/[linux-patches]/genpatches-2.6/tags/2.6.38-8/1005_linux-2.6.38.6.patch
Gentoo

Contents of /genpatches-2.6/tags/2.6.38-8/1005_linux-2.6.38.6.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1932 - (show annotations) (download) (as text)
Mon Jun 6 17:13:40 2011 UTC (7 years, 10 months ago) by mpagano
File MIME type: text/x-diff
File size: 53365 byte(s)
2.6.38-8 release
1 diff --git a/Documentation/flexible-arrays.txt b/Documentation/flexible-arrays.txt
2 index cb8a3a0..df904ae 100644
3 --- a/Documentation/flexible-arrays.txt
4 +++ b/Documentation/flexible-arrays.txt
5 @@ -66,10 +66,10 @@ trick is to ensure that any needed memory allocations are done before
6 entering atomic context, using:
7
8 int flex_array_prealloc(struct flex_array *array, unsigned int start,
9 - unsigned int end, gfp_t flags);
10 + unsigned int nr_elements, gfp_t flags);
11
12 This function will ensure that memory for the elements indexed in the range
13 -defined by start and end has been allocated. Thereafter, a
14 +defined by start and nr_elements has been allocated. Thereafter, a
15 flex_array_put() call on an element in that range is guaranteed not to
16 block.
17
18 diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
19 index 4ad8da1..af0aaeb 100644
20 --- a/arch/arm/kernel/sys_oabi-compat.c
21 +++ b/arch/arm/kernel/sys_oabi-compat.c
22 @@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
23 long err;
24 int i;
25
26 - if (nsops < 1)
27 + if (nsops < 1 || nsops > SEMOPM)
28 return -EINVAL;
29 sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
30 if (!sops)
31 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
32 index a2b9c7d..b65c707 100644
33 --- a/arch/x86/kernel/cpu/amd.c
34 +++ b/arch/x86/kernel/cpu/amd.c
35 @@ -681,7 +681,7 @@ cpu_dev_register(amd_cpu_dev);
36 */
37
38 const int amd_erratum_400[] =
39 - AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
40 + AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0x0f, 0x4, 0x2, 0xff, 0xf),
41 AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
42 EXPORT_SYMBOL_GPL(amd_erratum_400);
43
44 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
45 index 63fec15..d8a15a1 100644
46 --- a/arch/x86/kvm/svm.c
47 +++ b/arch/x86/kvm/svm.c
48 @@ -135,6 +135,8 @@ struct vcpu_svm {
49
50 u32 *msrpm;
51
52 + ulong nmi_iret_rip;
53 +
54 struct nested_state nested;
55
56 bool nmi_singlestep;
57 @@ -2653,6 +2655,7 @@ static int iret_interception(struct vcpu_svm *svm)
58 ++svm->vcpu.stat.nmi_window_exits;
59 clr_intercept(svm, INTERCEPT_IRET);
60 svm->vcpu.arch.hflags |= HF_IRET_MASK;
61 + svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
62 return 1;
63 }
64
65 @@ -3474,7 +3477,12 @@ static void svm_complete_interrupts(struct vcpu_svm *svm)
66
67 svm->int3_injected = 0;
68
69 - if (svm->vcpu.arch.hflags & HF_IRET_MASK) {
70 + /*
71 + * If we've made progress since setting HF_IRET_MASK, we've
72 + * executed an IRET and can allow NMI injection.
73 + */
74 + if ((svm->vcpu.arch.hflags & HF_IRET_MASK)
75 + && kvm_rip_read(&svm->vcpu) != svm->nmi_iret_rip) {
76 svm->vcpu.arch.hflags &= ~(HF_NMI_MASK | HF_IRET_MASK);
77 kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
78 }
79 diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
80 index bd3c61b..6a788c3 100644
81 --- a/drivers/firewire/ohci.c
82 +++ b/drivers/firewire/ohci.c
83 @@ -2163,7 +2163,6 @@ static int ohci_set_config_rom(struct fw_card *card,
84 {
85 struct fw_ohci *ohci;
86 unsigned long flags;
87 - int ret = -EBUSY;
88 __be32 *next_config_rom;
89 dma_addr_t uninitialized_var(next_config_rom_bus);
90
91 @@ -2204,22 +2203,37 @@ static int ohci_set_config_rom(struct fw_card *card,
92
93 spin_lock_irqsave(&ohci->lock, flags);
94
95 + /*
96 + * If there is not an already pending config_rom update,
97 + * push our new allocation into the ohci->next_config_rom
98 + * and then mark the local variable as null so that we
99 + * won't deallocate the new buffer.
100 + *
101 + * OTOH, if there is a pending config_rom update, just
102 + * use that buffer with the new config_rom data, and
103 + * let this routine free the unused DMA allocation.
104 + */
105 +
106 if (ohci->next_config_rom == NULL) {
107 ohci->next_config_rom = next_config_rom;
108 ohci->next_config_rom_bus = next_config_rom_bus;
109 + next_config_rom = NULL;
110 + }
111
112 - copy_config_rom(ohci->next_config_rom, config_rom, length);
113 + copy_config_rom(ohci->next_config_rom, config_rom, length);
114
115 - ohci->next_header = config_rom[0];
116 - ohci->next_config_rom[0] = 0;
117 + ohci->next_header = config_rom[0];
118 + ohci->next_config_rom[0] = 0;
119
120 - reg_write(ohci, OHCI1394_ConfigROMmap,
121 - ohci->next_config_rom_bus);
122 - ret = 0;
123 - }
124 + reg_write(ohci, OHCI1394_ConfigROMmap, ohci->next_config_rom_bus);
125
126 spin_unlock_irqrestore(&ohci->lock, flags);
127
128 + /* If we didn't use the DMA allocation, delete it. */
129 + if (next_config_rom != NULL)
130 + dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
131 + next_config_rom, next_config_rom_bus);
132 +
133 /*
134 * Now initiate a bus reset to have the changes take
135 * effect. We clean up the old config rom memory and DMA
136 @@ -2227,13 +2241,10 @@ static int ohci_set_config_rom(struct fw_card *card,
137 * controller could need to access it before the bus reset
138 * takes effect.
139 */
140 - if (ret == 0)
141 - fw_schedule_bus_reset(&ohci->card, true, true);
142 - else
143 - dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
144 - next_config_rom, next_config_rom_bus);
145
146 - return ret;
147 + fw_schedule_bus_reset(&ohci->card, true, true);
148 +
149 + return 0;
150 }
151
152 static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
153 diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
154 index 99768d9..a73f0e6 100644
155 --- a/drivers/gpu/drm/radeon/radeon_atombios.c
156 +++ b/drivers/gpu/drm/radeon/radeon_atombios.c
157 @@ -1599,9 +1599,10 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
158 memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
159 fake_edid_record->ucFakeEDIDLength);
160
161 - if (drm_edid_is_valid(edid))
162 + if (drm_edid_is_valid(edid)) {
163 rdev->mode_info.bios_hardcoded_edid = edid;
164 - else
165 + rdev->mode_info.bios_hardcoded_edid_size = edid_size;
166 + } else
167 kfree(edid);
168 }
169 }
170 diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
171 index 0eb1515..2dbba16 100644
172 --- a/drivers/i2c/busses/i2c-parport.c
173 +++ b/drivers/i2c/busses/i2c-parport.c
174 @@ -1,7 +1,7 @@
175 /* ------------------------------------------------------------------------ *
176 * i2c-parport.c I2C bus over parallel port *
177 * ------------------------------------------------------------------------ *
178 - Copyright (C) 2003-2010 Jean Delvare <khali@linux-fr.org>
179 + Copyright (C) 2003-2011 Jean Delvare <khali@linux-fr.org>
180
181 Based on older i2c-philips-par.c driver
182 Copyright (C) 1995-2000 Simon G. Vogl
183 @@ -33,6 +33,8 @@
184 #include <linux/i2c-algo-bit.h>
185 #include <linux/i2c-smbus.h>
186 #include <linux/slab.h>
187 +#include <linux/list.h>
188 +#include <linux/mutex.h>
189 #include "i2c-parport.h"
190
191 /* ----- Device list ------------------------------------------------------ */
192 @@ -43,10 +45,11 @@ struct i2c_par {
193 struct i2c_algo_bit_data algo_data;
194 struct i2c_smbus_alert_setup alert_data;
195 struct i2c_client *ara;
196 - struct i2c_par *next;
197 + struct list_head node;
198 };
199
200 -static struct i2c_par *adapter_list;
201 +static LIST_HEAD(adapter_list);
202 +static DEFINE_MUTEX(adapter_list_lock);
203
204 /* ----- Low-level parallel port access ----------------------------------- */
205
206 @@ -228,8 +231,9 @@ static void i2c_parport_attach (struct parport *port)
207 }
208
209 /* Add the new adapter to the list */
210 - adapter->next = adapter_list;
211 - adapter_list = adapter;
212 + mutex_lock(&adapter_list_lock);
213 + list_add_tail(&adapter->node, &adapter_list);
214 + mutex_unlock(&adapter_list_lock);
215 return;
216
217 ERROR1:
218 @@ -241,11 +245,11 @@ ERROR0:
219
220 static void i2c_parport_detach (struct parport *port)
221 {
222 - struct i2c_par *adapter, *prev;
223 + struct i2c_par *adapter, *_n;
224
225 /* Walk the list */
226 - for (prev = NULL, adapter = adapter_list; adapter;
227 - prev = adapter, adapter = adapter->next) {
228 + mutex_lock(&adapter_list_lock);
229 + list_for_each_entry_safe(adapter, _n, &adapter_list, node) {
230 if (adapter->pdev->port == port) {
231 if (adapter->ara) {
232 parport_disable_irq(port);
233 @@ -259,14 +263,11 @@ static void i2c_parport_detach (struct parport *port)
234
235 parport_release(adapter->pdev);
236 parport_unregister_device(adapter->pdev);
237 - if (prev)
238 - prev->next = adapter->next;
239 - else
240 - adapter_list = adapter->next;
241 + list_del(&adapter->node);
242 kfree(adapter);
243 - return;
244 }
245 }
246 + mutex_unlock(&adapter_list_lock);
247 }
248
249 static struct parport_driver i2c_parport_driver = {
250 diff --git a/drivers/media/radio/saa7706h.c b/drivers/media/radio/saa7706h.c
251 index 585680f..b1193df 100644
252 --- a/drivers/media/radio/saa7706h.c
253 +++ b/drivers/media/radio/saa7706h.c
254 @@ -376,7 +376,7 @@ static int __devinit saa7706h_probe(struct i2c_client *client,
255 v4l_info(client, "chip found @ 0x%02x (%s)\n",
256 client->addr << 1, client->adapter->name);
257
258 - state = kmalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
259 + state = kzalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
260 if (state == NULL)
261 return -ENOMEM;
262 sd = &state->sd;
263 diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
264 index 7c0d777..0991e19 100644
265 --- a/drivers/media/radio/tef6862.c
266 +++ b/drivers/media/radio/tef6862.c
267 @@ -176,7 +176,7 @@ static int __devinit tef6862_probe(struct i2c_client *client,
268 v4l_info(client, "chip found @ 0x%02x (%s)\n",
269 client->addr << 1, client->adapter->name);
270
271 - state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
272 + state = kzalloc(sizeof(struct tef6862_state), GFP_KERNEL);
273 if (state == NULL)
274 return -ENOMEM;
275 state->freq = TEF6862_LO_FREQ;
276 diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
277 index e7dc6b4..eee3957 100644
278 --- a/drivers/media/rc/imon.c
279 +++ b/drivers/media/rc/imon.c
280 @@ -46,7 +46,7 @@
281 #define MOD_AUTHOR "Jarod Wilson <jarod@wilsonet.com>"
282 #define MOD_DESC "Driver for SoundGraph iMON MultiMedia IR/Display"
283 #define MOD_NAME "imon"
284 -#define MOD_VERSION "0.9.2"
285 +#define MOD_VERSION "0.9.3"
286
287 #define DISPLAY_MINOR_BASE 144
288 #define DEVICE_NAME "lcd%d"
289 @@ -451,8 +451,9 @@ static int display_close(struct inode *inode, struct file *file)
290 }
291
292 /**
293 - * Sends a packet to the device -- this function must be called
294 - * with ictx->lock held.
295 + * Sends a packet to the device -- this function must be called with
296 + * ictx->lock held, or its unlock/lock sequence while waiting for tx
297 + * to complete can/will lead to a deadlock.
298 */
299 static int send_packet(struct imon_context *ictx)
300 {
301 @@ -982,12 +983,21 @@ static void imon_touch_display_timeout(unsigned long data)
302 * the iMON remotes, and those used by the Windows MCE remotes (which is
303 * really just RC-6), but only one or the other at a time, as the signals
304 * are decoded onboard the receiver.
305 + *
306 + * This function gets called two different ways, one way is from
307 + * rc_register_device, for initial protocol selection/setup, and the other is
308 + * via a userspace-initiated protocol change request, either by direct sysfs
309 + * prodding or by something like ir-keytable. In the rc_register_device case,
310 + * the imon context lock is already held, but when initiated from userspace,
311 + * it is not, so we must acquire it prior to calling send_packet, which
312 + * requires that the lock is held.
313 */
314 static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
315 {
316 int retval;
317 struct imon_context *ictx = rc->priv;
318 struct device *dev = ictx->dev;
319 + bool unlock = false;
320 unsigned char ir_proto_packet[] = {
321 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };
322
323 @@ -1020,6 +1030,11 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
324
325 memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet));
326
327 + if (!mutex_is_locked(&ictx->lock)) {
328 + unlock = true;
329 + mutex_lock(&ictx->lock);
330 + }
331 +
332 retval = send_packet(ictx);
333 if (retval)
334 goto out;
335 @@ -1028,6 +1043,9 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
336 ictx->pad_mouse = false;
337
338 out:
339 + if (unlock)
340 + mutex_unlock(&ictx->lock);
341 +
342 return retval;
343 }
344
345 @@ -2125,6 +2143,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
346 goto rdev_setup_failed;
347 }
348
349 + mutex_unlock(&ictx->lock);
350 return ictx;
351
352 rdev_setup_failed:
353 @@ -2196,6 +2215,7 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf,
354 goto urb_submit_failed;
355 }
356
357 + mutex_unlock(&ictx->lock);
358 return ictx;
359
360 urb_submit_failed:
361 @@ -2290,6 +2310,8 @@ static int __devinit imon_probe(struct usb_interface *interface,
362 usb_set_intfdata(interface, ictx);
363
364 if (ifnum == 0) {
365 + mutex_lock(&ictx->lock);
366 +
367 if (product == 0xffdc && ictx->rf_device) {
368 sysfs_err = sysfs_create_group(&interface->dev.kobj,
369 &imon_rf_attr_group);
370 @@ -2300,13 +2322,14 @@ static int __devinit imon_probe(struct usb_interface *interface,
371
372 if (ictx->display_supported)
373 imon_init_display(ictx, interface);
374 +
375 + mutex_unlock(&ictx->lock);
376 }
377
378 dev_info(dev, "iMON device (%04x:%04x, intf%d) on "
379 "usb<%d:%d> initialized\n", vendor, product, ifnum,
380 usbdev->bus->busnum, usbdev->devnum);
381
382 - mutex_unlock(&ictx->lock);
383 mutex_unlock(&driver_lock);
384
385 return 0;
386 diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
387 index 06f7d1d..ac4f8e0 100644
388 --- a/drivers/media/video/cx88/cx88-input.c
389 +++ b/drivers/media/video/cx88/cx88-input.c
390 @@ -283,7 +283,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
391 case CX88_BOARD_PCHDTV_HD3000:
392 case CX88_BOARD_PCHDTV_HD5500:
393 case CX88_BOARD_HAUPPAUGE_IRONLY:
394 - ir_codes = RC_MAP_HAUPPAUGE_NEW;
395 + ir_codes = RC_MAP_RC5_HAUPPAUGE_NEW;
396 ir->sampling = 1;
397 break;
398 case CX88_BOARD_WINFAST_DTV2000H:
399 diff --git a/drivers/media/video/m52790.c b/drivers/media/video/m52790.c
400 index 5e1c9a8..303ffa7 100644
401 --- a/drivers/media/video/m52790.c
402 +++ b/drivers/media/video/m52790.c
403 @@ -174,7 +174,7 @@ static int m52790_probe(struct i2c_client *client,
404 v4l_info(client, "chip found @ 0x%x (%s)\n",
405 client->addr << 1, client->adapter->name);
406
407 - state = kmalloc(sizeof(struct m52790_state), GFP_KERNEL);
408 + state = kzalloc(sizeof(struct m52790_state), GFP_KERNEL);
409 if (state == NULL)
410 return -ENOMEM;
411
412 diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c
413 index 5d4cf3b..22fa820 100644
414 --- a/drivers/media/video/tda9840.c
415 +++ b/drivers/media/video/tda9840.c
416 @@ -171,7 +171,7 @@ static int tda9840_probe(struct i2c_client *client,
417 v4l_info(client, "chip found @ 0x%x (%s)\n",
418 client->addr << 1, client->adapter->name);
419
420 - sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
421 + sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
422 if (sd == NULL)
423 return -ENOMEM;
424 v4l2_i2c_subdev_init(sd, client, &tda9840_ops);
425 diff --git a/drivers/media/video/tea6415c.c b/drivers/media/video/tea6415c.c
426 index 19621ed..827425c 100644
427 --- a/drivers/media/video/tea6415c.c
428 +++ b/drivers/media/video/tea6415c.c
429 @@ -152,7 +152,7 @@ static int tea6415c_probe(struct i2c_client *client,
430
431 v4l_info(client, "chip found @ 0x%x (%s)\n",
432 client->addr << 1, client->adapter->name);
433 - sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
434 + sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
435 if (sd == NULL)
436 return -ENOMEM;
437 v4l2_i2c_subdev_init(sd, client, &tea6415c_ops);
438 diff --git a/drivers/media/video/tea6420.c b/drivers/media/video/tea6420.c
439 index 5ea8404..f350b6c 100644
440 --- a/drivers/media/video/tea6420.c
441 +++ b/drivers/media/video/tea6420.c
442 @@ -125,7 +125,7 @@ static int tea6420_probe(struct i2c_client *client,
443 v4l_info(client, "chip found @ 0x%x (%s)\n",
444 client->addr << 1, client->adapter->name);
445
446 - sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
447 + sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
448 if (sd == NULL)
449 return -ENOMEM;
450 v4l2_i2c_subdev_init(sd, client, &tea6420_ops);
451 diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
452 index f8138c7..1aab96a 100644
453 --- a/drivers/media/video/upd64031a.c
454 +++ b/drivers/media/video/upd64031a.c
455 @@ -230,7 +230,7 @@ static int upd64031a_probe(struct i2c_client *client,
456 v4l_info(client, "chip found @ 0x%x (%s)\n",
457 client->addr << 1, client->adapter->name);
458
459 - state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
460 + state = kzalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
461 if (state == NULL)
462 return -ENOMEM;
463 sd = &state->sd;
464 diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
465 index 28e0e6b..9bbe617 100644
466 --- a/drivers/media/video/upd64083.c
467 +++ b/drivers/media/video/upd64083.c
468 @@ -202,7 +202,7 @@ static int upd64083_probe(struct i2c_client *client,
469 v4l_info(client, "chip found @ 0x%x (%s)\n",
470 client->addr << 1, client->adapter->name);
471
472 - state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
473 + state = kzalloc(sizeof(struct upd64083_state), GFP_KERNEL);
474 if (state == NULL)
475 return -ENOMEM;
476 sd = &state->sd;
477 diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
478 index b3ac6c5..9ae3dbf 100644
479 --- a/drivers/mmc/core/host.c
480 +++ b/drivers/mmc/core/host.c
481 @@ -94,7 +94,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
482 spin_unlock_irqrestore(&host->clk_lock, flags);
483 return;
484 }
485 - mutex_lock(&host->clk_gate_mutex);
486 + mmc_claim_host(host);
487 spin_lock_irqsave(&host->clk_lock, flags);
488 if (!host->clk_requests) {
489 spin_unlock_irqrestore(&host->clk_lock, flags);
490 @@ -104,7 +104,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
491 pr_debug("%s: gated MCI clock\n", mmc_hostname(host));
492 }
493 spin_unlock_irqrestore(&host->clk_lock, flags);
494 - mutex_unlock(&host->clk_gate_mutex);
495 + mmc_release_host(host);
496 }
497
498 /*
499 @@ -130,7 +130,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
500 {
501 unsigned long flags;
502
503 - mutex_lock(&host->clk_gate_mutex);
504 + mmc_claim_host(host);
505 spin_lock_irqsave(&host->clk_lock, flags);
506 if (host->clk_gated) {
507 spin_unlock_irqrestore(&host->clk_lock, flags);
508 @@ -140,7 +140,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
509 }
510 host->clk_requests++;
511 spin_unlock_irqrestore(&host->clk_lock, flags);
512 - mutex_unlock(&host->clk_gate_mutex);
513 + mmc_release_host(host);
514 }
515
516 /**
517 @@ -218,7 +218,6 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
518 host->clk_gated = false;
519 INIT_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
520 spin_lock_init(&host->clk_lock);
521 - mutex_init(&host->clk_gate_mutex);
522 }
523
524 /**
525 diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
526 index f7e622c..b1b2fc0 100644
527 --- a/drivers/mmc/host/sdhci-pci.c
528 +++ b/drivers/mmc/host/sdhci-pci.c
529 @@ -961,6 +961,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
530 host->ioaddr = pci_ioremap_bar(pdev, bar);
531 if (!host->ioaddr) {
532 dev_err(&pdev->dev, "failed to remap registers\n");
533 + ret = -ENOMEM;
534 goto release;
535 }
536
537 diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
538 index 9e15f41..5d20661 100644
539 --- a/drivers/mmc/host/sdhci.c
540 +++ b/drivers/mmc/host/sdhci.c
541 @@ -1334,6 +1334,13 @@ static void sdhci_tasklet_finish(unsigned long param)
542
543 host = (struct sdhci_host*)param;
544
545 + /*
546 + * If this tasklet gets rescheduled while running, it will
547 + * be run again afterwards but without any active request.
548 + */
549 + if (!host->mrq)
550 + return;
551 +
552 spin_lock_irqsave(&host->lock, flags);
553
554 del_timer(&host->timer);
555 @@ -1345,7 +1352,7 @@ static void sdhci_tasklet_finish(unsigned long param)
556 * upon error conditions.
557 */
558 if (!(host->flags & SDHCI_DEVICE_DEAD) &&
559 - (mrq->cmd->error ||
560 + ((mrq->cmd && mrq->cmd->error) ||
561 (mrq->data && (mrq->data->error ||
562 (mrq->data->stop && mrq->data->stop->error))) ||
563 (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
564 diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
565 index 9ab5809..dec8110 100644
566 --- a/drivers/net/atl1c/atl1c.h
567 +++ b/drivers/net/atl1c/atl1c.h
568 @@ -566,9 +566,9 @@ struct atl1c_adapter {
569 #define __AT_TESTING 0x0001
570 #define __AT_RESETTING 0x0002
571 #define __AT_DOWN 0x0003
572 - u8 work_event;
573 -#define ATL1C_WORK_EVENT_RESET 0x01
574 -#define ATL1C_WORK_EVENT_LINK_CHANGE 0x02
575 + unsigned long work_event;
576 +#define ATL1C_WORK_EVENT_RESET 0
577 +#define ATL1C_WORK_EVENT_LINK_CHANGE 1
578 u32 msg_enable;
579
580 bool have_msi;
581 diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
582 index 3824382..dffc7f7 100644
583 --- a/drivers/net/atl1c/atl1c_main.c
584 +++ b/drivers/net/atl1c/atl1c_main.c
585 @@ -325,7 +325,7 @@ static void atl1c_link_chg_event(struct atl1c_adapter *adapter)
586 }
587 }
588
589 - adapter->work_event |= ATL1C_WORK_EVENT_LINK_CHANGE;
590 + set_bit(ATL1C_WORK_EVENT_LINK_CHANGE, &adapter->work_event);
591 schedule_work(&adapter->common_task);
592 }
593
594 @@ -337,20 +337,16 @@ static void atl1c_common_task(struct work_struct *work)
595 adapter = container_of(work, struct atl1c_adapter, common_task);
596 netdev = adapter->netdev;
597
598 - if (adapter->work_event & ATL1C_WORK_EVENT_RESET) {
599 - adapter->work_event &= ~ATL1C_WORK_EVENT_RESET;
600 + if (test_and_clear_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event)) {
601 netif_device_detach(netdev);
602 atl1c_down(adapter);
603 atl1c_up(adapter);
604 netif_device_attach(netdev);
605 - return;
606 }
607
608 - if (adapter->work_event & ATL1C_WORK_EVENT_LINK_CHANGE) {
609 - adapter->work_event &= ~ATL1C_WORK_EVENT_LINK_CHANGE;
610 + if (test_and_clear_bit(ATL1C_WORK_EVENT_LINK_CHANGE,
611 + &adapter->work_event))
612 atl1c_check_link_status(adapter);
613 - }
614 - return;
615 }
616
617
618 @@ -369,7 +365,7 @@ static void atl1c_tx_timeout(struct net_device *netdev)
619 struct atl1c_adapter *adapter = netdev_priv(netdev);
620
621 /* Do the reset outside of interrupt context */
622 - adapter->work_event |= ATL1C_WORK_EVENT_RESET;
623 + set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
624 schedule_work(&adapter->common_task);
625 }
626
627 diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
628 index 9a60e41..1189d72 100644
629 --- a/drivers/net/usb/cdc_ether.c
630 +++ b/drivers/net/usb/cdc_ether.c
631 @@ -458,7 +458,7 @@ static const struct driver_info cdc_info = {
632 .manage_power = cdc_manage_power,
633 };
634
635 -static const struct driver_info mbm_info = {
636 +static const struct driver_info wwan_info = {
637 .description = "Mobile Broadband Network Device",
638 .flags = FLAG_WWAN,
639 .bind = cdc_bind,
640 @@ -469,6 +469,7 @@ static const struct driver_info mbm_info = {
641
642 /*-------------------------------------------------------------------------*/
643
644 +#define HUAWEI_VENDOR_ID 0x12D1
645
646 static const struct usb_device_id products [] = {
647 /*
648 @@ -578,8 +579,17 @@ static const struct usb_device_id products [] = {
649 }, {
650 USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
651 USB_CDC_PROTO_NONE),
652 - .driver_info = (unsigned long)&mbm_info,
653 + .driver_info = (unsigned long)&wwan_info,
654
655 +}, {
656 + /* Various Huawei modems with a network port like the UMG1831 */
657 + .match_flags = USB_DEVICE_ID_MATCH_VENDOR
658 + | USB_DEVICE_ID_MATCH_INT_INFO,
659 + .idVendor = HUAWEI_VENDOR_ID,
660 + .bInterfaceClass = USB_CLASS_COMM,
661 + .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
662 + .bInterfaceProtocol = 255,
663 + .driver_info = (unsigned long)&wwan_info,
664 },
665 { }, // END
666 };
667 diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
668 index 89546bc..1e0c1e3 100644
669 --- a/drivers/net/wireless/ath/ath9k/recv.c
670 +++ b/drivers/net/wireless/ath/ath9k/recv.c
671 @@ -533,7 +533,7 @@ bool ath_stoprecv(struct ath_softc *sc)
672 "confusing the DMA engine when we start RX up\n");
673 ATH_DBG_WARN_ON_ONCE(!stopped);
674 }
675 - return stopped || reset;
676 + return stopped && !reset;
677 }
678
679 void ath_flushrecv(struct ath_softc *sc)
680 diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
681 index 24a11b8..c13542b 100644
682 --- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
683 +++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
684 @@ -561,12 +561,17 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
685
686 hdr_len = ieee80211_hdrlen(fc);
687
688 - /* Find index into station table for destination station */
689 - sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
690 - if (sta_id == IWL_INVALID_STATION) {
691 - IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
692 - hdr->addr1);
693 - goto drop_unlock;
694 + /* For management frames use broadcast id to do not break aggregation */
695 + if (!ieee80211_is_data(fc))
696 + sta_id = ctx->bcast_sta_id;
697 + else {
698 + /* Find index into station table for destination station */
699 + sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
700 + if (sta_id == IWL_INVALID_STATION) {
701 + IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
702 + hdr->addr1);
703 + goto drop_unlock;
704 + }
705 }
706
707 IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
708 @@ -1207,12 +1212,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
709 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
710
711 tx_info = &txq->txb[txq->q.read_ptr];
712 - iwlagn_tx_status(priv, tx_info,
713 - txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
714 +
715 + if (WARN_ON_ONCE(tx_info->skb == NULL))
716 + continue;
717
718 hdr = (struct ieee80211_hdr *)tx_info->skb->data;
719 - if (hdr && ieee80211_is_data_qos(hdr->frame_control))
720 + if (ieee80211_is_data_qos(hdr->frame_control))
721 nfreed++;
722 +
723 + iwlagn_tx_status(priv, tx_info,
724 + txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
725 tx_info->skb = NULL;
726
727 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
728 diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
729 index b837c5b..1367b91 100644
730 --- a/drivers/scsi/device_handler/scsi_dh.c
731 +++ b/drivers/scsi/device_handler/scsi_dh.c
732 @@ -437,12 +437,14 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
733 unsigned long flags;
734 struct scsi_device *sdev;
735 struct scsi_device_handler *scsi_dh = NULL;
736 + struct device *dev = NULL;
737
738 spin_lock_irqsave(q->queue_lock, flags);
739 sdev = q->queuedata;
740 if (sdev && sdev->scsi_dh_data)
741 scsi_dh = sdev->scsi_dh_data->scsi_dh;
742 - if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
743 + dev = get_device(&sdev->sdev_gendev);
744 + if (!scsi_dh || !dev ||
745 sdev->sdev_state == SDEV_CANCEL ||
746 sdev->sdev_state == SDEV_DEL)
747 err = SCSI_DH_NOSYS;
748 @@ -453,12 +455,13 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
749 if (err) {
750 if (fn)
751 fn(data, err);
752 - return err;
753 + goto out;
754 }
755
756 if (scsi_dh->activate)
757 err = scsi_dh->activate(sdev, fn, data);
758 - put_device(&sdev->sdev_gendev);
759 +out:
760 + put_device(dev);
761 return err;
762 }
763 EXPORT_SYMBOL_GPL(scsi_dh_activate);
764 diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
765 index e92b77a..3834c95 100644
766 --- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
767 +++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
768 @@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
769 goto out;
770 }
771
772 + /* Check for overflow and wraparound */
773 + if (karg.data_sge_offset * 4 > ioc->request_sz ||
774 + karg.data_sge_offset > (UINT_MAX / 4)) {
775 + ret = -EINVAL;
776 + goto out;
777 + }
778 +
779 /* copy in request message frame from user */
780 if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
781 printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
782 @@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
783 Mpi2DiagBufferPostReply_t *mpi_reply;
784 int rc, i;
785 u8 buffer_type;
786 - unsigned long timeleft;
787 + unsigned long timeleft, request_size, copy_size;
788 u16 smid;
789 u16 ioc_status;
790 u8 issue_reset = 0;
791 @@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
792 return -ENOMEM;
793 }
794
795 + request_size = ioc->diag_buffer_sz[buffer_type];
796 +
797 if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
798 printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
799 "or bytes_to_read are not 4 byte aligned\n", ioc->name,
800 @@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
801 return -EINVAL;
802 }
803
804 + if (karg.starting_offset > request_size)
805 + return -EINVAL;
806 +
807 diag_data = (void *)(request_data + karg.starting_offset);
808 dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
809 "offset(%d), sz(%d)\n", ioc->name, __func__,
810 diag_data, karg.starting_offset, karg.bytes_to_read));
811
812 + /* Truncate data on requests that are too large */
813 + if ((diag_data + karg.bytes_to_read < diag_data) ||
814 + (diag_data + karg.bytes_to_read > request_data + request_size))
815 + copy_size = request_size - karg.starting_offset;
816 + else
817 + copy_size = karg.bytes_to_read;
818 +
819 if (copy_to_user((void __user *)uarg->diagnostic_data,
820 - diag_data, karg.bytes_to_read)) {
821 + diag_data, copy_size)) {
822 printk(MPT2SAS_ERR_FMT "%s: Unable to write "
823 "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
824 __func__, diag_data);
825 diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
826 index 321cf3a..ce0701d 100644
827 --- a/drivers/scsi/pmcraid.c
828 +++ b/drivers/scsi/pmcraid.c
829 @@ -3814,6 +3814,9 @@ static long pmcraid_ioctl_passthrough(
830 rc = -EFAULT;
831 goto out_free_buffer;
832 }
833 + } else if (request_size < 0) {
834 + rc = -EINVAL;
835 + goto out_free_buffer;
836 }
837
838 /* check if we have any additional command parameters */
839 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
840 index fb2bb35..415fdf2 100644
841 --- a/drivers/scsi/scsi_lib.c
842 +++ b/drivers/scsi/scsi_lib.c
843 @@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
844 static void scsi_run_queue(struct request_queue *q)
845 {
846 struct scsi_device *sdev = q->queuedata;
847 - struct Scsi_Host *shost = sdev->host;
848 + struct Scsi_Host *shost;
849 LIST_HEAD(starved_list);
850 unsigned long flags;
851
852 + /* if the device is dead, sdev will be NULL, so no queue to run */
853 + if (!sdev)
854 + return;
855 +
856 + shost = sdev->host;
857 if (scsi_target(sdev)->single_lun)
858 scsi_single_lun_run(sdev);
859
860 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
861 index 490ce21..360b7cb 100644
862 --- a/drivers/scsi/scsi_sysfs.c
863 +++ b/drivers/scsi/scsi_sysfs.c
864 @@ -322,14 +322,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
865 kfree(evt);
866 }
867
868 - if (sdev->request_queue) {
869 - sdev->request_queue->queuedata = NULL;
870 - /* user context needed to free queue */
871 - scsi_free_queue(sdev->request_queue);
872 - /* temporary expedient, try to catch use of queue lock
873 - * after free of sdev */
874 - sdev->request_queue = NULL;
875 - }
876 + /* NULL queue means the device can't be used */
877 + sdev->request_queue = NULL;
878
879 scsi_target_reap(scsi_target(sdev));
880
881 @@ -937,6 +931,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
882 if (sdev->host->hostt->slave_destroy)
883 sdev->host->hostt->slave_destroy(sdev);
884 transport_destroy_device(dev);
885 +
886 + /* cause the request function to reject all I/O requests */
887 + sdev->request_queue->queuedata = NULL;
888 +
889 + /* Freeing the queue signals to block that we're done */
890 + scsi_free_queue(sdev->request_queue);
891 put_device(dev);
892 }
893
894 diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
895 index a35fe61..7284d0c 100644
896 --- a/drivers/staging/usbip/vhci_hcd.c
897 +++ b/drivers/staging/usbip/vhci_hcd.c
898 @@ -1135,7 +1135,7 @@ static int vhci_hcd_probe(struct platform_device *pdev)
899 usbip_uerr("create hcd failed\n");
900 return -ENOMEM;
901 }
902 -
903 + hcd->has_tt = 1;
904
905 /* this is private data for vhci_hcd */
906 the_controller = hcd_to_vhci(hcd);
907 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
908 index da1d970..435f407 100644
909 --- a/fs/nfsd/vfs.c
910 +++ b/fs/nfsd/vfs.c
911 @@ -1363,7 +1363,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
912 goto out;
913 if (!(iap->ia_valid & ATTR_MODE))
914 iap->ia_mode = 0;
915 - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
916 + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
917 if (err)
918 goto out;
919
920 @@ -1385,6 +1385,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
921 if (IS_ERR(dchild))
922 goto out_nfserr;
923
924 + /* If file doesn't exist, check for permissions to create one */
925 + if (!dchild->d_inode) {
926 + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
927 + if (err)
928 + goto out;
929 + }
930 +
931 err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
932 if (err)
933 goto out;
934 diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
935 index b10e354..ce4f624 100644
936 --- a/fs/partitions/ldm.c
937 +++ b/fs/partitions/ldm.c
938 @@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
939
940 BUG_ON (!data || !frags);
941
942 + if (size < 2 * VBLK_SIZE_HEAD) {
943 + ldm_error("Value of size is to small.");
944 + return false;
945 + }
946 +
947 group = get_unaligned_be32(data + 0x08);
948 rec = get_unaligned_be16(data + 0x0C);
949 num = get_unaligned_be16(data + 0x0E);
950 @@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
951 ldm_error ("A VBLK claims to have %d parts.", num);
952 return false;
953 }
954 + if (rec >= num) {
955 + ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
956 + return false;
957 + }
958
959 list_for_each (item, frags) {
960 f = list_entry (item, struct frag, list);
961 @@ -1334,10 +1343,9 @@ found:
962
963 f->map |= (1 << rec);
964
965 - if (num > 0) {
966 - data += VBLK_SIZE_HEAD;
967 - size -= VBLK_SIZE_HEAD;
968 - }
969 + data += VBLK_SIZE_HEAD;
970 + size -= VBLK_SIZE_HEAD;
971 +
972 memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
973
974 return true;
975 diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
976 index 4d0cb12..40fa780 100644
977 --- a/fs/ubifs/log.c
978 +++ b/fs/ubifs/log.c
979 @@ -175,26 +175,6 @@ void ubifs_add_bud(struct ubifs_info *c, struct ubifs_bud *bud)
980 }
981
982 /**
983 - * ubifs_create_buds_lists - create journal head buds lists for remount rw.
984 - * @c: UBIFS file-system description object
985 - */
986 -void ubifs_create_buds_lists(struct ubifs_info *c)
987 -{
988 - struct rb_node *p;
989 -
990 - spin_lock(&c->buds_lock);
991 - p = rb_first(&c->buds);
992 - while (p) {
993 - struct ubifs_bud *bud = rb_entry(p, struct ubifs_bud, rb);
994 - struct ubifs_jhead *jhead = &c->jheads[bud->jhead];
995 -
996 - list_add_tail(&bud->list, &jhead->buds_list);
997 - p = rb_next(p);
998 - }
999 - spin_unlock(&c->buds_lock);
1000 -}
1001 -
1002 -/**
1003 * ubifs_add_bud_to_log - add a new bud to the log.
1004 * @c: UBIFS file-system description object
1005 * @jhead: journal head the bud belongs to
1006 diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
1007 index eed0fcf..d3d6d36 100644
1008 --- a/fs/ubifs/replay.c
1009 +++ b/fs/ubifs/replay.c
1010 @@ -59,6 +59,7 @@ enum {
1011 * @new_size: truncation new size
1012 * @free: amount of free space in a bud
1013 * @dirty: amount of dirty space in a bud from padding and deletion nodes
1014 + * @jhead: journal head number of the bud
1015 *
1016 * UBIFS journal replay must compare node sequence numbers, which means it must
1017 * build a tree of node information to insert into the TNC.
1018 @@ -80,6 +81,7 @@ struct replay_entry {
1019 struct {
1020 int free;
1021 int dirty;
1022 + int jhead;
1023 };
1024 };
1025 };
1026 @@ -159,6 +161,11 @@ static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
1027 err = PTR_ERR(lp);
1028 goto out;
1029 }
1030 +
1031 + /* Make sure the journal head points to the latest bud */
1032 + err = ubifs_wbuf_seek_nolock(&c->jheads[r->jhead].wbuf, r->lnum,
1033 + c->leb_size - r->free, UBI_SHORTTERM);
1034 +
1035 out:
1036 ubifs_release_lprops(c);
1037 return err;
1038 @@ -627,10 +634,6 @@ static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
1039 ubifs_assert(sleb->endpt - offs >= used);
1040 ubifs_assert(sleb->endpt % c->min_io_size == 0);
1041
1042 - if (sleb->endpt + c->min_io_size <= c->leb_size && !c->ro_mount)
1043 - err = ubifs_wbuf_seek_nolock(&c->jheads[jhead].wbuf, lnum,
1044 - sleb->endpt, UBI_SHORTTERM);
1045 -
1046 *dirty = sleb->endpt - offs - used;
1047 *free = c->leb_size - sleb->endpt;
1048
1049 @@ -653,12 +656,14 @@ out_dump:
1050 * @sqnum: sequence number
1051 * @free: amount of free space in bud
1052 * @dirty: amount of dirty space from padding and deletion nodes
1053 + * @jhead: journal head number for the bud
1054 *
1055 * This function inserts a reference node to the replay tree and returns zero
1056 * in case of success or a negative error code in case of failure.
1057 */
1058 static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
1059 - unsigned long long sqnum, int free, int dirty)
1060 + unsigned long long sqnum, int free, int dirty,
1061 + int jhead)
1062 {
1063 struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
1064 struct replay_entry *r;
1065 @@ -688,6 +693,7 @@ static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
1066 r->flags = REPLAY_REF;
1067 r->free = free;
1068 r->dirty = dirty;
1069 + r->jhead = jhead;
1070
1071 rb_link_node(&r->rb, parent, p);
1072 rb_insert_color(&r->rb, &c->replay_tree);
1073 @@ -712,7 +718,7 @@ static int replay_buds(struct ubifs_info *c)
1074 if (err)
1075 return err;
1076 err = insert_ref_node(c, b->bud->lnum, b->bud->start, b->sqnum,
1077 - free, dirty);
1078 + free, dirty, b->bud->jhead);
1079 if (err)
1080 return err;
1081 }
1082 diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
1083 index e94d962..e20cb5a 100644
1084 --- a/fs/ubifs/super.c
1085 +++ b/fs/ubifs/super.c
1086 @@ -1235,12 +1235,12 @@ static int mount_ubifs(struct ubifs_info *c)
1087 goto out_free;
1088 }
1089
1090 + err = alloc_wbufs(c);
1091 + if (err)
1092 + goto out_cbuf;
1093 +
1094 sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
1095 if (!c->ro_mount) {
1096 - err = alloc_wbufs(c);
1097 - if (err)
1098 - goto out_cbuf;
1099 -
1100 /* Create background thread */
1101 c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
1102 if (IS_ERR(c->bgt)) {
1103 @@ -1603,12 +1603,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
1104 if (err)
1105 goto out;
1106
1107 - err = alloc_wbufs(c);
1108 - if (err)
1109 - goto out;
1110 -
1111 - ubifs_create_buds_lists(c);
1112 -
1113 /* Create background thread */
1114 c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
1115 if (IS_ERR(c->bgt)) {
1116 @@ -1717,7 +1711,6 @@ static void ubifs_remount_ro(struct ubifs_info *c)
1117 if (err)
1118 ubifs_ro_mode(c, err);
1119
1120 - free_wbufs(c);
1121 vfree(c->orph_buf);
1122 c->orph_buf = NULL;
1123 vfree(c->ileb_buf);
1124 diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
1125 index 6724bf3..e893a90 100644
1126 --- a/include/drm/drm_pciids.h
1127 +++ b/include/drm/drm_pciids.h
1128 @@ -153,6 +153,7 @@
1129 {0x1002, 0x6729, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
1130 {0x1002, 0x6738, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
1131 {0x1002, 0x6739, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
1132 + {0x1002, 0x673e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
1133 {0x1002, 0x6740, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1134 {0x1002, 0x6741, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1135 {0x1002, 0x6742, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1136 @@ -185,6 +186,7 @@
1137 {0x1002, 0x688D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
1138 {0x1002, 0x6898, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
1139 {0x1002, 0x6899, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
1140 + {0x1002, 0x689b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
1141 {0x1002, 0x689c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
1142 {0x1002, 0x689d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
1143 {0x1002, 0x689e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
1144 @@ -195,7 +197,9 @@
1145 {0x1002, 0x68b0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1146 {0x1002, 0x68b8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
1147 {0x1002, 0x68b9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
1148 + {0x1002, 0x68ba, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
1149 {0x1002, 0x68be, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
1150 + {0x1002, 0x68bf, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
1151 {0x1002, 0x68c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1152 {0x1002, 0x68c1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1153 {0x1002, 0x68c7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
1154 diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
1155 index 70e4efa..ebeb2f3 100644
1156 --- a/include/linux/flex_array.h
1157 +++ b/include/linux/flex_array.h
1158 @@ -61,7 +61,7 @@ struct flex_array {
1159 struct flex_array *flex_array_alloc(int element_size, unsigned int total,
1160 gfp_t flags);
1161 int flex_array_prealloc(struct flex_array *fa, unsigned int start,
1162 - unsigned int end, gfp_t flags);
1163 + unsigned int nr_elements, gfp_t flags);
1164 void flex_array_free(struct flex_array *fa);
1165 void flex_array_free_parts(struct flex_array *fa);
1166 int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
1167 diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
1168 index bcb793e..eb792cb 100644
1169 --- a/include/linux/mmc/host.h
1170 +++ b/include/linux/mmc/host.h
1171 @@ -183,7 +183,6 @@ struct mmc_host {
1172 struct work_struct clk_gate_work; /* delayed clock gate */
1173 unsigned int clk_old; /* old clock value cache */
1174 spinlock_t clk_lock; /* lock for clk fields */
1175 - struct mutex clk_gate_mutex; /* mutex for clock gating */
1176 #endif
1177
1178 /* host specific block data */
1179 diff --git a/kernel/workqueue.c b/kernel/workqueue.c
1180 index ee6578b..7b65ae7 100644
1181 --- a/kernel/workqueue.c
1182 +++ b/kernel/workqueue.c
1183 @@ -1283,8 +1283,14 @@ __acquires(&gcwq->lock)
1184 return true;
1185 spin_unlock_irq(&gcwq->lock);
1186
1187 - /* CPU has come up inbetween, retry migration */
1188 + /*
1189 + * We've raced with CPU hot[un]plug. Give it a breather
1190 + * and retry migration. cond_resched() is required here;
1191 + * otherwise, we might deadlock against cpu_stop trying to
1192 + * bring down the CPU on non-preemptive kernel.
1193 + */
1194 cpu_relax();
1195 + cond_resched();
1196 }
1197 }
1198
1199 diff --git a/lib/flex_array.c b/lib/flex_array.c
1200 index c0ea40b..854b57b 100644
1201 --- a/lib/flex_array.c
1202 +++ b/lib/flex_array.c
1203 @@ -232,10 +232,10 @@ EXPORT_SYMBOL(flex_array_clear);
1204
1205 /**
1206 * flex_array_prealloc - guarantee that array space exists
1207 - * @fa: the flex array for which to preallocate parts
1208 - * @start: index of first array element for which space is allocated
1209 - * @end: index of last (inclusive) element for which space is allocated
1210 - * @flags: page allocation flags
1211 + * @fa: the flex array for which to preallocate parts
1212 + * @start: index of first array element for which space is allocated
1213 + * @nr_elements: number of elements for which space is allocated
1214 + * @flags: page allocation flags
1215 *
1216 * This will guarantee that no future calls to flex_array_put()
1217 * will allocate memory. It can be used if you are expecting to
1218 @@ -245,14 +245,24 @@ EXPORT_SYMBOL(flex_array_clear);
1219 * Locking must be provided by the caller.
1220 */
1221 int flex_array_prealloc(struct flex_array *fa, unsigned int start,
1222 - unsigned int end, gfp_t flags)
1223 + unsigned int nr_elements, gfp_t flags)
1224 {
1225 int start_part;
1226 int end_part;
1227 int part_nr;
1228 + unsigned int end;
1229 struct flex_array_part *part;
1230
1231 - if (start >= fa->total_nr_elements || end >= fa->total_nr_elements)
1232 + if (!start && !nr_elements)
1233 + return 0;
1234 + if (start >= fa->total_nr_elements)
1235 + return -ENOSPC;
1236 + if (!nr_elements)
1237 + return 0;
1238 +
1239 + end = start + nr_elements - 1;
1240 +
1241 + if (end >= fa->total_nr_elements)
1242 return -ENOSPC;
1243 if (elements_fit_in_base(fa))
1244 return 0;
1245 @@ -343,6 +353,8 @@ int flex_array_shrink(struct flex_array *fa)
1246 int part_nr;
1247 int ret = 0;
1248
1249 + if (!fa->total_nr_elements)
1250 + return 0;
1251 if (elements_fit_in_base(fa))
1252 return ret;
1253 for (part_nr = 0; part_nr < FLEX_ARRAY_NR_BASE_PTRS; part_nr++) {
1254 diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
1255 index ea5fa4f..a6cdc96 100644
1256 --- a/lib/xz/xz_dec_lzma2.c
1257 +++ b/lib/xz/xz_dec_lzma2.c
1258 @@ -969,6 +969,9 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
1259 */
1260 tmp = b->in[b->in_pos++];
1261
1262 + if (tmp == 0x00)
1263 + return XZ_STREAM_END;
1264 +
1265 if (tmp >= 0xE0 || tmp == 0x01) {
1266 s->lzma2.need_props = true;
1267 s->lzma2.need_dict_reset = false;
1268 @@ -1001,9 +1004,6 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
1269 lzma_reset(s);
1270 }
1271 } else {
1272 - if (tmp == 0x00)
1273 - return XZ_STREAM_END;
1274 -
1275 if (tmp > 0x02)
1276 return XZ_DATA_ERROR;
1277
1278 diff --git a/mm/memory.c b/mm/memory.c
1279 index ab88d09..8b2bb7d 100644
1280 --- a/mm/memory.c
1281 +++ b/mm/memory.c
1282 @@ -1359,7 +1359,7 @@ split_fallthrough:
1283 */
1284 mark_page_accessed(page);
1285 }
1286 - if (flags & FOLL_MLOCK) {
1287 + if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
1288 /*
1289 * The preliminary mapping check is mainly to avoid the
1290 * pointless overhead of lock_page on the ZERO_PAGE
1291 @@ -1503,10 +1503,9 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
1292 }
1293
1294 /*
1295 - * If we don't actually want the page itself,
1296 - * and it's the stack guard page, just skip it.
1297 + * For mlock, just skip the stack guard page.
1298 */
1299 - if (!pages && stack_guard_page(vma, start))
1300 + if ((gup_flags & FOLL_MLOCK) && stack_guard_page(vma, start))
1301 goto next_page;
1302
1303 do {
1304 diff --git a/mm/mlock.c b/mm/mlock.c
1305 index da23be4..c8e7790 100644
1306 --- a/mm/mlock.c
1307 +++ b/mm/mlock.c
1308 @@ -162,7 +162,7 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
1309 VM_BUG_ON(end > vma->vm_end);
1310 VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
1311
1312 - gup_flags = FOLL_TOUCH;
1313 + gup_flags = FOLL_TOUCH | FOLL_MLOCK;
1314 /*
1315 * We want to touch writable mappings with a write fault in order
1316 * to break COW, except for shared mappings because these don't COW
1317 @@ -178,9 +178,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
1318 if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC))
1319 gup_flags |= FOLL_FORCE;
1320
1321 - if (vma->vm_flags & VM_LOCKED)
1322 - gup_flags |= FOLL_MLOCK;
1323 -
1324 return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
1325 NULL, NULL, nonblocking);
1326 }
1327 diff --git a/net/can/bcm.c b/net/can/bcm.c
1328 index 092dc88..63779ab 100644
1329 --- a/net/can/bcm.c
1330 +++ b/net/can/bcm.c
1331 @@ -1427,9 +1427,14 @@ static int bcm_init(struct sock *sk)
1332 static int bcm_release(struct socket *sock)
1333 {
1334 struct sock *sk = sock->sk;
1335 - struct bcm_sock *bo = bcm_sk(sk);
1336 + struct bcm_sock *bo;
1337 struct bcm_op *op, *next;
1338
1339 + if (sk == NULL)
1340 + return 0;
1341 +
1342 + bo = bcm_sk(sk);
1343 +
1344 /* remove bcm_ops, timer, rx_unregister(), etc. */
1345
1346 unregister_netdevice_notifier(&bo->notifier);
1347 diff --git a/net/can/raw.c b/net/can/raw.c
1348 index 883e9d7..241b2b6 100644
1349 --- a/net/can/raw.c
1350 +++ b/net/can/raw.c
1351 @@ -305,7 +305,12 @@ static int raw_init(struct sock *sk)
1352 static int raw_release(struct socket *sock)
1353 {
1354 struct sock *sk = sock->sk;
1355 - struct raw_sock *ro = raw_sk(sk);
1356 + struct raw_sock *ro;
1357 +
1358 + if (!sk)
1359 + return 0;
1360 +
1361 + ro = raw_sk(sk);
1362
1363 unregister_netdevice_notifier(&ro->notifier);
1364
1365 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
1366 index 9cd73b1..40f7357 100644
1367 --- a/net/mac80211/cfg.c
1368 +++ b/net/mac80211/cfg.c
1369 @@ -1471,6 +1471,8 @@ int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
1370 enum ieee80211_smps_mode old_req;
1371 int err;
1372
1373 + lockdep_assert_held(&sdata->u.mgd.mtx);
1374 +
1375 old_req = sdata->u.mgd.req_smps;
1376 sdata->u.mgd.req_smps = smps_mode;
1377
1378 diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
1379 index 2dabdf7..bae23ad 100644
1380 --- a/net/mac80211/debugfs_netdev.c
1381 +++ b/net/mac80211/debugfs_netdev.c
1382 @@ -172,9 +172,9 @@ static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
1383 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1384 return -EOPNOTSUPP;
1385
1386 - mutex_lock(&local->iflist_mtx);
1387 + mutex_lock(&sdata->u.mgd.mtx);
1388 err = __ieee80211_request_smps(sdata, smps_mode);
1389 - mutex_unlock(&local->iflist_mtx);
1390 + mutex_unlock(&sdata->u.mgd.mtx);
1391
1392 return err;
1393 }
1394 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
1395 index 437a99e..7a79ad0 100644
1396 --- a/net/unix/af_unix.c
1397 +++ b/net/unix/af_unix.c
1398 @@ -524,6 +524,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *,
1399 int, int);
1400 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
1401 struct msghdr *, size_t);
1402 +static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
1403 + struct msghdr *, size_t, int);
1404
1405 static const struct proto_ops unix_stream_ops = {
1406 .family = PF_UNIX,
1407 @@ -583,7 +585,7 @@ static const struct proto_ops unix_seqpacket_ops = {
1408 .setsockopt = sock_no_setsockopt,
1409 .getsockopt = sock_no_getsockopt,
1410 .sendmsg = unix_seqpacket_sendmsg,
1411 - .recvmsg = unix_dgram_recvmsg,
1412 + .recvmsg = unix_seqpacket_recvmsg,
1413 .mmap = sock_no_mmap,
1414 .sendpage = sock_no_sendpage,
1415 };
1416 @@ -1695,6 +1697,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
1417 return unix_dgram_sendmsg(kiocb, sock, msg, len);
1418 }
1419
1420 +static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
1421 + struct msghdr *msg, size_t size,
1422 + int flags)
1423 +{
1424 + struct sock *sk = sock->sk;
1425 +
1426 + if (sk->sk_state != TCP_ESTABLISHED)
1427 + return -ENOTCONN;
1428 +
1429 + return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
1430 +}
1431 +
1432 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
1433 {
1434 struct unix_sock *u = unix_sk(sk);
1435 diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
1436 index 5736356..f96f09c 100644
1437 --- a/security/selinux/ss/policydb.c
1438 +++ b/security/selinux/ss/policydb.c
1439 @@ -497,7 +497,7 @@ static int policydb_index(struct policydb *p)
1440 goto out;
1441
1442 rc = flex_array_prealloc(p->type_val_to_struct_array, 0,
1443 - p->p_types.nprim - 1, GFP_KERNEL | __GFP_ZERO);
1444 + p->p_types.nprim, GFP_KERNEL | __GFP_ZERO);
1445 if (rc)
1446 goto out;
1447
1448 @@ -514,7 +514,7 @@ static int policydb_index(struct policydb *p)
1449 goto out;
1450
1451 rc = flex_array_prealloc(p->sym_val_to_name[i],
1452 - 0, p->symtab[i].nprim - 1,
1453 + 0, p->symtab[i].nprim,
1454 GFP_KERNEL | __GFP_ZERO);
1455 if (rc)
1456 goto out;
1457 @@ -2286,7 +2286,7 @@ int policydb_read(struct policydb *p, void *fp)
1458 goto bad;
1459
1460 /* preallocate so we don't have to worry about the put ever failing */
1461 - rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim - 1,
1462 + rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim,
1463 GFP_KERNEL | __GFP_ZERO);
1464 if (rc)
1465 goto bad;
1466 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
1467 index 8ff0223..24a3acb 100644
1468 --- a/sound/pci/hda/patch_realtek.c
1469 +++ b/sound/pci/hda/patch_realtek.c
1470 @@ -1774,11 +1774,11 @@ static void alc_apply_fixup(struct hda_codec *codec, int action)
1471 codec->chip_name, fix->type);
1472 break;
1473 }
1474 - if (!fix[id].chained)
1475 + if (!fix->chained)
1476 break;
1477 if (++depth > 10)
1478 break;
1479 - id = fix[id].chain_id;
1480 + id = fix->chain_id;
1481 }
1482 }
1483
1484 @@ -9932,6 +9932,7 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
1485 SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
1486 SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL),
1487 SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch),
1488 + SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG),
1489
1490 SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG),
1491 SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG),
1492 @@ -10768,7 +10769,6 @@ enum {
1493 PINFIX_LENOVO_Y530,
1494 PINFIX_PB_M5210,
1495 PINFIX_ACER_ASPIRE_7736,
1496 - PINFIX_GIGABYTE_880GM,
1497 };
1498
1499 static const struct alc_fixup alc882_fixups[] = {
1500 @@ -10800,13 +10800,6 @@ static const struct alc_fixup alc882_fixups[] = {
1501 .type = ALC_FIXUP_SKU,
1502 .v.sku = ALC_FIXUP_SKU_IGNORE,
1503 },
1504 - [PINFIX_GIGABYTE_880GM] = {
1505 - .type = ALC_FIXUP_PINS,
1506 - .v.pins = (const struct alc_pincfg[]) {
1507 - { 0x14, 0x1114410 }, /* set as speaker */
1508 - { }
1509 - }
1510 - },
1511 };
1512
1513 static struct snd_pci_quirk alc882_fixup_tbl[] = {
1514 @@ -10814,7 +10807,6 @@ static struct snd_pci_quirk alc882_fixup_tbl[] = {
1515 SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
1516 SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
1517 SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736),
1518 - SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM),
1519 {}
1520 };
1521
1522 @@ -18882,6 +18874,8 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
1523 ALC662_3ST_6ch_DIG),
1524 SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO),
1525 SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
1526 + SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
1527 + ALC662_3ST_6ch_DIG),
1528 SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13),
1529 SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG),
1530 SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA),
1531 @@ -19555,7 +19549,7 @@ enum {
1532 ALC662_FIXUP_IDEAPAD,
1533 ALC272_FIXUP_MARIO,
1534 ALC662_FIXUP_CZC_P10T,
1535 - ALC662_FIXUP_GIGABYTE,
1536 + ALC662_FIXUP_SKU_IGNORE,
1537 };
1538
1539 static const struct alc_fixup alc662_fixups[] = {
1540 @@ -19584,20 +19578,17 @@ static const struct alc_fixup alc662_fixups[] = {
1541 {}
1542 }
1543 },
1544 - [ALC662_FIXUP_GIGABYTE] = {
1545 - .type = ALC_FIXUP_PINS,
1546 - .v.pins = (const struct alc_pincfg[]) {
1547 - { 0x14, 0x1114410 }, /* set as speaker */
1548 - { }
1549 - }
1550 + [ALC662_FIXUP_SKU_IGNORE] = {
1551 + .type = ALC_FIXUP_SKU,
1552 + .v.sku = ALC_FIXUP_SKU_IGNORE,
1553 },
1554 };
1555
1556 static struct snd_pci_quirk alc662_fixup_tbl[] = {
1557 SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
1558 + SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
1559 SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
1560 SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
1561 - SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE),
1562 SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
1563 SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
1564 SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),

  ViewVC Help
Powered by ViewVC 1.1.20