staging:iio: Disallow modifying buffer size when buffer is enabled
The buffer buffer storage is only update when enabling the buffer. Changing the
buffer size while the buffer is enabled will confuse the buffer in regard to
its actual buffer size and can cause potential memory corruption. Thus it is
only safe to modify the buffer size when the buffer is disabled.
staging:iio: Disallow changing scan elements in all buffered modes
Currently we only disallow changing the scan elements, while the buffer is
enabled, in triggered buffer mode. This patch changes it to disallow it for all
buffered modes. Disabling or enabling scan elements while the buffer is enabled
will cause undefined behavior since the reader will not be able to tell samples
with the new and old scan element set apart and thus wont be able to extract
any meaningful data from the buffer.
Fixes the following warning:
drivers/staging/iio/industrialio-buffer.c: In function ‘iio_scan_mask_query’:
drivers/staging/iio/industrialio-buffer.c:620: warning: unused variable ‘mask’
Rakib Mullick [Thu, 22 Dec 2011 18:46:45 +0000 (00:46 +0600)]
staging: gma500: Fix warning in power.c
gma_resume_display() wants 'struct pci_dev *' as it's parameter, so lets pass dev->pdev instead of dev. Fixes the following warning.
drivers/staging/gma500/power.c: In function ‘gma_power_begin’:
drivers/staging/gma500/power.c:269:3: warning: passing argument 1 of ‘gma_resume_display’ from incompatible pointer type
drivers/staging/gma500/power.c:99:13: note: expected ‘struct pci_dev *’ but argument is of type ‘struct drm_device *’
Kevin McKinney [Sat, 17 Dec 2011 16:53:37 +0000 (11:53 -0500)]
Staging: bcm: Fix an invalid dereference to a kmalloc in IOCTL_BCM_BULK_WRM
Variable IoBuffer.InputLength is chosen from userspace,
and can therefore be less than the intended size. In this
case,the memory from the kmalloc call is eventually cast
to a PBULKWRM_BUFFER. If the IoBuffer.InputLength does not
meet the minimum size of PBULKWRM_BUFFER, then we will get
a kernel Oops. To resolve this issue, this patch verifies
IoBuffer.InputLength meets the minimum size before invoking
the kmalloc call.
Signed-off-by: Kevin McKinney <klmckinney1@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Kevin McKinney [Thu, 15 Dec 2011 03:44:33 +0000 (22:44 -0500)]
Staging: bcm: Fix information leak in IOCTL_BCM_GET_DRIVER_VERSION
This ioctl, IOCTL_BCM_GET_DRIVER_VERSION, is
responsible for sending the driver version
to userspace. However, the requested size stored
in IoBuffer.OutputLength may be incorrect.
Therefore, we altered the code to send the
exact length of the version, plus one for the
null character.
Signed-off-by: Kevin McKinney <klmckinney1@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Robert Love [Wed, 21 Dec 2011 00:49:48 +0000 (16:49 -0800)]
ashmem: Anonymous shared memory subsystem
The anonymous shared memory (ashmem) subsystem provides a
Unix-y,file-based shared memory interface to user-space. It
works like anonymous memory (e.g. mmapping fd=0) except if
you share the file descriptor via the usual means, you will
share the mapping. The shared memory can be accessed via both
mmap or file I/O. The backing store is a simple shmem file.
Additionally, ashmem introduces the concept of page pinning.
Pinned pages (the default) behave like any anonymous memory.
Unpinned pages are available to the kernel for eviction during
VM pressure. When repinning the pages, the return value
instructs user-space as to any eviction. In this manner,
user-space processes may implement caching and similar
resource management that efficiently integrates with kernel
memory management.
Signed-off-by: Robert Love <rlove@google.com>
ashmem: Don't install fault handler for private mmaps.
Ashmem is used to create named private heaps. If this heap is backed
by a tmpfs file it will allocate two pages for every page touched.
In 2.6.27, the extra page would later be freed, but 2.6.29 does not
scan anonymous pages when running without swap so the memory is not
freed while the file is referenced. This change changes the behavior
of private ashmem mmaps to match /dev/zero instead tmpfs.
Signed-off-by: Arve Hjønnevåg <arve@android.com>
ashmem: Add common prefix to name reported in /proc/pid/maps
This makes ashmem more similar to shmem and mmap, by
not requiring the specified size to be page aligned,
instead rounding it internally as needed.
Signed-off-by: Marco Nelissen <marcone@android.com>
[jstultz: Improved commit subject and included patch description
from rlove. Also moved ashmem files to staging dir, and reworked
code to avoid touching mm/shmem.c while we're in staging.] CC: Brian Swetland <swetland@google.com> CC: Colin Cross <ccross@android.com> CC: Arve Hjønnevåg <arve@android.com> CC: Dima Zavin <dima@android.com> CC: Robert Love <rlove@google.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Mike Lockwood [Tue, 14 Oct 2008 16:50:16 +0000 (12:50 -0400)]
staging: android: switch: switch class and GPIO drivers.
This adds the Android switch driver code to the staging tree.
[Note, this code was located in drivers/switch/ in the Android kernel
releases, but as that api wasn't generally accepted, and the interface
is working toward changing to the newly proposed extcon inteface, this
driver was placed here until the extcon code is merged into mainline and
the Android userspace code is converted over to using it. - gregkh]
Signed-off-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Mike Lockwood <lockwood@android.com> Cc: MyungJoo Ham <myungjoo.ham@samsung.com> Cc: Kyungmin Park <kyungmin.park@samsung.com> Cc: Donggeun Kim <dg77.kim@samsung.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: MyungJoo Ham <myungjoo.ham@gmail.com> Cc: Linus Walleij <linus.walleij@linaro.org> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Cc: NeilBrown <neilb@suse.de> Cc: Morten CHRISTIANSEN <morten.christiansen@stericsson.com> Cc: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Rob Clark [Fri, 16 Dec 2011 17:34:34 +0000 (11:34 -0600)]
staging: drm/omap: avoid aquiring mutex in atomic context (v2)
omap_gem_roll() could be called by fbcon in atomic context or when
struct_mutext is held. Avoid aquiring mutex (deadlock), or calling
tiler_pin() (which itself is not safe for atomic context) in these
cases.
Signed-off-by: Rob Clark <rob@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Sean MacLennan [Thu, 15 Dec 2011 01:18:44 +0000 (20:18 -0500)]
staging: fix build problem with staging/rtl8192e
The rtllib and rtllib_crypt drivers are both required for a fully
functional rtllib. Make sure both are always available by having
rtllib select rtllib_crypt.
Reported-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Sean MacLennan <seanm@seanm.ca> Acked-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jonathan Cameron [Wed, 14 Dec 2011 20:49:31 +0000 (20:49 +0000)]
staging:iio: iio_trigger contains defunct owner field. Remove it.
This field moved into the trigger_ops structure a while back, but somehow
never quite got cleared up. This clears the last few drivers to set it
(nothing uses it) and gets rid of it entirely.
staging:iio:kfifo_buf: Fix potential buffer overflow in iio_read_first_n_kfifo
n is the number of bytes to read, not the number of samples. So if there is
enough data available we will write to the userspace buffer beyond its bounds.
Fix this by copying n bytes maximum. Also round n down to the next multiple of
the sample size, so we will only read complete samples. If the buffer is too
small to hold at least one sample return -EINVAL.
Also update the documentation of read_first_n to reflect the fact that 'n' is
supposed to be in bytes and not in samples.
Rob Clark [Sat, 10 Dec 2011 05:26:08 +0000 (23:26 -0600)]
staging: drm/omap: DMM based hardware scrolling console
Add support for YWRAP scrolling by shuffling pages around in DMM
instead of sw blits.
Note that fbcon only utilizes this mode if the y resolution is
divided evenly by the font height. So, for example, a 1920x1080
display using a 16 pixel tall font will not utilize this, but a
1280x1024 display would.
Signed-off-by: Rob Clark <rob@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Markus Grabner [Sat, 10 Dec 2011 01:12:32 +0000 (02:12 +0100)]
staging: line6: fixed ALSA/PCM interaction
The PCM subsystem in the Line6 driver is mainly used for PCM playback and
capture by ALSA, but also has other tasks, most notably providing a
low-latency software monitor for devices which don't support hardware
monitoring (e.g., the TonePort series). This patch makes ALSA "play nicely"
with the other components, i.e., prevents it from resetting the isochronous
USB transfer while other PCM tasks (software monitoring) are running.
Signed-off-by: Markus Grabner <grabner@icg.tugraz.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Stefan Hajnoczi [Sat, 10 Dec 2011 01:12:31 +0000 (02:12 +0100)]
staging: line6: wait for urbs in snd_line6_prepare()
The .trigger() pcm callbacks are not allowed to block and cannot wait
until urbs have completed. We need to ensure that stopping, preparing,
and then restarting a stream always works.
Currently the driver will sometimes return -EBUSY when restarting the
stream because urbs have not completed yet. This can be triggered by
jackd from userspace.
The solution is to wait on urbs in the .prepare() pcm callback since
blocking is allowed in that callback. This guarantees that all urbs are
quiesced and ready to be submitted when the start trigger callback is
invoked.
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Markus Grabner <grabner@icg.tugraz.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Stefan Hajnoczi [Sat, 10 Dec 2011 01:12:30 +0000 (02:12 +0100)]
staging: line6: eliminate useless NULL checks
The line6 driver checks struct field addresses for NULL where it does
not make sense to do so. The struct has already been checked for NULL
and there is no value in checking the first field's address too.
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Markus Grabner <grabner@icg.tugraz.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Playback urbs use the index_out counter to decide which part of the
playback buffer to use. Since the urb already has a unique index in
range [0, LINE6_ISO_BUFFERS) there is no need to keep a separate
counter.
Use the urb index instead. This also eliminates the possibility of two
urbs using the same playback buffer space if they ever complete
out-of-order for some reason.
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Markus Grabner <grabner@icg.tugraz.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
However, we're lucky that LINE6_ISO_PACKETS is currently defined as 1 so
this patch does not change any behavior. It's still worth including
this fix in case the LINE6_ISO_PACKETS value is changed in the future.
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Markus Grabner <grabner@icg.tugraz.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Haiyang Zhang [Fri, 2 Dec 2011 19:56:25 +0000 (11:56 -0800)]
net/hyperv: Fix the stop/wake queue mechanism
The ring buffer is only used to pass meta data for outbound packets. The
actual payload is accessed by DMA from the host. So the stop/wake queue
mechanism based on counting and comparing number of pages sent v.s. number
of pages in the ring buffer is wrong. Also, there is a race condition in
the stop/wake queue calls, which can stop xmit queue forever.
The new stop/wake queue mechanism is based on the actual bytes used by
outbound packets in the ring buffer. The check for number of outstanding
sends after stop queue prevents the race condition that can cause wake
queue happening earlier than stop queue.
