Age | Commit message (Collapse) | Author | Files | Lines |
|
If the inherited BIOS framebuffer is smaller than the mode selected for
fbdev, then if we continue to use it then we cause display corruption as
we do not setup the panel fitter to upscale.
Regression from commit d978ef14456a38034f6c0e94a794129501f89200
Author: Jesse Barnes <[email protected]>
Date: Fri Mar 7 08:57:51 2014 -0800
drm/i915: Wrap the preallocated BIOS framebuffer and preserve for KMS fbcon v12
v2: Add a debug message to track the discard of the BIOS fb.
v3: Ville pointed out the difference between ref/unref
Reported-by: Knut Petersen <[email protected]>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77767
Signed-off-by: Chris Wilson <[email protected]>
Cc: Jesse Barnes <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Reviewed-by: Ville Syrjälä <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
We already check that the buffer object we're accessing is registered with
the file. Now also make sure that we can't DMA across buffer object boundaries.
v2: Code commenting update.
Cc: [email protected]
Signed-off-by: Thomas Hellstrom <[email protected]>
Reviewed-by: Jakob Bornecrantz <[email protected]>
|
|
Work around BIOSes that don't report the entire Intel MCH area.
MCHBAR is not an architected PCI BAR, so MCH space is usually reported as a
PNP0C02 resource. The MCH space was once 16KB, but is 32KB in newer parts.
Some BIOSes still report a PNP0C02 resource that is only 16KB, which means
the rest of the MCH space is consumed but unreported.
This can cause resource map sanity check warnings or (theoretically) a
device conflict if we assigned the unreported space to another device.
The Intel perf event uncore driver tripped over this when it claimed the
MCH region:
resource map sanity check conflict: 0xfed10000 0xfed15fff 0xfed10000 0xfed13fff pnp 00:01
Info: mapping multiple BARs. Your kernel is fine.
To prevent this, if we find a PNP0C02 resource that covers part of the MCH
space, extend it to cover the entire space.
References: http://lkml.kernel.org/r/[email protected]
Reported-and-tested-by: Borislav Petkov <[email protected]>
Signed-off-by: Bjorn Helgaas <[email protected]>
Acked-by: Borislav Petkov <[email protected]>
Acked-by: Stephane Eranian <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
In usbdux_ao_cmd(), the channels for the command are transfered from the
cmd->chanlist and stored in the private data 'ao_chanlist'. The channel
numbers are bit-shifted when stored so that they become the "command"
that is transfered to the device. The channel to command conversion
results in the 'ao_chanlist' having these values for the channels:
channel 0 -> ao_chanlist = 0x00
channel 1 -> ao_chanlist = 0x40
channel 2 -> ao_chanlist = 0x80
channel 3 -> ao_chanlist = 0xc0
The problem is, the usbduxsub_ao_isoc_irq() function uses the 'chan' value
from 'ao_chanlist' to access the 'ao_readback' array in the private data.
So instead of accessing the array as 0, 1, 2, 3, it accesses it as 0x00,
0x40, 0x80, 0xc0.
Fix this by storing the raw channel number in 'ao_chanlist' and doing the
bit-shift when creating the command.
Fixes: a998a3db530bff80 "staging: comedi: usbdux: cleanup the private data 'outBuffer'"
Cc: stable <[email protected]> # 3.12
Signed-off-by: H Hartley Sweeten <[email protected]>
Reviewed-by: Ian Abbott <[email protected]>
Acked-by: Bernd Porr <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
"The main change is that we now publish "firmware ID" for the serio
devices to help userspace figure out the kind of touchpads it is
dealing with: i8042 will export PS/2 port's PNP IDs as firmware IDs.
You will also get more quirks for Synaptics touchpads in various
Lenovo laptops, a change to elantech driver to recognize even more
models, and fixups to wacom and couple other drivers"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: elantech - add support for newer elantech touchpads
Input: soc_button_array - fix a crash during rmmod
Input: synaptics - add min/max quirk for ThinkPad T431s, L440, L540, S1 Yoga and X1
Input: synaptics - report INPUT_PROP_TOPBUTTONPAD property
Input: Add INPUT_PROP_TOPBUTTONPAD device property
Input: i8042 - add firmware_id support
Input: serio - add firmware_id sysfs attribute
Input: wacom - handle 1024 pressure levels in wacom_tpc_pen
Input: wacom - references to 'wacom->data' should use 'unsigned char*'
Input: wacom - override 'pressure_max' with value from HID_USAGE_PRESSURE
Input: wacom - use full 32-bit HID Usage value in switch statement
Input: wacom - missed the last bit of expresskey for DTU-1031
Input: ads7846 - fix device usage within attribute show
Input: da9055_onkey - remove use of regmap_irq_get_virq()
|
|
There is a missing 0 entry from the MOD_SEL3 table.
Signed-off-by: Phil Edworthy <[email protected]>
Acked-by: Laurent Pinchart <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
The extra entry in the table makes SCIFA0_B, and all
peripherals after it, fail.
Signed-off-by: Phil Edworthy <[email protected]>
Acked-by: Laurent Pinchart <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Since we set up device wake-up interrupts as pinctrl-single
interrupts, we now must use the standard request_irq and
related functions to manage them.
If the pin interrupts are enabled for some pins at boot,
the wake-up events can show up as constantly pending
at least on omaps and will hang the system unless the related
device driver clears the event at the device.
To fix this, let's clear the interrupt flags during init,
and print out a warning so the board maintainers can update
their drivers to do proper request_irq for the driver specific
wake-up events.
Cc: Haojian Zhuang <[email protected]>
Cc: Linus Walleij <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
'spi/fix/hspi' and 'spi/fix/sirf' into spi-linus
|
|
|
|
s/interrupts-names/interrupt-names/g
s/clocks-names/clock-names/g
Some of the binding files and device tree files get this wrong and the
kernel won't be able to pick it up. Fix them up now so that they don't
get widely used.
Signed-off-by: Geert Uytterhoeven <[email protected]>
Acked-by : Patrice Chotard <[email protected]>
Signed-off-by: Grant Likely <[email protected]>
|
|
If I unplug the eDP monitor, the BIOS of my machine will enable the
VDD bit, then when the driver loads it will think VDD is enabled. It
will detect that the eDP is not enabled and return false from
intel_edp_init_connector. This will trigger a call to
edp_panel_vdd_off_sync(), which trigger a WARN saying that the
refcount of the power domain is less than zero.
The problem happens because the driver gets a refcount whenever it
enables the VDD bit, and puts the refcount whenever it disables the
VDD bit. But on this case, the BIOS enabled VDD, so all we do is to
call put() without calling get() first, so the code added is there to
make sure we always have the get() in case the BIOS enabled the bit.
This regression was introduced in
commit e9cb81a22841908b1c075156b409a538d09c8466
Author: Paulo Zanoni <[email protected]>
Date: Thu Nov 21 13:47:23 2013 -0200
drm/i915: get a runtime PM reference when the panel VDD is on
v2: - Rebase
Tested-by: Chris Wilson <[email protected]> (v1)
Reviewed-by: Daniel Vetter <[email protected]>
Cc: [email protected] (v3.13+)
Signed-off-by: Paulo Zanoni <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
... our current modeset code isn't good enough yet to handle this. The
scenario is:
1. BIOS sets up a cloned config with lvds+external screen on the same
pipe, e.g. pipe B.
2. We read out that state for pipe B and assign the gmch_pfit state to
it.
3. The initial modeset switches the lvds to pipe A but due to lack of
atomic modeset we don't recompute the config of pipe B.
-> both pipes now claim (in the sw pipe config structure) to use the
gmch_pfit, which just won't work.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74081
Tested-by: max <[email protected]>
Cc: Alan Stern <[email protected]>
Cc: [email protected]
Signed-off-by: Daniel Vetter <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
Newer elantech touchpads are not recognized by the current driver, since it
fails to detect their firmware version number. This prevents more advanced
touchpad features from being usable such as two-finger scrolling. This
patch allows newer touchpads to be detected and be fully functional. Tested
on Sony Vaio SVF13N17PXB.
