Commit e5553ac7 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'staging-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are some small staging driver fixes for 5.6-rc3, along with the
  removal of an unused/unneeded driver as well.

  The android vsoc driver is not needed anymore by anyone, so it was
  removed.

  The other driver fixes are:
   - ashmem bugfixes
   - greybus audio driver bugfix
   - wireless driver bugfixes and tiny cleanups to error paths

  All of these have been in linux-next for a while now with no reported
  issues"

* tag 'staging-5.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: Remove unneeded goto statements
  staging: rtl8188eu: Remove some unneeded goto statements
  staging: rtl8723bs: Fix potential overuse of kernel memory
  staging: rtl8188eu: Fix potential overuse of kernel memory
  staging: rtl8723bs: Fix potential security hole
  staging: rtl8188eu: Fix potential security hole
  staging: greybus: use after free in gb_audio_manager_remove_all()
  staging: android: Delete the 'vsoc' driver
  staging: rtl8723bs: fix copy of overlapping memory
  staging: android: ashmem: Disallow ashmem memory from being remapped
  staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
parents ef11f1b7 9a4556bd
...@@ -14,14 +14,6 @@ config ASHMEM ...@@ -14,14 +14,6 @@ config ASHMEM
It is, in theory, a good memory allocator for low-memory devices, It is, in theory, a good memory allocator for low-memory devices,
because it can discard shared memory units when under memory pressure. because it can discard shared memory units when under memory pressure.
config ANDROID_VSOC
tristate "Android Virtual SoC support"
depends on PCI_MSI
help
This option adds support for the Virtual SoC driver needed to boot
a 'cuttlefish' Android image inside QEmu. The driver interacts with
a QEmu ivshmem device. If built as a module, it will be called vsoc.
source "drivers/staging/android/ion/Kconfig" source "drivers/staging/android/ion/Kconfig"
endif # if ANDROID endif # if ANDROID
......
...@@ -4,4 +4,3 @@ ccflags-y += -I$(src) # needed for trace events ...@@ -4,4 +4,3 @@ ccflags-y += -I$(src) # needed for trace events
obj-y += ion/ obj-y += ion/
obj-$(CONFIG_ASHMEM) += ashmem.o obj-$(CONFIG_ASHMEM) += ashmem.o
obj-$(CONFIG_ANDROID_VSOC) += vsoc.o
...@@ -9,14 +9,5 @@ ion/ ...@@ -9,14 +9,5 @@ ion/
- Split /dev/ion up into multiple nodes (e.g. /dev/ion/heap0) - Split /dev/ion up into multiple nodes (e.g. /dev/ion/heap0)
- Better test framework (integration with VGEM was suggested) - Better test framework (integration with VGEM was suggested)
vsoc.c, uapi/vsoc_shm.h
- The current driver uses the same wait queue for all of the futexes in a
region. This will cause false wakeups in regions with a large number of
waiting threads. We should eventually use multiple queues and select the
queue based on the region.
- Add debugfs support for examining the permissions of regions.
- Remove VSOC_WAIT_FOR_INCOMING_INTERRUPT ioctl. This functionality has been
superseded by the futex and is there for legacy reasons.
Please send patches to Greg Kroah-Hartman <greg@kroah.com> and Cc: Please send patches to Greg Kroah-Hartman <greg@kroah.com> and Cc:
Arve Hjønnevåg <arve@android.com> and Riley Andrews <riandrews@android.com> Arve Hjønnevåg <arve@android.com> and Riley Andrews <riandrews@android.com>
...@@ -351,8 +351,23 @@ static inline vm_flags_t calc_vm_may_flags(unsigned long prot) ...@@ -351,8 +351,23 @@ static inline vm_flags_t calc_vm_may_flags(unsigned long prot)
_calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC); _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC);
} }
static int ashmem_vmfile_mmap(struct file *file, struct vm_area_struct *vma)
{
/* do not allow to mmap ashmem backing shmem file directly */
return -EPERM;
}
static unsigned long
ashmem_vmfile_get_unmapped_area(struct file *file, unsigned long addr,
unsigned long len, unsigned long pgoff,
unsigned long flags)
{
return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
}
static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
{ {
static struct file_operations vmfile_fops;
struct ashmem_area *asma = file->private_data; struct ashmem_area *asma = file->private_data;
int ret = 0; int ret = 0;
...@@ -393,6 +408,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) ...@@ -393,6 +408,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
} }
vmfile->f_mode |= FMODE_LSEEK; vmfile->f_mode |= FMODE_LSEEK;
asma->file = vmfile; asma->file = vmfile;
/*
* override mmap operation of the vmfile so that it can't be
* remapped which would lead to creation of a new vma with no
* asma permission checks. Have to override get_unmapped_area
* as well to prevent VM_BUG_ON check for f_ops modification.
*/
if (!vmfile_fops.mmap) {
vmfile_fops = *vmfile->f_op;
vmfile_fops.mmap = ashmem_vmfile_mmap;
vmfile_fops.get_unmapped_area =
ashmem_vmfile_get_unmapped_area;
}
vmfile->f_op = &vmfile_fops;
} }
get_file(asma->file); get_file(asma->file);
......
This diff is collapsed.
This diff is collapsed.
...@@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void) ...@@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
list_for_each_entry_safe(module, next, &modules_list, list) { list_for_each_entry_safe(module, next, &modules_list, list) {
list_del(&module->list); list_del(&module->list);
kobject_put(&module->kobj);
ida_simple_remove(&module_id, module->id); ida_simple_remove(&module_id, module->id);
kobject_put(&module->kobj);
} }
is_empty = list_empty(&modules_list); is_empty = list_empty(&modules_list);
......
...@@ -2009,21 +2009,16 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -2009,21 +2009,16 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
struct ieee_param *param; struct ieee_param *param;
uint ret = 0; uint ret = 0;
if (p->length < sizeof(struct ieee_param) || !p->pointer) { if (!p->pointer || p->length != sizeof(struct ieee_param))
ret = -EINVAL; return -EINVAL;
goto out;
}
param = (struct ieee_param *)rtw_malloc(p->length); param = (struct ieee_param *)rtw_malloc(p->length);
if (!param) { if (!param)
ret = -ENOMEM; return -ENOMEM;
goto out;
}
if (copy_from_user(param, p->pointer, p->length)) { if (copy_from_user(param, p->pointer, p->length)) {
kfree(param); kfree(param);
ret = -EFAULT; return -EFAULT;
goto out;
} }
switch (param->cmd) { switch (param->cmd) {
...@@ -2054,9 +2049,6 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -2054,9 +2049,6 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
ret = -EFAULT; ret = -EFAULT;
kfree(param); kfree(param);
out:
return ret; return ret;
} }
...@@ -2791,26 +2783,19 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -2791,26 +2783,19 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
* so, we just check hw_init_completed * so, we just check hw_init_completed
*/ */
if (!padapter->hw_init_completed) { if (!padapter->hw_init_completed)
ret = -EPERM; return -EPERM;
goto out;
}
if (!p->pointer) { if (!p->pointer || p->length != sizeof(struct ieee_param))
ret = -EINVAL; return -EINVAL;
goto out;
}
param = (struct ieee_param *)rtw_malloc(p->length); param = (struct ieee_param *)rtw_malloc(p->length);
if (!param) { if (!param)
ret = -ENOMEM; return -ENOMEM;
goto out;
}
if (copy_from_user(param, p->pointer, p->length)) { if (copy_from_user(param, p->pointer, p->length)) {
kfree(param); kfree(param);
ret = -EFAULT; return -EFAULT;
goto out;
} }
switch (param->cmd) { switch (param->cmd) {
...@@ -2865,7 +2850,6 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -2865,7 +2850,6 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
if (ret == 0 && copy_to_user(p->pointer, param, p->length)) if (ret == 0 && copy_to_user(p->pointer, param, p->length))
ret = -EFAULT; ret = -EFAULT;
kfree(param); kfree(param);
out:
return ret; return ret;
} }
#endif #endif
......
...@@ -476,14 +476,13 @@ int rtl8723bs_xmit_thread(void *context) ...@@ -476,14 +476,13 @@ int rtl8723bs_xmit_thread(void *context)
s32 ret; s32 ret;
struct adapter *padapter; struct adapter *padapter;
struct xmit_priv *pxmitpriv; struct xmit_priv *pxmitpriv;
u8 thread_name[20] = "RTWHALXT"; u8 thread_name[20];
ret = _SUCCESS; ret = _SUCCESS;
padapter = context; padapter = context;
pxmitpriv = &padapter->xmitpriv; pxmitpriv = &padapter->xmitpriv;
rtw_sprintf(thread_name, 20, "%s-"ADPT_FMT, thread_name, ADPT_ARG(padapter)); rtw_sprintf(thread_name, 20, "RTWHALXT-" ADPT_FMT, ADPT_ARG(padapter));
thread_enter(thread_name); thread_enter(thread_name);
DBG_871X("start "FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter)); DBG_871X("start "FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
......
...@@ -3373,21 +3373,16 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -3373,21 +3373,16 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
/* down(&ieee->wx_sem); */ /* down(&ieee->wx_sem); */
if (p->length < sizeof(struct ieee_param) || !p->pointer) { if (!p->pointer || p->length != sizeof(struct ieee_param))
ret = -EINVAL; return -EINVAL;
goto out;
}
param = rtw_malloc(p->length); param = rtw_malloc(p->length);
if (param == NULL) { if (param == NULL)
ret = -ENOMEM; return -ENOMEM;
goto out;
}
if (copy_from_user(param, p->pointer, p->length)) { if (copy_from_user(param, p->pointer, p->length)) {
kfree(param); kfree(param);
ret = -EFAULT; return -EFAULT;
goto out;
} }
switch (param->cmd) { switch (param->cmd) {
...@@ -3421,12 +3416,8 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -3421,12 +3416,8 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
kfree(param); kfree(param);
out:
/* up(&ieee->wx_sem); */ /* up(&ieee->wx_sem); */
return ret; return ret;
} }
static int rtw_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len) static int rtw_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
...@@ -4200,28 +4191,19 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -4200,28 +4191,19 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
* so, we just check hw_init_completed * so, we just check hw_init_completed
*/ */
if (!padapter->hw_init_completed) { if (!padapter->hw_init_completed)
ret = -EPERM; return -EPERM;
goto out;
}
/* if (p->length < sizeof(struct ieee_param) || !p->pointer) { */ if (!p->pointer || p->length != sizeof(*param))
if (!p->pointer) { return -EINVAL;
ret = -EINVAL;
goto out;
}
param = rtw_malloc(p->length); param = rtw_malloc(p->length);
if (param == NULL) { if (param == NULL)
ret = -ENOMEM; return -ENOMEM;
goto out;
}
if (copy_from_user(param, p->pointer, p->length)) { if (copy_from_user(param, p->pointer, p->length)) {
kfree(param); kfree(param);
ret = -EFAULT; return -EFAULT;
goto out;
} }
/* DBG_871X("%s, cmd =%d\n", __func__, param->cmd); */ /* DBG_871X("%s, cmd =%d\n", __func__, param->cmd); */
...@@ -4321,13 +4303,8 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p) ...@@ -4321,13 +4303,8 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
if (ret == 0 && copy_to_user(p->pointer, param, p->length)) if (ret == 0 && copy_to_user(p->pointer, param, p->length))
ret = -EFAULT; ret = -EFAULT;
kfree(param); kfree(param);
out:
return ret; return ret;
} }
static int rtw_wx_set_priv(struct net_device *dev, static int rtw_wx_set_priv(struct net_device *dev,
......
...@@ -98,7 +98,7 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb, ...@@ -98,7 +98,7 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb,
vnt_rf_rssi_to_dbm(priv, tail->rssi, &rx_dbm); vnt_rf_rssi_to_dbm(priv, tail->rssi, &rx_dbm);
priv->bb_pre_ed_rssi = (u8)rx_dbm + 1; priv->bb_pre_ed_rssi = (u8)-rx_dbm + 1;
priv->current_rssi = priv->bb_pre_ed_rssi; priv->current_rssi = priv->bb_pre_ed_rssi;
skb_pull(skb, sizeof(*head)); skb_pull(skb, sizeof(*head));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment