| Age | Commit message (Collapse) | Author |
|---|
|
In hidraw_open, if hid_hw_power returns with error, hidraw device open count
should not increase.
Signed-off-by: Amit Nagal <helloin.amit@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Smatch has a new check for Rosenberg type information leaks where
structs are copied to the user with uninitialized stack data in them.
In this case, the hiddev_devinfo struct has a two byte hole.
struct hiddev_devinfo {
__u32 bustype; /* 0 4 */
__u32 busnum; /* 4 4 */
__u32 devnum; /* 8 4 */
__u32 ifnum; /* 12 4 */
__s16 vendor; /* 16 2 */
__s16 product; /* 18 2 */
__s16 version; /* 20 2 */
/* XXX 2 bytes hole, try to pack */
__u32 num_applications; /* 24 4 */
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
The function hidraw_disconnect() only acquires the hidraw minors_lock
when clearing the entry in hidraw_table. However the device_destroy()
call can cause a userland read/write to return with an error. It may
cause the program to release the file descripter before the disconnect
is finished. hidraw_disconnect() has already set hidraw->exist to 0,
which makes hidraw_release() kfree the hidraw structure, which
hidraw_disconnect() continues to access and even tries to kfree again.
Similarly if a hidraw_release() occurs after setting hidraw->exist to 0,
the same thing can happen.
This is fixed by expanding the mutex critical section to cover the whole
function from setting hidraw->exist to 0 to freeing the hidraw
structure, preventing a hidraw_release() from interfering.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Tested-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine/ste_dma40: fix memory leak due to prepared descriptors
dmaengine/ste_dma40: fix Oops due to double free of client descriptor
dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free().
dmaengine/ste_dma40: add missing kernel doc for pending_queue
|
|
* 'for-linus' of git://opensource.wolfsonmicro.com/regmap:
regmap: Remove bitrotted module_put()s
|
|
* 'for-linus' of git://twin.jikos.cz/jikos/hid:
HID: wacom: Unregister sysfs attributes on remove
HID: wacom: Fix error path of power-supply initialization
HID: add support for HuiJia USB Gamepad connector
HID: magicmouse: ignore 'ivalid report id' while switching modes, v2
HID: magicmouse: Set resolution of touch surfaces
|
|
* 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
i2c-tegra: fix possible race condition after tx
i2c-tegra: add I2C_FUNC_SMBUS_EMUL
i2c-tegra: Add of_match_table
i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths
|
|
* 'amd/fixes' of git://git.8bytes.org/scm/iommu:
iommu/amd: Don't take domain->lock recursivly
iommu/amd: Make sure iommu->need_sync contains correct value
|
|
* 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip:
rtc: twl: Fix registration vs. init order
rtc: Initialized rtc_time->tm_isdst
rtc: Fix RTC PIE frequency limit
rtc: rtc-twl: Remove lockdep related local_irq_enable()
rtc: rtc-twl: Switch to using threaded irq
rtc: ep93xx: Fix 'rtc' may be used uninitialized warning
alarmtimers: Avoid possible denial of service with high freq periodic timers
alarmtimers: Memset itimerspec passed into alarm_timer_get
alarmtimers: Avoid possible null pointer traversal
|
|
git://git.infradead.org/ubi-2.6
* branch 'linux-next' of git://git.infradead.org/ubifs-2.6:
UBIFS: not build debug messages with CONFIG_UBIFS_FS_DEBUG disabled
* branch 'linux-next' of git://git.infradead.org/ubi-2.6:
UBI: do not link debug messages when debugging is disabled
|
|
|
|
HID devices can be hotplugged so we should unregister all sysfs attributes when
removing a driver. Otherwise, manually unloading the wacom-driver will not
remove the sysfs attributes. Only when the device is disconnected, they are
removed, eventually.
Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
power_supply_unregister() must not be called if power_supply_register() failed.
The wdata->psy.dev pointer may point to invalid memory after a failed
power_supply_register() and hence wacom_remove() will fail while calling
power_supply_unregister().
This changes the wacom_probe function to fail if it cannot register the
power_supply devices. If we would want to keep the previous behaviour we had to
keep some flag about the power_supply state and check it on wacom_remove, but
this seems inappropriate here. Hence, we simply fail, too, if
power_supply_register fails.
Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
In tegra_i2c_fill_tx_fifo, once we have finished pushing all the bytes
to the I2C hardware controller, the interrupt might happen before we
have updated i2c_dev->msg_buf_remaining at the end of the function.
Then, in tegra_i2c_isr, we will call again tegra_i2c_fill_tx_fifo
triggering weird behaviour. This has been shown to happen under real
conditions.
Signed-off-by: Doug Anderson <dianders@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Acked-by: Rhyland Klein <rklein@nvidia.com>
Acked-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
|
|
Signed-off-by: Mike Rapoport <mike@compulab.co.il>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
|
|
This patch was intended to be part of 7ca2d1a105a239e300b937e9c41a10a4bd08f569
"i2c: Tegra: Add DeviceTree support". However, an early version of that patch,
which was missing a chunk, was applied to next-i2c. This change is that
missing chunk.
Signed-off-by: John Bonesio <bones@secretlab.ca>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
|
|
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
|
|
Rewrite the loop walking the id array during probe. The new code is
better adapted to a null-terminated array, and is also clearer and
more efficient than the original.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Axel Lin <axel.lin@gmail.com>
Cc: Guenter Roeck <guenter.roeck@ericsson.com>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
|
|
Current calculation is completely wrong. Add missing brackets to fix it.
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Cc: stable@kernel.org # 3.0+
|
|
The conversion to per bus type registration functions means we don't need
to do module_get()s to hold the bus types in memory (their users will link
to them) so we removed all those calls. This left module_put() calls in
the cleanup paths which aren't needed and which cause unbalanced puts if
we ever try to unload anything.
Reported-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
|
|
Prepared descriptors that are not submitted will not be freed. Add
prepared descriptor to a list to be able to release them upon
dmaengine_terminate_all().
Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
|
|
The client list may exist in two lists at the same time. This makes free
fail since the same desc is freed multiple times. Remove desc from
client list when adding it to the pending queue. Move free of client owned
descriptors from free_dma() to terminate_all().
Unable to handle kernel paging request at virtual address 00100104
pgd = dea8c000
[00100104] *pgd=1ea62831, *pte=00000000, *ppte=00000000
Internal error: Oops: 817 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 Not tainted (3.1.0-rc3+ #58)
PC is at d40_free_chan_resources+0x64/0x330
Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
|
|
d40_desc_free() already calls d40_pool_lli_free().
Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
|
|
Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
|
|
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon/kms: make sure pci max read request size is valid on evergreen+ (v2)
drm/radeon/kms: set a default max_pixel_clock
|
|
The domain_flush_devices() function takes the domain->lock.
But this function is only called from update_domain() which
itself is already called unter the domain->lock. This causes
a deadlock situation when the dma-address-space of a domain
grows larger than 1GB.
Cc: stable@kernel.org
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
|
|
The value is only set to true but never set back to false,
which causes to many completion-wait commands to be sent to
hardware. Fix it with this patch.
Cc: stable@kernel.org
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
|
|
If the bios or OS sets the pci max read request size to 0 or an
invalid value (6,7), it can result in a hang or slowdown. Check
and set it to something sane if it's invalid.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=42162
v2: use pci reg defines from include/linux/pci_regs.h
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@kernel.org
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
* 'for-linus' of git://neil.brown.name/md:
md/raid5: fix a hang on device failure.
md: fix clearing of 'blocked' flag in the presence of bad blocks.
md/linear: avoid corrupting structure while waiting for rcu_free to complete.
md: use REQ_NOIDLE flag in md_super_write()
md: ensure changes to 'write-mostly' are reflected in metadata.
md: report failure if a 'set faulty' request doesn't.
|
|
On some Power rv100 cards, we have no ATY OF table, but we have
no combios table either, and hence we refuse all modes on VGA-0
since we end up with a 0 max pixel clock.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: stable@kernel.org
Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
|
|
Waiting for a 'blocked' rdev to become unblocked in the raid5d thread
cannot work with internal metadata as it is the raid5d thread which
will clear the blocked flag.
This wasn't a problem in 3.0 and earlier as we only set the blocked
flag when external metadata was used then.
However we now set it always, so we need to be more careful.
Signed-off-by: NeilBrown <neilb@suse.de>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm/radeon/kms: add s/r quirk for Compaq Presario V5245EU
drm/radeon/kms: evergreen & ni reset SPI block on CP resume
drm: Fix the number of connector and encoder to cleanup functions
|
|
Fixes resume on Compaq Presario V5245EU.
Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=41642
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
For some reason SPI block is in broken state after module
unloading. This lead to broken rendering after reloading
module. Fix this by reseting SPI block in CP resume function
Signed-off-by: Jerome Glisse <jglisse@redhat.com
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
When the 'blocked' flag on a device is cleared while there are
unacknowledged bad blocks we must fail the device. This is needed for
backwards compatability of the interface.
The code currently uses the wrong test for "unacknowledged bad blocks
exist". Change it to the right test.
Signed-off-by: NeilBrown <neilb@suse.de>
|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (42 commits)
netpoll: fix incorrect access to skb data in __netpoll_rx
cassini: init before use in cas_interruptN.
can: ti_hecc: Fix uninitialized spinlock in probe
can: ti_hecc: Fix unintialized variable
net: sh_eth: fix the compile error
net/phy: fix DP83865 phy interrupt handler
sendmmsg/sendmsg: fix unsafe user pointer access
ibmveth: Fix leak when recycling skb and hypervisor returns error
arp: fix rcu lockdep splat in arp_process()
bridge: fix a possible use after free
bridge: Pseudo-header required for the checksum of ICMPv6
mcast: Fix source address selection for multicast listener report
MAINTAINERS: Update GIT trees for network development
ath9k: Fix PS wrappers in ath9k_set_coverage_class
carl9170: Fix mismatch in carl9170_op_set_key mutex lock-unlock
wl12xx: add max_sched_scan_ssids value to the hw description
wl12xx: Fix validation of pm_runtime_get_sync return value
wl12xx: Remove obsolete testmode NVS push command
bcma: add uevent to the bus, to autoload drivers
ath9k_hw: Fix STA (AR9485) bringup issue due to incorrect MAC address
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-3.x
* 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-3.x:
sh: fix the compile error in setup-sh7757.c
serial: sh-sci: report CTS as active for get_mctrl
sh: Add unaligned memory access for PC relative intructions
sh: Fix unaligned memory access for branches without delay slots
sh: Fix up fallout from cpuidle changes.
serial: sh-sci: console Runtime PM support
sh: Fix conflicting definitions of ptrace_triggered
serial: sh-sci: fix DMA build by including dma-mapping.h
serial: sh-sci: Fix up default regtype probing.
sh: intc: enable both edges GPIO interrupts on sh7372
shwdt: fix usage of mod_timer
clocksource: sh_cmt: wait for CMCNT on init V2
|
|
It is left out the code to decrease the number of connector and encoder
to the cleanup functions.
Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
sh-sci.c sets hardware up and then let the HW do all flow controls.
There is no software code, nor needs to get/set real CTS signal.
But, when turning CRTSCTS on through termios, uart_set_termios() in
serial_core.c checks CTS, and stops TX if it is inactive at the moment.
Because sci_get_mctrl() returns a fixed value DTR|RTS|DSR but CTS,
the sequence
open -> set CRTSCTS -> write
hit the case and stop working, no more outputs.
This patch makes sci_get_mctrl() report CTS in addition.
Signed-off-by: Takashi YOSHII <takashi.yoshii.zj@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
* 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ARM: mach-shmobile: sh7372 LCDC1 suspend fix V2 (incremental)
OMAP: omap_device: only override _noirq methods, not normal suspend/resume
PM / Runtime: Correct documentation of pm_runtime_irq_safe()
ARM: mach-shmobile: sh7372 LCDC1 suspend fix
sh-sci / PM: Use power.irq_safe
PM: Use spinlock instead of mutex in clock management functions
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
firewire: sbp2: fix panic after rmmod with slow targets
|
|
Only register as an RTC device after the hardware has been
successfully initialized. The RTC class driver will call
back to this driver to read a pending alarm, and other
drivers watching for new devices on the RTC class may
read the RTC time upon registration. Such access might
occur while the RTC is stopped, prior to clearing
pending alarms, etc.
The new ordering also avoids leaving the platform
device drvdata set to an unregistered struct rtc_device *
on probe errors.
