1. 30 11月, 2013 3 次提交
    • L
      Merge tag 'sound-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · b8495995
      Linus Torvalds 提交于
      Pull sound fixes from Takashi Iwai:
       "Quite a few HD-Audio fixes, a WUSB audio fix and a fix for FireWire
        audio.  The HD-audio part contains a couple of fixes for the generic
        parser, and these are the only intrusive fixes.  The rest are mostly
        device-specific fixes"
      
      * tag 'sound-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Add LFE chmap to ASUS ET2700
        ALSA: hda - Initialize missing bass speaker pin for ASUS AIO ET2700
        ALSA: hda - limit mic boost on Asus UX31[A,E]
        ALSA: hda - Check leaf nodes to find aamix amps
        ALSA: hda - Fix hp-mic mode without VREF bits
        ALSA: hda - Create Headhpone Mic Jack Mode when really needed
        ALSA: usb: use multiple packets per urb for Wireless USB inbound audio
        ALSA: hda - Enable mute/mic-mute LEDs for more Thinkpads with Conexant codec
        ALSA: hda - Drop bus->avoid_link_reset flag
        ALSA: hda/realtek - Set pcbeep amp for ALC668
        ALSA: hda/realtek - Add support of ALC231 codec
        ALSA: firewire-lib: fix wrong value for FDF field as an empty packet
      b8495995
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b01537bf
      Linus Torvalds 提交于
      Pull vfs dentry reference count fix from Al Viro.
      
      This fixes a possible inode_permission NULL pointer dereference (and
      other problems) that were due to the root dentry count being decremented
      too much.  In commit 48a066e7 ("RCU'd vfsmounts") the placement of
      clearing the LOOKUP_RCU bit changed, and we then returned failure of
      incrementing the lockref on the parent dentry with LOOKUP_RCU cleared.
      
      But that meant we needed to go through the same cleanup routines that
      the later failures did wrt LOOKUP_ROOT and nd->root.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fix bogus path_put() of nd->root after some unlazy_walk() failures
      b01537bf
    • L
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 282c183b
      Linus Torvalds 提交于
      Pull drm qxl leak fix from Dave Airlie:
       "As usual 5 mins after I send a trivial pull fix I find a real bug!
      
        This fixes a memory leak and I'd like to get it into stable queue
        asap"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/qxl: fix memory leak in release list handling
      282c183b
  2. 29 11月, 2013 6 次提交
    • A
      fix bogus path_put() of nd->root after some unlazy_walk() failures · d870b4a1
      Al Viro 提交于
      Failure to grab reference to parent dentry should go through the
      same cleanup as nd->seq mismatch.  As it is, we might end up with
      caller thinking it needs to path_put() nd->root, with obvious
      nasty results once we'd hit that bug enough times to drive the
      refcount of root dentry all the way to zero...
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      d870b4a1
    • D
      drm/qxl: fix memory leak in release list handling · 1b28c3e6
      Dave Airlie 提交于
      wow no idea how I got this far without seeing this,
      leaking the entries in the list makes kmalloc-64 slab grow.
      
      References: https://bugzilla.kernel.org/show_bug.cgi?id=65121
      Cc: stable@vger.kernel.org
      Reported-by: NMatthew Stapleton <matthew4196@gmail.com>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      1b28c3e6
    • L
      Merge tag 'gpio-v3.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · dda9cc3a
      Linus Torvalds 提交于
      Pull GPIO fixes from Linus Walleij:
       "Here us a bunch of patches for the v3.13 series.  Most important stuff
        is related to fixes and documentation for the new GPIO descriptor API.
        If the diffstat is scary you'll notice most of it is to
        Documentation/*:
      
         - A big slew of documentation for the gpiod transition that happened
           in the merge window, no semantic effect, but we should provide
           proper documentation with the new API.
      
         - Fix flags related to the new API.
      
         - Fix to the find_chip_by_name() lookup function related to the new
           API.
      
         - Fix of_find_gpio() when not using device tree.
      
         - Bug fix for the TB10x direction setting.
      
         - Error path fixes from Dan Carpenter.
      
         - Nasty IRQdomain bug relating to taking an unitialized spinlock.
      
         - Minor fixes here and there"
      
      * tag 'gpio-v3.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: bcm281xx: Fix return value of bcm_kona_gpio_get()
        gpio: pl061: move irqdomain initialization
        gpio: ucb1400: Add MODULE_ALIAS
        gpiolib: fix of_find_gpio() when OF not defined
        gpio: fix memory leak in error path
        gpio: rcar: NULL dereference on error in probe()
        gpio: msm: make msm_gpio.summary_irq signed for error handling
        gpio: mvebu: make mvchip->irqbase signed for error handling
        gpiolib: use dedicated flags for GPIO properties
        gpiolib: fix find_chip_by_name()
        Documentation: gpiolib: document new interface
        gpio: tb10x: Set output value before setting direction to output
      dda9cc3a
    • L
      Merge tag 'md/3.13-fixes' of git://neil.brown.name/md · 962ba263
      Linus Torvalds 提交于
      Pull md fixes from Neil Brown:
       "Three bug fixes for md in 3.13-rc
      
        All recent regressions, one in 3.12 so marked for -stable"
      
      * tag 'md/3.13-fixes' of git://neil.brown.name/md:
        md/raid5: fix newly-broken locking in get_active_stripe.
        md: test mddev->flags more safely in md_check_recovery.
        md/raid5: fix new memory-reference bug in alloc_thread_groups.
      962ba263
    • L
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · 3bad8bb5
      Linus Torvalds 提交于
      Pull cifs fixes from Steve French:
       "SMB3 "validate negotiate" is needed to prevent certain types of
        downgrade attacks.
      
        Also changes SMB2/SMB3 copy offload from using the BTRFS copy ioctl
        (BTRFS_IOC_CLONE) to a cifs specific ioctl (CIFS_IOC_COPYCHUNK_FILE)
        to address Christoph's comment that there are semantic differences
        between requesting copy offload in which copy-on-write is mandatory
        (as in the BTRFS ioctl) and optional in the SMB2/SMB3 case.  Also
        fixes SMB2/SMB3 copychunk for large files"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        [CIFS] Do not use btrfs refcopy ioctl for SMB2 copy offload
        Check SMB3 dialects against downgrade attacks
        Removed duplicated (and unneeded) goto
        CIFS: Fix SMB2/SMB3 Copy offload support (refcopy) for large files
      3bad8bb5
    • H
      kernel/extable: fix address-checks for core_kernel and init areas · 5ecbe3c3
      Helge Deller 提交于
      The init_kernel_text() and core_kernel_text() functions should not
      include the labels _einittext and _etext when checking if an address is
      inside the .text or .init sections.
      Signed-off-by: NHelge Deller <deller@gmx.de>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      5ecbe3c3
  3. 28 11月, 2013 21 次提交
  4. 27 11月, 2013 10 次提交
    • M
      gpio: bcm281xx: Fix return value of bcm_kona_gpio_get() · e2f0b005
      Markus Mayer 提交于
      We need to return the corresponding bit for a particular GPIO. This bit
      contains shift not mask.
      Signed-off-by: NMarkus Mayer <markus.mayer@linaro.org>
      Reviewed-by: NTim Kryger <tim.kryger@linaro.org>
      Reviewed-by: NMatt Porter <matt.porter@linaro.org>
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      e2f0b005
    • T
      ALSA: hda - Fix hp-mic mode without VREF bits · 16c0cefe
      Takashi Iwai 提交于
      When the hp mic pin has no VREF bits, the driver forgot to set PIN_IN
      bit.  Spotted during debugging old MacBook Airs.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=65681
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      16c0cefe
    • T
      ALSA: hda - Create Headhpone Mic Jack Mode when really needed · ced4cefc
      Takashi Iwai 提交于
      When a headphone jack is configurable as input, the generic parser
      tries to make it retaskable as Headphone Mic.  The switching can be
      done smoothly if Capture Source control exists (i.e. there is another
      input source).  Or when user explicitly enables the creation of jack
      mode controls, "Headhpone Mic Jack Mode" will be created accordingly.
      
      However, if the headphone mic is the only input source, we have to
      create "Headphone Mic Jack Mode" control because there is no capture
      source selection.  Otherwise, the generic parser assumes that the
      input is constantly enabled, thus the headphone is permanently set
      as input.  This situation happens on the old MacBook Airs where no
      input is supported properly, for example.
      
      This patch fixes the problem: now "Headphone Mic Jack Mode" is created
      when such an input selection isn't possible.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=65681
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      ced4cefc
    • L
      gpio: pl061: move irqdomain initialization · 2ba3154d
      Linus Walleij 提交于
      The PL061 driver had the irqdomain initialization in an unfortunate
      place: when used with device tree (and thus passing the base IRQ
      0) the driver would work, as this registers an irqdomain and waits
      for mappings to be done dynamically as the devices request their
      IRQs, whereas when booting using platform data the irqdomain core
      would attempt to allocate IRQ descriptors dynamically (which works
      fine) but also to associate the irq_domain_associate_many() on all
      IRQs, which in turn will call the mapping function which at this
      point will try to set the type of the IRQ and then tries to acquire
      a non-initialized spinlock yielding a backtrace like this:
      
      CPU: 0 PID: 1 Comm: swapper Not tainted 3.13.0-rc1+ #652
      Backtrace:
      [<c0016f0c>] (dump_backtrace) from [<c00172ac>] (show_stack+0x18/0x1c)
       r6:c798ace0 r5:00000000 r4:c78257e0 r3:00200140
      [<c0017294>] (show_stack) from [<c0329ea0>] (dump_stack+0x20/0x28)
      [<c0329e80>] (dump_stack) from [<c004fa80>] (__lock_acquire+0x1c0/0x1b80)
      [<c004f8c0>] (__lock_acquire) from [<c0051970>] (lock_acquire+0x6c/0x80)
       r10:00000000 r9:c0455234 r8:00000060 r7:c047d798 r6:600000d3 r5:00000000
       r4:c782c000
      [<c0051904>] (lock_acquire) from [<c032e484>] (_raw_spin_lock_irqsave+0x60/0x74)
       r6:c01a1100 r5:800000d3 r4:c798acd0
      [<c032e424>] (_raw_spin_lock_irqsave) from [<c01a1100>] (pl061_irq_type+0x28/0x)
       r6:00000000 r5:00000000 r4:c798acd0
      [<c01a10d8>] (pl061_irq_type) from [<c0059ef4>] (__irq_set_trigger+0x70/0x104)
       r6:00000000 r5:c01a10d8 r4:c046da1c r3:c01a10d8
      [<c0059e84>] (__irq_set_trigger) from [<c005b348>] (irq_set_irq_type+0x40/0x60)
       r10:c043240c r8:00000060 r7:00000000 r6:c046da1c r5:00000060 r4:00000000
      [<c005b308>] (irq_set_irq_type) from [<c01a1208>] (pl061_irq_map+0x40/0x54)
       r6:c79693c0 r5:c798acd0 r4:00000060
      [<c01a11c8>] (pl061_irq_map) from [<c005d27c>] (irq_domain_associate+0xc0/0x190)
       r5:00000060 r4:c046da1c
      [<c005d1bc>] (irq_domain_associate) from [<c005d604>] (irq_domain_associate_man)
       r8:00000008 r7:00000000 r6:c79693c0 r5:00000060 r4:00000000
      [<c005d5d0>] (irq_domain_associate_many) from [<c005d864>] (irq_domain_add_simp)
       r8:c046578c r7:c035b72c r6:c79693c0 r5:00000060 r4:00000008 r3:00000008
      [<c005d814>] (irq_domain_add_simple) from [<c01a1380>] (pl061_probe+0xc4/0x22c)
       r6:00000060 r5:c0464380 r4:c798acd0
      [<c01a12bc>] (pl061_probe) from [<c01c0450>] (amba_probe+0x74/0xe0)
       r10:c043240c r9:c0455234 r8:00000000 r7:c047d7f8 r6:c047d744 r5:00000000
       r4:c0464380
      
      This moves the irqdomain initialization to a point where the spinlock
      and GPIO chip are both fully propulated, so the callbacks can be used
      without crashes.
      
      I had some problem reproducing the crash, as the devm_kzalloc():ed
      zeroed memory would seemingly mask the spinlock as something OK,
      but by poisoning the lock like this:
      
      u32 *dum;
      dum = (u32 *) &chip->lock;
      *dum = 0xaaaaaaaaU;
      
      I could reproduce, fix and test the patch.
      Reported-by: NRussell King <linux@arm.linux.org.uk>
      Cc: Rob Herring <robherring2@gmail.com>
      Cc: Haojian Zhuang <haojian.zhuang@linaro.org>
      Cc: Baruch Siach <baruch@tkos.co.il>
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      2ba3154d
    • T
      ALSA: usb: use multiple packets per urb for Wireless USB inbound audio · a93455e1
      Thomas Pugliese 提交于
      For Wireless USB audio devices, use multiple isoc packets per URB for
      inbound endpoints with a datainterval < 5.  This allows the WUSB host
      controller to take advantage of bursting to service endpoints whose
      logical polling interval is less than the 4ms minimum polling interval
      limit in WUSB.
      Signed-off-by: NThomas Pugliese <thomas.pugliese@gmail.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      a93455e1
    • D
      HID: uhid: fix leak for 64/32 UHID_CREATE · 80897aa7
      David Herrmann 提交于
      UHID allows short writes so user-space can omit unused fields. We
      automatically set them to 0 in the kernel. However, the 64/32 bit
      compat-handler didn't do that in the UHID_CREATE fallback. This will
      reveal random kernel heap data (of random size, even) to user-space.
      
      Fixes: befde022 ('HID: uhid: make creating devices work on 64/32 systems')
      Reported-by: NBen Hutchings <ben@decadent.org.uk>
      Signed-off-by: NDavid Herrmann <dh.herrmann@gmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      80897aa7
    • H
      ALSA: hda - Enable mute/mic-mute LEDs for more Thinkpads with Conexant codec · 2fd3f170
      Hui Wang 提交于
      Most Thinkpad Edge series laptops use conexant codec, so far although
      the codecs have different minor Vendor Id and minor Subsystem Id,
      they all belong to the cxt5066 family, this change can make the
      mute/mic-mute LEDs support more generic among cxt_5066 family.
      
      This design refers to the similar solution for the realtek codec
      ALC269 family in the patch_realtek.c.
      
      Cc: Alex Hung <alex.hung@canonical.com>
      Signed-off-by: NHui Wang <hui.wang@canonical.com>
      Acked-by: NDavid Henningsson <david.henningsson@canonical.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      2fd3f170
    • L
      Merge tag 'trace-fixes-v3.13-rc1' of... · 8ae516aa
      Linus Torvalds 提交于
      Merge tag 'trace-fixes-v3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fixes from Steven Rostedt:
       "This includes two fixes.
      
        1) is a bug fix that happens when root does the following:
      
           echo function_graph > current_tracer
           modprobe foo
           echo nop > current_tracer
      
         This causes the ftrace internal accounting to get screwed up and
         crashes ftrace, preventing the user from using the function tracer
         after that.
      
        2) if a TRACE_EVENT has a string field, and NULL is given for it.
      
         The internal trace event code does a strlen() and strcpy() on the
         source of field.  If it is NULL it causes the system to oops.
      
         This bug has been there since 2.6.31, but no TRACE_EVENT ever passed
         in a NULL to the string field, until now"
      
      * tag 'trace-fixes-v3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        ftrace: Fix function graph with loading of modules
        tracing: Allow events to have NULL strings
      8ae516aa
    • L
      Merge branch 'for-linus-bugs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 4f9e5df2
      Linus Torvalds 提交于
      Pull ceph bug-fixes from Sage Weil:
       "These include a couple fixes to the new fscache code that went in
        during the last cycle (which will need to go stable@ shortly as well),
        a couple client-side directory fragmentation fixes, a fix for a race
        in the cap release queuing path, and a couple race fixes in the
        request abort and resend code.
      
        Obviously some of this could have gone into 3.12 final, but I
        preferred to overtest rather than send things in for a late -rc, and
        then my travel schedule intervened"
      
      * 'for-linus-bugs' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        ceph: allocate non-zero page to fscache in readpage()
        ceph: wake up 'safe' waiters when unregistering request
        ceph: cleanup aborted requests when re-sending requests.
        ceph: handle race between cap reconnect and cap release
        ceph: set caps count after composing cap reconnect message
        ceph: queue cap release in __ceph_remove_cap()
        ceph: handle frag mismatch between readdir request and reply
        ceph: remove outdated frag information
        ceph: hung on ceph fscache invalidate in some cases
      4f9e5df2
    • B
      powerpc/windfarm: Fix XServe G5 fan control Makefile issue · 721cb59e
      Benjamin Herrenschmidt 提交于
      We are missing building windfarm_max6690_sensor.o when building
      CONFIG_WINDFARM_RM31. Usually all the windfarm drivers are built
      and thus this isn't a problem but some more "tailored" setups
      (Gentoo ?) building only that driver are not working because
      the require sensor module is missing.
      Reported-by: NStanislav Ponomarev <devhexorg@gmail.com>
      Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
      721cb59e