1. 05 Feb, 2016 3 commits
    • Linus Torvalds's avatar
      Merge tag 'media/v4.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · dd6f86af
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
       - vb2: fix a vb2_thread regression and DVB read() breakages
       - vsp1: fix compilation and links creation
       - s5k6a3: Fix VIDIOC_SUBDEV_G_FMT ioctl for TRY format
       - exynos4-is: fix a build issue, format negotiation and sensor detection
       - Fix a regression with pvrusb2 and ir-kbd-i2c
       - atmel-isi: fix debug message which only show the first format
       - tda1004x: fix a tuning bug if G_PROPERTY is called too early
       - saa7134-alsa: fix a bug at device unbinding/driver removal
       - Fix build of one driver if !HAS_DMA
       - soc_camera: cleanup control device on async_unbind
      
      * tag 'media/v4.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] saa7134-alsa: Only frees registered sound cards
        [media] vb2-core: call threadio->fnc() if !VB2_BUF_STATE_ERROR
        [media] vb2: fix nasty vb2_thread regression
        [media] tda1004x: only update the frontend properties if locked
        [media] media: i2c: Don't export ir-kbd-i2c module alias
        [media] exynos4-is: make VIDEO_SAMSUNG_EXYNOS4_IS tristate
        [media] media: Kconfig: add dependency of HAS_DMA
        [media] exynos4-is: Wait for 100us before opening sensor
        [media] exynos4-is: Open shouldn't fail when sensor entity is not linked
        [media] s5k6a3: Fix VIDIOC_SUBDEV_G_FMT ioctl for TRY format
        [media] exynos4-is: fix a format string bug
        [media] drivers/media: vsp1_video: fix compile error
        [media] atmel-isi: fix debug message which only show the first format
        [media] soc_camera: cleanup control device on async_unbind
        [media] v4l: vsp1: Fix wrong entities links creation
      dd6f86af
    • Linus Torvalds's avatar
      Merge tag 'sound-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ea5a273c
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "This was a busy week and I had to prepare a pile of duct tapes for the
        bugs reported by syzkaller fuzzer in wide range of ALSA core APIs:
        timer, rawmidi, sequencer, and PCM OSS emulation.  Let's see how many
        other holes we need to plug.
      
        Besides that, a few usual boring stuff, HD- and USB-audio quirks, have
        been added"
      
      * tag 'sound-4.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: timer: Fix leftover link at closing
        ALSA: seq: Fix lockdep warnings due to double mutex locks
        ALSA: rawmidi: Fix race at copying & updating the position
        ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
        ALSA: hda - Add fixup for Mac Mini 7,1 model
        ALSA: hda/realtek - Support headset mode for ALC225
        ALSA: hda/realtek - Support Dell headset mode for ALC225
        ALSA: hda/realtek - New codec support of ALC225
        ALSA: timer: Sync timer deletion at closing the system timer
        ALSA: timer: Fix link corruption due to double start or stop
        ALSA: seq: Fix yet another races among ALSA timer accesses
        ALSA: pcm: Fix potential deadlock in OSS emulation
        ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
        ALSA: seq: Fix race at closing in virmidi driver
        ALSA: emu10k1: correctly handling failed thread creation
        ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
        ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
        ALSA: usb-audio: Fix OPPO HA-1 vendor ID
      ea5a273c
    • Linus Torvalds's avatar
      Merge git://www.linux-watchdog.org/linux-watchdog · ed1741b7
      Linus Torvalds authored
      Pull watchdog fixes from Wim Van Sebroeck:
       "This fixes several Kconfig dependencies, a compilation warning in
        pcwd_usb, a failure to abort the sp805 wdt after a ping and the
        max63xx wdt's MODULE_LICENSE"
      
      * git://www.linux-watchdog.org/linux-watchdog:
        watchdog: Fix dependencies for !HAS_IOMEM archs
        watchdog: imgdpc: select WATCHDOG_CORE
        watchdog: tango: rename ARCH_TANGOX to ARCH_TANGO
        watchdog: pcwd_usb: fix compilation warning
        watchdog: sp805: ping fails to abort wdt reset
        watchdog: max63xx: make module's license marker match the header
      ed1741b7
  2. 04 Feb, 2016 8 commits
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · df48ab3c
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "Nothing particularly interesting here, but all important fixes
        nonetheless:
      
         - Add missing PAN toggling in the futex code
      
         - Fix missing #include that briefly caused issues in -next
      
         - Allow changing of vmalloc permissions with set_memory_* (used by
           bpf)"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: asm: Explicitly include linux/personality.h in asm/page.h
        arm64: futex.h: Add missing PAN toggling
        arm64: allow vmalloc regions to be set with set_memory_*
      df48ab3c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 5787c252
      Linus Torvalds authored
      Pull MD fix from Shaohua Li:
       "As you know, Neil steps down from MD.  I'm looking after it.  Here are
        some patches queued.
      
        A build fix from Gayatri and several trival patches from me"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md-cluster: delete useless code
        md-cluster: fix missing memory free
        raid6/algos.c : bug fix : Add the missing definitions to the pq.h file
        MD: add myself as MD maintainer
        MD: rename some functions
      5787c252
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 04d740d5
      Linus Torvalds authored
      Pull rdma fixes from Doug Ledford:
       - One minor fix to the ib core
       - Four minor fixes to the Mellanox drivers
       - Remove three deprecated drivers from staging/rdma now that all of
         Greg's queued changes to them are merged
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        staging/rdma: remove deprecated ipath driver
        staging/rdma: remove deprecated ehca driver
        staging/rdma: remove deprecated amso1100 driver
        IB/core: Set correct payload length for RoCEv2 over IPv6
        IB/mlx5: Use MLX5_GET to correctly get end of padding mode
        IB/mlx5: Fix use of null pointer PD
        IB/mlx5: Fix reqlen validation in mlx5_ib_alloc_ucontext
        IB/mlx5: Add CREATE_CQ and CREATE_QP to uverbs_ex_cmd_mask
      04d740d5
    • Mauro Carvalho Chehab's avatar
      [media] saa7134-alsa: Only frees registered sound cards · ac75fe5d
      Mauro Carvalho Chehab authored
      That prevents this bug:
      [ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540
      [ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
      [ 2382.270013] PGD 0
      [ 2382.270013] Oops: 0002 [#1] SMP
      [ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops]
      [ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4
      [ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012  05/14/2008
      [ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000
      [ 2382.270013] RIP: 0010:[<ffffffffa01fe616>]  [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
      [ 2382.270013] RSP: 0018:ffff88003c767ea0  EFLAGS: 00010286
      [ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260
      [ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0
      [ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412
      [ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8
      [ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0
      [ 2382.270013] FS:  00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000
      [ 2382.270013] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0
      [ 2382.270013] Stack:
      [ 2382.270013]  000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8
      [ 2382.270013]  ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0
      [ 2382.270013]  ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c
      [ 2382.270013] Call Trace:
      [ 2382.270013]  [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa]
      [ 2382.270013]  [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0
      [ 2382.270013]  [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71
      [ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d
      [ 2382.270013] RIP  [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
      [ 2382.270013]  RSP <ffff88003c767ea0>
      [ 2382.270013] CR2: 0000000000000540
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      ac75fe5d
    • Takashi Iwai's avatar
      ALSA: timer: Fix leftover link at closing · 094fd3be
      Takashi Iwai authored
      In ALSA timer core, the active timer instance is managed in
      active_list linked list.  Each element is added / removed dynamically
      at timer start, stop and in timer interrupt.  The problem is that
      snd_timer_interrupt() has a thinko and leaves the element in
      active_list when it's the last opened element.  This eventually leads
      to list corruption or use-after-free error.
      
      This hasn't been revealed because we used to delete the list forcibly
      in snd_timer_stop() in the past.  However, the recent fix avoids the
      double-stop behavior (in commit [f784beb7: ALSA: timer: Fix link
      corruption due to double start or stop]), and this leak hits reality.
      
      This patch fixes the link management in snd_timer_interrupt().  Now it
      simply unlinks no matter which stream is.
      
      BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.comReported-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      094fd3be
    • Mauro Carvalho Chehab's avatar
      [media] vb2-core: call threadio->fnc() if !VB2_BUF_STATE_ERROR · 1f2c4501
      Mauro Carvalho Chehab authored
      changeset 70433a15 ("media: videobuf2: Refactor vb2_fileio_data
      and vb2_thread") broke videobuf2-dvb.
      
      The root cause is that, instead of calling threadio->fnc() for
      all types of events except for VB2_BUF_STATE_ERROR, it was calling
      it only for VB2_BUF_STATE_DONE.
      
      With that, the DVB thread were never called.
      
      Cc: stable@vger.kernel.org # Kernel >= 4.3
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      1f2c4501
    • Hans Verkuil's avatar
      [media] vb2: fix nasty vb2_thread regression · fac710e4
      Hans Verkuil authored
      The vb2_thread implementation was made generic and was moved from
      videobuf2-v4l2.c to videobuf2-core.c in commit af3bac1a. Unfortunately
      that clearly was never tested since it broke read() causing NULL address
      references.
      
      The root cause was confused handling of vb2_buffer vs v4l2_buffer (the pb
      pointer in various core functions).
      
      The v4l2_buffer no longer exists after moving the code into the core and
      it is no longer needed. However, the vb2_thread code passed a pointer to
      a vb2_buffer to the core functions were a v4l2_buffer pointer was expected
      and vb2_thread expected that the vb2_buffer fields would be filled in
      correctly.
      
      This is obviously wrong since v4l2_buffer != vb2_buffer. Note that the
      pb pointer is a void pointer, so no type-checking took place.
      
      This patch fixes this problem:
      
      1) allow pb to be NULL for vb2_core_(d)qbuf. The vb2_thread code will use
         a NULL pointer here since they don't care about v4l2_buffer anyway.
      2) let vb2_core_dqbuf pass back the index of the received buffer. This is
         all vb2_thread needs: this index is the index into the q->bufs array
         and vb2_thread just gets the vb2_buffer from there.
      3) the fileio->b pointer (that originally contained a v4l2_buffer) is
         removed altogether since it is no longer needed.
      
      Tested with vivid and the cobalt driver.
      
      Cc: stable@vger.kernel.org # Kernel >= 4.3
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Reported-by: default avatarMatthias Schwarzott <zzam@gentoo.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      fac710e4
    • Mauro Carvalho Chehab's avatar
      [media] tda1004x: only update the frontend properties if locked · e8beb023
      Mauro Carvalho Chehab authored
      The tda1004x was updating the properties cache before locking.
      If the device is not locked, the data at the registers are just
      random values with no real meaning.
      
      This caused the driver to fail with libdvbv5, as such library
      calls GET_PROPERTY from time to time, in order to return the
      DVB stats.
      
      Tested with a saa7134 card 78:
      	ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      e8beb023
  3. 03 Feb, 2016 29 commits