linux/drivers/staging, branch v3.14

staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()

2014-03-05T00:20:01Z

The function c4_ioctl() writes data from user in ifr->ifr_data to the kernel struct data arg, without any iolen bounds checking. This can lead to a arbitrary write outside of the struct data arg. Corrected by adding bounds-checking of iolen before the copy_from_user(). Signed-off-by: Salva Peiró Signed-off-by: Greg Kroah-Hartman

Merge tag 'fixes-for-3.14d' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

2014-03-01T01:08:03Z

Jonathan writes: Fourth set of IIO fixes for the 3.14 kernel. A single line patch fixing a regression that was introduced in 3.13 in the reworking of the mxs touch screen and ADC drivers to be interrupt rather than polling driven. It resulted in a stray double reporting of the release coordinate in the touch screen driver. The bug lay in the adc side of the driver which left the statemachine in the wrong state.

staging: r8188eu: Add new device ID

2014-02-25T01:02:31Z

The D-Link DWA-123 REV D1 with USB ID 2001:3310 uses this driver. Signed-off-by: Manu Gupta Signed-off-by: Larry Finger Cc: stable Signed-off-by: Greg Kroah-Hartman

staging:iio:adc:MXS:LRADC: fix touchscreen statemachine

2014-02-24T21:55:50Z

Releasing the touchscreen lets the internal statemachine left in a wrong state. Due to this the release coordinate will be reported again by accident when the next touchscreen event happens. This change sets up the correct state when waiting for the next touchscreen event. This has led to reported issues with calibrating the touchscreen. Bug was introduced somewhere in the series that began with 18da755de59b406ce2371a55fb15ed676eb08ed2 Staging/iio/adc/touchscreen/MXS: add proper clock handling in which the way this driver worked was substantially changed to be interrupt driven rather than relying on a busy loop. This was a regression in the 3.13 kernel. Signed-off-by: Juergen Beisert Tested-by: Alexandre Belloni Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron

Merge tag 'staging-3.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2014-02-23T18:39:21Z

Pull staging tree fix from Greg KH: "Here is a single android driver fix for 3.14-rc4 that fixes a reported problem in the binder driver" * tag 'staging-3.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: binder: Fix death notifications

staging: binder: Fix death notifications

2014-02-21T20:30:54Z

The change (008fa749e0fe5b2fffd20b7fe4891bb80d072c6a) that moved the node release code to a separate function broke death notifications in some cases. When it encountered a reference without a death notification request, it would skip looking at the remaining references, and therefore fail to send death notifications for them. Cc: Colin Cross Cc: Android Kernel Team Cc: stable # 3.10 Signed-off-by: Arve Hjønnevåg Signed-off-by: John Stultz Signed-off-by: Jeremy Compostella Signed-off-by: Greg Kroah-Hartman

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-02-18T23:52:43Z

Pull networking fixes from David Miller: 1) kvaser CAN driver has fixed limits of some of it's table, validate that we won't exceed those limits at probe time. Fix from Olivier Sobrie. 2) Fix rtl8192ce disabling interrupts for too long, from Olivier Langlois. 3) Fix botched shift in ath5k driver, from Dan Carpenter. 4) Fix corruption of deferred packets in TIPC, from Erik Hugne. 5) Fix newlink error path in macvlan driver, from Cong Wang. 6) Fix netpoll deadlock in bonding, from Ding Tianhong. 7) Handle GSO packets properly in forwarding path when fragmentation is necessary on egress, from Florian Westphal. 8) Fix axienet build errors, from Michal Simek. 9) Fix refcounting of ubufs on tx in vhost net driver, from Michael S Tsirkin. 10) Carrier status isn't set properly in hyperv driver, from Haiyang Zhang. 11) Missing pci_disable_device() in tulip_remove_one), from Ingo Molnar. 12) AF_PACKET qdisc bypass mode doesn't adhere to driver provided TX queue selection method. Add a fallback method mechanism to fix this bug, from Daniel Borkmann. 13) Fix regression in link local route handling on GRE tunnels, from Nicolas Dichtel. 14) Bonding can assign dup aggregator IDs in some sequences of configuration, fix by making the allocation counter per-bond instead of global. From Jiri Bohac. 15) sctp_connectx() needs compat translations, from Daniel Borkmann. 16) Fix of_mdio PHY interrupt parsing, from Ben Dooks * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (62 commits) MAINTAINERS: add entry for the PHY library of_mdio: fix phy interrupt passing net: ethernet: update dependency and help text of mvneta NET: fec: only enable napi if we are successful af_packet: remove a stray tab in packet_set_ring() net: sctp: fix sctp_connectx abi for ia32 emulation/compat mode ipv4: fix counter in_slow_tot irtty-sir.c: Do not set_termios() on irtty_close() bonding: 802.3ad: make aggregator_identifier bond-private usbnet: remove generic hard_header_len check gre: add link local route when local addr is any batman-adv: fix potential kernel paging error for unicast transmissions batman-adv: avoid double free when orig_node initialization fails batman-adv: free skb on TVLV parsing success batman-adv: fix TT CRC computation by ensuring byte order batman-adv: fix potential orig_node reference leak batman-adv: avoid potential race condition when adding a new neighbour batman-adv: properly check pskb_may_pull return value batman-adv: release vlan object after checking the CRC batman-adv: fix TT-TVLV parsing on OGM reception ...

