summaryrefslogtreecommitdiffstats
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2016-11-07drm/nouveau: silence sparse warnings about symbols not being marked staticBen Skeggs33-55/+58
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/tegra: Fix error handlingChristophe JAILLET1-1/+1
'iommu_domain_alloc()' returns NULL in case of error, not an error pointer. So test it accordingly. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/fb: add gm20b deviceAlexandre Courbot6-2/+48
gm20b's FB has the same capabilities as gm200, minus the ability to allocate RAM. Create a device that reflects this instead of re-using the gk20a device which may be incorrect. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-By: Karol Herbst <karolherbst@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/fb/gk20a: use regular gf100's functionsAlexandre Courbot1-12/+5
gk20a's FB is not special compared to other Kepler chips, besides the fact it does not have VRAM. Use the regular gf100 hooks instead of the incomplete versions we rewrote. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-By: Karol Herbst <karolherbst@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/fb/gk20a: fix constructor callAlexandre Courbot1-1/+2
The gf100 constructor should be called, otherwise we will allocate a smaller object than expected. This was without effect so far because gk20a did not allocate a page, but with gf100's page allocation moved to the oneinit() hook this problem has become apparent. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/pmu: remove reset() hookAlexandre Courbot2-11/+0
The reset hook of pmu_func is never called, and gt215 was the only chip to implement. Remove this dead code. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau: fix notify data leakLucas Stach1-4/+2
There is no reason to not free the notify data if the NTFY_DEL ioctl failed. As nvif_notify_fini() is also called from the cleanup path of nvif_notify_init(), the notifier may not have been successfully created at that point. But it should also be the right thing to just free the data in the regular fini calls, as there is nothing much we can do if the ioctl fails, so better not leak memory. Signed-off-by: Lucas Stach <dev@lynxeye.de> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau: fix nv84 fence context leakLucas Stach1-1/+1
uevent based fences hold a reference to the fence context, just like the legacy ones. So they need to drop this reference in the same way. Signed-off-by: Lucas Stach <dev@lynxeye.de> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau: hide gcc-4.9 -Wmaybe-uninitializedArnd Bergmann1-1/+1
gcc-4.9 notices that the validate_init() function returns unintialized data when called with a zero 'nr_buffers' argument, when called with the -Wmaybe-uninitialized flag: drivers/gpu/drm/nouveau/nouveau_gem.c: In function ‘validate_init.isra.6’: drivers/gpu/drm/nouveau/nouveau_gem.c:457:5: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized] However, the only caller of this function always passes a nonzero argument, and gcc-6 is clever enough to take this into account and not warn about it any more. Adding an explicit initialization to -EINVAL here is correct even if the caller changed, and it avoids the warning on gcc-4.9 as well. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-By: Karol Herbst <karolherbst@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau: mark symbols static where possibleBaoyou Xie17-28/+28
We get a few warnings when building kernel with W=1: drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c:29:1: warning: no previous prototype for 'nvbios_fan_table' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c:56:1: warning: no previous prototype for 'nvbios_fan_entry' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/clk/gt215.c:184:1: warning: no previous prototype for 'gt215_clk_info' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c:99:1: warning: no previous prototype for 'gt215_link_train_calc' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c:153:1: warning: no previous prototype for 'gt215_link_train' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgt215.c:271:1: warning: no previous prototype for 'gt215_link_train_init' [-Wmissing-prototypes] .... In fact, both functions are only used in the file in which they are declared and don't need a declaration, but can be made static. So this patch marks these functions with 'static'. Signed-off-by: Baoyou Xie <baoyou.xie@linaro.org> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau: add missing header dependenciesBaoyou Xie5-1/+5
We get a few warnings when building kernel with W=1: drivers/gpu/drm/nouveau/nvkm/core/firmware.c:34:1: warning: no previous prototype for 'nvkm_firmware_get' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/core/firmware.c:58:1: warning: no previous prototype for 'nvkm_firmware_put' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/fb/sddr3.c:69:1: warning: no previous prototype for 'nvkm_sddr3_calc' [-Wmissing-prototypes] drivers/gpu/drm/nouveau/nvkm/subdev/fb/sddr2.c:60:1: warning: no previous prototype for 'nvkm_sddr2_calc' [-Wmissing-prototypes] .... In fact, these functions are declared in drivers/gpu/drm/nouveau/include/nvkm/core/firmware.h drivers/gpu/drm/nouveau/nvkm/subdev/fb/ram.h drivers/gpu/drm/nouveau/nvkm/subdev/volt/priv.h drivers/gpu/drm/nouveau/nvkm/engine/gr/nv50.h drivers/gpu/drm/nouveau/dispnv04/disp.h. So this patch adds missing header dependencies. Signed-off-by: Baoyou Xie <baoyou.xie@linaro.org> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/i2c/gk110b,gm10x: use the correct implementationBen Skeggs1-3/+3
DPAUX registers moved on Kepler, these chipsets were still using the Fermi implementation for some reason. This fixes detection of hotplug/sink IRQs on DP connectors. Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Cc: stable@vger.kernel.org
2016-11-07drm/nouveau/i2c/aux/g94-: retry transactions after hw reports an errorBen Skeggs2-10/+10
This fixes (works around?) link training failures seen on (at least) the Lenovo P50's internal panel. It's also an important fix on the same system for MST support on the dock. Sometimes, right after receiving an IRQ from the sink, there's an error bit (SINKSTAT_ERR) set in the DPAUX registers before we've even attempted a transaction. v2. Fixed regression on passive DP->DVI adapters. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/kms: lvds panel strap moved again on maxwellBen Skeggs1-0/+3
Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Cc: stable@vger.kernel.org
2016-11-07drm/nouveau/mxm: add some extra debug outputBen Skeggs1-0/+4
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2016-11-07drm/nouveau/bios: require checksum to match for fast acpi shadow methodBen Skeggs3-2/+7
Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Cc: stable@vger.kernel.org
2016-11-07Backmerge tag 'v4.9-rc4' into drm-nextDave Airlie350-2144/+3624
Linux 4.9-rc4 This is needed for nouveau development.
2016-11-05Merge branch 'i2c/for-current' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "A bugfix for the I2C core fixing a (rare) race condition" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: core: fix NULL pointer dereference under race condition
2016-11-05Merge tag 'md/4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/mdLinus Torvalds4-19/+30
Pull MD fixes from Shaohua Li: "There are several bug fixes queued: - fix raid5-cache recovery bugs - fix discard IO error handling for raid1/10 - fix array sync writes bogus position to superblock - fix IO error handling for raid array with external metadata" * tag 'md/4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: md: be careful not lot leak internal curr_resync value into metadata. -- (all) raid1: handle read error also in readonly mode raid5-cache: correct condition for empty metadata write md: report 'write_pending' state when array in sync md/raid5: write an empty meta-block when creating log super-block md/raid5: initialize next_checkpoint field before use RAID10: ignore discard error RAID1: ignore discard error
2016-11-05Merge tag 'scsi-fixes' of ↵Linus Torvalds3-17/+6
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two more important data integrity fixes related to RAID device drivers which wrongly throw away the SYNCHRONIZE CACHE command in the non-RAID path and a memory leak in the scsi_debug driver" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices
2016-11-05Merge branch 'for-linus' of ↵Linus Torvalds2-3/+10
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem updates from Dmitry Torokhov. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: psmouse - cleanup Focaltech code Input: i8042 - add XMG C504 to keyboard reset table
2016-11-05Merge tag 'firewire-fixes' of ↵Linus Torvalds1-20/+39
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull FireWire (IEEE 1394) fixes from Stefan Richter: - add missing input validation to the firewire-net driver. Invalid IP-over-1394 encapsulation headers could trigger buffer overflows (CVE 2016-8633). - IP-over-1394 link fragmentation headers were read and written incorrectly, breaking fragmented RX/TX with other OS's stacks. * tag 'firewire-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: net: fix fragmented datagram_size off-by-one firewire: net: guard against rx buffer overflows
2016-11-05Merge tag 'media/v4.9-3' of ↵Linus Torvalds25-499/+919
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A series of fixup patches meant to fix the usage of DMA on stack, plus one warning fixup" * tag 'media/v4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (32 commits) [media] radio-bcm2048: don't ignore errors [media] pctv452e: fix semicolon.cocci warnings [media] flexcop-usb: don't use stack for DMA [media] stk-webcam: don't use stack for DMA [media] s2255drv: don't use stack for DMA [media] cpia2_usb: don't use stack for DMA [media] digitv: handle error code on RC query [media] dw2102: return error if su3000_power_ctrl() fails [media] nova-t-usb2: handle error code on RC query [media] technisat-usb2: use DMA buffers for I2C transfers [media] pctv452e: don't call BUG_ON() on non-fatal error [media] pctv452e: don't do DMA on stack [media] nova-t-usb2: don't do DMA on stack [media] gp8psk: don't go past the buffer size [media] gp8psk: don't do DMA on stack [media] dtv5100: don't do DMA on stack [media] dtt200u: handle USB control message errors [media] dtt200u: don't do DMA on stack [media] dtt200u-fe: handle errors on USB control messages [media] dtt200u-fe: don't do DMA on stack ...
2016-11-05Merge tag 'pci-v4.9-fixes-2' of ↵Linus Torvalds2-3/+6
git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - fix for a Qualcomm driver issue that causes a use-before-set crash - fix for DesignWare iATU unroll support that causes external aborts when enabling the host bridge * tag 'pci-v4.9-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: designware: Check for iATU unroll support after initializing host PCI: qcom: Fix pp->dev usage before assignment
2016-11-05Merge tag 'for-linus-20161104' of git://git.infradead.org/linux-mtdLinus Torvalds3-30/+55
Pull MTD fixes from Brian Norris: - MAINTAINERS updates to reflect some new maintainers/submaintainers. We have some great volunteers who've been developing and reviewing already. We're going to try a group maintainership model, so eventually you'll probably see pull requests from people besides me. - NAND fixes from Boris: "Three simple fixes: - fix a non-critical bug in the gpmi driver - fix a bug in the 'automatic NAND timings selection' feature introduced in 4.9-rc1 - fix a false positive uninitialized-var warning" * tag 'for-linus-20161104' of git://git.infradead.org/linux-mtd: mtd: mtk: avoid warning in mtk_ecc_encode mtd: nand: Fix data interface configuration logic mtd: nand: gpmi: disable the clocks on errors MAINTAINERS: add more people to the MTD maintainer team MAINTAINERS: add a maintainer for the SPI NOR subsystem
2016-11-05Merge tag 'mmc-v4.9-rc2' of ↵Linus Torvalds2-2/+4
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC host: - sdhci-msm: Fix error path in probe - dw_mmc-pltfm: Avoid NULL pointer dereference" * tag 'mmc-v4.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-msm: Fix error return code in sdhci_msm_probe() mmc: dw_mmc-pltfm: fix the potential NULL pointer dereference
2016-11-05Merge tag 'gpio-v4.9-3' of ↵Linus Torvalds3-66/+97
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Some GPIO fixes for the v4.9 series: - Fix a nasty file descriptor leak when getting line handles. - A fix for a cleanup that seemed innocent but created a problem for drivers instantiating several gpiochips for one single OF node. - Fix a unpredictable problem using irq_domain_simple() in the mvebu driver by converting it to a lineas irqdomain" * tag 'gpio-v4.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio/mvebu: Use irq_domain_add_linear gpio: of: fix GPIO drivers with multiple gpio_chip for a single node gpio: GPIO_GET_LINE{HANDLE,EVENT}_IOCTL: Fix file descriptor leak
2016-11-04Merge tag 'drm-fixes-for-v4.9-rc4' of ↵Linus Torvalds51-240/+443
git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "Fixes for amdgpu, radeon, intel, imx and virtio-gpu. This is a bit larger than I'd like, but I had some stuff I meant to send for -rc3 but was waiting for the PAT regression fix to land. So this is really fixes for rc3 and rc4 in one go. There are a set of fixes for an oops we've been seeing around MST display unplug, along with more suspend/resume and shutdown fixes for amdgpu, one power management follow on fix for nouveau, and set of imx fixes, and a single virtio-gpu regression fix" * tag 'drm-fixes-for-v4.9-rc4' of git://people.freedesktop.org/~airlied/linux: (54 commits) virtio-gpu: fix vblank events drm/nouveau/acpi: fix check for power resources support drm/i915: Fix SKL+ 90/270 degree rotated plane coordinate computation drm/i915: Remove two invalid warns drm/i915: Rotated view does not need a fence drm/i915/fbc: fix CFB size calculation for gen8+ drm: i915: Wait for fences on new fb, not old drm/i915: Clean up DDI DDC/AUX CH sanitation drm/i915: Respect alternate_aux_channel for all DDI ports drm/i915/gen9: fix watermarks when using the pipe scaler drm/i915: Fix mismatched INIT power domain disabling during suspend drm/i915: fix a read size argument drm/i915: Use fence_write() from rpm resume drm/i915/gen9: fix DDB partitioning for multi-screen cases drm/i915: workaround sparse warning on variable length arrays drm/i915: keep declarations in i915_drv.h drm/amd/powerplay: fix bug get wrong evv voltage of Polaris. drm/amdgpu/si_dpm: workaround for SI kickers drm/radeon/si_dpm: workaround for SI kickers drm/amdgpu: fix s3 resume back, uvd dpm randomly can't disable. ...
2016-11-04PCI: designware: Check for iATU unroll support after initializing hostNiklas Cassel1-2/+5
dw_pcie_iatu_unroll_enabled() reads a dbi_base register. Reading any dbi_base register before pp->ops->host_init has been called causes "imprecise external abort" on platforms like ARTPEC-6, where the PCIe module is disabled at boot and first enabled in pp->ops->host_init. Move dw_pcie_iatu_unroll_enabled() to dw_pcie_setup_rc(), since it is after pp->ops->host_init, but before pp->iatu_unroll_enabled is actually used. Fixes: a0601a470537 ("PCI: designware: Add iATU Unroll feature") Tested-by: James Le Cuirot <chewi@gentoo.org> Signed-off-by: Niklas Cassel <niklas.cassel@axis.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Joao Pinto <jpinto@synopsys.com> Acked-by: Olof Johansson <olof@lixom.net>
2016-11-04i2c: core: fix NULL pointer dereference under race conditionVladimir Zapolskiy1-1/+1
Race condition between registering an I2C device driver and deregistering an I2C adapter device which is assumed to manage that I2C device may lead to a NULL pointer dereference due to the uninitialized list head of driver clients. The root cause of the issue is that the I2C bus may know about the registered device driver and thus it is matched by bus_for_each_drv(), but the list of clients is not initialized and commonly it is NULL, because I2C device drivers define struct i2c_driver as static and clients field is expected to be initialized by I2C core: i2c_register_driver() i2c_del_adapter() driver_register() ... bus_add_driver() ... ... bus_for_each_drv(..., __process_removed_adapter) ... i2c_do_del_adapter() ... list_for_each_entry_safe(..., &driver->clients, ...) INIT_LIST_HEAD(&driver->clients); To solve the problem it is sufficient to do clients list head initialization before calling driver_register(). The problem was found while using an I2C device driver with a sluggish registration routine on a bus provided by a physically detachable I2C master controller, but practically the oops may be reproduced under the race between arbitraty I2C device driver registration and managing I2C bus device removal e.g. by unbinding the latter over sysfs: % echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind Unable to handle kernel NULL pointer dereference at virtual address 00000000 Internal error: Oops: 17 [#1] SMP ARM CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) task: e5ada400 task.stack: e4936000 PC is at i2c_do_del_adapter+0x20/0xcc LR is at __process_removed_adapter+0x14/0x1c Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 35bd004a DAC: 00000051 Process sh (pid: 533, stack limit = 0xe4936210) Stack: (0xe4937d28 to 0xe4938000) Backtrace: [<c0667be0>] (i2c_do_del_adapter) from [<c0667cc0>] (__process_removed_adapter+0x14/0x1c) [<c0667cac>] (__process_removed_adapter) from [<c0516998>] (bus_for_each_drv+0x6c/0xa0) [<c051692c>] (bus_for_each_drv) from [<c06685ec>] (i2c_del_adapter+0xbc/0x284) [<c0668530>] (i2c_del_adapter) from [<bf0110ec>] (i2c_imx_remove+0x44/0x164 [i2c_imx]) [<bf0110a8>] (i2c_imx_remove [i2c_imx]) from [<c051a838>] (platform_drv_remove+0x2c/0x44) [<c051a80c>] (platform_drv_remove) from [<c05183d8>] (__device_release_driver+0x90/0x12c) [<c0518348>] (__device_release_driver) from [<c051849c>] (device_release_driver+0x28/0x34) [<c0518474>] (device_release_driver) from [<c0517150>] (unbind_store+0x80/0x104) [<c05170d0>] (unbind_store) from [<c0516520>] (drv_attr_store+0x28/0x34) [<c05164f8>] (drv_attr_store) from [<c0298acc>] (sysfs_kf_write+0x50/0x54) [<c0298a7c>] (sysfs_kf_write) from [<c029801c>] (kernfs_fop_write+0x100/0x214) [<c0297f1c>] (kernfs_fop_write) from [<c0220130>] (__vfs_write+0x34/0x120) [<c02200fc>] (__vfs_write) from [<c0221088>] (vfs_write+0xa8/0x170) [<c0220fe0>] (vfs_write) from [<c0221e74>] (SyS_write+0x4c/0xa8) [<c0221e28>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c) Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de> Cc: stable@kernel.org
2016-11-03firewire: net: fix fragmented datagram_size off-by-oneStefan Richter1-4/+4
RFC 2734 defines the datagram_size field in fragment encapsulation headers thus: datagram_size: The encoded size of the entire IP datagram. The value of datagram_size [...] SHALL be one less than the value of Total Length in the datagram's IP header (see STD 5, RFC 791). Accordingly, the eth1394 driver of Linux 2.6.36 and older set and got this field with a -/+1 offset: ether1394_tx() /* transmit */ ether1394_encapsulate_prep() hdr->ff.dg_size = dg_size - 1; ether1394_data_handler() /* receive */ if (hdr->common.lf == ETH1394_HDR_LF_FF) dg_size = hdr->ff.dg_size + 1; else dg_size = hdr->sf.dg_size + 1; Likewise, I observe OS X 10.4 and Windows XP Pro SP3 to transmit 1500 byte sized datagrams in fragments with datagram_size=1499 if link fragmentation is required. Only firewire-net sets and gets datagram_size without this offset. The result is lacking interoperability of firewire-net with OS X, Windows XP, and presumably Linux' eth1394. (I did not test with the latter.) For example, FTP data transfers to a Linux firewire-net box with max_rec smaller than the 1500 bytes MTU - from OS X fail entirely, - from Win XP start out with a bunch of fragmented datagrams which time out, then continue with unfragmented datagrams because Win XP temporarily reduces the MTU to 576 bytes. So let's fix firewire-net's datagram_size accessors. Note that firewire-net thereby loses interoperability with unpatched firewire-net, but only if link fragmentation is employed. (This happens with large broadcast datagrams, and with large datagrams on several FireWire CardBus cards with smaller max_rec than equivalent PCI cards, and it can be worked around by setting a small enough MTU.) Cc: stable@vger.kernel.org Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2016-11-03firewire: net: guard against rx buffer overflowsStefan Richter1-16/+35
The IP-over-1394 driver firewire-net lacked input validation when handling incoming fragmented datagrams. A maliciously formed fragment with a respectively large datagram_offset would cause a memcpy past the datagram buffer. So, drop any packets carrying a fragment with offset + length larger than datagram_size. In addition, ensure that - GASP header, unfragmented encapsulation header, or fragment encapsulation header actually exists before we access it, - the encapsulated datagram or fragment is of nonzero size. Reported-by: Eyal Itkin <eyal.itkin@gmail.com> Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com> Fixes: CVE 2016-8633 Cc: stable@vger.kernel.org Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2016-11-03Merge tag 'drm-intel-fixes-2016-11-01' of ↵Dave Airlie11-108/+171
git://anongit.freedesktop.org/drm-intel into drm-fixes batch of scattered i915 fixes. * tag 'drm-intel-fixes-2016-11-01' of git://anongit.freedesktop.org/drm-intel: drm/i915: Fix SKL+ 90/270 degree rotated plane coordinate computation drm/i915: Remove two invalid warns drm/i915: Rotated view does not need a fence drm/i915/fbc: fix CFB size calculation for gen8+ drm: i915: Wait for fences on new fb, not old drm/i915: Clean up DDI DDC/AUX CH sanitation drm/i915: Respect alternate_aux_channel for all DDI ports drm/i915/gen9: fix watermarks when using the pipe scaler drm/i915: Fix mismatched INIT power domain disabling during suspend drm/i915: fix a read size argument drm/i915: Use fence_write() from rpm resume drm/i915/gen9: fix DDB partitioning for multi-screen cases drm/i915: workaround sparse warning on variable length arrays drm/i915: keep declarations in i915_drv.h
2016-11-03Merge tag 'imx-drm-fixes-20161021' of git://git.pengutronix.de/pza/linux ↵Dave Airlie3-10/+26
into drm-fixes imx-drm plane, build warning, and error handling fixes - some fixes for active plane reconfiguration support - hide unused label in case of disabled CONFIG_DRM_FBDEV_EMULATION, which caused a build warning - fixed error handling in imx_drm_bind - disallow odd x/y plane offsets for chroma subsampled formats - disable local alpha when switching from a format with alpha channel to an opaque format * tag 'imx-drm-fixes-20161021' of git://git.pengutronix.de/pza/linux: drm/imx: ipuv3-plane: disable local alpha for planes without alpha channel drm/imx: ipuv3-plane: make sure x/y offsets are even in case of chroma subsampling drm/imx: ipuv3-plane: Access old u/vbo properly in ->atomic_check for YU12/YV12 drm/imx: drm_dev_alloc() returns error pointers drm/imx: ipuv3-plane: Skip setting u/vbo only when we don't need modeset drm/imx: ipuv3-plane: Switch EBA buffer only when we don't need modeset gpu: ipu-v3: Use ERR_CAST instead of ERR_PTR(PTR_ERR()) drm/imx: hide an unused label
2016-11-03virtio-gpu: fix vblank eventsGerd Hoffmann1-2/+1
virtio-gpu sends vblank events in virtio_gpu_crtc_atomic_flush, and because of that it must be called for disabled planes too. Ask drm_atomic_helper_commit_planes to do that. v2: update to use new drm_atomic_helper_commit_planes() API. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2016-11-02drm/omap: panel-lgphilips-lb035q02: Add note for incorrect data drive edge ↵Peter Ujfalusi1-0/+5
and DE level According to the datasheet of the panel, both data, DEN and sync signals are expected to be driven on the falling edge of the DOTCLK. The DE is active low according to the documentation. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: panel-sharp-ls037v7dw01: Add note for incorrect data drive edgePeter Ujfalusi1-0/+4
According to the datasheet of the panel, both data, DEN and sync signals are expected to be driven on the falling edge of the DOTCLK. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: panel-tpo-td028ttec1: Add note for incorrect sync drive edgePeter Ujfalusi1-0/+4
According to the datasheet of the panel, both data, DEN and sync signals are expected to be driven on the falling edge of the DOTCLK. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: panel-tpo-td043mtea1: Add note for incorrect sync drive edgePeter Ujfalusi1-0/+4
According to the datasheet of the panel, both data, DEN and sync signals are expected to be driven on the falling edge of the DOTCLK. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: Use consistent name for struct videomodePeter Ujfalusi33-535/+527
Use 'vm' to refer to a struct videomode instead of 'p', 't', 'timings' or something else. The code will be easier to follow if we use consistent names. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: Replace struct omap_video_timings with videomodePeter Ujfalusi34-317/+178
omap_video_timings can be replaced with the generic videomode in omapdrm and the omap_video_timings can be removed. This patch will replace the omap_video_timings with videomode. With the change we no longer need the functions to convert to/from videomode and drm_display_mode to omap_video_timings, these can be removed as well. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: Change the types of struct omap_video_timings membersPeter Ujfalusi5-14/+15
omap_video_timings struct have the same members as struct videomode, but their types are different. As first step change the types of the omap_video_timings struct members to match their counterpart in struct videomode to catch any type cast related issues. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: omap_display_timings: Use display_flags for sync edgePeter Ujfalusi16-54/+35
In preparation to move the stack to use the generic videmode struct for display timing information use display_flags for sync edge. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: omap_display_timings: Use display_flags for pixel data edgePeter Ujfalusi16-46/+24
In preparation to move the stack to use the generic videmode struct for display timing information use display_flags for pixel data edge. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: omap_display_timings: Use display_flags for double_pixel modePeter Ujfalusi7-13/+11
In preparation to move the stack to use the generic videmode struct for display timing information use display_flags for double_pixel mode. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: omap_display_timings: Use display_flags for DE levelPeter Ujfalusi15-44/+29
In preparation to move the stack to use the generic videmode struct for display timing information use display_flags for DE level. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: omap_display_timings: Use display_flags for h/vsync levelPeter Ujfalusi18-83/+52
In preparation to move the stack to use the generic videmode struct for display timing information use display_flags for h/vsync level. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: dispc: Simplify _dispc_mgr_set_lcd_timings() parametersPeter Ujfalusi1-24/+14
Instead of passing the omap_video_timings structure's members individually, use the pointer to the struct. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: omap_display_timings: Use display_flags for interlace modePeter Ujfalusi10-22/+21
Remove the interlace member and add display_flags to omap_video_timings to configure the interlace mode. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-11-02drm/omap: HDMI5: Use pointer to cfg->v_fc_config.timings in ↵Peter Ujfalusi1-27/+20
hdmi_core_video_config By using a pointer to the omap_mode_timings struct we can unwrap lines to make the code easier to follow. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>