linux-stable.git, branch v3.17.7

Linux 3.17.7

2014-12-16T17:37:26+00:00

ALSA: usb-audio: Don't resubmit pending URBs at MIDI error recovery

2014-12-16T17:37:12+00:00

commit 66139a48cee1530c91f37c145384b4ee7043f0b7 upstream.

In snd_usbmidi_error_timer(), the driver tries to resubmit MIDI input
URBs to reactivate the MIDI stream, but this causes the error when
some of URBs are still pending like:

 WARNING: CPU: 0 PID: 0 at ../drivers/usb/core/urb.c:339 usb_submit_urb+0x5f/0x70()
 URB ef705c40 submitted while active
 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.16.6-2-desktop #1
 Hardware name: FOXCONN TPS01/TPS01, BIOS 080015  03/23/2010
  c0984bfa f4009ed4 c078deaf f4009ee4 c024c884 c09a135c f4009f00 00000000
  c0984bfa 00000153 c061ac4f c061ac4f 00000009 00000001 ef705c40 e854d1c0
  f4009eec c024c8d3 00000009 f4009ee4 c09a135c f4009f00 f4009f04 c061ac4f
 Call Trace:
  [] try_stack_unwind+0x156/0x170
  [] dump_trace+0x5a/0x1b0
  [] show_trace_log_lvl+0x46/0x50
  [] show_stack_log_lvl+0x51/0xe0
  [] show_stack+0x27/0x50
  [] dump_stack+0x45/0x65
  [] warn_slowpath_common+0x84/0xa0
  [] warn_slowpath_fmt+0x33/0x40
  [] usb_submit_urb+0x5f/0x70
  [] snd_usbmidi_submit_urb+0x14/0x60 [snd_usbmidi_lib]
  [] snd_usbmidi_error_timer+0x6a/0xa0 [snd_usbmidi_lib]
  [] call_timer_fn+0x30/0x130
  [] run_timer_softirq+0x1c2/0x260
  [] __do_softirq+0xc3/0x270
  [] do_softirq_own_stack+0x22/0x30
  [] irq_exit+0x8d/0xa0
  [] smp_apic_timer_interrupt+0x38/0x50
  [] apic_timer_interrupt+0x34/0x3c
  [] cpuidle_enter_state+0x3e/0xd0
  [] cpu_idle_loop+0x29d/0x3e0
  [] cpu_startup_entry+0x53/0x60
  [] start_kernel+0x415/0x41a

For avoiding these errors, check the pending URBs and skip
resubmitting such ones.

Reported-and-tested-by: Stefan Seyfried 
Acked-by: Clemens Ladisch 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Fix built-in mic at resume on Lenovo Ideapad S210

2014-12-16T17:37:12+00:00

commit fedb2245cbb8d823e449ebdd48ba9bb35c071ce0 upstream.

The built-in mic boost volume gets almost muted after suspend/resume
on Lenovo Ideapad S210.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88121
Reported-and-tested-by: Roman Kagan 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Add EAPD fixup for ASUS Z99He laptop

2014-12-16T17:37:11+00:00

commit f62f5eff3d40a56ad1cf0d81a6cac8dd8743e8a1 upstream.

The same fixup to enable EAPD is needed for ASUS Z99He with AD1986A
codec like another ASUS machine.

Reported-and-tested-by: Dmitry V. Zimin 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

drm/radeon: sync all BOs involved in a CS v2

2014-12-16T17:37:11+00:00

commit 86b276385c6a986872e4cd144f5940b156053c3f upstream.

Not just the userspace relocs, otherwise we won't wait
for a swapped out page tables to be swapped in again.

v2: rebased on Alex current drm-fixes-3.18

Signed-off-by: Christian König 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

Revert: ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC

2014-12-16T17:37:11+00:00

This reverts commit 2dbfff81a40b5b2be553042ad5c767e34fdd214c, which
really is commit 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 upstream.

Sorry for the confusion, this got applied twice, and reverted once, this
is the second revert and I hope to never touch it again...

Reported-by: Lv Zheng 
Cc: Alexander Mezin 
Cc: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

netlink: use jhash as hashfn for rhashtable

2014-12-16T17:37:11+00:00

[ Upstream commit 7f19fc5e0b617593dcda0d9956adc78b559ef1f5 ]

For netlink, we shouldn't be using arch_fast_hash() as a hashing
discipline, but rather jhash() instead.

Since netlink sockets can be opened by any user, a local attacker
would be able to easily create collisions with the DPDK-derived
arch_fast_hash(), which trades off performance for security by
using crc32 CPU instructions on x86_64.

While it might have a legimite use case in other places, it should
be avoided in netlink context, though. As rhashtable's API is very
flexible, we could later on still decide on other hashing disciplines,
if legitimate.

Reference: http://thread.gmane.org/gmane.linux.kernel/1844123
Fixes: e341694e3eb5 ("netlink: Convert netlink_lookup() to use RCU protected hash table")
Cc: Herbert Xu 
Signed-off-by: Daniel Borkmann 
Acked-by: Thomas Graf 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen-netfront: use correct linear area after linearizing an skb

2014-12-16T17:37:11+00:00

[ Upstream commit 11d3d2a16cc1f05c6ece69a4392e99efb85666a6 ]

Commit 97a6d1bb2b658ac85ed88205ccd1ab809899884d (xen-netfront: Fix
handling packets on compound pages with skb_linearize) attempted to
fix a problem where an skb that would have required too many slots
would be dropped causing TCP connections to stall.

However, it filled in the first slot using the original buffer and not
the new one and would use the wrong offset and grant access to the
wrong page.

Netback would notice the malformed request and stop all traffic on the
VIF, reporting:

    vif vif-3-0 vif3.0: txreq.offset: 85e, size: 4002, end: 6144
    vif vif-3-0 vif3.0: fatal error; disabling device

Reported-by: Anthony Wright 
Tested-by: Anthony Wright 
Signed-off-by: David Vrabel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: sctp: use MAX_HEADER for headroom reserve in output path

2014-12-16T17:37:11+00:00

[ Upstream commit 9772b54c55266ce80c639a80aa68eeb908f8ecf5 ]

To accomodate for enough headroom for tunnels, use MAX_HEADER instead
of LL_MAX_HEADER. Robert reported that he has hit after roughly 40hrs
of trinity an skb_under_panic() via SCTP output path (see reference).
I couldn't reproduce it from here, but not using MAX_HEADER as elsewhere
in other protocols might be one possible cause for this.

In any case, it looks like accounting on chunks themself seems to look
good as the skb already passed the SCTP output path and did not hit
any skb_over_panic(). Given tunneling was enabled in his .config, the
headroom would have been expanded by MAX_HEADER in this case.

Reported-by: Robert Święcki 
Reference: https://lkml.org/lkml/2014/12/1/507
Fixes: 594ccc14dfe4d ("[SCTP] Replace incorrect use of dev_alloc_skb with alloc_skb in sctp_packet_transmit().")
Signed-off-by: Daniel Borkmann 
Acked-by: Vlad Yasevich 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: mvneta: fix race condition in mvneta_tx()

2014-12-16T17:37:11+00:00

[ Upstream commit 5f478b41033606d325e420df693162e2524c2b94 ]

mvneta_tx() dereferences skb to get skb->len too late,
as hardware might have completed the transmit and TX completion
could have freed the skb from another cpu.

Fixes: 71f6d1b31fb1 ("net: mvneta: replace Tx timer with a real interrupt")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman