* remotes/origin/tmp-331d833:
Linux 4.14.31
bpf, x64: increase number of passes
bpf: skip unnecessary capability check
kbuild: disable clang's default use of -fmerge-all-constants
x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
usb: xhci: Fix potential memory leak in xhci_disable_slot()
usb: xhci: Disable slot even when virt-dev is null
staging: lustre: ptlrpc: kfree used instead of kvfree
staging: android: ion: Zero CMA allocated memory
iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()
iio: ABI: Fix name of timestamp sysfs file
perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
perf/core: Fix ctx_event_type in ctx_resched()
perf stat: Fix CVS output format for non-supported counters
perf/x86/intel/uncore: Fix Skylake UPI event format
drm/syncobj: Stop reusing the same struct file for all syncobj -> fd
x86/boot/64: Verify alignment of the LOAD segment
x86/build/64: Force the linker to use 2MB page size
kvm/x86: fix icebp instruction handling
posix-timers: Protect posix clock array access against speculation
x86/efi: Free efi_pgd with free_pages()
x86/vsyscall/64: Use proper accessor to update P4D entry
selftests/x86/ptrace_syscall: Fix for yet more glibc interference
x86/entry/64: Don't use IST entry for #BP stack
tty: vt: fix up tabstops properly
can: cc770: Fix use after free in cc770_tx_interrupt()
can: cc770: Fix queue stall & dropped RTR reply
can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
can: ifi: Check core revision upon probe
can: ifi: Repair the error handling
can: peak/pcie_fd: remove useless code when interface starts
can: peak/pcie_fd: fix echo_skb is occupied! bug
staging: ncpfs: memory corruption in ncp_read_kernel()
mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
mtd: nand: fsl_ifc: Fix nand waitfunc return value
mtdchar: fix usage of mtd_ooblayout_ecc()
tracing: probeevent: Fix to support minus offset from symbol
rtlwifi: rtl8723be: Fix loss of signal
brcmfmac: fix P2P_DEVICE ethernet address generation
libnvdimm, {btt, blk}: do integrity setup before add_disk()
ACPI / watchdog: Fix off-by-one error at resource assignment
acpi, numa: fix pxm to online numa node associations
mm/vmscan: wake up flushers for legacy cgroups too
drm: udl: Properly check framebuffer mmap offsets
drm: Reject getfb for multi-plane framebuffers
drm/radeon: Don't turn off DP sink when disconnected
drm/vmwgfx: Fix a destoy-while-held mutex problem.
drm/vmwgfx: Fix black screen and device errors when running without fbdev
Revert "mm: page_alloc: skip over regions of invalid pfns where possible"
mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
mm/thp: do not wait for lock_page() in deferred_split_scan()
mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
x86/mm: implement free pmd/pte page interfaces
mm/vmalloc: add interfaces to free unmapped page table
h8300: remove extraneous __BIG_ENDIAN definition
hugetlbfs: check for pgoff value overflow
nfsd: remove blocked locks on client teardown
cgroup: fix rule checking for threaded mode switching
libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
libata: Enable queued TRIM for Samsung SSD 860
libata: disable LPM for Crucial BX100 SSD 500GB drive
libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
libata: don't try to pass through NCQ commands to non-NCQ devices
libata: remove WARN() for DMA or PIO command without data
libata: fix length validation of ATAPI-relayed SCSI commands
Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
Bluetooth: btusb: Add Dell OptiPlex 3060 to btusb_needs_reset_resume_table
Bluetooth: btusb: Remove Yoga 920 from the btusb_needs_reset_resume_table
pinctrl: samsung: Validate alias coming from DT
Drivers: hv: vmbus: Fix ring buffer signaling
RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory
clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
clk: bcm2835: Protect sections updating shared registers
clk: bcm2835: Fix ana->maskX definitions
lockdep: fix fs_reclaim warning
ahci: Add PCI-id for the Highpoint Rocketraid 644L card
PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
mmc: dw_mmc: exynos: fix the suspend/resume issue for exynos5433
mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit systems
mmc: block: fix updating ext_csd caches on ioctl call
mmc: core: Disable HPI for certain Micron (Numonyx) eMMC cards
mmc: core: Fix tracepoint print of blk_addr and blksz
ALSA: hda/realtek - Always immediately update mute LED with pin VREF
ALSA: hda/realtek - Fix Dell headset Mic can't record
ALSA: hda/realtek - Fix speaker no sound after system resume
ALSA: hda - Force polling mode on CFL for fixing codec communication
ALSA: aloop: Fix access to not-yet-ready substream via cable
ALSA: aloop: Sync stale timer before release
ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock()
iio: st_pressure: st_accel: pass correct platform data to init
iio: chemical: ccs811: Corrected firmware boot/application mode transition
MIPS: lantiq: ase: Enable MFD_SYSCON
MIPS: lantiq: Enable AHB Bus for USB
MIPS: lantiq: Fix Danube USB clock
MIPS: ralink: Fix booting on MT7621
MIPS: ralink: Remove ralink_halt()
ANDROID: arm64: Image.gz-dtb build target depends on Image.gz
Conflicts:
drivers/staging/android/ion/ion_cma_heap.c
Change-Id: I1ed32b5d3bcf4db15991859bdd89fed0d70fdb86
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
commit e40bdb03d3cd7da66bd0bc1e40cbcfb49351265c upstream.
Some HP laptops have a mute mute LED controlled by a pin VREF. The
Realtek codec driver updates the VREF via vmaster hook by calling
snd_hda_set_pin_ctl_cache().
This works fine as long as the driver is running in a normal mode.
However, when the VREF change happens during the codec being in
runtime PM suspend, the regmap access will skip and postpone the
actual register change. This ends up with the unchanged LED status
until the next runtime PM resume even if you change the Master mute
switch. (Interestingly, the machine keeps the LED status even after
the codec goes into D3 -- but it's another story.)
For improving this usability, let the driver temporarily powering up /
down only during the pin VREF change. This can be achieved easily by
wrapping the call with snd_hda_power_up_pm() / *_down_pm().
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199073
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f0ba9d699e5ca2bcd07f70185d18720c4f1b597c upstream.
This platform was hardware fixed type for CTIA type for headset port.
Assigned 0x19 verb will fix can't record issue.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 88d42b2b45d7208cc872c2c9dec0b1ae6c6008d7 upstream.
It will have a chance speaker no sound after system resume.
To toggle NID 0x53 index 0x2 bit 15 will solve this issue.
This usage will also suitable with ALC256.
Fixes: 4a219ef8f370 ("ALSA: hda/realtek - Add ALC256 HP depop function")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a8d7bde23e7130686b76624b099f3e22dd38aef7 upstream.
We've observed too long probe time with Coffee Lake (CFL) machines,
and the likely cause is some communication problem between the
HD-audio controller and the codec chips. While the controller expects
an IRQ wakeup for each codec response, it seems sometimes missing, and
it takes one second for the controller driver to time out and read the
response in the polling mode.
Although we aren't sure about the real culprit yet, in this patch, we
put a workaround by forcing the polling mode as default for CFL
machines; the polling mode itself isn't too heavy, and much better
than other workarounds initially suggested (e.g. disabling
power-save), at least.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199007
Fixes: e79b0006c45c ("ALSA: hda - Add Coffelake PCI ID")
Reported-and-tested-by: Hui Wang <hui.wang@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e upstream.
In loopback_open() and loopback_close(), we assign and release the
substream object to the corresponding cable in a racy way. It's
neither locked nor done in the right position. The open callback
assigns the substream before its preparation finishes, hence the other
side of the cable may pick it up, which may lead to the invalid memory
access.
This patch addresses these: move the assignment to the end of the open
callback, and wrap with cable->lock for avoiding concurrent accesses.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 67a01afaf3d34893cf7d2ea19b34555d6abb7cb0 upstream.
The aloop driver tries to stop the pending timer via timer_del() in
the trigger callback and in the close callback. The former is
correct, as it's an atomic operation, while the latter expects that
the timer gets really removed and proceeds the resource releases after
that. But timer_del() doesn't synchronize, hence the running timer
may still access the released resources.
A similar situation can be also seen in the prepare callback after
trigger(STOP) where the prepare tries to re-initialize the things
while a timer is still running.
The problems like the above are seen indirectly in some syzkaller
reports (although it's not 100% clear whether this is the only cause,
as the race condition is quite narrow and not always easy to
trigger).
For addressing these issues, this patch adds the explicit alls of
timer_del_sync() in some places, so that the pending timer is properly
killed / synced.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* refs/heads/tmp-45c8dbe
Linux 4.14.29
usb: dwc3: Fix GDBGFIFOSPACE_TYPE values
USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure
scsi: qla2xxx: Fix logo flag for qlt_free_session_done()
scsi: qla2xxx: Fix NULL pointer access for fcport structure
scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que
btrfs: Fix memory barriers usage with device stats counters
btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes
btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
btrfs: alloc_chunk: fix DUP stripe size handling
btrfs: add missing initialization in btrfs_check_shared
btrfs: Fix NULL pointer exception in find_bio_stripe
irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
RDMAVT: Fix synchronization around percpu_ref
fs/aio: Use RCU accessors for kioctx_table->table[]
fs/aio: Add explicit RCU grace period when freeing kioctx
lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
KVM: arm/arm64: vgic: Don't populate multiple LRs with the same vintid
kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3
KVM: arm/arm64: Reduce verbosity of KVM init log
fs: Teach path_connected to handle nfs filesystems with multiple roots.
drm/amdgpu/dce: Don't turn off DP sink when disconnected
drm/radeon: fix prime teardown order
drm/amdgpu: fix prime teardown order
drm/nouveau/bl: Fix oops on driver unbind
ALSA: seq: Clear client entry before deleting else at closing
ALSA: seq: Fix possible UAF in snd_seq_check_queue()
ALSA: hda - Revert power_save option default value
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
parisc: Handle case where flush_cache_range is called with no context
x86/mm: Fix vmalloc_fault to use pXd_large
KVM: x86: Fix device passthrough when SME is active
x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist
x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels
x86/vm86/32: Fix POPF emulation
selftests/x86/entry_from_vm86: Add test cases for POPF
selftests/x86: Add tests for the STR and SLDT instructions
selftests/x86: Add tests for User-Mode Instruction Prevention
selftests/x86/entry_from_vm86: Exit with 1 if we fail
x86/cpufeatures: Add Intel PCONFIG cpufeature
x86/cpufeatures: Add Intel Total Memory Encryption cpufeature
ANDROID: arm-smccc: fix clang build
staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
Linux 4.14.28
drm/i915/glk: Disable Guc and HuC on GLK
dmaengine: qcom_hidma: check pending interrupts
IB/mlx5: revisit -Wmaybe-uninitialized warning
ima: relax requiring a file signature for new files with zero length
locking/locktorture: Fix num reader/writer corner cases
rcutorture/configinit: Fix build directory error message
ipvlan: add L2 check for packets arriving via virtual devices
Fix misannotated out-of-line _copy_to_user()
mmc: mmc_test: Ensure command queue is disabled for testing
ASoC: nuc900: Fix a loop timeout test
crypto: caam/qi - use correct print specifier for size_t
mac80211: remove BUG() when interface type is invalid
mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
agp/intel: Flush all chipset writes after updating the GGTT
arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset
powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context
powerpc/modules: Don't try to restore r2 after a sibling call
drm/amdkfd: Fix memory leaks in kfd topology
veth: set peer GSO values
net: sched: drop qdisc_reset from dev_graft_qdisc
virtio_net: Disable interrupts if napi_complete_done rescheduled napi
media: davinci: vpif_capture: add NULL check on devm_kzalloc return value
media: cpia2: Fix a couple off by one bugs
dm raid: fix raid set size revalidation
media: vsp1: Prevent suspending and resuming DRM pipelines
scsi: dh: add new rdac devices
scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
scsi: core: scsi_get_device_flags_keyed(): Always return device flags
bnxt_en: Don't print "Link speed -1 no longer supported" messages.
spi: sun6i: disable/unprepare clocks on remove
tools/usbip: fixes build with musl libc toolchain
ath10k: fix invalid STS_CAP_OFFSET_MASK
mwifiex: cfg80211: do not change virtual interface during scan processing
clk: qcom: msm8916: fix mnd_width for codec_digcodec
drm/amdgpu:fix virtual dce bug
iwlwifi: mvm: avoid dumping assert log when device is stopped
perf annotate: Fix objdump comment parsing for Intel mov dissassembly
perf annotate: Fix unnecessary memory allocation for s390x
pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D
pinctrl: sh-pfc: r8a7791: Add can_clk function
drm/sun4i: Fix format mask in DE2 driver
pwm: stmpe: Fix wrong register offset for hwpwm=2 case
scsi: ses: don't ask for diagnostic pages repeatedly during probe
drm/amdgpu:fix random missing of FLR NOTIFY
cpufreq: Fix governor module removal race
ath10k: update tdls teardown state to target
iio: health: max30102: Add power enable parameter to get_temp function
iio: adc: ina2xx: Shift bus voltage register to mask flag bits
drm/etnaviv: make THERMAL selectable
power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()'
power: supply: ab8500_charger: Fix an error handling path
leds: pm8058: Silence pointer to integer size warning
xfrm: Fix xfrm_replay_overflow_offload_esn
userns: Don't fail follow_automount based on s_user_ns
mtd: nand: ifc: update bufnum mask for ver >= 2.0.0
ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
net: thunderx: Set max queue count taking XDP_TX into account
mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
net: xfrm: allow clearing socket xfrm policies.
rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe()
net: ieee802154: adf7242: Fix bug if defined DEBUG
test_firmware: fix setting old custom fw path back on exit
crypto: cavium - fix memory leak on info
crypto: ecc - Fix NULL pointer deref. on no default_rng
sched: Stop resched_cpu() from sending IPIs to offline CPUs
sched: Stop switched_to_rt() from sending IPIs to offline CPUs
USB: ledtrig-usbport: fix of-node leak
typec: tcpm: fusb302: Resolve out of order messaging events
staging: rtl8822be: fix missing null check on dev_alloc_skb return
drm/amdgpu: fix get_max_engine_clock_in_mhz
ARM: dts: exynos: Correct Trats2 panel reset line
clk: meson: gxbb: fix wrong clock for SARADC/SANA
ARM: dts: koelsch: Move cec_clock to root node
iwlwifi: mvm: rs: don't override the rate history in the search cycle
HID: elo: clear BTN_LEFT mapping
HID: multitouch: Only look at non touch fields in first packet of a frame
video/hdmi: Allow "empty" HDMI infoframes
dma-buf/fence: Fix lock inversion within dma-fence-array
drm/edid: set ELD connector type in drm_edid_to_eld()
Revert "btrfs: use proper endianness accessors for super_copy"
dm mpath: fix passing integrity data
earlycon: add reg-offset to physical address before mapping
serial: core: mark port as initialized in autoconfig
serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
usb: dwc3: Fix lock-up on ID change during system suspend/resume
usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
usb: usbmon: Read text within supplied buffer size
usb: quirks: add control message delay for 1b1c:1b20
usbip: vudc: fix null pointer dereference on udc->lock
USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
staging: android: ashmem: Fix lockdep issue during llseek
staging: comedi: fix comedi_nsamples_left.
uas: fix comparison for error code
tty/serial: atmel: add new version check for usart
serial: sh-sci: prevent lockup on full TTY buffers
xhci: fix endpoint context tracer output
xhci: Fix front USB ports on ASUS PRIME B350M-A
usb: host: xhci-rcar: add support for r8a77965
ASoC: rt5651: Fix regcache sync errors on resume
ASoC: wm_adsp: For TLV controls only register TLV get/set
ASoC: sgtl5000: Fix suspend/resume
ASoC: sun4i-i2s: Fix RX slot number of SUN8I
x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
net: phy: Restore phy_resume() locking assumption
net: phy: fix resume handling
ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures
Change-Id: Ida88909c333e059adf42a8794c3b92b1d15252f7
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
commit a2ff19f7b70118ced291a28d5313469914de451b upstream.
When releasing a client, we need to clear the clienttab[] entry at
first, then call snd_seq_queue_client_leave(). Otherwise, the
in-flight cell in the queue might be picked up by the timer interrupt
via snd_seq_check_queue() before calling snd_seq_queue_client_leave(),
and it's delivered to another queue while the client is clearing
queues. This may eventually result in an uncleared cell remaining in
a queue, and the later snd_seq_pool_delete() may need to wait for a
long time until the event gets really processed.
By moving the clienttab[] clearance at the beginning of release, any
event delivery of a cell belonging to this client will fail at a later
point, since snd_seq_client_ptr() returns NULL. Thus the cell that
was picked up by the timer interrupt will be returned immediately
without further delivery, and the long stall of snd_seq_delete_pool()
can be avoided, too.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d0f833065221cbfcbadf19fd4102bcfa9330006a upstream.
Although we've covered the races between concurrent write() and
ioctl() in the previous patch series, there is still a possible UAF in
the following scenario:
A: user client closed B: timer irq
-> snd_seq_release() -> snd_seq_timer_interrupt()
-> snd_seq_free_client() -> snd_seq_check_queue()
-> cell = snd_seq_prioq_cell_peek()
-> snd_seq_prioq_leave()
.... removing all cells
-> snd_seq_pool_done()
.... vfree()
-> snd_seq_compare_tick_time(cell)
... Oops
So the problem is that a cell is peeked and accessed without any
protection until it's retrieved from the queue again via
snd_seq_prioq_cell_out().
This patch tries to address it, also cleans up the code by a slight
refactoring. snd_seq_prioq_cell_out() now receives an extra pointer
argument. When it's non-NULL, the function checks the event timestamp
with the given pointer. The caller needs to pass the right reference
either to snd_seq_tick or snd_seq_realtime depending on the event
timestamp type.
A good news is that the above change allows us to remove the
snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the
code size.
Reviewed-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 40088dc4e1ead7df31728c73f5b51d71da18831d upstream.
With the commit 1ba8f9d30817 ("ALSA: hda: Add a power_save
blacklist"), we changed the default value of power_save option to -1
for processing the power-save blacklist.
Unfortunately, this seems breaking user-space applications that
actually read the power_save parameter value via sysfs and judge /
adjust the power-saving status. They see the value -1 as if the
power-save is turned off, although the actual value is taken from
CONFIG_SND_HDA_POWER_SAVE_DEFAULT and it can be a positive.
So, overall, passing -1 there was no good idea. Let's partially
revert it -- at least for power_save option default value is restored
again to CONFIG_SND_HDA_POWER_SAVE_DEFAULT. Meanwhile, in this patch,
we keep the blacklist behavior and make is adjustable via the new
option, pm_blacklist.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199073
Fixes: 1ba8f9d30817 ("ALSA: hda: Add a power_save blacklist")
Acked-by: Hans de Goede <hdegoede@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 01c0b4265cc16bc1f43f475c5944c55c10d5768f upstream.
snd_pcm_oss_get_formats() has an obvious use-after-free around
snd_mask_test() calls, as spotted by syzbot. The passed format_mask
argument is a pointer to the hw_params object that is freed before the
loop. What a surprise that it has been present since the original
code of decades ago...
Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ]
We should be finishing the loop with timeout set to zero but because
this is a post-op we finish with timeout == -1.
Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2d30e9494f1ea320aaaad0cff9ddd92c87eac355 upstream.
The ALC5651 does not like multi-write accesses, avoid them. This fixes:
rt5651 i2c-10EC5651:00: Unable to sync registers 0x27-0x28. -121
Errors on resume (and all registers after the registers in the error not
being synced).
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d7789f5bcdb298c4a302db471b1b20f74a20de95 upstream.
Normal 512-byte get/set of a TLV isn't supported but we were
registering the normal get/set anyway and relying on omitting
the SNDRV_CTL_ELEM_ACCESS_[READ|WRITE] flags to prevent them
being called.
Trouble is if this gets broken in the core ALSA code - as it has
been since at least 4.14 - the standard get/set can be called
unexpectedly and corrupt memory.
There's no point providing functions that won't be called and
it's a trivial change. The benefit is that if the ALSA core gets
broken again we get a big fat immediate NULL dereference instead
of a memory corruption timebomb.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a8992973edbb2555e956b90f6fe97c4bc14d761d upstream.
Commit 8419caa72702 ("ASoC: sgtl5000: Do not disable regulators in
SND_SOC_BIAS_OFF") causes the sgtl5000 to fail after a suspend/resume
sequence:
Playing WAVE '/media/a2002011001-e02.wav' : Signed 16 bit Little
Endian, Rate 44100 Hz, Stereo
aplay: pcm_write:2051: write error: Input/output error
The problem is caused by the fact that the aforementioned commit
dropped the cache handling, so re-introduce the register map
resync to fix the problem.
Suggested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5a3386790a172cf738194e1574f631cd43c6140a upstream.
I2S's RX slot number of SUN8I should be shifted 4 bit to left.
Fixes: 7d2993811a1e ("ASoC: sun4i-i2s: Add support for H3")
Signed-off-by: Yong Deng <yong.deng@magewell.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Audio device supporting burst mode exposes alt settings with
different service intervals. In order to find the requested
format as well as service interval remote entity provides
service interval parameter. Data interval (bInterval - 1) is
calculated using service interval and used to find the matching
alt setting using find_format_and_si().
Change-Id: Ie15c78ab53eb5258085b54bf13459ebef44a44a4
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
* remotes/origin/tmp-df0daba:
Linux 4.14.27
x86/kprobes: Fix kernel crash when probing .entry_trampoline code
objtool: Fix 32-bit build
objtool: Fix another switch table detection issue
objtool, retpolines: Integrate objtool with retpoline support more closely
objtool: Add module specific retpoline rules
kbuild: move cc-option and cc-disable-warning after incl. arch Makefile
kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
kbuild: re-order the code to not parse unnecessary variables
objtool: Add retpoline validation
objtool: Use existing global variables for options
x86/mm/sme, objtool: Annotate indirect call in sme_encrypt_execute()
x86/boot, objtool: Annotate indirect jump in secondary_startup_64()
x86/paravirt, objtool: Annotate indirect calls
x86/speculation: Move firmware_restrict_branch_speculation_*() from C to CPP
x86/speculation, objtool: Annotate indirect calls/jumps for objtool
x86/retpoline: Support retpoline builds with Clang
x86/speculation: Use IBRS if available before calling into firmware
Revert "x86/retpoline: Simplify vmexit_fill_RSB()"
x86-64/realmode: Add instruction suffix
x86/LDT: Avoid warning in 32-bit builds with older gcc
x86/asm: Improve how GEN_*_SUFFIXED_RMWcc() specify clobbers
x86/mm: Remove stale comment about KMEMCHECK
x86/entry/64: Use 'xorl' for faster register clearing
x86/entry: Reduce the code footprint of the 'idtentry' macro
nospec: Include <asm/barrier.h> dependency
nospec: Kill array_index_nospec_mask_check()
MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
dt-bindings: Document mti,mips-cpc binding
scsi: qla2xxx: Fix recursion while sending terminate exchange
scsi: qla2xxx: Fix NULL pointer crash due to probe failure
ALSA: hda: add dock and led support for HP ProBook 640 G2
ALSA: hda: add dock and led support for HP EliteBook 820 G3
ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
ALSA: seq: More protection for concurrent write and ioctl races
ALSA: seq: Don't allow resizing pool in use
ALSA: hda/realtek - Make dock sound work on ThinkPad L570
ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
ALSA: hda/realtek: Limit mic boost on T480
ALSA: hda/realtek - Add headset mode support for Dell laptop
ALSA: hda/realtek - Add support headset mode for DELL WYSE
x86/spectre_v2: Don't check microcode versions when running under hypervisors
perf tools: Fix trigger class trigger_on()
x86/MCE: Serialize sysfs changes
x86/MCE: Save microcode revision in machine check records
bcache: don't attach backing with duplicate UUID
bcache: fix crashes in duplicate cache device register
IB/mlx5: Fix incorrect size of klms in the memory region
dm bufio: avoid false-positive Wmaybe-uninitialized warning
kbuild: Handle builtin dtb file names containing hyphens
IB/core: Fix missing RDMA cgroups release in case of failure to register device
arm64: mm: fix thinko in non-global page table attribute check
KVM: s390: fix memory overwrites when not using SCA entries
virtio_ring: fix num_free handling in error case
loop: Fix lost writes caused by missing flag
Documentation/sphinx: Fix Directive import error
mm/memblock.c: hardcode the end_pfn being -1
lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
Input: matrix_keypad - fix race when disabling interrupts
PCI: dwc: Fix enumeration end when reaching root subordinate
MIPS: OCTEON: irq: Check for null return on kzalloc allocation
MIPS: ath25: Check for kzalloc allocation failure
MIPS: BMIPS: Do not mask IPIs during suspend
drm/amdgpu:Always save uvd vcpu_bo in VM Mode
drm/amdgpu:Correct max uvd handles
drm/amdgpu: fix KV harvesting
drm/radeon: fix KV harvesting
drm/amdgpu: Notify sbios device ready before send request
drm/amdgpu: used cached pcie gen info for SI (v2)
drm/amd/powerplay: fix power over limit on Fiji
drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE
Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
drm/amd/powerplay/vega10: allow mclk switching with no displays
drm/amd/powerplay/smu7: allow mclk switching with no displays
drm/nouveau: prefer XBGR2101010 for addfb ioctl
drm/amdgpu: Fix deadlock on runtime suspend
drm/radeon: Fix deadlock on runtime suspend
drm/nouveau: Fix deadlock on runtime suspend
drm: Allow determining if current task is output poll worker
workqueue: Allow retrieval of current task's work struct
drm/i915: Always call to intel_display_set_init_power() in resume_early.
scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
scsi: core: Avoid that ATA error handling can trigger a kernel hang or oops
drm/i915/perf: fix perf stream opening lock
drm/i915: Try EDID bitbanging on HDMI after failed read
drm/i915: Update watermark state correctly in sanitize_watermarks
drm/i915: Disable DC states around GMBUS on GLK
drm/i915: Clear the in-use marker on execbuf failure
drm/i915: Fix rsvd2 mask when out-fence is returned
regulator: stm32-vrefbuf: fix check on ready flag
net/smc: fix NULL pointer dereference on sock_create_kern() error path
IB/uverbs: Improve lockdep_check
RDMA/mlx5: Fix integer overflow while resizing CQ
RDMA/ucma: Check that user doesn't overflow QP state
RDMA/ucma: Limit possible option size
NFS: Fix unstable write completion
pNFS: Prevent the layout header refcount going to zero in pnfs_roc()
NFS: Fix an incorrect type in struct nfs_direct_req
scsi: qla2xxx: Fix memory leak in dual/target mode
scsi: qla2xxx: Fix system crash in qlt_plogi_ack_unref
scsi: qla2xxx: Remove aborting ELS IOCB call issued as part of timeout.
scsi: qla2xxx: Defer processing of GS IOCB calls
scsi: qla2xxx: Clear loop id after delete
scsi: qla2xxx: Fix scan state field for fcport
scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
scsi: qla2xxx: Fix abort command deadlock due to spinlock
scsi: qla2xxx: Fix PRLI state check
scsi: qla2xxx: Fix Relogin being triggered too fast
scsi: qla2xxx: Fix NPIV host cleanup in target mode
scsi: qla2xxx: Fix login state machine stuck at GPDB
scsi: qla2xxx: Serialize GPNID for multiple RSCN
scsi: qla2xxx: Retry switch command on time out
scsi: qla2xxx: Fix re-login for Nport Handle in use
scsi: qla2xxx: Skip IRQ affinity for Target QPairs
scsi: qla2xxx: Move session delete to driver work queue
scsi: qla2xxx: Fix gpnid error processing
scsi: qla2xxx: Fix system crash for Notify ack timeout handling
tpm: only attempt to disable the LPC CLKRUN if is already enabled
tpm: remove unused variables
tpm: delete the TPM_TIS_CLK_ENABLE flag
tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()
tpm_tis: Move ilb_base_addr to tpm_tis_data
netfilter: use skb_to_full_sk in ip6_route_me_harder
netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
netfilter: bridge: ebt_among: add missing match size checks
netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
netfilter: IDLETIMER: be syzkaller friendly
netfilter: nat: cope with negative port range
netfilter: x_tables: fix missing timer initialization in xt_LED
netfilter: xt_hashlimit: fix lock imbalance
netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation
netfilter: add back stackpointer size checks
ASoC: Intel: kbl: fix jack name
ASoC: Intel: Skylake: Fix jack name format substitution
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
watchdog: hpwdt: Remove legacy NMI sourcing.
watchdog: hpwdt: fix unused variable warning
watchdog: hpwdt: Check source of NMI
watchdog: hpwdt: SMBIOS check
kbuild: move "_all" target out of $(KBUILD_SRC) conditional
FROMLIST: f2fs: don't put dentry page in pagecache into highmem
Conflicts:
Makefile
Change-Id: I9c0acaa8aea9f4986bf01898de8d4be4658c64ce
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Commit 1efd15d0bb99 ("sound: usb: Adopt new QMI framework related
changes") used wrong structure size while allocating memory
causing random memory corruption. Fix this issue by using correct
structure size.
Change-Id: I07019ad176f4cb6c5b5bcadce3e4df1a3f09219e
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
commit 099fd6ca0ad25bc19c5ade2ea4b25b8fadaa11b3 upstream.
This patch adds missing initialisation for HP 2013 UltraSlim Dock
Line-In/Out PINs and activates keyboard mute/micmute leds
for HP ProBook 640 G2
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aea808172018ca01abf53db808323aed23281835 upstream.
This patch adds missing initialisation for HP 2013 UltraSlim Dock
Line-In/Out PINs and activates keyboard mute/micmute leds
for HP EliteBook 820 G3
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream.
With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign
ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than
ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested
by Kailang of Realtek and is verified on the machine.
Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines")
Cc: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 upstream.
This patch is an attempt for further hardening against races between
the concurrent write and ioctls. The previous fix d15d662e89fc
("ALSA: seq: Fix racy pool initializations") covered the race of the
pool initialization at writer and the pool resize ioctl by the
client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex
should be applied more widely to the whole write operation for
avoiding the unexpected pool operations by another thread.
The only change outside snd_seq_write() is the additional mutex
argument to helper functions, so that we can unlock / relock the given
mutex temporarily during schedule() call for blocking write.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Reviewed-and-tested-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d85739367c6d56e475c281945c68fdb05ca74b4c upstream.
This is a fix for a (sort of) fallout in the recent commit
d15d662e89fc ("ALSA: seq: Fix racy pool initializations") for
CVE-2018-1000004.
As the pool resize deletes the existing cells, it may lead to a race
when another thread is writing concurrently, eventually resulting a
UAF.
A simple workaround is not to allow the pool resizing when the pool is
in use. It's an invalid behavior in anyway.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e4c07b3b66b7d6a24c2fe3b1ddeff5cd9b378b3a upstream.
One version of Lenovo Thinkpad T570 did not use ALC298
(like other Kaby Lake devices). Instead it uses ALC292.
In order to make the Lenovo dock working with that codec
the dock quirk for ALC292 will be used.
Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e312a869cd726c698a75caca0d9e5c22fd3f1534 upstream.
The dock line-out pin (NID 0x17 of ALC3254 codec) on Dell Precision
7520 may route to three different DACs, 0x02, 0x03 and 0x06. The
first two DACS have the volume amp controls while the last one
doesn't. And unfortunately, the auto-parser assigns this pin to DAC3,
resulting in the non-working volume control for the line out.
Fix it by disabling the routing to DAC3 on the corresponding pin.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199029
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 85981dfd6b0a0fd9ed87ca4a525981b67c21f098 upstream.
The internal mic boost on the T480 is too high. Fix this by applying the
ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
Signed-off-by: Benjamin Berg <bberg@redhat.com>
Tested-by: Benjamin Berg <bberg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ae104a21e52b1f9aab342cf6924405177b720069 upstream.
This platform was only one phone Jack.
Add dummy lineout verb to fix automute mode disable.
This just the workaround.
[ More background information:
since the platform has only a headphone jack without speaker, the
driver doesn't create the auto-mute control. Meanwhile we do update
the headset mode via the automute hook in the driver, thus with this
setup, the headset won't be updated any longer.
By adding a dummy line-out pin here, the auto-mute is added by the
driver, and the headset update is triggered properly.
Note that this is different from the other
ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, which has the real line-out pin,
while this quirk adds a dummy line-out pin. -- tiwai ]
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit cedb6415f9ece6d3368aa0ac8a433caff799792a upstream.
Commit d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format
substitution") added Jack name but erroneously added a space as well,
so remove the space in Jack name.
Fixes: d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format substitution")
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d1c4cb447a7efcb5608a33cdfed8ab4234378b0a upstream.
Jack name is not getting formatted correctly hence resulting
in invalid name for HDMI/DP input devices.
This was recently exposed due changes brought by MST:
commit 3a13347f05fd ("ASoC: Intel: kbl: Add jack port initialize
in kbl machine drivers")
Signed-off-by: Chintan Patel <chintan.m.patel@intel.com>
Acked-By: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Driver currently restrict upper bound check for bInterval
to 4 which corresponds to 1 ms. Fix the bInterval range
check as per the USB spec for ISOC endpoint.
Change-Id: I580e1fdfab0eeb1231642b920239691e7af67727
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
* remotes/origin/tmp-4576e0e:
Linux 4.14.26
KVM: x86: fix backward migration with async_PF
bpf, ppc64: fix out of bounds access in tail call
bpf: allow xadd only on aligned memory
bpf: add schedule points in percpu arrays management
bpf, arm64: fix out of bounds access in tail call
bpf, x64: implement retpoline for tail call
bpf: fix rcu lockdep warning for lpm_trie map_free callback
bpf: fix memory leak in lpm_trie map_free callback function
bpf: fix mlock precharge on arraymaps
Linux 4.14.25
nvme-rdma: don't suppress send completions
md: only allow remove_and_add_spares when no sync_thread running.
ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
ACPI / bus: Parse tables as term_list for Dell XPS 9570 and Precision M5530
KVM/x86: remove WARN_ON() for when vm_munmap() fails
KVM/x86: Fix wrong macro references of X86_CR0_PG_BIT and X86_CR4_PAE_BIT in kvm_valid_sregs()
PCI/ASPM: Deal with missing root ports in link state handling
KVM: x86: fix vcpu initialization with userspace lapic
KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
KVM: x86: move LAPIC initialization after VMCS creation
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
KVM: mmu: Fix overlap between public and private memslots
KVM: X86: Fix SMRAM accessing even if VM is shutdown
KVM: x86: extend usage of RET_MMIO_PF_* constants
ARM: kvm: fix building with gcc-8
ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
ARM: dts: rockchip: Remove 1.8 GHz operation point from phycore som
ARM: orion: fix orion_ge00_switch_board_info initialization
x86/mm: Fix {pmd,pud}_{set,clear}_flags()
nospec: Allow index argument to have const-qualified type
KVM: s390: consider epoch index on TOD clock syncs
KVM: s390: consider epoch index on hotplugged CPUs
KVM: s390: provide only a single function for setting the tod (fix SCK)
KVM: s390: take care of clock-comparator sign control
EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL
media: m88ds3103: don't call a non-initalized function
blk-mq: don't call io sched's .requeue_request when requeueing rq to ->dispatch
s390/qeth: fix IPA command submission race
s390/qeth: fix IP address lookup for L3 devices
Revert "s390/qeth: fix using of ref counter for rxip addresses"
s390/qeth: fix double-free on IP add/remove race
s390/qeth: fix IP removal on offline cards
s390/qeth: fix overestimated count of buffer elements
s390/qeth: fix SETIP command handling
s390/qeth: fix underestimated count of buffer elements
virtio-net: disable NAPI only when enabled during XDP set
tuntap: disable preemption during XDP processing
tuntap: correctly add the missing XDP flush
tcp: purge write queue upon RST
netlink: put module reference if dump start fails
mlxsw: spectrum_router: Do not unconditionally clear route offload indication
cls_u32: fix use after free in u32_destroy_key()
amd-xgbe: Restore PCI interrupt enablement setting on resume
net/mlx5e: Verify inline header size do not exceed SKB linear size
bridge: Fix VLAN reference count problem
sctp: fix dst refcnt leak in sctp_v6_get_dst()
net: ipv4: Set addr_type in hash_keys for forwarded case
mlxsw: spectrum_router: Fix error path in mlxsw_sp_vr_create
tcp: revert F-RTO extension to detect more spurious timeouts
tcp: revert F-RTO middle-box workaround
sctp: do not pr_err for the duplicated node in transport rhlist
net/sched: cls_u32: fix cls_u32 on filter replace
net_sched: gen_estimator: fix broken estimators based on percpu stats
net/mlx5e: Fix loopback self test when GRO is off
doc: Change the min default value of tcp_wmem/tcp_rmem.
tcp_bbr: better deal with suboptimal GSO
rxrpc: Fix send in rxrpc_send_data_packet()
tcp: Honor the eor bit in tcp_mtu_probe
net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
net/mlx5e: Specify numa node when allocating drop rq
mlxsw: spectrum_switchdev: Check success of FDB add operation
sctp: fix dst refcnt leak in sctp_v4_get_dst
net/mlx5e: Fix TCP checksum in LRO buffers
udplite: fix partial checksum initialization
sctp: verify size of a new chunk in _sctp_make_chunk()
ppp: prevent unregistered channels from connecting to PPP units
net: sched: report if filter is too large to dump
netlink: ensure to loop over all netns in genlmsg_multicast_allns()
net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
net: fix race on decreasing number of TX queues
net: ethernet: ti: cpsw: fix net watchdog timeout
net: amd-xgbe: fix comparison to bitshift when dealing with a mask
ipv6 sit: work around bogus gcc-8 -Wrestrict warning
hdlc_ppp: carrier detect ok, don't turn off negotiation
fib_semantics: Don't match route with mismatching tclassid
bridge: check brport attr show in brport_show
x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table
x86/platform/intel-mid: Handle Intel Edison reboot correctly
x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
direct-io: Fix sleep in atomic due to sync AIO
dax: fix vma_is_fsdax() helper
cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
vfio: disable filesystem-dax page pinning
block: kyber: fix domain token leak during requeue
block: fix the count of PGPGOUT for WRITE_SAME
btrfs: use proper endianness accessors for super_copy
parisc: Fix ordering of cache and TLB flushes
parisc: Reduce irq overhead when run in qemu
parisc: Use cr16 interval timers unconditionally on qemu
timers: Forward timer base before migrating timers
mmc: dw_mmc: Fix out-of-bounds access for slot's caps
mmc: dw_mmc: Factor out dw_mci_init_slot_caps
mmc: dw_mmc: Avoid accessing registers in runtime suspended state
mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias
mmc: sdhci-pci: Fix S0i3 for Intel BYT-based controllers
ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
ALSA: hda: Add a power_save blacklist
ALSA: x86: Fix missing spinlock and mutex initializations
ALSA: control: Fix memory corruption risk in snd_ctl_elem_read
ALSA: usb-audio: Add a quirck for B&W PX headphones
tpm_tis_spi: Use DMA-safe memory for SPI transfers
tpm: constify transmit data pointers
tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
tpm: fix potential buffer overruns caused by bit glitches on the bus
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
ixgbe: fix crash in build_skb Rx code path
Bluetooth: btusb: Use DMI matching for QCA reset_resume quirking
ANDROID: uid_sys_stats: Copy task_struct comm field to bigger buffer
FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer
Conflicts:
kernel/time/timer.c
Change-Id: Iab19f552a822c233175e6553faf5c62447844201
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
commit 71db96ddfa72671bd43cacdcc99ca178d90ba267 upstream.
We've added a quirk to enable the recent Lenovo dock support, where it
overwrites the pin configs of NID 0x17 and 19, not only updating the
pin config cache. It works right after the boot, but the problem is
that the pin configs are occasionally cleared when the machine goes to
PM. Meanwhile the quirk writes the pin configs only at the pre-probe,
so this won't be applied any longer.
For addressing that issue, this patch moves the code to overwrite the
pin configs into HDA_FIXUP_ACT_INIT section so that it's always
applied at both probe and resume time.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195161
Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1ba8f9d308174e647b864c36209b4d7934d99888 upstream.
On some boards setting power_save to a non 0 value leads to clicking /
popping sounds when ever we enter/leave powersaving mode. Ideally we would
figure out how to avoid these sounds, but that is not always feasible.
This commit adds a blacklist for devices where powersaving is known to
cause problems and disables it on these devices.
Note I tried to put this blacklist in userspace first:
https://github.com/systemd/systemd/pull/8128
But the systemd maintainers rightfully pointed out that it would be
impossible to then later remove entries once we actually find a way to
make power-saving work on listed boards without issues. Having this list
in the kernel will allow removal of the blacklist entry in the same commit
which fixes the clicks / plops.
The blacklist only applies to the default power_save module-option value,
if a user explicitly sets the module-option then the blacklist is not
used.
[ added an ifdef CONFIG_PM for the build error -- tiwai]
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=198611
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 350144069abf351c743d766b2fba9cb9b7cd32a1 upstream.
The commit change for supporting the multiple ports moved involved
some code shuffling, and there the initializations of spinlock and
mutex in snd_intelhad object were dropped mistakenly.
This patch adds the missing initializations again for each port.
Fixes: b4eb0d522fcb ("ALSA: x86: Split snd_intelhad into card and PCM specific structures")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5a23699a39abc5328921a81b89383d088f6ba9cc upstream.
The patch "ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE
operations" introduced a potential for kernel memory corruption due
to an incorrect if statement allowing non-readable controls to fall
through and call the get function. For TLV controls a driver can omit
SNDRV_CTL_ELEM_ACCESS_READ to ensure that only the TLV get function
can be called. Instead the normal get() can be invoked unexpectedly
and as the driver expects that this will only be called for controls
<= 512 bytes, potentially try to copy >512 bytes into the 512 byte
return array, so corrupting kernel memory.
The problem is an attempt to refactor the snd_ctl_elem_read function
to invert the logic so that it conditionally aborted if the control
is unreadable instead of conditionally executing. But the if statement
wasn't inverted correctly.
The correct inversion of
if (a && !b)
is
if (!a || b)
Fixes: becf9e5d553c2 ("ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE operations")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 240a8af929c7c57dcde28682725b29cf8474e8e5 upstream.
The capture interface doesn't work and the playback interface only
supports 48 kHz sampling rate even though it advertises more rates.
