Contents of /trunk/kernel-lts/patches-3.4/0128-3.4.29-all-fixes.patch
Parent Directory | Revision Log
Revision 2065 -
(show annotations)
(download)
Wed Feb 6 10:50:19 2013 UTC (11 years, 7 months ago) by niro
File size: 32240 byte(s)
Wed Feb 6 10:50:19 2013 UTC (11 years, 7 months ago) by niro
File size: 32240 byte(s)
-linux-3.4.29
1 | diff --git a/Makefile b/Makefile |
2 | index 8ccebba..23bcb1a 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 4 |
8 | -SUBLEVEL = 28 |
9 | +SUBLEVEL = 29 |
10 | EXTRAVERSION = |
11 | NAME = Saber-toothed Squirrel |
12 | |
13 | diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c |
14 | index 582142e..55293a7 100644 |
15 | --- a/arch/arm/mach-at91/setup.c |
16 | +++ b/arch/arm/mach-at91/setup.c |
17 | @@ -104,6 +104,8 @@ static void __init soc_detect(u32 dbgu_base) |
18 | switch (socid) { |
19 | case ARCH_ID_AT91RM9200: |
20 | at91_soc_initdata.type = AT91_SOC_RM9200; |
21 | + if (at91_soc_initdata.subtype == AT91_SOC_SUBTYPE_NONE) |
22 | + at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA; |
23 | at91_boot_soc = at91rm9200_soc; |
24 | break; |
25 | |
26 | diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c |
27 | index db23ae4..a3e4adf 100644 |
28 | --- a/arch/arm/mm/dma-mapping.c |
29 | +++ b/arch/arm/mm/dma-mapping.c |
30 | @@ -503,25 +503,27 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset, |
31 | size_t size, enum dma_data_direction dir, |
32 | void (*op)(const void *, size_t, int)) |
33 | { |
34 | + unsigned long pfn; |
35 | + size_t left = size; |
36 | + |
37 | + pfn = page_to_pfn(page) + offset / PAGE_SIZE; |
38 | + offset %= PAGE_SIZE; |
39 | + |
40 | /* |
41 | * A single sg entry may refer to multiple physically contiguous |
42 | * pages. But we still need to process highmem pages individually. |
43 | * If highmem is not configured then the bulk of this loop gets |
44 | * optimized out. |
45 | */ |
46 | - size_t left = size; |
47 | do { |
48 | size_t len = left; |
49 | void *vaddr; |
50 | |
51 | + page = pfn_to_page(pfn); |
52 | + |
53 | if (PageHighMem(page)) { |
54 | - if (len + offset > PAGE_SIZE) { |
55 | - if (offset >= PAGE_SIZE) { |
56 | - page += offset / PAGE_SIZE; |
57 | - offset %= PAGE_SIZE; |
58 | - } |
59 | + if (len + offset > PAGE_SIZE) |
60 | len = PAGE_SIZE - offset; |
61 | - } |
62 | vaddr = kmap_high_get(page); |
63 | if (vaddr) { |
64 | vaddr += offset; |
65 | @@ -538,7 +540,7 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset, |
66 | op(vaddr, len, dir); |
67 | } |
68 | offset = 0; |
69 | - page++; |
70 | + pfn++; |
71 | left -= len; |
72 | } while (left); |
73 | } |
74 | diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S |
75 | index cc926c9..323ce1a 100644 |
76 | --- a/arch/arm/vfp/entry.S |
77 | +++ b/arch/arm/vfp/entry.S |
78 | @@ -22,7 +22,7 @@ |
79 | @ IRQs disabled. |
80 | @ |
81 | ENTRY(do_vfp) |
82 | -#ifdef CONFIG_PREEMPT |
83 | +#ifdef CONFIG_PREEMPT_COUNT |
84 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
85 | add r11, r4, #1 @ increment it |
86 | str r11, [r10, #TI_PREEMPT] |
87 | @@ -35,7 +35,7 @@ ENTRY(do_vfp) |
88 | ENDPROC(do_vfp) |
89 | |
90 | ENTRY(vfp_null_entry) |
91 | -#ifdef CONFIG_PREEMPT |
92 | +#ifdef CONFIG_PREEMPT_COUNT |
93 | get_thread_info r10 |
94 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
95 | sub r11, r4, #1 @ decrement it |
96 | @@ -53,7 +53,7 @@ ENDPROC(vfp_null_entry) |
97 | |
98 | __INIT |
99 | ENTRY(vfp_testing_entry) |
100 | -#ifdef CONFIG_PREEMPT |
101 | +#ifdef CONFIG_PREEMPT_COUNT |
102 | get_thread_info r10 |
103 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
104 | sub r11, r4, #1 @ decrement it |
105 | diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S |
106 | index 3a0efaa..6ff903e 100644 |
107 | --- a/arch/arm/vfp/vfphw.S |
108 | +++ b/arch/arm/vfp/vfphw.S |
109 | @@ -167,7 +167,7 @@ vfp_hw_state_valid: |
110 | @ else it's one 32-bit instruction, so |
111 | @ always subtract 4 from the following |
112 | @ instruction address. |
113 | -#ifdef CONFIG_PREEMPT |
114 | +#ifdef CONFIG_PREEMPT_COUNT |
115 | get_thread_info r10 |
116 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
117 | sub r11, r4, #1 @ decrement it |
118 | @@ -191,7 +191,7 @@ look_for_VFP_exceptions: |
119 | @ not recognised by VFP |
120 | |
121 | DBGSTR "not VFP" |
122 | -#ifdef CONFIG_PREEMPT |
123 | +#ifdef CONFIG_PREEMPT_COUNT |
124 | get_thread_info r10 |
125 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
126 | sub r11, r4, #1 @ decrement it |
127 | diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c |
128 | index eb11369..8563b64 100644 |
129 | --- a/arch/x86/kernel/msr.c |
130 | +++ b/arch/x86/kernel/msr.c |
131 | @@ -174,6 +174,9 @@ static int msr_open(struct inode *inode, struct file *file) |
132 | unsigned int cpu; |
133 | struct cpuinfo_x86 *c; |
134 | |
135 | + if (!capable(CAP_SYS_RAWIO)) |
136 | + return -EPERM; |
137 | + |
138 | cpu = iminor(file->f_path.dentry->d_inode); |
139 | if (cpu >= nr_cpu_ids || !cpu_online(cpu)) |
140 | return -ENXIO; /* No such CPU */ |
141 | diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c |
142 | index d289ee7..b71e4a5 100644 |
143 | --- a/arch/x86/kernel/setup.c |
144 | +++ b/arch/x86/kernel/setup.c |
145 | @@ -622,6 +622,7 @@ static unsigned reserve_low = CONFIG_X86_RESERVE_LOW << 10; |
146 | |
147 | static bool __init snb_gfx_workaround_needed(void) |
148 | { |
149 | +#ifdef CONFIG_PCI |
150 | int i; |
151 | u16 vendor, devid; |
152 | static const u16 snb_ids[] = { |
153 | @@ -646,6 +647,7 @@ static bool __init snb_gfx_workaround_needed(void) |
154 | for (i = 0; i < ARRAY_SIZE(snb_ids); i++) |
155 | if (devid == snb_ids[i]) |
156 | return true; |
157 | +#endif |
158 | |
159 | return false; |
160 | } |
161 | diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c |
162 | index 72d8899..6825327 100644 |
163 | --- a/arch/x86/platform/efi/efi.c |
164 | +++ b/arch/x86/platform/efi/efi.c |
165 | @@ -900,7 +900,7 @@ void __init efi_enter_virtual_mode(void) |
166 | * |
167 | * Call EFI services through wrapper functions. |
168 | */ |
169 | - efi.runtime_version = efi_systab.fw_revision; |
170 | + efi.runtime_version = efi_systab.hdr.revision; |
171 | efi.get_time = virt_efi_get_time; |
172 | efi.set_time = virt_efi_set_time; |
173 | efi.get_wakeup_time = virt_efi_get_wakeup_time; |
174 | diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c |
175 | index ac3aa54..0fba86d 100644 |
176 | --- a/arch/x86/platform/efi/efi_64.c |
177 | +++ b/arch/x86/platform/efi/efi_64.c |
178 | @@ -38,7 +38,7 @@ |
179 | #include <asm/cacheflush.h> |
180 | #include <asm/fixmap.h> |
181 | |
182 | -static pgd_t save_pgd __initdata; |
183 | +static pgd_t *save_pgd __initdata; |
184 | static unsigned long efi_flags __initdata; |
185 | |
186 | static void __init early_code_mapping_set_exec(int executable) |
187 | @@ -61,12 +61,20 @@ static void __init early_code_mapping_set_exec(int executable) |
188 | void __init efi_call_phys_prelog(void) |
189 | { |
190 | unsigned long vaddress; |
191 | + int pgd; |
192 | + int n_pgds; |
193 | |
194 | early_code_mapping_set_exec(1); |
195 | local_irq_save(efi_flags); |
196 | - vaddress = (unsigned long)__va(0x0UL); |
197 | - save_pgd = *pgd_offset_k(0x0UL); |
198 | - set_pgd(pgd_offset_k(0x0UL), *pgd_offset_k(vaddress)); |
199 | + |
200 | + n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE); |
201 | + save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL); |
202 | + |
203 | + for (pgd = 0; pgd < n_pgds; pgd++) { |
204 | + save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE); |
205 | + vaddress = (unsigned long)__va(pgd * PGDIR_SIZE); |
206 | + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress)); |
207 | + } |
208 | __flush_tlb_all(); |
209 | } |
210 | |
211 | @@ -75,7 +83,11 @@ void __init efi_call_phys_epilog(void) |
212 | /* |
213 | * After the lock is released, the original page table is restored. |
214 | */ |
215 | - set_pgd(pgd_offset_k(0x0UL), save_pgd); |
216 | + int pgd; |
217 | + int n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE); |
218 | + for (pgd = 0; pgd < n_pgds; pgd++) |
219 | + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]); |
220 | + kfree(save_pgd); |
221 | __flush_tlb_all(); |
222 | local_irq_restore(efi_flags); |
223 | early_code_mapping_set_exec(0); |
224 | diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c |
225 | index 97f5064..686ac03 100644 |
226 | --- a/drivers/edac/edac_pci_sysfs.c |
227 | +++ b/drivers/edac/edac_pci_sysfs.c |
228 | @@ -257,7 +257,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj, |
229 | struct edac_pci_dev_attribute *edac_pci_dev; |
230 | edac_pci_dev = (struct edac_pci_dev_attribute *)attr; |
231 | |
232 | - if (edac_pci_dev->show) |
233 | + if (edac_pci_dev->store) |
234 | return edac_pci_dev->store(edac_pci_dev->value, buffer, count); |
235 | return -EIO; |
236 | } |
237 | diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c |
238 | index 711e95a..8fb6f41 100644 |
239 | --- a/drivers/gpu/drm/radeon/radeon_cursor.c |
240 | +++ b/drivers/gpu/drm/radeon/radeon_cursor.c |
241 | @@ -238,7 +238,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc, |
242 | y = 0; |
243 | } |
244 | |
245 | - if (ASIC_IS_AVIVO(rdev)) { |
246 | + /* fixed on DCE6 and newer */ |
247 | + if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) { |
248 | int i = 0; |
249 | struct drm_crtc *crtc_p; |
250 | |
251 | diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c |
252 | index 173b97b..1f50727 100644 |
253 | --- a/drivers/gpu/drm/radeon/radeon_display.c |
254 | +++ b/drivers/gpu/drm/radeon/radeon_display.c |
255 | @@ -1136,7 +1136,7 @@ radeon_user_framebuffer_create(struct drm_device *dev, |
256 | if (ret) { |
257 | kfree(radeon_fb); |
258 | drm_gem_object_unreference_unlocked(obj); |
259 | - return NULL; |
260 | + return ERR_PTR(ret); |
261 | } |
262 | |
263 | return &radeon_fb->base; |
264 | diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c |
265 | index c04ddca..ef0ae93 100644 |
266 | --- a/drivers/iommu/amd_iommu_init.c |
267 | +++ b/drivers/iommu/amd_iommu_init.c |
268 | @@ -1002,6 +1002,38 @@ static void __init free_iommu_all(void) |
269 | } |
270 | |
271 | /* |
272 | + * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations) |
273 | + * Workaround: |
274 | + * BIOS should disable L2B micellaneous clock gating by setting |
275 | + * L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b |
276 | + */ |
277 | +static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu) |
278 | +{ |
279 | + u32 value; |
280 | + |
281 | + if ((boot_cpu_data.x86 != 0x15) || |
282 | + (boot_cpu_data.x86_model < 0x10) || |
283 | + (boot_cpu_data.x86_model > 0x1f)) |
284 | + return; |
285 | + |
286 | + pci_write_config_dword(iommu->dev, 0xf0, 0x90); |
287 | + pci_read_config_dword(iommu->dev, 0xf4, &value); |
288 | + |
289 | + if (value & BIT(2)) |
290 | + return; |
291 | + |
292 | + /* Select NB indirect register 0x90 and enable writing */ |
293 | + pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8)); |
294 | + |
295 | + pci_write_config_dword(iommu->dev, 0xf4, value | 0x4); |
296 | + pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n", |
297 | + dev_name(&iommu->dev->dev)); |
298 | + |
299 | + /* Clear the enable writing bit */ |
300 | + pci_write_config_dword(iommu->dev, 0xf0, 0x90); |
301 | +} |
302 | + |
303 | +/* |
304 | * This function clues the initialization function for one IOMMU |
305 | * together and also allocates the command buffer and programs the |
306 | * hardware. It does NOT enable the IOMMU. This is done afterwards. |
307 | @@ -1062,6 +1094,8 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h) |
308 | if (iommu->cap & (1UL << IOMMU_CAP_NPCACHE)) |
309 | amd_iommu_np_cache = true; |
310 | |
311 | + amd_iommu_erratum_746_workaround(iommu); |
312 | + |
313 | return pci_enable_device(iommu->dev); |
314 | } |
315 | |
316 | diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c |
317 | index be66606..5d71873 100644 |
318 | --- a/drivers/iommu/intel-iommu.c |
319 | +++ b/drivers/iommu/intel-iommu.c |
320 | @@ -4193,6 +4193,21 @@ static struct iommu_ops intel_iommu_ops = { |
321 | .pgsize_bitmap = INTEL_IOMMU_PGSIZES, |
322 | }; |
323 | |
324 | +static void __devinit quirk_iommu_g4x_gfx(struct pci_dev *dev) |
325 | +{ |
326 | + /* G4x/GM45 integrated gfx dmar support is totally busted. */ |
327 | + printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n"); |
328 | + dmar_map_gfx = 0; |
329 | +} |
330 | + |
331 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx); |
332 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx); |
333 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx); |
334 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_g4x_gfx); |
335 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_g4x_gfx); |
336 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_g4x_gfx); |
337 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_g4x_gfx); |
338 | + |
339 | static void __devinit quirk_iommu_rwbf(struct pci_dev *dev) |
340 | { |
341 | /* |
342 | @@ -4201,12 +4216,6 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev) |
343 | */ |
344 | printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n"); |
345 | rwbf_quirk = 1; |
346 | - |
347 | - /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */ |
348 | - if (dev->revision == 0x07) { |
349 | - printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n"); |
350 | - dmar_map_gfx = 0; |
351 | - } |
352 | } |
353 | |
354 | DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf); |
355 | diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c |
356 | index 86cd532..21a3d77 100644 |
357 | --- a/drivers/net/can/c_can/c_can.c |
358 | +++ b/drivers/net/can/c_can/c_can.c |
359 | @@ -914,7 +914,7 @@ static int c_can_handle_bus_err(struct net_device *dev, |
360 | break; |
361 | case LEC_ACK_ERROR: |
362 | netdev_dbg(dev, "ack error\n"); |
363 | - cf->data[2] |= (CAN_ERR_PROT_LOC_ACK | |
364 | + cf->data[3] |= (CAN_ERR_PROT_LOC_ACK | |
365 | CAN_ERR_PROT_LOC_ACK_DEL); |
366 | break; |
367 | case LEC_BIT1_ERROR: |
368 | @@ -927,7 +927,7 @@ static int c_can_handle_bus_err(struct net_device *dev, |
369 | break; |
370 | case LEC_CRC_ERROR: |
371 | netdev_dbg(dev, "CRC error\n"); |
372 | - cf->data[2] |= (CAN_ERR_PROT_LOC_CRC_SEQ | |
373 | + cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ | |
374 | CAN_ERR_PROT_LOC_CRC_DEL); |
375 | break; |
376 | default: |
377 | diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c |
378 | index 2bb215e..ab13a57 100644 |
379 | --- a/drivers/net/can/pch_can.c |
380 | +++ b/drivers/net/can/pch_can.c |
381 | @@ -560,7 +560,7 @@ static void pch_can_error(struct net_device *ndev, u32 status) |
382 | stats->rx_errors++; |
383 | break; |
384 | case PCH_CRC_ERR: |
385 | - cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
386 | + cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
387 | CAN_ERR_PROT_LOC_CRC_DEL; |
388 | priv->can.can_stats.bus_error++; |
389 | stats->rx_errors++; |
390 | diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c |
391 | index 5ec2700..19000aa 100644 |
392 | --- a/drivers/net/can/ti_hecc.c |
393 | +++ b/drivers/net/can/ti_hecc.c |
394 | @@ -746,12 +746,12 @@ static int ti_hecc_error(struct net_device *ndev, int int_status, |
395 | } |
396 | if (err_status & HECC_CANES_CRCE) { |
397 | hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE); |
398 | - cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
399 | + cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
400 | CAN_ERR_PROT_LOC_CRC_DEL; |
401 | } |
402 | if (err_status & HECC_CANES_ACKE) { |
403 | hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE); |
404 | - cf->data[2] |= CAN_ERR_PROT_LOC_ACK | |
405 | + cf->data[3] |= CAN_ERR_PROT_LOC_ACK | |
406 | CAN_ERR_PROT_LOC_ACK_DEL; |
407 | } |
408 | } |
409 | diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c |
410 | index 5eb53c9..2e4243f 100644 |
411 | --- a/drivers/net/wireless/ath/ath9k/beacon.c |
412 | +++ b/drivers/net/wireless/ath/ath9k/beacon.c |
413 | @@ -154,6 +154,7 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw, |
414 | skb->len, DMA_TO_DEVICE); |
415 | dev_kfree_skb_any(skb); |
416 | bf->bf_buf_addr = 0; |
417 | + bf->bf_mpdu = NULL; |
418 | } |
419 | |
420 | /* Get a new beacon from mac80211 */ |
421 | diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c |
422 | index c25226a..ec86d98 100644 |
423 | --- a/drivers/net/wireless/ath/ath9k/htc_hst.c |
424 | +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c |
425 | @@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, |
426 | endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv, |
427 | skb, htc_hdr->endpoint_id, |
428 | txok); |
429 | + } else { |
430 | + kfree_skb(skb); |
431 | } |
432 | } |
433 | |
434 | diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c |
435 | index 90b8527..039bac7 100644 |
436 | --- a/drivers/net/wireless/ath/ath9k/recv.c |
437 | +++ b/drivers/net/wireless/ath/ath9k/recv.c |
438 | @@ -778,6 +778,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc, |
439 | return NULL; |
440 | } |
441 | |
442 | + list_del(&bf->list); |
443 | if (!bf->bf_mpdu) |
444 | return bf; |
445 | |
446 | @@ -1966,14 +1967,15 @@ requeue_drop_frag: |
447 | sc->rx.frag = NULL; |
448 | } |
449 | requeue: |
450 | + list_add_tail(&bf->list, &sc->rx.rxbuf); |
451 | + if (flush) |
452 | + continue; |
453 | + |
454 | if (edma) { |
455 | - list_add_tail(&bf->list, &sc->rx.rxbuf); |
456 | ath_rx_edma_buf_link(sc, qtype); |
457 | } else { |
458 | - list_move_tail(&bf->list, &sc->rx.rxbuf); |
459 | ath_rx_buf_link(sc, bf); |
460 | - if (!flush) |
461 | - ath9k_hw_rxena(ah); |
462 | + ath9k_hw_rxena(ah); |
463 | } |
464 | } while (1); |
465 | |
466 | diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c |
467 | index 569ab8a..27f37c7 100644 |
468 | --- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c |
469 | +++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c |
470 | @@ -1400,9 +1400,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic) |
471 | #endif |
472 | t->ms = ms; |
473 | t->periodic = (bool) periodic; |
474 | - t->set = true; |
475 | - |
476 | - atomic_inc(&t->wl->callbacks); |
477 | + if (!t->set) { |
478 | + t->set = true; |
479 | + atomic_inc(&t->wl->callbacks); |
480 | + } |
481 | |
482 | ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms)); |
483 | } |
484 | diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c |
485 | index 4bc2711..2ab6b96 100644 |
486 | --- a/drivers/net/wireless/iwlegacy/common.c |
487 | +++ b/drivers/net/wireless/iwlegacy/common.c |
488 | @@ -3957,17 +3957,21 @@ il_connection_init_rx_config(struct il_priv *il) |
489 | |
490 | memset(&il->staging, 0, sizeof(il->staging)); |
491 | |
492 | - if (!il->vif) { |
493 | + switch (il->iw_mode) { |
494 | + case NL80211_IFTYPE_UNSPECIFIED: |
495 | il->staging.dev_type = RXON_DEV_TYPE_ESS; |
496 | - } else if (il->vif->type == NL80211_IFTYPE_STATION) { |
497 | + break; |
498 | + case NL80211_IFTYPE_STATION: |
499 | il->staging.dev_type = RXON_DEV_TYPE_ESS; |
500 | il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK; |
501 | - } else if (il->vif->type == NL80211_IFTYPE_ADHOC) { |
502 | + break; |
503 | + case NL80211_IFTYPE_ADHOC: |
504 | il->staging.dev_type = RXON_DEV_TYPE_IBSS; |
505 | il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK; |
506 | il->staging.filter_flags = |
507 | RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK; |
508 | - } else { |
509 | + break; |
510 | + default: |
511 | IL_ERR("Unsupported interface type %d\n", il->vif->type); |
512 | return; |
513 | } |
514 | @@ -4550,8 +4554,7 @@ out: |
515 | EXPORT_SYMBOL(il_mac_add_interface); |
516 | |
517 | static void |
518 | -il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif, |
519 | - bool mode_change) |
520 | +il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif) |
521 | { |
522 | lockdep_assert_held(&il->mutex); |
523 | |
524 | @@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif, |
525 | il_force_scan_end(il); |
526 | } |
527 | |
528 | - if (!mode_change) |
529 | - il_set_mode(il); |
530 | - |
531 | + il_set_mode(il); |
532 | } |
533 | |
534 | void |
535 | @@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) |
536 | |
537 | WARN_ON(il->vif != vif); |
538 | il->vif = NULL; |
539 | - |
540 | - il_teardown_interface(il, vif, false); |
541 | + il->iw_mode = NL80211_IFTYPE_UNSPECIFIED; |
542 | + il_teardown_interface(il, vif); |
543 | memset(il->bssid, 0, ETH_ALEN); |
544 | |
545 | D_MAC80211("leave\n"); |
546 | @@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif, |
547 | } |
548 | |
549 | /* success */ |
550 | - il_teardown_interface(il, vif, true); |
551 | vif->type = newtype; |
552 | vif->p2p = false; |
553 | - err = il_set_mode(il); |
554 | - WARN_ON(err); |
555 | - /* |
556 | - * We've switched internally, but submitting to the |
557 | - * device may have failed for some reason. Mask this |
558 | - * error, because otherwise mac80211 will not switch |
559 | - * (and set the interface type back) and we'll be |
560 | - * out of sync with it. |
561 | - */ |
562 | + il->iw_mode = newtype; |
563 | + il_teardown_interface(il, vif); |
564 | err = 0; |
565 | |
566 | out: |
567 | diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c |
568 | index 5867fac..6ca3d8a 100644 |
569 | --- a/drivers/net/wireless/mwifiex/pcie.c |
570 | +++ b/drivers/net/wireless/mwifiex/pcie.c |
571 | @@ -158,7 +158,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state) |
572 | |
573 | if (pdev) { |
574 | card = (struct pcie_service_card *) pci_get_drvdata(pdev); |
575 | - if (!card || card->adapter) { |
576 | + if (!card || !card->adapter) { |
577 | pr_err("Card or adapter structure is not valid\n"); |
578 | return 0; |
579 | } |
580 | diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c |
581 | index b009b89..817ba7c 100644 |
582 | --- a/drivers/target/target_core_fabric_configfs.c |
583 | +++ b/drivers/target/target_core_fabric_configfs.c |
584 | @@ -752,12 +752,6 @@ static int target_fabric_port_link( |
585 | struct target_fabric_configfs *tf; |
586 | int ret; |
587 | |
588 | - if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) { |
589 | - pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:" |
590 | - " %p to struct se_device: %p\n", se_dev_ci, dev); |
591 | - return -EFAULT; |
592 | - } |
593 | - |
594 | tpg_ci = &lun_ci->ci_parent->ci_group->cg_item; |
595 | se_tpg = container_of(to_config_group(tpg_ci), |
596 | struct se_portal_group, tpg_group); |
597 | @@ -775,6 +769,11 @@ static int target_fabric_port_link( |
598 | ret = -ENODEV; |
599 | goto out; |
600 | } |
601 | + if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) { |
602 | + pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:" |
603 | + " %p to struct se_device: %p\n", se_dev_ci, dev); |
604 | + return -EFAULT; |
605 | + } |
606 | |
607 | lun_p = core_dev_add_lun(se_tpg, dev->se_hba, dev, |
608 | lun->unpacked_lun); |
609 | diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c |
610 | index 6873bb6..2263144 100644 |
611 | --- a/fs/cifs/cifs_dfs_ref.c |
612 | +++ b/fs/cifs/cifs_dfs_ref.c |
613 | @@ -226,6 +226,8 @@ compose_mount_options_out: |
614 | compose_mount_options_err: |
615 | kfree(mountdata); |
616 | mountdata = ERR_PTR(rc); |
617 | + kfree(*devname); |
618 | + *devname = NULL; |
619 | goto compose_mount_options_out; |
620 | } |
621 | |
622 | diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c |
623 | index 2257d1f..4327516 100644 |
624 | --- a/fs/nfs/namespace.c |
625 | +++ b/fs/nfs/namespace.c |
626 | @@ -253,11 +253,31 @@ out_nofree: |
627 | return mnt; |
628 | } |
629 | |
630 | +static int |
631 | +nfs_namespace_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) |
632 | +{ |
633 | + if (NFS_FH(dentry->d_inode)->size != 0) |
634 | + return nfs_getattr(mnt, dentry, stat); |
635 | + generic_fillattr(dentry->d_inode, stat); |
636 | + return 0; |
637 | +} |
638 | + |
639 | +static int |
640 | +nfs_namespace_setattr(struct dentry *dentry, struct iattr *attr) |
641 | +{ |
642 | + if (NFS_FH(dentry->d_inode)->size != 0) |
643 | + return nfs_setattr(dentry, attr); |
644 | + return -EACCES; |
645 | +} |
646 | + |
647 | const struct inode_operations nfs_mountpoint_inode_operations = { |
648 | .getattr = nfs_getattr, |
649 | + .setattr = nfs_setattr, |
650 | }; |
651 | |
652 | const struct inode_operations nfs_referral_inode_operations = { |
653 | + .getattr = nfs_namespace_getattr, |
654 | + .setattr = nfs_namespace_setattr, |
655 | }; |
656 | |
657 | static void nfs_expire_automounts(struct work_struct *work) |
658 | diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c |
659 | index 0dbb9e7..7a978c7 100644 |
660 | --- a/fs/xfs/xfs_aops.c |
661 | +++ b/fs/xfs/xfs_aops.c |
662 | @@ -89,11 +89,11 @@ xfs_destroy_ioend( |
663 | } |
664 | |
665 | if (ioend->io_iocb) { |
666 | + inode_dio_done(ioend->io_inode); |
667 | if (ioend->io_isasync) { |
668 | aio_complete(ioend->io_iocb, ioend->io_error ? |
669 | ioend->io_error : ioend->io_result, 0); |
670 | } |
671 | - inode_dio_done(ioend->io_inode); |
672 | } |
673 | |
674 | mempool_free(ioend, xfs_ioend_pool); |
675 | diff --git a/kernel/smp.c b/kernel/smp.c |
676 | index 2f8b10e..d5f3238 100644 |
677 | --- a/kernel/smp.c |
678 | +++ b/kernel/smp.c |
679 | @@ -31,6 +31,7 @@ struct call_function_data { |
680 | struct call_single_data csd; |
681 | atomic_t refs; |
682 | cpumask_var_t cpumask; |
683 | + cpumask_var_t cpumask_ipi; |
684 | }; |
685 | |
686 | static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data); |
687 | @@ -54,6 +55,9 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu) |
688 | if (!zalloc_cpumask_var_node(&cfd->cpumask, GFP_KERNEL, |
689 | cpu_to_node(cpu))) |
690 | return notifier_from_errno(-ENOMEM); |
691 | + if (!zalloc_cpumask_var_node(&cfd->cpumask_ipi, GFP_KERNEL, |
692 | + cpu_to_node(cpu))) |
693 | + return notifier_from_errno(-ENOMEM); |
694 | break; |
695 | |
696 | #ifdef CONFIG_HOTPLUG_CPU |
697 | @@ -63,6 +67,7 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu) |
698 | case CPU_DEAD: |
699 | case CPU_DEAD_FROZEN: |
700 | free_cpumask_var(cfd->cpumask); |
701 | + free_cpumask_var(cfd->cpumask_ipi); |
702 | break; |
703 | #endif |
704 | }; |
705 | @@ -524,6 +529,12 @@ void smp_call_function_many(const struct cpumask *mask, |
706 | return; |
707 | } |
708 | |
709 | + /* |
710 | + * After we put an entry into the list, data->cpumask |
711 | + * may be cleared again when another CPU sends another IPI for |
712 | + * a SMP function call, so data->cpumask will be zero. |
713 | + */ |
714 | + cpumask_copy(data->cpumask_ipi, data->cpumask); |
715 | raw_spin_lock_irqsave(&call_function.lock, flags); |
716 | /* |
717 | * Place entry at the _HEAD_ of the list, so that any cpu still |
718 | @@ -547,7 +558,7 @@ void smp_call_function_many(const struct cpumask *mask, |
719 | smp_mb(); |
720 | |
721 | /* Send a message to all CPUs in the map */ |
722 | - arch_send_call_function_ipi_mask(data->cpumask); |
723 | + arch_send_call_function_ipi_mask(data->cpumask_ipi); |
724 | |
725 | /* Optionally wait for the CPUs to complete */ |
726 | if (wait) |
727 | diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c |
728 | index 25edda0..ef45e10 100644 |
729 | --- a/net/bluetooth/hci_event.c |
730 | +++ b/net/bluetooth/hci_event.c |
731 | @@ -2366,7 +2366,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk |
732 | if (ev->opcode != HCI_OP_NOP) |
733 | del_timer(&hdev->cmd_timer); |
734 | |
735 | - if (ev->ncmd) { |
736 | + if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) { |
737 | atomic_set(&hdev->cmd_cnt, 1); |
738 | if (!skb_queue_empty(&hdev->cmd_q)) |
739 | queue_work(hdev->workqueue, &hdev->cmd_work); |
740 | diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c |
741 | index d478be1..7a0d984 100644 |
742 | --- a/net/bluetooth/hidp/core.c |
743 | +++ b/net/bluetooth/hidp/core.c |
744 | @@ -949,7 +949,7 @@ static int hidp_setup_hid(struct hidp_session *session, |
745 | hid->version = req->version; |
746 | hid->country = req->country; |
747 | |
748 | - strncpy(hid->name, req->name, 128); |
749 | + strncpy(hid->name, req->name, sizeof(req->name) - 1); |
750 | strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64); |
751 | strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64); |
752 | |
753 | diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c |
754 | index 677d659..9443348 100644 |
755 | --- a/net/mac80211/cfg.c |
756 | +++ b/net/mac80211/cfg.c |
757 | @@ -151,7 +151,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, |
758 | sta = sta_info_get(sdata, mac_addr); |
759 | else |
760 | sta = sta_info_get_bss(sdata, mac_addr); |
761 | - if (!sta) { |
762 | + /* |
763 | + * The ASSOC test makes sure the driver is ready to |
764 | + * receive the key. When wpa_supplicant has roamed |
765 | + * using FT, it attempts to set the key before |
766 | + * association has completed, this rejects that attempt |
767 | + * so it will set the key again after assocation. |
768 | + * |
769 | + * TODO: accept the key if we have a station entry and |
770 | + * add it to the device after the station. |
771 | + */ |
772 | + if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) { |
773 | ieee80211_key_free(sdata->local, key); |
774 | err = -ENOENT; |
775 | goto out_unlock; |
776 | diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h |
777 | index f8b5e75..05160db 100644 |
778 | --- a/net/mac80211/ieee80211_i.h |
779 | +++ b/net/mac80211/ieee80211_i.h |
780 | @@ -1264,10 +1264,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata); |
781 | void ieee80211_sched_scan_stopped_work(struct work_struct *work); |
782 | |
783 | /* off-channel helpers */ |
784 | -void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
785 | - bool offchannel_ps_enable); |
786 | -void ieee80211_offchannel_return(struct ieee80211_local *local, |
787 | - bool offchannel_ps_disable); |
788 | +void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local); |
789 | +void ieee80211_offchannel_return(struct ieee80211_local *local); |
790 | void ieee80211_hw_roc_setup(struct ieee80211_local *local); |
791 | |
792 | /* interface handling */ |
793 | diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c |
794 | index 935aa4b..c22f074 100644 |
795 | --- a/net/mac80211/offchannel.c |
796 | +++ b/net/mac80211/offchannel.c |
797 | @@ -103,8 +103,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata) |
798 | ieee80211_sta_reset_conn_monitor(sdata); |
799 | } |
800 | |
801 | -void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
802 | - bool offchannel_ps_enable) |
803 | +void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local) |
804 | { |
805 | struct ieee80211_sub_if_data *sdata; |
806 | |
807 | @@ -129,8 +128,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
808 | |
809 | if (sdata->vif.type != NL80211_IFTYPE_MONITOR) { |
810 | netif_tx_stop_all_queues(sdata->dev); |
811 | - if (offchannel_ps_enable && |
812 | - (sdata->vif.type == NL80211_IFTYPE_STATION) && |
813 | + if (sdata->vif.type == NL80211_IFTYPE_STATION && |
814 | sdata->u.mgd.associated) |
815 | ieee80211_offchannel_ps_enable(sdata, true); |
816 | } |
817 | @@ -138,8 +136,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
818 | mutex_unlock(&local->iflist_mtx); |
819 | } |
820 | |
821 | -void ieee80211_offchannel_return(struct ieee80211_local *local, |
822 | - bool offchannel_ps_disable) |
823 | +void ieee80211_offchannel_return(struct ieee80211_local *local) |
824 | { |
825 | struct ieee80211_sub_if_data *sdata; |
826 | |
827 | @@ -152,11 +149,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local, |
828 | continue; |
829 | |
830 | /* Tell AP we're back */ |
831 | - if (offchannel_ps_disable && |
832 | - sdata->vif.type == NL80211_IFTYPE_STATION) { |
833 | - if (sdata->u.mgd.associated) |
834 | - ieee80211_offchannel_ps_disable(sdata); |
835 | - } |
836 | + if (sdata->vif.type == NL80211_IFTYPE_STATION && |
837 | + sdata->u.mgd.associated) |
838 | + ieee80211_offchannel_ps_disable(sdata); |
839 | |
840 | if (sdata->vif.type != NL80211_IFTYPE_MONITOR) { |
841 | /* |
842 | diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c |
843 | index e95d494..bcc57f9 100644 |
844 | --- a/net/mac80211/scan.c |
845 | +++ b/net/mac80211/scan.c |
846 | @@ -329,7 +329,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted, |
847 | if (!was_hw_scan) { |
848 | ieee80211_configure_filter(local); |
849 | drv_sw_scan_complete(local); |
850 | - ieee80211_offchannel_return(local, true); |
851 | + ieee80211_offchannel_return(local); |
852 | } |
853 | |
854 | ieee80211_recalc_idle(local); |
855 | @@ -374,7 +374,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local) |
856 | local->next_scan_state = SCAN_DECISION; |
857 | local->scan_channel_idx = 0; |
858 | |
859 | - ieee80211_offchannel_stop_vifs(local, true); |
860 | + ieee80211_offchannel_stop_vifs(local); |
861 | |
862 | ieee80211_configure_filter(local); |
863 | |
864 | @@ -629,12 +629,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local, |
865 | local->scan_channel = NULL; |
866 | ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL); |
867 | |
868 | - /* |
869 | - * Re-enable vifs and beaconing. Leave PS |
870 | - * in off-channel state..will put that back |
871 | - * on-channel at the end of scanning. |
872 | - */ |
873 | - ieee80211_offchannel_return(local, false); |
874 | + /* disable PS */ |
875 | + ieee80211_offchannel_return(local); |
876 | |
877 | *next_delay = HZ / 5; |
878 | /* afterwards, resume scan & go to next channel */ |
879 | @@ -644,8 +640,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local, |
880 | static void ieee80211_scan_state_resume(struct ieee80211_local *local, |
881 | unsigned long *next_delay) |
882 | { |
883 | - /* PS already is in off-channel mode */ |
884 | - ieee80211_offchannel_stop_vifs(local, false); |
885 | + ieee80211_offchannel_stop_vifs(local); |
886 | |
887 | if (local->ops->flush) { |
888 | drv_flush(local, false); |
889 | diff --git a/net/mac80211/work.c b/net/mac80211/work.c |
890 | index c6e230e..a74f538 100644 |
891 | --- a/net/mac80211/work.c |
892 | +++ b/net/mac80211/work.c |
893 | @@ -148,7 +148,7 @@ static void ieee80211_work_work(struct work_struct *work) |
894 | } |
895 | |
896 | if (!started && !local->tmp_channel) { |
897 | - ieee80211_offchannel_stop_vifs(local, true); |
898 | + ieee80211_offchannel_stop_vifs(local); |
899 | |
900 | local->tmp_channel = wk->chan; |
901 | local->tmp_channel_type = wk->chan_type; |
902 | @@ -220,7 +220,7 @@ static void ieee80211_work_work(struct work_struct *work) |
903 | local->tmp_channel = NULL; |
904 | ieee80211_hw_config(local, 0); |
905 | |
906 | - ieee80211_offchannel_return(local, true); |
907 | + ieee80211_offchannel_return(local); |
908 | |
909 | /* give connection some time to breathe */ |
910 | run_again(local, jiffies + HZ/2); |
911 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
912 | index 7f2a109..f7f8776 100644 |
913 | --- a/sound/pci/hda/patch_realtek.c |
914 | +++ b/sound/pci/hda/patch_realtek.c |
915 | @@ -4741,6 +4741,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = { |
916 | SND_PCI_QUIRK(0x1584, 0x9077, "Uniwill P53", ALC880_FIXUP_VOL_KNOB), |
917 | SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810), |
918 | SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM), |
919 | + SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST), |
920 | SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734), |
921 | SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU), |
922 | SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734), |
923 | diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c |
924 | index 86b84a1..8e0cf14 100644 |
925 | --- a/sound/soc/codecs/wm2200.c |
926 | +++ b/sound/soc/codecs/wm2200.c |
927 | @@ -897,8 +897,6 @@ static const char *wm2200_mixer_texts[] = { |
928 | "EQR", |
929 | "LHPF1", |
930 | "LHPF2", |
931 | - "LHPF3", |
932 | - "LHPF4", |
933 | "DSP1.1", |
934 | "DSP1.2", |
935 | "DSP1.3", |
936 | @@ -931,7 +929,6 @@ static int wm2200_mixer_values[] = { |
937 | 0x25, |
938 | 0x50, /* EQ */ |
939 | 0x51, |
940 | - 0x52, |
941 | 0x60, /* LHPF1 */ |
942 | 0x61, /* LHPF2 */ |
943 | 0x68, /* DSP1 */ |
944 | diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c |
945 | index 29ae209..15b0712 100644 |
946 | --- a/sound/usb/mixer.c |
947 | +++ b/sound/usb/mixer.c |
948 | @@ -1239,16 +1239,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void |
949 | } |
950 | channels = (hdr->bLength - 7) / csize - 1; |
951 | bmaControls = hdr->bmaControls; |
952 | + if (hdr->bLength < 7 + csize) { |
953 | + snd_printk(KERN_ERR "usbaudio: unit %u: " |
954 | + "invalid UAC_FEATURE_UNIT descriptor\n", |
955 | + unitid); |
956 | + return -EINVAL; |
957 | + } |
958 | } else { |
959 | struct uac2_feature_unit_descriptor *ftr = _ftr; |
960 | csize = 4; |
961 | channels = (hdr->bLength - 6) / 4 - 1; |
962 | bmaControls = ftr->bmaControls; |
963 | - } |
964 | - |
965 | - if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) { |
966 | - snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid); |
967 | - return -EINVAL; |
968 | + if (hdr->bLength < 6 + csize) { |
969 | + snd_printk(KERN_ERR "usbaudio: unit %u: " |
970 | + "invalid UAC_FEATURE_UNIT descriptor\n", |
971 | + unitid); |
972 | + return -EINVAL; |
973 | + } |
974 | } |
975 | |
976 | /* parse the source unit */ |