summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-02-26mt76usb: use synchronous msg for mcu command responsesStanislaw Gruszka
Use usb_bulk_msg for reading MCU command responses. This simplify code a lot. Together with 97a3005759c ("mt76usb: allow mt76u_bulk_msg be used for reads") it also fix possible problems with rx data buffers not being aligned and contained within single page. After doing page_frag_alloc(1024) consecutive page_frag_alloc(PAGE_SIZE) will alloc PAGE_SIZE buffer at PAGE_SIZE - 1024 offset. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76usb: allow mt76u_bulk_msg be used for readsStanislaw Gruszka
Extend mt76u_bulk_msg() such it can be used for synchronous bulk reads. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26firmware: hardcode the debug message for -ENOENTJohn Zhao
When no file /path was found, the error code of -ENOENT enumerated in errno-base.h, is returned. Stating clearly that the file was not found is much more useful for debugging, So let's be explicit about that. Signed-off-by: John Zhao <yuankuiz@codeaurora.org> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26usb: chipidea: tegra: Fix missed ci_hdrc_remove_device()Dmitry Osipenko
The ChipIdea's platform device need to be unregistered on Tegra's driver module removal. Fixes: dfebb5f43a78827a ("usb: chipidea: Add support for Tegra20/30/114/124") Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Acked-by: Peter Chen <peter.chen@nxp.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26mei: bus: move hw module get/put to probe/releaseAlexander Usyskin
Fix unbalanced module reference counting during internal reset, which prevents the drivers unloading. Tracking mei_me/txe modules on mei client bus via mei_cldev_enable/disable is error prone due to possible internal reset flow, where clients are disconnected underneath. Moving reference counting to probe and release of mei bus client driver solves this issue in simplest way, as each client provides only a single connection to a client bus driver. Cc: <stable@vger.kernel.org> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: fsl-dpaa2: ethsw: Add missing netdevice checkFlorian Fainelli
port_switchdev_event() does not check that the target network device is actually backed by the ethsw driver, this could be problematic in a stacked environment case. Fixes: 44baaa43d7cc ("staging: fsl-dpaa2/ethsw: Add Freescale DPAA2 Ethernet Switch driver") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: rtl8188eu: cleanup comparsions to NULL in rtl8188eu_xmit.cMichael Straube
Use !x instead of x == NULL. Reported by checkpatch. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: rtl8188eu: add spaces around '*' in rtl8188e_cmd.cMichael Straube
Add spaces around '*' to follow kernel coding style. Reported by checkpatch. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: rtl8188eu: remove unused function declarationsMichael Straube
There are no definitions of odm_DIGbyRSSI_LPS(), ODM_PhyStatusQuery() and ODM_MacStatusQuery() in the driver code. So remove the unused declarations from the headers odm.h and odm_hwconfig.h. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: rtl8188eu: remove blank line between declarationsMichael Straube
Remove unnecessary blank line between declarations. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: rtl8188eu: cleanup declarations in rtl8188e_cmd.cMichael Straube
Replace tabs with spaces in declarations to cleanup whitespace. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: erofs: switch to ->iterate_shared()Gao Xiang
After commit 6192269444eb ("introduce a parallel variant of ->iterate()"), readdir can be done without taking exclusive inode lock of course. Signed-off-by: Gao Xiang <gaoxiang25@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: rtl8188eu: remove unnecessary parentheses in rtl8188e_cmd.cMichael Straube
Remove unnecessary parentheses reported by checkpatch. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: erofs: no need to take page lock in readdirGao Xiang
VFS will take inode_lock for readdir, therefore no need to take page lock in readdir at all just as the majority of other generic filesystems. Signed-off-by: Gao Xiang <gaoxiang25@huawei.com> Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: speakup: Note that simple_strtoul can't simply be replaced by kstrtoulSamuel Thibault
We often receive patches which erroneously try to use kstrtoul in these places. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: comedi: ni_tio: Allocate shadow regs for each counter chipIan Abbott
The "ni_tio" module contains code to allocate, destroy and operate on a `struct ni_gpct_device`, which represents a number of counters spread over one or more blocks (or "chips"). `struct ni_gpct_device` includes an array member `regs` holding shadow copies of register values. Unfortunately, this is currently shared by each block of counters so they interfere with each other. This is a problem for the "ni_660x" module, which has 8 counters spread over 2 blocks. The `regs` storage needs to be two-dimensional, indexed by block (chip) number and register number. (It does not need to be three-dimensional because the registers for individual counters are intermingled within the block.) Change the `regs` member to an array pointer that can be indexed like a two-dimensional array to access the shadow storage for each register in each block. Allocate the storage in `ni_gpct_device_construct()` and free it in `ni_gpct_device_destroy()`. (`ni_gpct_device_construct()` can determine the number of blocks from the `num_counters` and `counters_per_chip` parameters.) Add new member `num_chips` to hold the number of chips. Use that to check that `chip_index` value is in range in the same places that check the register offset is in range. Remove the `counters_per_chip` member of `struct ni_gpct_device` as it is not needed anywhere and could be easily derived from the `num_counters` and `num_chips` members if required. Thanks to GitHub user "raabej" (real name unknown) for an initial implementation of this in the out-of-tree fork of the Comedi drivers. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex held.Tetsuo Handa
ashmem_pin() is calling range_shrink() without checking whether range_alloc() succeeded. Also, doing memory allocation with ashmem_mutex held should be avoided because ashmem_shrink_scan() tries to hold it. Therefore, move memory allocation for range_alloc() to ashmem_pin_unpin() and make range_alloc() not to fail. This patch is mostly meant for backporting purpose for fuzz testing on stable/distributor kernels, for there is a plan to remove this code in near future. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: stable@vger.kernel.org Reviewed-by: Joel Fernandes <joel@joelfernandes.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: wilc1000: fix incorrent type assignmentBo YU
Fix sparse warning: drivers/staging/wilc1000/host_interface.c:450:30: warning: incorrect type in assignment (different base types) drivers/staging/wilc1000/host_interface.c:450:30: expected restricted __le16 [usertype] beacon_period drivers/staging/wilc1000/host_interface.c:450:30: got unsigned short [usertype] beacon_interval drivers/staging/wilc1000/host_interface.c:451:25: warning: incorrect type in assignment (different base types) drivers/staging/wilc1000/host_interface.c:451:25: expected restricted __le16 [usertype] cap_info drivers/staging/wilc1000/host_interface.c:451:25: got unsigned short [usertype] capability Signed-off-by: Bo YU <tsu.yubo@gmail.com> Reviewed-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: greybus: Alignment should match open parenthesisBhanusree Pola
Clean checkpatch.pl issue in various files: CHECK: Alignment should match open parenthesis Adjust parameters to match alignment with open paranthesis Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: greybus: Blank lines not required before '}'Bhanusree Pola
Remove blank line to resolve checkpatch.pl issue: CHECK: Blank lines aren't necessary before a close brace '}' Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: greybus: Do not use multiple blank linesBhanusree Pola
Remove unnecessary blank line issue found with checkpatch.pl: CHECK: Please don't use multiple blank lines Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: ks7010: Match alignments with open parenthesisBhanusree Pola
Adjust parameters of "netdev_dbg" to match alignment with open parenthesis. Issue found using checkpatch.pl Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: vt6655: Alignment should match open parenthesisMadhumitha Prabakaran
Fix the check to improve readibility. CHECK: Alignment should match open parenthesis Signed-off-by: Madhumitha Prabakaran <madhumithabiw@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: fwserial: Add blank line after declarationsBhanusree Pola
Add blank line after the structure declaration, struct fwtty_port *port = tty->driver_data; Issue found using checkpatch.pl Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: fbtft: Fix line over 80 charactersBhanusree Pola
Fix the checkpatch.pl warning: WARNING:line over 80 characters Move Parameters to the next lines with proper alignment Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: fbtft: Extra blank line not required before '}'Bhanusree Pola
Remove unnecesessary extra blank line before the closing brace, to solve the checkpatch.pl check: CHECK: Extra blank line not required before closing brace '}' Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: fbtft: Alignment should match open parenthesisBhanusree Pola
Clear the warning found by checkpatch.pl WARNING:Alignment should match open parenthesis Adjust paremeters in fbtft_par_dbg and write_reg. Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: netlogic: Remove boilerplate license textBhagyashri Dighole
Removes the boilerplate license text. Signed-off-by: Bhagyashri Dighole <digholebhagyashri@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: netlogic: Add SPDX-License-Identifier tag at the topBhagyashri Dighole
Adds the SPDX GPL-2.0 or BSD-2-clause license identifier, which solves the checkpatch.pl warnings: "WARNING: Missing or malformed SPDX-License-Identifier tag in line 1". Signed-off-by: Bhagyashri Dighole <digholebhagyashri@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26staging: netlogic: Modify coding style alignmentsBhagyashri Dighole
Fix coding style alignment issues detected by checkpatch.pl Match alignments with parenthesis. Limit lines to 80 characters. Signed-off-by: Bhagyashri Dighole <digholebhagyashri@gmail.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: mt761-dma: Alignment should match open parenthesisBhanusree Pola
Adjust "dev_dbg" parameters to match alignment with open parenthesis Issue found with checkpatch.pl Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26Staging: mt7621_dma: Prefer unsigned int over just unsignedBhanusree Pola
Replace 'unsigned' with 'unsigned int' to be specific with data type. Issue found with checkpatch.pl Signed-off-by: Bhanusree Pola <bhanusreemahesh@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26habanalabs: return error when failing to read/write i2cOded Gabbay
The driver can't read/write from i2c if the device is in reset or disabled. Therefore, return -EBUSY in those cases instead of 0. This change also fixes a smatch warning about uninitialized variable. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-26iommu/dmar: Fix buffer overflow during PCI bus notificationJulia Cartwright
Commit 57384592c433 ("iommu/vt-d: Store bus information in RMRR PCI device path") changed the type of the path data, however, the change in path type was not reflected in size calculations. Update to use the correct type and prevent a buffer overflow. This bug manifests in systems with deep PCI hierarchies, and can lead to an overflow of the static allocated buffer (dmar_pci_notify_info_buf), or can lead to overflow of slab-allocated data. BUG: KASAN: global-out-of-bounds in dmar_alloc_pci_notify_info+0x1d5/0x2e0 Write of size 1 at addr ffffffff90445d80 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.14.87-rt49-02406-gd0a0e96 #1 Call Trace: ? dump_stack+0x46/0x59 ? print_address_description+0x1df/0x290 ? dmar_alloc_pci_notify_info+0x1d5/0x2e0 ? kasan_report+0x256/0x340 ? dmar_alloc_pci_notify_info+0x1d5/0x2e0 ? e820__memblock_setup+0xb0/0xb0 ? dmar_dev_scope_init+0x424/0x48f ? __down_write_common+0x1ec/0x230 ? dmar_dev_scope_init+0x48f/0x48f ? dmar_free_unused_resources+0x109/0x109 ? cpumask_next+0x16/0x20 ? __kmem_cache_create+0x392/0x430 ? kmem_cache_create+0x135/0x2f0 ? e820__memblock_setup+0xb0/0xb0 ? intel_iommu_init+0x170/0x1848 ? _raw_spin_unlock_irqrestore+0x32/0x60 ? migrate_enable+0x27a/0x5b0 ? sched_setattr+0x20/0x20 ? migrate_disable+0x1fc/0x380 ? task_rq_lock+0x170/0x170 ? try_to_run_init_process+0x40/0x40 ? locks_remove_file+0x85/0x2f0 ? dev_prepare_static_identity_mapping+0x78/0x78 ? rt_spin_unlock+0x39/0x50 ? lockref_put_or_lock+0x2a/0x40 ? dput+0x128/0x2f0 ? __rcu_read_unlock+0x66/0x80 ? __fput+0x250/0x300 ? __rcu_read_lock+0x1b/0x30 ? mntput_no_expire+0x38/0x290 ? e820__memblock_setup+0xb0/0xb0 ? pci_iommu_init+0x25/0x63 ? pci_iommu_init+0x25/0x63 ? do_one_initcall+0x7e/0x1c0 ? initcall_blacklisted+0x120/0x120 ? kernel_init_freeable+0x27b/0x307 ? rest_init+0xd0/0xd0 ? kernel_init+0xf/0x120 ? rest_init+0xd0/0xd0 ? ret_from_fork+0x1f/0x40 The buggy address belongs to the variable: dmar_pci_notify_info_buf+0x40/0x60 Fixes: 57384592c433 ("iommu/vt-d: Store bus information in RMRR PCI device path") Signed-off-by: Julia Cartwright <julia@ni.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2019-02-26mt76: mt76x02: set MT_TXOP_HLDR_TX40M_BLK_EN for mt76x2Felix Fietkau
It needs to be always enabled for 76x2 and conditionally enabled/disabled for 76x0. Since mt76x2_mac_stop clears this bit, ensure that it is enabled in mt76x02_edcca_init Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x2: unify mt76x2[u]_mac_resumeFelix Fietkau
They are now the same and short enough to be turned into an inline function Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix ED/CCA enabling/disablingFelix Fietkau
ED/CCA needs to be disable before stopping the MAC to avoid hangs from tx being blocked. It must only be enabled again after the MAC has been started again. In many places this wasn't done properly, so fix this by always clearing the relevant ED/CCA bits in mt76x2_mac_stop and set it up again after channel change or calibration is done Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: issue watchdog reset on MCU request timeoutFelix Fietkau
MCU request timeout usually indicates that the device is no longer responsive, and it usually does not recover without a reset Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: only reset beacon drift counter when enabling beaconsFelix Fietkau
When the timer is already running, there is no need to reset the counter, because the drift will remain the same. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix beacon timer issueFelix Fietkau
When mt76x0 and mt76x2 beacon code was unified, it changed the order in which beacon enable and beacon interval are configured. Configuring beacon enable before beacon interval can in some cases cause problems with the beacon timer, leading to clients not waking up properly from powersave mode. Fix this by changing the order back to interval first, then enable. Fixes: cc726268e4dce ("mt76: move mt76x02_bss_info_changed in mt76x02-lib module") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix beacon timer drift adjustmentFelix Fietkau
Check the count before incrementing it to match vendor code behavior. This defers the adjustment by one more tick, which should improve accuracy Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix TSF sync modeFelix Fietkau
MT_BEACON_TIME_CFG_SYNC_MODE needs to be set for AP mode, according to the documentation. For other modes it should be irrelevant in this case. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26Bluetooth: hci_qca: Set HCI_QUIRK_USE_BDADDR_PROPERTY for wcn3990Matthias Kaehlcke
Set quirk for wcn3990 to read BD_ADDR from a firmware node property. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Tested-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26Bluetooth: btqcomsmd: use HCI_QUIRK_USE_BDADDR_PROPERTYMatthias Kaehlcke
Use the HCI_QUIRK_USE_BDADDR_PROPERTY quirk to let the HCI core handle the reading of 'local-bd-address'. With this there is no need to set HCI_QUIRK_INVALID_BDADDR, the case of a non-existing or invalid fwnode property is handled by the core code. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26Bluetooth: Add quirk for reading BD_ADDR from fwnode propertyMatthias Kaehlcke
Add HCI_QUIRK_USE_BDADDR_PROPERTY to allow controllers to retrieve the public Bluetooth address from the firmware node property 'local-bd-address'. If quirk is set and the property does not exist or is invalid the controller is marked as unconfigured. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Tested-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26mmc: tmio: fix access width of Block Count RegisterTakeshi Saito
In R-Car Gen2 or later, the maximum number of transfer blocks are changed from 0xFFFF to 0xFFFFFFFF. Therefore, Block Count Register should use iowrite32(). If another system (U-boot, Hypervisor OS, etc) uses bit[31:16], this value will not be cleared. So, SD/MMC card initialization fails. So, check for the bigger register and use apropriate write. Also, mark the register as extended on Gen2. Signed-off-by: Takeshi Saito <takeshi.saito.xv@renesas.com> [wsa: use max_blk_count in if(), add Gen2, update commit message] Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Cc: stable@kernel.org Reviewed-by: Simon Horman <horms+renesas@verge.net.au> [Ulf: Fixed build error] Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-02-26Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in ↵Kefeng Wang
hci_uart_set_proto() task A: task B: hci_uart_set_proto flush_to_ldisc - p->open(hu) -> h5_open //alloc h5 - receive_buf - set_bit HCI_UART_PROTO_READY - tty_port_default_receive_buf - hci_uart_register_dev - tty_ldisc_receive_buf - hci_uart_tty_receive - test_bit HCI_UART_PROTO_READY - h5_recv - clear_bit HCI_UART_PROTO_READY while() { - p->open(hu) -> h5_close //free h5 - h5_rx_3wire_hdr - h5_reset() //use-after-free } It could use ioctl to set hci uart proto, but there is a use-after-free issue when hci_uart_register_dev() fail in hci_uart_set_proto(), see stack above, fix this by setting HCI_UART_PROTO_READY bit only when hci_uart_register_dev() return success. Reported-by: syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Reviewed-by: Jeremy Cline <jcline@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26Bluetooth: mgmt: Use struct_size() helperGustavo A. R. Silva
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*rp) + (sizeof(rp->entry[0]) * count); to : struct_size(rp, entry, count) Notice that, in this case, variable rp_len is not necessary, hence it is removed. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26ALSA: firewire-motu: fix construction of PCM frame for capture directionTakashi Sakamoto
In data blocks of common isochronous packet for MOTU devices, PCM frames are multiplexed in a shape of '24 bit * 4 Audio Pack', described in IEC 61883-6. The frames are not aligned to quadlet. For capture PCM substream, ALSA firewire-motu driver constructs PCM frames by reading data blocks byte-by-byte. However this operation includes bug for lower byte of the PCM sample. This brings invalid content of the PCM samples. This commit fixes the bug. Reported-by: Peter Sjöberg <autopeter@gmail.com> Cc: <stable@vger.kernel.org> # v4.12+ Fixes: 4641c9394010 ("ALSA: firewire-motu: add MOTU specific protocol layer") Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-26ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against ↵Takashi Sakamoto
Liquid Saffire 56 ALSA bebob driver has an entry for Focusrite Saffire Pro 10 I/O. The entry matches vendor_id in root directory and model_id in unit directory of configuration ROM for IEEE 1394 bus. On the other hand, configuration ROM of Focusrite Liquid Saffire 56 has the same vendor_id and model_id. This device is an application of TCAT Dice (TCD2220 a.k.a Dice Jr.) however ALSA bebob driver can be bound to it randomly instead of ALSA dice driver. At present, drivers in ALSA firewire stack can not handle this situation appropriately. This commit uses more identical mod_alias for Focusrite Saffire Pro 10 I/O in ALSA bebob driver. $ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom ROM header and bus information block ----------------------------------------------------------------- 400 042a829d bus_info_length 4, crc_length 42, crc 33437 404 31333934 bus_name "1394" 408 f0649222 irmc 1, cmc 1, isc 1, bmc 1, pmc 0, cyc_clk_acc 100, max_rec 9 (1024), max_rom 2, gen 2, spd 2 (S400) 40c 00130e01 company_id 00130e | 410 000606e0 device_id 01000606e0 | EUI-64 00130e01000606e0 root directory ----------------------------------------------------------------- 414 0009d31c directory_length 9, crc 54044 418 04000014 hardware version 41c 0c0083c0 node capabilities per IEEE 1394 420 0300130e vendor 424 81000012 --> descriptor leaf at 46c 428 17000006 model 42c 81000016 --> descriptor leaf at 484 430 130120c2 version 434 d1000002 --> unit directory at 43c 438 d4000006 --> dependent info directory at 450 unit directory at 43c ----------------------------------------------------------------- 43c 0004707c directory_length 4, crc 28796 440 1200a02d specifier id: 1394 TA 444 13010001 version: AV/C 448 17000006 model 44c 81000013 --> descriptor leaf at 498 dependent info directory at 450 ----------------------------------------------------------------- 450 000637c7 directory_length 6, crc 14279 454 120007f5 specifier id 458 13000001 version 45c 3affffc7 (immediate value) 460 3b100000 (immediate value) 464 3cffffc7 (immediate value) 468 3d600000 (immediate value) descriptor leaf at 46c ----------------------------------------------------------------- 46c 00056f3b leaf_length 5, crc 28475 470 00000000 textual descriptor 474 00000000 minimal ASCII 478 466f6375 "Focu" 47c 73726974 "srit" 480 65000000 "e" descriptor leaf at 484 ----------------------------------------------------------------- 484 0004a165 leaf_length 4, crc 41317 488 00000000 textual descriptor 48c 00000000 minimal ASCII 490 50726f31 "Pro1" 494 30494f00 "0IO" descriptor leaf at 498 ----------------------------------------------------------------- 498 0004a165 leaf_length 4, crc 41317 49c 00000000 textual descriptor 4a0 00000000 minimal ASCII 4a4 50726f31 "Pro1" 4a8 30494f00 "0IO" $ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom ROM header and bus information block ----------------------------------------------------------------- 400 040442e4 bus_info_length 4, crc_length 4, crc 17124 404 31333934 bus_name "1394" 408 e0ff8112 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 255, max_rec 8 (512), max_rom 1, gen 1, spd 2 (S400) 40c 00130e04 company_id 00130e | 410 018001e9 device_id 04018001e9 | EUI-64 00130e04018001e9 root directory ----------------------------------------------------------------- 414 00065612 directory_length 6, crc 22034 418 0300130e vendor 41c 8100000a --> descriptor leaf at 444 420 17000006 model 424 8100000e --> descriptor leaf at 45c 428 0c0087c0 node capabilities per IEEE 1394 42c d1000001 --> unit directory at 430 unit directory at 430 ----------------------------------------------------------------- 430 000418a0 directory_length 4, crc 6304 434 1200130e specifier id 438 13000001 version 43c 17000006 model 440 8100000f --> descriptor leaf at 47c descriptor leaf at 444 ----------------------------------------------------------------- 444 00056f3b leaf_length 5, crc 28475 448 00000000 textual descriptor 44c 00000000 minimal ASCII 450 466f6375 "Focu" 454 73726974 "srit" 458 65000000 "e" descriptor leaf at 45c ----------------------------------------------------------------- 45c 000762c6 leaf_length 7, crc 25286 460 00000000 textual descriptor 464 00000000 minimal ASCII 468 4c495155 "LIQU" 46c 49445f53 "ID_S" 470 41464649 "AFFI" 474 52455f35 "RE_5" 478 36000000 "6" descriptor leaf at 47c ----------------------------------------------------------------- 47c 000762c6 leaf_length 7, crc 25286 480 00000000 textual descriptor 484 00000000 minimal ASCII 488 4c495155 "LIQU" 48c 49445f53 "ID_S" 490 41464649 "AFFI" 494 52455f35 "RE_5" 498 36000000 "6" Cc: <stable@vger.kernel.org> # v3.16+ Fixes: 25784ec2d034 ("ALSA: bebob: Add support for Focusrite Saffire/SaffirePro series") Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>