Signed-off-by: Jordan Rife <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
|
|
When the system has zero or one button available, trying to rmmod
soc_button_array will cause crash. Fix this by properly handling -ENODEV
in probe().
Signed-off-by: Lejun Zhu <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus
Jonathan writes:
First found of IIO fixes for the 3.15 cycle.
* Fix the platform data support for the at91 adc driver.
* A couple of related follow up patches get the support working again
for at91sam9260 and at91sam9g45 as the earlier patch results in a device
name change.
* A default timer value in the at91 adc driver was bonkers. Make it sane.
* Fix incorrect reporting of the integration time for the cm32181 light sensor
* Fix a missing break in the ad2s1200 driver which would have give a false
error return.
* Make sure buffer scan mask queries from userspace return 0/1 rather than
a fairly random value depending on their implementation of test_bit
* Fix leak of the i2c client and a null pointer dereference in the cm36651
driver.
* Fix a build warning on avr32 for the mxs-lradc (not exactly a critical
combination - but the issue was real).
|
|
git://people.freedesktop.org/~deathsimple/linux into drm-next
1. Further PLL parameter fixes.
2. Fixes for HPD on DP
3. Could of different PM fixes
4. Disabling DPM on RV770
* 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux:
drm/radeon: don't allow runpm=1 on systems with out ATPX
drm/radeon: fix ATPX detection on non-VGA GPUs
drm/radeon/pm: don't walk the crtc list before it has been initialized (v2)
drm/radeon: properly unregister hwmon interface (v2)
drm/radeon: fix count in cik_sdma_ring_test()
drm/radeon/aux: fix hpd assignment for aux bus
drm/radeon: improve PLL limit handling in post div calculation
drm/radeon: use fixed PPL ref divider if needed
drm/radeon: disable dpm on rv770 by default
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
Pull gpio fixes from Linus Walleij:
"A small batch of GPIO fixes for the v3.15 series. I expect more to
come in but I'm a bit behind on mail, might as well get these to you
right now:
- Change a crucial semantic ordering in the GPIO irqchip helpers
- Fix two nasty regressions in the ACPI gpiolib extensions"
* tag 'gpio-v3.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
gpio / ACPI: Prevent potential wrap of GPIO value on OpRegion read
gpio / ACPI: Don't crash on NULL chip->dev
gpio: set data first, then chip and handler
|
|
The AS3722_GPIO_INV bit will always be blindly overwritten by
as3722_pinctrl_gpio_set_direction() and will be ignored when
setting the value of the GPIO in as3722_gpio_set() since the
enable_gpio_invert flag is never set. This will cause an
initially inverted GPIO to toggle when requested as an output,
which could be problematic if, for example, the GPIO controls
a critical regulator.
Instead of setting up the enable_gpio_invert flag, just leave
the invert bit alone and check it before setting the GPIO value.
Cc: <[email protected]> # v3.14+
Signed-off-by: Andrew Bresticker <[email protected]>
Reviewed-by: Stephen Warren <[email protected]>
Tested-by: Stephen Warren <[email protected]>
Acked-by: Laxman Dewangan <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
vgaswitcheroo and the ATPX ACPI methods are required to
power down the dGPU.
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=73901
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
|
|
Some newer PX laptops have the pci device class
set to DISPLAY_OTHER rather than DISPLAY_VGA. This
properly detects ATPX on those laptops.
Based on a patch from: Pali Rohár <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
Cc: [email protected]
|
|
Avoids a crash in certain cases when thermal irqs are generated
before the display structures have been initialized.
v2: fix the vblank and vrefresh helpers as well
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=73931
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
|
|
Need to properly unregister the hwmon device on driver
unload.
v2: minor clean up
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=73931
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
|
|
In the TB10x pin database, a port index of -1 is used to indicate
unmuxed GPIO pin groups. This bug fixes a 'cast to unsigned' bug of
this value.
Thanks to Dan Carpenter for highlighting this.
CC: Dan Carpenter <[email protected]>
Signed-off-by: Christian Ruppert <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
|
|
Should be 5 rather than 4.
Noticed-by: Mathias Fröhlich <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
Signed-off-by: Christian König <[email protected]>
|
|
In commit
commit 6375b768a9850b6154478993e5fb566fa4614a9c
Author: Ville Syrjälä <[email protected]>
Date: Mon Mar 3 11:33:36 2014 +0200
drm/i915: Reject >165MHz modes w/ DVI monitors
the driver started to filter out display modes which exceed the
single-link DVI 165Mz dotclock limits when the monitor doesn't report
itself as being HDMI compliant. The intent was to filter out all
EDID derived modes that require dual-link DVI to operate since we
don't support dual-link.
However the patch went a bit too far and also causes the driver to reject
such modes even when specified by the user. Normally we don't check the
sink limitations when setting a mode from the user. This allows the user
to specify any mode whether the sink reports to support it or not. This
can be useful since often the sinks support more modes than they report
in the EDID.
So relax the checks a bit, and apply the single-link DVI dotclock limit
only when filtering the mode list, and ignore the limit when setting
a user specified mode.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=72961
Tested-by: Nicholas Vinson <[email protected]>
Cc: [email protected] [3.14]
Reviewed-by: Daniel Vetter <[email protected]>
Signed-off-by: Ville Syrjälä <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>
|
|
The hpd (hot plug detect) pin assignment got lost
in the conversion to to the common i2c over aux
code. Without this information, aux transactions
do not work properly. Fixes DP failures.
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Christian König <[email protected]>
|
|
* pm-sleep:
PM / suspend: Make cpuidle work in the "freeze" state
* pm-cpuidle:
intel_idle: fix IVT idle state table setting
* pm-cpufreq:
cpufreq: highbank: fix ARM_HIGHBANK_CPUFREQ dependency warning
cpufreq: ppc: Fix integer overflow in expression
cpufreq, powernv: Fix build failure on UP
cpufreq: unicore32: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO
|
|
When make ARCH=arm multi_v7_defconfig, we get the following warnings:
warning: (ARM_HIGHBANK_CPUFREQ) selects GENERIC_CPUFREQ_CPU0 which has
unmet direct dependencies (ARCH_HAS_CPUFREQ && CPU_FREQ && HAVE_CLK
&& REGULATOR && OF && THERMAL && CPU_THERMAL)
To fix this, make ARM_HIGHBANK_CPUFREQ depend on ARCH_HAS_CPUFREQ and
REGULATOR instead of selecting them, PM_OPP will be selected by ARCH_HAS_CPUFREQ.
Signed-off-by: Kefeng Wang <[email protected]>
Acked-by: Viresh Kumar <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
On 32-bit, "12 * NSEC_PER_SEC" doesn't fit in "unsigned long"
(NSEC_PER_SEC is a "long" constant), causing an integer overflow:
drivers/cpufreq/ppc-corenet-cpufreq.c: In function 'corenet_cpufreq_cpu_init':
drivers/cpufreq/ppc-corenet-cpufreq.c:211:9: warning: integer overflow in expression [-Woverflow]
Force the intermediate to be 64-bit by adding an "ULL" suffix to the
constant multiplier to fix this.
Signed-off-by: Geert Uytterhoeven <[email protected]>
Acked-by: Viresh Kumar <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
Paul Gortmaker reported the following build failure of the powernv cpufreq
driver on UP configs:
drivers/cpufreq/powernv-cpufreq.c:241:2: error: implicit declaration of
function 'cpu_sibling_mask' [-Werror=implicit-function-declaration]
cc1: some warnings being treated as errors
make[3]: *** [drivers/cpufreq/powernv-cpufreq.o] Error 1
make[2]: *** [drivers/cpufreq] Error 2
make[1]: *** [drivers] Error 2
make: *** [sub-make] Error 2
The trouble here is that cpu_sibling_mask is defined only in <asm/smp.h>,
and <linux/smp.h> includes <asm/smp.h> only in SMP builds.
So fix this build failure by explicitly including <asm/smp.h> in the driver,
so that we get the definition of cpu_sibling_mask even in UP configurations.
Reported-by: Paul Gortmaker <[email protected]>
Signed-off-by: Srivatsa S. Bhat <[email protected]>
Acked-by: Viresh Kumar <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
This patch fixes coccinelle error regarding usage of IS_ERR and
PTR_ERR instead of PTR_ERR_OR_ZERO.
Signed-off-by: Duan Jiong <[email protected]>
Acked-by: Viresh Kumar <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
Ivy Town idle state table will not be set as intended. Fix it.
Picked up by Coverity - CID 1201420/1201421.
Fixes: 0138d8f075 ("intel_idle: fine-tune IVT residency targets")
Signed-off-by: Christoph Jaeger <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
This patch fixes a corner case in the previous USB Deadlock fix patch (12023e7
[SCSI] Fix USB deadlock caused by SCSI error handling).
The scenario is abort command, set flag, abort completes, send TUR, TUR
doesn't return, so we now try to abort the TUR, but scsi_abort_eh_cmnd()
will skip the abort because the flag is set and move straight to reset.
Reviewed-by: Hannes Reinecke <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
USB requires that every command be aborted first before we escalate to reset.
In particular, USB will deadlock if we try to reset first before aborting the
command.
Unfortunately, the flag we use to tell if a command has already been aborted:
SCSI_EH_ABORT_SCHEDULED is not cleared properly leading to cases where we can
requeue a command with the flag set and proceed immediately to reset if it
fails (thus causing USB to deadlock).
Fix by clearing the SCSI_EH_ABORT_SCHEDULED flag if it has been set. Which
means this will be the second time scsi_abort_command() has been called for
the same command. IE the first abort went out, did its thing, but now the
same command has timed out again.
So this flag gets cleared, and scsi_abort_command() returns FAILED, and _no_
asynchronous abort is being scheduled. scsi_times_out() will then proceed to
call scsi_eh_scmd_add(). But as we've cleared the SCSI_EH_ABORT_SCHEDULED
flag the SCSI_EH_CANCEL_CMD flag will continue to be set, and the command will
be aborted with the main SCSI EH routine.
Reported-by: Alan Stern <[email protected]>
Tested-by: Andreas Reis <[email protected]>
Signed-off-by: Hannes Reinecke <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
We're seeing a case where the contents of scmd->result isn't being reset after
a SCSI command encounters an error, is resubmitted, times out and then gets
handled. The error handler acts on the stale result of the previous error
instead of the timeout. Fix this by properly zeroing the scmd->status before
the command is resubmitted.
Signed-off-by: Alan Stern <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
We unconditionally execute scsi_eh_get_sense() to make sure all failed
commands that should have sense attached, do. However, the routine forgets
that some commands, because of the way they fail, will not have any sense code
... we should not bother them with a REQUEST_SENSE command. Fix this by
testing to see if we actually got a CHECK_CONDITION return and skip asking for
sense if we don't.
Tested-by: Alan Stern <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
The size of the buffer allocated for generic_serial_bus region access
is not correct. This patch introduces acpi_ex_get_serial_access_length()
to be invoked to obtain correct data buffer length.
Signed-off-by: Lv Zheng <[email protected]>
Reported by: Lan Tianyu <[email protected]>
Acked-by: Lan Tianyu <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
|
|
Tests have shown that when a power-up transition is followed by other
PHY operations too quickly, the USB port appears dead. Waiting 1ms fixes
this problem.
Signed-off-by: Daniel Mack <[email protected]>
Cc: [email protected] [3.14]
Signed-off-by: Felipe Balbi <[email protected]>
|
|
This patch reduce unecessary NETTX softirq call caused by
free skb header. You will see this softirq comes twice while
there is only one TX packet to be transmitted.
So using dev_kfree_skb() instead of dev_kfree_skb_any() to
avoid this problem.
Cc: David S. Miller <[email protected]>
Cc: Stephen Hemminger <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Macpaul Lin <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>
|
|
This reverts commit 716fb91dfe1777bd6d5e598f3d3572214b3ed296.
That commit caused a regression which would end up in a kernel
BUG() as below:
[ 101.554300] g_ether gadget: full-speed config #1: CDC Subset/SAFE
[ 101.585186] ------------[ cut here ]------------
[ 101.600587] kernel BUG at include/linux/netdevice.h:495!
[ 101.615850] Internal error: Oops - BUG: 0 [#1] PREEMPT ARM
[ 101.645539] Modules linked in:
[ 101.660483] CPU: 0 PID: 0 Comm: swapper Not tainted 3.15.0-rc1+ #104
[ 101.690175] task: c05dc5c8 ti: c05d2000 task.ti: c05d2000
[ 101.705579] PC is at eth_start+0x64/0x8c
[ 101.720981] LR is at __netif_schedule+0x7c/0x90
[ 101.736455] pc : [<c0299174>] lr : [<c036a134>] psr: 60000093
[ 101.736455] sp : c05d3d18 ip : c05d3cf8 fp : c05d3d2c
[ 101.782340] r10: 00000000 r9 : c196c1f0 r8 : c196c1a0
[ 101.797823] r7 : 00000000 r6 : 00000002 r5 : c1976400 r4 : c1976400
[ 101.828058] r3 : 00000000 r2 : c05d3ce8 r1 : 00000001 r0 : 00000002
[ 101.858722] Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
Reported-by: Robert Jarzmik <[email protected]>
Signed-of-by: Felipe Balbi <[email protected]>
|
|
Patch
commit 0479633686d370303e3430256ace4bd5f7f138dc
Author: Christoph Hellwig <[email protected]>
Date: Thu Feb 20 14:20:55 2014 -0800
[SCSI] do not manipulate device reference counts in scsi_get/put_command
Introduced a use after free:I in the kill case of scsi_prep_return we have to
release our device reference, but we do this trying to reference the just
freed command. Use the local sdev pointer instead.
Fixes: 0479633686d370303e3430256ace4bd5f7f138dc
Reported-by: Joe Lawrence <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
Patch
commit 0479633686d370303e3430256ace4bd5f7f138dc
Author: Christoph Hellwig <[email protected]>
Date: Thu Feb 20 14:20:55 2014 -0800
[SCSI] do not manipulate device reference counts in scsi_get/put_command
Introduced a use after free: when scsi_init_io fails we have to release our
device reference, but we do this trying to reference the just freed command.
Add a local scsi_device pointer to fix this.
Fixes: 0479633686d370303e3430256ace4bd5f7f138dc
Reported-by: Sander Eikelenboom <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
Initialize local variable trans_support before it is used rather
than after. It is supposed to contain the value of a register on the
controller containing bits that describe which transport modes the
controller supports (e.g. "performant", "ioaccel1", "ioaccel2"). A
NULL pointer dereference will almost certainly occur if trans_support
is not initialized at the right point. If for example the uninitialized
trans_support value does not have the bit set for ioaccel2 support when it
should be, then ioaccel2_alloc_cmds_and_bft() will not get called as it
should be and the h->ioaccel2_blockFetchTable array will remain NULL
instead of being allocated. Too late, trans_support finally gets
initialized with the correct value with ioaccel2 mode bit set,
which later causes calc_bucket_map() to be called to fill in
h->ioaccel2_blockFetchTable[]. However h->ioaccel2_blockFetchTable
is NULL because it didn't get allocated because earlier trans_support
wasn't initialized at the right point.
Fixes: e1f7de0cdd68d246d7008241cd9e443a54f880a8
Signed-off-by: Stephen M. Cameron <[email protected]>
Reported-by: Baoquan He <[email protected]>
Tested-by: Baoquan He <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
|
|
Store the value of d->hwirq in a local variable as the real value is wiped out
by calling irq_dispose_mapping. Without this patch, the armada_370_xp_free_msi
function would always free MSI#0, no matter what was passed to it.
Fixes: 31f614edb726fcc4d5aa0f2895fbdec9b04a3ca4 ('irqchip: armada-370-xp: implement MSI support')
Cc: <[email protected]> # v3.13+
Signed-off-by: Neil Greatorex <[email protected]>
Link: https://lkml.kernel.org/r/1397823593-1932-4-git-send-email-thomas.petazzoni@free-electrons.com
Signed-off-by: Thomas Petazzoni <[email protected]>
Link: https://lkml.kernel.org/r/1397823593-1932-4-git-send-email-thomas.petazzoni@free-electrons.com
Signed-off-by: Jason Cooper <[email protected]>
|
|
Until now, we were leaving the ->check_device() msi_chip operation
empty, which leads the PCI core to believe that we support both MSI
and MSI-X. In fact, we do not support MSI-X, so we have to tell this
to the PCI core by providing an implementation of this operation.
Fixes: 31f614edb726fcc4d5aa0f2895fbdec9b04a3ca4 ('irqchip: armada-370-xp: implement MSI support')
Cc: <[email protected]> # v3.13+
Signed-off-by: Thomas Petazzoni <[email protected]>
Link: https://lkml.kernel.org/r/1397823593-1932-3-git-send-email-thomas.petazzoni@free-electrons.com
Tested-by: Neil Greatorex <[email protected]>
Signed-off-by: Jason Cooper <[email protected]>
|
|
The armada_370_xp_alloc_msi() function returns a signed int, which is
negative on error. However, we store the return value into an
irq_hw_number_t, which is unsigned. Therefore, we actually never test
if armada_370_xp_alloc_msi() returns an error or not, which may lead
us to use hwirq numbers of as 0xffffffe4 (when
armada_370_xp_alloc_msi() returns -ENOSPC).
This commit fixes that by storing the return value of
armada_370_xp_alloc_msi() in a signed variable.
Fixes: 31f614edb726fcc4d5aa0f2895fbdec9b04a3ca4 ('irqchip: armada-370-xp: implement MSI support')
Cc: <[email protected]> # v3.13+
Signed-off-by: Thomas Petazzoni <[email protected]>
Link: https://lkml.kernel.org/r/1397823593-1932-2-git-send-email-thomas.petazzoni@free-electrons.com
Tested-by: Neil Greatorex <[email protected]>
Signed-off-by: Jason Cooper <[email protected]>
|
|
Pull slave-dmaengine fixes from Vinod Koul:
"Back from long weekend here in India and now the time to send fixes
for slave dmaengine.
- Dan's fix of sirf xlate code
- Jean's fix for timberland
- edma fixes by Sekhar for SG handling and Yuan for changing init
call"
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dma: fix eDMA driver as a subsys_initcall
dmaengine: sirf: off by one in of_dma_sirfsoc_xlate()
platform: Fix timberdale dependencies
dma: edma: fix incorrect SG list handling
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu
Pull iommu fixes from Joerg Roedel:
"Fixes for regressions:
- fix wrong IOMMU enumeration causing some SCSI device drivers
initialization failures
- ARM-SMMU fixes for a panic condition and a wrong return value"
* tag 'iommu-fixes-v3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/arm-smmu: fix panic in arm_smmu_alloc_init_pte
iommu/arm-smmu: Return 0 on unmap failure
iommu/vt-d: fix bug in matching PCI devices with DRHD/RMRR descriptors
iommu/vt-d: Fix get_domain_for_dev() handling of upstream PCIe bridges
iommu/vt-d: fix memory leakage caused by commit ea8ea46
|
|
This improves the PLL parameters when we work at
the limits of the allowed ranges.
Signed-off-by: Christian König <[email protected]>
|