Contents of /trunk/kernel-lts/patches-3.4/0128-3.4.29-all-fixes.patch
Parent Directory | Revision Log
Revision 2068 -
(show annotations)
(download)
Wed Feb 6 12:41:03 2013 UTC (11 years, 7 months ago) by niro
File size: 32023 byte(s)
Wed Feb 6 12:41:03 2013 UTC (11 years, 7 months ago) by niro
File size: 32023 byte(s)
-fixed patch
1 | diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c |
2 | index 582142e..55293a7 100644 |
3 | --- a/arch/arm/mach-at91/setup.c |
4 | +++ b/arch/arm/mach-at91/setup.c |
5 | @@ -104,6 +104,8 @@ static void __init soc_detect(u32 dbgu_base) |
6 | switch (socid) { |
7 | case ARCH_ID_AT91RM9200: |
8 | at91_soc_initdata.type = AT91_SOC_RM9200; |
9 | + if (at91_soc_initdata.subtype == AT91_SOC_SUBTYPE_NONE) |
10 | + at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA; |
11 | at91_boot_soc = at91rm9200_soc; |
12 | break; |
13 | |
14 | diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c |
15 | index db23ae4..a3e4adf 100644 |
16 | --- a/arch/arm/mm/dma-mapping.c |
17 | +++ b/arch/arm/mm/dma-mapping.c |
18 | @@ -503,25 +503,27 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset, |
19 | size_t size, enum dma_data_direction dir, |
20 | void (*op)(const void *, size_t, int)) |
21 | { |
22 | + unsigned long pfn; |
23 | + size_t left = size; |
24 | + |
25 | + pfn = page_to_pfn(page) + offset / PAGE_SIZE; |
26 | + offset %= PAGE_SIZE; |
27 | + |
28 | /* |
29 | * A single sg entry may refer to multiple physically contiguous |
30 | * pages. But we still need to process highmem pages individually. |
31 | * If highmem is not configured then the bulk of this loop gets |
32 | * optimized out. |
33 | */ |
34 | - size_t left = size; |
35 | do { |
36 | size_t len = left; |
37 | void *vaddr; |
38 | |
39 | + page = pfn_to_page(pfn); |
40 | + |
41 | if (PageHighMem(page)) { |
42 | - if (len + offset > PAGE_SIZE) { |
43 | - if (offset >= PAGE_SIZE) { |
44 | - page += offset / PAGE_SIZE; |
45 | - offset %= PAGE_SIZE; |
46 | - } |
47 | + if (len + offset > PAGE_SIZE) |
48 | len = PAGE_SIZE - offset; |
49 | - } |
50 | vaddr = kmap_high_get(page); |
51 | if (vaddr) { |
52 | vaddr += offset; |
53 | @@ -538,7 +540,7 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset, |
54 | op(vaddr, len, dir); |
55 | } |
56 | offset = 0; |
57 | - page++; |
58 | + pfn++; |
59 | left -= len; |
60 | } while (left); |
61 | } |
62 | diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S |
63 | index cc926c9..323ce1a 100644 |
64 | --- a/arch/arm/vfp/entry.S |
65 | +++ b/arch/arm/vfp/entry.S |
66 | @@ -22,7 +22,7 @@ |
67 | @ IRQs disabled. |
68 | @ |
69 | ENTRY(do_vfp) |
70 | -#ifdef CONFIG_PREEMPT |
71 | +#ifdef CONFIG_PREEMPT_COUNT |
72 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
73 | add r11, r4, #1 @ increment it |
74 | str r11, [r10, #TI_PREEMPT] |
75 | @@ -35,7 +35,7 @@ ENTRY(do_vfp) |
76 | ENDPROC(do_vfp) |
77 | |
78 | ENTRY(vfp_null_entry) |
79 | -#ifdef CONFIG_PREEMPT |
80 | +#ifdef CONFIG_PREEMPT_COUNT |
81 | get_thread_info r10 |
82 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
83 | sub r11, r4, #1 @ decrement it |
84 | @@ -53,7 +53,7 @@ ENDPROC(vfp_null_entry) |
85 | |
86 | __INIT |
87 | ENTRY(vfp_testing_entry) |
88 | -#ifdef CONFIG_PREEMPT |
89 | +#ifdef CONFIG_PREEMPT_COUNT |
90 | get_thread_info r10 |
91 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
92 | sub r11, r4, #1 @ decrement it |
93 | diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S |
94 | index 3a0efaa..6ff903e 100644 |
95 | --- a/arch/arm/vfp/vfphw.S |
96 | +++ b/arch/arm/vfp/vfphw.S |
97 | @@ -167,7 +167,7 @@ vfp_hw_state_valid: |
98 | @ else it's one 32-bit instruction, so |
99 | @ always subtract 4 from the following |
100 | @ instruction address. |
101 | -#ifdef CONFIG_PREEMPT |
102 | +#ifdef CONFIG_PREEMPT_COUNT |
103 | get_thread_info r10 |
104 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
105 | sub r11, r4, #1 @ decrement it |
106 | @@ -191,7 +191,7 @@ look_for_VFP_exceptions: |
107 | @ not recognised by VFP |
108 | |
109 | DBGSTR "not VFP" |
110 | -#ifdef CONFIG_PREEMPT |
111 | +#ifdef CONFIG_PREEMPT_COUNT |
112 | get_thread_info r10 |
113 | ldr r4, [r10, #TI_PREEMPT] @ get preempt count |
114 | sub r11, r4, #1 @ decrement it |
115 | diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c |
116 | index eb11369..8563b64 100644 |
117 | --- a/arch/x86/kernel/msr.c |
118 | +++ b/arch/x86/kernel/msr.c |
119 | @@ -174,6 +174,9 @@ static int msr_open(struct inode *inode, struct file *file) |
120 | unsigned int cpu; |
121 | struct cpuinfo_x86 *c; |
122 | |
123 | + if (!capable(CAP_SYS_RAWIO)) |
124 | + return -EPERM; |
125 | + |
