* remotes/origin/tmp-7e76ead:
Linux 4.14.34
net/mlx4_core: Fix memory leak while delete slave's resources
vhost_net: add missing lock nesting notation
team: move dev_mc_sync after master_upper_dev_link in team_port_add
route: check sysctl_fib_multipath_use_neigh earlier than hash
vhost: validate log when IOTLB is enabled
net/mlx5e: Fix traffic being dropped on VF representor
net/mlx4_en: Fix mixed PFC and Global pause user control requests
strparser: Fix sign of err codes
net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
net/sched: fix NULL dereference in the error path of tunnel_key_init()
net/mlx5e: Sync netdev vxlan ports at open
net/mlx5e: Don't override vport admin link state in switchdev mode
ipv6: sr: fix seg6 encap performances with TSO enabled
nfp: use full 40 bits of the NSP buffer address
net/mlx5e: Fix memory usage issues in offloading TC flows
net/mlx5e: Avoid using the ipv6 stub in the TC offload neigh update path
vti6: better validate user provided tunnel names
ip6_tunnel: better validate user provided tunnel names
ip6_gre: better validate user provided tunnel names
ipv6: sit: better validate user provided tunnel names
ip_tunnel: better validate user provided tunnel names
net: fool proof dev_valid_name()
bonding: process the err returned by dev_set_allmulti properly in bond_enslave
bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
bonding: fix the err path for dev hwaddr sync in bond_enslave
vrf: Fix use after free and double free in vrf_finish_output
vlan: also check phy_driver ts_info for vlan's real device
vhost: correctly remove wait queue during poll failure
sky2: Increase D3 delay to sky2 stops working after suspend
sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
sctp: do not leak kernel memory to user space
r8169: fix setting driver_data after register_netdev
pptp: remove a buggy dst release in pptp_connect()
net/sched: fix NULL dereference in the error path of tcf_bpf_init()
net sched actions: fix dumping which requires several messages to user space
netlink: make sure nladdr has correct size in netlink_connect()
net/ipv6: Increment OUTxxx counters after netfilter hook
net/ipv6: Fix route leaking between VRFs
net: fix possible out-of-bound read in skb_network_protocol()
lan78xx: Crash in lan78xx_writ_reg (Workqueue: events lan78xx_deferred_multicast_write)
ipv6: the entire IPv6 header chain must fit the first fragment
arp: fix arp_filter on l3slave devices
x86/microcode: Fix CPU synchronization routine
x86/microcode: Attempt late loading only when new microcode is present
x86/microcode: Synchronize late microcode loading
x86/microcode: Request microcode on the BSP
x86/microcode/intel: Look into the patch cache first
x86/microcode: Do not upload microcode if CPUs are offline
x86/microcode/intel: Writeback and invalidate caches before updating microcode
x86/microcode/intel: Check microcode revision before updating sibling threads
x86/microcode: Get rid of struct apply_microcode_ctx
x86/CPU: Check CPU feature bits after microcode upgrade
x86/CPU: Add a microcode loader callback
x86/microcode: Propagate return value from updating functions
crypto: arm64/aes-ce-cipher - move assembler code to .S file
objtool: Add Clang support
thermal: int3400_thermal: fix error handling in int3400_thermal_probe()
tcmu: release blocks for partially setup cmds
perf tools: Fix copyfile_offset update of output offset
crypto: aes-generic - build with -Os on gcc-7+
mtd: mtd_oobtest: Handle bitflips during reads
Input: goodix - disable IRQs while suspended
ibmvnic: Don't handle RX interrupts when not up.
sdhci: Advertise 2.0v supply on SDIO host controller
x86/gart: Exclude GART aperture from vmcore
gpio: thunderx: fix error return code in thunderx_gpio_probe()
RDMA/cma: Fix rdma_cm path querying for RoCE
scsi: megaraid_sas: unload flag should be set after scsi_remove_host is called
scsi: megaraid_sas: Error handling for invalid ldcount provided by firmware in RAID map
cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
i40evf: don't rely on netif_running() outside rtnl_lock()
uio_hv_generic: check that host supports monitor page
EDAC, mv64x60: Fix an error handling path
block, bfq: put async queues for root bfq groups too
tty: n_gsm: Allow ADM response in addition to UA for control dlci
blk-mq: fix kernel oops in blk_mq_tag_idle()
scsi: libsas: initialize sas_phy status according to response of DISCOVER
scsi: libsas: fix error when getting phy events
scsi: libsas: fix memory leak in sas_smp_get_phy_events()
bcache: segregate flash only volume write streams
bcache: stop writeback thread after detaching
bcache: ret IOERR when read meets metadata error
net: hns3: fix for changing MTU
net: hns3: Fix an error macro definition of HNS3_TQP_STAT
net: hns3: Fix a loop index error of tqp statistics query
net: hns3: Fix an error of total drop packet statistics
net/mlx5: Fix race for multiple RoCE enable
wl1251: check return from call to wl1251_acx_arp_ip_filter
rt2x00: do not pause queue unconditionally on error path
power: supply: axp288_charger: Properly stop work on probe-error / remove
ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
staging: lustre: disable preempt while sampling processor id.
perf report: Fix a no annotate browser displayed issue
tpm: return a TPM_RC_COMMAND_CODE response if command is not implemented
nvme_fcloop: fix abort race condition
nvme_fcloop: disassocate local port structs
pinctrl: baytrail: Enable glitch filter for GPIOs used as interrupts
backlight: tdo24m: Fix the SPI CS between transfers
blk-mq: fix race between updating nr_hw_queues and switching io sched
blk-mq: avoid to map CPU into stale hw queue
IB/rdmavt: Allocate CQ memory on the correct node
powernv-cpufreq: Add helper to extract pstate from PMSR
gpio: label descriptors using the device name
vfb: fix video mode and line_length being set when loaded
mac80211: Fix setting TX power on monitor interfaces
ACPI: EC: Fix debugfs_create_*() usage
irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
scsi: libiscsi: Allow sd_shutdown on bad transport
spi: sh-msiof: Fix timeout failures for TX-only DMA transfers
ASoC: Intel: cht_bsw_rt5645: Analog Mic support
ASoC: Intel: Skylake: Disable clock gating during firmware and library download
media: videobuf2-core: don't go out of the buffer range
clk: sunxi-ng: a83t: Add M divider to TCON1 clock
hwmon: (ina2xx) Make calibration register value fixed
RDMA/cma: Mark end of CMA ID messages
selftests/net: fix bugs in address and port initialization
PM / devfreq: Fix potential NULL pointer dereference in governor_store
clk: divider: fix incorrect usage of container_of
watchdog: dw_wdt: add stop watchdog operation
VFS: close race between getcwd() and d_move()
net/mlx4_en: Change default QoS settings
ACPI / video: Default lcd_only to true on Win8-ready and newer machines
rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
l2tp: fix missing print session offset info
net: hns3: fix for getting auto-negotiation state in hclge_get_autoneg
net: hns3: free the ring_data structrue when change tqps
perf evsel: Enable ignore_missing_thread for pid option
perf probe: Add warning message if there is unexpected event name
perf probe: Find versioned symbols from map
thermal: power_allocator: fix one race condition issue for thermal_instances list
ipv6: Reinject IPv6 packets if IPsec policy matches after SNAT
Bluetooth: Add a new 04ca:3015 QCA_ROME device
ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
clk: meson: mpll: use 64-bit maths in params_from_rate
i40iw: Validate correct IRD/ORD connection parameters
i40iw: Correct Q1/XF object count equation
i40iw: Fix sequence number for the first partial FPDU
Revert "ANDROID: sched/tune: Initialize raw_spin_lock in boosted_groups"
Conflicts:
arch/arm64/crypto/Makefile
drivers/clk/qcom/clk-regmap-divider.c
Change-Id: I7d83113e6d6d943804051a983d73067184b9fb39
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
* remotes/origin/tmp-27e69ad:
Linux 4.14.33
Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
Revert "cpufreq: Fix governor module removal race"
Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin"
Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin"
Fix slab name "biovec-(1<<(21-12))"
net: hns: Fix ethtool private flags
ARM: dts: DRA76-EVM: Set powerhold property for tps65917
vt: change SGR 21 to follow the standards
Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
Revert "base: arch_topology: fix section mismatch build warnings"
staging: comedi: ni_mio_common: ack ai fifo error interrupts.
Btrfs: fix unexpected cow in run_delalloc_nocow
crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
crypto: arm,arm64 - Fix random regeneration of S_shipped
crypto: ccp - return an actual key size from RSA max_size callback
crypto: caam - Fix null dereference at error path
crypto: ahash - Fix early termination in hash walk
crypto: testmgr - Fix incorrect values in PKCS#1 test vector
crypto: inside-secure - fix clock management
crypto: lrw - Free rctx->ext with kzfree
parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
media: usbtv: prevent double free in error case
/dev/mem: Avoid overwriting "err" in read_mem()
mei: remove dev_err message on an unsupported ioctl
serial: 8250: Add Nuvoton NPCM UART
USB: serial: cp210x: add ELDAT Easywave RX09 id
USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
USB: serial: ftdi_sio: add RT Systems VX-8 cable
bitmap: fix memset optimization on big-endian systems
usb: dwc2: Improve gadget state disconnection handling
Bluetooth: Fix missing encryption refresh on Security Request
phy: qcom-ufs: add MODULE_LICENSE tag
netfilter: x_tables: add and use xt_check_proc_name
netfilter: drop template ct when conntrack is skipped.
l2tp: fix races with ipv4-mapped ipv6 addresses
netfilter: bridge: ebt_among: add more missing match size checks
netfilter: x_tables: make allocation less aggressive
percpu: add __GFP_NORETRY semantics to the percpu balancing path
xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
RDMA/ucma: Introduce safer rdma_addr_size() variants
RDMA/ucma: Check that device exists prior to accessing it
RDMA/ucma: Check that device is connected prior to access it
RDMA/rdma_cm: Fix use after free race with process_one_req
RDMA/ucma: Ensure that CM_ID exists prior to access it
RDMA/ucma: Fix use-after-free access in ucma_close
RDMA/ucma: Check AF family prior resolving address
xfrm_user: uncoditionally validate esn replay attribute struct
partitions/msdos: Unable to mount UFS 44bsd partitions
powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs
powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened
i2c: i2c-stm32f7: fix no check on returned setup
ipc/shm.c: add split function to shm_vm_ops
ceph: only dirty ITER_IOVEC pages for direct read
perf/hwbp: Simplify the perf-hwbp code, fix documentation
x86/platform/uv/BAU: Add APIC idt entry
ALSA: pcm: potential uninitialized return values
ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
ALSA: usb-audio: Add native DSD support for TEAC UD-301
mtd: nand: atmel: Fix get_sectorsize() function
mtd: jedec_probe: Fix crash in jedec_read_mfr()
ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[]
ARM: OMAP: Fix SRAM W+X mapping
ANDROID: fuse: Add null terminator to path in canonical path to avoid issue
ANDROID: sdcardfs: Fix sdcardfs to stop creating cases-sensitive duplicate entries.
Conflicts:
drivers/phy/qualcomm/phy-qcom-ufs.c
Change-Id: Iab5cb23d596cebf19e0eb63a71828507dfb47054
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
[ Upstream commit eaadb1caa966a91128297b754e90b7c92b350a00 ]
In some error handling paths, an error code is assiegned to 'ret'.
However, the function always return 0.
Fix it and return the error code if such an error paths is taken.
Fixes: 3d9ff34622ba ("ASoC: Intel: sst: add stream operations")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit b70b309950418437bbd2a30afd169c4f09dee3e5 ]
Various Cherry Trail boards with a rt5645 codec have an analog mic
connected to IN2P + IN2N. The mic on this boards also needs micbias to
be enabled, on some boards micbias1 is used and on others micbias2, so
we enable both.
This commit adds a new "Int Analog Mic" DAPM widget for this, so that we
do not end up enabling micbias on boards with a digital mic which uses
the already present "Int Mic" widget. Some existing UCM files already
refer to "Int Mic" for their "Internal Analog Microphones" SectionDevice,
but these don't work anyways since they enable the RECMIX BST1 Switch
instead of the BST2 switch.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit d5cc0a1fcbb5ddbef9fdd4c4a978da3254ddbf37 ]
During firmware and library download, sometimes it is observed that
firmware and library download is timed-out resulting into probe failure.
This patch disables dynamic clock gating while firmware and library
download.
Signed-off-by: Pardha Saradhi K <pardha.saradhi.kesapragada@intel.com>
Signed-off-by: Sanyog Kale <sanyog.r.kale@intel.com>
Signed-off-by: Guneshwor Singh <guneshwor.o.singh@intel.com>
Acked-By: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Client's sockaddress related params are not cached but pointer to
sockaddress is cached on receiving request from client. Client's
sockaddress pointer is valid only when request related callback
is called from QMI framework. Due to invalid sockaddress param
USB headset disconnect notification to client is failing. There is
unhandle page fault seen when client is sending more request when
USB headset is already disconnected. Hence fix this issue by storing
sockaddress related params within driver, and use it while sending
unsolicited message to client using qmi_send_indication() i.e. USB
headset disconnect notification.
Change-Id: I569f6aaba9063f3153276bdd4e436644b056cef0
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Add debug message to find the platform name during failure
scenario.
Change-Id: I7ce5beff6f93e642db765dcb3066b30ed6e7e843
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Signed-off-by: Xiaoyu Ye <benyxy@codeaurora.org>
Signed-off-by: Meng Wang <mwang@codeaurora.org>
commit 5607dddbfca774fb38bffadcb077fe03aa4ac5c6 upstream.
Smatch complains that "tmp" can be uninitialized if we do a zero size
write.
Fixes: 02a5d6925cd3 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9066ae7ff5d89c0b5daa271e2d573540097a94fa upstream.
When trying to use the driver (e.g. aplay *.wav), the 4MiB DMA buffer
will get mmapp'ed in 16KiB chunks. But this fails with the 2nd 16KiB
area, as the page offset is outside of the VMA range (size), which is
currently used as size parameter in snd_pcm_lib_default_mmap(). By
using the DMA buffer size (dma_bytes) instead, the complete DMA buffer
can be mmapp'ed and the issue is fixed.
This issue was detected on an ARM platform (TI AM57xx) using the RME
HDSP MADI PCIe soundcard.
Fixes: 657b1989dacf ("ALSA: pcm - Use dma_mmap_coherent() if available")
Signed-off-by: Stefan Roese <sr@denx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When SMMU stage 1 is enabled, sg table entry may return different
page size entries for a xfer buffer. Calling uaudio_get_iova()
for each table entry may result into non-contiguous iova address
mapped for one xfer buffer. This results into page fault when
remote entity tries to access unmapped iova hole. Fix this issue
by calling uaudio_get_iova() first to get contiguous iova and then
map entire iova region by going over sg table entry. Also replace
print format %pa to %pK.
Change-Id: I7c74f25e6b76cf994717ca069948ac08631b5cd7
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
* remotes/origin/tmp-331d833:
Linux 4.14.31
bpf, x64: increase number of passes
bpf: skip unnecessary capability check
kbuild: disable clang's default use of -fmerge-all-constants
x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
usb: xhci: Fix potential memory leak in xhci_disable_slot()
usb: xhci: Disable slot even when virt-dev is null
staging: lustre: ptlrpc: kfree used instead of kvfree
staging: android: ion: Zero CMA allocated memory
iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()
iio: ABI: Fix name of timestamp sysfs file
perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
perf/core: Fix ctx_event_type in ctx_resched()
perf stat: Fix CVS output format for non-supported counters
perf/x86/intel/uncore: Fix Skylake UPI event format
drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
x86/boot/64: Verify alignment of the LOAD segment
x86/build/64: Force the linker to use 2MB page size
kvm/x86: fix icebp instruction handling
posix-timers: Protect posix clock array access against speculation
x86/efi: Free efi_pgd with free_pages()
x86/vsyscall/64: Use proper accessor to update P4D entry
selftests/x86/ptrace_syscall: Fix for yet more glibc interference
x86/entry/64: Don't use IST entry for #BP stack
tty: vt: fix up tabstops properly
can: cc770: Fix use after free in cc770_tx_interrupt()
can: cc770: Fix queue stall & dropped RTR reply
can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
can: ifi: Check core revision upon probe
can: ifi: Repair the error handling
can: peak/pcie_fd: remove useless code when interface starts
can: peak/pcie_fd: fix echo_skb is occupied! bug
staging: ncpfs: memory corruption in ncp_read_kernel()
mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
mtd: nand: fsl_ifc: Fix nand waitfunc return value
mtdchar: fix usage of mtd_ooblayout_ecc()
tracing: probeevent: Fix to support minus offset from symbol
rtlwifi: rtl8723be: Fix loss of signal
brcmfmac: fix P2P_DEVICE ethernet address generation
libnvdimm, {btt, blk}: do integrity setup before add_disk()
ACPI / watchdog: Fix off-by-one error at resource assignment
acpi, numa: fix pxm to online numa node associations
mm/vmscan: wake up flushers for legacy cgroups too
drm: udl: Properly check framebuffer mmap offsets
drm: Reject getfb for multi-plane framebuffers
drm/radeon: Don't turn off DP sink when disconnected
drm/vmwgfx: Fix a destoy-while-held mutex problem.
drm/vmwgfx: Fix black screen and device errors when running without fbdev
Revert "mm: page_alloc: skip over regions of invalid pfns where possible"
mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
mm/thp: do not wait for lock_page() in deferred_split_scan()
mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
x86/mm: implement free pmd/pte page interfaces
mm/vmalloc: add interfaces to free unmapped page table
h8300: remove extraneous __BIG_ENDIAN definition
hugetlbfs: check for pgoff value overflow
nfsd: remove blocked locks on client teardown
cgroup: fix rule checking for threaded mode switching
libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
libata: Enable queued TRIM for Samsung SSD 860
libata: disable LPM for Crucial BX100 SSD 500GB drive
libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
libata: don't try to pass through NCQ commands to non-NCQ devices
libata: remove WARN() for DMA or PIO command without data
libata: fix length validation of ATAPI-relayed SCSI commands
Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
Bluetooth: btusb: Add Dell OptiPlex 3060 to btusb_needs_reset_resume_table
Bluetooth: btusb: Remove Yoga 920 from the btusb_needs_reset_resume_table
pinctrl: samsung: Validate alias coming from DT
Drivers: hv: vmbus: Fix ring buffer signaling
RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory
clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
clk: bcm2835: Protect sections updating shared registers
clk: bcm2835: Fix ana->maskX definitions
lockdep: fix fs_reclaim warning
ahci: Add PCI-id for the Highpoint Rocketraid 644L card
PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
mmc: block: fix updating ext_csd caches on ioctl call
mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
mmc: core: Fix tracepoint print of blk_addr and blksz
ALSA: hda/realtek - Always immediately update mute LED with pin VREF
ALSA: hda/realtek - Fix Dell headset Mic can't record
ALSA: hda/realtek - Fix speaker no sound after system resume
ALSA: hda - Force polling mode on CFL for fixing codec communication
ALSA: aloop: Fix access to not-yet-ready substream via cable
ALSA: aloop: Sync stale timer before release
ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock()
iio: st_pressure: st_accel: pass correct platform data to init
iio: chemical: ccs811: Corrected firmware boot/application mode transition
MIPS: lantiq: ase: Enable MFD_SYSCON
MIPS: lantiq: Enable AHB Bus for USB
MIPS: lantiq: Fix Danube USB clock
MIPS: ralink: Fix booting on MT7621
MIPS: ralink: Remove ralink_halt()
ANDROID: arm64: Image.gz-dtb build target depends on Image.gz
Conflicts:
drivers/staging/android/ion/ion_cma_heap.c
Change-Id: I1ed32b5d3bcf4db15991859bdd89fed0d70fdb86
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
commit e40bdb03d3cd7da66bd0bc1e40cbcfb49351265c upstream.
Some HP laptops have a mute mute LED controlled by a pin VREF. The
Realtek codec driver updates the VREF via vmaster hook by calling
snd_hda_set_pin_ctl_cache().
This works fine as long as the driver is running in a normal mode.
However, when the VREF change happens during the codec being in
runtime PM suspend, the regmap access will skip and postpone the
actual register change. This ends up with the unchanged LED status
until the next runtime PM resume even if you change the Master mute
switch. (Interestingly, the machine keeps the LED status even after
the codec goes into D3 -- but it's another story.)
For improving this usability, let the driver temporarily powering up /
down only during the pin VREF change. This can be achieved easily by
wrapping the call with snd_hda_power_up_pm() / *_down_pm().
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199073
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f0ba9d699e5ca2bcd07f70185d18720c4f1b597c upstream.
This platform was hardware fixed type for CTIA type for headset port.
Assigned 0x19 verb will fix can't record issue.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 88d42b2b45d7208cc872c2c9dec0b1ae6c6008d7 upstream.
It will have a chance speaker no sound after system resume.
To toggle NID 0x53 index 0x2 bit 15 will solve this issue.
This usage will also suitable with ALC256.
Fixes: 4a219ef8f370 ("ALSA: hda/realtek - Add ALC256 HP depop function")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a8d7bde23e7130686b76624b099f3e22dd38aef7 upstream.
We've observed too long probe time with Coffee Lake (CFL) machines,
and the likely cause is some communication problem between the
HD-audio controller and the codec chips. While the controller expects
an IRQ wakeup for each codec response, it seems sometimes missing, and
it takes one second for the controller driver to time out and read the
response in the polling mode.
Although we aren't sure about the real culprit yet, in this patch, we
put a workaround by forcing the polling mode as default for CFL
machines; the polling mode itself isn't too heavy, and much better
than other workarounds initially suggested (e.g. disabling
power-save), at least.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199007
Fixes: e79b0006c45c ("ALSA: hda - Add Coffelake PCI ID")
Reported-and-tested-by: Hui Wang <hui.wang@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e upstream.
In loopback_open() and loopback_close(), we assign and release the
substream object to the corresponding cable in a racy way. It's
neither locked nor done in the right position. The open callback
assigns the substream before its preparation finishes, hence the other
side of the cable may pick it up, which may lead to the invalid memory
access.
This patch addresses these: move the assignment to the end of the open
callback, and wrap with cable->lock for avoiding concurrent accesses.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 67a01afaf3d34893cf7d2ea19b34555d6abb7cb0 upstream.
The aloop driver tries to stop the pending timer via timer_del() in
the trigger callback and in the close callback. The former is
correct, as it's an atomic operation, while the latter expects that
the timer gets really removed and proceeds the resource releases after
that. But timer_del() doesn't synchronize, hence the running timer
may still access the released resources.
A similar situation can be also seen in the prepare callback after
trigger(STOP) where the prepare tries to re-initialize the things
while a timer is still running.
The problems like the above are seen indirectly in some syzkaller
reports (although it's not 100% clear whether this is the only cause,
as the race condition is quite narrow and not always easy to
trigger).
For addressing these issues, this patch adds the explicit alls of
timer_del_sync() in some places, so that the pending timer is properly
killed / synced.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* refs/heads/tmp-45c8dbe
Linux 4.14.29
usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure
scsi: qla2xxx: Fix logo flag for qlt_free_session_done()
scsi: qla2xxx: Fix NULL pointer access for fcport structure
scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que
btrfs: Fix memory barriers usage with device stats counters
btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes
btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
btrfs: alloc_chunk: fix DUP stripe size handling
btrfs: add missing initialization in btrfs_check_shared
btrfs: Fix NULL pointer exception in find_bio_stripe
irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
RDMAVT: Fix synchronization around percpu_ref
fs/aio: Use RCU accessors for kioctx_table->table[]
fs/aio: Add explicit RCU grace period when freeing kioctx
lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid
kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3
KVM: arm/arm64: Reduce verbosity of KVM init log
fs: Teach path_connected to handle nfs filesystems with multiple roots.
drm/amdgpu/dce: Don't turn off DP sink when disconnected
drm/radeon: fix prime teardown order
drm/amdgpu: fix prime teardown order
drm/nouveau/bl: Fix oops on driver unbind
ALSA: seq: Clear client entry before deleting else at closing
ALSA: seq: Fix possible UAF in snd_seq_check_queue()
ALSA: hda - Revert power_save option default value
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
parisc: Handle case where flush_cache_range is called with no context
x86/mm: Fix vmalloc_fault to use pXd_large
KVM: x86: Fix device passthrough when SME is active
x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
x86/vm86/32: Fix POPF emulation
selftests/x86/entry_from_vm86: Add test cases for POPF
selftests/x86: Add tests for the STR and SLDT instructions
selftests/x86: Add tests for User-Mode Instruction Prevention
selftests/x86/entry_from_vm86: Exit with 1 if we fail
x86/cpufeatures: Add Intel PCONFIG cpufeature
x86/cpufeatures: Add Intel Total Memory Encryption cpufeature
ANDROID: arm-smccc: fix clang build
staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
Linux 4.14.28
drm/i915/glk: Disable Guc and HuC on GLK
dmaengine: qcom_hidma: check pending interrupts
IB/mlx5: revisit -Wmaybe-uninitialized warning
ima: relax requiring a file signature for new files with zero length
locking/locktorture: Fix num reader/writer corner cases
rcutorture/configinit: Fix build directory error message
ipvlan: add L2 check for packets arriving via virtual devices
Fix misannotated out-of-line _copy_to_user()
mmc: mmc_test: Ensure command queue is disabled for testing
ASoC: nuc900: Fix a loop timeout test
crypto: caam/qi - use correct print specifier for size_t
mac80211: remove BUG() when interface type is invalid
mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
agp/intel: Flush all chipset writes after updating the GGTT
arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context
powerpc/modules: Don't try to restore r2 after a sibling call
drm/amdkfd: Fix memory leaks in kfd topology
veth: set peer GSO values
net: sched: drop qdisc_reset from dev_graft_qdisc
virtio_net: Disable interrupts if napi_complete_done rescheduled napi
media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
media: cpia2: Fix a couple off by one bugs
dm raid: fix raid set size revalidation
media: vsp1: Prevent suspending and resuming DRM pipelines
scsi: dh: add new rdac devices
scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
scsi: core: scsi_get_device_flags_keyed(): Always return device flags
bnxt_en: Don't print "Link speed -1 no longer supported" messages.