Signed-off-by: Erik Veijola <erik.veijola@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* remotes/origin/tmp-85ab9a0:
Linux 4.14.24
net: sched: fix use-after-free in tcf_block_put_ext
net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
net: sched: crash on blocks with goto chain action
net: sched: fix crash when deleting secondary chains
arm64: dts: marvell: mcbin: add comphy references to Ethernet ports
arm64: dts: marvell: add comphy nodes on cp110 master and slave
powerpc/pseries: Enable RAS hotplug events later
MIPS: Implement __multi3 for GCC7 MIPS64r6 builds
mlxsw: pci: Wait after reset before accessing HW
nfp: always unmask aux interrupts at init
of_mdio: avoid MDIO bus removal when a PHY is missing
net: gianfar_ptp: move set_fipers() to spinlock protecting area
sctp: make use of pre-calculated len
sctp: add a ceiling to optlen in some sockopts
xen/gntdev: Fix partial gntdev_mmap() cleanup
xen/gntdev: Fix off-by-one error when unmapping with holes
SolutionEngine771x: fix Ether platform data
mdio-sun4i: Fix a memory leak
xen-netfront: enable device after manual module load
bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc()
x86/platform/intel-mid: Revert "Make 'bt_sfi_data' const"
nvme-fabrics: initialize default host->id in nvmf_host_default()
powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ
leds: core: Fix regression caused by commit 2b83ff96f51d
bpf: sockmap missing NULL psock check
ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y
block: drain queue before waiting for q_usage_counter becoming zero
wcn36xx: Fix dynamic power saving
can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
mac80211: mesh: drop frames appearing to be from us
nl80211: Check for the required netlink attribute presence
net: ena: unmask MSI-X only after device initialization is completed
i40e: don't remove netdev->dev_addr when syncing uc list
i40e/i40evf: Account for frags split over multiple descriptors in check linearize
uapi libc compat: add fallback for unsupported libcs
x86/efi: Fix kernel param add_efi_memmap regression
RDMA/netlink: Fix locking around __ib_get_device_by_index
drm/ttm: check the return value of kzalloc
NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625
e1000: fix disabling already-disabled warning
macvlan: Fix one possible double free
xfs: quota: check result of register_shrinker()
xfs: quota: fix missed destroy of qi_tree_lock
IB/ipoib: Fix race condition in neigh creation
IB/mlx4: Fix mlx4_ib_alloc_mr error flow
Input: xen-kbdfront - do not advertise multi-touch pressure support
ip6_tunnel: allow ip6gre dev mtu to be set below 1280
btrfs: Fix flush bio leak
s390/dasd: fix wrongly assigned configuration data
afs: Fix missing error handling in afs_write_end()
genirq: Guard handle_bad_irq log messages
IB/mlx5: Fix mlx5_ib_alloc_mr error flow
led: core: Fix brightness setting when setting delay_off=0
perf/x86/intel: Plug memory leak in intel_pmu_init()
bnx2x: Improve reliability in case of nested PCI errors
tg3: Enable PHY reset in MTU change path for 5720
tg3: Add workaround to restrict 5762 MRRS to 2048
tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path
tipc: error path leak fixes in tipc_enable_bearer()
netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()
crypto: inside-secure - fix request allocations in invalidation path
crypto: inside-secure - free requests even if their handling failed
crypto: inside-secure - per request invalidation
arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property
lib/mpi: Fix umul_ppmm() for MIPS64r6
crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t
ARM: dts: ls1021a: fix incorrect clock references
RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path
i915: Reject CCS modifiers for pipe C on Geminilake
netfilter: uapi: correct UNTRACKED conntrack state bit number
scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()
xen/balloon: Mark unallocated host memory as UNUSABLE
ASoC: rsnd: fixup ADG register mask
net/mlx5: Stay in polling mode when command EQ destroy fails
net/mlx5: Cleanup IRQs in case of unload failure
net/mlx5e: Fix ETS BW check
net: stmmac: Fix bad RX timestamp extraction
net: stmmac: Fix TX timestamp calculation
ip6_tunnel: get the min mtu properly in ip6_tnl_xmit
ip6_gre: remove the incorrect mtu limit for ipgre tap
ip_gre: remove the incorrect mtu limit for ipgre tap
vxlan: update skb dst pmtu on tx path
net: arc_emac: fix arc_emac_rx() error paths
net: mediatek: setup proper state for disabled GMAC on the default
x86-64/Xen: eliminate W+X mappings
staging: ion: Fix ion_cma_heap allocations
cgroup: Fix deadlock in cpu hotplug path
ASoC: nau8825: fix issue that pop noise when start capture
spi: atmel: fixed spin_lock usage inside atmel_spi_remove
mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl
x86/stacktrace: Make zombie stack traces reliable
xfrm: Reinject transport-mode packets through tasklet
drm/nouveau/pci: do a msi rearm on init
net: phy: xgene: disable clk on error paths
sget(): handle failures of register_shrinker()
sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
x86/asm: Allow again using asm.h when building for the 'bpf' clang target
ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
parisc: Reduce thread stack to 16 kb
ipv6: icmp6: Allow icmp messages to be looped back
mtd: nand: brcmnand: Zero bitflip is not an error
mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support
net: aquantia: Fix hardware DMA stream overload on large MRRS
net: aquantia: Fix actual speed capabilities reporting
nvme: check hw sectors before setting chunk sectors
nvme-fc: remove double put reference if admin connect fails
phy: cpcap-usb: Fix platform_get_irq_byname's error checking.
dmaengine: fsl-edma: disable clks on all error paths
scsi: aacraid: Fix I/O drop during reset
mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
exec: avoid gcc-8 warning for get_task_comm
hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)
Conflicts:
drivers/staging/android/ion/Kconfig
drivers/staging/android/ion/ion_cma_heap.c
Change-Id: I58485dd9ac8092a184c42a8e125e44523221e3ea
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
[ Upstream commit d5aa24825da5711f8cb829f873160ddf1a29b19c ]
BRGCKR should use 0x80770000, instead of 0x80FF0000.
R-Car Gen2 xxx_TIMSEL should use 0x0F1F,
R-Car Gen3 xxx_TIMSEL should use 0x1F1F.
Here, Gen3 doesn't support AVD, thus, both case can use 0x0F1F.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit d070f7c703ef26e3db613f24206823f916272fc6 ]
In skylake platform, we hear a loud pop noise(0 dB) at start of
audio capture power up sequence. This patch removes the pop noise
from the recording by adding a delay before enabling ADC.
Signed-off-by: Abhijeet Kumar <abhijeet.kumar@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* remotes/origin/tmp-af3b8e6:
Linux 4.14.22
vmalloc: fix __GFP_HIGHMEM usage for vmalloc_32 on 32b systems
mei: me: add cannon point device ids for 4th device
mei: me: add cannon point device ids
crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
drm/i915: fix intel_backlight_device_register declaration
crypto: talitos - fix Kernel Oops on hashing an empty file
hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
powerpc/perf/imc: Fix nest-imc cpuhotplug callback failure
PCI: rcar: Fix use-after-free in probe error path
xen: XEN_ACPI_PROCESSOR is Dom0-only
platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410
x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
usb: dwc3: of-simple: fix missing clk_disable_unprepare
usb: dwc3: gadget: Wait longer for controller to end command processing
dmaengine: jz4740: disable/unprepare clk if probe fails
drm/vc4: Release fence after signalling
ASoC: rsnd: ssi: fix race condition in rsnd_ssi_pointer_update
drm/armada: fix leak of crtc structure
xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
IB/mlx4: Fix RSS hash fields restrictions
spi: sun4i: disable clocks in the remove function
ASoC: rockchip: disable clock on error
staging: ccree: Uninitialized return in ssi_ahash_import()
clk: fix a panic error caused by accessing NULL pointer
netfilter: xt_bpf: add overflow checks
xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)
dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
dmaengine: ioat: Fix error handling path
scsi: bfa: fix type conversion warning
scsi: bfa: fix access to bfad_im_port_s
scsi: lpfc: Use after free in lpfc_rq_buf_free()
gianfar: Disable EEE autoneg by default
509: fix printing uninitialized stack memory when OID is empty
net: dsa: mv88e6xxx: Unregister MDIO bus on error path
net: dsa: mv88e6xxx: Fix interrupt masking on removal
net: ethernet: arc: fix error handling in emac_rockchip_probe
virtio_net: fix return value check in receive_mergeable()
brcmfmac: Avoid build error with make W=1
btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
Btrfs: disable FUA if mounted with nobarrier
btrfs: Fix quota reservation leak on preallocated files
locking/lockdep: Fix possible NULL deref
net: qualcomm: rmnet: Fix leak on transmit failure
KVM: VMX: fix page leak in hardware_setup()
VSOCK: fix outdated sk_state value in hvs_release()
net_sched: red: Avoid illegal values
net_sched: red: Avoid devision by zero
gianfar: fix a flooded alignment reports because of padding issue.
nfp: fix port stats for mac representors
ARM: dts: Fix elm interrupt compiler warning
s390/dasd: prevent prefix I/O error
s390/virtio: add BSD license to virtio-ccw
PM / runtime: Fix handling of suppliers with disabled runtime PM
powerpc/perf: Fix oops when grouping different pmu events
m68k: add missing SOFTIRQENTRY_TEXT linker section
ipvlan: Add the skb->mark as flow4's member to lookup route
bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown
scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
iio: fix kernel-doc build errors
iio: proximity: sx9500: Assign interrupt from GpioIo()
md/raid1/10: add missed blk plug
phylink: ensure we take the link down when phylink_stop() is called
sfp: fix RX_LOS signal handling
sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune
md/raid5: correct degraded calculation in raid5_error
IB/core: Init subsys if compiled to vmlinuz-core
RDMA/cma: Make sure that PSN is not over max allowed
i40iw: Correct ARP index mask
i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE
i40iw: Allocate a sdbuf per CQP WQE
KVM: arm/arm64: Fix spinlock acquisition in vgic_set_owner
meson-gx-socinfo: Fix package id parsing
IB/hfi1: Initialize bth1 in 16B rc ack builder
pinctrl: sunxi: Fix A64 UART mux value
pinctrl: sunxi: Fix A80 interrupt pin bank
gpio: davinci: Assign first bank regs for unbanked case
gpio: 74x164: Fix crash during .remove()
net: mvpp2: allocate zeroed tx descriptors
media: ov13858: Select V4L2_FWNODE
media: s5k6aa: describe some function parameters
trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list
kvm: arm: don't treat unavailable HYP mode as an error
pinctrl: denverton: Fix UART2 RTS pin mode
perf test: Fix test 21 for s390x
perf bench numa: Fixup discontiguous/sparse numa nodes
perf top: Fix window dimensions change handling
perf: Fix header.size for namespace events
perf test shell: Fix check open filename arg using 'perf trace' on s390x
perf annotate: Do not truncate instruction names at 6 chars
perf help: Fix a bug during strstart() conversion
perf record: Fix -c/-F options for cpu event aliases
ARM: dts: am437x-cm-t43: Correct the dmas property of spi0
ARM: dts: am4372: Correct the interrupts_properties of McASP
ARM: dts: logicpd-somlv: Fix wl127x pinmux
ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet
ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
serdev: fix receive_buf return value when no callback
usb: build drivers/usb/common/ when USB_SUPPORT is set
usbip: keep usbip_device sockfd state in sync with tcp_socket
staging: iio: ad5933: switch buffer mode to software
staging: iio: adc: ad7192: fix external frequency setting
staging: fsl-mc: fix build testing on x86
binder: replace "%p" with "%pK"
binder: check for binder_thread allocation failure in binder_poll()
staging: android: ashmem: Fix a race condition in pin ioctls
ANDROID: binder: synchronize_rcu() when using POLLFREE.
ANDROID: binder: remove WARN() for redundant txn error
dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
arm64: dts: add #cooling-cells to CPU nodes
ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag
video: fbdev/mmp: add MODULE_LICENSE
ASoC: ux500: add MODULE_LICENSE tag
net_sched: gen_estimator: fix lockdep splat
net: avoid skb_warn_bad_offload on IS_ERR
rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete
rds: tcp: correctly sequence cleanup on netns deletion.
netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1()
netfilter: on sockopt() acquire sock lock only in the required scope
netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
netfilter: x_tables: fix int overflow in xt_alloc_table_info()
kcov: detect double association with a single task
KVM: x86: fix escape of guest dr6 to the host
blk_rq_map_user_iov: fix error override
staging: android: ion: Switch from WARN to pr_warn
staging: android: ion: Add __GFP_NOWARN for system contig heap
crypto: x86/twofish-3way - Fix %rbp usage
media: pvrusb2: properly check endpoint types
selinux: skip bounded transition processing if the policy isn't loaded
selinux: ensure the context is NUL terminated in security_context_to_sid_core()
ptr_ring: try vmalloc() when kmalloc() fails
ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE
ALSA: bcd2000: Add a sanity check for invalid EPs
ALSA: caiaq: Add a sanity check for invalid EPs
ALSA: line6: Add a sanity check for invalid EPs
drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()
blktrace: fix unlocked registration of tracepoints
sctp: set frag_point in sctp_setsockopt_maxseg correctly
xfrm: check id proto in validate_tmpl()
xfrm: Fix stack-out-of-bounds read on socket policy lookup.
RDMA/netlink: Fix general protection fault
KVM/x86: Check input paging mode when cs.l is set
mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
xfrm: skip policies marked as dead while rehashing
xfrm: fix rcu usage in xfrm_get_type_offload
xfrm: don't call xfrm_policy_cache_flush while holding spinlock
esp: Fix GRO when the headers not fully in the linear part of the skb.
mac80211_hwsim: validate number of different channels
cfg80211: check dev_set_name() return value
bpf: mark dst unknown on inconsistent {s, u}bounds adjustments
kcm: Only allow TCP sockets to be attached to a KCM mux
kcm: Check if sk_user_data already set in kcm_attach
vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()
usb: core: Add a helper function to check the validity of EP type in URB
ANDROID: sdcardfs: Hold i_mutex for i_size_write
FROMGIT: crypto: speck - add test vectors for Speck64-XTS
FROMGIT: crypto: speck - add test vectors for Speck128-XTS
FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS
FROMGIT: crypto: speck - export common helpers
FROMGIT: crypto: speck - add support for the Speck block cipher
f2fs: updates on v4.16-rc1
Conflicts:
drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
Change-Id: I420172cd4438ce010645ceb00a71c4e3f03596d8
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
[ Upstream commit 33f801366bdf3f8b67dfe325b84f4051a090d01e ]
Currently there is race condition between set of byte_pos and wrap
it around when new buffer starts. If .pointer is called in-between
it will result in inconsistent pointer position be returned
from .pointer callback.
This patch increments buffer pointer atomically to avoid this issue.
Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reviewed-by: Takashi Sakamoto <takashi.sakamoto@miraclelinux.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
