I previously added an integer overflow check here but looking at it now,
it's still buggy.
The bug happens in snd_compr_allocate_buffer(). We multiply
".fragments" and ".fragment_size" and that doesn't overflow but then we
save it in an unsigned int so it truncates the high bits away and we
allocate a smaller than expected size.
Fixes: b35cc82258 ('ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Since init_failed flag was moved to struct hda_intel, its access in
the commit [4da63c6f: ALSA: hda - Fix broken PM due to incomplete
i915 initialization] is also replaced with hda->init_failed
appropriately.
When the initialization of Intel HDMI controller fails due to missing
i915 kernel symbols (e.g. HD-audio is built in while i915 is module),
the driver discontinues the probe. However, since the probe was done
asynchronously, the driver object still remains, thus the relevant PM
ops are still called at suspend/resume. This results in the bad access
to the incomplete audio card object, eventually leads to Oops or stall
at PM.
This patch adds the missing checks of chip->init_failed flag at each
PM callback in order to fix the problem above.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79561
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
We got a regression report for 3.15.x kernels, and this turned out to
be triggered by the fix for stream assignment order. On reporter's
machine with Intel controller (8086:1e20) + VIA VT1802 codec, the
first playback slot can't work with speaker outputs.
But the original commit was actually a fix for AMD controllers where
no proper GCAP value is returned, we shouldn't revert the whole
commit. Instead, in this patch, a new flag is introduced to determine
the stream assignment order, and follow the old behavior for Intel
controllers.
Fixes: dcb32ecd9a ('ALSA: hda - Do not assign streams in reverse order')
Reported-and-tested-by: Steven Newbury <steve@snewbury.org.uk>
Cc: <stable@vger.kernel.org> [v3.15+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
For allowing adjusting the timestamp type on the fly, add it to
sw_params. The existing ioctl is still kept for compatibility.
Along with this, increment the PCM protocol version.
The extension was suggested by Clemens Ladisch.
Acked-by: Jaroslav Kysela <perex@perex.cz>
Reviewed-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
For applications which need to synchronise with external timebases such
as broadcast TV applications the kernel monotonic time is not optimal as
it includes adjustments from NTP and so may still include discontinuities
due to that. A raw monotonic time which does not include any adjustments
is available in the kernel from getrawmonotonic() so provide userspace with
a new timestamp type SNDRV_PCM_TSTAMP_TYPE_MONOTONIC_RAW which provides
timestamps based on this as an option.
[dropped tstamp_type assignment code, as it's no longer needed -- tiwai]
Reported-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
Acked-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Vendor ID 0x10de0070 is used by a yet-to-be-named GPU chip.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The hda_tegra_disable_clocks() function is only used by the suspend and
resume code, so it needs to be included in the #ifdef CONFIG_PM_SLEEP
block to prevent the following warning:
CC sound/pci/hda/hda_tegra.o
sound/pci/hda/hda_tegra.c:238:13: warning: 'hda_tegra_disable_clocks' defined but not used [-Wunused-function]
static void hda_tegra_disable_clocks(struct hda_tegra *data)
^
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
print_nid_path has a possible buffer overflow if
struct nid_path.path values are > 256.
Avoid this and neaten the output to remove the leading ':'
Neaten debug_badness to always verify arguments.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Pull devicetree bugfix from Grant Likely:
"Important bug fix for parsing 64-bit addresses on 32-bit platforms.
Without this patch the kernel will try to use memory ranges that
cannot be reached"
* tag 'dt-for-linus' of git://git.secretlab.ca/git/linux:
of: Check for phys_addr_t overflows in early_init_dt_add_memory_arch
Pull SCSI fixes from James Bottomley:
"This is a set of 13 fixes, a MAINTAINERS update and a sparse update.
The fixes are mostly correct value initialisations, avoiding NULL
derefs and some uninitialised pointer avoidance.
All the patches have been incubated in -next for a few days. The
final patch (use the scsi data buffer length to extract transfer size)
has been rebased to add a cc to stable, but only the commit message
has changed"
* tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] use the scsi data buffer length to extract transfer size
virtio-scsi: fix various bad behavior on aborted requests
virtio-scsi: avoid cancelling uninitialized work items
ibmvscsi: Add memory barriers for send / receive
ibmvscsi: Abort init sequence during error recovery
qla2xxx: Fix sparse warning in qla_target.c.
bnx2fc: Improve stats update mechanism
bnx2fc: do not scan uninitialized lists in case of error.
fc: ensure scan_work isn't active when freeing fc_rport
pm8001: Fix potential null pointer dereference and memory leak.
MAINTAINERS: Update LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI) maintainers Email IDs
be2iscsi: remove potential junk pointer free
be2iscsi: add an missing goto in error path
scsi_error: set DID_TIME_OUT correctly
scsi_error: fix invalid setting of host byte
Pull drm fixes from Dave Airlie:
"i915, tda998x and vmwgfx fixes,
The main one is i915 fix for missing VGA connectors, along with some
fixes for the tda998x from Russell fixing some modesetting problems.
(still on holidays, but got a spare moment to find these)"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/vmwgfx: Fix incorrect write to read-only register v2:
drm/i915: Drop early VLV WA to fix Voltage not getting dropped to Vmin
drm/i915: only apply crt_present check on VLV
drm/i915: Wait for vblank after enabling the primary plane on BDW
drm/i2c: tda998x: add some basic mode validation
drm/i2c: tda998x: faster polling for edid
drm/i2c: tda998x: move drm_i2c_encoder_destroy call
Pull ARM SoC fixes from Olof Johansson:
"This week's arm-soc fixes:
- A set of of OMAP patches that we had missed Tony's pull request of:
* Reset fix for am43xx
* Proper OPP table for omap5
* Fix for SoC detection of one of the DRA7 SoCs
* hwmod updates to get SATA and OCP to work on omap5 (drivers
merged in 3.16)
* ... plus a handful of smaller fixes
- sunxi needed to re-add machine specific restart code that was
removed in anticipation of a watchdog driver being merged for 3.16,
and it didn't make it in.
- Marvell fixes for PCIe on SMP and a big-endian fix.
- A trivial defconfig update to make my capri test board boot with
bcm_defconfig again.
... and a couple of MAINTAINERS updates, one to claim new Keystone
drivers that have been merged, and one to merge MXS and i.MX (both
Freescale platforms).
The largest diffs come from the hwmod code for omap5 and the re-add of
the restart code on sunxi. The hwmod stuff is quite late at this
point but it slipped through cracks repeatedly while coming up the
maintainer chain and only affects the one SoC so risk is low"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
MAINTAINERS: Add few more Keystone drivers
MAINTAINERS: merge MXS entry into IMX one
ARM: sunxi: Reintroduce the restart code for A10/A20 SoCs
ARM: mvebu: fix cpuidle implementation to work on big-endian systems
ARM: mvebu: update L2/PCIe deadlock workaround after L2CC cleanup
ARM: mvebu: move Armada 375 external abort logic as a quirk
ARM: bcm: Fix bcm and multi_v7 defconfigs
ARM: dts: dra7-evm: remove interrupt binding
ARM: OMAP2+: Fix parser-bug in platform muxing code
ARM: DTS: dra7/dra7xx-clocks: ATL related changes
ARM: OMAP2+: drop unused function
ARM: dts: am43x-epos-evm: Add Missing cpsw-phy-sel for am43x-epos-evm
ARM: dts: omap5: Update CPU OPP table as per final production Manual
ARM: DRA722: add detection of SoC information
ARM: dts: Enable twl4030 off-idle configuration for selected omaps
ARM: OMAP5: hwmod: Add ocp2scp3 and sata hwmods
ARM: OMAP2+: hwmod: Change hardreset soc_ops for AM43XX
Pull irq fixes from Thomas Gleixner:
"A few minor fixlets in ARM SoC irq drivers and a fix for a memory leak
which I introduced in the last round of cleanups :("
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
genirq: Fix memory leak when calling irq_free_hwirqs()
irqchip: spear_shirq: Fix interrupt offset
irqchip: brcmstb-l2: Level-2 interrupts are edge sensitive
irqchip: armada-370-xp: Mask all interrupts during initialization.
Fixes for 3.16-rc3; most importantly Jesse brings back VGA he took away
on a bunch of machines. Also a vblank fix for BDW and a power workaround
fix for VLV.
* tag 'drm-intel-fixes-2014-07-03' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Drop early VLV WA to fix Voltage not getting dropped to Vmin
drm/i915: only apply crt_present check on VLV
drm/i915: Wait for vblank after enabling the primary plane on BDW
The mach-mxs platform is actually co-maintained by myself and
pengutronix folks. Also it's hosted in the same kernel tree as IMX.
So let's merge the entry into IMX one.
Signed-off-by: Shawn Guo <shawn.guo@freescale.com>
Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
mvebu fixes for v3.16 (round #2)
- mvebu
- Fix PCIe deadlock now that SMP is enabled
- Fix cpuidle for big-endian systems
* tag 'mvebu-fixes-3.16-2' of git://git.infradead.org/linux-mvebu:
ARM: mvebu: fix cpuidle implementation to work on big-endian systems
ARM: mvebu: update L2/PCIe deadlock workaround after L2CC cleanup
ARM: mvebu: move Armada 375 external abort logic as a quirk
Signed-off-by: Olof Johansson <olof@lixom.net>
This partly reverts commits 553600502b (ARM: sunxi: Remove reset code from
the platform) and 5e669ec583 (ARM: sunxi: Remove init_machine callback) for
the sun4i, sun5i and sun7i families.
This is needed because the watchdog counterpart of these commits was dropped,
and didn't make it into 3.16. In order to still be able to reboot the board, we
need to reintroduce that code. Of course, the long term view is still to get
rid of that code in mach-sunxi.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Merge OMAP fixes from Tony Lindgren:
Fixes for omaps for issues discovered during the merge window and
enabling of a few features that had to wait for the driver
dependencies to clear.
The fixes included are:
- Fix am43xx hard reset flags
- Fix SoC detection for DRA722
- Fix CPU OPP table for omap5
- Fix legacy mux parser bug if requested muxname is a prefix of
multiple mux entries
- Fix qspi interrupt binding that relies on the irq crossbar
that has not yet been enabled
- Add missing phy_sel for am43x-epos-evm
- Drop unused gic_init_irq() that is no longer needed
And the enabling of features that had driver dependencies are:
- Change dra7 to use Audio Tracking Logic clock instead of a fixed
clock now that the clock driver for it has been merged
- Enable off idle configuration for selected omaps as all the kernel
dependencies for device tree based booting are finally merged as
this is needed to get the automated PM tests working finally with
device tree based booting
- Add hwmod entry for ocp2scp3 for omap5 to get sata working as
all the driver dependencies are now in the kernel and this patch
fell through the cracks during the merge window
* tag 'omap-for-v3.16/fixes-against-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: dts: dra7-evm: remove interrupt binding
ARM: OMAP2+: Fix parser-bug in platform muxing code
ARM: DTS: dra7/dra7xx-clocks: ATL related changes
ARM: OMAP2+: drop unused function
ARM: dts: am43x-epos-evm: Add Missing cpsw-phy-sel for am43x-epos-evm
ARM: dts: omap5: Update CPU OPP table as per final production Manual
ARM: DRA722: add detection of SoC information
ARM: dts: Enable twl4030 off-idle configuration for selected omaps
ARM: OMAP5: hwmod: Add ocp2scp3 and sata hwmods
ARM: OMAP2+: hwmod: Change hardreset soc_ops for AM43XX
Pull md bugfixes from Neil Brown:
"Two minor bugfixes for md in 3.16"
* tag 'md/3.16-fixes' of git://neil.brown.name/md:
md: flush writes before starting a recovery.
md: make sure GET_ARRAY_INFO ioctl reports correct "clean" status
Pull sound fixes from Takashi Iwai:
"This contains a few fixes for HD-audio: yet another Dell headset pin
quirk, a fixup for Thinkpad T540P, and an improved fix for
Haswell/Broadwell HDMI clock setup"
* tag 'sound-3.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda - restore BCLK M/N value as per CDCLK for HSW/BDW display HDA controller
drm/i915: provide interface for audio driver to query cdclk
ALSA: hda - Add a fixup for Thinkpad T540p
ALSA: hda - Add another headset pin quirk for some Dell machines
Pull btrfs fixes from Chris Mason:
"We've queued up a few fixes in my for-linus branch"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: fix crash when starting transaction
Btrfs: fix btrfs_print_leaf for skinny metadata
Btrfs: fix race of using total_bytes_pinned
btrfs: use E2BIG instead of EIO if compression does not help
btrfs: remove stale comment from btrfs_flush_all_pending_stuffs
Btrfs: fix use-after-free when cloning a trailing file hole
btrfs: fix null pointer dereference in btrfs_show_devname when name is null
btrfs: fix null pointer dereference in clone_fs_devices when name is null
btrfs: fix nossd and ssd_spread mount option regression
Btrfs: fix race between balance recovery and root deletion
Btrfs: atomically set inode->i_flags in btrfs_update_iflags
btrfs: only unlock block in verify_parent_transid if we locked it
Btrfs: assert send doesn't attempt to start transactions
btrfs compression: reuse recently used workspace
Btrfs: fix crash when mounting raid5 btrfs with missing disks
btrfs: create sprout should rename fsid on the sysfs as well
btrfs: dev replace should replace the sysfs entry
btrfs: dev add should add its sysfs entry
btrfs: dev delete should remove sysfs entry
btrfs: rename add_device_membership to btrfs_kobj_add_device
The CurrentEL system register reports the Current Exception Level
of the CPU. It doesn't say anything about the stack handling, and
yet we compare it to PSR_MODE_EL2t and PSR_MODE_EL2h.
It works by chance because PSR_MODE_EL2t happens to match the right
bits, but that's otherwise a very bad idea. Just check for the EL
value instead.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
[catalin.marinas@arm.com: fixed arch/arm64/kernel/efi-entry.S]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The __sync_icache_dcache routine will only flush the dcache for the
first page of a compound page, potentially leading to stale icache
data residing further on in a hugetlb page.
This patch addresses this issue by taking into consideration the
order of the page when flushing the dcache.
Reported-by: Mark Brown <broonie@linaro.org>
Tested-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Steve Capper <steve.capper@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org> # v3.11+
The define ARM64_64K_PAGES is tested for rather than
CONFIG_ARM64_64K_PAGES. Correct that typo here.
Signed-off-by: Steve Capper <steve.capper@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
This small patch completes #defines for Control/Status Register,
adds comments for the missing ones there and on the Interrupt Mask
Register and additionally corrects "#define ICE1712_SERR_LEVEL 0x04 -> 0x08",
according to documentation.
Signed-off-by: Konstantinos Tsimpoukas <kostaslinuxxx@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
For HSW/BDW display HD-A controller, hda_set_bclk() is defined to set BCLK
by programming the M/N values as per the core display clock (CDCLK) queried from
i915 display driver.
And the audio driver will also set BCLK in azx_first_init() since the display
driver can turn off the shared power in boot phase if only eDP is connected
and M/N values will be lost and must be reprogrammed.
Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
For Haswell and Broadwell, if the display power well has been disabled,
the display audio controller divider values EM4 M VALUE and EM5 N VALUE
will have been lost. The CDCLK frequency is required for reprogramming them
to generate 24MHz HD-A link BCLK. So provide a private interface for the
audio driver to query CDCLK.
This is a stopgap solution until a more generic interface between audio
and display drivers has been implemented.
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Damien Lespiau <damien.lespiau@intel.com>
Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Pull USB bugfixes from Greg KH:
"Here's a round of USB bugfixes, quirk additions, and new device ids
for 3.16-rc4. Nothing major in here at all, just a bunch of tiny
changes. All have been in linux-next with no reported issues"
* tag 'usb-3.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (33 commits)
usb: chipidea: udc: delete td from req's td list at ep_dequeue
usb: Kconfig: make EHCI_MSM selectable for QCOM SOCs
usb-storage/SCSI: Add broken_fua blacklist flag
usb: musb: dsps: fix the base address for accessing the mode register
tools: ffs-test: fix header values endianess
usb: phy: msm: Do not do runtime pm if the phy is not idle
usb: musb: Ensure that cppi41 timer gets armed on premature DMA TX irq
usb: gadget: gr_udc: Fix check for invalid number of microframes
usb: musb: Fix panic upon musb_am335x module removal
usb: gadget: f_fs: resurect usb_functionfs_descs_head structure
Revert "tools: ffs-test: convert to new descriptor format fixing compilation error"
xhci: Fix runtime suspended xhci from blocking system suspend.
xhci: clear root port wake on bits if controller isn't wake-up capable
xhci: correct burst count field for isoc transfers on 1.0 xhci hosts
xhci: Use correct SLOT ID when handling a reset device command
MAINTAINERS: update e-mail address
usb: option: add/modify Olivetti Olicard modems
USB: ftdi_sio: fix null deref at port probe
MAINTAINERS: drop two usb-serial subdriver entries
USB: option: add device ID for SpeedUp SU9800 usb 3g modem
...
Pull staging driver bugfixes from Greg KH:
"Nothing major here, just 4 small bugfixes that resolve some issues
reported for the IIO (staging and non-staging) and the tidspbridge
driver"
* tag 'staging-3.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: tidspbridge: fix an erroneous removal of parentheses
iio: of_iio_channel_get_by_name() returns non-null pointers for error legs
staging: iio/ad7291: fix error code in ad7291_probe()
iio:adc:ad799x: Fix reading and writing of event values, apply shift
Pull driver core fixes from Greg KH:
"Well, one drivercore fix for kernfs to resolve a reported issue with
sysfs files being updated from atomic contexts, and another lz4 bugfix
for testing potential buffer overflows"
* tag 'driver-core-3.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
lz4: add overrun checks to lz4_uncompress_unknownoutputsize()
kernfs: kernfs_notify() must be useable from non-sleepable contexts
Pull tracing fixes from Steven Rostedt:
"Oleg Nesterov found and fixed a bug in the perf/ftrace/uprobes code
where running:
# perf probe -x /lib/libc.so.6 syscall
# echo 1 >> /sys/kernel/debug/tracing/events/probe_libc/enable
# perf record -e probe_libc:syscall whatever
kills the uprobe. Along the way he found some other minor bugs and
clean ups that he fixed up making it a total of 4 patches.
Doing unrelated work, I found that the reading of the ftrace trace
file disables all function tracer callbacks. This was fine when
ftrace was the only user, but now that it's used by perf and kprobes,
this is a bug where reading trace can disable kprobes and perf. A
very unexpected side effect and should be fixed"
* tag 'trace-fixes-v3.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
tracing: Remove ftrace_stop/start() from reading the trace file
tracing/uprobes: Fix the usage of uprobe_buffer_enable() in probe_event_enable()
tracing/uprobes: Kill the bogus UPROBE_HANDLER_REMOVE code in uprobe_dispatcher()
uprobes: Change unregister/apply to WARN() if uprobe/consumer is gone
tracing/uprobes: Revert "Support mix of ftrace and perf"
Pull kbuild fix from Michal Marek:
"There is one more fix for the relative paths series from -rc1: Print
the path to the build directory at the start of the build, so that
editors and IDEs can match the relative paths to source files"
* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
kbuild: Print the name of the build directory
Pull nfsd bugfixes from Bruce Fields:
"By coincidence, two NFSv4 symlink bugs, one introduced in the 3.16 xdr
encoding rewrite, the other a decoding bug that I think we've had
since the start but that just doesn't trigger very often"
* 'for-3.16' of git://linux-nfs.org/~bfields/linux:
nfs: fix nfs4d readlink truncated packet
nfsd: fix rare symlink decoding bug
The 'sysret' fastpath does not correctly restore even all regular
registers, much less any segment registers or reflags values. That is
very much part of why it's faster than 'iret'.
Normally that isn't a problem, because the normal ptrace() interface
catches the process using the signal handler infrastructure, which
always returns with an iret.
However, some paths can get caught using ptrace_event() instead of the
signal path, and for those we need to make sure that we aren't going to
return to user space using 'sysret'. Otherwise the modifications that
may have been done to the register set by the tracer wouldn't
necessarily take effect.
Fix it by forcing IRET path by setting TIF_NOTIFY_RESUME from
arch_ptrace_stop_needed() which is invoked from ptrace_stop().
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
