diff --git a/ACPICA-Fix-regression-in-FADT-revision-checks.patch b/ACPICA-Fix-regression-in-FADT-revision-checks.patch deleted file mode 100644 index d6b590389..000000000 --- a/ACPICA-Fix-regression-in-FADT-revision-checks.patch +++ /dev/null @@ -1,58 +0,0 @@ - commit 64b3db22c04586997ab4be46dd5a5b99f8a2d390 (2.6.39), -"Remove use of unreliable FADT revision field" causes regression -for old P4 systems because now cst_control and other fields are -not reset to 0. - - The effect is that acpi_processor_power_init will notice -cst_control != 0 and a write to CST_CNT register is performed -that should not happen. As result, the system oopses after the -"No _CST, giving up" message, sometimes in acpi_ns_internalize_name, -sometimes in acpi_ns_get_type, usually at random places. May be -during migration to CPU 1 in acpi_processor_get_throttling. - - Every one of these settings help to avoid this problem: - - acpi=off - - processor.nocst=1 - - maxcpus=1 - - The fix is to update acpi_gbl_FADT.header.length after -the original value is used to check for old revisions. - -Signed-off-by: Julian Anastasov ---- - drivers/acpi/acpica/tbfadt.c | 8 ++++---- - 1 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c -index c5d8704..4c9c760 100644 ---- a/drivers/acpi/acpica/tbfadt.c -+++ b/drivers/acpi/acpica/tbfadt.c -@@ -363,10 +363,6 @@ static void acpi_tb_convert_fadt(void) - u32 address32; - u32 i; - -- /* Update the local FADT table header length */ -- -- acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt); -- - /* - * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary. - * Later code will always use the X 64-bit field. Also, check for an -@@ -408,6 +404,10 @@ static void acpi_tb_convert_fadt(void) - acpi_gbl_FADT.boot_flags = 0; - } - -+ /* Update the local FADT table header length */ -+ -+ acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt); -+ - /* - * Expand the ACPI 1.0 32-bit addresses to the ACPI 2.0 64-bit "X" - * generic address structures as necessary. Later code will always use --- -1.7.3.4 - --- -To unsubscribe from this list: send the line "unsubscribe linux-acpi" in -the body of a message to majordomo@vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html \ No newline at end of file diff --git a/acpi-ensure-thermal-limits-match-cpu-freq.patch b/acpi-ensure-thermal-limits-match-cpu-freq.patch deleted file mode 100644 index 9d97b6024..000000000 --- a/acpi-ensure-thermal-limits-match-cpu-freq.patch +++ /dev/null @@ -1,146 +0,0 @@ -From 9a056a5843ff83db987d6e18625f4a2ee64b5450 Mon Sep 17 00:00:00 2001 -From: Matthew Garrett -Date: Tue, 30 Aug 2011 10:07:24 -0400 -Subject: [PATCH] ACPI: Ensure thermal limits match CPU frequencies - -The ACPI thermal management code supports slowing down a CPU when it's -overheating. Right now that's done by choosing to run it at 100%, 75%, 50% -or 25% of full speed. However, most CPUs do not allow an arbitrary -frequency to be set and so will run at the first frequency below that value. -This doesn't match the intent of the specification, which is to drop the -frequency state by state until the temperature stabalises. Fix this up -so it uses actual frequencies rather than percentages. - -Reported by: Gene Snider -Signed-off-by: Matthew Garrett ---- - drivers/acpi/Kconfig | 1 + - drivers/acpi/processor_thermal.c | 45 +++++++++++++++++++++---------------- - 2 files changed, 26 insertions(+), 20 deletions(-) - -diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig -index de0e3df..7d1bdb5 100644 ---- a/drivers/acpi/Kconfig -+++ b/drivers/acpi/Kconfig -@@ -185,6 +185,7 @@ config ACPI_PROCESSOR - tristate "Processor" - select THERMAL - select CPU_IDLE -+ select CPU_FREQ_TABLE - default y - help - This driver installs ACPI as the idle handler for Linux and uses -diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c -index 870550d..1c4eb60 100644 ---- a/drivers/acpi/processor_thermal.c -+++ b/drivers/acpi/processor_thermal.c -@@ -52,10 +52,8 @@ ACPI_MODULE_NAME("processor_thermal"); - * _any_ cpufreq driver and not only the acpi-cpufreq driver. - */ - --#define CPUFREQ_THERMAL_MIN_STEP 0 --#define CPUFREQ_THERMAL_MAX_STEP 3 - --static DEFINE_PER_CPU(unsigned int, cpufreq_thermal_reduction_pctg); -+static DEFINE_PER_CPU(unsigned int, cpufreq_thermal_limit_state); - static unsigned int acpi_thermal_cpufreq_is_init = 0; - - static int cpu_has_cpufreq(unsigned int cpu) -@@ -70,19 +68,19 @@ static int acpi_thermal_cpufreq_notifier(struct notifier_block *nb, - unsigned long event, void *data) - { - struct cpufreq_policy *policy = data; -- unsigned long max_freq = 0; -+ int state = per_cpu(cpufreq_thermal_limit_state, policy->cpu); -+ struct cpufreq_frequency_table *table; - - if (event != CPUFREQ_ADJUST) -- goto out; -+ return 0; -+ -+ table = cpufreq_frequency_get_table(policy->cpu); - -- max_freq = ( -- policy->cpuinfo.max_freq * -- (100 - per_cpu(cpufreq_thermal_reduction_pctg, policy->cpu) * 20) -- ) / 100; -+ if (!table) -+ return 0; - -- cpufreq_verify_within_limits(policy, 0, max_freq); -+ cpufreq_verify_within_limits(policy, 0, table[state].frequency); - -- out: - return 0; - } - -@@ -92,10 +90,21 @@ static struct notifier_block acpi_thermal_cpufreq_notifier_block = { - - static int cpufreq_get_max_state(unsigned int cpu) - { -+ int count = 0; -+ struct cpufreq_frequency_table *table; -+ - if (!cpu_has_cpufreq(cpu)) - return 0; - -- return CPUFREQ_THERMAL_MAX_STEP; -+ table = cpufreq_frequency_get_table(cpu); -+ -+ if (!table) -+ return 0; -+ -+ while (table[count].frequency != CPUFREQ_TABLE_END) -+ count++; -+ -+ return count; - } - - static int cpufreq_get_cur_state(unsigned int cpu) -@@ -103,7 +112,7 @@ static int cpufreq_get_cur_state(unsigned int cpu) - if (!cpu_has_cpufreq(cpu)) - return 0; - -- return per_cpu(cpufreq_thermal_reduction_pctg, cpu); -+ return per_cpu(cpufreq_thermal_limit_state, cpu); - } - - static int cpufreq_set_cur_state(unsigned int cpu, int state) -@@ -111,7 +120,7 @@ static int cpufreq_set_cur_state(unsigned int cpu, int state) - if (!cpu_has_cpufreq(cpu)) - return 0; - -- per_cpu(cpufreq_thermal_reduction_pctg, cpu) = state; -+ per_cpu(cpufreq_thermal_limit_state, cpu) = state; - cpufreq_update_policy(cpu); - return 0; - } -@@ -122,7 +131,7 @@ void acpi_thermal_cpufreq_init(void) - - for (i = 0; i < nr_cpu_ids; i++) - if (cpu_present(i)) -- per_cpu(cpufreq_thermal_reduction_pctg, i) = 0; -+ per_cpu(cpufreq_thermal_limit_state, i) = 0; - - i = cpufreq_register_notifier(&acpi_thermal_cpufreq_notifier_block, - CPUFREQ_POLICY_NOTIFIER); -@@ -170,15 +179,11 @@ int acpi_processor_get_limit_info(struct acpi_processor *pr) - return 0; - } - --/* thermal coolign device callbacks */ -+/* thermal cooling device callbacks */ - static int acpi_processor_max_state(struct acpi_processor *pr) - { - int max_state = 0; - -- /* -- * There exists four states according to -- * cpufreq_thermal_reduction_ptg. 0, 1, 2, 3 -- */ - max_state += cpufreq_get_max_state(pr->id); - if (pr->flags.throttling) - max_state += (pr->throttling.state_count -1); --- -1.7.6 - diff --git a/drivers-media-update.patch b/drivers-media-update.patch index 5d5612b72..f08a5d5cf 100644 --- a/drivers-media-update.patch +++ b/drivers-media-update.patch @@ -10439,51 +10439,15 @@ Index: linux-3.3.x86_64/drivers/media/dvb/dvb-core/dvb_frontend.c =================================================================== --- linux-3.3.x86_64.orig/drivers/media/dvb/dvb-core/dvb_frontend.c +++ linux-3.3.x86_64/drivers/media/dvb/dvb-core/dvb_frontend.c -@@ -143,10 +143,12 @@ struct dvb_frontend_private { - static void dvb_frontend_wakeup(struct dvb_frontend *fe); - static int dtv_get_frontend(struct dvb_frontend *fe, - struct dvb_frontend_parameters *p_out); -+static int dtv_property_legacy_params_sync(struct dvb_frontend *fe, -+ struct dvb_frontend_parameters *p); - +@@ -148,7 +148,7 @@ static int dtv_property_legacy_params_sy + static bool has_get_frontend(struct dvb_frontend *fe) { - return fe->ops.get_frontend; + return fe->ops.get_frontend != NULL; } - + /* -@@ -655,6 +657,8 @@ restart: - dprintk("%s: Retune requested, FESTATE_RETUNE\n", __func__); - re_tune = true; - fepriv->state = FESTATE_TUNED; -+ } else { -+ re_tune = false; - } - - if (fe->ops.tune) -@@ -695,6 +699,7 @@ restart: - fepriv->algo_status |= DVBFE_ALGO_SEARCH_AGAIN; - fepriv->delay = HZ / 2; - } -+ dtv_property_legacy_params_sync(fe, &fepriv->parameters_out); - fe->ops.read_status(fe, &s); - if (s != fepriv->status) { - dvb_frontend_add_event(fe, s); /* update event list */ -@@ -1831,6 +1836,13 @@ static int dtv_set_frontend(struct dvb_f - return -EINVAL; - - /* -+ * Initialize output parameters to match the values given by -+ * the user. FE_SET_FRONTEND triggers an initial frontend event -+ * with status = 0, which copies output parameters to userspace. -+ */ -+ dtv_property_legacy_params_sync(fe, &fepriv->parameters_out); -+ -+ /* - * Be sure that the bandwidth will be filled for all - * non-satellite systems, as tuners need to know what - * low pass/Nyquist half filter should be applied, in Index: linux-3.3.x86_64/drivers/media/common/tuners/xc5000.c =================================================================== --- linux-3.3.x86_64.orig/drivers/media/common/tuners/xc5000.c diff --git a/iwlegacy-do-not-nulify-il-vif-on-reset.patch b/iwlegacy-do-not-nulify-il-vif-on-reset.patch deleted file mode 100644 index d1913d708..000000000 --- a/iwlegacy-do-not-nulify-il-vif-on-reset.patch +++ /dev/null @@ -1,77 +0,0 @@ -This il->vif is dereferenced in different part of iwlegacy code, so do -not nullify it. This should fix random crashes observed in companion -with microcode errors i.e. crash in il3945_config_ap(). - -Additionally this should address also -WARNING: at drivers/net/wireless/iwlegacy/common.c:4656 il_mac_remove_interface -at least one of the possible reasons of that warning. - -Cc: stable@vger.kernel.org -Signed-off-by: Stanislaw Gruszka ---- - drivers/net/wireless/iwlegacy/3945-mac.c | 2 -- - drivers/net/wireless/iwlegacy/4965-mac.c | 2 -- - drivers/net/wireless/iwlegacy/common.c | 15 ++++++++++++--- - 3 files changed, 12 insertions(+), 7 deletions(-) - ---- linux-3.3.noarch.orig/drivers/net/wireless/iwlegacy/3945-mac.c -+++ linux-3.3.noarch/drivers/net/wireless/iwlegacy/3945-mac.c -@@ -2684,7 +2684,6 @@ il3945_bg_restart(struct work_struct *da - - if (test_and_clear_bit(S_FW_ERROR, &il->status)) { - mutex_lock(&il->mutex); -- il->ctx.vif = NULL; - il->is_open = 0; - mutex_unlock(&il->mutex); - il3945_down(il); ---- linux-3.3.noarch.orig/drivers/net/wireless/iwlegacy/4965-mac.c -+++ linux-3.3.noarch/drivers/net/wireless/iwlegacy/4965-mac.c -@@ -5381,7 +5381,6 @@ il4965_bg_restart(struct work_struct *da - - if (test_and_clear_bit(S_FW_ERROR, &il->status)) { - mutex_lock(&il->mutex); -- il->ctx.vif = NULL; - il->is_open = 0; - - __il4965_down(il); ---- linux-3.3.noarch.orig/drivers/net/wireless/iwlegacy/common.c -+++ linux-3.3.noarch/drivers/net/wireless/iwlegacy/common.c -@@ -4575,6 +4575,7 @@ il_mac_add_interface(struct ieee80211_hw - struct il_priv *il = hw->priv; - struct il_vif_priv *vif_priv = (void *)vif->drv_priv; - int err; -+ bool reset; - u32 modes; - - D_MAC80211("enter: type %d, addr %pM\n", vif->type, vif->addr); -@@ -4594,6 +4595,16 @@ il_mac_add_interface(struct ieee80211_hw - goto out; - } - -+ /* -+ * We do not support multiple virtual interfaces, but on hardware reset -+ * we have to add the same interface again. -+ */ -+ reset = (il->ctx.vif == vif); -+ if (il->ctx.vif && !reset) { -+ err = -EOPNOTSUPP; -+ goto out; -+ } -+ - modes = il->ctx.interface_modes | il->ctx.exclusive_interface_modes; - if (!(modes & BIT(vif->type))) { - err = -EOPNOTSUPP; -@@ -4605,8 +4616,11 @@ il_mac_add_interface(struct ieee80211_hw - - err = il_setup_interface(il, &il->ctx); - if (err) { -- il->ctx.vif = NULL; -- il->iw_mode = NL80211_IFTYPE_STATION; -+ IL_WARN("Fail to set mode %d\n", vif->type); -+ if (!reset) { -+ il->ctx.vif = NULL; -+ il->iw_mode = NL80211_IFTYPE_STATION; -+ } - } - - out: diff --git a/kernel.spec b/kernel.spec index 9cb272199..1df7ce9c3 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 6 +%global baserelease 1 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -66,7 +66,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 1 +%define stable_update 2 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -651,7 +651,6 @@ Patch383: linux-2.6-defaults-aspm.patch Patch390: linux-2.6-defaults-acpi-video.patch Patch391: linux-2.6-acpi-video-dos.patch Patch394: linux-2.6-acpi-debug-infinite-loop.patch -Patch395: acpi-ensure-thermal-limits-match-cpu-freq.patch Patch396: acpi-sony-nonvs-blacklist.patch Patch450: linux-2.6-input-kill-stupid-messages.patch @@ -754,15 +753,9 @@ Patch21235: scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch Patch21250: mcelog-rcu-splat.patch Patch21270: x86-Avoid-invoking-RCU-when-CPU-is-idle.patch -#rhbz 727865 730007 -Patch21300: ACPICA-Fix-regression-in-FADT-revision-checks.patch - #rhbz 728478 Patch21302: sony-laptop-Enable-keyboard-backlight-by-default.patch -#rhbz 804007 -Patch21305: mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch - #rhbz 804957 CVE-2012-1568 Patch21306: shlib_base_randomize.patch @@ -771,11 +764,7 @@ Patch21351: x86-add-io_apic_ops-to-allow-interception.patch Patch21352: x86-apic_ops-Replace-apic_ops-with-x86_apic_ops.patch Patch21353: xen-x86-Implement-x86_apic_ops.patch -#rhbz 806433 -Patch21360: uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch - #rhbz 770476 -Patch21370: iwlegacy-do-not-nulify-il-vif-on-reset.patch Patch21371: iwlwifi-do-not-nulify-ctx-vif-on-reset.patch #rhbz 808603 @@ -790,8 +779,6 @@ Patch21391: x86-Use-correct-byte-sized-register-constraint-in-__add.patch Patch21400: unhandled-irqs-switch-to-polling.patch -Patch21501: nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch - #rhbz 808207 CVE-2012-1601 Patch21520: KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch @@ -1383,7 +1370,6 @@ ApplyPatch NFSv4-Further-reduce-the-footprint-of-the-idmapper.patch ApplyPatch linux-2.6-defaults-acpi-video.patch ApplyPatch linux-2.6-acpi-video-dos.patch ApplyPatch linux-2.6-acpi-debug-infinite-loop.patch -ApplyPatch acpi-ensure-thermal-limits-match-cpu-freq.patch ApplyPatch acpi-sony-nonvs-blacklist.patch # @@ -1499,15 +1485,9 @@ ApplyPatch scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch ApplyPatch mcelog-rcu-splat.patch -#rhbz 727865 730007 -ApplyPatch ACPICA-Fix-regression-in-FADT-revision-checks.patch - #rhbz 728478 ApplyPatch sony-laptop-Enable-keyboard-backlight-by-default.patch -#rhbz 804007 -ApplyPatch mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch - #rhbz 804957 CVE-2012-1568 ApplyPatch shlib_base_randomize.patch @@ -1521,20 +1501,14 @@ ApplyPatch x86-apic_ops-Replace-apic_ops-with-x86_apic_ops.patch ApplyPatch xen-x86-Implement-x86_apic_ops.patch #rhbz 770476 -ApplyPatch iwlegacy-do-not-nulify-il-vif-on-reset.patch ApplyPatch iwlwifi-do-not-nulify-ctx-vif-on-reset.patch #Highbank clock functions ApplyPatch highbank-export-clock-functions.patch -ApplyPatch nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch - #rhbz 808207 CVE-2012-1601 ApplyPatch KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch -#rhbz 806433 -ApplyPatch uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch - #rhbz 808603 ApplyPatch wimax-i2400m-prevent-a-possible-kernel-bug-due-to-mi.patch @@ -2392,6 +2366,9 @@ fi # '-' | | # '-' %changelog +* Fri Apr 13 2012 Josh Boyer - 3.3.2-1 +- Linux 3.3.2 + * Thu Apr 12 2012 Dennis Gilmore - KALLSYMS_EXTRA_PASS=1 has to be passed in on the command line so do so only for arm diff --git a/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch b/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch deleted file mode 100644 index accda8afc..000000000 --- a/mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch +++ /dev/null @@ -1,42 +0,0 @@ -Is possible that we will arm the tid_rx->reorder_timer after -del_timer_sync() in ___ieee80211_stop_rx_ba_session(). We need to stop -timer after RCU grace period finish, so move it to -ieee80211_free_tid_rx(). Timer will not be armed again, as -rcu_dereference(sta->ampdu_mlme.tid_rx[tid]) will return NULL. - -Debug object detected problem with the following warning: -ODEBUG: free active (active state 0) object type: timer_list hint: sta_rx_agg_reorder_timer_expired+0x0/0xf0 [mac80211] - -Bug report (with all warning messages): -https://bugzilla.redhat.com/show_bug.cgi?id=804007 - -Reported-by: "jan p. springer" -Cc: stable@vger.kernel.org -Signed-off-by: Stanislaw Gruszka ---- - net/mac80211/agg-rx.c | 3 ++- - 1 files changed, 2 insertions(+), 1 deletions(-) - -diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c -index 1068f66..64d3ce5 100644 ---- a/net/mac80211/agg-rx.c -+++ b/net/mac80211/agg-rx.c -@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h) - container_of(h, struct tid_ampdu_rx, rcu_head); - int i; - -+ del_timer_sync(&tid_rx->reorder_timer); -+ - for (i = 0; i < tid_rx->buf_size; i++) - dev_kfree_skb(tid_rx->reorder_buf[i]); - kfree(tid_rx->reorder_buf); -@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, - tid, WLAN_BACK_RECIPIENT, reason); - - del_timer_sync(&tid_rx->session_timer); -- del_timer_sync(&tid_rx->reorder_timer); - - call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx); - } --- -1.7.1 diff --git a/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch b/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch deleted file mode 100644 index 981f1f467..000000000 --- a/nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 20e0fa98b751facf9a1101edaefbc19c82616a68 Mon Sep 17 00:00:00 2001 -From: Sachin Prabhu -Date: Thu, 22 Mar 2012 16:46:28 +0000 -Subject: [PATCH] Fix length of buffer copied in __nfs4_get_acl_uncached - -_copy_from_pages() used to copy data from the temporary buffer to the -user passed buffer is passed the wrong size parameter when copying -data. res.acl_len contains both the bitmap and acl lenghts while -acl_len contains the acl length after adjusting for the bitmap size. - -Signed-off-by: Sachin Prabhu -Signed-off-by: Trond Myklebust ---- - fs/nfs/nfs4proc.c | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index e809d23..45df7d4 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -3712,7 +3712,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu - if (acl_len > buflen) - goto out_free; - _copy_from_pages(buf, pages, res.acl_data_offset, -- res.acl_len); -+ acl_len); - } - ret = acl_len; - out_free: --- -1.7.7.6 - diff --git a/sources b/sources index e8c9e05f6..413d6dc42 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 7133f5a2086a7d7ef97abac610c094f5 linux-3.3.tar.xz -10771d657c5bf342bcfe66ed06653ecb patch-3.3.1.xz +68907107b0f62a19608588bdb6b29e20 patch-3.3.2.xz diff --git a/uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch b/uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch deleted file mode 100644 index 5f2a1c006..000000000 --- a/uvcvideo-Fix-race-induced-crash-in-uvc_video_clock_update.patch +++ /dev/null @@ -1,113 +0,0 @@ -@@ -, +, @@ - drivers/media/video/uvc/uvc_video.c | 50 ++++++++++++++++++++++------------ - 1 files changed, 32 insertions(+), 18 deletions(-) ---- a/drivers/media/video/uvc/uvc_video.c -+++ a/drivers/media/video/uvc/uvc_video.c -@@ -468,22 +468,30 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf, - spin_unlock_irqrestore(&stream->clock.lock, flags); - } - --static int uvc_video_clock_init(struct uvc_streaming *stream) -+static void uvc_video_clock_reset(struct uvc_streaming *stream) - { - struct uvc_clock *clock = &stream->clock; - -- spin_lock_init(&clock->lock); - clock->head = 0; - clock->count = 0; -- clock->size = 32; - clock->last_sof = -1; - clock->sof_offset = -1; -+} -+ -+static int uvc_video_clock_init(struct uvc_streaming *stream) -+{ -+ struct uvc_clock *clock = &stream->clock; -+ -+ spin_lock_init(&clock->lock); -+ clock->size = 32; - - clock->samples = kmalloc(clock->size * sizeof(*clock->samples), - GFP_KERNEL); - if (clock->samples == NULL) - return -ENOMEM; - -+ uvc_video_clock_reset(stream); -+ - return 0; - } - -@@ -1424,8 +1432,6 @@ static void uvc_uninit_video(struct uvc_streaming *stream, int free_buffers) - - if (free_buffers) - uvc_free_urb_buffers(stream); -- -- uvc_video_clock_cleanup(stream); - } - - /* -@@ -1555,10 +1561,6 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags) - - uvc_video_stats_start(stream); - -- ret = uvc_video_clock_init(stream); -- if (ret < 0) -- return ret; -- - if (intf->num_altsetting > 1) { - struct usb_host_endpoint *best_ep = NULL; - unsigned int best_psize = 3 * 1024; -@@ -1683,6 +1685,8 @@ int uvc_video_resume(struct uvc_streaming *stream, int reset) - - stream->frozen = 0; - -+ uvc_video_clock_reset(stream); -+ - ret = uvc_commit_video(stream, &stream->ctrl); - if (ret < 0) { - uvc_queue_enable(&stream->queue, 0); -@@ -1819,25 +1823,35 @@ int uvc_video_enable(struct uvc_streaming *stream, int enable) - uvc_uninit_video(stream, 1); - usb_set_interface(stream->dev->udev, stream->intfnum, 0); - uvc_queue_enable(&stream->queue, 0); -+ uvc_video_clock_cleanup(stream); - return 0; - } - -- ret = uvc_queue_enable(&stream->queue, 1); -+ ret = uvc_video_clock_init(stream); - if (ret < 0) - return ret; - -+ ret = uvc_queue_enable(&stream->queue, 1); -+ if (ret < 0) -+ goto error_queue; -+ - /* Commit the streaming parameters. */ - ret = uvc_commit_video(stream, &stream->ctrl); -- if (ret < 0) { -- uvc_queue_enable(&stream->queue, 0); -- return ret; -- } -+ if (ret < 0) -+ goto error_commit; - - ret = uvc_init_video(stream, GFP_KERNEL); -- if (ret < 0) { -- usb_set_interface(stream->dev->udev, stream->intfnum, 0); -- uvc_queue_enable(&stream->queue, 0); -- } -+ if (ret < 0) -+ goto error_video; -+ -+ return 0; -+ -+error_video: -+ usb_set_interface(stream->dev->udev, stream->intfnum, 0); -+error_commit: -+ uvc_queue_enable(&stream->queue, 0); -+error_queue: -+ uvc_video_clock_cleanup(stream); - - return ret; - }