linux-toradex.git/drivers/staging, branch v3.10.14

iio: mxs-lradc: Remove useless check in read_raw

2013-09-27T00:18:05+00:00

commit 2a961d0995cdadbfba565b28beada59c5ae7ebae upstream.

The removed check in the read_raw implementation was always true,
therefore remove it. This also fixes a bug, by closely inspecting
the code, one can notice the iio_validate_scan_mask_onehot() will
always return 1 and therefore the subsequent condition will always
succeed, therefore making the mxs_lradc_read_raw() function always
return -EINVAL; .

Signed-off-by: Marek Vasut 
Tested-by: Otavio Salvador 
Acked-by: Hector Palacios 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

iio: mxs-lradc: Fix misuse of iio->trig

2013-09-27T00:18:05+00:00

commit e1b1fa66a0398f0b52ae79a2bdc7de87c205d074 upstream.

The struct iio_dev .trig field is to be used only by the IIO core,
the driver shall not fill this field. This fixes ugly crash when
the driver is compiled as a module and the module is rmmod'd.

Signed-off-by: Marek Vasut 
Cc: Fabio Estevam 
Cc: Jonathan Cameron 
Cc: Shawn Guo 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: dt282x: dt282x_ai_insn_read() always fails

2013-09-27T00:18:05+00:00

commit 2c4283ca7cdcc6605859c836fc536fcd83a4525f upstream.

In dt282x_ai_insn_read() we call this macro like:
wait_for(!mux_busy(), comedi_error(dev, "timeout\n"); return -ETIME;);
Because the if statement doesn't have curly braces it means we always
return -ETIME and the function never succeeds.

Signed-off-by: Dan Carpenter 
Acked-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

imx-drm: imx-drm-core: Export imx_drm_encoder_get_mux_id

2013-09-08T05:10:00+00:00

commit ea8d15832016b0d07a8121159904e6b1d21b5b8b upstream.

When building imx_v6_v7_defconfig with imx-drm drivers selected as modules, we
get the following build error:

ERROR: "imx_drm_encoder_get_mux_id" [drivers/staging/imx-drm/imx-ldb.ko] undefined!

Export the required function to avoid this problem.

Signed-off-by: Fabio Estevam 
Acked-by: Sascha Hauer 
Acked-by: Philipp Zabel 
Cc: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: bug-fix NULL pointer dereference on failed attach

2013-08-29T16:47:36+00:00

commit 3955dfa8216f712bc204a5ad2f4e51efff252fde upstream.

Commit dcd7b8bd63cb81c5b973bf86510ca3c80bbbd162 ("staging: comedi: put
module _after_ detach" by myself) reversed a couple of calls in
`comedi_device_attach()` when recovering from an error returned by the
low-level driver's 'attach' handler.  Unfortunately, that introduced a
NULL pointer dereference bug as `dev->driver` is NULL after the call to
`comedi_device_detach()`.   We still have a pointer to the low-level
comedi driver structure in the `driv` variable, so use that instead.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

zram: allow request end to coincide with disksize

2013-08-15T05:59:09+00:00

commit 75c7caf5a052ffd8db3312fa7864ee2d142890c4 upstream.

Pass valid_io_request() checks if request end coincides with disksize
(end equals bound), only fail if we attempt to read beyond the bound.

mkfs.ext2 produces numerous errors:
[ 2164.632747] quiet_error: 1 callbacks suppressed
[ 2164.633260] Buffer I/O error on device zram0, logical block 153599
[ 2164.633265] lost page write due to I/O error on zram0

Signed-off-by: Sergey Senozhatsky 
Cc: Thomas Backlund 
Cc: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

staging: zcache: fix "zcache=" kernel parameter

2013-08-15T05:59:06+00:00

commit 02073798a6b081bf74e6c10d6f7e7a693c067ecd upstream.

Commit 835f2f5 ("staging: zcache: enable zcache to be built/loaded as
a module") introduced an incorrect handling of "zcache=" parameter.

Inside zcache_comp_init() function, zcache_comp_name variable is
checked for being empty. If not empty, the above variable is tested
for being compatible with Crypto API. Unfortunately, after that
function ends unconditionally (by the "goto out" directive) and returns:
- non-zero value if verification succeeded, wrongly indicating an error
- zero value if verification failed, falsely informing that function
  zcache_comp_init() ended properly.

A solution to this problem is as following:
1. Move the "goto out" directive inside the "if (!ret)" statement
2. In case that crypto_has_comp() returned 0, change the value of ret
   to non-zero before "goto out" to indicate an error.

This patch replaces an earlier one from Michal Hocko (based on report
from Cristian Rodriguez):

	http://permalink.gmane.org/gmane.linux.kernel.mm/102484

It also addressed the same issue but didn't fix the zcache_comp_init()
for case when the compressor data passed to "zcache=" option was invalid
or unsupported.

Signed-off-by: Piotr Sarna 
[bzolnier: updated patch description]
Acked-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Kyungmin Park 
Acked-by: Konrad Rzeszutek Wilk 
Acked-by: Michal Hocko 
Cc: Cristian Rodriguez 
Cc: Bob Liu 
Signed-off-by: Greg Kroah-Hartman

zram: protect sysfs handler from invalid memory access

2013-08-12T01:35:24+00:00

commit 5863e10b441e7ea4b492f930f1be180a97d026f3 upstream.

Use zram->init_lock to protect access to zram->meta, otherwise it
may cause invalid memory access if zram->meta has been freed by
zram_reset_device().

This issue may be triggered by:
Thread 1:
while true; do cat mem_used_total; done
Thread 2:
while true; do echo 8M > disksize; echo 1 > reset; done

Signed-off-by: Jiang Liu 
Acked-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

zram: avoid access beyond the zram device

2013-08-12T01:35:24+00:00

commit 12a7ad3b810e77137d0caf97a6dd97591e075b30 upstream.

Function valid_io_request() should verify the entire request are within
the zram device address range. Otherwise it may cause invalid memory
access when accessing/modifying zram->meta->table[index] because the
'index' is out of range. Then it may access non-exist memory, randomly
modify memory belong to other subsystems, which is hard to track down.

Signed-off-by: Jiang Liu 
Signed-off-by: Greg Kroah-Hartman

zram: avoid double free in function zram_bvec_write()

2013-08-12T01:35:23+00:00

commit 65c484609a3b25c35e4edcd5f2c38f98f5226093 upstream.

When doing a patial write and the whole page is filled with zero,
zram_bvec_write() will free uncmem twice.

Signed-off-by: Jiang Liu 
Acked-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman