linux-stable.git/drivers/staging, branch v3.4.92

speakup: lower default software speech rate

2014-06-07T23:02:14+00:00

commit cfd757010691eae4e17acc246f74e7622c3a2f05 upstream.

Speech synthesis beginners need a low speech rate, and trained people
want a high speech rate.  A medium speech rate is thus actually not a
good default for neither.  Since trained people will typically know how
to change the rate, better default for a low speech rate, which
beginners can grasp and learn how to increase it afterwards

This was agreed with users on the speakup mailing list.

Signed-off-by: Samuel Thibault 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
Cc: Qiang Huang 
Signed-off-by: Greg Kroah-Hartman

Staging: zram: Fix access of NULL pointer

2014-06-07T23:02:06+00:00

commit 46a51c80216cb891f271ad021f59009f34677499 upstream.

This patch fixes the bug in reset_store caused by accessing NULL pointer.

The bdev gets its value from bdget_disk() which could fail when memory
pressure is severe and hence can return NULL because allocation of
inode in bdget could fail.

Hence, this patch introduces a check for bdev to prevent reference to a
NULL pointer in the later part of the code. It also removes unnecessary
check of bdev for fsync_bdev().

Acked-by: Jerome Marchand 
Signed-off-by: Rashika Kheria 
Acked-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

zram: allow request end to coincide with disksize

2014-06-07T23:02:06+00:00

commit 75c7caf5a052ffd8db3312fa7864ee2d142890c4 upstream.

Pass valid_io_request() checks if request end coincides with disksize
(end equals bound), only fail if we attempt to read beyond the bound.

mkfs.ext2 produces numerous errors:
[ 2164.632747] quiet_error: 1 callbacks suppressed
[ 2164.633260] Buffer I/O error on device zram0, logical block 153599
[ 2164.633265] lost page write due to I/O error on zram0

Signed-off-by: Sergey Senozhatsky 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

zram: avoid access beyond the zram device

2014-06-07T23:02:06+00:00

commit 12a7ad3b810e77137d0caf97a6dd97591e075b30 upstream.

Function valid_io_request() should verify the entire request are within
the zram device address range. Otherwise it may cause invalid memory
access when accessing/modifying zram->meta->table[index] because the
'index' is out of range. Then it may access non-exist memory, randomly
modify memory belong to other subsystems, which is hard to track down.

Signed-off-by: Jiang Liu 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

zram: destroy all devices on error recovery path in zram_init()

2014-06-07T23:02:06+00:00

commit 39a9b8ac9333e4268ecff7da6c9d1ab3823ff243 upstream.

On error recovery path of zram_init(), it leaks the zram device object
causing the failure. So change create_device() to free allocated
resources on error path.

Signed-off-by: Jiang Liu 
Acked-by: Minchan Kim 
Acked-by: Jerome Marchand 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

zram: avoid invalid memory access in zram_exit()

2014-06-07T23:02:06+00:00

commit 6030ea9b35971a4200062f010341ab832e878ac9 upstream.

Memory for zram->disk object may have already been freed after returning
from destroy_device(zram), then it's unsafe for zram_reset_device(zram)
to access zram->disk again.

We can't solve this bug by flipping the order of destroy_device(zram)
and zram_reset_device(zram), that will cause deadlock issues to the
zram sysfs handler.

So fix it by holding an extra reference to zram->disk before calling
destroy_device(zram).

Signed-off-by: Jiang Liu 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

zram: Fix deadlock bug in partial read/write

2014-06-07T23:02:06+00:00

commit 7e5a5104c6af709a8d97d5f4711e7c917761d464 upstream.

Now zram allocates new page with GFP_KERNEL in zram I/O path
if IO is partial. Unfortunately, It may cause deadlock with
reclaim path like below.

write_page from fs
fs_lock
allocation(GFP_KERNEL)
reclaim
pageout
				write_page from fs
				fs_lock <-- deadlock

This patch fixes it by using GFP_NOIO.  In read path, we
reorganize code flow so that kmap_atomic is called after the
GFP_NOIO allocation.

Acked-by: Jerome Marchand 
Acked-by: Nitin Gupta 
[ penberg@kernel.org: don't use GFP_ATOMIC ]
Signed-off-by: Pekka Enberg 
Signed-off-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: no reordering is needed in the read path]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

skb: Add inline helper for getting the skb end offset from head

2014-06-07T23:02:00+00:00

[ Upstream commit ec47ea82477404631d49b8e568c71826c9b663ac ]

With the recent changes for how we compute the skb truesize it occurs to me
we are probably going to have a lot of calls to skb_end_pointer -
skb->head.  Instead of running all over the place doing that it would make
more sense to just make it a separate inline skb_end_offset(skb) that way
we can return the correct value without having gcc having to do all the
optimization to cancel out skb->head - skb->head.

Signed-off-by: Alexander Duyck 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0

2014-05-06T14:51:41+00:00

commit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.

Zero-initializing ether_type masked that the ether type would never be
obtained for 8021x packets and the comparison against eapol_type
would always fail.

Reported-by: Jes Sorensen 
Signed-off-by: Larry Finger 
Signed-off-by: Greg Kroah-Hartman

staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer

2014-05-06T14:51:41+00:00

commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.

This patch fixes the following sparse warning :
drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer

Signed-off-by: Himangi Saraogi 
Signed-off-by: Greg Kroah-Hartman