netdevice: add queue selection fallback handler for ndo_select_queue

2014-02-17T05:36:34Z

Add a new argument for ndo_select_queue() callback that passes a fallback handler. This gets invoked through netdev_pick_tx(); fallback handler is currently __netdev_pick_tx() as most drivers invoke this function within their customized implementation in case for skbs that don't need any special handling. This fallback handler can then be replaced on other call-sites with different queue selection methods (e.g. in packet sockets, pktgen etc). This also has the nice side-effect that __netdev_pick_tx() is then only invoked from netdev_pick_tx() and export of that function to modules can be undone. Suggested-by: David S. Miller Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller

Merge tag 'staging-3.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2014-02-15T00:14:11Z

Pull staging driver fixes from Greg KH: "Here are a number (lots, I know) of fixes for staging drivers to resolve a bunch of reported issues. The largest patches here is one revert of a patch that is in 3.14-rc1 to fix reported problems, and a sync of a usb host driver that required some ARM patches to go in before it could be accepted (which is why it missed -rc1) All of these have been in linux-next for a while with no reported issues" * tag 'staging-3.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (56 commits) staging/rtl8821ae: fix build, depends on MAC80211 iio: max1363: Use devm_regulator_get_optional for optional regulator iio:accel:bma180: Use modifier instead of index in channel specification iio: adis16400: Set timestamp as the last element in chan_spec iio: ak8975: Fix calculation formula for convert micro tesla to gauss unit staging:iio:ad799x fix typo in ad799x_events[] iio: mxs-lradc: remove useless scale_available files iio: mxs-lradc: fix buffer overflow iio:magnetometer:mag3110: Fix output of decimal digits in show_int_plus_micros() iio:magnetometer:mag3110: Report busy in _read_raw() / write_raw() when buffer is enabled wlags49_h2: Fix overflow in wireless_set_essid() xlr_net: Fix missing trivial allocation check staging: r8188eu: overflow in rtw_p2p_get_go_device_address() staging: r8188eu: array overflow in rtw_mp_ioctl_hdl() staging: r8188eu: Fix typo in USB_DEVICE list usbip/userspace/libsrc/names.c: memory leak gpu: ion: dereferencing an ERR_PTR staging: comedi: usbduxsigma: fix unaligned dereferences staging: comedi: fix too early cleanup in comedi_auto_config() staging: android: ion: dummy: fix an error code ...

staging/rtl8821ae: fix build, depends on MAC80211

2014-02-11T23:57:40Z

rtl8821ae uses ieee80211 interfaces so it should depend on MAC80211. Fixes these build errors: ERROR: "ieee80211_rx_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_beacon_get_tim" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_unregister_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "rate_control_send_low" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_stop_queue" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_rate_control_register" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "wiphy_to_ieee80211_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_stop_tx_ba_cb_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_tx_status_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_find_sta" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_wake_queue" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_rate_control_unregister" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_register_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_start_tx_ba_session" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_alloc_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_free_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_connection_loss" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_start_tx_ba_cb_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman