linux.git, branch v3.12.52

Linux 3.12.52

2016-01-05T17:43:37+00:00

HID: dragonrise: fix HID Descriptor for 0x0006 PID

2016-01-05T17:39:14+00:00

commit 18339f59c3a6698ee17d32970c9e1e450b16e7c3 upstream.

Fixed HID descriptor for DragonRise Joystick.  Replaced default descriptor
which doubles Z axis and causes mixing values of X and Z axes.

Signed-off-by: Maciej Zuk 
Signed-off-by: Jiri Kosina 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

gpio/omap: raw read and write endian fix

2016-01-05T17:38:56+00:00

commit 661553b9c67c1c7496de5f603ee3d338ecad6850 upstream.

All OMAP IP blocks expect LE data, but CPU may operate in BE mode.
Need to use endian neutral functions to read/write h/w registers.
I.e instead of __raw_read[lw] and __raw_write[lw] functions code
need to use read[lw]_relaxed and write[lw]_relaxed functions.
If the first simply reads/writes register, the second will byteswap
it if host operates in BE mode.

Changes are trivial sed like replacement of __raw_xxx functions
with xxx_relaxed variant.

Signed-off-by: Victor Kamensky 
Signed-off-by: Taras Kondratiuk 
Acked-by: Tony Lindgren 
Acked-by: Kevin Hilman 
Acked-by: Santosh Shilimkar 
Tested-by: Javier Martinez Canillas 
Signed-off-by: Linus Walleij 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

PM / devfreq: Fix incorrect type issue.

2016-01-05T17:38:22+00:00

commit 5f25f066f75a67835abb5e400471a27abd09395b upstream.

time_in_state in struct devfreq is defined as unsigned long, so
devm_kzalloc should use sizeof(unsigned long) as argument instead
of sizeof(unsigned int), otherwise it will cause unexpected result
in 64bit system.

Signed-off-by: Xiaolong Ye 
Signed-off-by: Kevin Liu 
Signed-off-by: MyungJoo Ham 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

PM / devfreq: Fix governor_store()

2016-01-05T17:37:46+00:00

commit 14a21e7ba8cf6eab968310c92ca19a00f13ce3d9 upstream.

Writing the currently set governor into sysfs currently
seems to fail.
Fix this by setting the return code to zero before
leaving governor_store().

Signed-off-by: Tobias Jakobi 
Signed-off-by: MyungJoo Ham 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

cdrom: Random writing support for BD-RE media

2016-01-05T17:36:52+00:00

commit f7e7868b4743f1cc5e59e6e0ddd3ccf9cfe53a1b upstream.

Recently, i bought a blu-ray writer and noticed that while cdrecord
worked perfectly, random writing didn't work on rewritable bd-re media.
For example, dd if=/dev/zero of=/dev/sr0 bs=32768 count=2 gave the usual
"read-only file system" message.

After checking if the problem lies with my burner or firmware, i grep-ed
the kernel source for EROFS. One of the results was in the cdrom driver.

I tried to follow the function chain and ended in the cdrom_is_dvd_rw
function where writing is permitted only for DVD-RAM and DVD+RW media.
I added a new case label for 0x43 which is the profile name of BD-RE
and now it works correctly for BD-RE too.

Maybe there is a better way of implementing this, like a new function
checking for blu-ray support and called from cdrom_open_write like
it happens for mrw and dvdram media, but adding the case label worked.

Thank you for your time.

Signed-off-by: Jens Axboe 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

i2c: i801: add Intel Lewisburg device IDs

2016-01-05T17:35:58+00:00

commit cdc5a3110e7c3ae793f367285789a6bc39c962dc upstream.

Adding Intel codename Lewisburg platform device IDs for SMBus.

Signed-off-by: Alexandra Yates 
Reviewed-by: Jean Delvare 
Signed-off-by: Wolfram Sang 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

i2c: i801: Add support for Intel Broxton

2016-01-05T17:34:20+00:00

commit dd77f423e516293c37c2370b44fd700900409c48 upstream.

This patch adds the SMBUS PCI ID of Intel Broxton.

Signed-off-by: Jarkko Nikula 
Signed-off-by: Wolfram Sang 
Cc: Oliver Neukum 
Signed-off-by: Jiri Slaby

ALSA: hda - Disable 64bit address for Creative HDA controllers

2016-01-05T17:28:21+00:00

commit cadd16ea33a938d49aee99edd4758cc76048b399 upstream.

We've had many reports that some Creative sound cards with CA0132
don't work well.  Some reported that it starts working after reloading
the module, while some reported it starts working when a 32bit kernel
is used.  All these facts seem implying that the chip fails to
communicate when the buffer is located in 64bit address.

This patch addresses these issues by just adding AZX_DCAPS_NO_64BIT
flag to the corresponding PCI entries.  I casually had a chance to
test an SB Recon3D board, and indeed this seems helping.

Although this hasn't been tested on all Creative devices, it's safer
to assume that this restriction applies to the rest of them, too.  So
the flag is applied to all Creative entries.

Signed-off-by: Takashi Iwai 
Signed-off-by: Jiri Slaby

RDS: fix race condition when sending a message on unbound socket

2016-01-05T17:26:39+00:00

commit 8c7188b23474cca017b3ef354c4a58456f68303a upstream.

Sasha's found a NULL pointer dereference in the RDS connection code when
sending a message to an apparently unbound socket.  The problem is caused
by the code checking if the socket is bound in rds_sendmsg(), which checks
the rs_bound_addr field without taking a lock on the socket.  This opens a
race where rs_bound_addr is temporarily set but where the transport is not
in rds_bind(), leading to a NULL pointer dereference when trying to
dereference 'trans' in __rds_conn_create().

Vegard wrote a reproducer for this issue, so kindly ask him to share if
you're interested.

I cannot reproduce the NULL pointer dereference using Vegard's reproducer
with this patch, whereas I could without.

Complete earlier incomplete fix to CVE-2015-6937:

  74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection")

Cc: David S. Miller 

Reviewed-by: Vegard Nossum 
Reviewed-by: Sasha Levin 
Acked-by: Santosh Shilimkar 
Signed-off-by: Quentin Casasnovas 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby