linux-toradex.git/drivers/staging, branch v3.2.55

staging: comedi: cb_pcidio: fix for newer PCI-DIO48H

2014-02-15T19:20:11+00:00

commit 0283f7a100882684ad32b768f9f1ad81658a0b92 upstream.

At some point, Measurement Computing / ComputerBoards redesigned the
PCI-DIO48H to use a PLX PCI interface chip instead of an AMCC chip.
This meant they had to put their hardware registers in the PCI BAR 2
region instead of PCI BAR 1.  Unfortunately, they kept the same PCI
device ID for the new design.  This means the driver recognizes the
newer cards, but doesn't work (and is likely to screw up the local
configuration registers of the PLX chip) because it's using the wrong
region.

Since all the supported boards have the DIO registers in the PCI BAR 2
region except for older PCI-DIO48H boards which have an empty PCI BAR 2
region and the DIO registers in PCI BAR 1, determine which PCI BAR
region to use based on whether the PCI BAR 2 region is empty or not.

This change makes the `dioregs_badrindex` member of `struct
pcidio_board` redundant.  The `pcicontroler_badrindex` member is also
unused, so remove both members.

Signed-off-by: Ian Abbott 
Cc: kernel-team@lists.ubuntu.com
Signed-off-by: Ben Hutchings

Staging: tidspbridge: disable driver

2014-01-03T04:33:26+00:00

commit 930ba4a374b96560ef9fde2145cdc454a164ddcc upstream.

There seems to be no active maintainer for the driver, and there is an
unfixed security bug, so disable the driver for now.

Hopefully someone steps up to be the maintainer, and works to get this
out of staging, otherwise it will be deleted soon.

Reported-by: Nico Golde 
Reported-by: Dan Carpenter 
Cc: Omar Ramirez Luna 
Cc: Omar Ramirez Luna 
Cc: Kanigeri, Hari 
Cc: Ameya Palande 
Cc: Guzman Lugo, Fernando 
Cc: Hebbar, Shivananda 
Cc: Ramos Falcon, Ernesto 
Cc: Felipe Contreras 
Cc: Anna, Suman 
Cc: Gupta, Ramesh 
Cc: Gomez Castellanos, Ivan 
Cc: Andy Shevchenko 
Cc: Armando Uribe De Leon 
Cc: Deepak Chitriki 
Cc: Menon, Nishanth 
Cc: Phil Carmody 
Cc: Ohad Ben-Cohen 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context; no dependency on !ARCH_MULTIPLATFORM]
Signed-off-by: Ben Hutchings

Staging: zram: Fix memory leak by refcount mismatch

2014-01-03T04:33:25+00:00

commit 1b672224d128ec2570eb37572ff803cfe452b4f7 upstream.

As suggested by Minchan Kim and Jerome Marchand "The code in reset_store
get the block device (bdget_disk()) but it does not put it (bdput()) when
it's done using it. The usage count is therefore incremented but never
decremented."

This patch also puts bdput() for all error cases.

Acked-by: Minchan Kim 
Acked-by: Jerome Marchand 
Signed-off-by: Rashika Kheria 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

Staging: zram: Fix access of NULL pointer

2014-01-03T04:33:25+00:00

commit 46a51c80216cb891f271ad021f59009f34677499 upstream.

This patch fixes the bug in reset_store caused by accessing NULL pointer.

The bdev gets its value from bdget_disk() which could fail when memory
pressure is severe and hence can return NULL because allocation of
inode in bdget could fail.

Hence, this patch introduces a check for bdev to prevent reference to a
NULL pointer in the later part of the code. It also removes unnecessary
check of bdev for fsync_bdev().

Acked-by: Jerome Marchand 
Signed-off-by: Rashika Kheria 
Acked-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

Staging: bcm: info leak in ioctl

2013-11-28T14:02:06+00:00

commit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream.

The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
information to user space.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings

staging: wlags49_h2: buffer overflow setting station name

2013-11-28T14:02:06+00:00

commit b5e2f339865fb443107e5b10603e53bbc92dc054 upstream.

We need to check the length parameter before doing the memcpy().  I've
actually changed it to strlcpy() as well so that it's NUL terminated.

You need CAP_NET_ADMIN to trigger these so it's not the end of the
world.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

zram: allow request end to coincide with disksize

2013-11-28T14:01:59+00:00

commit 75c7caf5a052ffd8db3312fa7864ee2d142890c4 upstream.

Pass valid_io_request() checks if request end coincides with disksize
(end equals bound), only fail if we attempt to read beyond the bound.

mkfs.ext2 produces numerous errors:
[ 2164.632747] quiet_error: 1 callbacks suppressed
[ 2164.633260] Buffer I/O error on device zram0, logical block 153599
[ 2164.633265] lost page write due to I/O error on zram0

Signed-off-by: Sergey Senozhatsky 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdevice

2013-10-26T20:06:13+00:00

commit 677a31565692d596ef42ea589b53ba289abf4713 upstream.

The `insn_bits` handler `ni_65xx_dio_insn_bits()` has a `for` loop that
currently writes (optionally) and reads back up to 5 "ports" consisting
of 8 channels each.  It reads up to 32 1-bit channels but can only read
and write a whole port at once - it needs to handle up to 5 ports as the
first channel it reads might not be aligned on a port boundary.  It
breaks out of the loop early if the next port it handles is beyond the
final port on the card.  It also breaks out early on the 5th port in the
loop if the first channel was aligned.  Unfortunately, it doesn't check
that the current port it is dealing with belongs to the comedi subdevice
the `insn_bits` handler is acting on.  That's a bug.

Redo the `for` loop to terminate after the final port belonging to the
subdevice, changing the loop variable in the process to simplify things
a bit.  The `for` loop could now try and handle more than 5 ports if the
subdevice has more than 40 channels, but the test `if (bitshift >= 32)`
ensures it will break out early after 4 or 5 ports (depending on whether
the first channel is aligned on a port boundary).  (`bitshift` will be
between -7 and 7 inclusive on the first iteration, increasing by 8 for
each subsequent operation.)

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
[Ian Abbott: This patch applies to kernels 2.6.34.y through to 3.5.y
 inclusive.]
Signed-off-by: Ben Hutchings

Revert "zram: use zram->lock to protect zram_free_page() in swap free notify path"

2013-10-26T20:06:11+00:00

This reverts commit 9e443904906ca2b5b3ae71f34ac4a4fa6905623e, which
was commit 57ab048532c0d975538cebd4456491b5c34248f4 upstream.

Taking the semaphore here leads to sleeping in atomic context.  This
was fixed in mainline commit a0c516cbfc74 ("zram: don't grab mutex in
zram_slot_free_noity") but that is too difficult to backport.

Signed-off-by: Ben Hutchings

staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.

2013-10-26T20:06:06+00:00

commit e3eb270fab7734427dd8171a93e4946fe28674bc upstream.

The vt6656 is prone to resetting on the usb bus.

It seems there is a race condition and wpa supplicant is
trying to open the device via iw_handlers before its actually
closed at a stage that the buffers are being removed.

The device is longer considered open when the
buffers are being removed. So move ~DEVICE_FLAGS_OPENED
flag to before freeing the device buffers.

Signed-off-by: Malcolm Priestley 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings