aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-02-07Merge tag 'driver-core-3.14-rc2' of ↵Linus Torvalds1-4/+8
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fix from Greg KH: "Here is a single kernfs fix to resolve a much-reported lockdep issue with the removal of entries in sysfs" * tag 'driver-core-3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: kernfs: make kernfs_deactivate() honor KERNFS_LOCKDEP flag
2014-02-07block/null_blk: Fix completion processing from LIFO to FIFOShlomo Pongratz1-0/+2
The completion queue is implemented using lockless list. The llist_add is adds the events to the list head which is a push operation. The processing of the completion elements is done by disconnecting all the pushed elements and iterating over the disconnected list. The problem is that the processing is done in reverse order w.r.t order of the insertion i.e. LIFO processing. By reversing the disconnected list which is done in linear time the desired FIFO processing is achieved. Signed-off-by: Shlomo Pongratz <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07block: Explicitly handle discard/write same segmentsKent Overstreet1-29/+62
Immutable biovecs changed the way biovecs are interpreted - drivers no longer use bi_vcnt, they have to go by bi_iter.bi_size (to allow for using part of an existing segment without modifying it). This breaks with discards and write_same bios, since for those bi_size has nothing to do with segments in the biovec. So for now, we need a fairly gross hack - we fortunately know that there will never be more than one segment for the entire request, so we can special case discard/write_same. Signed-off-by: Kent Overstreet <[email protected]> Tested-by: Hugh Dickins <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07block: Fix nr_vecs for inline integrity vectorsMartin K. Petersen1-1/+9
Commit 9f060e2231ca changed the way we handle allocations for the integrity vectors. When the vectors are inline there is no associated slab and consequently bvec_nr_vecs() returns 0. Ensure that we check against BIP_INLINE_VECS in that case. Reported-by: David Milburn <[email protected]> Tested-by: David Milburn <[email protected]> Cc: [email protected] # v3.10+ Signed-off-by: Martin K. Petersen <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: Add bio_integrity setup to blk_mq_make_requestNicholas Bellinger1-0/+5
This patch adds the missing bio_integrity_enabled() + bio_integrity_prep() setup into blk_mq_make_request() in order to use DIF protection with scsi-mq. Cc: Martin K. Petersen <[email protected]> Signed-off-by: Nicholas Bellinger <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07Merge branch 'for-linus' of ↵Linus Torvalds2-32/+60
git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client Pull ceph fixes from Sage Weil: "There is an RBD fix for a crash due to the immutable bio changes, an error path fix, and a locking fix in the recent redirect support" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: libceph: do not dereference a NULL bio pointer libceph: take map_sem for read in handle_reply() libceph: factor out logic from ceph_osdc_start_request() libceph: fix error handling in ceph_osdc_init()
2014-02-07Merge tag 'arm64-fixes' of ↵Linus Torvalds20-67/+102
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Relax VDSO alignment requirements so that the kernel-picked one (4K) does not conflict with the dynamic linker's one (64K) - VDSO gettimeofday fix - Barrier fixes for atomic operations and cache flushing - TLB invalidation when overriding early page mappings during boot - Wired up new 32-bit arm (compat) syscalls - LSM_MMAP_MIN_ADDR when COMPAT is enabled - defconfig update - Clean-up (comments, pgd_alloc). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: defconfig: Expand default enabled features arm64: asm: remove redundant "cc" clobbers arm64: atomics: fix use of acquire + release for full barrier semantics arm64: barriers: allow dsb macro to take option parameter security: select correct default LSM_MMAP_MIN_ADDR on arm on arm64 arm64: compat: Wire up new AArch32 syscalls arm64: vdso: update wtm fields for CLOCK_MONOTONIC_COARSE arm64: vdso: fix coarse clock handling arm64: simplify pgd_alloc arm64: fix typo: s/SERRROR/SERROR/ arm64: Invalidate the TLB when replacing pmd entries during boot arm64: Align CMA sizes to PAGE_SIZE arm64: add DSB after icache flush in __flush_icache_all() arm64: vdso: prevent ld from aligning PT_LOAD segments to 64k
2014-02-07Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linusLinus Torvalds7-11/+24
Pull MIPS updates from Ralf Baechle: "hree minor patches. All have sat in -next for a few days" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: fpu.h: Fix build when CONFIG_BUG is not set MIPS: Wire up sched_setattr/sched_getattr syscalls MIPS: Alchemy: Fix DB1100 GPIO registration
2014-02-07Merge branch 'v4l_for_linus' of ↵Linus Torvalds32-72/+84
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A series of small fixes. Mostly driver ones. There is one core regression fix on a patch that was meant to fix some race issues on vb2, but that actually caused more harm than good. So, we're just reverting it for now" * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] adv7842: Composite free-run platfrom-data fix [media] v4l2-dv-timings: fix GTF calculation [media] hdpvr: Fix memory leak in debug [media] af9035: add ID [2040:f900] Hauppauge WinTV-MiniStick 2 [media] mxl111sf: Fix compile when CONFIG_DVB_USB_MXL111SF is unset [media] mxl111sf: Fix unintentional garbage stack read [media] cx24117: use a valid dev pointer for dev_err printout [media] cx24117: remove dead code in always 'false' if statement [media] update Michael Krufky's email address [media] vb2: Check if there are buffers before streamon [media] Revert "[media] videobuf_vm_{open,close} race fixes" [media] go7007-loader: fix usb_dev leak [media] media: bt8xx: add missing put_device call [media] exynos4-is: Compile in fimc-lite runtime PM callbacks conditionally [media] exynos4-is: Compile in fimc runtime PM callbacks conditionally [media] exynos4-is: Fix error paths in probe() for !pm_runtime_enabled() [media] s5p-jpeg: Fix wrong NV12 format parameters [media] s5k5baf: allow to handle arbitrary long i2c sequences
2014-02-07Merge tag 'hwmon-for-linus' of ↵Linus Torvalds2-36/+36
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix PMBus driver problem with some multi-page voltage sensors and fix da9055 interrupt initialization" * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (da9055) Remove use of regmap_irq_get_virq() hwmon: (pmbus) Support per-page exponent in linear mode
2014-02-07Merge tag 'pm+acpi-3.14-rc2' of ↵Linus Torvalds7-23/+75
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael Wysocki: "These include a fix for a recent ACPI hotplug regression, four concurrency related fixes and one PCI device removal fix for ACPI-based PCI hotplug (ACPIPHP), intel_pstate fix that should go into stable, three simple ACPI cleanups and a new entry for the ACPI video blacklist. Specifics: - Fix for a recent ACPI hotplug regression causing a NULL pointer dereference to occur while handling ACPI eject notifications for already ejected devices. From Toshi Kani. - Four concurrency-related fixes for ACPIPHP. Two of them add missing locking and the other two fix race conditions related to reference counting. - ACPIPHP fix to avoid NULL pointer dereferences during device removal involving Virtual Funcions. - intel_pstate fix to make it compute the percentage of time the CPU is busy properly. From Dirk Brandewie. - Removal of two unnecessary NULL pointer checks in ACPI code and a fix for sscanf() format string from Dan Carpenter and Luis G.F. - New ACPI video blacklist entry for HP EliteBook Revolve 810 from Mika Westerberg" * tag 'pm+acpi-3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / hotplug: Fix panic on eject to ejected device ACPI / battery: Fix incorrect sscanf() string in acpi_battery_init_alarm() ACPI / proc: remove unneeded NULL check ACPI / utils: remove a pointless NULL check ACPI / video: Add HP EliteBook Revolve 810 to the blacklist intel_pstate: Take core C0 time into account for core busy calculation ACPI / hotplug / PCI: Fix bridge removal race vs dock events ACPI / hotplug / PCI: Fix bridge removal race in handle_hotplug_event() ACPI / hotplug / PCI: Scan root bus under the PCI rescan-remove lock ACPI / hotplug / PCI: Move PCI rescan-remove locking to hotplug_event() ACPI / hotplug / PCI: Remove entries from bus->devices in reverse order
2014-02-07libceph: do not dereference a NULL bio pointerIlya Dryomov1-2/+6
Commit f38a5181d9f3 ("ceph: Convert to immutable biovecs") introduced a NULL pointer dereference, which broke rbd in -rc1. Fix it. Cc: Kent Overstreet <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2014-02-07Merge tag 'efi-urgent' into x86/urgentH. Peter Anvin9081-199116/+514867
* Avoid WARN_ON() when mapping BGRT on Baytrail (EFI 32-bit). Signed-off-by: H. Peter Anvin <[email protected]>
2014-02-07Modpost: fixed USB alias generation for ranges including 0x9 and 0xAJan Moskyto Matejka1-2/+2
Commit afe2dab4f6 ("USB: add hex/bcd detection to usb modalias generation") changed the routine that generates alias ranges. Before that change, only digits 0-9 were supported; the commit tried to fix the case when the range includes higher values than 0x9. Unfortunately, the commit didn't fix the case when the range includes both 0x9 and 0xA, meaning that the final range must look like [x-9A-y] where x <= 0x9 and y >= 0xA -- instead the [x-9A-x] range was produced. Modprobe doesn't complain as it sees no difference between no-match and bad-pattern results of fnmatch(). Fixing this simple bug to fix the aliases. Also changing the hardcoded beginning of the range to uppercase as all the other letters are also uppercase in the device version numbers. Fortunately, this affects only the dvb-usb-dib0700 module, AFAIK. Signed-off-by: Jan Moskyto Matejka <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07wlags49_h2: Fix overflow in wireless_set_essid()Maurizio Lombardi1-1/+1
This patch prevents the wireless_set_essid() function from overwriting the last byte of the NetworkName buffer which must be NULL. Signed-off-by: Maurizio Lombardi <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07xlr_net: Fix missing trivial allocation checkAlan Cox1-0/+5
Signed-off-by: Alan Cox <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: r8188eu: overflow in rtw_p2p_get_go_device_address()Dan Carpenter1-6/+4
The go_devadd_str[] array is two characters too small to hold the address so we corrupt memory. I've changed the user space API slightly and I don't have a way to test if this breaks anything. In the original code we truncated away the last digit of the address and the NUL terminator so it was already a bit broken. Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Larry Finger <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: r8188eu: array overflow in rtw_mp_ioctl_hdl()Dan Carpenter1-1/+1
MAX_MP_IOCTL_SUBCODE (35) and mp_ioctl_hdl (32 elements) are no longer in sync. It leads to a bogus pointer dereference. Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Larry Finger <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: r8188eu: Fix typo in USB_DEVICE listLarry Finger1-1/+1
There is a typo in the device list that interchanges the vendor and product codes for one of the entries. This exchange was determined by noticing that the vendor code is 0x07b8 for Abocom at http://www.linux-usb.org/usb.ids. Signed-off-by: Larry Finger <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07usbip/userspace/libsrc/names.c: memory leakHeinrich Schuchardt1-4/+4
revised patch p is freed if NULL. p is leaked if second calloc fails. Signed-off-by: Heinrich Schuchardt <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07gpu: ion: dereferencing an ERR_PTRDan Carpenter1-1/+1
We dereference "heap->task" before checking if it's an ERR_PTR. Fixes: ea313b5f88ed ('gpu: ion: Also shrink memory cached in the deferred free list') Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: comedi: usbduxsigma: fix unaligned dereferencesIan Abbott1-2/+4
There are a couple of dereferences such as `*(uint32_t *)(devpriv->insn_buf + 1)` that are unaligned as `devpriv->insn_buf` is of type `uint8_t *`. This works on x86 architecture but may not be supported on other architectures. Call `get_unalign()` to perform the unaligned dereferences. Signed-off-by: Ian Abbott <[email protected]> Cc: Bernd Porr <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: comedi: fix too early cleanup in comedi_auto_config()Ian Abbott1-2/+0
`comedi_auto_config()` is usually called from the probe routine of a low-level comedi driver to allocate and auto-configure a comedi device. Part of this involves calling the low-level driver's `auto_attach()` handler, and if that is successful, `comedi_device_postconfig()` tries to complete the configuration of the comedi device. If either of those fail, `comedi_device_detach()` is called to clean up, and `comedi_release_hardware_device()` is called to remove the dynamically allocated comedi device. Unfortunately, `comedi_device_detach()` clears the `hw_dev` member of the `struct comedi_device` (indirectly via `comedi_clear_hw_dev()`), and that stops `comedi_release_hardware_device()` finding the comedi device associated with the hardware device, so the comedi device won't be removed properly. Since `comedi_release_hardware_device()` also calls `comedi_device_detach()` (assuming it finds the comedi device associated with the hardware device), the fix is to remove the direct call to `comedi_device_detach()` from `comedi_auto_config()` and let the call to `comedi_release_hardware_device()` take care of it. Signed-off-by: Ian Abbott <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: android: ion: dummy: fix an error codeDan Carpenter1-1/+1
We should be returning -ENOMEM here instead of zero. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07blk-mq: initialize sg_reserved_sizeChristoph Hellwig1-0/+2
To behave the same way as the old request path. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: handle dma_drain_sizeChristoph Hellwig1-0/+10
Make blk-mq handle the dma_drain_size field the same way as the old request path. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: divert __blk_put_request for MQ opsChristoph Hellwig1-0/+5
__blk_put_request needs to call into the blk-mq code just like blk_put_request. As we don't have the queue lock in this case both end up calling the same function. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07blk-mq: support at_head inserations for blk_execute_rqChristoph Hellwig3-9/+13
This is neede for proper SG_IO operation as well as various uses of blk_execute_rq from the SCSI midlayer. Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2014-02-07libceph: take map_sem for read in handle_reply()Ilya Dryomov1-6/+11
Handling redirect replies requires both map_sem and request_mutex. Taking map_sem unconditionally near the top of handle_reply() avoids possible race conditions that arise from releasing request_mutex to be able to acquire map_sem in redirect reply case. (Lock ordering is: map_sem, request_mutex, crush_mutex.) Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2014-02-07libceph: factor out logic from ceph_osdc_start_request()Ilya Dryomov1-23/+39
Factor out logic from ceph_osdc_start_request() into a new helper, __ceph_osdc_start_request(). ceph_osdc_start_request() now amounts to taking locks and calling __ceph_osdc_start_request(). Signed-off-by: Ilya Dryomov <[email protected]> Reviewed-by: Sage Weil <[email protected]>
2014-02-07Merge branch 'master' of ↵John W. Linville30-159/+256
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
2014-02-07xen-blkfront: handle backend CLOSED without CLOSINGDavid Vrabel1-1/+4
Backend drivers shouldn't transistion to CLOSED unless the frontend is CLOSED. If a backend does transition to CLOSED too soon then the frontend may not see the CLOSING state and will not properly shutdown. So, treat an unexpected backend CLOSED state the same as CLOSING. Signed-off-by: David Vrabel <[email protected]> Acked-by: Konrad Rzeszutek Wilk <[email protected]> Cc: [email protected] Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkif: drop struct blkif_request_segment_alignedRoger Pau Monne4-25/+19
This was wrongly introduced in commit 402b27f9, the only difference between blkif_request_segment_aligned and blkif_request_segment is that the former has a named padding, while both share the same memory layout. Also correct a few minor glitches in the description, including for it to no longer assume PAGE_SIZE == 4096. Signed-off-by: Roger Pau Monné <[email protected]> [Description fix by Jan Beulich] Signed-off-by: Jan Beulich <[email protected]> Reported-by: Jan Beulich <[email protected]> Cc: Konrad Rzeszutek Wilk <[email protected]> Cc: David Vrabel <[email protected]> Cc: Boris Ostrovsky <[email protected]> Tested-by: Matt Rushton <[email protected]> Cc: Matt Wilson <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkback: fix shutdown raceRoger Pau Monne3-10/+24
Introduce a new variable to keep track of the number of in-flight requests. We need to make sure that when xen_blkif_put is called the request has already been freed and we can safely free xen_blkif, which was not the case before. Signed-off-by: Roger Pau Monné <[email protected]> Cc: Konrad Rzeszutek Wilk <[email protected]> Cc: David Vrabel <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Tested-by: Matt Rushton <[email protected]> Reviewed-by: Matt Rushton <[email protected]> Cc: Matt Wilson <[email protected]> Cc: Ian Campbell <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkback: fix memory leaksRoger Pau Monne3-9/+31
I've at least identified two possible memory leaks in blkback, both related to the shutdown path of a VBD: - blkback doesn't wait for any pending purge work to finish before cleaning the list of free_pages. The purge work will call put_free_pages and thus we might end up with pages being added to the free_pages list after we have emptied it. Fix this by making sure there's no pending purge work before exiting xen_blkif_schedule, and moving the free_page cleanup code to xen_blkif_free. - blkback doesn't wait for pending requests to end before cleaning persistent grants and the list of free_pages. Again this can add pages to the free_pages list or persistent grants to the persistent_gnts red-black tree. Fixed by moving the persistent grants and free_pages cleanup code to xen_blkif_free. Also, add some checks in xen_blkif_free to make sure we are cleaning everything. Signed-off-by: Roger Pau Monné <[email protected]> Cc: Konrad Rzeszutek Wilk <[email protected]> Reviewed-by: David Vrabel <[email protected]> Cc: Boris Ostrovsky <[email protected]> Tested-by: Matt Rushton <[email protected]> Reviewed-by: Matt Rushton <[email protected]> Cc: Matt Wilson <[email protected]> Cc: Ian Campbell <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07xen-blkback: fix memory leak when persistent grants are usedMatt Rushton1-3/+3
Currently shrink_free_pagepool() is called before the pages used for persistent grants are released via free_persistent_gnts(). This results in a memory leak when a VBD that uses persistent grants is torn down. Cc: Konrad Rzeszutek Wilk <[email protected]> Cc: "Roger Pau Monné" <[email protected]> Cc: Ian Campbell <[email protected]> Reviewed-by: David Vrabel <[email protected]> Cc: [email protected] Cc: [email protected] Cc: Anthony Liguori <[email protected]> Signed-off-by: Matt Rushton <[email protected]> Signed-off-by: Matt Wilson <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
2014-02-07staging: lustre: fix quotactl permission denied (LU-4530)Cédric Dufour - Idiap Research Institute1-1/+1
The changes introduced in commit 4b1a25f06b30b203 ("fix build when CONFIG_UIDGID_STRICT_TYPE_CHECKS is on") got the UID check the wrong way around, leading to "Permission denied" when a regular user attempts to retrieve his quota (lfs quota -u ...) but allowing him to retrieve other users quota. Full details at: https://jira.hpdd.intel.com/browse/LU-4530 Cc: Peng Tao <[email protected]> Cc: <[email protected]> # 3.12.x Cc: <[email protected]> # 3.13.x Signed-off-by: Cédric Dufour <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: android: sync: Signal pt before sync_timeline object gets destroyedPrakash Kamliya1-4/+4
There is a race condition Assume we have *one* sync_fence object, with *one* sync_pt which belongs to *one* sync_timeline, given this condition, sync_timeline->kref will have two counts, one for sync_timeline (implicit) and another for sync_pt. Assume following is the situation on CPU Theead-1 : (Thread which calls sync_timeline_destroy()) -> (some function calls) -> sync_timeline_destory() -> sync_timeline_signal() (CPU is inside this function after putting reference to sync_timeline) At this time Thread-2 comes and does following Thread-2 : (fclose on fence fd) > sync_fence_release() -> because of fclose() on fence object -> sync_fence_free() -> sync_pt_free() -> kref_put(&pt->parent->kref, sync_timeline_free); -> sync_timeline_free() (CPU is inside this because this time kref will be zero after _put) Thread-2 will free sync_timeline object before Thread-1 has finished its work inside sync_timeline_signal. With this change we signals all sync_pt before putting reference to sync_timeline object. Cc: Colin Cross <[email protected]> Cc: Android Kernel Team <[email protected]> Signed-off-by: Prakash Kamliya <[email protected]> [jstultz: minor commit subject tweak] Signed-off-by: John Stultz <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: comedi: adv_pci1710: fix analog output readback valueH Hartley Sweeten1-5/+12
The last value written to a analog output channel is cached in the private data of this driver for readback. Currently, the wrong value is cached in the (*insn_write) functions. The current code stores the data[n] value for readback afer the loop has written all the values. At this time 'n' points past the end of the data array. Fix the functions by using a local variable to hold the data being written to the analog output channel. This variable is then used after the loop is complete to store the readback value. The current value is retrieved before the loop in case no values are actually written.. Signed-off-by: H Hartley Sweeten <[email protected]> Reviewed-by: Ian Abbott <[email protected]> Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: r8188eu: memory corruption handling long ssidsDan Carpenter1-14/+8
We should cap the SSID length at NDIS_802_11_LENGTH_SSID (32) characters to avoid memory corruption. If the SSID is too long then I have opted to ignore it instead of truncating it. We don't need to clear bssid->Ssid.Ssid[0] because this struct is allocated with rtw_zmalloc() Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Larry Finger <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: gdm72xx: fix leaks at failure path in gdm_usb_probe()Alexey Khoroshilov1-0/+3
Error handling code in gdm_usb_probe() misses to deallocate tx_ and rx_structs and to do usb_put_dev(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07arm64: defconfig: Expand default enabled featuresMark Rutland2-4/+15
FPGA implementations of the Cortex-A57 and Cortex-A53 are now available in the form of the SMM-A57 and SMM-A53 Soft Macrocell Models (SMMs) for Versatile Express. As these attach to a Motherboard Express V2M-P1 it would be useful to have support for some V2M-P1 peripherals enabled by default. Additionally a couple of of features have been introduced since the last defconfig update (CMA, jump labels) that would be good to have enabled by default to ensure they are build and boot tested. This patch updates the arm64 defconfig to enable support for these devices and features. The arm64 Kconfig is modified to select HAVE_PATA_PLATFORM, which is required to enable support for the CompactFlash controller on the V2M-P1. A few options which don't need to appear in defconfig are trimmed: * BLK_DEV - selected by default * EXPERIMENTAL - otherwise gone from the kernel * MII - selected by drivers which require it * USB_SUPPORT - selected by default Signed-off-by: Mark Rutland <[email protected]> Signed-off-by: Catalin Marinas <[email protected]>
2014-02-07Revert "Staging: dgrp: Refactor the function dgrp_receive() in drrp_net_ops.c"Greg Kroah-Hartman1-175/+155
This reverts commit b73db54750482cf3910046c82a84ce8c1684dfbe. Reported-by: Geert Uytterhoeven <[email protected]> Reported-by: Chen Gang <[email protected]> Cc: Rashika Kheria <[email protected]> Cc: James Hogan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07Staging: ozwpan: Fix null dereferenceSalym Senyonga1-1/+2
If net_dev is NULL memcpy() will Oops. Signed-off-by: Salym Senyonga <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging/usbip: Fix vhci_hcd attach failure error message to be informativeShuah Khan1-1/+2
When attach fails due to unsupported and/or invalid bus speed, the message vhci_hcd prints out doesn't include any useful information as to what caused the failure. Change the message to be informative and use usb_speed_string() to get the right speed string from usb common. Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: rtl8821ae: Fixed the size of array to macro as discussed by LinusSurendra Patil1-1/+1
Linus Torvalds writes: It causes an interesting warning for me: drivers/staging/rtl8821ae/rtl8821ae/dm.c: In function ‘rtl8821ae_dm_clear_txpower_tracking_state’: drivers/staging/rtl8821ae/rtl8821ae/dm.c:487:31: warning: iteration 2u invokes undefined behavior [-Waggressive-loop-optimizations] rtldm->bb_swing_idx_ofdm[p] = rtldm->default_ofdm_index; ^ drivers/staging/rtl8821ae/rtl8821ae/dm.c:485:2: note: containing loop for (p = RF90_PATH_A; p < MAX_RF_PATH; ++p) { ^ and gcc is entirely correct: that loop iterates from 0 to 3, and does this: rtldm->bb_swing_idx_ofdm[p] = rtldm->default_ofdm_index; but the bb_swing_idx_ofdm[] array only has two members. So the last two iterations will overwrite bb_swing_idx_ofdm_current and the first entry in bb_swing_idx_ofdm_base[]. Now, the bug does seem to be benign: bb_swing_idx_ofdm_current isn't actually ever *used* as far as I can tell, and the first entry of bb_swing_idx_ofdm_base[] will have been written with that same "rtldm->default_ofdm_index" value. But gcc is absolutely correct, and that driver needs fixing. I've pulled it and will let it be because it doesn't seem to be an issue in practice, but please fix it. The obvious fix would seem to change the size of "2" to be "MAX_RF_PATH", but I'll abstain from doing those kinds of changes in the merge when it doesn't seem to affect the build or functionality). Reported-By: Linus Torvalds <[email protected]> Signed-off-by: Surendra Patil <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07staging: octeon-usb: Probe via device tree populated platform device.David Daney1-157/+116
Extract clocking parameters from the device tree, and remove now dead code and types. Signed-off-by: David Daney <[email protected]> Tested-by: Aaro Koskinen <[email protected]> Signed-off-by: Aaro Koskinen <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07lustre: add myself to list of people to CC on lustre patchesOleg Drokin1-2/+3
Signed-off-by: Oleg Drokin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07lustre: Correct KUC code max changelog msg sizeOleg Drokin2-3/+5
The kernel to userspace communication routines (KUC) allocate and limit the maximum cs_buf size to CR_MAXSIZE. However this fails to account for the fact that the buffer is assumed to begin with a struct kuc_hdr. To allocate and account for that space, we introduce a new define, KUC_CHANGELOG_MSG_MAXSIZE. Signed-off-by: Christopher J. Morrone <[email protected]> Reviewed-on: http://review.whamcloud.com/7406 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3587 Reviewed-by: Andreas Dilger <[email protected]> Reviewed-by: jacques-Charles Lafoucriere <[email protected]> Reviewed-by: Oleg Drokin <[email protected]> Signed-off-by: Oleg Drokin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2014-02-07lustre: Account for changelog_ext_rec in CR_MAXSIZEOleg Drokin1-1/+2
CR_MAXSIZE needs to account for an llog_changelog_rec that actually contains a changelog_ext_rec structure rather than a changelog_rec. With out doing so, a file size approaching the Linux kernel NAME_MAX length that is renamed to a size also close to, or at, NAME_MAX will exceed CR_MAXSIZE and trip an assertion. Signed-off-by: Christopher J. Morrone <[email protected]> Reviewed-on: http://review.whamcloud.com/6993 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3587 Reviewed-by: Niu Yawei <[email protected]> Reviewed-by: Lai Siyao <[email protected]> Reviewed-by: Oleg Drokin <[email protected]> Signed-off-by: Oleg Drokin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>