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Reported-by: Long Li <longli@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Linus Torvalds [Fri, 9 Dec 2011 22:45:44 +0000 (14:45 -0800)]
Merge git://git.samba.org/sfrench/cifs-2.6
* git://git.samba.org/sfrench/cifs-2.6:
cifs: check for NULL last_entry before calling cifs_save_resume_key
cifs: attempt to freeze while looping on a receive attempt
cifs: Fix sparse warning when calling cifs_strtoUCS
CIFS: Add descriptions to the brlock cache functions
Linus Torvalds [Fri, 9 Dec 2011 22:45:12 +0000 (14:45 -0800)]
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86, efi: Calling __pa() with an ioremap()ed address is invalid
x86, hpet: Immediately disable HPET timer 1 if rtc irq is masked
x86/intel_mid: Kconfig select fix
x86/intel_mid: Fix the Kconfig for MID selection
Linus Torvalds [Fri, 9 Dec 2011 22:41:50 +0000 (14:41 -0800)]
Merge branch 'spi/for-3.2' of git://git.pengutronix.de/git/wsa/linux-2.6
* 'spi/for-3.2' of git://git.pengutronix.de/git/wsa/linux-2.6:
spi/gpio: fix section mismatch warning
spi/fsl-espi: disable CONFIG_SPI_FSL_ESPI=m build
spi/nuc900: Include linux/module.h
spi/ath79: fix compile error due to missing include
Linus Torvalds [Fri, 9 Dec 2011 16:18:08 +0000 (08:18 -0800)]
Merge branch 'for-linus' of git://neil.brown.name/md
* 'for-linus' of git://neil.brown.name/md:
md: raid5 crash during degradation
md/raid5: never wait for bad-block acks on failed device.
md: ensure new badblocks are handled promptly.
md: bad blocks shouldn't cause a Blocked status on a Faulty device.
md: take a reference to mddev during sysfs access.
md: refine interpretation of "hold_active == UNTIL_IOCTL".
md/lock: ensure updates to page_attrs are properly locked.
* git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
arch/tile: use new generic {enable,disable}_percpu_irq() routines
drivers/net/ethernet/tile: use skb_frag_page() API
asm-generic/unistd.h: support new process_vm_{readv,write} syscalls
arch/tile: fix double-free bug in homecache_free_pages()
arch/tile: add a few #includes and an EXPORT to catch up with kernel changes.
Linus Torvalds [Fri, 9 Dec 2011 16:07:42 +0000 (08:07 -0800)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda/realtek - Fix lost speaker volume controls
ALSA: hda/realtek - Create "Bass Speaker" for two speaker pins
ALSA: hda/realtek - Don't create extra controls with channel suffix
ALSA: hda - Fix remaining VREF mute-LED NID check in post-3.1 changes
ALSA: hda - Fix GPIO LED setup for IDT 92HD75 codecs
ASoC: Provide a more complete DMA driver stub
ASoC: Remove references to corgi and spitz from machine driver document
ASoC: Make SND_SOC_MX27VIS_AIC32X4 depend on I2C
ASoC: Fix dependency for SND_SOC_RAUMFELD and SND_PXA2XX_SOC_HX4700
ASoC: uda1380: Return proper error in uda1380_modinit failure path
ASoC: kirkwood: Make SND_KIRKWOOD_SOC_OPENRD and SND_KIRKWOOD_SOC_T5325 depend on I2C
ASoC: Mark WM8994 ADC muxes as virtual
ALSA: hda/realtek - Fix Oops in alc_mux_select()
ALSA: sis7019 - give slow codecs more time to reset
Linus Torvalds [Fri, 9 Dec 2011 16:07:24 +0000 (08:07 -0800)]
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Do no try to schedule task events if there are none
lockdep, kmemcheck: Annotate ->lock in lockdep_init_map()
perf header: Use event_name() to get an event name
perf stat: Failure with "Operation not supported"
Modify initialization of PCIe capability registers in Tsi721 mport driver:
- change Completion Timeout value to avoid unexpected data transfer
aborts during intensive traffic.
- replace hardcoded offset of PCIe capability block by making it use the
common function.
This patch is applicable to kernel versions starting from 3.2-rc1.
Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug fix for Tsi721 RapidIO mport driver: Tsi721 supports four RapidIO
mailboxes (MBOX0 - MBOX3) as defined by RapidIO specification. Mailbox
resources has to be properly reported to allow use of all available
mailboxes (initial version reports only MBOX0).
This patch is applicable to kernel versions staring from 3.2-rc1.
Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com> Cc: Matt Porter <mporter@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>