linux-toradex.git/drivers/char, branch v3.14.16

i8k: Fix non-SMP operation

2014-07-17T23:21:03+00:00

commit 6d827fbcc370ca259a2905309f64161ab7b10596 upstream.

Commit f36fdb9f0266 (i8k: Force SMM to run on CPU 0) adds support
for multi-core CPUs to the driver. Unfortunately, that causes it
to fail loading if compiled without SMP support, at least on
32 bit kernels. Kernel log shows "i8k: unable to get SMM Dell
signature", and function i8k_smm is found to return -EINVAL.

Testing revealed that the culprit is the missing return value check
of set_cpus_allowed_ptr.

Fixes: f36fdb9f0266 (i8k: Force SMM to run on CPU 0)
Reported-by: Jim Bos 
Tested-by: Jim Bos 
Signed-off-by: Guenter Roeck 
Cc: Andreas Mohr 
Signed-off-by: Greg Kroah-Hartman

applicom: dereferencing NULL on error path

2014-07-01T03:11:52+00:00

commit 8bab797c6e5724a43b7666ad70860712365cdb71 upstream.

This is a static checker fix.  The "dev" variable is always NULL after
the while statement so we would be dereferencing a NULL pointer here.

Fixes: 819a3eba4233 ('[PATCH] applicom: fix error handling')
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

ACPI / TPM: Fix resume regression on Chromebooks

2014-06-07T17:28:27+00:00

commit f759546498d820670934c901a2fdf1ce948d2e5c upstream.

Chromebooks (at least Acer C720 and Pixel) implement an ACPI object
for TPM, but don't implement the _DSM method to support PPI.  As
a result, the TPM driver fails to load on those machines after
commit 1569a4c4ceba (ACPI / TPM: detect PPI features by checking
availability of _DSM functions) which causes them to fail to
resume from system suspend, becuase they require the TPM hardware
to be put into the right state during resume and the TPM driver
is necessary for that.

Fix the problem by making tpm_add_ppi() return 0 when tpm_ppi_handle
is still NULL after walking the ACPI namespace in search for the PPI
_DSM, which allows the TPM driver to load and operate the hardware
(during system resume in particular), but avoid creating the PPI
sysfs group in that case.

This change is based on a prototype patch from Jiang Liu.

Fixes: 1569a4c4ceba (ACPI / TPM: detect PPI features by checking availability of _DSM functions)
References: https://bugzilla.kernel.org/show_bug.cgi?id=74021
Reported-by: James Duley 
Reported-by: Phillip Dixon 
Tested-by: Brandon Casey 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Greg Kroah-Hartman

ipmi: Reset the KCS timeout when starting error recovery

2014-06-07T17:28:10+00:00

commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.

The OBF timer in KCS was not reset in one situation when error recovery
was started, resulting in an immediate timeout.

Reported-by: Bodo Stroesser 
Signed-off-by: Corey Minyard 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

ipmi: Fix a race restarting the timer

2014-06-07T17:28:09+00:00

commit 48e8ac2979920ffa39117e2d725afa3a749bfe8d upstream.

With recent changes it is possible for the timer handler to detect an
idle interface and not start the timer, but the thread to start an
operation at the same time.  The thread will not start the timer in that
instance, resulting in the timer not running.

Instead, move all timer operations under the lock and start the timer in
the thread if it detect non-idle and the timer is not already running.
Moving under locks allows the last timeout to be set in both the thread
and the timer.  'Timer is not running' means that the timer is not
pending and smi_timeout() is not running.  So we need a flag to detect
this correctly.

Also fix a few other timeout bugs: setting the last timeout when the
interrupt has to be disabled and the timer started, and setting the last
timeout in check_start_timer_thread possibly racing with the timer

Signed-off-by: Corey Minyard 
Signed-off-by: Bodo Stroesser 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Char: ipmi_bt_sm, fix infinite loop

2014-04-27T00:19:02+00:00

commit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.

In read_all_bytes, we do

  unsigned char i;
  ...
  bt->read_data[0] = BMC2HOST;
  bt->read_count = bt->read_data[0];
  ...
  for (i = 1; i <= bt->read_count; i++)
    bt->read_data[i] = BMC2HOST;

If bt->read_data[0] == bt->read_count == 255, we loop infinitely in the
'for' loop.  Make 'i' an 'int' instead of 'char' to get rid of the
overflow and finish the loop after 255 iterations every time.

Signed-off-by: Jiri Slaby 
Reported-and-debugged-by: Rui Hui Dian 
Cc: Tomas Cech 
Cc: Corey Minyard 
Cc: 
Signed-off-by: Corey Minyard 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-3.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2014-02-15T00:13:00+00:00

Pull char/misc fixes from Greg KH:
 "Here are some small char/misc driver fixes, along with some
  documentation updates, for 3.14-rc3.  Nothing major, just a number of
  fixes for reported issues"

* tag 'char-misc-3.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  Revert "misc: eeprom: sunxi: Add new compatibles"
  Revert "ARM: sunxi: dt: Convert to the new SID compatibles"
  misc: mic: fix possible signed underflow (undefined behavior) in userspace API
  ARM: sunxi: dt: Convert to the new SID compatibles
  misc: eeprom: sunxi: Add new compatibles
  misc: genwqe: Fix potential memory leak when pinning memory
  Documentation:Update Documentation/zh_CN/arm64/memory.txt
  Documentation:Update Documentation/zh_CN/arm64/booting.txt
  Documentation:Chinese translation of Documentation/arm64/tagged-pointers.txt
  raw: set range for MAX_RAW_DEVS
  raw: test against runtime value of max_raw_minors
  Drivers: hv: vmbus: Don't timeout during the initial connection with host
  Drivers: hv: vmbus: Specify the target CPU that should receive notification
  VME: Correct read/write alignment algorithm
  mei: don't unset read cb ptr on reset
  mei: clear write cb from waiting list on reset

fix a kmap leak in virtio_console

2014-02-09T20:21:16+00:00

While we are at it, don't do kmap() under kmap_atomic(), *especially*
for a page we'd allocated with GFP_KERNEL.  It's spelled "page_address",
and had that been more than that, we'd have a real trouble - kmap_high()
can block, and doing that while holding kmap_atomic() is a Bad Idea(tm).

Signed-off-by: Al Viro

raw: set range for MAX_RAW_DEVS

2014-02-07T16:29:46+00:00

The Kconfig symbol MAX_RAW_DEVS is meant to be between 1 and 65536. But
those boundaries are not enforced by its Kconfig entry.

Note that MAX_RAW_DEVS is used to set MAX_RAW_MINORS in
drivers/char/raw.c. If one would accidentally set MAX_RAW_DEVS to an
invalid value, that invalid value will actually end up being used in
raw_init().

So add an appropriate range to this Kconfig entry.

Signed-off-by: Paul Bolle 
Signed-off-by: Greg Kroah-Hartman

raw: test against runtime value of max_raw_minors

2014-02-07T16:29:46+00:00

bind_get() checks the device number it is called with. It uses
MAX_RAW_MINORS for the upper bound. But MAX_RAW_MINORS is set at compile
time while the actual number of raw devices can be set at runtime. This
means the test can either be too strict or too lenient. And if the test
ends up being too lenient bind_get() might try to access memory beyond
what was allocated for "raw_devices".

So check against the runtime value (max_raw_minors) in this function.

Signed-off-by: Paul Bolle 
Acked-by: Jan Kara 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman