1. 26 Jun, 2014 6 commits
    • Takashi Iwai's avatar
      ALSA: hda - Move more PCI-controller-specific stuff from generic code · 9a34af4a
      Takashi Iwai authored
      Just move struct fields between struct azx and struct hda_intel, and
      move some definitions from hda_priv.h to hda_intel.c.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      9a34af4a
    • Takashi Iwai's avatar
      ALSA: hda - Make position_fix as generic callback · b6050ef6
      Takashi Iwai authored
      ... and move most parts into hda_intel.c from the generic controller
      code.  This is a clean up, and there should be no functional change by
      this patch.
      
      Now, struct azx obtains the generic callbacks for getting the position
      and the delay.  As default NULL, posbuf is read.  These replace the
      old position_fix[], and each is implemented as a callback.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      b6050ef6
    • Takashi Iwai's avatar
      ALSA: hda - Remove superfluous MAX_AZX_DEV · 085ec0d9
      Takashi Iwai authored
      MAX_AZX_DEV is no longer referred anywhere, let's kill it.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      085ec0d9
    • Takashi Iwai's avatar
      Merge branch 'for-linus' into for-next · 7e9c2eb6
      Takashi Iwai authored
      7e9c2eb6
    • Mengdong Lin's avatar
      ALSA: hda - restore BCLK M/N values when resuming HSW/BDW display controller · a07187c9
      Mengdong Lin authored
      For Intel Haswell/Broadwell display HD-A controller, the 24MHz HD-A link BCLK
      is converted from Core Display Clock (CDCLK): BCLK = CDCLK * M / N
      And there are two registers EM4 and EM5 to program M, N value respectively.
      The EM4/EM5 values will be lost and when the display power well is disabled.
      
      BIOS programs CDCLK selected by OEM and EM4/EM5, but BIOS has no idea about
      display power well on/off at runtime. So the M/N can be wrong if non-default
      CDCLK is used when the audio controller resumes, which results in an invalid
      BCLK and abnormal audio playback rate. So this patch saves and restores valid
      M/N values on controller suspend/resume.
      
      And 'struct hda_intel' is defined to contain standard HD-A 'struct azx' and
      Intel specific fields, as Takashi suggested.
      Signed-off-by: default avatarMengdong Lin <mengdong.lin@intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      a07187c9
    • Takashi Iwai's avatar
      ALSA: usb-audio: Fix races at disconnection and PCM closing · 92a586bd
      Takashi Iwai authored
      When a USB-audio device is disconnected while PCM is still running, we
      still see some race: the disconnect callback calls
      snd_usb_endpoint_free() that calls release_urbs() and then kfree()
      while a PCM stream would be closed at the same time and calls
      stop_endpoints() that leads to wait_clear_urbs().  That is, the EP
      object might be deallocated while a PCM stream is syncing with
      wait_clear_urbs() with the same EP.
      
      Basically calling multiple wait_clear_urbs() would work fine, also
      calling wait_clear_urbs() and release_urbs() would work, too, as
      wait_clear_urbs() just reads some fields in ep.  The problem is the
      succeeding kfree() in snd_pcm_endpoint_free().
      
      This patch moves out the EP deallocation into the later point, the
      destructor callback.  At this stage, all PCMs must have been already
      closed, so it's safe to free the objects.
      Reported-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      92a586bd
  2. 25 Jun, 2014 6 commits
  3. 24 Jun, 2014 4 commits
  4. 23 Jun, 2014 6 commits
  5. 18 Jun, 2014 7 commits
    • Takashi Iwai's avatar
      8d42fda9
    • Takashi Iwai's avatar
      Merge tag 'asoc-v3.16-rc1' of... · 6c0c9a3d
      Takashi Iwai authored
      Merge tag 'asoc-v3.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v3.16
      
      Quite a few build coverage fixes in here among the usual small driver
      fixes includling the sigmadsp change from Lars - moving the driver to
      separate modules per bus (which is basically just code motion) avoids
      issues with some combinations of buses being enabled.
      6c0c9a3d
    • Lars-Peter Clausen's avatar
      ALSA: control: Make sure that id->index does not overflow · 883a1d49
      Lars-Peter Clausen authored
      The ALSA control code expects that the range of assigned indices to a control is
      continuous and does not overflow. Currently there are no checks to enforce this.
      If a control with a overflowing index range is created that control becomes
      effectively inaccessible and unremovable since snd_ctl_find_id() will not be
      able to find it. This patch adds a check that makes sure that controls with a
      overflowing index range can not be created.
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarJaroslav Kysela <perex@perex.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      883a1d49
    • Lars-Peter Clausen's avatar
      ALSA: control: Handle numid overflow · ac902c11
      Lars-Peter Clausen authored
      Each control gets automatically assigned its numids when the control is created.
      The allocation is done by incrementing the numid by the amount of allocated
      numids per allocation. This means that excessive creation and destruction of
      controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
      eventually overflow. Currently when this happens for the control that caused the
      overflow kctl->id.numid + kctl->count will also over flow causing it to be
      smaller than kctl->id.numid. Most of the code assumes that this is something
      that can not happen, so we need to make sure that it won't happen
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarJaroslav Kysela <perex@perex.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      ac902c11
    • Lars-Peter Clausen's avatar
      ALSA: control: Don't access controls outside of protected regions · fd9f26e4
      Lars-Peter Clausen authored
      A control that is visible on the card->controls list can be freed at any time.
      This means we must not access any of its memory while not holding the
      controls_rw_lock. Otherwise we risk a use after free access.
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarJaroslav Kysela <perex@perex.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      fd9f26e4
    • Lars-Peter Clausen's avatar
      ALSA: control: Fix replacing user controls · 82262a46
      Lars-Peter Clausen authored
      There are two issues with the current implementation for replacing user
      controls. The first is that the code does not check if the control is actually a
      user control and neither does it check if the control is owned by the process
      that tries to remove it. That allows userspace applications to remove arbitrary
      controls, which can cause a user after free if a for example a driver does not
      expect a control to be removed from under its feed.
      
      The second issue is that on one hand when a control is replaced the
      user_ctl_count limit is not checked and on the other hand the user_ctl_count is
      increased (even though the number of user controls does not change). This allows
      userspace, once the user_ctl_count limit as been reached, to repeatedly replace
      a control until user_ctl_count overflows. Once that happens new controls can be
      added effectively bypassing the user_ctl_count limit.
      
      Both issues can be fixed by instead of open-coding the removal of the control
      that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
      proper permission checks as well as decrements user_ctl_count after the control
      has been removed.
      
      Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
      beginning of the function if the control already exists is removed. This is not
      a problem though since the check is quite useless, because the lock that is
      protecting the control list is released between the check and before adding the
      new control to the list, which means that it is possible that a different
      control with the same settings is added to the list after the check. Luckily
      there is another check that is done while holding the lock in snd_ctl_add(), so
      we'll rely on that to make sure that the same control is not added twice.
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarJaroslav Kysela <perex@perex.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      82262a46
    • Lars-Peter Clausen's avatar
      ALSA: control: Protect user controls against concurrent access · 07f4d9d7
      Lars-Peter Clausen authored
      The user-control put and get handlers as well as the tlv do not protect against
      concurrent access from multiple threads. Since the state of the control is not
      updated atomically it is possible that either two write operations or a write
      and a read operation race against each other. Both can lead to arbitrary memory
      disclosure. This patch introduces a new lock that protects user-controls from
      concurrent access. Since applications typically access controls sequentially
      than in parallel a single lock per card should be fine.
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Acked-by: default avatarJaroslav Kysela <perex@perex.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      07f4d9d7
  6. 16 Jun, 2014 8 commits
    • Mark Brown's avatar
      Merge remote-tracking branches 'asoc/fix/fsl-dma', 'asoc/fix/fsl-spdif',... · 28e48f0e
      Mark Brown authored
      Merge remote-tracking branches 'asoc/fix/fsl-dma', 'asoc/fix/fsl-spdif', 'asoc/fix/pxa', 'asoc/fix/rcar' and 'asoc/fix/sigmadsp' into asoc-linus
      28e48f0e
    • Mark Brown's avatar
    • Joe Perches's avatar
      ALSA: Use dma_zalloc_coherent · 7f0f2048
      Joe Perches authored
      Use the zeroing function instead of dma_alloc_coherent & memset(,0,)
      Signed-off-by: default avatarJoe Perches <joe@perches.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      7f0f2048
    • Takashi Iwai's avatar
      drm/i915, HD-audio: Don't continue probing when nomodeset is given · 74b0c2d7
      Takashi Iwai authored
      When a machine is booted with nomodeset option, i915 driver skips the
      whole initialization.  Meanwhile, HD-audio tries to bind wth i915 just
      by request_symbol() without knowing that the initialization was
      skipped, and eventually it hits WARN_ON() in i915_request_power_well()
      and i915_release_power_well() wrongly but still continues probing,
      even though it doesn't work at all.
      
      In this patch, both functions are changed to return an error in case
      of uninitialized state instead of WARN_ON(), so that HD-audio driver
      can give up HDMI controller initialization at the right time.
      Acked-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Cc: <stable@vger.kernel.org> [3.15]
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      74b0c2d7
    • Linus Torvalds's avatar
      Linux 3.16-rc1 · 7171511e
      Linus Torvalds authored
      7171511e
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a9be2242
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix checksumming regressions, from Tom Herbert.
      
       2) Undo unintentional permissions changes for SCTP rto_alpha and
          rto_beta sysfs knobs, from Denial Borkmann.
      
       3) VXLAN, like other IP tunnels, should advertize it's encapsulation
          size using dev->needed_headroom instead of dev->hard_header_len.
          From Cong Wang.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        net: sctp: fix permissions for rto_alpha and rto_beta knobs
        vxlan: Checksum fixes
        net: add skb_pop_rcv_encapsulation
        udp: call __skb_checksum_complete when doing full checksum
        net: Fix save software checksum complete
        net: Fix GSO constants to match NETIF flags
        udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup
        vxlan: use dev->needed_headroom instead of dev->hard_header_len
        MAINTAINERS: update cxgb4 maintainer
      a9be2242
    • Linus Torvalds's avatar
      Merge tag 'clk-for-linus-3.16-part2' of git://git.linaro.org/people/mike.turquette/linux · dd1845af
      Linus Torvalds authored
      Pull more clock framework updates from Mike Turquette:
       "This contains the second half the of the clk changes for 3.16.
      
        They are simply fixes and code refactoring for the OMAP clock drivers.
        The sunxi clock driver changes include splitting out the one
        mega-driver into several smaller pieces and adding support for the A31
        SoC clocks"
      
      * tag 'clk-for-linus-3.16-part2' of git://git.linaro.org/people/mike.turquette/linux: (25 commits)
        clk: sunxi: document PRCM clock compatible strings
        clk: sunxi: add PRCM (Power/Reset/Clock Management) clks support
        clk: sun6i: Protect SDRAM gating bit
        clk: sun6i: Protect CPU clock
        clk: sunxi: Rework clock protection code
        clk: sunxi: Move the GMAC clock to a file of its own
        clk: sunxi: Move the 24M oscillator to a file of its own
        clk: sunxi: Remove calls to clk_put
        clk: sunxi: document new A31 USB clock compatible
        clk: sunxi: Implement A31 USB clock
        ARM: dts: OMAP5/DRA7: use omap5-mpu-dpll-clock capable of dealing with higher frequencies
        CLK: TI: dpll: support OMAP5 MPU DPLL that need special handling for higher frequencies
        ARM: OMAP5+: dpll: support Duty Cycle Correction(DCC)
        CLK: TI: clk-54xx: Set the rate for dpll_abe_m2x2_ck
        CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)
        dt:/bindings: DRA7 ATL (Audio Tracking Logic) clock bindings
        ARM: dts: dra7xx-clocks: Correct name for atl clkin3 clock
        CLK: TI: gate: add composite interface clock to OMAP2 only build
        ARM: OMAP2: clock: add DT boot support for cpufreq_ck
        CLK: TI: OMAP2: add clock init support
        ...
      dd1845af
    • Linus Torvalds's avatar
      Merge git://git.infradead.org/users/willy/linux-nvme · b55b3902
      Linus Torvalds authored
      Pull NVMe update from Matthew Wilcox:
       "Mostly bugfixes again for the NVMe driver.  I'd like to call out the
        exported tracepoint in the block layer; I believe Keith has cleared
        this with Jens.
      
        We've had a few reports from people who're really pounding on NVMe
        devices at scale, hence the timeout changes (and new module
        parameters), hotplug cpu deadlock, tracepoints, and minor performance
        tweaks"
      
      [ Jens hadn't seen that tracepoint thing, but is ok with it - it will
        end up going away when mq conversion happens ]
      
      * git://git.infradead.org/users/willy/linux-nvme: (22 commits)
        NVMe: Fix START_STOP_UNIT Scsi->NVMe translation.
        NVMe: Use Log Page constants in SCSI emulation
        NVMe: Define Log Page constants
        NVMe: Fix hot cpu notification dead lock
        NVMe: Rename io_timeout to nvme_io_timeout
        NVMe: Use last bytes of f/w rev SCSI Inquiry
        NVMe: Adhere to request queue block accounting enable/disable
        NVMe: Fix nvme get/put queue semantics
        NVMe: Delete NVME_GET_FEAT_TEMP_THRESH
        NVMe: Make admin timeout a module parameter
        NVMe: Make iod bio timeout a parameter
        NVMe: Prevent possible NULL pointer dereference
        NVMe: Fix the buffer size passed in GetLogPage(CDW10.NUMD)
        NVMe: Update data structures for NVMe 1.2
        NVMe: Enable BUILD_BUG_ON checks
        NVMe: Update namespace and controller identify structures to the 1.1a spec
        NVMe: Flush with data support
        NVMe: Configure support for block flush
        NVMe: Add tracepoints
        NVMe: Protect against badly formatted CQEs
        ...
      b55b3902
  7. 15 Jun, 2014 3 commits
    • Daniel Borkmann's avatar
      net: sctp: fix permissions for rto_alpha and rto_beta knobs · b58537a1
      Daniel Borkmann authored
      Commit 3fd091e7 ("[SCTP]: Remove multiple levels of msecs
      to jiffies conversions.") has silently changed permissions for
      rto_alpha and rto_beta knobs from 0644 to 0444. The purpose of
      this was to discourage users from tweaking rto_alpha and
      rto_beta knobs in production environments since they are key
      to correctly compute rtt/srtt.
      
      RFC4960 under section 6.3.1. RTO Calculation says regarding
      rto_alpha and rto_beta under rule C3 and C4:
      
        [...]
        C3)  When a new RTT measurement R' is made, set
      
             RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
      
             and
      
             SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
      
             Note: The value of SRTT used in the update to RTTVAR
             is its value before updating SRTT itself using the
             second assignment. After the computation, update
             RTO <- SRTT + 4 * RTTVAR.
      
        C4)  When data is in flight and when allowed by rule C5
             below, a new RTT measurement MUST be made each round
             trip. Furthermore, new RTT measurements SHOULD be
             made no more than once per round trip for a given
             destination transport address. There are two reasons
             for this recommendation: First, it appears that
             measuring more frequently often does not in practice
             yield any significant benefit [ALLMAN99]; second,
             if measurements are made more often, then the values
             of RTO.Alpha and RTO.Beta in rule C3 above should be
             adjusted so that SRTT and RTTVAR still adjust to
             changes at roughly the same rate (in terms of how many
             round trips it takes them to reflect new values) as
             they would if making only one measurement per
             round-trip and using RTO.Alpha and RTO.Beta as given
             in rule C3. However, the exact nature of these
             adjustments remains a research issue.
        [...]
      
      While it is discouraged to adjust rto_alpha and rto_beta
      and not further specified how to adjust them, the RFC also
      doesn't explicitly forbid it, but rather gives a RECOMMENDED
      default value (rto_alpha=3, rto_beta=2). We have a couple
      of users relying on the old permissions before they got
      changed. That said, if someone really has the urge to adjust
      them, we could allow it with a warning in the log.
      
      Fixes: 3fd091e7 ("[SCTP]: Remove multiple levels of msecs to jiffies conversions.")
      Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Cc: Vlad Yasevich <vyasevich@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b58537a1
    • David S. Miller's avatar
      Merge branch 'csum_fixes' · e4f7ae93
      David S. Miller authored
      Tom Herbert says:
      
      ====================
      Fixes related to some recent checksum modifications.
      
      - Fix GSO constants to match NETIF flags
      - Fix logic in saving checksum complete in __skb_checksum_complete
      - Call __skb_checksum_complete from UDP if we are checksumming over
        whole packet in order to save checksum.
      - Fixes to VXLAN to work correctly with checksum complete
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e4f7ae93
    • Tom Herbert's avatar
      vxlan: Checksum fixes · f79b064c
      Tom Herbert authored
      Call skb_pop_rcv_encapsulation and postpull_rcsum for the Ethernet
      header to work properly with checksum complete.
      Signed-off-by: default avatarTom Herbert <therbert@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f79b064c