.39 patches

8 files changed, 327 insertions, 0 deletions

diff --git a/queue-2.6.39/asoc-correct-wm8994-micbias-supply-widget-hookup.patch b/queue-2.6.39/asoc-correct-wm8994-micbias-supply-widget-hookup.patch
new file mode 100644
index 0000000000..0d6d3b496c
--- /dev/null
+++ b/queue-2.6.39/asoc-correct-wm8994-micbias-supply-widget-hookup.patch
@@ -0,0 +1,46 @@
+From b793eb60a01d5b5e4aaeb2fbc2b036dec0d9f84d Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 14 Jul 2011 18:21:37 +0900
+Subject: ASoC: Correct WM8994 MICBIAS supply widget hookup
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit b793eb60a01d5b5e4aaeb2fbc2b036dec0d9f84d upstream.
+
+The WM8994 and WM8958 series of devices have two MICBIAS supplies rather
+than one, the current widget actually manages the microphone detection
+control register bit (which is managed separately by the relevant API).
+
+Fix this, hooking the relevant supplies up to the MICBIAS1 and MICBIAS2
+widgets.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -1446,7 +1446,6 @@ SND_SOC_DAPM_INPUT("DMIC1DAT"),
+ SND_SOC_DAPM_INPUT("DMIC2DAT"),
+ SND_SOC_DAPM_INPUT("Clock"),
+ 
+-SND_SOC_DAPM_MICBIAS("MICBIAS", WM8994_MICBIAS, 2, 0),
+ SND_SOC_DAPM_SUPPLY_S("MICBIAS Supply", 1, SND_SOC_NOPM, 0, 0, micbias_ev,
+ 		      SND_SOC_DAPM_PRE_PMU),
+ 
+@@ -1765,8 +1764,10 @@ static const struct snd_soc_dapm_route w
+ 	{ "AIF2DACDAT", NULL, "AIF1DACDAT" },
+ 	{ "AIF1ADCDAT", NULL, "AIF2ADCDAT" },
+ 	{ "AIF2ADCDAT", NULL, "AIF1ADCDAT" },
+-	{ "MICBIAS", NULL, "CLK_SYS" },
+-	{ "MICBIAS", NULL, "MICBIAS Supply" },
++	{ "MICBIAS1", NULL, "CLK_SYS" },
++	{ "MICBIAS1", NULL, "MICBIAS Supply" },
++	{ "MICBIAS2", NULL, "CLK_SYS" },
++	{ "MICBIAS2", NULL, "MICBIAS Supply" },
+ };
+ 
+ static const struct snd_soc_dapm_route wm8994_intercon[] = {
diff --git a/queue-2.6.39/asoc-fix-shift-in-wm8958-accessory-detection-default.patch b/queue-2.6.39/asoc-fix-shift-in-wm8958-accessory-detection-default.patch
new file mode 100644
index 0000000000..67a603b7d1
--- /dev/null
+++ b/queue-2.6.39/asoc-fix-shift-in-wm8958-accessory-detection-default.patch
@@ -0,0 +1,28 @@
+From b35e160a111aa9ae3fad6294e038be20d0da721b Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 15 Jul 2011 22:28:32 +0900
+Subject: ASoC: Fix shift in WM8958 accessory detection default
+ implementation
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit b35e160a111aa9ae3fad6294e038be20d0da721b upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -3021,7 +3021,7 @@ static void wm8958_default_micdet(u16 st
+ 	report = SND_JACK_MICROPHONE;
+ 
+ 	/* Everything else is buttons; just assign slots */
+-	if (status & 0x1c0)
++	if (status & 0x1c)
+ 		report |= SND_JACK_BTN_0;
+ 
+ done:
diff --git a/queue-2.6.39/hwmon-asus_atk0110-fix-memory-leak.patch b/queue-2.6.39/hwmon-asus_atk0110-fix-memory-leak.patch
new file mode 100644
index 0000000000..483247f7c4
--- /dev/null
+++ b/queue-2.6.39/hwmon-asus_atk0110-fix-memory-leak.patch
@@ -0,0 +1,30 @@
+From 0b8e77f12cb6bfe2e5a67f2cdc8c7af23abc4ccf Mon Sep 17 00:00:00 2001
+From: Luca Tettamanti <kronos.it@gmail.com>
+Date: Sun, 17 Jul 2011 18:39:18 +0200
+Subject: hwmon: (asus_atk0110) Fix memory leak
+
+From: Luca Tettamanti <kronos.it@gmail.com>
+
+commit 0b8e77f12cb6bfe2e5a67f2cdc8c7af23abc4ccf upstream.
+
+The object returned by atk_gitm is dynamically allocated and must be
+freed.
+
+Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/asus_atk0110.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/asus_atk0110.c
++++ b/drivers/hwmon/asus_atk0110.c
+@@ -673,6 +673,7 @@ static int atk_debugfs_gitm_get(void *p,
+ 	else
+ 		err = -EIO;
+ 
++	ACPI_FREE(ret);
+ 	return err;
+ }
+ 
diff --git a/queue-2.6.39/hwmon-it87-fix-label-group-removal.patch b/queue-2.6.39/hwmon-it87-fix-label-group-removal.patch
new file mode 100644
index 0000000000..019cb0a2aa
--- /dev/null
+++ b/queue-2.6.39/hwmon-it87-fix-label-group-removal.patch
@@ -0,0 +1,33 @@
+From fa8b69758e65b406c8010936b541cd00deef804d Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sun, 17 Jul 2011 18:39:19 +0200
+Subject: hwmon: (it87) Fix label group removal
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit fa8b69758e65b406c8010936b541cd00deef804d upstream.
+
+A copy-and-paste error caused it87_attributes_vid to be referenced
+where it87_attributes_label should be. Thankfully the group is only
+used for attribute removal, not attribute creation, so the effects of
+this bug are limited, but let's fix it still.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/it87.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -1535,7 +1535,7 @@ static struct attribute *it87_attributes
+ };
+ 
+ static const struct attribute_group it87_group_label = {
+-	.attrs = it87_attributes_vid,
++	.attrs = it87_attributes_label,
+ };
+ 
+ /* SuperIO detection - will change isa_address if a chip is found */
diff --git a/queue-2.6.39/hwmon-max1111-fix-race-condition-causing-null-pointer-exception.patch b/queue-2.6.39/hwmon-max1111-fix-race-condition-causing-null-pointer-exception.patch
new file mode 100644
index 0000000000..15e1e38ca7
--- /dev/null
+++ b/queue-2.6.39/hwmon-max1111-fix-race-condition-causing-null-pointer-exception.patch
@@ -0,0 +1,80 @@
+From d3f684f2820a7f42acef68bea6622d9032127fb2 Mon Sep 17 00:00:00 2001
+From: Pavel Herrmann <morpheus.ibis@gmail.com>
+Date: Sun, 17 Jul 2011 18:39:19 +0200
+Subject: hwmon: (max1111) Fix race condition causing NULL pointer exception
+
+From: Pavel Herrmann <morpheus.ibis@gmail.com>
+
+commit d3f684f2820a7f42acef68bea6622d9032127fb2 upstream.
+
+spi_sync call uses its spi_message parameter to keep completion information,
+using a drvdata structure is not thread-safe. Use a mutex to prevent
+multiple access to shared driver data.
+
+Signed-off-by: Pavel Herrmann <morpheus.ibis@gmail.com>
+Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Marek Vasut <marek.vasut@gmail.com>
+Acked-by: Cyril Hrubis <metan@ucw.cz>
+Tested-by: Stanislav Brabec <utx@penguin.cz>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/max1111.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/hwmon/max1111.c
++++ b/drivers/hwmon/max1111.c
+@@ -40,6 +40,8 @@ struct max1111_data {
+ 	struct spi_transfer	xfer[2];
+ 	uint8_t *tx_buf;
+ 	uint8_t *rx_buf;
++	struct mutex		drvdata_lock;
++	/* protect msg, xfer and buffers from multiple access */
+ };
+ 
+ static int max1111_read(struct device *dev, int channel)
+@@ -48,6 +50,9 @@ static int max1111_read(struct device *d
+ 	uint8_t v1, v2;
+ 	int err;
+ 
++	/* writing to drvdata struct is not thread safe, wait on mutex */
++	mutex_lock(&data->drvdata_lock);
++
+ 	data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) |
+ 		MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 |
+ 		MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR;
+@@ -55,12 +60,15 @@ static int max1111_read(struct device *d
+ 	err = spi_sync(data->spi, &data->msg);
+ 	if (err < 0) {
+ 		dev_err(dev, "spi_sync failed with %d\n", err);
++		mutex_unlock(&data->drvdata_lock);
+ 		return err;
+ 	}
+ 
+ 	v1 = data->rx_buf[0];
+ 	v2 = data->rx_buf[1];
+ 
++	mutex_unlock(&data->drvdata_lock);
++
+ 	if ((v1 & 0xc0) || (v2 & 0x3f))
+ 		return -EINVAL;
+ 
+@@ -176,6 +184,8 @@ static int __devinit max1111_probe(struc
+ 	if (err)
+ 		goto err_free_data;
+ 
++	mutex_init(&data->drvdata_lock);
++
+ 	data->spi = spi;
+ 	spi_set_drvdata(spi, data);
+ 
+@@ -213,6 +223,7 @@ static int __devexit max1111_remove(stru
+ 
+ 	hwmon_device_unregister(data->hwmon_dev);
+ 	sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
++	mutex_destroy(&data->drvdata_lock);
+ 	kfree(data->rx_buf);
+ 	kfree(data->tx_buf);
+ 	kfree(data);
diff --git a/queue-2.6.39/revert-v4l-dvb-cx23885-enable-message-signaled-interrupts-msi.patch b/queue-2.6.39/revert-v4l-dvb-cx23885-enable-message-signaled-interrupts-msi.patch
new file mode 100644
index 0000000000..d147cb70a5
--- /dev/null
+++ b/queue-2.6.39/revert-v4l-dvb-cx23885-enable-message-signaled-interrupts-msi.patch
@@ -0,0 +1,55 @@
+From d7515b8866b60c9526d2d7af37ebcd16c3c5ed97 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Wed, 29 Jun 2011 18:36:19 -0300
+Subject: [media] Revert "V4L/DVB: cx23885: Enable Message Signaled Interrupts(MSI)"
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit d7515b8866b60c9526d2d7af37ebcd16c3c5ed97 upstream.
+
+This reverts commit e38030f3ff02684eb9e25e983a03ad318a10a2ea.
+
+MSI flat-out doesn't work right on cx2388x devices yet. There are now
+multiple reports of cards that hard-lock systems when MSI is enabled,
+including my own HVR-1250 when trying to use its built-in IR receiver.
+Disable MSI and it works just fine. Similar for another user's HVR-1270.
+Issues have also been reported with the HVR-1850 when MSI is enabled,
+and the 1850 behavior sounds similar to an as-yet-undiagnosed issue I've
+seen with an 1800.
+
+CC: Steven Toth <stoth@kernellabs.com>
+CC: Kusanagi Kouichi <slash@ac.auone-net.jp>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Acked-by: Andy Walls <awalls@md.metrocast.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx23885/cx23885-core.c |    9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/video/cx23885/cx23885-core.c
++++ b/drivers/media/video/cx23885/cx23885-core.c
+@@ -2060,12 +2060,8 @@ static int __devinit cx23885_initdev(str
+ 		goto fail_irq;
+ 	}
+ 
+-	if (!pci_enable_msi(pci_dev))
+-		err = request_irq(pci_dev->irq, cx23885_irq,
+-				  IRQF_DISABLED, dev->name, dev);
+-	else
+-		err = request_irq(pci_dev->irq, cx23885_irq,
+-				  IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
++	err = request_irq(pci_dev->irq, cx23885_irq,
++			  IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
+ 	if (err < 0) {
+ 		printk(KERN_ERR "%s: can't get IRQ %d\n",
+ 		       dev->name, pci_dev->irq);
+@@ -2114,7 +2110,6 @@ static void __devexit cx23885_finidev(st
+ 
+ 	/* unregister stuff */
+ 	free_irq(pci_dev->irq, dev);
+-	pci_disable_msi(pci_dev);
+ 
+ 	cx23885_dev_unregister(dev);
+ 	v4l2_device_unregister(v4l2_dev);
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
index 0a30d405db..7d64a037dd 100644
--- a/queue-2.6.39/series
+++ b/queue-2.6.39/series
@@ -40,3 +40,10 @@ ath5k-fix-incorrect-use-of-drvdata-in-pci-suspend-resume.patch
 drm-radeon-kms-clean-up-multiple-crtc-handling-for.patch
 drm-radeon-fix-oops-in-ttm-reserve-when-pageflipping-v2.patch
 gfs2-make-sure-fallocate-bytes-is-a-multiple-of-blksize.patch
+revert-v4l-dvb-cx23885-enable-message-signaled-interrupts-msi.patch
+si4713-i2c-avoid-potential-buffer-overflow-on-si4713.patch
+asoc-correct-wm8994-micbias-supply-widget-hookup.patch
+asoc-fix-shift-in-wm8958-accessory-detection-default.patch
+hwmon-it87-fix-label-group-removal.patch
+hwmon-asus_atk0110-fix-memory-leak.patch
+hwmon-max1111-fix-race-condition-causing-null-pointer-exception.patch
diff --git a/queue-2.6.39/si4713-i2c-avoid-potential-buffer-overflow-on-si4713.patch b/queue-2.6.39/si4713-i2c-avoid-potential-buffer-overflow-on-si4713.patch
new file mode 100644
index 0000000000..3e8e376b3f
--- /dev/null
+++ b/queue-2.6.39/si4713-i2c-avoid-potential-buffer-overflow-on-si4713.patch
@@ -0,0 +1,48 @@
+From dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+Date: Sun, 17 Jul 2011 00:24:37 -0300
+Subject: si4713-i2c: avoid potential buffer overflow on si4713
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+commit dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6 upstream.
+
+While compiling it with Fedora 15, I noticed this issue:
+
+  inlined from ‘si4713_write_econtrol_string’ at drivers/media/radio/si4713-i2c.c:1065:24:
+  arch/x86/include/asm/uaccess_32.h:211:26: error: call to ‘copy_from_user_overflow’ declared with attribute error: copy_from_user() buffer size is not provably correct
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Acked-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
+Acked-by: Eduardo Valentin <edubezval@gmail.com>
+Reviewed-by: Eugene Teo <eugeneteo@kernel.sg>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/radio/si4713-i2c.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/radio/si4713-i2c.c
++++ b/drivers/media/radio/si4713-i2c.c
+@@ -1033,7 +1033,7 @@ static int si4713_write_econtrol_string(
+ 		char ps_name[MAX_RDS_PS_NAME + 1];
+ 
+ 		len = control->size - 1;
+-		if (len > MAX_RDS_PS_NAME) {
++		if (len < 0 || len > MAX_RDS_PS_NAME) {
+ 			rval = -ERANGE;
+ 			goto exit;
+ 		}
+@@ -1057,7 +1057,7 @@ static int si4713_write_econtrol_string(
+ 		char radio_text[MAX_RDS_RADIO_TEXT + 1];
+ 
+ 		len = control->size - 1;
+-		if (len > MAX_RDS_RADIO_TEXT) {
++		if (len < 0 || len > MAX_RDS_RADIO_TEXT) {
+ 			rval = -ERANGE;
+ 			goto exit;
+ 		}