1. 23 Oct, 2015 4 commits
    • Linus Torvalds's avatar
      Merge tag 'sound-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 0122835a
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "There is nothing to worry you much, only a few small & stable patches
        are found for usual stuff, HD-audio (a Lenovo laptop quirk, a fix for
        minor error handling) and ASoC (trivial fixes for RT298 and WM
        codecs).
      
        The only remaining major change is the fix for ASoC SX_TLV control
        that was overseen during refactoring, but the fix itself is trivial
        and safe"
      
      * tag 'sound-4.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ASoC: wm8962: mark cache_dirty flag after software reset in pm_resume
        ASoC: rt298: fix wrong setting of gpio2_en
        ASoC: wm8904: Correct number of EQ registers
        ALSA: hda - Fix deadlock at error in building PCM
        ASoC: Add info callback for SX_TLV controls
        ASoC: rt298: correct index default value
        ALSA: hda - Fix inverted internal mic on Lenovo G50-80
        ALSA: hdac: Explicitly add io.h
      0122835a
    • Linus Torvalds's avatar
      Merge tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 45d80f16
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
       "Some regression fixes and potential security issues:
      
         - netup_unidvb: fix potential crash when spi is NULL
         - rtl28xxu: fix control message flaws
         - m88ds3103: fix a regression on Kernel 4.2
         - c8sectpfe: fix some issues on this new driver
         - v4l2-flash-led-class: fix a Kbuild dependency
         - si2157 and si2158: check for array boundary when uploading firmware
           files
         - horus3a and lnbh25: fix some building troubles when some options
           aren't selected
         - ir-hix5hd2: drop the use of IRQF_NO_SUSPEND"
      
      * tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] m88ds3103: use own reg update_bits() implementation
        [media] rtl28xxu: fix control message flaws
        [media] v4l2-flash-led-class: Add missing VIDEO_V4L2 Kconfig dependency
        [media] netup_unidvb: fix potential crash when spi is NULL
        [media] si2168: Bounds check firmware
        [media] si2157: Bounds check firmware
        [media] ir-hix5hd2: drop the use of IRQF_NO_SUSPEND
        [media] c8sectpfe: fix return of garbage
        [media] c8sectpfe: fix ininitialized error return on firmware load failure
        [media] lnbh25: Fix lnbh25_attach() function return type
        [media] horus3a: Fix horus3a_attach() function parameters
      45d80f16
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · a67b20d2
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "I've been a bit slow gathering these:
      
         - drm/mst: one mutex leak in a fail path
      
         - radeon: two oops fixes, one dpm fix
      
         - i915: one messy set of fixes, where we revert the original fix, and
                 pull back the proper set of fixes from -next on top.
      
         - nouveau: one fix for an illegal buffer placement.
      
        Doesn't look too bad, hopefully shouldn't be too much more"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/nouveau/gem: return only valid domain when there's only one
        drm: fix mutex leak in drm_dp_get_mst_branch_device
        drm/amdgpu: add missing dpm check for KV dpm late init
        drm/amdgpu/dpm: don't add pwm attributes if DPM is disabled
        drm/radeon/dpm: don't add pwm attributes if DPM is disabled
        drm/i915: Add primary plane to mask if it's visible
        drm/i915: Move sprite/cursor plane disable to intel_sanitize_crtc()
        drm/i915: Assign hwmode after encoder state readout
        Revert "drm/i915: Add primary plane to mask if it's visible"
        drm/i915: Deny wrapping an userptr into a framebuffer
        drm/i915: Enable DPLL VGA mode before P1/P2 divider write
        drm/i915: Restore lost DPLL register write on gen2-4
        drm/i915: Flush pipecontrol post-sync writes
        drm/i915: Fix kerneldoc for i915_gem_shrink_all
      a67b20d2
    • Takashi Iwai's avatar
      Merge tag 'asoc-fix-v4.3-rc6' of... · b9b6e4ac
      Takashi Iwai authored
      Merge tag 'asoc-fix-v4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v4.3
      
      A bunch of driver fixes plus one core fix which fixes problems with
      misreporting values from _SX controls following a recent refactoring.
      This had gone unnoticed as such controls are quite rare.
      b9b6e4ac
  2. 22 Oct, 2015 16 commits
  3. 21 Oct, 2015 7 commits
  4. 20 Oct, 2015 4 commits
    • Charles Keepax's avatar
      ASoC: wm8904: Correct number of EQ registers · 97aff2c0
      Charles Keepax authored
      There are 24 EQ registers not 25, I suspect this bug came about because
      the registers start at EQ1 not zero. The bug is relatively harmless as
      the extra register written is an unused one.
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.wolfsonmicro.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Cc: stable@vger.kernel.org
      97aff2c0
    • Takashi Iwai's avatar
      ALSA: hda - Fix deadlock at error in building PCM · d289619a
      Takashi Iwai authored
      The HDA codec driver issues snd_hda_codec_reset() at the error path of
      PCM build.  This was needed in the earlier code base, but the recent
      rewrite to use the standard bus binding made this a deadlock:
       modprobe        D 0000000000000005     0   720    716 0x00000080
       Call Trace:
        [<ffffffff816a5dbe>] schedule+0x3e/0x90
        [<ffffffff816a61a5>] schedule_preempt_disabled+0x15/0x20
        [<ffffffff816a7ae5>] __mutex_lock_slowpath+0xb5/0x120
        [<ffffffff816a7b6b>] mutex_lock+0x1b/0x30
        [<ffffffff8148656b>] device_release_driver+0x1b/0x30
        [<ffffffff81485c15>] bus_remove_device+0x105/0x180
        [<ffffffff814822b9>] device_del+0x139/0x260
        [<ffffffffa05e0ec5>] snd_hdac_device_unregister+0x25/0x30 [snd_hda_core]
        [<ffffffffa074fa6a>] snd_hda_codec_reset+0x2a/0x70 [snd_hda_codec]
        [<ffffffffa075007b>] snd_hda_codec_build_pcms+0x18b/0x1b0 [snd_hda_codec]
        [<ffffffffa074a44e>] hda_codec_driver_probe+0xbe/0x140 [snd_hda_codec]
        [<ffffffff81486ac4>] driver_probe_device+0x1f4/0x460
        [<ffffffff81486dc0>] __driver_attach+0x90/0xa0
        [<ffffffff81484844>] bus_for_each_dev+0x64/0xa0
        [<ffffffff814862de>] driver_attach+0x1e/0x20
        [<ffffffff81485e7b>] bus_add_driver+0x1eb/0x280
        [<ffffffff81487680>] driver_register+0x60/0xe0
        [<ffffffffa074a0da>] __hda_codec_driver_register+0x5a/0x60 [snd_hda_codec]
        [<ffffffffa070a01e>] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek]
        [<ffffffff810002f3>] do_one_initcall+0xb3/0x200
        [<ffffffff816a1fc5>] do_init_module+0x60/0x1f8
        [<ffffffff810ee5c3>] load_module+0x1653/0x1bd0
        [<ffffffff810eed48>] SYSC_finit_module+0x98/0xc0
        [<ffffffff810eed8e>] SyS_finit_module+0xe/0x10
        [<ffffffff816aa032>] entry_SYSCALL_64_fastpath+0x16/0x75
      
      The simple fix is just to remove this call, since we don't need to
      think about unbinding at there any longer.
      
      Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=948758
      Cc: <stable@vger.kernel.org> # v4.1+
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      d289619a
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml · be0e1987
      Linus Torvalds authored
      Pull UML fixes from Richard Weinberger:
       "This contains four overdue UML regression fixes"
      
      * 'for-linus-4.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml:
        um: Fix kernel mode fault condition
        um: Fix waitpid() usage in helper code
        um: Do not rely on libc to provide modify_ldt()
        um: Fix out-of-tree build
      be0e1987
    • Linus Torvalds's avatar
      Merge branch 'keys-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · ce1fad27
      Linus Torvalds authored
      Pull key handling fixes from David Howells:
       "Here are two patches, the first of which at least should go upstream
        immediately:
      
        (1) Prevent a user-triggerable crash in the keyrings destructor when a
            negatively instantiated keyring is garbage collected.  I have also
            seen this triggered for user type keys.
      
        (2) Prevent the user from using requesting that a keyring be created
            and instantiated through an upcall.  Doing so is probably safe
            since the keyring type ignores the arguments to its instantiation
            function - but we probably shouldn't let keyrings be created in
            this manner"
      
      * 'keys-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
        KEYS: Don't permit request_key() to construct a new keyring
        KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
      ce1fad27
  5. 19 Oct, 2015 9 commits
    • Richard Weinberger's avatar
      um: Fix kernel mode fault condition · 56b88a3b
      Richard Weinberger authored
      We have to exclude memory locations <= PAGE_SIZE from
      the condition and let the kernel mode fault path catch it.
      Otherwise a kernel NULL pointer exception will be reported
      as a kernel user space access.
      
      Fixes: d2313084 (um: Catch unprotected user memory access)
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      56b88a3b
    • Richard Weinberger's avatar
      um: Fix waitpid() usage in helper code · 6b187337
      Richard Weinberger authored
      If UML is executing a helper program it is using
      waitpid() with the __WCLONE flag to wait for the program
      as the helper is executed from a clone()'ed thread.
      While using __WCLONE is perfectly fine for clone()'ed
      childs it won't detect terminated childs if the helper
      has issued an execve().
      
      We have to use __WALL to wait for both clone()'ed and
      regular childs to detect the termination before and
      after an execve().
      Reported-and-tested-by: default avatarThomas Meyer <thomas@m3y3r.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      6b187337
    • Hans-Werner Hilse's avatar
      um: Do not rely on libc to provide modify_ldt() · 37e81a01
      Hans-Werner Hilse authored
      modify_ldt() was declared as an external symbol. Despite the man
      page for this syscall telling that there is no wrapper in glibc,
      since version 2.1 there actually is, so linking to the glibc
      works.
      
      Since modify_ldt() is not a POSIX interface, other libc
      implementations do not always provide a wrapper function.
      Even glibc headers do not provide a corresponding declaration.
      
      So go the recommended way to call this using syscall().
      Signed-off-by: default avatarHans-Werner Hilse <hwhilse@gmail.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      37e81a01
    • Richard Weinberger's avatar
      um: Fix out-of-tree build · 0b5aedfe
      Richard Weinberger authored
      Commit 30b11ee9 (um: Remove copy&paste code from init.h)
      uncovered an issue wrt. out-of-tree builds.
      For out-of-tree builds, we must not rely on relative paths.
      Before 30b11ee9 it worked by chance as no host code included
      generated header files.
      Acked-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      0b5aedfe
    • Alex Deucher's avatar
      drm/amdgpu: add missing dpm check for KV dpm late init · 677c884f
      Alex Deucher authored
      Skip dpm late init if dpm is disabled.
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      677c884f
    • Alex Deucher's avatar
      drm/amdgpu/dpm: don't add pwm attributes if DPM is disabled · 27100735
      Alex Deucher authored
      PWM fan control is only available with DPM.  There is no non-DPM
      support on amdgpu, so we should never get a crash here because
      the sysfs nodes would never be created in the first place. Add the
      check just in case to be on the safe side.
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      27100735
    • Alex Deucher's avatar
      drm/radeon/dpm: don't add pwm attributes if DPM is disabled · 2a7d44f4
      Alex Deucher authored
      PWM fan control is only available with DPM.  If DPM disabled,
      don't expose the PWM fan controls to avoid a crash.
      
      Bug:
      https://bugs.freedesktop.org/show_bug.cgi?id=92524Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      2a7d44f4
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 1099f860
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Account for extra headroom in ath9k driver, from Felix Fietkau.
      
       2) Fix OOPS in pppoe driver due to incorrect socket state transition,
          from Guillaume Nault.
      
       3) Kill memory leak in amd-xgbe debugfx, from Geliang Tang.
      
       4) Power management fixes for iwlwifi, from Johannes Berg.
      
       5) Fix races in reqsk_queue_unlink(), from Eric Dumazet.
      
       6) Fix dst_entry usage in ARP replies, from Jiri Benc.
      
       7) Cure OOPSes with SO_GET_FILTER, from Daniel Borkmann.
      
       8) Missing allocation failure check in amd-xgbe, from Tom Lendacky.
      
       9) Various resource allocation/freeing cures in DSA< from Neil
          Armstrong.
      
      10) A series of bug fixes in the openvswitch conntrack support, from
          Joe Stringer.
      
      11) Fix two cases (BPF and act_mirred) where we have to clean the sender
          cpu stored in the SKB before transmitting.  From WANG Cong and
          Alexei Starovoitov.
      
      12) Disable VLAN filtering in promiscuous mode in mlx5 driver, from
          Achiad Shochat.
      
      13) Older bnx2x chips cannot do 4-tuple UDP hashing, so prevent this
          configuration via ethtool.  From Yuval Mintz.
      
      14) Don't call rt6_uncached_list_flush_dev() from rt6_ifdown() when
          'dev' is NULL, from Eric Biederman.
      
      15) Prevent stalled link synchronization in tipc, from Jon Paul Maloy.
      
      16) kcalloc() gstrings ethtool buffer before having driver fill it in,
          in order to prevent kernel memory leaking.  From Joe Perches.
      
      17) Fix mixxing rt6_info initialization for blackhole routes, from
          Martin KaFai Lau.
      
      18) Kill VLAN regression in via-rhine, from Andrej Ota.
      
      19) Missing pfmemalloc check in sk_add_backlog(), from Eric Dumazet.
      
      20) Fix spurious MSG_TRUNC signalling in netlink dumps, from Ronen Arad.
      
      21) Scrube SKBs when pushing them between namespaces in openvswitch,
          from Joe Stringer.
      
      22) bcmgenet enables link interrupts too early, fix from Florian
          Fainelli.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (92 commits)
        net: bcmgenet: Fix early link interrupt enabling
        tunnels: Don't require remote endpoint or ID during creation.
        openvswitch: Scrub skb between namespaces
        xen-netback: correctly check failed allocation
        net: asix: add support for the Billionton GUSB2AM-1G-B USB adapter
        netlink: Trim skb to alloc size to avoid MSG_TRUNC
        net: add pfmemalloc check in sk_add_backlog()
        via-rhine: fix VLAN receive handling regression.
        ipv6: Initialize rt6_info properly in ip6_blackhole_route()
        ipv6: Move common init code for rt6_info to a new function rt6_info_init()
        Bluetooth: Fix initializing conn_params in scan phase
        Bluetooth: Fix conn_params list update in hci_connect_le_scan_cleanup
        Bluetooth: Fix remove_device behavior for explicit connects
        Bluetooth: Fix LE reconnection logic
        Bluetooth: Fix reference counting for LE-scan based connections
        Bluetooth: Fix double scan updates
        mlxsw: core: Fix race condition in __mlxsw_emad_transmit
        tipc: move fragment importance field to new header position
        ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
        tipc: eliminate risk of stalled link synchronization
        ...
      1099f860
    • David Howells's avatar
      KEYS: Don't permit request_key() to construct a new keyring · 911b79cd
      David Howells authored
      If request_key() is used to find a keyring, only do the search part - don't
      do the construction part if the keyring was not found by the search.  We
      don't really want keyrings in the negative instantiated state since the
      rejected/negative instantiation error value in the payload is unioned with
      keyring metadata.
      
      Now the kernel gives an error:
      
      	request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      911b79cd