1. 30 Apr, 2016 40 commits
    • Tom Lendacky's avatar
      crypto: ccp - memset request context to zero during import · 3900078d
      Tom Lendacky authored
      commit ce0ae266 upstream.
      
      Since a crypto_ahash_import() can be called against a request context
      that has not had a crypto_ahash_init() performed, the request context
      needs to be cleared to insure there is no random data present. If not,
      the random data can result in a kernel oops during crypto_ahash_update().
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      3900078d
    • Jiri Kosina's avatar
      kbuild/mkspec: fix grub2 installkernel issue · 24a748be
      Jiri Kosina authored
      commit c8b08ca5 upstream.
      
      mkspec is copying built kernel to temporrary location
      
      	/boot/vmlinuz-$KERNELRELEASE-rpm
      
      and runs installkernel on it. This however directly leads to grub2
      menuentry for this suffixed binary being generated as well during the run
      of installkernel script.
      
      Later in the process the temporary -rpm suffixed files are removed, and
      therefore we end up with spurious (and non-functional) grub2 menu entries
      for each installed kernel RPM.
      
      Fix that by using a different temporary name (prefixed by '.'), so that
      the binary is not recognized as an actual kernel binary and no menuentry
      is created for it.
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Fixes: 3c9c7a14 ("rpm-pkg: add %post section to create initramfs and grub hooks")
      Signed-off-by: default avatarMichal Marek <mmarek@suse.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      24a748be
    • Jes Sorensen's avatar
      md/raid5: Compare apples to apples (or sectors to sectors) · 2af186e0
      Jes Sorensen authored
      commit e7597e69 upstream.
      
      'max_discard_sectors' is in sectors, while 'stripe' is in bytes.
      
      This fixes the problem where DISCARD would get disabled on some larger
      RAID5 configurations (6 or more drives in my testing), while it worked
      as expected with smaller configurations.
      
      Fixes: 620125f2 ("MD: raid5 trim support")
      Signed-off-by: default avatarJes Sorensen <Jes.Sorensen@redhat.com>
      Signed-off-by: default avatarShaohua Li <shli@fb.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      2af186e0
    • Linus Walleij's avatar
      clk: versatile: sp810: support reentrance · 1243ed57
      Linus Walleij authored
      commit ec7957a6 upstream.
      
      Despite care take to allocate clocks state containers the
      SP810 driver actually just supports creating one instance:
      all clocks registered for every instance will end up with the
      exact same name and __clk_init() will fail.
      
      Rename the timclken<0> .. timclken<n> to sp810_<instance>_<n>
      so every clock on every instance gets a unique name.
      
      This is necessary for the RealView PBA8 which has two SP810
      blocks: the second block will not register its clocks unless
      every clock on every instance is unique and results in boot
      logs like this:
      
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 0 at ../drivers/clk/versatile/clk-sp810.c:137
        clk_sp810_of_setup+0x110/0x154()
      Modules linked in:
      CPU: 0 PID: 0 Comm: swapper/0 Not tainted
      4.5.0-rc2-00030-g352718fc39f6-dirty #225
      Hardware name: ARM RealView Machine (Device Tree Support)
      [<c00167f8>] (unwind_backtrace) from [<c0013204>]
                   (show_stack+0x10/0x14)
      [<c0013204>] (show_stack) from [<c01a049c>]
                   (dump_stack+0x84/0x9c)
      [<c01a049c>] (dump_stack) from [<c0024990>]
                   (warn_slowpath_common+0x74/0xb0)
      [<c0024990>] (warn_slowpath_common) from [<c0024a68>]
                   (warn_slowpath_null+0x1c/0x24)
      [<c0024a68>] (warn_slowpath_null) from [<c051eb44>]
                   (clk_sp810_of_setup+0x110/0x154)
      [<c051eb44>] (clk_sp810_of_setup) from [<c051e3a4>]
                   (of_clk_init+0x12c/0x1c8)
      [<c051e3a4>] (of_clk_init) from [<c0504714>]
                   (time_init+0x20/0x2c)
      [<c0504714>] (time_init) from [<c0501b18>]
                   (start_kernel+0x244/0x3c4)
      [<c0501b18>] (start_kernel) from [<7000807c>] (0x7000807c)
      ---[ end trace cb88537fdc8fa200 ]---
      
      Cc: Michael Turquette <mturquette@baylibre.com>
      Cc: Pawel Moll <pawel.moll@arm.com>
      Fixes: 6e973d2c "clk: vexpress: Add separate SP810 driver"
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarStephen Boyd <sboyd@codeaurora.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      1243ed57
    • Bjorn Helgaas's avatar
      PCI: Disable IO/MEM decoding for devices with non-compliant BARs · fa02bc48
      Bjorn Helgaas authored
      commit b84106b4 upstream.
      
      The PCI config header (first 64 bytes of each device's config space) is
      defined by the PCI spec so generic software can identify the device and
      manage its usage of I/O, memory, and IRQ resources.
      
      Some non-spec-compliant devices put registers other than BARs where the
      BARs should be.  When the PCI core sizes these "BARs", the reads and writes
      it does may have unwanted side effects, and the "BAR" may appear to
      describe non-sensical address space.
      
      Add a flag bit to mark non-compliant devices so we don't touch their BARs.
      Turn off IO/MEM decoding to prevent the devices from consuming address
      space, since we can't read the BARs to find out what that address space
      would be.
      Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Tested-by: default avatarAndi Kleen <ak@linux.intel.com>
      [bwh: Backported to 3.16: adjust context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      fa02bc48
    • Aaro Koskinen's avatar
      mtd: onenand: fix deadlock in onenand_block_markbad · 6c479a8f
      Aaro Koskinen authored
      commit 5e64c29e upstream.
      
      Commit 5942ddbc ("mtd: introduce mtd_block_markbad interface")
      incorrectly changed onenand_block_markbad() to call mtd_block_markbad
      instead of onenand_chip's block_markbad function. As a result the function
      will now recurse and deadlock. Fix by reverting the change.
      
      Fixes: 5942ddbc ("mtd: introduce mtd_block_markbad interface")
      Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
      Acked-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
      Signed-off-by: default avatarBrian Norris <computersforpeace@gmail.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      6c479a8f
    • Sudip Mukherjee's avatar
      mac80211: fix memory leak · f4f8ac41
      Sudip Mukherjee authored
      commit ea32f065 upstream.
      
      On error we jumped to the error label and returned the error code but we
      missed releasing sinfo.
      
      Fixes: 5fe74014172d ("mac80211: avoid excessive stack usage in sta_info")
      Reviewed-by: default avatarJulian Calaby <julian.calaby@gmail.com>
      Signed-off-by: default avatarSudip Mukherjee <sudip@vectorindia.org>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      f4f8ac41
    • Arnd Bergmann's avatar
      mac80211: avoid excessive stack usage in sta_info · ad86e29c
      Arnd Bergmann authored
      commit 0ef049dc upstream.
      
      When CONFIG_OPTIMIZE_INLINING is set, the sta_info_insert_finish
      function consumes more stack than normally, exceeding the
      1024 byte limit on ARM:
      
      net/mac80211/sta_info.c: In function 'sta_info_insert_finish':
      net/mac80211/sta_info.c:561:1: error: the frame size of 1080 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
      
      It turns out that there are two functions that put a 'struct station_info'
      on the stack: __sta_info_destroy_part2 and sta_info_insert_finish, and
      this structure alone requires up to 792 bytes.
      
      Hoping that both are called rarely enough, this replaces the
      on-stack structure with a dynamic allocation, which unfortunately
      requires some suboptimal error handling for out-of-memory.
      
      The __sta_info_destroy_part2 function is actually affected by the
      stack usage twice because it calls cfg80211_del_sta_sinfo(), which
      has another instance of struct station_info on its stack.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 98b62183 ("mac80211/cfg80211: add station events")
      Fixes: 6f7a8d26 ("mac80211: send statistics with delete station event")
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      [bwh: Backported to 3.16: there's only one instance to fix]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      ad86e29c
    • Michal Kazior's avatar
      mac80211: fix unnecessary frame drops in mesh fwding · 5f1842be
      Michal Kazior authored
      commit cf440128 upstream.
      
      The ieee80211_queue_stopped() expects hw queue
      number but it was given raw WMM AC number instead.
      
      This could cause frame drops and problems with
      traffic in some cases - most notably if driver
      doesn't map AC numbers to queue numbers 1:1 and
      uses ieee80211_stop_queues() and
      ieee80211_wake_queue() only without ever calling
      ieee80211_wake_queues().
      
      On ath10k it was possible to hit this problem in
      the following case:
      
        1. wlan0 uses queue 0
           (ath10k maps queues per vif)
        2. offchannel uses queue 15
        3. queues 1-14 are unused
        4. ieee80211_stop_queues()
        5. ieee80211_wake_queue(q=0)
        6. ieee80211_wake_queue(q=15)
           (other queues are not woken up because both
            driver and mac80211 know other queues are
            unused)
        7. ieee80211_rx_h_mesh_fwding()
        8. ieee80211_select_queue_80211() returns 2
        9. ieee80211_queue_stopped(q=2) returns true
       10. frame is dropped (oops!)
      
      Fixes: d3c1597b ("mac80211: fix forwarded mesh frame queue mapping")
      Signed-off-by: default avatarMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      5f1842be
    • Raghava Aditya Renukunta's avatar
      aacraid: Fix memory leak in aac_fib_map_free · 6faa4cbd
      Raghava Aditya Renukunta authored
      commit f88fa79a upstream.
      
      aac_fib_map_free() calls pci_free_consistent() without checking that
      dev->hw_fib_va is not NULL and dev->max_fib_size is not zero.If they are
      indeed NULL/0, this will result in a hang as pci_free_consistent() will
      attempt to invalidate cache for the entire 64-bit address space
      (which would take a very long time).
      
      Fixed by adding a check to make sure that dev->hw_fib_va and
      dev->max_fib_size are not NULL and 0 respectively.
      
      Fixes: 9ad5204d - "[SCSI]aacraid: incorrect dma mapping mask during blinked recover or user initiated reset"
      Signed-off-by: default avatarRaghava Aditya Renukunta <raghavaaditya.renukunta@pmcs.com>
      Reviewed-by: default avatarJohannes Thumshirn <jthumshirn@suse.de>
      Reviewed-by: default avatarTomas Henzl <thenzl@redhat.com>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      6faa4cbd
    • Dmitry Tunin's avatar
      Bluetooth: Add new AR3012 ID 0489:e095 · 49e6abc2
      Dmitry Tunin authored
      commit 28c971d8 upstream.
      
      T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
      D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
      P: Vendor=0489 ProdID=e095 Rev=00.01
      C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      
      This device requires ar3k/AthrBT_0x31010100.dfu and
      ar3k/ramps_0x31010100_40.dfu firmware files that are not in
      linux-firmware yet.
      
      BugLink: https://bugs.launchpad.net/bugs/1542944Signed-off-by: default avatarDmitry Tunin <hanipouspilot@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      49e6abc2
    • Dmitry Tunin's avatar
      Bluetooth: btusb: Add new AR3012 ID 13d3:3395 · f1681c1a
      Dmitry Tunin authored
      commit 609574eb upstream.
      
      T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
      D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
      P: Vendor=13d3 ProdID=3395 Rev=00.01
      C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      
      BugLink: https://bugs.launchpad.net/bugs/1542564Reported-and-tested-by: default avatarChristopher Simerly <kilikopela29@gmail.com>
      Signed-off-by: default avatarDmitry Tunin <hanipouspilot@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      f1681c1a
    • Andi Kleen's avatar
      perf tools: Dont stop PMU parsing on alias parse error · 38bac187
      Andi Kleen authored
      commit 940db6dc upstream.
      
      When an error happens during alias parsing currently the complete
      parsing of all attributes of the PMU is stopped. This is breaks old perf
      on a newer kernel that may have not-yet-know alias attributes (such as
      .scale or .per-pkg).
      
      Continue when some attribute is unparseable.
      
      This is IMHO a stable candidate and should be backported to older
      versions to avoid problems with newer kernels.
      
      v2: Print warnings when something goes wrong.
      v3: Change warning to debug output
      Signed-off-by: default avatarAndi Kleen <ak@linux.intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Link: http://lkml.kernel.org/r/1455749095-18358-1-git-send-email-andi@firstfloor.orgSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      [bwh: Backported to 3.16: adjust context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      38bac187
    • Alexander Usyskin's avatar
      mei: fix format string in debug prints · 6efef4d6
      Alexander Usyskin authored
      commit 35bf7692 upstream.
      
      buf_idx type was changed to size_t, and few places
      missed out to change the print format from %ld to %zu.
      Use also uz for buf.size which is also of size_t
      
      Fixes:
      commit 56988f22e097 ("mei: fix possible integer overflow issue")'
      Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
      Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      [bwh: Backported to 3.16: adjust context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      6efef4d6
    • Tomas Winkler's avatar
      mei: fix possible integer overflow issue · 2e7adcd5
      Tomas Winkler authored
      commit f862b6b2 upstream.
      
      There is a possible integer overflow following by a buffer overflow
      when accumulating messages coming from the FW to compose a full payload.
      Occurrence of wrap around has to be prevented for next message size
      calculation.
      For unsigned integer the addition overflow has occurred when the
      result is smaller than one of the arguments.
      To simplify the fix, the types of buf.size and buf_idx are set to the
      same width, namely size_t also to be aligned with the type of length
      parameter in file read/write ops.
      Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
      Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      [bwh: Backported to 3.16:
       - Adjust context, indentation
       - Return error directly, rather than through cb->status and the completion list
       - Fix up additional format string in mei_cl_write()]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      2e7adcd5
    • Pali Rohár's avatar
      ARM: OMAP3: Add cpuidle parameters table for omap3430 · edf41954
      Pali Rohár authored
      commit 98f42221 upstream.
      
      Based on CPU type choose generic omap3 or omap3430 specific cpuidle
      parameters. Parameters for omap3430 were measured on Nokia N900 device and
      added by commit 5a1b1d3a ("OMAP3: RX-51: Pass cpu idle parameters")
      which were later removed by commit 231900af ("ARM: OMAP3: cpuidle -
      remove rx51 cpuidle parameters table") due to huge code complexity.
      
      This patch brings cpuidle parameters for omap3430 devices again, but uses
      simple condition based on CPU type.
      
      Fixes: 231900af ("ARM: OMAP3: cpuidle - remove rx51 cpuidle
      parameters table")
      Signed-off-by: default avatarPali Rohár <pali.rohar@gmail.com>
      Acked-by: default avatarDaniel Lezcano <daniel.lezcano@linaro.org>
      Signed-off-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      edf41954
    • Hans de Goede's avatar
      saa7134: Fix bytesperline not being set correctly for planar formats · 2f03c1e4
      Hans de Goede authored
      commit 3e71da19 upstream.
      
      bytesperline should be the bytesperline for the first plane for planar
      formats, not that of all planes combined.
      
      This fixes a crash in xawtv caused by the wrong bpl.
      
      BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1305389Reported-and-tested-by: default avatarStas Sergeev <stsp@list.ru>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      2f03c1e4
    • Hans Verkuil's avatar
      adv7511: TX_EDID_PRESENT is still 1 after a disconnect · f5107bb1
      Hans Verkuil authored
      commit b339a72e upstream.
      
      The V4L2_CID_TX_EDID_PRESENT control reports if an EDID is present.
      The adv7511 however still reported the EDID present after disconnecting
      the HDMI cable. Fix the logic regarding this control. And when the EDID
      is disconnected also call ADV7511_EDID_DETECT to notify the bridge driver.
      This was also missing.
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      f5107bb1
    • Julia Lawall's avatar
      scripts/coccinelle: modernize & · b89414e4
      Julia Lawall authored
      commit 1b669e71 upstream.
      
      & is no longer allowed in column 0, since Coccinelle 1.0.4.
      Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
      Tested-by: default avatarNishanth Menon <nm@ti.com>
      Signed-off-by: default avatarMichal Marek <mmarek@suse.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      b89414e4
    • Arnd Bergmann's avatar
      ARM: davinci: make I2C support optional · a7b434f7
      Arnd Bergmann authored
      commit 8e580411 upstream.
      
      The davinci platform has tried to get support for the EEPROM right,
      but failed to get a clean build so far. At the moment, we get
      a warning whenever CONFIG_SYSFS is disabled, as that is needed by
      EEPROM_AT24:
      
      warning: (MACH_DAVINCI_EVM && MACH_SFFSDR && MACH_DAVINCI_DM6467_EVM && MACH_DAVINCI_DM365_EVM && MACH_DAVINCI_DA830_EVM && MACH_MITYOMAPL138 && MACH_MINI2440) selects EEPROM_AT24 which has unmet direct dependencies (I2C && SYSFS)
      
      Kevin Hilman initially added the 'select' to ensure that EEPROM_AT24
      is always enabled in machines that really want it for normal operation
      (i.e. for reading the MAC address). This broke when I2C was disabled,
      and Russell King followed up with another patch to select that as
      well.
      
      I now see that the SYSFS dependency is still missing, which leaves
      us with three options:
      
      a) add 'select SYSFS' in addition to the others
      b) change AT24_EEPPROM to work without sysfs (should be possible)
      c) remove all those selects again and get the files to build when
         I2C is disabled.
      
      I would really hate to do a) because adding select statements that
      hardwire user-selectable symbols is generally a bad idea. I first
      tried b) but then ended up redoing the patch from scratch to approach
      c), so we can also remove the other selects.
      
      I checked that CONFIG_I2C is still enabled with davinci_all_defconfig,
      so that does not have to change.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 45b146d7 ("ARM: Davinci: Fix I2C build errors")
      Fixes: 22ca4668 ("davinci: kconfig: select at24 eeprom for selected boards")
      Signed-off-by: default avatarSekhar Nori <nsekhar@ti.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      a7b434f7
    • Arnd Bergmann's avatar
      regulator: s5m8767: fix get_register() error handling · 3f7b679d
      Arnd Bergmann authored
      commit e07ff943 upstream.
      
      The s5m8767_pmic_probe() function calls s5m8767_get_register() to
      read data without checking the return code, which produces a compile-time
      warning when that data is accessed:
      
      drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe':
      drivers/regulator/s5m8767.c:924:7: error: 'enable_reg' may be used uninitialized in this function [-Werror=maybe-uninitialized]
      drivers/regulator/s5m8767.c:944:30: error: 'enable_val' may be used uninitialized in this function [-Werror=maybe-uninitialized]
      
      This changes the s5m8767_get_register() function to return a -EINVAL
      not just for an invalid register number but also for an invalid
      regulator number, as both would result in returning uninitialized
      data. The s5m8767_pmic_probe() function is then changed accordingly
      to fail on a read error, as all the other callers of s5m8767_get_register()
      already do.
      
      In practice this probably cannot happen, as we don't call
      s5m8767_get_register() with invalid arguments, but the gcc
      warning seems valid in principle, in terms writing safe
      error checking.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 9c4c6055 ("regulator: s5m8767: Convert to use regulator_[enable|disable|is_enabled]_regmap")
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      3f7b679d
    • Benjamin Tissoires's avatar
      HID: fix hid_ignore_special_drivers module parameter · 778c3762
      Benjamin Tissoires authored
      commit 4392bf33 upstream.
      
      hid_ignore_special_drivers works fine until hid_scan_report autodetects and
      reassign devices (for hid-multitouch, hid-microsoft and hid-rmi).
      
      Simplify the handling of the parameter: if it is there, use hid-generic, no
      matter what, and if not, scan the device or rely on the hid_have_special_driver
      table.
      
      This was detected while trying to disable hid-multitouch on a Surface Pro cover
      which prevented to use the keyboard.
      Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      778c3762
    • Benjamin Tissoires's avatar
      HID: core: do not scan reports if the group is already set · 1d0c5109
      Benjamin Tissoires authored
      commit 9578f41a upstream.
      
      This allows the transport layer (I have in mind hid-logitech-dj and uhid)
      to set the group before it is added to the hid bus. This way, it can
      bypass the hid_scan_report() call, and choose in advance which driver
      will handle the newly created hid device.
      Signed-off-by: default avatarBenjamin Tisssoires <benjamin.tissoires@redhat.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      1d0c5109
    • Grazvydas Ignotas's avatar
      HID: logitech: fix Dual Action gamepad support · c6eb01fb
      Grazvydas Ignotas authored
      commit 5d74325a upstream.
      
      The patch that added Logitech Dual Action gamepad support forgot to
      update the special driver list for the device. This caused the logitech
      driver not to probe unless kernel module load order was favorable.
      Update the special driver list to fix it. Thanks to Simon Wood for the
      idea.
      
      Cc: Vitaly Katraew <zawullon@gmail.com>
      Fixes: 56d0c8b7 ("HID: add support for Logitech Dual Action gamepads")
      Signed-off-by: default avatarGrazvydas Ignotas <notasas@gmail.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      c6eb01fb
    • Oliver Neukum's avatar
      usb: retry reset if a device times out · 41f599eb
      Oliver Neukum authored
      commit 264904cc upstream.
      
      Some devices I got show an inability to operate right after
      power on if they are already connected. They are beyond recovery
      if the descriptors are requested multiple times. So in case of
      a timeout we rather bail early and reset again. But it must be
      done only on the first loop lest we get into a reset/time out
      spiral that can be overcome with a retry.
      
      This patch is a rework of a patch that fell through the cracks.
      http://www.spinics.net/lists/linux-usb/msg103263.htmlSigned-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      41f599eb
    • Linus Walleij's avatar
      mtd: map: fix .set_vpp() documentation · 4a670ea7
      Linus Walleij authored
      commit 95a001f2 upstream.
      
      As of commit 876fe76d
      "mtd: maps: physmap: Add reference counter to set_vpp()"
      the comment in the header file is incorrect and misleading.
      Fix it up.
      
      Cc: Russell King <linux@arm.linux.org.uk>
      Cc: Paul Parsons <lost.distance@yahoo.com>
      Fixes: 876fe76d ("mtd: maps: physmap: Add reference counter to set_vpp()")
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarBrian Norris <computersforpeace@gmail.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      4a670ea7
    • Lior Amsalem's avatar
      ARM: dts: armada-375: use armada-370-sata for SATA · 5e202b51
      Lior Amsalem authored
      commit b3a7f31e upstream.
      
      The Armada 375 has the same SATA IP as Armada 370 and Armada XP, which
      requires the PHY speed to be set in the LP_PHY_CTL register for SATA
      hotplug to work.
      
      Therefore, this commit updates the compatible string used to describe
      the SATA IP in Armada 375 from marvell,orion-sata to
      marvell,armada-370-sata.
      
      Fixes: 4de59085 ("ARM: mvebu: add Device Tree description of the Armada 375 SoC")
      Signed-off-by: default avatarLior Amsalem <alior@marvell.com>
      Signed-off-by: default avatarThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarGregory CLEMENT <gregory.clement@free-electrons.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      5e202b51
    • Ben Hutchings's avatar
      misc/bmp085: Enable building as a module · fa22b141
      Ben Hutchings authored
      commit 50e6315d upstream.
      
      Commit 985087db 'misc: add support for bmp18x chips to the bmp085
      driver' changed the BMP085 config symbol to a boolean.  I see no
      reason why the shared code cannot be built as a module, so change it
      back to tristate.
      
      Fixes: 985087db ("misc: add support for bmp18x chips to the bmp085 driver")
      Cc: Eric Andersson <eric.andersson@unixphere.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      fa22b141
    • Peter Hurley's avatar
      net: irda: Fix use-after-free in irtty_open() · ee01ab70
      Peter Hurley authored
      commit 401879c5 upstream.
      
      The N_IRDA line discipline may access the previous line discipline's closed
      and already-fre private data on open [1].
      
      The tty->disc_data field _never_ refers to valid data on entry to the
      line discipline's open() method. Rather, the ldisc is expected to
      initialize that field for its own use for the lifetime of the instance
      (ie. from open() to close() only).
      
      [1]
          ==================================================================
          BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
          Read of size 4 by task a.out/13960
          =============================================================================
          BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
          -----------------------------------------------------------------------------
          ...
          Call Trace:
           [<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
           [<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
           [<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
           [<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
           [<     inline     >] tiocsetd drivers/tty/tty_io.c:2650
           [<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
           [<     inline     >] vfs_ioctl fs/ioctl.c:43
           [<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
           [<     inline     >] SYSC_ioctl fs/ioctl.c:622
           [<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
           [<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a
      Reported-and-tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      ee01ab70
    • Sebastian Frias's avatar
      8250: use callbacks to access UART_DLL/UART_DLM · 3062b9aa
      Sebastian Frias authored
      commit 0b41ce99 upstream.
      
      Some UART HW has a single register combining UART_DLL/UART_DLM
      (this was probably forgotten in the change that introduced the
      callbacks, commit b32b19b8)
      
      Fixes: b32b19b8 ("[SERIAL] 8250: set divisor register correctly ...")
      Signed-off-by: default avatarSebastian Frias <sf84@laposte.net>
      Reviewed-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      [bwh: Backported to 3.16: adjust filename]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      3062b9aa
    • Tom Lendacky's avatar
      crypto: ccp - Don't assume export/import areas are aligned · ec231ef4
      Tom Lendacky authored
      commit b31dde2a upstream.
      
      Use a local variable for the exported and imported state so that
      alignment is not an issue. On export, set a local variable from the
      request context and then memcpy the contents of the local variable to
      the export memory area. On import, memcpy the import memory area into
      a local variable and then use the local variable to set the request
      context.
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      ec231ef4
    • Marcin Ślusarz's avatar
      perf tools: handle spaces in file names obtained from /proc/pid/maps · 3a9b8bd0
      Marcin Ślusarz authored
      commit 89fee59b upstream.
      
      Steam frequently puts game binaries in folders with spaces.
      
      Note: "(deleted)" markers are now treated as part of the file name.
      Signed-off-by: default avatarMarcin Ślusarz <marcin.slusarz@gmail.com>
      Acked-by: default avatarNamhyung Kim <namhyung@kernel.org>
      Fixes: 60648033 ("perf tools: Use sscanf for parsing /proc/pid/maps")
      Link: http://lkml.kernel.org/r/20160119190303.GA17579@marcin-Inspiron-7720Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      3a9b8bd0
    • Dan Streetman's avatar
      nbd: ratelimit error msgs after socket close · dd37eba1
      Dan Streetman authored
      commit da6ccaaa upstream.
      
      Make the "Attempted send on closed socket" error messages generated in
      nbd_request_handler() ratelimited.
      
      When the nbd socket is shutdown, the nbd_request_handler() function emits
      an error message for every request remaining in its queue.  If the queue
      is large, this will spam a large amount of messages to the log.  There's
      no need for a separate error message for each request, so this patch
      ratelimits it.
      
      In the specific case this was found, the system was virtual and the error
      messages were logged to the serial port, which overwhelmed it.
      
      Fixes: 4d48a542 ("nbd: fix I/O hang on disconnected nbds")
      Signed-off-by: default avatarDan Streetman <dan.streetman@canonical.com>
      Signed-off-by: default avatarMarkus Pargmann <mpa@pengutronix.de>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      dd37eba1
    • Dan Carpenter's avatar
      xc2028: unlock on error in xc2028_set_config() · 1d572520
      Dan Carpenter authored
      commit 210bd104 upstream.
      
      We have to unlock before returning -ENOMEM.
      
      Fixes: 8dfbcc43 ('[media] xc2028: avoid use after free')
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      1d572520
    • Mauro Carvalho Chehab's avatar
      xc2028: avoid use after free · e6cb39ac
      Mauro Carvalho Chehab authored
      commit 8dfbcc43 upstream.
      
      If struct xc2028_config is passed without a firmware name,
      the following trouble may happen:
      
      [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner
      [11009.907491] ==================================================================
      [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40
      [11009.907992] Read of size 1 by task modprobe/28992
      [11009.907994] =============================================================================
      [11009.907997] BUG kmalloc-16 (Tainted: G        W      ): kasan: bad access detected
      [11009.907999] -----------------------------------------------------------------------------
      
      [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992
      [11009.908012] 	___slab_alloc+0x581/0x5b0
      [11009.908014] 	__slab_alloc+0x51/0x90
      [11009.908017] 	__kmalloc+0x27b/0x350
      [11009.908022] 	xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd]
      [11009.908026] 	usb_hcd_submit_urb+0x1e8/0x1c60
      [11009.908029] 	usb_submit_urb+0xb0e/0x1200
      [11009.908032] 	usb_serial_generic_write_start+0xb6/0x4c0
      [11009.908035] 	usb_serial_generic_write+0x92/0xc0
      [11009.908039] 	usb_console_write+0x38a/0x560
      [11009.908045] 	call_console_drivers.constprop.14+0x1ee/0x2c0
      [11009.908051] 	console_unlock+0x40d/0x900
      [11009.908056] 	vprintk_emit+0x4b4/0x830
      [11009.908061] 	vprintk_default+0x1f/0x30
      [11009.908064] 	printk+0x99/0xb5
      [11009.908067] 	kasan_report_error+0x10a/0x550
      [11009.908070] 	__asan_report_load1_noabort+0x43/0x50
      [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992
      [11009.908077] 	__slab_free+0x2ec/0x460
      [11009.908080] 	kfree+0x266/0x280
      [11009.908083] 	xc2028_set_config+0x90/0x630 [tuner_xc2028]
      [11009.908086] 	xc2028_attach+0x310/0x8a0 [tuner_xc2028]
      [11009.908090] 	em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]
      [11009.908094] 	em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]
      [11009.908098] 	em28xx_dvb_init+0x81/0x8a [em28xx_dvb]
      [11009.908101] 	em28xx_register_extension+0xd9/0x190 [em28xx]
      [11009.908105] 	em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]
      [11009.908108] 	do_one_initcall+0x141/0x300
      [11009.908111] 	do_init_module+0x1d0/0x5ad
      [11009.908114] 	load_module+0x6666/0x9ba0
      [11009.908117] 	SyS_finit_module+0x108/0x130
      [11009.908120] 	entry_SYSCALL_64_fastpath+0x16/0x76
      [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x          (null) flags=0x2ffff8000004080
      [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001
      
      [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00  ....*....(......
      [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff  ...........j....
      [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G    B   W       4.5.0-rc1+ #43
      [11009.908140] Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015
      [11009.908142]  ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80
      [11009.908148]  ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280
      [11009.908153]  ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4
      [11009.908158] Call Trace:
      [11009.908162]  [<ffffffff81932007>] dump_stack+0x4b/0x64
      [11009.908165]  [<ffffffff81556759>] print_trailer+0xf9/0x150
      [11009.908168]  [<ffffffff8155ccb4>] object_err+0x34/0x40
      [11009.908171]  [<ffffffff8155f260>] kasan_report_error+0x230/0x550
      [11009.908175]  [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290
      [11009.908179]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50
      [11009.908182]  [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50
      [11009.908185]  [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0
      [11009.908189]  [<ffffffff8194cea6>] ? strcmp+0x96/0xb0
      [11009.908192]  [<ffffffff8194cea6>] strcmp+0x96/0xb0
      [11009.908196]  [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028]
      [11009.908200]  [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028]
      [11009.908203]  [<ffffffff8155ea78>] ? memset+0x28/0x30
      [11009.908206]  [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028]
      [11009.908211]  [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]
      [11009.908215]  [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb]
      [11009.908219]  [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb]
      [11009.908222]  [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x]
      [11009.908226]  [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x]
      [11009.908230]  [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10
      [11009.908233]  [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80
      [11009.908238]  [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]
      [11009.908242]  [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb]
      [11009.908245]  [<ffffffff8195222d>] ? string+0x14d/0x1f0
      [11009.908249]  [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0
      [11009.908253]  [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0
      [11009.908257]  [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0
      [11009.908260]  [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0
      [11009.908264]  [<ffffffff812e9846>] ? __module_address+0xb6/0x360
      [11009.908268]  [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0
      [11009.908271]  [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0
      [11009.908275]  [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290
      [11009.908278]  [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300
      [11009.908282]  [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx]
      [11009.908285]  [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290
      [11009.908289]  [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590
      [11009.908292]  [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10
      [11009.908296]  [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx]
      [11009.908299]  [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400
      [11009.908302]  [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300
      [11009.908306]  [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20
      [11009.908309]  [<ffffffff8159e708>] ? put_object+0x48/0x70
      [11009.908314]  [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb]
      [11009.908317]  [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx]
      [11009.908320]  [<ffffffffa0150000>] ? 0xffffffffa0150000
      [11009.908324]  [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]
      [11009.908327]  [<ffffffff810021b1>] do_one_initcall+0x141/0x300
      [11009.908330]  [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40
      [11009.908333]  [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590
      [11009.908337]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50
      [11009.908340]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50
      [11009.908343]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50
      [11009.908346]  [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0
      [11009.908350]  [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad
      [11009.908353]  [<ffffffff812f2626>] load_module+0x6666/0x9ba0
      [11009.908356]  [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50
      [11009.908361]  [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb]
      [11009.908366]  [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20
      [11009.908369]  [<ffffffff815bc940>] ? open_exec+0x50/0x50
      [11009.908374]  [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0
      [11009.908377]  [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130
      [11009.908379]  [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0
      [11009.908383]  [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14
      [11009.908394]  [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76
      [11009.908396] Memory state around the buggy address:
      [11009.908398]  ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [11009.908401]  ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc
      [11009.908405]                                            ^
      [11009.908407]  ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [11009.908409]  ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [11009.908411] ==================================================================
      
      In order to avoid it, let's set the cached value of the firmware
      name to NULL after freeing it. While here, return an error if
      the memory allocation fails.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      e6cb39ac
    • Tom Lendacky's avatar
      crypto: ccp - Limit the amount of information exported · 4b0073de
      Tom Lendacky authored
      commit d1662165 upstream.
      
      Since the exported information can be exposed to user-space, instead of
      exporting the entire request context only export the minimum information
      needed.
      Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      4b0073de
    • Al Viro's avatar
      unbreak allmodconfig KCONFIG_ALLCONFIG=... · d6f7f96a
      Al Viro authored
      commit 6b87b70c upstream.
      
      	Prior to 3.13 make allmodconfig KCONFIG_ALLCONFIG=/dev/null used
      to be equivalent to make allmodconfig; these days it hardwires MODULES to n.
      In fact, any KCONFIG_ALLCONFIG that doesn't set MODULES explicitly is
      treated as if it set it to n.
      
      	Regression had been introduced by commit cfa98f ("kconfig: do not
      override symbols already set"); what happens is that conf_read_simple()
      does sym_calc_value(modules_sym) on exit, which leaves SYMBOL_VALID set and
      has conf_set_all_new_symbols() skip modules_sym.
      
      	It's pretty easy to fix - simply move that call of sym_calc_value()
      into the callers, except for the ones in KCONFIG_ALLCONFIG handling.
      Objections?
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Fixes: cfa98f2e ("kconfig: do not override symbols already set")
      Signed-off-by: default avatarMichal Marek <mmarek@suse.com>
      [bwh: Backported to 3.16: old code also checked for modules_sym != NULL;
       drop the check since it's only useful for other projects]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      d6f7f96a
    • Hans de Goede's avatar
      3efb8871
    • Tiffany Lin's avatar
      media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32 · 8b06e084
      Tiffany Lin authored
      commit 7df5ab87 upstream.
      
      In v4l2-compliance utility, test QUERYBUF required correct length
      value to go through each planar to check planar's length in
      multi-planar buffer type
      Signed-off-by: default avatarTiffany Lin <tiffany.lin@mediatek.com>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      8b06e084
    • Peter Hurley's avatar
      tty: Fix GPF in flush_to_ldisc(), part 2 · c4bef7cb
      Peter Hurley authored
      commit f33798de upstream.
      
      commit 9ce119f3 ("tty: Fix GPF in flush_to_ldisc()") fixed a
      GPF caused by a line discipline which does not define a receive_buf()
      method.
      
      However, the vt driver (and speakup driver also) pushes selection
      data directly to the line discipline receive_buf() method via
      tty_ldisc_receive_buf(). Fix the same problem in tty_ldisc_receive_buf().
      Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      c4bef7cb