126 | cpu = iminor(file->f_path.dentry->d_inode); |
127 | if (cpu >= nr_cpu_ids || !cpu_online(cpu)) |
128 | return -ENXIO; /* No such CPU */ |
129 | diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c |
130 | index d289ee7..b71e4a5 100644 |
131 | --- a/arch/x86/kernel/setup.c |
132 | +++ b/arch/x86/kernel/setup.c |
133 | @@ -622,6 +622,7 @@ static unsigned reserve_low = CONFIG_X86_RESERVE_LOW << 10; |
134 | |
135 | static bool __init snb_gfx_workaround_needed(void) |
136 | { |
137 | +#ifdef CONFIG_PCI |
138 | int i; |
139 | u16 vendor, devid; |
140 | static const u16 snb_ids[] = { |
141 | @@ -646,6 +647,7 @@ static bool __init snb_gfx_workaround_needed(void) |
142 | for (i = 0; i < ARRAY_SIZE(snb_ids); i++) |
143 | if (devid == snb_ids[i]) |
144 | return true; |
145 | +#endif |
146 | |
147 | return false; |
148 | } |
149 | diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c |
150 | index 72d8899..6825327 100644 |
151 | --- a/arch/x86/platform/efi/efi.c |
152 | +++ b/arch/x86/platform/efi/efi.c |
153 | @@ -900,7 +900,7 @@ void __init efi_enter_virtual_mode(void) |
154 | * |
155 | * Call EFI services through wrapper functions. |
156 | */ |
157 | - efi.runtime_version = efi_systab.fw_revision; |
158 | + efi.runtime_version = efi_systab.hdr.revision; |
159 | efi.get_time = virt_efi_get_time; |
160 | efi.set_time = virt_efi_set_time; |
161 | efi.get_wakeup_time = virt_efi_get_wakeup_time; |
162 | diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c |
163 | index ac3aa54..0fba86d 100644 |
164 | --- a/arch/x86/platform/efi/efi_64.c |
165 | +++ b/arch/x86/platform/efi/efi_64.c |
166 | @@ -38,7 +38,7 @@ |
167 | #include <asm/cacheflush.h> |
168 | #include <asm/fixmap.h> |
169 | |
170 | -static pgd_t save_pgd __initdata; |
171 | +static pgd_t *save_pgd __initdata; |
172 | static unsigned long efi_flags __initdata; |
173 | |
174 | static void __init early_code_mapping_set_exec(int executable) |
175 | @@ -61,12 +61,20 @@ static void __init early_code_mapping_set_exec(int executable) |
176 | void __init efi_call_phys_prelog(void) |
177 | { |
178 | unsigned long vaddress; |
179 | + int pgd; |
180 | + int n_pgds; |
181 | |
182 | early_code_mapping_set_exec(1); |
183 | local_irq_save(efi_flags); |
184 | - vaddress = (unsigned long)__va(0x0UL); |
185 | - save_pgd = *pgd_offset_k(0x0UL); |
186 | - set_pgd(pgd_offset_k(0x0UL), *pgd_offset_k(vaddress)); |
187 | + |
188 | + n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE); |
189 | + save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL); |
190 | + |
191 | + for (pgd = 0; pgd < n_pgds; pgd++) { |
192 | + save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE); |
193 | + vaddress = (unsigned long)__va(pgd * PGDIR_SIZE); |
194 | + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress)); |
195 | + } |
196 | __flush_tlb_all(); |
197 | } |
198 | |
199 | @@ -75,7 +83,11 @@ void __init efi_call_phys_epilog(void) |
200 | /* |
201 | * After the lock is released, the original page table is restored. |
202 | */ |
203 | - set_pgd(pgd_offset_k(0x0UL), save_pgd); |
204 | + int pgd; |
205 | + int n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE); |
206 | + for (pgd = 0; pgd < n_pgds; pgd++) |
207 | + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]); |
208 | + kfree(save_pgd); |
209 | __flush_tlb_all(); |
210 | local_irq_restore(efi_flags); |
211 | early_code_mapping_set_exec(0); |
212 | diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c |
213 | index 97f5064..686ac03 100644 |
214 | --- a/drivers/edac/edac_pci_sysfs.c |
215 | +++ b/drivers/edac/edac_pci_sysfs.c |
216 | @@ -257,7 +257,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj, |
217 | struct edac_pci_dev_attribute *edac_pci_dev; |
218 | edac_pci_dev = (struct edac_pci_dev_attribute *)attr; |
219 | |
220 | - if (edac_pci_dev->show) |
221 | + if (edac_pci_dev->store) |
222 | return edac_pci_dev->store(edac_pci_dev->value, buffer, count); |
223 | return -EIO; |
224 | } |
225 | diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c |
226 | index 711e95a..8fb6f41 100644 |
227 | --- a/drivers/gpu/drm/radeon/radeon_cursor.c |
228 | +++ b/drivers/gpu/drm/radeon/radeon_cursor.c |
229 | @@ -238,7 +238,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc, |
230 | y = 0; |
231 | } |
232 | |
233 | - if (ASIC_IS_AVIVO(rdev)) { |
234 | + /* fixed on DCE6 and newer */ |
235 | + if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) { |
236 | int i = 0; |
237 | struct drm_crtc *crtc_p; |
238 | |
239 | diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c |
240 | index 173b97b..1f50727 100644 |
241 | --- a/drivers/gpu/drm/radeon/radeon_display.c |
242 | +++ b/drivers/gpu/drm/radeon/radeon_display.c |
243 | @@ -1136,7 +1136,7 @@ radeon_user_framebuffer_create(struct drm_device *dev, |
244 | if (ret) { |
245 | kfree(radeon_fb); |
246 | drm_gem_object_unreference_unlocked(obj); |
247 | - return NULL; |
248 | + return ERR_PTR(ret); |
249 | } |
250 | |
251 | return &radeon_fb->base; |
252 | diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c |
253 | index c04ddca..ef0ae93 100644 |
254 | --- a/drivers/iommu/amd_iommu_init.c |
255 | +++ b/drivers/iommu/amd_iommu_init.c |
256 | @@ -1002,6 +1002,38 @@ static void __init free_iommu_all(void) |
257 | } |
258 | |
259 | /* |
260 | + * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations) |
261 | + * Workaround: |
262 | + * BIOS should disable L2B micellaneous clock gating by setting |
263 | + * L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b |
264 | + */ |
265 | +static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu) |
266 | +{ |
267 | + u32 value; |
268 | + |
269 | + if ((boot_cpu_data.x86 != 0x15) || |
270 | + (boot_cpu_data.x86_model < 0x10) || |
271 | + (boot_cpu_data.x86_model > 0x1f)) |
272 | + return; |
273 | + |
274 | + pci_write_config_dword(iommu->dev, 0xf0, 0x90); |
275 | + pci_read_config_dword(iommu->dev, 0xf4, &value); |
276 | + |
277 | + if (value & BIT(2)) |
278 | + return; |
279 | + |
280 | + /* Select NB indirect register 0x90 and enable writing */ |
281 | + pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8)); |
282 | + |
283 | + pci_write_config_dword(iommu->dev, 0xf4, value | 0x4); |
284 | + pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n", |
285 | + dev_name(&iommu->dev->dev)); |
286 | + |
287 | + /* Clear the enable writing bit */ |
288 | + pci_write_config_dword(iommu->dev, 0xf0, 0x90); |
289 | +} |
290 | + |
291 | +/* |
292 | * This function clues the initialization function for one IOMMU |
293 | * together and also allocates the command buffer and programs the |
294 | * hardware. It does NOT enable the IOMMU. This is done afterwards. |
295 | @@ -1062,6 +1094,8 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h) |
296 | if (iommu->cap & (1UL << IOMMU_CAP_NPCACHE)) |
297 | amd_iommu_np_cache = true; |
298 | |
299 | + amd_iommu_erratum_746_workaround(iommu); |
300 | + |
301 | return pci_enable_device(iommu->dev); |
302 | } |
303 | |
304 | diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c |
305 | index be66606..5d71873 100644 |
306 | --- a/drivers/iommu/intel-iommu.c |
307 | +++ b/drivers/iommu/intel-iommu.c |
308 | @@ -4193,6 +4193,21 @@ static struct iommu_ops intel_iommu_ops = { |
309 | .pgsize_bitmap = INTEL_IOMMU_PGSIZES, |
310 | }; |
311 | |
312 | +static void __devinit quirk_iommu_g4x_gfx(struct pci_dev *dev) |
313 | +{ |
314 | + /* G4x/GM45 integrated gfx dmar support is totally busted. */ |
315 | + printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n"); |
316 | + dmar_map_gfx = 0; |
317 | +} |
318 | + |
319 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx); |
320 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx); |
321 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx); |
322 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_g4x_gfx); |
323 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_g4x_gfx); |
324 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_g4x_gfx); |
325 | +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_g4x_gfx); |
326 | + |
327 | static void __devinit quirk_iommu_rwbf(struct pci_dev *dev) |
328 | { |
329 | /* |
330 | @@ -4201,12 +4216,6 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev) |
331 | */ |
332 | printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n"); |
333 | rwbf_quirk = 1; |
334 | - |
335 | - /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */ |
336 | - if (dev->revision == 0x07) { |
337 | - printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n"); |
338 | - dmar_map_gfx = 0; |
339 | - } |
340 | } |
341 | |
342 | DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf); |
343 | diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c |
344 | index 86cd532..21a3d77 100644 |
345 | --- a/drivers/net/can/c_can/c_can.c |
346 | +++ b/drivers/net/can/c_can/c_can.c |
347 | @@ -914,7 +914,7 @@ static int c_can_handle_bus_err(struct net_device *dev, |
348 | break; |
349 | case LEC_ACK_ERROR: |
350 | netdev_dbg(dev, "ack error\n"); |
351 | - cf->data[2] |= (CAN_ERR_PROT_LOC_ACK | |
352 | + cf->data[3] |= (CAN_ERR_PROT_LOC_ACK | |
353 | CAN_ERR_PROT_LOC_ACK_DEL); |
354 | break; |
355 | case LEC_BIT1_ERROR: |
356 | @@ -927,7 +927,7 @@ static int c_can_handle_bus_err(struct net_device *dev, |
357 | break; |
358 | case LEC_CRC_ERROR: |
359 | netdev_dbg(dev, "CRC error\n"); |
360 | - cf->data[2] |= (CAN_ERR_PROT_LOC_CRC_SEQ | |
361 | + cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ | |
362 | CAN_ERR_PROT_LOC_CRC_DEL); |
363 | break; |
364 | default: |
365 | diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c |
366 | index 2bb215e..ab13a57 100644 |
367 | --- a/drivers/net/can/pch_can.c |
368 | +++ b/drivers/net/can/pch_can.c |
369 | @@ -560,7 +560,7 @@ static void pch_can_error(struct net_device *ndev, u32 status) |
370 | stats->rx_errors++; |
371 | break; |
372 | case PCH_CRC_ERR: |
373 | - cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
374 | + cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
375 | CAN_ERR_PROT_LOC_CRC_DEL; |
376 | priv->can.can_stats.bus_error++; |
377 | stats->rx_errors++; |
378 | diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c |
379 | index 5ec2700..19000aa 100644 |
380 | --- a/drivers/net/can/ti_hecc.c |
381 | +++ b/drivers/net/can/ti_hecc.c |
382 | @@ -746,12 +746,12 @@ static int ti_hecc_error(struct net_device *ndev, int int_status, |
383 | } |
384 | if (err_status & HECC_CANES_CRCE) { |
385 | hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE); |
386 | - cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
387 | + cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ | |
388 | CAN_ERR_PROT_LOC_CRC_DEL; |
389 | } |
390 | if (err_status & HECC_CANES_ACKE) { |
391 | hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE); |
392 | - cf->data[2] |= CAN_ERR_PROT_LOC_ACK | |
393 | + cf->data[3] |= CAN_ERR_PROT_LOC_ACK | |
394 | CAN_ERR_PROT_LOC_ACK_DEL; |
395 | } |
396 | } |
397 | diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c |
398 | index 5eb53c9..2e4243f 100644 |
399 | --- a/drivers/net/wireless/ath/ath9k/beacon.c |
400 | +++ b/drivers/net/wireless/ath/ath9k/beacon.c |
401 | @@ -154,6 +154,7 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw, |
402 | skb->len, DMA_TO_DEVICE); |
403 | dev_kfree_skb_any(skb); |
404 | bf->bf_buf_addr = 0; |
405 | + bf->bf_mpdu = NULL; |
406 | } |
407 | |
408 | /* Get a new beacon from mac80211 */ |
409 | diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c |
410 | index c25226a..ec86d98 100644 |
411 | --- a/drivers/net/wireless/ath/ath9k/htc_hst.c |
412 | +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c |
413 | @@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, |
414 | endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv, |
415 | skb, htc_hdr->endpoint_id, |
416 | txok); |
417 | + } else { |
418 | + kfree_skb(skb); |
419 | } |
420 | } |
421 | |
422 | diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c |
423 | index 90b8527..039bac7 100644 |
424 | --- a/drivers/net/wireless/ath/ath9k/recv.c |
425 | +++ b/drivers/net/wireless/ath/ath9k/recv.c |
426 | @@ -778,6 +778,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc, |
427 | return NULL; |
428 | } |
429 | |
430 | + list_del(&bf->list); |
431 | if (!bf->bf_mpdu) |
432 | return bf; |
433 | |
434 | @@ -1966,14 +1967,15 @@ requeue_drop_frag: |
435 | sc->rx.frag = NULL; |
436 | } |
437 | requeue: |
438 | + list_add_tail(&bf->list, &sc->rx.rxbuf); |
439 | + if (flush) |
440 | + continue; |
441 | + |
442 | if (edma) { |
443 | - list_add_tail(&bf->list, &sc->rx.rxbuf); |
444 | ath_rx_edma_buf_link(sc, qtype); |
445 | } else { |
446 | - list_move_tail(&bf->list, &sc->rx.rxbuf); |
447 | ath_rx_buf_link(sc, bf); |
448 | - if (!flush) |
449 | - ath9k_hw_rxena(ah); |
450 | + ath9k_hw_rxena(ah); |
451 | } |
452 | } while (1); |
453 | |
454 | diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c |
455 | index 569ab8a..27f37c7 100644 |
456 | --- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c |
457 | +++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c |
458 | @@ -1400,9 +1400,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic) |
459 | #endif |
460 | t->ms = ms; |
461 | t->periodic = (bool) periodic; |
462 | - t->set = true; |
463 | - |
464 | - atomic_inc(&t->wl->callbacks); |
465 | + if (!t->set) { |
466 | + t->set = true; |
467 | + atomic_inc(&t->wl->callbacks); |
468 | + } |
469 | |
470 | ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms)); |
471 | } |
472 | diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c |
473 | index 4bc2711..2ab6b96 100644 |
474 | --- a/drivers/net/wireless/iwlegacy/common.c |
475 | +++ b/drivers/net/wireless/iwlegacy/common.c |
476 | @@ -3957,17 +3957,21 @@ il_connection_init_rx_config(struct il_priv *il) |
477 | |
478 | memset(&il->staging, 0, sizeof(il->staging)); |
479 | |
480 | - if (!il->vif) { |
481 | + switch (il->iw_mode) { |
482 | + case NL80211_IFTYPE_UNSPECIFIED: |
483 | il->staging.dev_type = RXON_DEV_TYPE_ESS; |
484 | - } else if (il->vif->type == NL80211_IFTYPE_STATION) { |
485 | + break; |
486 | + case NL80211_IFTYPE_STATION: |
487 | il->staging.dev_type = RXON_DEV_TYPE_ESS; |
488 | il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK; |
489 | - } else if (il->vif->type == NL80211_IFTYPE_ADHOC) { |
490 | + break; |
491 | + case NL80211_IFTYPE_ADHOC: |
492 | il->staging.dev_type = RXON_DEV_TYPE_IBSS; |
493 | il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK; |
494 | il->staging.filter_flags = |
495 | RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK; |
496 | - } else { |
497 | + break; |
498 | + default: |
499 | IL_ERR("Unsupported interface type %d\n", il->vif->type); |
500 | return; |
501 | } |
502 | @@ -4550,8 +4554,7 @@ out: |
503 | EXPORT_SYMBOL(il_mac_add_interface); |
504 | |
505 | static void |
506 | -il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif, |
507 | - bool mode_change) |
508 | +il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif) |
509 | { |
510 | lockdep_assert_held(&il->mutex); |
511 | |
512 | @@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif, |
513 | il_force_scan_end(il); |
514 | } |
515 | |
516 | - if (!mode_change) |
517 | - il_set_mode(il); |
518 | - |
519 | + il_set_mode(il); |
520 | } |
521 | |
522 | void |
523 | @@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) |
524 | |
525 | WARN_ON(il->vif != vif); |
526 | il->vif = NULL; |
527 | - |
528 | - il_teardown_interface(il, vif, false); |
529 | + il->iw_mode = NL80211_IFTYPE_UNSPECIFIED; |
530 | + il_teardown_interface(il, vif); |
531 | memset(il->bssid, 0, ETH_ALEN); |
532 | |
533 | D_MAC80211("leave\n"); |
534 | @@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif, |
535 | } |
536 | |
537 | /* success */ |
538 | - il_teardown_interface(il, vif, true); |
539 | vif->type = newtype; |
540 | vif->p2p = false; |
541 | - err = il_set_mode(il); |
542 | - WARN_ON(err); |
543 | - /* |
544 | - * We've switched internally, but submitting to the |
545 | - * device may have failed for some reason. Mask this |
546 | - * error, because otherwise mac80211 will not switch |
547 | - * (and set the interface type back) and we'll be |
548 | - * out of sync with it. |
549 | - */ |
550 | + il->iw_mode = newtype; |
551 | + il_teardown_interface(il, vif); |
552 | err = 0; |
553 | |
554 | out: |
555 | diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c |
556 | index 5867fac..6ca3d8a 100644 |
557 | --- a/drivers/net/wireless/mwifiex/pcie.c |
558 | +++ b/drivers/net/wireless/mwifiex/pcie.c |
559 | @@ -158,7 +158,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state) |
560 | |
561 | if (pdev) { |
562 | card = (struct pcie_service_card *) pci_get_drvdata(pdev); |
563 | - if (!card || card->adapter) { |
564 | + if (!card || !card->adapter) { |
565 | pr_err("Card or adapter structure is not valid\n"); |
566 | return 0; |
567 | } |
568 | diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c |
569 | index b009b89..817ba7c 100644 |
570 | --- a/drivers/target/target_core_fabric_configfs.c |
571 | +++ b/drivers/target/target_core_fabric_configfs.c |
572 | @@ -752,12 +752,6 @@ static int target_fabric_port_link( |
573 | struct target_fabric_configfs *tf; |
574 | int ret; |
575 | |
576 | - if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) { |
577 | - pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:" |
578 | - " %p to struct se_device: %p\n", se_dev_ci, dev); |
579 | - return -EFAULT; |
580 | - } |
581 | - |
582 | tpg_ci = &lun_ci->ci_parent->ci_group->cg_item; |
583 | se_tpg = container_of(to_config_group(tpg_ci), |
584 | struct se_portal_group, tpg_group); |
585 | @@ -775,6 +769,11 @@ static int target_fabric_port_link( |
586 | ret = -ENODEV; |
587 | goto out; |
588 | } |
589 | + if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) { |
590 | + pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:" |
591 | + " %p to struct se_device: %p\n", se_dev_ci, dev); |
592 | + return -EFAULT; |
593 | + } |
594 | |
595 | lun_p = core_dev_add_lun(se_tpg, dev->se_hba, dev, |
596 | lun->unpacked_lun); |
597 | diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c |
598 | index 6873bb6..2263144 100644 |
599 | --- a/fs/cifs/cifs_dfs_ref.c |
600 | +++ b/fs/cifs/cifs_dfs_ref.c |
601 | @@ -226,6 +226,8 @@ compose_mount_options_out: |
602 | compose_mount_options_err: |
603 | kfree(mountdata); |
604 | mountdata = ERR_PTR(rc); |
605 | + kfree(*devname); |
606 | + *devname = NULL; |
607 | goto compose_mount_options_out; |
608 | } |
609 | |
610 | diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c |
611 | index 2257d1f..4327516 100644 |
612 | --- a/fs/nfs/namespace.c |
613 | +++ b/fs/nfs/namespace.c |
614 | @@ -253,11 +253,31 @@ out_nofree: |
615 | return mnt; |
616 | } |
617 | |
618 | +static int |
619 | +nfs_namespace_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) |
620 | +{ |
621 | + if (NFS_FH(dentry->d_inode)->size != 0) |
622 | + return nfs_getattr(mnt, dentry, stat); |
623 | + generic_fillattr(dentry->d_inode, stat); |
624 | + return 0; |
625 | +} |
626 | + |
627 | +static int |
628 | +nfs_namespace_setattr(struct dentry *dentry, struct iattr *attr) |
629 | +{ |
630 | + if (NFS_FH(dentry->d_inode)->size != 0) |
631 | + return nfs_setattr(dentry, attr); |
632 | + return -EACCES; |
633 | +} |
634 | + |
635 | const struct inode_operations nfs_mountpoint_inode_operations = { |
636 | .getattr = nfs_getattr, |
637 | + .setattr = nfs_setattr, |
638 | }; |
639 | |
640 | const struct inode_operations nfs_referral_inode_operations = { |
641 | + .getattr = nfs_namespace_getattr, |
642 | + .setattr = nfs_namespace_setattr, |
643 | }; |
644 | |
645 | static void nfs_expire_automounts(struct work_struct *work) |
646 | diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c |
647 | index 0dbb9e7..7a978c7 100644 |
648 | --- a/fs/xfs/xfs_aops.c |
649 | +++ b/fs/xfs/xfs_aops.c |
650 | @@ -89,11 +89,11 @@ xfs_destroy_ioend( |
651 | } |
652 | |
653 | if (ioend->io_iocb) { |
654 | + inode_dio_done(ioend->io_inode); |
655 | if (ioend->io_isasync) { |
656 | aio_complete(ioend->io_iocb, ioend->io_error ? |
657 | ioend->io_error : ioend->io_result, 0); |
658 | } |
659 | - inode_dio_done(ioend->io_inode); |
660 | } |
661 | |
662 | mempool_free(ioend, xfs_ioend_pool); |
663 | diff --git a/kernel/smp.c b/kernel/smp.c |
664 | index 2f8b10e..d5f3238 100644 |
665 | --- a/kernel/smp.c |
666 | +++ b/kernel/smp.c |
667 | @@ -31,6 +31,7 @@ struct call_function_data { |
668 | struct call_single_data csd; |
669 | atomic_t refs; |
670 | cpumask_var_t cpumask; |
671 | + cpumask_var_t cpumask_ipi; |
672 | }; |
673 | |
674 | static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data); |
675 | @@ -54,6 +55,9 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu) |
676 | if (!zalloc_cpumask_var_node(&cfd->cpumask, GFP_KERNEL, |
677 | cpu_to_node(cpu))) |
678 | return notifier_from_errno(-ENOMEM); |
679 | + if (!zalloc_cpumask_var_node(&cfd->cpumask_ipi, GFP_KERNEL, |
680 | + cpu_to_node(cpu))) |
681 | + return notifier_from_errno(-ENOMEM); |
682 | break; |
683 | |
684 | #ifdef CONFIG_HOTPLUG_CPU |
685 | @@ -63,6 +67,7 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu) |
686 | case CPU_DEAD: |
687 | case CPU_DEAD_FROZEN: |
688 | free_cpumask_var(cfd->cpumask); |
689 | + free_cpumask_var(cfd->cpumask_ipi); |
690 | break; |
691 | #endif |
692 | }; |
693 | @@ -524,6 +529,12 @@ void smp_call_function_many(const struct cpumask *mask, |
694 | return; |
695 | } |
696 | |
697 | + /* |
698 | + * After we put an entry into the list, data->cpumask |
699 | + * may be cleared again when another CPU sends another IPI for |
700 | + * a SMP function call, so data->cpumask will be zero. |
701 | + */ |
702 | + cpumask_copy(data->cpumask_ipi, data->cpumask); |
703 | raw_spin_lock_irqsave(&call_function.lock, flags); |
704 | /* |
705 | * Place entry at the _HEAD_ of the list, so that any cpu still |
706 | @@ -547,7 +558,7 @@ void smp_call_function_many(const struct cpumask *mask, |
707 | smp_mb(); |
708 | |
709 | /* Send a message to all CPUs in the map */ |
710 | - arch_send_call_function_ipi_mask(data->cpumask); |
711 | + arch_send_call_function_ipi_mask(data->cpumask_ipi); |
712 | |
713 | /* Optionally wait for the CPUs to complete */ |
714 | if (wait) |
715 | diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c |
716 | index 25edda0..ef45e10 100644 |
717 | --- a/net/bluetooth/hci_event.c |
718 | +++ b/net/bluetooth/hci_event.c |
719 | @@ -2366,7 +2366,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk |
720 | if (ev->opcode != HCI_OP_NOP) |
721 | del_timer(&hdev->cmd_timer); |
722 | |
723 | - if (ev->ncmd) { |
724 | + if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) { |
725 | atomic_set(&hdev->cmd_cnt, 1); |
726 | if (!skb_queue_empty(&hdev->cmd_q)) |
727 | queue_work(hdev->workqueue, &hdev->cmd_work); |
728 | diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c |
729 | index d478be1..7a0d984 100644 |
730 | --- a/net/bluetooth/hidp/core.c |
731 | +++ b/net/bluetooth/hidp/core.c |
732 | @@ -949,7 +949,7 @@ static int hidp_setup_hid(struct hidp_session *session, |
733 | hid->version = req->version; |
734 | hid->country = req->country; |
735 | |
736 | - strncpy(hid->name, req->name, 128); |
737 | + strncpy(hid->name, req->name, sizeof(req->name) - 1); |
738 | strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64); |
739 | strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64); |
740 | |
741 | diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c |
742 | index 677d659..9443348 100644 |
743 | --- a/net/mac80211/cfg.c |
744 | +++ b/net/mac80211/cfg.c |
745 | @@ -151,7 +151,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, |
746 | sta = sta_info_get(sdata, mac_addr); |
747 | else |
748 | sta = sta_info_get_bss(sdata, mac_addr); |
749 | - if (!sta) { |
750 | + /* |
751 | + * The ASSOC test makes sure the driver is ready to |
752 | + * receive the key. When wpa_supplicant has roamed |
753 | + * using FT, it attempts to set the key before |
754 | + * association has completed, this rejects that attempt |
755 | + * so it will set the key again after assocation. |
756 | + * |
757 | + * TODO: accept the key if we have a station entry and |
758 | + * add it to the device after the station. |
759 | + */ |
760 | + if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) { |
761 | ieee80211_key_free(sdata->local, key); |
762 | err = -ENOENT; |
763 | goto out_unlock; |
764 | diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h |
765 | index f8b5e75..05160db 100644 |
766 | --- a/net/mac80211/ieee80211_i.h |
767 | +++ b/net/mac80211/ieee80211_i.h |
768 | @@ -1264,10 +1264,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata); |
769 | void ieee80211_sched_scan_stopped_work(struct work_struct *work); |
770 | |
771 | /* off-channel helpers */ |
772 | -void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
773 | - bool offchannel_ps_enable); |
774 | -void ieee80211_offchannel_return(struct ieee80211_local *local, |
775 | - bool offchannel_ps_disable); |
776 | +void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local); |
777 | +void ieee80211_offchannel_return(struct ieee80211_local *local); |
778 | void ieee80211_hw_roc_setup(struct ieee80211_local *local); |
779 | |
780 | /* interface handling */ |
781 | diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c |
782 | index 935aa4b..c22f074 100644 |
783 | --- a/net/mac80211/offchannel.c |
784 | +++ b/net/mac80211/offchannel.c |
785 | @@ -103,8 +103,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata) |
786 | ieee80211_sta_reset_conn_monitor(sdata); |
787 | } |
788 | |
789 | -void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
790 | - bool offchannel_ps_enable) |
791 | +void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local) |
792 | { |
793 | struct ieee80211_sub_if_data *sdata; |
794 | |
795 | @@ -129,8 +128,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
796 | |
797 | if (sdata->vif.type != NL80211_IFTYPE_MONITOR) { |
798 | netif_tx_stop_all_queues(sdata->dev); |
799 | - if (offchannel_ps_enable && |
800 | - (sdata->vif.type == NL80211_IFTYPE_STATION) && |
801 | + if (sdata->vif.type == NL80211_IFTYPE_STATION && |
802 | sdata->u.mgd.associated) |
803 | ieee80211_offchannel_ps_enable(sdata, true); |
804 | } |
805 | @@ -138,8 +136,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, |
806 | mutex_unlock(&local->iflist_mtx); |
807 | } |
808 | |
809 | -void ieee80211_offchannel_return(struct ieee80211_local *local, |
810 | - bool offchannel_ps_disable) |
811 | +void ieee80211_offchannel_return(struct ieee80211_local *local) |
812 | { |
813 | struct ieee80211_sub_if_data *sdata; |
814 | |
815 | @@ -152,11 +149,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local, |
816 | continue; |
817 | |
818 | /* Tell AP we're back */ |
819 | - if (offchannel_ps_disable && |
820 | - sdata->vif.type == NL80211_IFTYPE_STATION) { |
821 | - if (sdata->u.mgd.associated) |
822 | - ieee80211_offchannel_ps_disable(sdata); |
823 | - } |
824 | + if (sdata->vif.type == NL80211_IFTYPE_STATION && |
825 | + sdata->u.mgd.associated) |
826 | + ieee80211_offchannel_ps_disable(sdata); |
827 | |
828 | if (sdata->vif.type != NL80211_IFTYPE_MONITOR) { |
829 | /* |
830 | diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c |
831 | index e95d494..bcc57f9 100644 |
832 | --- a/net/mac80211/scan.c |
833 | +++ b/net/mac80211/scan.c |
834 | @@ -329,7 +329,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted, |
835 | if (!was_hw_scan) { |
836 | ieee80211_configure_filter(local); |
837 | drv_sw_scan_complete(local); |
838 | - ieee80211_offchannel_return(local, true); |
839 | + ieee80211_offchannel_return(local); |
840 | } |
841 | |
842 | ieee80211_recalc_idle(local); |
843 | @@ -374,7 +374,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local) |
844 | local->next_scan_state = SCAN_DECISION; |
845 | local->scan_channel_idx = 0; |
846 | |
847 | - ieee80211_offchannel_stop_vifs(local, true); |
848 | + ieee80211_offchannel_stop_vifs(local); |
849 | |
850 | ieee80211_configure_filter(local); |
851 | |
852 | @@ -629,12 +629,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local, |
853 | local->scan_channel = NULL; |
854 | ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL); |
855 | |
856 | - /* |
857 | - * Re-enable vifs and beaconing. Leave PS |
858 | - * in off-channel state..will put that back |
859 | - * on-channel at the end of scanning. |
860 | - */ |
861 | - ieee80211_offchannel_return(local, false); |
862 | + /* disable PS */ |
863 | + ieee80211_offchannel_return(local); |
864 | |
865 | *next_delay = HZ / 5; |
866 | /* afterwards, resume scan & go to next channel */ |
867 | @@ -644,8 +640,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local, |
868 | static void ieee80211_scan_state_resume(struct ieee80211_local *local, |
869 | unsigned long *next_delay) |
870 | { |
871 | - /* PS already is in off-channel mode */ |
872 | - ieee80211_offchannel_stop_vifs(local, false); |
873 | + ieee80211_offchannel_stop_vifs(local); |
874 | |
875 | if (local->ops->flush) { |
876 | drv_flush(local, false); |
877 | diff --git a/net/mac80211/work.c b/net/mac80211/work.c |
878 | index c6e230e..a74f538 100644 |
879 | --- a/net/mac80211/work.c |
880 | +++ b/net/mac80211/work.c |
881 | @@ -148,7 +148,7 @@ static void ieee80211_work_work(struct work_struct *work) |
882 | } |
883 | |
884 | if (!started && !local->tmp_channel) { |
885 | - ieee80211_offchannel_stop_vifs(local, true); |
886 | + ieee80211_offchannel_stop_vifs(local); |
887 | |
888 | local->tmp_channel = wk->chan; |
889 | local->tmp_channel_type = wk->chan_type; |
890 | @@ -220,7 +220,7 @@ static void ieee80211_work_work(struct work_struct *work) |
891 | local->tmp_channel = NULL; |
892 | ieee80211_hw_config(local, 0); |
893 | |
894 | - ieee80211_offchannel_return(local, true); |
895 | + ieee80211_offchannel_return(local); |
896 | |
897 | /* give connection some time to breathe */ |
898 | run_again(local, jiffies + HZ/2); |
899 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
900 | index 7f2a109..f7f8776 100644 |
901 | --- a/sound/pci/hda/patch_realtek.c |
902 | +++ b/sound/pci/hda/patch_realtek.c |
903 | @@ -4741,6 +4741,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = { |
904 | SND_PCI_QUIRK(0x1584, 0x9077, "Uniwill P53", ALC880_FIXUP_VOL_KNOB), |
905 | SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810), |
906 | SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM), |
907 | + SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST), |
908 | SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734), |
909 | SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU), |
910 | SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734), |
911 | diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c |
912 | index 86b84a1..8e0cf14 100644 |
913 | --- a/sound/soc/codecs/wm2200.c |
914 | +++ b/sound/soc/codecs/wm2200.c |
915 | @@ -897,8 +897,6 @@ static const char *wm2200_mixer_texts[] = { |
916 | "EQR", |
917 | "LHPF1", |
918 | "LHPF2", |
919 | - "LHPF3", |
920 | - "LHPF4", |
921 | "DSP1.1", |
922 | "DSP1.2", |
923 | "DSP1.3", |
924 | @@ -931,7 +929,6 @@ static int wm2200_mixer_values[] = { |
925 | 0x25, |
926 | 0x50, /* EQ */ |
927 | 0x51, |
928 | - 0x52, |
929 | 0x60, /* LHPF1 */ |
930 | 0x61, /* LHPF2 */ |
931 | 0x68, /* DSP1 */ |
932 | diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c |
933 | index 29ae209..15b0712 100644 |
934 | --- a/sound/usb/mixer.c |
935 | +++ b/sound/usb/mixer.c |
936 | @@ -1239,16 +1239,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void |
937 | } |
938 | channels = (hdr->bLength - 7) / csize - 1; |
939 | bmaControls = hdr->bmaControls; |
940 | + if (hdr->bLength < 7 + csize) { |
941 | + snd_printk(KERN_ERR "usbaudio: unit %u: " |
942 | + "invalid UAC_FEATURE_UNIT descriptor\n", |
943 | + unitid); |
944 | + return -EINVAL; |
945 | + } |
946 | } else { |
947 | struct uac2_feature_unit_descriptor *ftr = _ftr; |
948 | csize = 4; |
949 | channels = (hdr->bLength - 6) / 4 - 1; |
950 | bmaControls = ftr->bmaControls; |
951 | - } |
952 | - |
953 | - if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) { |
954 | - snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid); |
955 | - return -EINVAL; |
956 | + if (hdr->bLength < 6 + csize) { |
957 | + snd_printk(KERN_ERR "usbaudio: unit %u: " |
958 | + "invalid UAC_FEATURE_UNIT descriptor\n", |
959 | + unitid); |
960 | + return -EINVAL; |
961 | + } |
962 | } |
963 | |
964 | /* parse the source unit */ |