spi: sun6i: disable/unprepare clocks on remove
tools/usbip: fixes build with musl libc toolchain
ath10k: fix invalid STS_CAP_OFFSET_MASK
mwifiex: cfg80211: do not change virtual interface during scan processing
clk: qcom: msm8916: fix mnd_width for codec_digcodec
drm/amdgpu:fix virtual dce bug
iwlwifi: mvm: avoid dumping assert log when device is stopped
perf annotate: Fix objdump comment parsing for Intel mov dissassembly
perf annotate: Fix unnecessary memory allocation for s390x
pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D
pinctrl: sh-pfc: r8a7791: Add can_clk function
drm/sun4i: Fix format mask in DE2 driver
pwm: stmpe: Fix wrong register offset for hwpwm=2 case
scsi: ses: don't ask for diagnostic pages repeatedly during probe
drm/amdgpu:fix random missing of FLR NOTIFY
cpufreq: Fix governor module removal race
ath10k: update tdls teardown state to target
iio: health: max30102: Add power enable parameter to get_temp function
iio: adc: ina2xx: Shift bus voltage register to mask flag bits
drm/etnaviv: make THERMAL selectable
power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
power: supply: ab8500_charger: Fix an error handling path
leds: pm8058: Silence pointer to integer size warning
xfrm: Fix xfrm_replay_overflow_offload_esn
userns: Don't fail follow_automount based on s_user_ns
mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
net: thunderx: Set max queue count taking XDP_TX into account
mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
net: xfrm: allow clearing socket xfrm policies.
rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
net: ieee802154: adf7242: Fix bug if defined DEBUG
test_firmware: fix setting old custom fw path back on exit
crypto: cavium - fix memory leak on info
crypto: ecc - Fix NULL pointer deref. on no default_rng
sched: Stop resched_cpu() from sending IPIs to offline CPUs
sched: Stop switched_to_rt() from sending IPIs to offline CPUs
USB: ledtrig-usbport: fix of-node leak
typec: tcpm: fusb302: Resolve out of order messaging events
staging: rtl8822be: fix missing null check on dev_alloc_skb return
drm/amdgpu: fix get_max_engine_clock_in_mhz
ARM: dts: exynos: Correct Trats2 panel reset line
clk: meson: gxbb: fix wrong clock for SARADC/SANA
ARM: dts: koelsch: Move cec_clock to root node
iwlwifi: mvm: rs: don't override the rate history in the search cycle
HID: elo: clear BTN_LEFT mapping
HID: multitouch: Only look at non touch fields in first packet of a frame
video/hdmi: Allow "empty" HDMI infoframes
dma-buf/fence: Fix lock inversion within dma-fence-array
drm/edid: set ELD connector type in drm_edid_to_eld()
Revert "btrfs: use proper endianness accessors for super_copy"
dm mpath: fix passing integrity data
earlycon: add reg-offset to physical address before mapping
serial: core: mark port as initialized in autoconfig
serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
usb: dwc3: Fix lock-up on ID change during system suspend/resume
usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
usb: usbmon: Read text within supplied buffer size
usb: quirks: add control message delay for 1b1c:1b20
usbip: vudc: fix null pointer dereference on udc->lock
USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
staging: android: ashmem: Fix lockdep issue during llseek
staging: comedi: fix comedi_nsamples_left.
uas: fix comparison for error code
tty/serial: atmel: add new version check for usart
serial: sh-sci: prevent lockup on full TTY buffers
xhci: fix endpoint context tracer output
xhci: Fix front USB ports on ASUS PRIME B350M-A
usb: host: xhci-rcar: add support for r8a77965
ASoC: rt5651: Fix regcache sync errors on resume
ASoC: wm_adsp: For TLV controls only register TLV get/set
ASoC: sgtl5000: Fix suspend/resume
ASoC: sun4i-i2s: Fix RX slot number of SUN8I
x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
net: phy: Restore phy_resume() locking assumption
net: phy: fix resume handling
ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures
Change-Id: Ida88909c333e059adf42a8794c3b92b1d15252f7
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
commit a2ff19f7b70118ced291a28d5313469914de451b upstream.
When releasing a client, we need to clear the clienttab[] entry at
first, then call snd_seq_queue_client_leave(). Otherwise, the
in-flight cell in the queue might be picked up by the timer interrupt
via snd_seq_check_queue() before calling snd_seq_queue_client_leave(),
and it's delivered to another queue while the client is clearing
queues. This may eventually result in an uncleared cell remaining in
a queue, and the later snd_seq_pool_delete() may need to wait for a
long time until the event gets really processed.
By moving the clienttab[] clearance at the beginning of release, any
event delivery of a cell belonging to this client will fail at a later
point, since snd_seq_client_ptr() returns NULL. Thus the cell that
was picked up by the timer interrupt will be returned immediately
without further delivery, and the long stall of snd_seq_delete_pool()
can be avoided, too.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d0f833065221cbfcbadf19fd4102bcfa9330006a upstream.
Although we've covered the races between concurrent write() and
ioctl() in the previous patch series, there is still a possible UAF in
the following scenario:
A: user client closed B: timer irq
-> snd_seq_release() -> snd_seq_timer_interrupt()
-> snd_seq_free_client() -> snd_seq_check_queue()
-> cell = snd_seq_prioq_cell_peek()
-> snd_seq_prioq_leave()
.... removing all cells
-> snd_seq_pool_done()
.... vfree()
-> snd_seq_compare_tick_time(cell)
... Oops
So the problem is that a cell is peeked and accessed without any
protection until it's retrieved from the queue again via
snd_seq_prioq_cell_out().
This patch tries to address it, also cleans up the code by a slight
refactoring. snd_seq_prioq_cell_out() now receives an extra pointer
argument. When it's non-NULL, the function checks the event timestamp
with the given pointer. The caller needs to pass the right reference
either to snd_seq_tick or snd_seq_realtime depending on the event
timestamp type.
A good news is that the above change allows us to remove the
snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the
code size.
Reviewed-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 40088dc4e1ead7df31728c73f5b51d71da18831d upstream.
With the commit 1ba8f9d30817 ("ALSA: hda: Add a power_save
blacklist"), we changed the default value of power_save option to -1
for processing the power-save blacklist.
Unfortunately, this seems breaking user-space applications that
actually read the power_save parameter value via sysfs and judge /
adjust the power-saving status. They see the value -1 as if the
power-save is turned off, although the actual value is taken from
CONFIG_SND_HDA_POWER_SAVE_DEFAULT and it can be a positive.
So, overall, passing -1 there was no good idea. Let's partially
revert it -- at least for power_save option default value is restored
again to CONFIG_SND_HDA_POWER_SAVE_DEFAULT. Meanwhile, in this patch,
we keep the blacklist behavior and make is adjustable via the new
option, pm_blacklist.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199073
Fixes: 1ba8f9d30817 ("ALSA: hda: Add a power_save blacklist")
Acked-by: Hans de Goede <hdegoede@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 01c0b4265cc16bc1f43f475c5944c55c10d5768f upstream.
snd_pcm_oss_get_formats() has an obvious use-after-free around
snd_mask_test() calls, as spotted by syzbot. The passed format_mask
argument is a pointer to the hw_params object that is freed before the
loop. What a surprise that it has been present since the original
code of decades ago...
Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ]
We should be finishing the loop with timeout set to zero but because
this is a post-op we finish with timeout == -1.
Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2d30e9494f1ea320aaaad0cff9ddd92c87eac355 upstream.
The ALC5651 does not like multi-write accesses, avoid them. This fixes:
rt5651 i2c-10EC5651:00: Unable to sync registers 0x27-0x28. -121
Errors on resume (and all registers after the registers in the error not
being synced).
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d7789f5bcdb298c4a302db471b1b20f74a20de95 upstream.
Normal 512-byte get/set of a TLV isn't supported but we were
registering the normal get/set anyway and relying on omitting
the SNDRV_CTL_ELEM_ACCESS_[READ|WRITE] flags to prevent them
being called.
Trouble is if this gets broken in the core ALSA code - as it has
been since at least 4.14 - the standard get/set can be called
unexpectedly and corrupt memory.
There's no point providing functions that won't be called and
it's a trivial change. The benefit is that if the ALSA core gets
broken again we get a big fat immediate NULL dereference instead
of a memory corruption timebomb.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a8992973edbb2555e956b90f6fe97c4bc14d761d upstream.
Commit 8419caa72702 ("ASoC: sgtl5000: Do not disable regulators in
SND_SOC_BIAS_OFF") causes the sgtl5000 to fail after a suspend/resume
sequence:
Playing WAVE '/media/a2002011001-e02.wav' : Signed 16 bit Little
Endian, Rate 44100 Hz, Stereo
aplay: pcm_write:2051: write error: Input/output error
The problem is caused by the fact that the aforementioned commit
dropped the cache handling, so re-introduce the register map
resync to fix the problem.
Suggested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5a3386790a172cf738194e1574f631cd43c6140a upstream.
I2S's RX slot number of SUN8I should be shifted 4 bit to left.
Fixes: 7d2993811a1e ("ASoC: sun4i-i2s: Add support for H3")
Signed-off-by: Yong Deng <yong.deng@magewell.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Audio device supporting burst mode exposes alt settings with
different service intervals. In order to find the requested
format as well as service interval remote entity provides
service interval parameter. Data interval (bInterval - 1) is
calculated using service interval and used to find the matching
alt setting using find_format_and_si().
Change-Id: Ie15c78ab53eb5258085b54bf13459ebef44a44a4
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
* remotes/origin/tmp-df0daba:
Linux 4.14.27
x86/kprobes: Fix kernel crash when probing .entry_trampoline code
objtool: Fix 32-bit build
objtool: Fix another switch table detection issue
objtool, retpolines: Integrate objtool with retpoline support more closely
objtool: Add module specific retpoline rules
kbuild: move cc-option and cc-disable-warning after incl. arch Makefile
kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
kbuild: re-order the code to not parse unnecessary variables
objtool: Add retpoline validation
objtool: Use existing global variables for options
x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
x86/paravirt, objtool: Annotate indirect calls
x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
x86/speculation, objtool: Annotate indirect calls/jumps for objtool
x86/retpoline: Support retpoline builds with Clang
x86/speculation: Use IBRS if available before calling into firmware
Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
x86-64/realmode: Add instruction suffix
x86/LDT: Avoid warning in 32-bit builds with older gcc
x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
x86/mm: Remove stale comment about KMEMCHECK
x86/entry/64: Use 'xorl' for faster register clearing
x86/entry: Reduce the code footprint of the 'idtentry' macro
nospec: Include <asm/barrier.h> dependency
nospec: Kill array_index_nospec_mask_check()
MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
dt-bindings: Document mti,mips-cpc binding
scsi: qla2xxx: Fix recursion while sending terminate exchange
scsi: qla2xxx: Fix NULL pointer crash due to probe failure
ALSA: hda: add dock and led support for HP ProBook 640 G2
ALSA: hda: add dock and led support for HP EliteBook 820 G3
ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
ALSA: seq: More protection for concurrent write and ioctl races
ALSA: seq: Don't allow resizing pool in use
ALSA: hda/realtek - Make dock sound work on ThinkPad L570
ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
ALSA: hda/realtek: Limit mic boost on T480
ALSA: hda/realtek - Add headset mode support for Dell laptop
ALSA: hda/realtek - Add support headset mode for DELL WYSE
x86/spectre_v2: Don't check microcode versions when running under hypervisors
perf tools: Fix trigger class trigger_on()
x86/MCE: Serialize sysfs changes
x86/MCE: Save microcode revision in machine check records
bcache: don't attach backing with duplicate UUID
bcache: fix crashes in duplicate cache device register
IB/mlx5: Fix incorrect size of klms in the memory region
dm bufio: avoid false-positive Wmaybe-uninitialized warning
kbuild: Handle builtin dtb file names containing hyphens
IB/core: Fix missing RDMA cgroups release in case of failure to register device
arm64: mm: fix thinko in non-global page table attribute check
KVM: s390: fix memory overwrites when not using SCA entries
virtio_ring: fix num_free handling in error case
loop: Fix lost writes caused by missing flag
Documentation/sphinx: Fix Directive import error
mm/memblock.c: hardcode the end_pfn being -1
lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
Input: matrix_keypad - fix race when disabling interrupts
PCI: dwc: Fix enumeration end when reaching root subordinate
MIPS: OCTEON: irq: Check for null return on kzalloc allocation
MIPS: ath25: Check for kzalloc allocation failure
MIPS: BMIPS: Do not mask IPIs during suspend
drm/amdgpu:Always save uvd vcpu_bo in VM Mode
drm/amdgpu:Correct max uvd handles
drm/amdgpu: fix KV harvesting
drm/radeon: fix KV harvesting
drm/amdgpu: Notify sbios device ready before send request
drm/amdgpu: used cached pcie gen info for SI (v2)
drm/amd/powerplay: fix power over limit on Fiji
drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
drm/amd/powerplay/vega10: allow mclk switching with no displays
drm/amd/powerplay/smu7: allow mclk switching with no displays
drm/nouveau: prefer XBGR2101010 for addfb ioctl
drm/amdgpu: Fix deadlock on runtime suspend
drm/radeon: Fix deadlock on runtime suspend
drm/nouveau: Fix deadlock on runtime suspend
drm: Allow determining if current task is output poll worker
workqueue: Allow retrieval of current task's work struct
drm/i915: Always call to intel_display_set_init_power() in resume_early.
scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
drm/i915/perf: fix perf stream opening lock
drm/i915: Try EDID bitbanging on HDMI after failed read
drm/i915: Update watermark state correctly in sanitize_watermarks
drm/i915: Disable DC states around GMBUS on GLK
drm/i915: Clear the in-use marker on execbuf failure
drm/i915: Fix rsvd2 mask when out-fence is returned
regulator: stm32-vrefbuf: fix check on ready flag
net/smc: fix NULL pointer dereference on sock_create_kern() error path
IB/uverbs: Improve lockdep_check
RDMA/mlx5: Fix integer overflow while resizing CQ
RDMA/ucma: Check that user doesn't overflow QP state
RDMA/ucma: Limit possible option size
NFS: Fix unstable write completion
pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
NFS: Fix an incorrect type in struct nfs_direct_req
scsi: qla2xxx: Fix memory leak in dual/target mode
scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
scsi: qla2xxx: Defer processing of GS IOCB calls
scsi: qla2xxx: Clear loop id after delete
scsi: qla2xxx: Fix scan state field for fcport
scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
scsi: qla2xxx: Fix abort command deadlock due to spinlock
scsi: qla2xxx: Fix PRLI state check
scsi: qla2xxx: Fix Relogin being triggered too fast
scsi: qla2xxx: Fix NPIV host cleanup in target mode
scsi: qla2xxx: Fix login state machine stuck at GPDB
scsi: qla2xxx: Serialize GPNID for multiple RSCN
scsi: qla2xxx: Retry switch command on time out
scsi: qla2xxx: Fix re-login for Nport Handle in use
scsi: qla2xxx: Skip IRQ affinity for Target QPairs
scsi: qla2xxx: Move session delete to driver work queue
scsi: qla2xxx: Fix gpnid error processing
scsi: qla2xxx: Fix system crash for Notify ack timeout handling
tpm: only attempt to disable the LPC CLKRUN if is already enabled
tpm: remove unused variables
tpm: delete the TPM_TIS_CLK_ENABLE flag
tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
tpm_tis: Move ilb_base_addr to tpm_tis_data
netfilter: use skb_to_full_sk in ip6_route_me_harder
netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
netfilter: bridge: ebt_among: add missing match size checks
netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
netfilter: IDLETIMER: be syzkaller friendly
netfilter: nat: cope with negative port range
netfilter: x_tables: fix missing timer initialization in xt_LED
netfilter: xt_hashlimit: fix lock imbalance
netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
netfilter: add back stackpointer size checks
ASoC: Intel: kbl: fix jack name
ASoC: Intel: Skylake: Fix jack name format substitution
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
watchdog: hpwdt: Remove legacy NMI sourcing.
watchdog: hpwdt: fix unused variable warning
watchdog: hpwdt: Check source of NMI
watchdog: hpwdt: SMBIOS check
kbuild: move "_all" target out of $(KBUILD_SRC) conditional
FROMLIST: f2fs: don't put dentry page in pagecache into highmem
Conflicts:
Makefile
Change-Id: I9c0acaa8aea9f4986bf01898de8d4be4658c64ce
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Commit 1efd15d0bb99 ("sound: usb: Adopt new QMI framework related
changes") used wrong structure size while allocating memory
causing random memory corruption. Fix this issue by using correct
structure size.
Change-Id: I07019ad176f4cb6c5b5bcadce3e4df1a3f09219e
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
commit 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 upstream.
This patch adds missing initialisation for HP 2013 UltraSlim Dock
Line-In/Out PINs and activates keyboard mute/micmute leds
for HP ProBook 640 G2
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aea808172018ca01abf53db808323aed23281835 upstream.
This patch adds missing initialisation for HP 2013 UltraSlim Dock
Line-In/Out PINs and activates keyboard mute/micmute leds
for HP EliteBook 820 G3
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream.
With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign
ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than
ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested
by Kailang of Realtek and is verified on the machine.
Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines")
Cc: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 upstream.
This patch is an attempt for further hardening against races between
the concurrent write and ioctls. The previous fix d15d662e89fc
("ALSA: seq: Fix racy pool initializations") covered the race of the
pool initialization at writer and the pool resize ioctl by the
client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex
should be applied more widely to the whole write operation for
avoiding the unexpected pool operations by another thread.
The only change outside snd_seq_write() is the additional mutex
argument to helper functions, so that we can unlock / relock the given
mutex temporarily during schedule() call for blocking write.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Reviewed-and-tested-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d85739367c6d56e475c281945c68fdb05ca74b4c upstream.
This is a fix for a (sort of) fallout in the recent commit
d15d662e89fc ("ALSA: seq: Fix racy pool initializations") for
CVE-2018-1000004.
As the pool resize deletes the existing cells, it may lead to a race
when another thread is writing concurrently, eventually resulting a
UAF.
A simple workaround is not to allow the pool resizing when the pool is
in use. It's an invalid behavior in anyway.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a upstream.
One version of Lenovo Thinkpad T570 did not use ALC298
(like other Kaby Lake devices). Instead it uses ALC292.
In order to make the Lenovo dock working with that codec
the dock quirk for ALC292 will be used.
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e312a869cd726c698a75caca0d9e5c22fd3f1534 upstream.
The dock line-out pin (NID 0x17 of ALC3254 codec) on Dell Precision
7520 may route to three different DACs, 0x02, 0x03 and 0x06. The
first two DACS have the volume amp controls while the last one
doesn't. And unfortunately, the auto-parser assigns this pin to DAC3,
resulting in the non-working volume control for the line out.
Fix it by disabling the routing to DAC3 on the corresponding pin.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199029
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 upstream.
The internal mic boost on the T480 is too high. Fix this by applying the
ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
Signed-off-by: Benjamin Berg <bberg@redhat.com>
Tested-by: Benjamin Berg <bberg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ae104a21e52b1f9aab342cf6924405177b720069 upstream.
This platform was only one phone Jack.
Add dummy lineout verb to fix automute mode disable.
This just the workaround.
[ More background information:
since the platform has only a headphone jack without speaker, the
driver doesn't create the auto-mute control. Meanwhile we do update
the headset mode via the automute hook in the driver, thus with this
setup, the headset won't be updated any longer.
By adding a dummy line-out pin here, the auto-mute is added by the
driver, and the headset update is triggered properly.
Note that this is different from the other
ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, which has the real line-out pin,
while this quirk adds a dummy line-out pin. -- tiwai ]
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit cedb6415f9ece6d3368aa0ac8a433caff799792a upstream.
Commit d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format
substitution") added Jack name but erroneously added a space as well,
so remove the space in Jack name.
Fixes: d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format substitution")
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d1c4cb447a7efcb5608a33cdfed8ab4234378b0a upstream.
Jack name is not getting formatted correctly hence resulting
in invalid name for HDMI/DP input devices.
This was recently exposed due changes brought by MST:
commit 3a13347f05fd ("ASoC: Intel: kbl: Add jack port initialize
in kbl machine drivers")
Signed-off-by: Chintan Patel <chintan.m.patel@intel.com>
Acked-By: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Driver currently restrict upper bound check for bInterval
to 4 which corresponds to 1 ms. Fix the bInterval range
check as per the USB spec for ISOC endpoint.
Change-Id: I580e1fdfab0eeb1231642b920239691e7af67727
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
* remotes/origin/tmp-4576e0e:
Linux 4.14.26
KVM: x86: fix backward migration with async_PF
bpf, ppc64: fix out of bounds access in tail call
bpf: allow xadd only on aligned memory
bpf: add schedule points in percpu arrays management
bpf, arm64: fix out of bounds access in tail call
bpf, x64: implement retpoline for tail call
bpf: fix rcu lockdep warning for lpm_trie map_free callback
bpf: fix memory leak in lpm_trie map_free callback function
bpf: fix mlock precharge on arraymaps
Linux 4.14.25
nvme-rdma: don't suppress send completions
md: only allow remove_and_add_spares when no sync_thread running.
ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
ACPI / bus: Parse tables as term_list for Dell XPS 9570 and Precision M5530
KVM/x86: remove WARN_ON() for when vm_munmap() fails
KVM/x86: Fix wrong macro references of X86_CR0_PG_BIT and X86_CR4_PAE_BIT in kvm_valid_sregs()
PCI/ASPM: Deal with missing root ports in link state handling
KVM: x86: fix vcpu initialization with userspace lapic
KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
KVM: x86: move LAPIC initialization after VMCS creation
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
KVM: mmu: Fix overlap between public and private memslots
KVM: X86: Fix SMRAM accessing even if VM is shutdown
KVM: x86: extend usage of RET_MMIO_PF_* constants
ARM: kvm: fix building with gcc-8
ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
ARM: dts: rockchip: Remove 1.8 GHz operation point from phycore som
ARM: orion: fix orion_ge00_switch_board_info initialization
x86/mm: Fix {pmd,pud}_{set,clear}_flags()
nospec: Allow index argument to have const-qualified type
KVM: s390: consider epoch index on TOD clock syncs
KVM: s390: consider epoch index on hotplugged CPUs
KVM: s390: provide only a single function for setting the tod (fix SCK)
KVM: s390: take care of clock-comparator sign control
EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL
media: m88ds3103: don't call a non-initalized function
blk-mq: don't call io sched's .requeue_request when requeueing rq to ->dispatch
s390/qeth: fix IPA command submission race
s390/qeth: fix IP address lookup for L3 devices
Revert "s390/qeth: fix using of ref counter for rxip addresses"
s390/qeth: fix double-free on IP add/remove race
s390/qeth: fix IP removal on offline cards
s390/qeth: fix overestimated count of buffer elements
s390/qeth: fix SETIP command handling
s390/qeth: fix underestimated count of buffer elements
virtio-net: disable NAPI only when enabled during XDP set
tuntap: disable preemption during XDP processing
tuntap: correctly add the missing XDP flush
tcp: purge write queue upon RST
netlink: put module reference if dump start fails
mlxsw: spectrum_router: Do not unconditionally clear route offload indication
cls_u32: fix use after free in u32_destroy_key()
amd-xgbe: Restore PCI interrupt enablement setting on resume
net/mlx5e: Verify inline header size do not exceed SKB linear size
bridge: Fix VLAN reference count problem
sctp: fix dst refcnt leak in sctp_v6_get_dst()
net: ipv4: Set addr_type in hash_keys for forwarded case
mlxsw: spectrum_router: Fix error path in mlxsw_sp_vr_create
tcp: revert F-RTO extension to detect more spurious timeouts
tcp: revert F-RTO middle-box workaround
sctp: do not pr_err for the duplicated node in transport rhlist
net/sched: cls_u32: fix cls_u32 on filter replace
net_sched: gen_estimator: fix broken estimators based on percpu stats
net/mlx5e: Fix loopback self test when GRO is off
doc: Change the min default value of tcp_wmem/tcp_rmem.
tcp_bbr: better deal with suboptimal GSO
rxrpc: Fix send in rxrpc_send_data_packet()
tcp: Honor the eor bit in tcp_mtu_probe
net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
net/mlx5e: Specify numa node when allocating drop rq
mlxsw: spectrum_switchdev: Check success of FDB add operation
sctp: fix dst refcnt leak in sctp_v4_get_dst
net/mlx5e: Fix TCP checksum in LRO buffers
udplite: fix partial checksum initialization
sctp: verify size of a new chunk in _sctp_make_chunk()
ppp: prevent unregistered channels from connecting to PPP units
net: sched: report if filter is too large to dump
netlink: ensure to loop over all netns in genlmsg_multicast_allns()
net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
net: fix race on decreasing number of TX queues
net: ethernet: ti: cpsw: fix net watchdog timeout
net: amd-xgbe: fix comparison to bitshift when dealing with a mask
ipv6 sit: work around bogus gcc-8 -Wrestrict warning
hdlc_ppp: carrier detect ok, don't turn off negotiation
fib_semantics: Don't match route with mismatching tclassid
bridge: check brport attr show in brport_show
x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table
x86/platform/intel-mid: Handle Intel Edison reboot correctly
x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
direct-io: Fix sleep in atomic due to sync AIO
dax: fix vma_is_fsdax() helper
cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
vfio: disable filesystem-dax page pinning
block: kyber: fix domain token leak during requeue
block: fix the count of PGPGOUT for WRITE_SAME
btrfs: use proper endianness accessors for super_copy
parisc: Fix ordering of cache and TLB flushes
parisc: Reduce irq overhead when run in qemu
parisc: Use cr16 interval timers unconditionally on qemu
timers: Forward timer base before migrating timers
mmc: dw_mmc: Fix out-of-bounds access for slot's caps
mmc: dw_mmc: Factor out dw_mci_init_slot_caps
mmc: dw_mmc: Avoid accessing registers in runtime suspended state
mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias
mmc: sdhci-pci: Fix S0i3 for Intel BYT-based controllers
ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
ALSA: hda: Add a power_save blacklist
ALSA: x86: Fix missing spinlock and mutex initializations
ALSA: control: Fix memory corruption risk in snd_ctl_elem_read
ALSA: usb-audio: Add a quirck for B&W PX headphones
tpm_tis_spi: Use DMA-safe memory for SPI transfers
tpm: constify transmit data pointers
tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
tpm: fix potential buffer overruns caused by bit glitches on the bus
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
ixgbe: fix crash in build_skb Rx code path
Bluetooth: btusb: Use DMI matching for QCA reset_resume quirking
ANDROID: uid_sys_stats: Copy task_struct comm field to bigger buffer
FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer
Conflicts:
kernel/time/timer.c
Change-Id: Iab19f552a822c233175e6553faf5c62447844201
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
commit 71db96ddfa72671bd43cacdcc99ca178d90ba267 upstream.
We've added a quirk to enable the recent Lenovo dock support, where it
overwrites the pin configs of NID 0x17 and 19, not only updating the
pin config cache. It works right after the boot, but the problem is
that the pin configs are occasionally cleared when the machine goes to
PM. Meanwhile the quirk writes the pin configs only at the pre-probe,
so this won't be applied any longer.
For addressing that issue, this patch moves the code to overwrite the
pin configs into HDA_FIXUP_ACT_INIT section so that it's always
applied at both probe and resume time.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195161
Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
