summaryrefslogtreecommitdiffstats
path: root/drivers/staging
AgeCommit message (Collapse)AuthorFilesLines
2014-02-14Merge tag 'staging-3.14-rc3' of ↵Linus Torvalds38-481/+465
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are a number (lots, I know) of fixes for staging drivers to resolve a bunch of reported issues. The largest patches here is one revert of a patch that is in 3.14-rc1 to fix reported problems, and a sync of a usb host driver that required some ARM patches to go in before it could be accepted (which is why it missed -rc1) All of these have been in linux-next for a while with no reported issues" * tag 'staging-3.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (56 commits) staging/rtl8821ae: fix build, depends on MAC80211 iio: max1363: Use devm_regulator_get_optional for optional regulator iio:accel:bma180: Use modifier instead of index in channel specification iio: adis16400: Set timestamp as the last element in chan_spec iio: ak8975: Fix calculation formula for convert micro tesla to gauss unit staging:iio:ad799x fix typo in ad799x_events[] iio: mxs-lradc: remove useless scale_available files iio: mxs-lradc: fix buffer overflow iio:magnetometer:mag3110: Fix output of decimal digits in show_int_plus_micros() iio:magnetometer:mag3110: Report busy in _read_raw() / write_raw() when buffer is enabled wlags49_h2: Fix overflow in wireless_set_essid() xlr_net: Fix missing trivial allocation check staging: r8188eu: overflow in rtw_p2p_get_go_device_address() staging: r8188eu: array overflow in rtw_mp_ioctl_hdl() staging: r8188eu: Fix typo in USB_DEVICE list usbip/userspace/libsrc/names.c: memory leak gpu: ion: dereferencing an ERR_PTR staging: comedi: usbduxsigma: fix unaligned dereferences staging: comedi: fix too early cleanup in comedi_auto_config() staging: android: ion: dummy: fix an error code ...
2014-02-11staging/rtl8821ae: fix build, depends on MAC80211Randy Dunlap1-1/+1
rtl8821ae uses ieee80211 interfaces so it should depend on MAC80211. Fixes these build errors: ERROR: "ieee80211_rx_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_beacon_get_tim" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_unregister_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "rate_control_send_low" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_stop_queue" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_rate_control_register" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "wiphy_to_ieee80211_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_stop_tx_ba_cb_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_tx_status_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_find_sta" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_wake_queue" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_rate_control_unregister" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_register_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_start_tx_ba_session" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_alloc_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_free_hw" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_connection_loss" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! ERROR: "ieee80211_start_tx_ba_cb_irqsafe" [drivers/staging/rtl8821ae/rtl8821ae.ko] undefined! Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-08staging:iio:ad799x fix typo in ad799x_events[]Hartmut Knaack1-1/+1
This patch fixes a typo in ad799x_events[], which caused the error "Failed to register event set". Signed-off-by: Hartmut Knaack <knaack.h@gmx.de> Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2014-02-08iio: mxs-lradc: remove useless scale_available filesAlexandre Belloni1-4/+0
in_voltage8_scale_available and in_voltage9_scale_available are exposed to userspace but useless as in_voltage8_raw and in_voltage9_raw are not available. Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2014-02-08iio: mxs-lradc: fix buffer overflowAlexandre Belloni1-1/+1
Fixes: drivers/staging/iio/adc/mxs-lradc.c:1556 mxs_lradc_probe() error: buffer overflow 'iio->channels' 15 <= 15 The reported available scales for in_voltage15 were also wrong. The realbits lookup is not necessary as all the channels of the LRADC have the same resolution, use LRADC_RESOLUTION instead. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2014-02-07wlags49_h2: Fix overflow in wireless_set_essid()Maurizio Lombardi1-1/+1
This patch prevents the wireless_set_essid() function from overwriting the last byte of the NetworkName buffer which must be NULL. Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07xlr_net: Fix missing trivial allocation checkAlan Cox1-0/+5
Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: r8188eu: overflow in rtw_p2p_get_go_device_address()Dan Carpenter1-6/+4
The go_devadd_str[] array is two characters too small to hold the address so we corrupt memory. I've changed the user space API slightly and I don't have a way to test if this breaks anything. In the original code we truncated away the last digit of the address and the NUL terminator so it was already a bit broken. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: r8188eu: array overflow in rtw_mp_ioctl_hdl()Dan Carpenter1-1/+1
MAX_MP_IOCTL_SUBCODE (35) and mp_ioctl_hdl (32 elements) are no longer in sync. It leads to a bogus pointer dereference. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: r8188eu: Fix typo in USB_DEVICE listLarry Finger1-1/+1
There is a typo in the device list that interchanges the vendor and product codes for one of the entries. This exchange was determined by noticing that the vendor code is 0x07b8 for Abocom at http://www.linux-usb.org/usb.ids. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07usbip/userspace/libsrc/names.c: memory leakHeinrich Schuchardt1-4/+4
revised patch p is freed if NULL. p is leaked if second calloc fails. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07gpu: ion: dereferencing an ERR_PTRDan Carpenter1-1/+1
We dereference "heap->task" before checking if it's an ERR_PTR. Fixes: ea313b5f88ed ('gpu: ion: Also shrink memory cached in the deferred free list') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: comedi: usbduxsigma: fix unaligned dereferencesIan Abbott1-2/+4
There are a couple of dereferences such as `*(uint32_t *)(devpriv->insn_buf + 1)` that are unaligned as `devpriv->insn_buf` is of type `uint8_t *`. This works on x86 architecture but may not be supported on other architectures. Call `get_unalign()` to perform the unaligned dereferences. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Cc: Bernd Porr <mail@berndporr.me.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: comedi: fix too early cleanup in comedi_auto_config()Ian Abbott1-2/+0
`comedi_auto_config()` is usually called from the probe routine of a low-level comedi driver to allocate and auto-configure a comedi device. Part of this involves calling the low-level driver's `auto_attach()` handler, and if that is successful, `comedi_device_postconfig()` tries to complete the configuration of the comedi device. If either of those fail, `comedi_device_detach()` is called to clean up, and `comedi_release_hardware_device()` is called to remove the dynamically allocated comedi device. Unfortunately, `comedi_device_detach()` clears the `hw_dev` member of the `struct comedi_device` (indirectly via `comedi_clear_hw_dev()`), and that stops `comedi_release_hardware_device()` finding the comedi device associated with the hardware device, so the comedi device won't be removed properly. Since `comedi_release_hardware_device()` also calls `comedi_device_detach()` (assuming it finds the comedi device associated with the hardware device), the fix is to remove the direct call to `comedi_device_detach()` from `comedi_auto_config()` and let the call to `comedi_release_hardware_device()` take care of it. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: android: ion: dummy: fix an error codeDan Carpenter1-1/+1
We should be returning -ENOMEM here instead of zero. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: lustre: fix quotactl permission denied (LU-4530)Cédric Dufour - Idiap Research Institute1-1/+1
The changes introduced in commit 4b1a25f06b30b203 ("fix build when CONFIG_UIDGID_STRICT_TYPE_CHECKS is on") got the UID check the wrong way around, leading to "Permission denied" when a regular user attempts to retrieve his quota (lfs quota -u ...) but allowing him to retrieve other users quota. Full details at: https://jira.hpdd.intel.com/browse/LU-4530 Cc: Peng Tao <tao.peng@emc.com> Cc: <stable@vger.kernel.org> # 3.12.x Cc: <stable@vger.kernel.org> # 3.13.x Signed-off-by: Cédric Dufour <cedric.dufour@idiap.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: android: sync: Signal pt before sync_timeline object gets destroyedPrakash Kamliya1-4/+4
There is a race condition Assume we have *one* sync_fence object, with *one* sync_pt which belongs to *one* sync_timeline, given this condition, sync_timeline->kref will have two counts, one for sync_timeline (implicit) and another for sync_pt. Assume following is the situation on CPU Theead-1 : (Thread which calls sync_timeline_destroy()) -> (some function calls) -> sync_timeline_destory() -> sync_timeline_signal() (CPU is inside this function after putting reference to sync_timeline) At this time Thread-2 comes and does following Thread-2 : (fclose on fence fd) > sync_fence_release() -> because of fclose() on fence object -> sync_fence_free() -> sync_pt_free() -> kref_put(&pt->parent->kref, sync_timeline_free); -> sync_timeline_free() (CPU is inside this because this time kref will be zero after _put) Thread-2 will free sync_timeline object before Thread-1 has finished its work inside sync_timeline_signal. With this change we signals all sync_pt before putting reference to sync_timeline object. Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org> [jstultz: minor commit subject tweak] Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: comedi: adv_pci1710: fix analog output readback valueH Hartley Sweeten1-5/+12
The last value written to a analog output channel is cached in the private data of this driver for readback. Currently, the wrong value is cached in the (*insn_write) functions. The current code stores the data[n] value for readback afer the loop has written all the values. At this time 'n' points past the end of the data array. Fix the functions by using a local variable to hold the data being written to the analog output channel. This variable is then used after the loop is complete to store the readback value. The current value is retrieved before the loop in case no values are actually written.. Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: r8188eu: memory corruption handling long ssidsDan Carpenter1-14/+8
We should cap the SSID length at NDIS_802_11_LENGTH_SSID (32) characters to avoid memory corruption. If the SSID is too long then I have opted to ignore it instead of truncating it. We don't need to clear bssid->Ssid.Ssid[0] because this struct is allocated with rtw_zmalloc() Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: gdm72xx: fix leaks at failure path in gdm_usb_probe()Alexey Khoroshilov1-0/+3
Error handling code in gdm_usb_probe() misses to deallocate tx_ and rx_structs and to do usb_put_dev(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07Revert "Staging: dgrp: Refactor the function dgrp_receive() in drrp_net_ops.c"Greg Kroah-Hartman1-175/+155
This reverts commit b73db54750482cf3910046c82a84ce8c1684dfbe. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Reported-by: Chen Gang <gang.chen.5i5j@gmail.com> Cc: Rashika Kheria <rashika.kheria@gmail.com> Cc: James Hogan <james.hogan@imgtec.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07Staging: ozwpan: Fix null dereferenceSalym Senyonga1-1/+2
If net_dev is NULL memcpy() will Oops. Signed-off-by: Salym Senyonga <salymsash@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging/usbip: Fix vhci_hcd attach failure error message to be informativeShuah Khan1-1/+2
When attach fails due to unsupported and/or invalid bus speed, the message vhci_hcd prints out doesn't include any useful information as to what caused the failure. Change the message to be informative and use usb_speed_string() to get the right speed string from usb common. Signed-off-by: Shuah Khan <shuah.kh@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: rtl8821ae: Fixed the size of array to macro as discussed by LinusSurendra Patil1-1/+1
Linus Torvalds writes: It causes an interesting warning for me: drivers/staging/rtl8821ae/rtl8821ae/dm.c: In function ‘rtl8821ae_dm_clear_txpower_tracking_state’: drivers/staging/rtl8821ae/rtl8821ae/dm.c:487:31: warning: iteration 2u invokes undefined behavior [-Waggressive-loop-optimizations] rtldm->bb_swing_idx_ofdm[p] = rtldm->default_ofdm_index; ^ drivers/staging/rtl8821ae/rtl8821ae/dm.c:485:2: note: containing loop for (p = RF90_PATH_A; p < MAX_RF_PATH; ++p) { ^ and gcc is entirely correct: that loop iterates from 0 to 3, and does this: rtldm->bb_swing_idx_ofdm[p] = rtldm->default_ofdm_index; but the bb_swing_idx_ofdm[] array only has two members. So the last two iterations will overwrite bb_swing_idx_ofdm_current and the first entry in bb_swing_idx_ofdm_base[]. Now, the bug does seem to be benign: bb_swing_idx_ofdm_current isn't actually ever *used* as far as I can tell, and the first entry of bb_swing_idx_ofdm_base[] will have been written with that same "rtldm->default_ofdm_index" value. But gcc is absolutely correct, and that driver needs fixing. I've pulled it and will let it be because it doesn't seem to be an issue in practice, but please fix it. The obvious fix would seem to change the size of "2" to be "MAX_RF_PATH", but I'll abstain from doing those kinds of changes in the merge when it doesn't seem to affect the build or functionality). Reported-By: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Surendra Patil <surendra.tux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: octeon-usb: Probe via device tree populated platform device.David Daney1-157/+116
Extract clocking parameters from the device tree, and remove now dead code and types. Signed-off-by: David Daney <david.daney@cavium.com> Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07lustre: add myself to list of people to CC on lustre patchesOleg Drokin1-2/+3
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07lustre: Correct KUC code max changelog msg sizeOleg Drokin2-3/+5
The kernel to userspace communication routines (KUC) allocate and limit the maximum cs_buf size to CR_MAXSIZE. However this fails to account for the fact that the buffer is assumed to begin with a struct kuc_hdr. To allocate and account for that space, we introduce a new define, KUC_CHANGELOG_MSG_MAXSIZE. Signed-off-by: Christopher J. Morrone <morrone2@llnl.gov> Reviewed-on: http://review.whamcloud.com/7406 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3587 Reviewed-by: Andreas Dilger <andreas.dilger@intel.com> Reviewed-by: jacques-Charles Lafoucriere <jacques-charles.lafoucriere@cea.fr> Reviewed-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07lustre: Account for changelog_ext_rec in CR_MAXSIZEOleg Drokin1-1/+2
CR_MAXSIZE needs to account for an llog_changelog_rec that actually contains a changelog_ext_rec structure rather than a changelog_rec. With out doing so, a file size approaching the Linux kernel NAME_MAX length that is renamed to a size also close to, or at, NAME_MAX will exceed CR_MAXSIZE and trip an assertion. Signed-off-by: Christopher J. Morrone <morrone2@llnl.gov> Reviewed-on: http://review.whamcloud.com/6993 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3587 Reviewed-by: Niu Yawei <yawei.niu@intel.com> Reviewed-by: Lai Siyao <lai.siyao@intel.com> Reviewed-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging/lustre/lnet: Fix use after free in ksocknal_sendOleg Drokin1-2/+3
Call to ksocknal_launch_packet might schedule a callback that might free the just sent message, and so subsequent access to it via lntmsg->msg_vmflush goes to freed memory. Instead we'll just remember if we are in the vmflush thread and only restore if we happened to set mempressure flag. Signed-off-by: Oleg Drokin <oleg.drokin@intel.com> Reviewed-on: http://review.whamcloud.com/8667 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4360 Reviewed-by: Liang Zhen <liang.zhen@intel.com> Reviewed-by: Amir Shehata <amir.shehata@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging/lustre: fix compile warning with is_vmalloc_addrOleg Drokin1-1/+1
Recent commit 175f5475fb9c5800319da4e3c4204413d7280f5c introduced this compile warning (because vaddr is unsigned long), so add a cast: drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c: In function ‘kiblnd_kvaddr_to_page’: drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:532:2: warning: passing argument 1 of ‘is_vmalloc_addr’ makes pointer from integer without a cast [enabled by default] if (is_vmalloc_addr(vaddr)) { ^ In file included from drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.h:43:0, from drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c:41: include/linux/mm.h:336:59: note: expected ‘const void *’ but argument is of type ‘long unsigned int’ static inline int is_vmalloc_addr(const void *x) Signed-off-by: Oleg Drokin <green@linuxhacker.ru> CC: Laura Abbott <lauraa@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: lustre: fix GFP_ATOMIC macro usageMarek Szyprowski1-1/+1
GFP_ATOMIC is not a single gfp flag, but a macro which expands to the other flags and LACK of __GFP_WAIT flag. To check if caller wanted to perform an atomic allocation, the code must test __GFP_WAIT flag presence. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: ion: Fix build warningJohn Stultz1-0/+1
Add #include <linux/device.h> to fix the following warning seen with gcc 4.7.3: In file included from drivers/staging/android/ion/ion_heap.c:26:0: drivers/staging/android/ion/ion_priv.h:358:21: warning: ‘struct device’ declared inside parameter list [enabled by default] drivers/staging/android/ion/ion_priv.h:358:21: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: ion: Fix ION_IOC_FREE compat ioctlLaura Abbott1-4/+22
The compat ioctl for ION_IOC_FREE currently passes allocation data instead of the free data. Correct this. Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: Laura Abbott <lauraa@codeaurora.org> [jstultz: Folded in a small build fix] Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: ion: Fix overflow and list bugs in system heapColin Cross1-1/+5
Fix a few bugs in ion_system_heap: Initialize the list node in the info block. Don't store size_remaining in a signed long, allocating >2GB could overflow, resulting in a call to sg_alloc_table with nents=0 which panics. alloc_largest_available will never return a block larger than size_remanining, so it can never go negative. Limit a single allocation to half of all memory. Prevents a large allocation from taking down the whole system. Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: Colin Cross <ccross@android.com> [jstultz: Minor commit subject tweak] Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: ashmem: Avoid deadlock between read and mmap callsTodd Poynor1-19/+26
Avoid holding ashmem_mutex across code that can page fault. Page faults grab the mmap_sem for the process, which are also held by mmap calls prior to calling ashmem_mmap, which locks ashmem_mutex. The reversed order of locking between the two can deadlock. The calls that can page fault are read() and the ASHMEM_SET_NAME and ASHMEM_GET_NAME ioctls. Move the code that accesses userspace pages outside the ashmem_mutex. Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: Todd Poynor <toddpoynor@google.com> [jstultz: minor commit message tweaks] Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: sync: Fix a race condition between release_obj and print_objAlistair Strachan1-3/+3
Before this change, a timeline would only be removed from the timeline list *after* the sync driver had its release_obj() called. However, the driver's release_obj() may free resources needed by print_obj(). Although the timeline list is locked when print_obj() is called, it is not locked when release_obj() is called. If one CPU was in print_obj() when another was in release_obj(), the print_obj() may make unsafe accesses. It is not actually necessary to hold the timeline list lock when calling release_obj() if the call is made after the timeline is unlinked from the list, since there is no possibility another thread could be in -- or enter -- print_obj() for that timeline. This change moves the release_obj() call to after the timeline is unlinked, preventing the above race from occurring. Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com> [jstultz: minor commit subject tweak] Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: sw_sync: Add stubs for kernels without CONFIG_SW_SYNCGreg Hackmann1-0/+17
Add stubs for kernels without CONFIG_SW_SYNC Cc: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Signed-off-by: Greg Hackmann <ghackmann@google.com> [jstultz: resolved minor conflict, tweaked commit message] Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07staging: don't use module_init in non-modular ion_dummy_driver.cPaul Gortmaker1-4/+3
The ION_DUMMY option is bool, and hence this code is either present or absent. It will never be modular, so using module_init as an alias for __initcall is rather misleading. Fix this up now, so that we can relocate module_init from init.h into module.h in the future. If we don't do this, we'd have to add module.h to obviously non-modular code, and that would be a worse thing. Note that direct use of __initcall is discouraged, vs. one of the priority categorized subgroups. As __initcall gets mapped onto device_initcall, our use of device_initcall directly in this change means that the runtime impact is zero -- it will remain at level 6 in initcall ordering. Cc: Colin Cross <ccross@android.com> Cc: Jesse Barker <jesse.barker@arm.com> Cc: Android Kernel Team <kernel-team@android.com> Cc: John Stultz <john.stultz@linaro.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07ion: dummy driver: use ARRAY_SIZE for nr of heapsTomas Winkler1-1/+1
use ARRAY_SIZE to count number of heaps in static array Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07drivers: staging: android: ion: ion_dummy_driver: include "linux/io.h"Chen Gang1-0/+1
Need add "linux/io.h" to pass compiling under metag architecture with allmodconfig (which use the default 'virt_to_phys'), the related error: CC drivers/staging/android/ion/ion_dummy_driver.o drivers/staging/android/ion/ion_dummy_driver.c: In function 'ion_dummy_init': drivers/staging/android/ion/ion_dummy_driver.c:81: error: implicit declaration of function 'virt_to_phys' Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07Merge tag 'iio-fixes-for-3.14a' of ↵Greg Kroah-Hartman3-6/+13
git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes for the 3.14 cycle. Included is the patch previously set as the fourth round for 3.13 which was to late to be appropriate. * Another endian fix (ad799x adc) due to missuse of the IIO_ST macro (which is going away very shortly) * A reversed error check in ad5933 which will make the probe fail. * A buffer overflow in the example code in the documentation. * ad799x was freeing an irq that might or might not have been requested. * tsl2563 was checking the wrong element of chan_spec for modifiers. Thus some sysfs reads would give the wrong values. * A missing dependency on HAS_IOMEM in spear_adc and lpc32xx was causing some test build failures (on s390 and perhaps elsewhere). I also have a few fixes queued up for things that went in during the 3.14 merge window which will follow as a separate pull request (to avoid rebasing my tree).
2014-02-05staging: imx-drm: Fix build errorSachin Kamat1-13/+9
Instead of redefining the enums, use the standard ones already available to avoid the following build errors: drivers/staging/imx-drm/imx-hdmi.c:56:13: error: nested redefinition of ‘enum hdmi_colorimetry’ drivers/staging/imx-drm/imx-hdmi.c:56:13: error: redeclaration of ‘enum hdmi_colorimetry’ In file included from include/drm/drm_crtc.h:33:0, from include/drm/drmP.h:710, from drivers/staging/imx-drm/imx-hdmi.c:24: include/linux/hdmi.h:48:6: note: originally defined here Reported-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Cc: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-05imx-drm: imx-drm-core: merge imx_drm_crtc_register() into imx_drm_add_crtc()Russell King1-24/+9
There's no reason for this to be a separate function; merge the two together. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Shawn Guo <shawn.guo@linaro.org> Tested-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-05imx-drm: imx-drm-core: avoid going the long route round for drm_deviceRussell King1-8/+8
We have the drm_device available, so rather than storing it and then using the stored version, us the one we already have available to us. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Shawn Guo <shawn.guo@linaro.org> Tested-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-05imx-drm: imx-drm-core: use the crtc drm device for vblankRussell King1-3/+3
There are a couple of ways to get at the drm_device for the vblank operations. One of them is via the private imxdrm structure, the other is via the DRM crtc structure, which also stores a pointer. Use the DRM method instead of our own method. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Shawn Guo <shawn.guo@linaro.org> Tested-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-04[media] go7007-loader: fix usb_dev leakAlexey Khoroshilov1-1/+3
There is usb_get_dev() in go7007_loader_probe(), but there is no usb_put_dev() anywhere. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2014-02-01Merge tag 'staging-3.14-rc1' of ↵Linus Torvalds75-0/+71854
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull rtl8812ae staging wireless driver from Greg KH: "Here's a single staging driver for a wireless chipset that has shown up in the SteamBox hardware. It is merged separately from the "main" staging pull request to sync up with the wireless api changes that came in from the networking tree. It's self-contained and works for me and others. Larry will be replacing it with a "real" driver for 3.15, but for now this one is needed" * tag 'staging-3.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: r8821ae: Enable build by reverting BROKEN marking staging: r8821ae: Fix build problems Staging: rtl8812ae: disable due to build errors Staging: rtl8821ae: add TODO file Staging: rtl8821ae: removed unused functions and variables Staging: rtl8821ae: rc.c: fix up function prototypes Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver
2014-01-31Merge branch 'v4l_for_linus' of ↵Linus Torvalds69-141/+24865
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - a new jpeg codec driver for Samsung Exynos (jpeg-hw-exynos4) - a new dvb frontend for ds2103 chipset (m88ds2103) - a new sensor driver for Samsung S5K5BAF UXGA (s5k5baf) - new drivers for R-Car VSP1 - a new radio driver: radio-raremono - a new tuner driver for ts2022 chipset (m88ts2022) - the analog part of em28xx is now a separate module that only load/runs if the device is not a pure digital TV device - added a staging driver for bcm2048 radio devices - the omap 2 video driver (omap24xx) was moved to staging. This driver is for an old hardware and uses a deprecated Kernel internal API. If nobody cares enough to fix it, it would be removed on a couple Kernel releases - the sn9c102 driver was moved to staging. This driver was replaced by gspca, and disabled on some distros, as almost all devices are known to work properly with gspca. It should be removed from kernel on a couple Kernel releases - lots of driver fixes, improvements and cleanups * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (421 commits) [media] media: v4l2-dev: fix video device index assignment [media] rc-core: reuse device numbers [media] em28xx-cards: properly initialize the device bitmap [media] Staging: media: Fix line length exceeding 80 characters in as102_drv.c [media] Staging: media: Fix line length exceeding 80 characters in as102_fe.c [media] Staging: media: Fix quoted string split across line in as102_fe.c [media] media: st-rc: Add reset support [media] m2m-deinterlace: fix allocated struct type [media] radio-usb-si4713: fix sparse non static symbol warnings [media] em28xx-audio: remove needless check before usb_free_coherent() [media] au0828: Fix sparse non static symbol warning Revert "[media] go7007-usb: only use go->dev after allocated" [media] em28xx-audio: provide an error code when URB submit fails [media] em28xx: fix check for audio only usb interfaces when changing the usb alternate setting [media] em28xx: fix usb alternate setting for analog and digital video endpoints > 0 [media] em28xx: make 'em28xx_ctrl_ops' static em28xx-alsa: Fix error patch for init/fini [media] em28xx-audio: flush work at .fini [media] drxk: remove the option to load firmware asynchronously [media] em28xx: adjust period size at runtime ...
2014-01-30zram: promote zram from stagingMinchan Kim7-1226/+0
Zram has lived in staging for a LONG LONG time and have been fixed/improved by many contributors so code is clean and stable now. Of course, there are lots of product using zram in real practice. The major TV companys have used zram as swap since two years ago and recently our production team released android smart phone with zram which is used as swap, too and recently Android Kitkat start to use zram for small memory smart phone. And there was a report Google released their ChromeOS with zram, too and cyanogenmod have been used zram long time ago. And I heard some disto have used zram block device for tmpfs. In addition, I saw many report from many other peoples. For example, Lubuntu start to use it. The benefit of zram is very clear. With my experience, one of the benefit was to remove jitter of video application with backgroud memory pressure. It would be effect of efficient memory usage by compression but more issue is whether swap is there or not in the system. Recent mobile platforms have used JAVA so there are many anonymous pages. But embedded system normally are reluctant to use eMMC or SDCard as swap because there is wear-leveling and latency issues so if we do not use swap, it means we can't reclaim anoymous pages and at last, we could encounter OOM kill. :( Although we have real storage as swap, it was a problem, too. Because it sometime ends up making system very unresponsible caused by slow swap storage performance. Quote from Luigi on Google "Since Chrome OS was mentioned: the main reason why we don't use swap to a disk (rotating or SSD) is because it doesn't degrade gracefully and leads to a bad interactive experience. Generally we prefer to manage RAM at a higher level, by transparently killing and restarting processes. But we noticed that zram is fast enough to be competitive with the latter, and it lets us make more efficient use of the available RAM. " and he announced. http://www.spinics.net/lists/linux-mm/msg57717.html Other uses case is to use zram for block device. Zram is block device so anyone can format the block device and mount on it so some guys on the internet start zram as /var/tmp. http://forums.gentoo.org/viewtopic-t-838198-start-0.html Let's promote zram and enhance/maintain it instead of removing. Signed-off-by: Minchan Kim <minchan@kernel.org> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Nitin Gupta <ngupta@vflare.org> Acked-by: Pekka Enberg <penberg@kernel.org> Cc: Bob Liu <bob.liu@oracle.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hugh Dickins <hughd@google.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Luigi Semenzato <semenzato@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Rik van Riel <riel@redhat.com> Cc: Seth Jennings <sjenning@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-01-30zsmalloc: move it under mmMinchan Kim7-1188/+1
This patch moves zsmalloc under mm directory. Before that, description will explain why we have needed custom allocator. Zsmalloc is a new slab-based memory allocator for storing compressed pages. It is designed for low fragmentation and high allocation success rate on large object, but <= PAGE_SIZE allocations. zsmalloc differs from the kernel slab allocator in two primary ways to achieve these design goals. zsmalloc never requires high order page allocations to back slabs, or "size classes" in zsmalloc terms. Instead it allows multiple single-order pages to be stitched together into a "zspage" which backs the slab. This allows for higher allocation success rate under memory pressure. Also, zsmalloc allows objects to span page boundaries within the zspage. This allows for lower fragmentation than could be had with the kernel slab allocator for objects between PAGE_SIZE/2 and PAGE_SIZE. With the kernel slab allocator, if a page compresses to 60% of it original size, the memory savings gained through compression is lost in fragmentation because another object of the same size can't be stored in the leftover space. This ability to span pages results in zsmalloc allocations not being directly addressable by the user. The user is given an non-dereferencable handle in response to an allocation request. That handle must be mapped, using zs_map_object(), which returns a pointer to the mapped region that can be used. The mapping is necessary since the object data may reside in two different noncontigious pages. The zsmalloc fulfills the allocation needs for zram perfectly [sjenning@linux.vnet.ibm.com: borrow Seth's quote] Signed-off-by: Minchan Kim <minchan@kernel.org> Acked-by: Nitin Gupta <ngupta@vflare.org> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Cc: Bob Liu <bob.liu@oracle.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hugh Dickins <hughd@google.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Luigi Semenzato <semenzato@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Pekka Enberg <penberg@kernel.org> Cc: Rik van Riel <riel@redhat.com> Cc: Seth Jennings <sjenning@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>