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
|
|
Even though the Linux kernel does not use the tm_isdst field, it is
exposed as part of the ABI. This field can accidentally be left
initialized, which is why we currently memset buffers returned to
userland in rtc_read_time.
There is a case however where the field can return garbage from the
stack though when using the RTC_ALM_READ ioctl on the rtc device. This
ioctl invokes rtc_read_alarm, which is careful to memset the rtc_wkalrm
buffer that is copied to userland, but it then uses a struct copy to
assign to alarm->time given the return value from rtc_ktime_to_tm().
rtc_ktime_to_tm() is implemented by calling rtc_time_to_tm using a
derivative seconds counds from ktime, but rtc_time_to_tm does not assign
a value to ->tm_isdst. This results in garbage from rtc_ktime_to_tm()'s
frame ending up being copied out to userland as part of the returned
rtc_wkalrm.
Fix this by initializing rtc_time->tm_isdst to 0 in rtc_time_to_tm.
Signed-off-by: Mike Waychison <mikew@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6
* 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6:
drm/i915: Fix wrong initializer for "locked" variable in assert_panel_unlocked
i915: do not setup intel_backlight twice
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6
* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (30 commits)
USB: ftdi_sio: add Calao reference board support
USB option driver K3765/K4505 avoid CDC_DATA interface
USB: option: add YUGA device id to driver
usb: s5p-ehci: fix a NULL pointer deference
USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in ehci_bus_resume().
USB option driver add PID of Huawei Vodafone K4605
USB option driver add PID of Huawei Vodafone K3806
xhci: Handle zero-length isochronous packets.
USB: Avoid NULL pointer deref in usb_hcd_alloc_bandwidth.
usb: musb: gadget: fix error path
usb: gadget: f_phonet: unlock in error case
usb: musb: blackfin: include prefetch head file
usb: musb: tusb6010: fix compilation
usb: gadget: renesas_usbhs: fix DMA build by including dma-mapping.h
usb: musb: cppi: fix build errors due to DBG and missing musb variable
usb: musb: ux500: replace missing DBG with dev_dbg
usb: musb: ux500: set dma config for both src and dst
usb: musb: fix oops on musb_gadget_pullup
usb: host: ehci-omap: fix .remove and failure handling path of .probe(v1)
usb: gadget: hid: don't STALL when processing a HID Descriptor request
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6
* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
omap-serial: Allow IXON and IXOFF to be disabled.
TTY: serial, document ignoring of uart->ops->startup error
TTY: pty, fix pty counting
8250: Fix race condition in serial8250_backup_timeout().
serial/8250_pci: delete duplicate data definition
8250_pci: add support for Rosewill RC-305 4x serial port card
tty: Add "spi:" prefix for spi modalias
atmel_serial: fix atmel_default_console_device
serial: 8250_pnp: add Intermec CV60 touchscreen device
drivers/serial/ucc_uart.c: Fix compiler warning
pch_uart: Set PCIe bus number using probe parameter
serial: samsung: Fix build error
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6
* 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
drivers:misc: ti-st: fix unexpected UART close
drivers:misc: ti-st: free skb on firmware download
drivers:misc: ti-st: wait for completion at fail
drivers:misc: ti-st: reinit completion before send
drivers:misc: ti-st: fail-safe on wrong pkt type
drivers:misc: ti-st: reinit completion on ver read
drivers:misc:ti-st: platform hooks for chip states
drivers:misc: ti-st: avoid a misleading dbg msg
base/devres.c: quiet sparse noise about context imbalance
pti: add missing CONFIG_PCI dependency
drivers/base/devtmpfs.c: correct annotation of `setup_done'
driver core: fix kernel-doc warning in platform.c
firmware: fix google/gsmi.c build warning
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
* 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
staging: tidspbridge: fix compilation on dsp clock functions
staging: octeon-ethernet: Add missing #includes.
Staging: zcache: signedness bug in tmem_get()
staging: zcache: fix crash on high memory swap
staging: brcm80211: SPARC build error fix
staging: brcm80211: fix compile error on non-x86 archs since 3.0 kernel
|
|
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Spotted-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
In ti_hecc_probe(), the spinlock priv->mbx_lock is not
inited, causing a spinlock lockup BUG.
Acked-by: Anant Gole <anantgole@ti.com>
Signed-off-by: Abhilash K V <abhilash.kv@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
