aboutsummaryrefslogtreecommitdiff
path: root/drivers/staging
AgeCommit message (Collapse)Author
2014-02-06zram: fix race between reset and flushing pending workMinchan Kim
commit da4a04126baa3be03bc566d4a2ee0944c5e783d0 upstream. Dan and Sergey reported that there is a racy between reset and flushing of pending work so that it could make oops by freeing zram->meta in reset while zram_slot_free can access zram->meta if new request is adding during the race window. This patch moves flush after taking init_lock so it prevents new request so that it closes the race. Signed-off-by: Minchan Kim <minchan@kernel.org> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Nitin Gupta <ngupta@vflare.org> Cc: Jerome Marchand <jmarchan@redhat.com> Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-06staging: vt6656: CARDqGetNextTBTT correct uLowNextTBTTMalcolm Priestley
commit 9acec059c0cef0bf086c738f4c0b1f4447782a48 upstream. value uLowNextTBTT yields wrong value. ULL is needed with qwTSF Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-06staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on ↵Malcolm Priestley
bScanning commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream. byBBPreEDIndex value is initially 0, this means that from cold BBvUpdatePreEDThreshold is never set. This means that sensitivity may be in an ambiguous state, failing to scan any wireless points or at least distant ones. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-06staging: r8712u: Set device type to wlanLarry Finger
commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream. The latest version of NetworkManager does not recognize the device as wireless without this change. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-06staging/lustre/ptlrpc: Fix a crash when dereferencing NULL pointerAmir Shehata
commit 3c92a0bf4d72737035a16c4fe357ccd439c9b7d2 upstream. When a system runs out of memory and the function ptlrpc_register_bulk() is called from ptl_send_rpc() the call to LNetMEAttach() fails due to failure to allocate memory. This forces the code into an error path, which most probably previously went untested. The error path: if (rc != 0) { CERROR("%s: LNetMEAttach failed x"LPU64"/%d: rc = %dn", desc->bd_export->exp_obd->obd_name, xid, posted_md, rc); break; } This print assumes that desc->bd_export is not NULL. However, it is. In fact it is expected to be NULL. desc->bd_import is the correct structure to access in this case. Lustre-change: http://review.whamcloud.com/7121 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3585 Signed-off-by: Amir Shehata <amir.shehata@intel.com> Reviewed-by: Liang Zhen <liang.zhen@intel.com> Reviewed-by: Doug Oucharek <doug.s.oucharek@intel.com> Reviewed-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Peng Tao <bergwolf@gmail.com> Signed-off-by: Andreas Dilger <andreas.dilger@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-29staging: comedi: adl_pci9111: fix incorrect irq passed to request_irq()H Hartley Sweeten
commit 48108fe3daa0d142f9b97178fdb23704ea3a407b upstream. The dev->irq passed to request_irq() will always be 0 when the auto_attach function is called. The pcidev->irq should be used instead to get the correct irq number. Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-29staging: comedi: addi_apci_1032: fix subdevice type/flags bugH Hartley Sweeten
commit 90daf69a7a3f1d1a41018c799968a0bb896d65e0 upstream. The SDF_CMD_READ should be one of the s->subdev_flags not part of the s->type. Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-29staging: comedi: fix result of memdup_user for user chanlistBernd Porr
commit e56b1401056288a725d50942ef300dcbed5e519a upstream. If the channel list is not set in userspace we get an error at PTR_ERR(async->cmd.chanlist). However, do_become_nonbusy(dev, s) cleans up this pointer which causes a kernel ooops. Setting the channel list in async to NULL and checking this in do_become_nonbusy prevents the oops. [Ian Abbott] Also do the same for the chanlist allocated in do_cmdtest_ioctl(). Signed-off-by: Bernd Porr <mail@berndporr.me.uk> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-10net: core: explicitly select a txq before doing l2 forwardingJason Wang
Currently, the tx queue were selected implicitly in ndo_dfwd_start_xmit(). The will cause several issues: - NETIF_F_LLTX were removed for macvlan, so txq lock were done for macvlan instead of lower device which misses the necessary txq synchronization for lower device such as txq stopping or frozen required by dev watchdog or control path. - dev_hard_start_xmit() was called with NULL txq which bypasses the net device watchdog. - dev_hard_start_xmit() does not check txq everywhere which will lead a crash when tso is disabled for lower device. Fix this by explicitly introducing a new param for .ndo_select_queue() for just selecting queues in the case of l2 forwarding offload. netdev_pick_tx() was also extended to accept this parameter and dev_queue_xmit_accel() was used to do l2 forwarding transmission. With this fixes, NETIF_F_LLTX could be preserved for macvlan and there's no need to check txq against NULL in dev_hard_start_xmit(). Also there's no need to keep a dedicated ndo_dfwd_start_xmit() and we can just reuse the code of dev_queue_xmit() to do the transmission. In the future, it was also required for macvtap l2 forwarding support since it provides a necessary synchronization method. Cc: John Fastabend <john.r.fastabend@intel.com> Cc: Neil Horman <nhorman@tuxdriver.com> Cc: e1000-devel@lists.sourceforge.net Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-12-17imx-drm: imx-drm-core: improve safety of imx_drm_add_crtc()Russell King
We must not add more CRTCs than we have declared to the vblank helpers, otherwise we overflow their arrays. Force failure if we exceed the number of CRTCs. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17imx-drm: imx-drm-core: make imx_drm_crtc_register() saferRussell King
imx_drm_crtc_register() doesn't clean up the CRTC upon failure, which leaves the CRTC attached to the DRM device. Also, it does setup after attaching the CRTC to the DRM device. Fix this by reordering the function such that we do the setup before drm_crtc_init(): this fixes both issues. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17imx-drm: imx-drm-core: use defined constant for number of CRTCs.Russell King
We have this definition, there's no reason not to use it. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17imx-drm: imx-tve: don't call sleeping functions beneath enable_lock spinlockRussell King
Enable lock claims that it is serializing tve_enable/disable calls. However, DRM already serialises mode sets with a mutex, which prevents encoder/connector functions being called concurrently. Secondly, holding a spinlock while calling clk_prepare_enable() is wrong; it will cause a might_sleep() warning should that debugging be enabled. So, let's just get rid of the enable_lock. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17imx-drm: ipu-v3: fix potential CRTC device registration raceRussell King
Clean up the IPUv3 CRTC device registration; we don't need a separate function just to call platform_device_register_data(), and we don't need the return value converted at all. Update the IPU client id under a mutex, so that parallel probing doesn't race. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17imx-drm: imx-drm-core: fix DRM cleanup pathsRussell King
We must call drm_vblank_cleanup() on the error cleanup and unload paths after we've had a successful call to drm_vblank_init(). Ensure that the calls are in the reverse order to the initialisation order. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17imx-drm: imx-drm-core: fix error cleanup path for imx_drm_add_crtc()Russell King
imx_drm_add_crtc() was kfree'ing the imx_drm_crtc structure while leaving it on the list of CRTCs. Delete it from the list first. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17staging: comedi: drivers: fix return value of comedi_load_firmware()H Hartley Sweeten
Some of the callback functions that upload the firmware in the comedi drivers return a positive value indicating the number of bytes sent to the device. Detect this condition and just return '0' to indicate a successful upload. Reported-by: Bernd Porr <mail@berndporr.me.uk> Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Acked-by: Ian Abbott <abbotti@mev.co.uk> Acked-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17staging: comedi: 8255_pci: fix for newer PCI-DIO48HIan Abbott
At some point, Measurement Computing / ComputerBoards redesigned the PCI-DIO48H to use a PLX PCI interface chip instead of an AMCC chip. This meant they had to put their hardware registers in the PCI BAR 2 region instead of PCI BAR 1. Unfortunately, they kept the same PCI device ID for the new design. This means the driver recognizes the newer cards, but doesn't work (and is likely to screw up the local configuration registers of the PLX chip) because it's using the wrong region. Since the PCI subvendor and subdevice IDs were both zero on the old design, but are the same as the vendor and device on the new design, we can tell the old design and new design apart easily enough. Split the existing entry for the PCI-DIO48H in `pci_8255_boards[]` into two new entries, referenced by different entries in the PCI device ID table `pci_8255_pci_table[]`. Use the same board name for both entries. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Cc: stablle <stable@vger.kernel.org> # 3.10.y # 3.11.y # 3.12.y # 3.13.y Acked-by: H Hartley Sweeten <hsweeten@visionengravers.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-12-17staging:iio:mag:hmc5843 fix incorrect endianness of channel as a result of ↵Jonathan Cameron
missuse of the IIO_ST macro. This driver sets the shift value equal to IIO_BE (or 1) rather than setting that to 0 and specificying the endianness. This means the channel type is missreported as [be|le]:u16/16>>1 where the be|le is dependent on the cpu native endianness, rather than be:u16/16>>0 resulting in any userspace code using this information, miss converting the channel and generating thoroughly trashed data. Signed-off-by: Jonathan Cameron <jic23@kernel.org> Acked-by: Lars-Peter Clausen <lars@metafoo.de> Cc: stable@vger.kernel.org
2013-12-03Staging: TIDSPBRIDGE: Use vm_iomap_memory for mmap-ing instead of ↵Ivaylo Dimitrov
remap_pfn_range This fixes the following bug: ---- Bug Report ---- source file: drivers/staging/tidspbridge/rmgr/drv_interface.c issue : mapping of physical memory without address range checks 259 static int bridge_mmap(struct file *filp, struct vm_area_struct *vma) 260 { 261 u32 status; 262 263 /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */ 264 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); 265 266 dev_dbg(bridge, "%s: vm filp %p start %lx end %lx page_prot %ulx " 267 "flags %lx\n", __func__, filp, 268 vma->vm_start, vma->vm_end, vma->vm_page_prot, 269 vma->vm_flags); 270 271 status = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, 272 vma->vm_end - vma->vm_start, 273 vma->vm_page_prot); 274 if (status != 0) 275 status = -EAGAIN; 276 277 return status; 278 } The function provides an interface to remap physical memory to user space, but does not provide any checks to ensure that the memory is within the region that should be accessible. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Ivaylo Dimitrov <freemangordon@abv.bg> Signed-off-by: Pavel Machek <pavel@ucw.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-27Staging: tidspbridge: disable driverGreg Kroah-Hartman
There seems to be no active maintainer for the driver, and there is an unfixed security bug, so disable the driver for now. Hopefully someone steps up to be the maintainer, and works to get this out of staging, otherwise it will be deleted soon. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Omar Ramirez Luna <omar.ramirez@copitl.com> Cc: Omar Ramirez Luna <omar.ramirez@ti.com> Cc: Kanigeri, Hari <h-kanigeri2@ti.com> Cc: Ameya Palande <ameya.palande@nokia.com> Cc: Guzman Lugo, Fernando <fernando.lugo@ti.com> Cc: Hebbar, Shivananda <x0hebbar@ti.com> Cc: Ramos Falcon, Ernesto <ernesto@ti.com> Cc: Felipe Contreras <felipe.contreras@gmail.com> Cc: Anna, Suman <s-anna@ti.com> Cc: Gupta, Ramesh <grgupta@ti.com> Cc: Gomez Castellanos, Ivan <ivan.gomez@ti.com> Cc: Andy Shevchenko <ext-andriy.shevchenko@nokia.com> Cc: Armando Uribe De Leon <x0095078@ti.com> Cc: Deepak Chitriki <deepak.chitriki@ti.com> Cc: Menon, Nishanth <nm@ti.com> Cc: Phil Carmody <ext-phil.2.carmody@nokia.com> Cc: Ohad Ben-Cohen <ohad@wizery.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: zsmalloc: Ensure handle is never 0 on successOlav Haugan
zsmalloc encodes a handle using the pfn and an object index. On hardware platforms with physical memory starting at 0x0 the pfn can be 0. This causes the encoded handle to be 0 and is incorrectly interpreted as an allocation failure. This issue affects all current and future SoCs with physical memory starting at 0x0. All MSM8974 SoCs which includes Google Nexus 5 devices are affected. To prevent this false error we ensure that the encoded handle will not be 0 when allocation succeeds. Signed-off-by: Olav Haugan <ohaugan@codeaurora.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging/lustre/ptlrpc: fix ptlrpc_stop_pinger logicPeng Tao
It was introduced due to a patch hunk when porting commit 20802057 (staging/lustre/ptlrpc: race in pinger). Cc: Andreas Dilger <andreas.dilger@intel.com> Signed-off-by: Peng Tao <bergwolf@gmail.com> Cc: stable <stable@vger.kernel.org> # 3.12 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: r8188eu: Fix AP modeLarry Finger
Two code lines were accidentally deleted. Restore them. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Merge tag 'fixes-for-3.13a' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First round of fixes for IIO in the 3.13 cycle. The usual mixed bag of fixes. * 3 cases where kconfig dependencies were missing. We need to keep a closer eye on this in new drivers. * hid_sensors was abusing the iio_dev->trigger pointer. We had a round of clearing this out some time ago but this driver clearly slipped through. * A misuse of the IIO_ST macro, in mcp3422, which we should really make a concertive effort to finish removing. * Avoid a double free introduced by recent buffer reference counting in the one driver that (quite reasonably!) does things differently (am335x) * A missing mutex_unlock in kxsd9 that means that driver has been non functional for some time and no one noticed (including me who for once actually has one of the supported devices). * An incorrect assumption about the parameters of sign_extend32 in mcp3422. So nothing controversial. The only substantial patch is the hid_sensors one and that is actually just adding a new pointer to the devices private state then moving the code over to it.
2013-11-25Staging: btmtk_usb: Add hdev parameter to hdev->send driver callbackGeert Uytterhoeven
drivers/staging/btmtk_usb/btmtk_usb.c: In function ‘btmtk_usb_probe’: drivers/staging/btmtk_usb/btmtk_usb.c:1610: warning: assignment from incompatible pointer type Add the new hdev parameter, cfr. commit 7bd8f09f69f8a190f9b8334a07bb0a9237612314 ("Bluetooth: Add hdev parameter to hdev->send driver callback"). Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Staging: go7007: fix up some remaining go->dev issuesGreg Kroah-Hartman
This fixes up the remaining "dev is used before it is set" issues in the go7007 driver that were originally caused by commit b6ea5ef80aa7fd6f4b18ff2e4174930e8772e812 but not fixed up by reverting it due to other patches later on adding these "fixes". Cc: Hans Verkuil <hans.verkuil@cisco.com> Cc: Mauro Carvalho Chehab <m.chehab@samsung.com> Cc: Dulshani Gunawardhana <dulshani.gunawardhana89@gmail.com> Cc: Josh Triplett <josh@joshtriplett.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: imx-drm: Fix modular build of DRM_IMX_IPUV3Josh Boyer
commit b8d181e408af (staging: drm/imx: add drm plane support) added a file to the make target for DRM_IMX_IPUV3 but didn't adjust the objs required to actually build that as a module. Kbuild got confused and this lead to link errors like: ERROR: "ipu_plane_disable" [drivers/staging/imx-drm/ipuv3-crtc.ko] undefined! ERROR: "ipu_plane_enable" [drivers/staging/imx-drm/ipuv3-crtc.ko] undefined! Additionally, it added a call to imx_drm_crtc_id which also fails with a link error as above. To fix this, we adjust the make target with the proper objs, which will change the name of the resulting .ko. We also add an EXPORT_SYMBOL_GPL for imx_drm_crtc_id. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Fixes: b8d181e408af '(staging: drm/imx: add drm plane support)' Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: ft1000: fix use of potentially uninitialized variableMichal Nazarewicz
If boot_case is false, status in never assigned a value. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Revert "staging:media: Use dev_dbg() instead of pr_debug()"Greg Kroah-Hartman
This reverts commit b6ea5ef80aa7fd6f4b18ff2e4174930e8772e812. Turns out to have lots of run-time issues in that the structure is not initialized before it is used in the debugging messages. Reported-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Cc: Dulshani Gunawardhana <dulshani.gunawardhana89@gmail.com> Cc: Josh Triplett <josh@joshtriplett.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Staging: zram: Fix memory leak by refcount mismatchRashika Kheria
As suggested by Minchan Kim and Jerome Marchand "The code in reset_store get the block device (bdget_disk()) but it does not put it (bdput()) when it's done using it. The usage count is therefore incremented but never decremented." This patch also puts bdput() for all error cases. Acked-by: Minchan Kim <minchan@kernel.org> Acked-by: Jerome Marchand <jmarchan@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Rashika Kheria <rashika.kheria@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: vt6656: [BUG] Fix for TX USB resets from vendors driver.Malcolm Priestley
This fixes resets on heavy TX data traffic. Vendor driver VT6656_Linux_src_v1.21.03_x86_11.04.zip http://www.viaembedded.com/servlet/downloadSvl?id=1890&download_file_id=14704 This is GPL-licensed code. original code BBbVT3184Init ... //2007-0725, RobertChang add, Enable Squelch detect reset option(SQ_RST_Opt), USB (register4, bit1) CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, (WORD)0x600+4, // USB's Reg4's bit1 MESSAGE_REQUEST_MEM, 1, (PBYTE) &byData); byData = byData|2 ; CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, (WORD)0x600+4, // USB's Reg4's bit1 MESSAGE_REQUEST_MEM, 1, (PBYTE) &byData); return TRUE;//ntStatus; .... A back port patch is needed for kernels less than 3.10. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Cc: stable@vger.kernel.org # v3.10+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: nvec: potential NULL dereference on error pathDan Carpenter
We assume nvec->rx can be NULL earlier so I have added a check here as well. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd()Dan Carpenter
We fixed this to use free_netdev() instead of kfree() but unfortunately free_netdev() doesn't accept NULL pointers. Smatch complains about this, it's not something I discovered through testing. Fixes: 3030d40b5036 ('staging: vt6655: use free_netdev instead of kfree') Fixes: 0a438d5b381e ('staging: vt6656: use free_netdev instead of kfree') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: comedi: s626: fix value written by s626_set_dac()Ian Abbott
I broke `s626_set_dac()` by changing the type of the `dacdata` parameter from `short` to `unsigned short`. It's actually designed to take a signed value in the range -0x1fff to +0x2000 although values above 0x1fff get clamped to 0x1fff. (We could change the `maxdata` value to 0x1ffe to avoid the clamping, but `maxdata` values are usually a power of 2 minus 1.) The bug results in all negative values passed to the function being changed to +0x1fff by the clamp. Change the parameter type to `int16_t` to fix the problem. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25Staging: comedi: pcl730: fix some bitwise vs logical AND bugsDan Carpenter
These conditions are never true because they use bitwise AND instead of logical ands. Fixes: b3ff824a81e8 ('staging: comedi: drivers: use comedi_dio_update_state() for complex cases') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-25staging: comedi: fix potentially uninitialised variableMichal Nazarewicz
If none of the if conditions take a true path, the ret variable will never be assigned a value. Signed-off-by: Michal Nazarewicz <mina86@mina86.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-11-18Merge branch 'topic/kbuild-fixes-for-next' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media build fixes from Mauro Carvalho Chehab: "A series of patches that fix compilation on non-x86 archs. While most of them are just build fixes, there are some fixes for real bugs, as there are a number of drivers using dynamic stack allocation. A few of those might be considered a security risk, if the i2c-dev module is loaded, as someone could be sending very long I2C data that could potentially overflow the Kernel stack. Ok, as using /dev/i2c-* devnodes usually requires root on usual distros, and exploiting it would require a DVB board or USB stick, the risk is not high" * 'topic/kbuild-fixes-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (28 commits) [media] platform drivers: Fix build on frv arch [media] lirc_zilog: Don't use dynamic static allocation [media] mxl111sf: Don't use dynamic static allocation [media] af9035: Don't use dynamic static allocation [media] af9015: Don't use dynamic static allocation [media] dw2102: Don't use dynamic static allocation [media] dibusb-common: Don't use dynamic static allocation [media] cxusb: Don't use dynamic static allocation [media] v4l2-async: Don't use dynamic static allocation [media] cimax2: Don't use dynamic static allocation [media] tuner-xc2028: Don't use dynamic static allocation [media] tuners: Don't use dynamic static allocation [media] av7110_hw: Don't use dynamic static allocation [media] stv090x: Don't use dynamic static allocation [media] stv0367: Don't use dynamic static allocation [media] stb0899_drv: Don't use dynamic static allocation [media] dvb-frontends: Don't use dynamic static allocation [media] dvb-frontends: Don't use dynamic static allocation [media] s5h1420: Don't use dynamic static allocation [media] uvc/lirc_serial: Fix some warnings on parisc arch ...
2013-11-18Merge branch 'v4l_for_linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: "This series include: - a new Remote Controller driver for ST SoC with the corresponding DT bindings - a new frontend (cx24117) - a new I2C camera flash driver (lm3560) - a new mem2mem driver for TI SoC (ti-vpe) - support for Raphael r828d added to r820t driver - some improvements on buffer allocation at VB2 core - usual driver fixes and improvements PS this time, we have a smaller number of patches. While it is hard to pinpoint to the reasons, I believe that it is mainly due to: 1) there are several patch series ready, but depending on DT review. I decided to grant some extra time for DT maintainers to look on it, as they're expecting to have more time with the changes agreed during ARM mini-summit and KS. If they can't review in time for 3.14, I'll review myself and apply for the next merge window. 2) I suspect that having both LinuxCon EU and LinuxCon NA happening during the same merge window affected the development productivity, as several core media developers participated on both events" * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (151 commits) [media] media: st-rc: Add ST remote control driver [media] gpio-ir-recv: Include linux/of.h header [media] tvp7002: Include linux/of.h header [media] tvp514x: Include linux/of.h header [media] ths8200: Include linux/of.h header [media] adv7343: Include linux/of.h header [media] v4l: Fix typo in v4l2_subdev_get_try_crop() [media] media: i2c: add driver for dual LED Flash, lm3560 [media] rtl28xxu: add 15f4:0131 Astrometa DVB-T2 [media] rtl28xxu: add RTL2832P + R828D support [media] rtl2832: add new tuner R828D [media] r820t: add support for R828D [media] media/i2c: ths8200: fix build failure with gcc 4.5.4 [media] Add support for KWorld UB435-Q V2 [media] staging/media: fix msi3101 build errors [media] ddbridge: Remove casting the return value which is a void pointer [media] ngene: Remove casting the return value which is a void pointer [media] dm1105: remove unneeded not-null test [media] sh_mobile_ceu_camera: remove deprecated IRQF_DISABLED [media] media: rcar_vin: Add preliminary r8a7790 support ...
2013-11-15Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial Pull trivial tree updates from Jiri Kosina: "Usual earth-shaking, news-breaking, rocket science pile from trivial.git" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (23 commits) doc: usb: Fix typo in Documentation/usb/gadget_configs.txt doc: add missing files to timers/00-INDEX timekeeping: Fix some trivial typos in comments mm: Fix some trivial typos in comments irq: Fix some trivial typos in comments NUMA: fix typos in Kconfig help text mm: update 00-INDEX doc: Documentation/DMA-attributes.txt fix typo DRM: comment: `halve' -> `half' Docs: Kconfig: `devlopers' -> `developers' doc: typo on word accounting in kprobes.c in mutliple architectures treewide: fix "usefull" typo treewide: fix "distingush" typo mm/Kconfig: Grammar s/an/a/ kexec: Typo s/the/then/ Documentation/kvm: Update cpuid documentation for steal time and pv eoi treewide: Fix common typo in "identify" __page_to_pfn: Fix typo in comment Correct some typos for word frequency clk: fixed-factor: Fix a trivial typo ...
2013-11-15Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm updates from Dave Airlie: "This is a combo of -next and some -fixes that came in in the intervening time. Highlights: New drivers: ARM Armada driver for Marvell Armada 510 SOCs Intel: Broadwell initial support under a default off switch, Stereo/3D HDMI mode support Valleyview improvements Displayport improvements Haswell fixes initial mipi dsi panel support CRC support for debugging build with CONFIG_FB=n Radeon: enable DPM on a number of GPUs by default secondary GPU powerdown support enable HDMI audio by default Hawaii support Nouveau: dynamic pm code infrastructure reworked, does nothing major yet GK208 modesetting support MSI fixes, on by default again PMPEG improvements pageflipping fixes GMA500: minnowboard SDVO support VMware: misc fixes MSM: prime, plane and rendernodes support Tegra: rearchitected to put the drm driver into the drm subsystem. HDMI and gr2d support for tegra 114 SoC QXL: oops fix, and multi-head fixes DRM core: sysfs lifetime fixes client capability ioctl further cleanups to device midlayer more vblank timestamp fixes" * 'drm-next' of git://people.freedesktop.org/~airlied/linux: (789 commits) drm/nouveau: do not map evicted vram buffers in nouveau_bo_vma_add drm/nvc0-/gr: shift wrapping bug in nvc0_grctx_generate_r406800 drm/nouveau/pwr: fix missing mutex unlock in a failure path drm/nv40/therm: fix slowing down fan when pstate undefined drm/nv11-: synchronise flips to vblank, unless async flip requested drm/nvc0-: remove nasty fifo swmthd hack for flip completion method drm/nv10-: we no longer need to create nvsw object on user channels drm/nouveau: always queue flips relative to kernel channel activity drm/nouveau: there is no need to reserve/fence the new fb when flipping drm/nouveau: when bailing out of a pushbuf ioctl, do not remove previous fence drm/nouveau: allow nouveau_fence_ref() to be a noop drm/nvc8/mc: msi rearm is via the nvc0 method drm/ttm: Fix vma page_prot bit manipulation drm/vmwgfx: Fix a couple of compile / sparse warnings and errors drm/vmwgfx: Resource evict fixes drm/edid: compare actual vrefresh for all modes for quirks drm: shmob_drm: Convert to clk_prepare/unprepare drm/nouveau: fix 32-bit build drm/i915/opregion: fix build error on CONFIG_ACPI=n Revert "drm/radeon/audio: don't set speaker allocation on DCE4+" ...
2013-11-15tree-wide: use reinit_completion instead of INIT_COMPLETIONWolfram Sang
Use this new function to make code more comprehensible, since we are reinitialzing the completion, not initializing. [akpm@linux-foundation.org: linux-next resyncs] Signed-off-by: Wolfram Sang <wsa@the-dreams.de> Acked-by: Linus Walleij <linus.walleij@linaro.org> (personally at LCE13) Cc: Ingo Molnar <mingo@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-11-14Merge tag 'pci-v3.13-changes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI changes from Bjorn Helgaas: "Resource management - Fix host bridge window coalescing (Alexey Neyman) - Pass type, width, and prefetchability for window alignment (Wei Yang) PCI device hotplug - Convert acpiphp, acpiphp_ibm to dynamic debug (Lan Tianyu) Power management - Remove pci_pm_complete() (Liu Chuansheng) MSI - Fail initialization if device is not in PCI_D0 (Yijing Wang) MPS (Max Payload Size) - Use pcie_get_mps() and pcie_set_mps() to simplify code (Yijing Wang) - Use pcie_set_readrq() to simplify code (Yijing Wang) - Use cached pci_dev->pcie_mpss to simplify code (Yijing Wang) SR-IOV - Enable upstream bridges even for VFs on virtual buses (Bjorn Helgaas) - Use pci_is_root_bus() to avoid catching virtual buses (Wei Yang) Virtualization - Add x86 MSI masking ops (Konrad Rzeszutek Wilk) Freescale i.MX6 - Support i.MX6 PCIe controller (Sean Cross) - Increase link startup timeout (Marek Vasut) - Probe PCIe in fs_initcall() (Marek Vasut) - Fix imprecise abort handler (Tim Harvey) - Remove redundant of_match_ptr (Sachin Kamat) Renesas R-Car - Support Gen2 internal PCIe controller (Valentine Barshak) Samsung Exynos - Add MSI support (Jingoo Han) - Turn off power when link fails (Jingoo Han) - Add Jingoo Han as maintainer (Jingoo Han) - Add clk_disable_unprepare() on error path (Wei Yongjun) - Remove redundant of_match_ptr (Sachin Kamat) Synopsys DesignWare - Add irq_create_mapping() (Pratyush Anand) - Add header guards (Seungwon Jeon) Miscellaneous - Enable native PCIe services by default on non-ACPI (Andrew Murray) - Cleanup _OSC usage and messages (Bjorn Helgaas) - Remove pcibios_last_bus boot option on non-x86 (Bjorn Helgaas) - Convert bus code to use bus_, drv_, and dev_groups (Greg Kroah-Hartman) - Remove unused pci_mem_start (Myron Stowe) - Make sysfs functions static (Sachin Kamat) - Warn on invalid return from driver probe (Stephen M. Cameron) - Remove Intel Haswell D3 delays (Todd E Brandt) - Call pci_set_master() in core if driver doesn't do it (Yinghai Lu) - Use pci_is_pcie() to simplify code (Yijing Wang) - Use PCIe capability accessors to simplify code (Yijing Wang) - Use cached pci_dev->pcie_cap to simplify code (Yijing Wang) - Removed unused "is_pcie" from struct pci_dev (Yijing Wang) - Simplify sysfs CPU affinity implementation (Yijing Wang)" * tag 'pci-v3.13-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (79 commits) PCI: Enable upstream bridges even for VFs on virtual buses PCI: Add pci_upstream_bridge() PCI: Add x86_msi.msi_mask_irq() and msix_mask_irq() PCI: Warn on driver probe return value greater than zero PCI: Drop warning about drivers that don't use pci_set_master() PCI: Workaround missing pci_set_master in pci drivers powerpc/pci: Use pci_is_pcie() to simplify code [fix] PCI: Update pcie_ports 'auto' behavior for non-ACPI platforms PCI: imx6: Probe the PCIe in fs_initcall() PCI: Add R-Car Gen2 internal PCI support PCI: imx6: Remove redundant of_match_ptr PCI: Report pci_pme_active() kmalloc failure mn10300/PCI: Remove useless pcibios_last_bus frv/PCI: Remove pcibios_last_bus PCI: imx6: Increase link startup timeout PCI: exynos: Remove redundant of_match_ptr PCI: imx6: Fix imprecise abort handler PCI: Fail MSI/MSI-X initialization if device is not in PCI_D0 PCI: imx6: Remove redundant dev_err() in imx6_pcie_probe() x86/PCI: Coalesce multiple overlapping host bridge windows ...
2013-11-14Merge branch 'for-linus-dma-masks' of git://git.linaro.org/people/rmk/linux-armLinus Torvalds
Pull DMA mask updates from Russell King: "This series cleans up the handling of DMA masks in a lot of drivers, fixing some bugs as we go. Some of the more serious errors include: - drivers which only set their coherent DMA mask if the attempt to set the streaming mask fails. - drivers which test for a NULL dma mask pointer, and then set the dma mask pointer to a location in their module .data section - which will cause problems if the module is reloaded. To counter these, I have introduced two helper functions: - dma_set_mask_and_coherent() takes care of setting both the streaming and coherent masks at the same time, with the correct error handling as specified by the API. - dma_coerce_mask_and_coherent() which resolves the problem of drivers forcefully setting DMA masks. This is more a marker for future work to further clean these locations up - the code which creates the devices really should be initialising these, but to fix that in one go along with this change could potentially be very disruptive. The last thing this series does is prise away some of Linux's addition to "DMA addresses are physical addresses and RAM always starts at zero". We have ARM LPAE systems where all system memory is above 4GB physical, hence having DMA masks interpreted by (eg) the block layers as describing physical addresses in the range 0..DMAMASK fails on these platforms. Santosh Shilimkar addresses this in this series; the patches were copied to the appropriate people multiple times but were ignored. Fixing this also gets rid of some ARM weirdness in the setup of the max*pfn variables, and brings ARM into line with every other Linux architecture as far as those go" * 'for-linus-dma-masks' of git://git.linaro.org/people/rmk/linux-arm: (52 commits) ARM: 7805/1: mm: change max*pfn to include the physical offset of memory ARM: 7797/1: mmc: Use dma_max_pfn(dev) helper for bounce_limit calculations ARM: 7796/1: scsi: Use dma_max_pfn(dev) helper for bounce_limit calculations ARM: 7795/1: mm: dma-mapping: Add dma_max_pfn(dev) helper function ARM: 7794/1: block: Rename parameter dma_mask to max_addr for blk_queue_bounce_limit() ARM: DMA-API: better handing of DMA masks for coherent allocations ARM: 7857/1: dma: imx-sdma: setup dma mask DMA-API: firmware/google/gsmi.c: avoid direct access to DMA masks DMA-API: dcdbas: update DMA mask handing DMA-API: dma: edma.c: no need to explicitly initialize DMA masks DMA-API: usb: musb: use platform_device_register_full() to avoid directly messing with dma masks DMA-API: crypto: remove last references to 'static struct device *dev' DMA-API: crypto: fix ixp4xx crypto platform device support DMA-API: others: use dma_set_coherent_mask() DMA-API: staging: use dma_set_coherent_mask() DMA-API: usb: use new dma_coerce_mask_and_coherent() DMA-API: usb: use dma_set_coherent_mask() DMA-API: parport: parport_pc.c: use dma_coerce_mask_and_coherent() DMA-API: net: octeon: use dma_coerce_mask_and_coherent() DMA-API: net: nxp/lpc_eth: use dma_coerce_mask_and_coherent() ...
2013-11-13Merge branch 'akpm' (patches from Andrew Morton)Linus Torvalds
Merge first patch-bomb from Andrew Morton: "Quite a lot of other stuff is banked up awaiting further next->mainline merging, but this batch contains: - Lots of random misc patches - OCFS2 - Most of MM - backlight updates - lib/ updates - printk updates - checkpatch updates - epoll tweaking - rtc updates - hfs - hfsplus - documentation - procfs - update gcov to gcc-4.7 format - IPC" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (269 commits) ipc, msg: fix message length check for negative values ipc/util.c: remove unnecessary work pending test devpts: plug the memory leak in kill_sb ./Makefile: export initial ramdisk compression config option init/Kconfig: add option to disable kernel compression drivers: w1: make w1_slave::flags long to avoid memory corruption drivers/w1/masters/ds1wm.cuse dev_get_platdata() drivers/memstick/core/ms_block.c: fix unreachable state in h_msb_read_page() drivers/memstick/core/mspro_block.c: fix attributes array allocation drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr kernel/panic.c: reduce 1 byte usage for print tainted buffer gcov: reuse kbasename helper kernel/gcov/fs.c: use pr_warn() kernel/module.c: use pr_foo() gcov: compile specific gcov implementation based on gcc version gcov: add support for gcc 4.7 gcov format gcov: move gcov structs definitions to a gcc version specific file kernel/taskstats.c: return -ENOMEM when alloc memory fails in add_del_listener() kernel/taskstats.c: add nla_nest_cancel() for failure processing between nla_nest_start() and nla_nest_end() kernel/sysctl_binary.c: use scnprintf() instead of snprintf() ...
