3.0 patches

4 files changed, 155 insertions, 0 deletions

diff --git a/queue-3.0/alsa-hda-realtek-fix-auto-mute-with-hp-lo-configuration.patch b/queue-3.0/alsa-hda-realtek-fix-auto-mute-with-hp-lo-configuration.patch
new file mode 100644
index 0000000000..7fb9efeff6
--- /dev/null
+++ b/queue-3.0/alsa-hda-realtek-fix-auto-mute-with-hp-lo-configuration.patch
@@ -0,0 +1,68 @@
+From 8974bd51a77824d91010176f9a5da28513c2e1f5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 19 Sep 2011 11:31:34 +0200
+Subject: ALSA: hda/realtek - Fix auto-mute with HP+LO configuration
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8974bd51a77824d91010176f9a5da28513c2e1f5 upstream.
+
+When the system has only the headphone and the line-out jacks without
+speakers, the current auto-mute code doesn't work.  It's because the
+spec->automute_lines flag is wrongly referred in update_speakers().
+This flag must be meaningless when spec->automute_hp_lo isn't set, thus
+they should be always coupled.
+
+The patch fixes the problem and add a comment to indicate the
+relationship briefly.
+
+BugLink: http://bugs.launchpad.net/bugs/851697
+
+Reported-by: David Henningsson <david.henningsson@canonical.com>
+Tested-By: Jayne Han <jayne.han@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -397,7 +397,7 @@ struct alc_spec {
+ 	unsigned int auto_mic:1;
+ 	unsigned int automute:1;	/* HP automute enabled */
+ 	unsigned int detect_line:1;	/* Line-out detection enabled */
+-	unsigned int automute_lines:1;	/* automute line-out as well */
++	unsigned int automute_lines:1;	/* automute line-out as well; NOP when automute_hp_lo isn't set */
+ 	unsigned int automute_hp_lo:1;	/* both HP and LO available */
+ 
+ 	/* other flags */
+@@ -1161,7 +1161,7 @@ static void update_speakers(struct hda_c
+ 	if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0] ||
+ 	    spec->autocfg.line_out_pins[0] == spec->autocfg.speaker_pins[0])
+ 		return;
+-	if (!spec->automute_lines || !spec->automute)
++	if (!spec->automute || (spec->automute_hp_lo && !spec->automute_lines))
+ 		on = 0;
+ 	else
+ 		on = spec->jack_present;
+@@ -1494,7 +1494,7 @@ static int alc_automute_mode_get(struct
+ 	unsigned int val;
+ 	if (!spec->automute)
+ 		val = 0;
+-	else if (!spec->automute_lines)
++	else if (!spec->automute_hp_lo || !spec->automute_lines)
+ 		val = 1;
+ 	else
+ 		val = 2;
+@@ -1515,7 +1515,8 @@ static int alc_automute_mode_put(struct
+ 		spec->automute = 0;
+ 		break;
+ 	case 1:
+-		if (spec->automute && !spec->automute_lines)
++		if (spec->automute &&
++		    (!spec->automute_hp_lo || !spec->automute_lines))
+ 			return 0;
+ 		spec->automute = 1;
+ 		spec->automute_lines = 0;
diff --git a/queue-3.0/cifs-fix-possible-memory-corruption-in-cifsfindnext.patch b/queue-3.0/cifs-fix-possible-memory-corruption-in-cifsfindnext.patch
new file mode 100644
index 0000000000..a626e18bad
--- /dev/null
+++ b/queue-3.0/cifs-fix-possible-memory-corruption-in-cifsfindnext.patch
@@ -0,0 +1,43 @@
+From 9438fabb73eb48055b58b89fc51e0bc4db22fabd Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 23 Aug 2011 07:21:28 -0400
+Subject: cifs: fix possible memory corruption in CIFSFindNext
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 9438fabb73eb48055b58b89fc51e0bc4db22fabd upstream.
+
+The name_len variable in CIFSFindNext is a signed int that gets set to
+the resume_name_len in the cifs_search_info. The resume_name_len however
+is unsigned and for some infolevels is populated directly from a 32 bit
+value sent by the server.
+
+If the server sends a very large value for this, then that value could
+look negative when converted to a signed int. That would make that
+value pass the PATH_MAX check later in CIFSFindNext. The name_len would
+then be used as a length value for a memcpy. It would then be treated
+as unsigned again, and the memcpy scribbles over a ton of memory.
+
+Fix this by making the name_len an unsigned value in CIFSFindNext.
+
+Reported-by: Darren Lavender <dcl@hppine99.gbr.hp.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifssmb.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -4079,7 +4079,8 @@ int CIFSFindNext(const int xid, struct c
+ 	T2_FNEXT_RSP_PARMS *parms;
+ 	char *response_data;
+ 	int rc = 0;
+-	int bytes_returned, name_len;
++	int bytes_returned;
++	unsigned int name_len;
+ 	__u16 params, byte_count;
+ 
+ 	cFYI(1, "In FindNext");
diff --git a/queue-3.0/fix-the-conflict-between-rwpidforward-and-rw-mount-options.patch b/queue-3.0/fix-the-conflict-between-rwpidforward-and-rw-mount-options.patch
new file mode 100644
index 0000000000..9e648024f1
--- /dev/null
+++ b/queue-3.0/fix-the-conflict-between-rwpidforward-and-rw-mount-options.patch
@@ -0,0 +1,41 @@
+From c9c7fa0064f4afe1d040e72f24c2256dd8ac402d Mon Sep 17 00:00:00 2001
+From: Steve French <sfrench@us.ibm.com>
+Date: Mon, 29 Aug 2011 18:54:12 +0000
+Subject: Fix the conflict between rwpidforward and rw mount options
+
+From: Steve French <sfrench@us.ibm.com>
+
+commit c9c7fa0064f4afe1d040e72f24c2256dd8ac402d upstream.
+
+Both these options are started with "rw" - that's why the first one
+isn't switched on even if it is specified. Fix this by adding a length
+check for "rw" option check.
+
+Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -1258,7 +1258,7 @@ cifs_parse_mount_options(const char *mou
+ 			/* ignore */
+ 		} else if (strnicmp(data, "guest", 5) == 0) {
+ 			/* ignore */
+-		} else if (strnicmp(data, "rw", 2) == 0) {
++		} else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
+ 			/* ignore */
+ 		} else if (strnicmp(data, "ro", 2) == 0) {
+ 			/* ignore */
+@@ -1361,7 +1361,7 @@ cifs_parse_mount_options(const char *mou
+ 			vol->server_ino = 1;
+ 		} else if (strnicmp(data, "noserverino", 9) == 0) {
+ 			vol->server_ino = 0;
+-		} else if (strnicmp(data, "rwpidforward", 4) == 0) {
++		} else if (strnicmp(data, "rwpidforward", 12) == 0) {
+ 			vol->rwpidforward = 1;
+ 		} else if (strnicmp(data, "cifsacl", 7) == 0) {
+ 			vol->cifs_acl = 1;
diff --git a/queue-3.0/series b/queue-3.0/series
index 74b9a41c57..8cf7aef73b 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -136,3 +136,6 @@ drm-radeon-kms-fix-typo-in-r100_blit_copy.patch
 drm-radeon-kms-make-gpu-cpu-page-size-handling-consistent-in-blit-code-v2.patch
 usb-xhci-set-change-bit-when-warm-reset-change-is-set.patch
 iwlagn-fix-command-queue-timeout.patch
+alsa-hda-realtek-fix-auto-mute-with-hp-lo-configuration.patch
+cifs-fix-possible-memory-corruption-in-cifsfindnext.patch
+fix-the-conflict-between-rwpidforward-and-rw-mount-options.patch