_device * pointer. Since the number of PPS devices in a typical system is generally very low (n=1 is by far the most common), it's practical to search the entire list of allocated pps devices. (We capture the timestamp before the lookup, so the timing isn't affected.) It is a bit ugly that this function, which is part of the in-kernel PPS API, has to be in pps.c as opposed to kapi,c, but that's not something that affects users. Signed-off-by: George Spelvin Acked-by: Rodolfo Giometti Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit ee164499c5f538f1cd8e5cf31e157aff32ea0546 Author: Philipp Reisner Date: Wed Jul 20 14:59:37 2011 +0200 idr: idr_for_each_entry() macro commit 9749f30f1a387070e6e8351f35aeb829eacc3ab6 upstream. Inspired by the list_for_each_entry() macro Signed-off-by: Philipp Reisner Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 5a27d6987454a169a4f3362e1a14c77ad1aca193 Author: Mathias Krause Date: Tue Nov 12 15:11:47 2013 -0800 ipc, msg: fix message length check for negative values commit 4e9b45a19241354daec281d7a785739829b52359 upstream. On 64 bit systems the test for negative message sizes is bogus as the size, which may be positive when evaluated as a long, will get truncated to an int when passed to load_msg(). So a long might very well contain a positive value but when truncated to an int it would become negative. That in combination with a small negative value of msg_ctlmax (which will be promoted to an unsigned type for the comparison against msgsz, making it a big positive value and therefore make it pass the check) will lead to two problems: 1/ The kmalloc() call in alloc_msg() will allocate a too small buffer as the addition of alen is effectively a subtraction. 2/ The copy_from_user() call in load_msg() will first overflow the buffer with userland data and then, when the userland access generates an access violation, the fixup handler copy_user_handle_tail() will try to fill the remainder with zeros -- roughly 4GB. That almost instantly results in a system crash or reset. ,-[ Reproducer (needs to be run as root) ]-- | #include | #include | #include | #include | | int main(void) { | long msg = 1; | int fd; | | fd = open("/proc/sys/kernel/msgmax", O_WRONLY); | write(fd, "-1", 2); | close(fd); | | msgsnd(0, &msg, 0xfffffff0, IPC_NOWAIT); | | return 0; | } '--- Fix the issue by preventing msgsz from getting truncated by consistently using size_t for the message length. This way the size checks in do_msgsnd() could still be passed with a negative value for msg_ctlmax but we would fail on the buffer allocation in that case and error out. Also change the type of m_ts from int to size_t to avoid similar nastiness in other code paths -- it is used in similar constructs, i.e. signed vs. unsigned checks. It should never become negative under normal circumstances, though. Setting msg_ctlmax to a negative value is an odd configuration and should be prevented. As that might break existing userland, it will be handled in a separate commit so it could easily be reverted and reworked without reintroducing the above described bug. Hardening mechanisms for user copy operations would have catched that bug early -- e.g. checking slab object sizes on user copy operations as the usercopy feature of the PaX patch does. Or, for that matter, detect the long vs. int sign change due to truncation, as the size overflow plugin of the very same patch does. [akpm@linux-foundation.org: fix i386 min() warnings] Signed-off-by: Mathias Krause Cc: Pax Team Cc: Davidlohr Bueso Cc: Brad Spengler Cc: Manfred Spraul Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [bwh: Backported to 3.2: - Adjust context - Drop changes to alloc_msg() and copy_msg(), which don't exist] Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit d19157519c9d76828df39cae34cc0d824356f7db Author: Ingo Molnar Date: Thu Oct 10 10:16:30 2013 +0200 compiler/gcc4: Add quirk for 'asm goto' miscompilation bug commit 3f0116c3238a96bc18ad4b4acefe4e7be32fa861 upstream. Fengguang Wu, Oleg Nesterov and Peter Zijlstra tracked down a kernel crash to a GCC bug: GCC miscompiles certain 'asm goto' constructs, as outlined here: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 Implement a workaround suggested by Jakub Jelinek. Reported-and-tested-by: Fengguang Wu Reported-by: Oleg Nesterov Reported-by: Peter Zijlstra Suggested-by: Jakub Jelinek Reviewed-by: Richard Henderson Cc: Linus Torvalds Cc: Andrew Morton Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings [hq: Backported to 3.4: Adjust context] Signed-off-by: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 460207adba76ac1279f4b72e54196b17d5d18cc2 Author: Daniel Santos Date: Thu Feb 21 16:41:39 2013 -0800 compiler-gcc.h: Add gcc-recommended GCC_VERSION macro commit 3f3f8d2f48acfd8ed3b8e6b7377935da57b27b16 upstream. Throughout compiler*.h, many version checks are made. These can be simplified by using the macro that gcc's documentation recommends. However, my primary reason for adding this is that I need bug-check macros that are enabled at certain gcc versions and it's cleaner to use this macro than the tradition method: #if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ => 2) If you add patch level, it gets this ugly: #if __GNUC__ > 4 || (__GNUC__ == 4 && (__GNUC_MINOR__ > 2 || \ __GNUC_MINOR__ == 2 __GNUC_PATCHLEVEL__ >= 1)) As opposed to: #if GCC_VERSION >= 40201 While having separate headers for gcc 3 & 4 eliminates some of this verbosity, they can still be cleaned up by this. See also: http://gcc.gnu.org/onlinedocs/cpp/Common-Predefined-Macros.html Signed-off-by: Daniel Santos Acked-by: Borislav Petkov Acked-by: David Rientjes Cc: Andi Kleen Cc: Joe Perches Cc: Josh Triplett Cc: Paul Gortmaker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 00cef7a5e0766f0f4bedc9da1c80fbe992cf68ef Author: Tejun Heo Date: Wed Aug 28 17:33:37 2013 -0400 workqueue: cond_resched() after processing each work item commit b22ce2785d97423846206cceec4efee0c4afd980 upstream. If !PREEMPT, a kworker running work items back to back can hog CPU. This becomes dangerous when a self-requeueing work item which is waiting for something to happen races against stop_machine. Such self-requeueing work item would requeue itself indefinitely hogging the kworker and CPU it's running on while stop_machine would wait for that CPU to enter stop_machine while preventing anything else from happening on all other CPUs. The two would deadlock. Jamie Liu reports that this deadlock scenario exists around scsi_requeue_run_queue() and libata port multiplier support, where one port may exclude command processing from other ports. With the right timing, scsi_requeue_run_queue() can end up requeueing itself trying to execute an IO which is asked to be retried while another device has an exclusive access, which in turn can't make forward progress due to stop_machine. Fix it by invoking cond_resched() after executing each work item. Signed-off-by: Tejun Heo Reported-by: Jamie Liu References: http://thread.gmane.org/gmane.linux.kernel/1552567 [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit aa34e62c2f0d4a105606971a1eb666f22338993b Author: Bu, Yitian Date: Mon Feb 18 12:53:37 2013 +0000 printk: Fix rq->lock vs logbuf_lock unlock lock inversion commit dbda92d16f8655044e082930e4e9d244b87fde77 upstream. commit 07354eb1a74d1 ("locking printk: Annotate logbuf_lock as raw") reintroduced a lock inversion problem which was fixed in commit 0b5e1c5255 ("printk: Release console_sem after logbuf_lock"). This happened probably when fixing up patch rejects. Restore the ordering and unlock logbuf_lock before releasing console_sem. Signed-off-by: ybu Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/E807E903FE6CBE4D95E420FBFCC273B827413C@nasanexd01h.na.qualcomm.com Signed-off-by: Thomas Gleixner [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 0df19efa7549d47aa906b8316665e46366b56061 Author: Oleg Nesterov Date: Wed Jun 12 14:04:46 2013 -0700 audit: wait_for_auditd() should use TASK_UNINTERRUPTIBLE commit f000cfdde5de4fc15dead5ccf524359c07eadf2b upstream. audit_log_start() does wait_for_auditd() in a loop until audit_backlog_wait_time passes or audit_skb_queue has a room. If signal_pending() is true this becomes a busy-wait loop, schedule() in TASK_INTERRUPTIBLE won't block. Thanks to Guy for fully investigating and explaining the problem. (akpm: that'll cause the system to lock up on a non-preemptible uniprocessor kernel) (Guy: "Our customer was in fact running a uniprocessor machine, and they reported a system hang.") Signed-off-by: Oleg Nesterov Reported-by: Guy Streeter Cc: Eric Paris Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [bwh: Backported to 3.2: adjust context, indentation] Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit c45821f729ca087f87aa9ea08ffe964584a0d605 Author: Tejun Heo Date: Wed Feb 27 17:05:02 2013 -0800 idr: fix top layer handling commit 326cf0f0f308933c10236280a322031f0097205d upstream. Most functions in idr fail to deal with the high bits when the idr tree grows to the maximum height. * idr_get_empty_slot() stops growing idr tree once the depth reaches MAX_IDR_LEVEL - 1, which is one depth shallower than necessary to cover the whole range. The function doesn't even notice that it didn't grow the tree enough and ends up allocating the wrong ID given sufficiently high @starting_id. For example, on 64 bit, if the starting id is 0x7fffff01, idr_get_empty_slot() will grow the tree 5 layer deep, which only covers the 30 bits and then proceed to allocate as if the bit 30 wasn't specified. It ends up allocating 0x3fffff01 without the bit 30 but still returns 0x7fffff01. * __idr_remove_all() will not remove anything if the tree is fully grown. * idr_find() can't find anything if the tree is fully grown. * idr_for_each() and idr_get_next() can't iterate anything if the tree is fully grown. Fix it by introducing idr_max() which returns the maximum possible ID given the depth of tree and replacing the id limit checks in all affected places. As the idr_layer pointer array pa[] needs to be 1 larger than the maximum depth, enlarge pa[] arrays by one. While this plugs the discovered issues, the whole code base is horrible and in desparate need of rewrite. It's fragile like hell, Signed-off-by: Tejun Heo Cc: Rusty Russell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [bwh: Backported to 3.2: - Adjust context - s/MAX_IDR_LEVEL/MAX_LEVEL/; s/MAX_IDR_SHIFT/MAX_ID_SHIFT/ - Drop change to idr_alloc()] Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman commit 4ca2cf4abaae2bda2feea8ec5eb0d18723a43553 Author: Artem Bityutskiy Date: Mon Dec 17 16:03:17 2012 -0800 proc: pid/status: show all supplementary groups commit 8d238027b87e654be552eabdf492042a34c5c300 upstream. We display a list of supplementary group for each process in /proc//status. However, we show only the first 32 groups, not all of them. Although this is rare, but sometimes processes do have more than 32 supplementary groups, and this kernel limitation breaks user-space apps that rely on the group list in /proc//status. Number 32 comes from the internal NGROUPS_SMALL macro which defines the length for the internal kernel "small" groups buffer. There is no apparent reason to limit to this value. This patch removes the 32 groups printing limit. The Linux kernel limits the amount of supplementary groups by NGROUPS_MAX, which is currently set to 65536. And this is the maximum count of groups we may possibly print. Signed-off-by: Artem Bityutskiy Acked-by: Serge E. Hallyn Acked-by: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings Cc: Qiang Huang Cc: Li Zefan Cc: Jianguo Wu Signed-off-by: Greg Kroah-Hartman