The original code doesn't take into consideration that the value of
MIXART_BA0_SIZE - pos can be less than zero which would lead to a large
unsigned value for "count".

Also I moved the check that read size is a multiple of 4 bytes below
the code that adjusts "count".
Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: <stable@kernel.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Use the call to snd_card_free in the error handling code at the end of the
function, as in the other error cases.

A simplified version of the semantic patch that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression E,E2;
@@

snd_card_free(E)
...
(
  E = E2
|
* E
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

We actually pass an array of 7 chars not 5.
This silences a smatch warning.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

BugLink: https://launchpad.net/bugs/481058

The OR has verified that both 'Headphone Jack Sense' and 'Line Jack Sense'
need to be muted for sound to be audible, so just add the machine's SSID
to the ac97 jack sense blacklist.

Reported-by: Richard Gagne
Tested-by: Richard Gagne
Cc: <stable@kernel.org>
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The commit 4d96eb25 broke the interrupt
time xrun functionality (stream stop etc.) if the CONFIG_SND_PCM_XRUN_DEBUG
is not set. This is because the xrun() is null defined without it.

Fix this by letting the function xrun() to be always defined as it was
before.
Signed-off-by: Jarkko Nikula <jhnikula@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

BugLink: https://launchpad.net/bugs/303789

This model needs both 'Headphone Jack Sense' and 'Line Jack Sense'
muted for audible audio, so just add its SSID to the blacklist and
don't enumerate the controls.
Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

When the CMI8738 FRAME2 register is read, the chip sometimes (probably
when wrapping around) returns an invalid value that would be outside the
programmed DMA buffer. This leads to an inconsistent PCM pointer that is
likely to result in an underrun.

To work around this, read the register multiple times until we get a
valid value; the error state seems to be very short-lived.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-and-tested-by: Matija Nalis <mnalis-alsadev@voyager.hr>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The constant DMA_ACTIVE is defined with the dma_buffparams structure rather
than with the audio_operations structure.  Takashi Iwai suggested that the
dmap_out field of the audio_operations structure should be used instead.

This is not tested.
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  serial: sh-sci: remove duplicated #include
  sh: Export uncached helper symbols.
  sh: Fix up NUMA build for 29-bit.
  serial: sh-sci: Fix build failure for non-sh architectures.
  sh: Fix up uncached offset for legacy 29-bit mode.
  sh: Support CPU affinity masks for INTC controllers.

* 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/dvrabel/uwb:
  uwb: remove duplicate cpu_to_le16()
  uwb: declare MODULE_FIRMWARE() in i1480 DFU driver
  uwb: make USB device id table constant
  uwb: wlp: refactor wlp_get_<attribute>() macros

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
  alpha: fix compile errors in dma-mapping-common.h
  alpha: remove trailing spaces in messages
  alpha: use __ratelimit

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Remove IOMMU_VMERGE config option
  powerpc: Fix swiotlb to respect the boot option
  powerpc: Do not call prink when CONFIG_PRINTK is not defined
  powerpc: Use correct ccr bit for syscall error status
  powerpc/fsl-booke: Get coherent bit from PTE
  powerpc/85xx: Make sure lwarx hint isn't set on ppc32

* 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
  Delete zero-length file drivers/mtd/maps/omap_nor.c

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  tty_port,usb-console: Fix usb serial console open/close regression
  tty: cpm_uart: use resource_size()
  tty_buffer: Fix distinct type warning
  hvc_console: Fix race between hvc_close and hvc_remove
  uartlite: Fix build on sparc.
  tty: Take a 256 byte padding into account when buffering below sub-page units
  Revert "tty: Add a new VT mode which is like VT_PROCESS but doesn't require a VT_RELDISP ioctl call"

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  driver core: numa: fix BUILD_BUG_ON for node_read_distance
  driver-core: document ERR_PTR() return values
  kobject: documentation: Update to refer to kset-example.c.
  sysdev: the cpu probe/release attributes should be sysdev_class_attributes
  kobject: documentation: Fix erroneous example in kobject doc.
  driver-core: fix missing kernel-doc in firmware_class
  Driver core: Early platform kernel-doc update
  sysfs: fix sysfs lockdep warning in mlx4 code
  sysfs: fix sysfs lockdep warning in infiniband code
  sysfs: fix sysfs lockdep warning in ipmi code
  sysfs: Initialised pci bus legacy_mem field before use
  sysfs: use sysfs_bin_attr_init in firmware class driver

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (45 commits)
  USB: gadget/multi: cdc_do_config: remove redundant check
  usb: r8a66597-hcd: fix removed from an attached hub
  USB: xhci: Make endpoint interval debugging clearer.
  USB: Fix usb_fill_int_urb for SuperSpeed devices
  USB: cp210x: Remove double usb_control_msg from cp210x_set_config
  USB: Remove last bit of CONFIG_USB_BERRY_CHARGE
  USB: gadget: add gadget controller number for s3c-hsotg driver
  USB: ftdi_sio: Fix locking for change_speed() function
  USB: g_mass_storage: fixed module name in Kconfig
  USB: gadget: f_mass_storage::fsg_bind(): fix error handling
  USB: g_mass_storage: fix section mismatch warnings
  USB: gadget: fix Blackfin builds after gadget cleansing
  USB: goku_udc: remove potential null dereference
  USB: option.c: Add Pirelli VID/PID and indicate Pirelli's modem interface is 0xff
  USB: serial: Fix module name typo for qcaux Kconfig entry.
  usb: cdc-wdm: Fix deadlock between write and resume
  usb: cdc-wdm: Fix order in disconnect and fix locking
  usb: cdc-wdm:Fix loss of data due to autosuspend
  usb: cdc-wdm: Fix submission of URB after suspension
  usb: cdc-wdm: Fix race between disconnect and debug messages
  ...

The content was deleted in cc87edb1,
but the file remained as a zero-length file.
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: (205 commits)
  ceph: update for write_inode API change
  ceph: reset osd after relevant messages timed out
  ceph: fix flush_dirty_caps race with caps migration
  ceph: include migrating caps in issued set
  ceph: fix osdmap decoding when pools include (removed) snaps
  ceph: return EBADF if waiting for caps on closed file
  ceph: set osd request message front length correctly
  ceph: reset front len on return to msgpool; BUG on mismatched front iov
  ceph: fix snaptrace decoding on cap migration between mds
  ceph: use single osd op reply msg
  ceph: reset bits on connection close
  ceph: remove bogus mds forward warning
  ceph: remove fragile __map_osds optimization
  ceph: fix connection fault STANDBY check
  ceph: invalidate_authorizer without con->mutex held
  ceph: don't clobber write return value when using O_SYNC
  ceph: fix client_request_forward decoding
  ceph: drop messages on unregistered mds sessions; cleanup
  ceph: fix comments, locking in destroy_inode
  ceph: move dereference after NULL test
  ...

Fix trivial conflicts in Documentation/ioctl/ioctl-number.txt

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  cifs: trivial white space
  [CIFS] checkpatch cleanup
  cifs: add cifs_revalidate_file
  cifs: add a CIFSSMBUnixQFileInfo function
  cifs: add a CIFSSMBQFileInfo function
  cifs: overhaul cifs_revalidate and rename to cifs_revalidate_dentry

cdc_do_config() had a double ret check after fsg_add().
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

fix the problem that when a USB hub is attached to the r8a66597-hcd and
a device is removed from that hub, it's likely that a kernel panic follows.
Reported-by: Markus Pietrek <Markus.Pietrek@emtrion.de>
Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The xHCI hardware can only handle polling intervals that are a power of
two.  When we add a new endpoint during a bandwidth allocation, and the
polling interval is rounded down to a power of two, print the original
polling interval in the endpoint descriptor.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB 3 and Wireless USB specify a logarithmic encoding of the endpoint
interval that matches the USB 2 specification.  usb_fill_int_urb() didn't
know that and was filling in the interval as if it was USB 1.1.  Fix
usb_fill_int_urb() for SuperSpeed devices, but leave the wireless case
alone, because David Vrabel wants to keep the old encoding.

Update the struct urb kernel doc to note that SuperSpeed URBs must have
urb->interval specified in microframes.

Add a missing break statement in the usb_submit_urb() interrupt URB
checking, since wireless USB and SuperSpeed USB encode urb->interval
differently.  This allows xHCI roothubs to actually register with khubd.
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch removes a double usb_control_msg that sets the cp210x
configuration registers a second time when calling cp210x_set_config.
For data sizes >2 the second write gets corrupted.
The patch has been created against 2.6.34-rc1, but all cp210x driver
revisions are affected.
Signed-off-by: Michael Brunner <mibru@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

One last bit was missed while removing the USB_BERRY_CHARGE config
option in a8d4211f which gets dropped
by this patch.
Signed-off-by: Christoph Egger <siccegge@stud.informatik.uni-erlangen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This prevents some drivers from complaining that no bcdDevice id was set.
Signed-off-by: Maurus Cuelenaere <mcuelenaere@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The change_speed() function should be serialized against multiple calls.
Use the cfg_lock mutex to do this.
Signed-off-by: Alessio Igor Bogani <abogani@texware.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The Kconfig help message for Mass Storage Gadget claimed the
module will be named "g_file_storage" whereas it should be
"g_mass_storage".
Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Contrary to the comment in fsg_add, fsg_bind calls fsg_unbind on errors,
which decreases refcount and frees the fsg_dev structure, causing trouble
when fsg_add does the same.

Fix it by simply leaving up cleanup to fsg_add().
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Acked-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The recent commit (0e530b45) that moved usb_ep_autoconfig from the
__devinit section to the __init section missed the mass storage device.
Its fsg_bind() function uses the usb_ep_autoconfig() function from non
__init context leading to:
WARNING: drivers/usb/gadget/g_mass_storage.o(.text): Section mismatch in
	reference from the function _fsg_bind()
	            to the function .init.text:_usb_ep_autoconfig()

So move fsg_bind() into __init as well.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The recent change to clean out dead gadget drivers (90f79768)
missed the call to gadget_is_musbhsfc() behind CONFIG_BLACKFIN.  This
causes Blackfin gadget builds to fail since the function no longer
exists anywhere.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

"dev" is always null here.  In the end it's only used to get the
pci_name() of "pdev" which is redundant information and so I
removed it.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: spark <spark@bandrich.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The module is called qcaux and not moto_modem. Also use help instead of
---help-- to be in sync with the other Kconfig entries.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The new runtime PM scheme allows resume() to have no locks.
This fixes the deadlock.
Signed-off-by: Oliver Neukum <neukum@b1-systems.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

- as the callback can schedule work, URBs must be killed first
- if the driver causes an autoresume, the caller must handle locking
Signed-off-by: Oliver Neukum <neukum@b1-systems.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The guarding flag must be set and tested under spinlock
and cleared before the URBs are resubmitted in resume.
Signed-off-by: Oliver Neukum <neukum@b1-systems.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

There's a window under which cdc-wdm may submit
an URB to a device about to be suspended. This
introduces a flag to prevent it.
Signed-off-by: Oliver Neukum <neukum@b1-systems.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

dev_dbg() and dev_err() cannot be used to report failures
that may have been caused by a device's removal
Signed-off-by: Oliver Neukum <neukum@b1-systems.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>