1. 06 Feb, 2016 2 commits
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 9b108828
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Fixes all over the place:
      
         - amdkfd: two static checker fixes
         - mst: a bunch of static checker and spec/hw interaction fixes
         - amdgpu: fix Iceland hw properly, and some fiji bugs, along with
           some write-combining fixes.
         - exynos: some regression fixes
         - adv7511: fix some EDID reading issues"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (38 commits)
        drm/dp/mst: deallocate payload on port destruction
        drm/dp/mst: Reverse order of MST enable and clearing VC payload table.
        drm/dp/mst: move GUID storage from mgr, port to only mst branch
        drm/dp/mst: change MST detection scheme
        drm/dp/mst: Calculate MST PBN with 31.32 fixed point
        drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil
        drm/mst: Add range check for max_payloads during init
        drm/mst: Don't ignore the MST PBN self-test result
        drm: fix missing reference counting decrease
        drm/amdgpu: disable uvd and vce clockgating on Fiji
        drm/amdgpu: remove exp hardware support from iceland
        drm/amdgpu: load MEC ucode manually on iceland
        drm/amdgpu: don't load MEC2 on topaz
        drm/amdgpu: drop topaz support from gmc8 module
        drm/amdgpu: pull topaz gmc bits into gmc_v7
        drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above
        drm/amdgpu: iceland use CI based MC IP
        drm/amdgpu: move gmc7 support out of CIK dependency
        drm/amdgpu/gfx7: enable cp inst/reg error interrupts
        drm/amdgpu/gfx8: enable cp inst/reg error interrupts
        ...
      9b108828
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 22f60701
      Linus Torvalds authored
      Pull power management and ACPI fixes from Rafael Wysocki:
       "These are: a fix for a recently introduced false-positive warnings
        about PM domain pointers being changed inappropriately (harmless but
        annoying), an MCH size workaround quirk for one more platform, a
        compiler warning fix (generic power domains framework), an ACPI LPSS
        (Intel SoCs) driver fixup and a cleanup of the ACPI CPPC core code.
      
        Specifics:
      
         - PM core fix to avoid false-positive warnings generated when the
           pm_domain field is cleared for a device that appears to be bound to
           a driver (Rafael Wysocki).
      
         - New MCH size workaround quirk for Intel Haswell-ULT (Josh Boyer).
      
         - Fix for an "unused function" compiler warning in the generic power
           domains framework (Ulf Hansson).
      
         - Fixup for the ACPI driver for Intel SoCs (acpi-lpss) to set the PM
           domain pointer of a device properly in one place that was
           overlooked by a recent PM core update (Andy Shevchenko).
      
         - Removal of a redundant function declaration in the ACPI CPPC core
           code (Timur Tabi)"
      
      * tag 'pm+acpi-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        PM: Avoid false-positive warnings in dev_pm_domain_set()
        PM / Domains: Silence compiler warning for an unused function
        ACPI / CPPC: remove redundant mbox_send_message() declaration
        ACPI / LPSS: set PM domain via helper setter
        PNP: Add Haswell-ULT to Intel MCH size workaround
      22f60701
  2. 05 Feb, 2016 20 commits
  3. 04 Feb, 2016 8 commits
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · df48ab3c
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "Nothing particularly interesting here, but all important fixes
        nonetheless:
      
         - Add missing PAN toggling in the futex code
      
         - Fix missing #include that briefly caused issues in -next
      
         - Allow changing of vmalloc permissions with set_memory_* (used by
           bpf)"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: asm: Explicitly include linux/personality.h in asm/page.h
        arm64: futex.h: Add missing PAN toggling
        arm64: allow vmalloc regions to be set with set_memory_*
      df48ab3c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 5787c252
      Linus Torvalds authored
      Pull MD fix from Shaohua Li:
       "As you know, Neil steps down from MD.  I'm looking after it.  Here are
        some patches queued.
      
        A build fix from Gayatri and several trival patches from me"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md-cluster: delete useless code
        md-cluster: fix missing memory free
        raid6/algos.c : bug fix : Add the missing definitions to the pq.h file
        MD: add myself as MD maintainer
        MD: rename some functions
      5787c252
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 04d740d5
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       - One minor fix to the ib core
       - Four minor fixes to the Mellanox drivers
       - Remove three deprecated drivers from staging/rdma now that all of
         Greg's queued changes to them are merged
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        staging/rdma: remove deprecated ipath driver
        staging/rdma: remove deprecated ehca driver
        staging/rdma: remove deprecated amso1100 driver
        IB/core: Set correct payload length for RoCEv2 over IPv6
        IB/mlx5: Use MLX5_GET to correctly get end of padding mode
        IB/mlx5: Fix use of null pointer PD
        IB/mlx5: Fix reqlen validation in mlx5_ib_alloc_ucontext
        IB/mlx5: Add CREATE_CQ and CREATE_QP to uverbs_ex_cmd_mask
      04d740d5
    • Mauro Carvalho Chehab's avatar
      [media] saa7134-alsa: Only frees registered sound cards · ac75fe5d
      Mauro Carvalho Chehab authored
      That prevents this bug:
      [ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540
      [ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
      [ 2382.270013] PGD 0
      [ 2382.270013] Oops: 0002 [#1] SMP
      [ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops]
      [ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4
      [ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012  05/14/2008
      [ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000
      [ 2382.270013] RIP: 0010:[<ffffffffa01fe616>]  [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
      [ 2382.270013] RSP: 0018:ffff88003c767ea0  EFLAGS: 00010286
      [ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260
      [ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0
      [ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412
      [ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8
      [ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0
      [ 2382.270013] FS:  00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000
      [ 2382.270013] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0
      [ 2382.270013] Stack:
      [ 2382.270013]  000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8
      [ 2382.270013]  ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0
      [ 2382.270013]  ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c
      [ 2382.270013] Call Trace:
      [ 2382.270013]  [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa]
      [ 2382.270013]  [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0
      [ 2382.270013]  [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71
      [ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d
      [ 2382.270013] RIP  [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
      [ 2382.270013]  RSP <ffff88003c767ea0>
      [ 2382.270013] CR2: 0000000000000540
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      ac75fe5d
    • Takashi Iwai's avatar
      ALSA: timer: Fix leftover link at closing · 094fd3be
      Takashi Iwai authored
      In ALSA timer core, the active timer instance is managed in
      active_list linked list.  Each element is added / removed dynamically
      at timer start, stop and in timer interrupt.  The problem is that
      snd_timer_interrupt() has a thinko and leaves the element in
      active_list when it's the last opened element.  This eventually leads
      to list corruption or use-after-free error.
      
      This hasn't been revealed because we used to delete the list forcibly
      in snd_timer_stop() in the past.  However, the recent fix avoids the
      double-stop behavior (in commit [f784beb7: ALSA: timer: Fix link
      corruption due to double start or stop]), and this leak hits reality.
      
      This patch fixes the link management in snd_timer_interrupt().  Now it
      simply unlinks no matter which stream is.
      
      BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.comReported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      094fd3be
    • Mauro Carvalho Chehab's avatar
      [media] vb2-core: call threadio->fnc() if !VB2_BUF_STATE_ERROR · 1f2c4501
      Mauro Carvalho Chehab authored
      changeset 70433a15 ("media: videobuf2: Refactor vb2_fileio_data
      and vb2_thread") broke videobuf2-dvb.
      
      The root cause is that, instead of calling threadio->fnc() for
      all types of events except for VB2_BUF_STATE_ERROR, it was calling
      it only for VB2_BUF_STATE_DONE.
      
      With that, the DVB thread were never called.
      
      Cc: stable@vger.kernel.org # Kernel >= 4.3
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      1f2c4501
    • Hans Verkuil's avatar
      [media] vb2: fix nasty vb2_thread regression · fac710e4
      Hans Verkuil authored
      The vb2_thread implementation was made generic and was moved from
      videobuf2-v4l2.c to videobuf2-core.c in commit af3bac1a. Unfortunately
      that clearly was never tested since it broke read() causing NULL address
      references.
      
      The root cause was confused handling of vb2_buffer vs v4l2_buffer (the pb
      pointer in various core functions).
      
      The v4l2_buffer no longer exists after moving the code into the core and
      it is no longer needed. However, the vb2_thread code passed a pointer to
      a vb2_buffer to the core functions were a v4l2_buffer pointer was expected
      and vb2_thread expected that the vb2_buffer fields would be filled in
      correctly.
      
      This is obviously wrong since v4l2_buffer != vb2_buffer. Note that the
      pb pointer is a void pointer, so no type-checking took place.
      
      This patch fixes this problem:
      
      1) allow pb to be NULL for vb2_core_(d)qbuf. The vb2_thread code will use
         a NULL pointer here since they don't care about v4l2_buffer anyway.
      2) let vb2_core_dqbuf pass back the index of the received buffer. This is
         all vb2_thread needs: this index is the index into the q->bufs array
         and vb2_thread just gets the vb2_buffer from there.
      3) the fileio->b pointer (that originally contained a v4l2_buffer) is
         removed altogether since it is no longer needed.
      
      Tested with vivid and the cobalt driver.
      
      Cc: stable@vger.kernel.org # Kernel >= 4.3
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Reported-by: default avatarMatthias Schwarzott <zzam@gentoo.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      fac710e4
    • Mauro Carvalho Chehab's avatar
      [media] tda1004x: only update the frontend properties if locked · e8beb023
      Mauro Carvalho Chehab authored
      The tda1004x was updating the properties cache before locking.
      If the device is not locked, the data at the registers are just
      random values with no real meaning.
      
      This caused the driver to fail with libdvbv5, as such library
      calls GET_PROPERTY from time to time, in order to return the
      DVB stats.
      
      Tested with a saa7134 card 78:
      	ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      e8beb023
  4. 03 Feb, 2016 10 commits