2013-11-13Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs updates from Al Viro: "All kinds of stuff this time around; some more notable parts: - RCU'd vfsmounts handling - new primitives for coredump handling - files_lock is gone - Bruce's delegations handling series - exportfs fixes plus misc stuff all over the place" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (101 commits) ecryptfs: ->f_op is never NULL locks: break delegations on any attribute modification locks: break delegations on link locks: break delegations on rename locks: helper functions for delegation breaking locks: break delegations on unlink namei: minor vfs_unlink cleanup locks: implement delegations locks: introduce new FL_DELEG lock flag vfs: take i_mutex on renamed file vfs: rename I_MUTEX_QUOTA now that it's not used for quotas vfs: don't use PARENT/CHILD lock classes for non-directories vfs: pull ext4's double-i_mutex-locking into common code exportfs: fix quadratic behavior in filehandle lookup exportfs: better variable name exportfs: move most of reconnect_path to helper function exportfs: eliminate unused "noprogress" counter exportfs: stop retrying once we race with rename/remove exportfs: clear DISCONNECTED on all parents sooner exportfs: more detailed comment for path_reconnect ...
2013-11-13errno.h: remove "NFS" from descriptions in commentsEric Sandeen
glibc recently changed the error string for ESTALE to remove "NFS" - https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=96945714ec61951cc748da2b4b8a80cf02127ee9 from: [ERR_REMAP (ESTALE)] = N_("Stale NFS file handle"), to: [ERR_REMAP (ESTALE)] = N_("Stale file handle"), And some have expressed concern that the kernel's errno.h comments still refer to NFS. So make that change... note that this is a comment-only change, and has no functional difference. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-11-12Merge tag 'gpio-v3.13-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO changes from Linus Walleij: "Here is the bulk of GPIO changes for the v3.13 development cycle. I've got ACKs for the things that affect other subsystems (or it's my own subsystem, like pinctrl). Most of that pertain to an attempt from my side to consolidate and get rid of custom GPIO implementations in the ARM tree. I will continue doing this. The main change this time is the new GPIO descriptor API, background for this can be found in Corbet's summary from this january in LWN: http://lwn.net/Articles/533632/ Summary: - Merged the GPIO descriptor API from Alexandre Courbot. This is a first step toward trying to get rid of the global GPIO numberspace for the future. - Add an API so that driver can flag that a certain GPIO line is being used by a irqchip backend for generating IRQs, so that we can enforce checks, like not allowing users to switch that line to an output at runtime, since this makes no sense. Implemented corresponding calls in a few select drivers. - ACPI GPIO cleanups, refactorings and switch to using the descriptor-based interface. - Support for the TPS80036 Palmas GPIO variant. - A new driver for the Broadcom Kona GPIO SoC IP block. - Device tree support for the PCF857x driver. - A set of ARM GPIO refactorings with the goal of getting rid of a bunch of custom GPIO implementations from the arch/arm/* tree: * Move the IOP GPIO driver to the GPIO subsystem and fix all users to use the gpiolib API for accessing GPIOs. Delete the old custom GPIO implementation. * Delete the unused custom PXA GPIO implemention. * Convert all users of the IXP4 custom GPIO implementation to use gpiolib and delete the custom implementation. * Delete the custom Gemini GPIO implementation, also completely unused. - Various cleanups and renamings" * tag 'gpio-v3.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (85 commits) gpio: gpio-mxs: Remove unneeded dt checks gpio: pl061: don't depend on CONFIG_ARM gpio: bcm-kona: add missing .owner to struct gpio_chip gpiolib: provide a declaration of seq_file in gpio/driver.h gpiolib: include gpio/consumer.h in of_gpio.h for desc_to_gpio() gpio: provide stubs for devres gpio functions gpiolib: devres: add missing headers gpiolib: make GPIO_DEVRES depend on GPIOLIB gpiolib: devres: fix devm_gpiod_get_index() gpiolib / ACPI: document the GPIO descriptor based interface gpiolib / ACPI: allow passing GPIOF_ACTIVE_LOW for GpioInt resources gpiolib / ACPI: add ACPI support for gpiod_get_index() gpiolib / ACPI: convert to gpiod interfaces gpiolib: add gpiod_get() and gpiod_put() functions gpiolib: port of_ functions to use gpiod gpiolib: export descriptor-based GPIO interface Fixup "MAINTAINERS: GPIO-INTEL-MID: add maintainer" gpio: bcm281xx: Don't print addresses of GPIO area in probe() gpio: tegra: use new gpio_lock_as_irq() API gpio: rcar: Include linux/of.h