summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-03-12can: m_can: change comparison to bitshift when dealing with a maskWolfram Sang
Due to a typo, the mask was destroyed by a comparison instead of a bit shift. Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2018-03-11openvswitch: meter: fix the incorrect calculation of max delta_tzhangliping
Max delat_t should be the full_bucket/rate instead of the full_bucket. Also report EINVAL if the rate is zero. Fixes: 96fbc13d7e77 ("openvswitch: Add meter infrastructure") Cc: Andy Zhou <azhou@ovn.org> Signed-off-by: zhangliping <zhangliping02@baidu.com> Acked-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-11macvlan: filter out unsupported feature flagsShannon Nelson
Adding a macvlan device on top of a lowerdev that supports the xfrm offloads fails with a new regression: # ip link add link ens1f0 mv0 type macvlan RTNETLINK answers: Operation not permitted Tracing down the failure shows that the macvlan device inherits the NETIF_F_HW_ESP and NETIF_F_HW_ESP_TX_CSUM feature flags from the lowerdev, but with no dev->xfrmdev_ops API filled in, it doesn't actually support xfrm. When the request is made to add the new macvlan device, the XFRM listener for NETDEV_REGISTER calls xfrm_api_check() which fails the new registration because dev->xfrmdev_ops is NULL. The macvlan creation succeeds when we filter out the ESP feature flags in macvlan_fix_features(), so let's filter them out like we're already filtering out ~NETIF_F_NETNS_LOCAL. When XFRM support is added in the future, we can add the flags into MACVLAN_FEATURES. This same problem could crop up in the future with any other new feature flags, so let's filter out any flags that aren't defined as supported in macvlan. Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Reported-by: Alexey Kodanev <alexey.kodanev@oracle.com> Signed-off-by: Shannon Nelson <shannon.nelson@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-11clk: update cached phase to respect the fact when setting phaseShawn Lin
It's found that the final phase set by driver doesn't match that of the output from clk_summary: dwmmc_rockchip fe310000.dwmmc: Successfully tuned phase to 346 mmc0: new ultra high speed SDR104 SDIO card at address 0001 cat /sys/kernel/debug/clk/clk_summary | grep sdio_sample sdio_sample 0 1 0 50000000 0 0 It seems the cached core->phase isn't updated after the clk was registered. So fix this issue by updating the core->phase if setting phase successfully. Fixes: 9e4d04adeb1a ("clk: add clk_core_set_phase_nolock function") Cc: Stable <stable@vger.kernel.org> Cc: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Jerome Brunet <jbrunet@baylibre.com> Tested-by: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Michael Turquette <mturquette@baylibre.com>
2018-03-11Linux 4.16-rc5v4.16-rc5Linus Torvalds
2018-03-11Merge branch 'x86-pti-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86/pti updates from Thomas Gleixner: "Yet another pile of melted spectrum related updates: - Drop native vsyscall support finally as it causes more trouble than benefit. - Make microcode loading more robust. There were a few issues especially related to late loading which are now surfacing because late loading of the IB* microcodes addressing spectre issues has become more widely used. - Simplify and robustify the syscall handling in the entry code - Prevent kprobes on the entry trampoline code which lead to kernel crashes when the probe hits before CR3 is updated - Don't check microcode versions when running on hypervisors as they are considered as lying anyway. - Fix the 32bit objtool build and a coment typo" * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kprobes: Fix kernel crash when probing .entry_trampoline code x86/pti: Fix a comment typo x86/microcode: Synchronize late microcode loading x86/microcode: Request microcode on the BSP x86/microcode/intel: Look into the patch cache first x86/microcode: Do not upload microcode if CPUs are offline x86/microcode/intel: Writeback and invalidate caches before updating microcode x86/microcode/intel: Check microcode revision before updating sibling threads x86/microcode: Get rid of struct apply_microcode_ctx x86/spectre_v2: Don't check microcode versions when running under hypervisors x86/vsyscall/64: Drop "native" vsyscalls x86/entry/64/compat: Save one instruction in entry_INT80_compat() x86/entry: Do not special-case clone(2) in compat entry x86/syscalls: Use COMPAT_SYSCALL_DEFINEx() macros for x86-only compat syscalls x86/syscalls: Use proper syscall definition for sys_ioperm() x86/entry: Remove stale syscall prototype x86/syscalls/32: Simplify $entry == $compat entries objtool: Fix 32-bit build
2018-03-11Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "Just a single fix which adds a missing Kconfig dependency to avoid unmet dependency warnings" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/atmel-st: Add 'depends on HAS_IOMEM' to fix unmet dependency
2018-03-11Merge branch 'ras-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fixes from Thomas Gleixner: "Two small fixes for RAS/MCE: - Serialize sysfs changes to avoid concurrent modificaiton of underlying data - Add microcode revision to Machine Check records. This should have been there forever, but now with the broken microcode versions in the wild it has become important" * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/MCE: Serialize sysfs changes x86/MCE: Save microcode revision in machine check records
2018-03-11Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Thomas Gleixner: "Another set of perf updates: - Fix a Skylake Uncore event format declaration - Prevent perf pipe mode from crahsing which was caused by a missing buffer allocation - Make the perf top popup message which tells the user that it uses fallback mode on older kernels a debug message. - Make perf context rescheduling work correcctly - Robustify the jump error drawing in perf browser mode so it does not try to create references to NULL initialized offset entries - Make trigger_on() robust so it does not enable the trigger before everything is set up correctly to handle it - Make perf auxtrace respect the --no-itrace option so it does not try to queue AUX data for decoding. - Prevent having different number of field separators in CVS output lines when a counter is not supported. - Make the perf kallsyms man page usage behave like it does for all other perf commands. - Synchronize the kernel headers" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix ctx_event_type in ctx_resched() perf tools: Fix trigger class trigger_on() perf auxtrace: Prevent decoding when --no-itrace perf stat: Fix CVS output format for non-supported counters tools headers: Sync x86's cpufeatures.h tools headers: Sync copy of kvm UAPI headers perf record: Fix crash in pipe mode perf annotate browser: Be more robust when drawing jump arrows perf top: Fix annoying fallback message on older kernels perf kallsyms: Fix the usage on the man page perf/x86/intel/uncore: Fix Skylake UPI event format
2018-03-11Merge branch 'locking-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Thomas Gleixner: "rt_mutex_futex_unlock() grew a new irq-off call site, but the function assumes that its always called from irq enabled context. Use (un)lock_irqsafe() to handle the new call site correctly" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rtmutex: Make rt_mutex_futex_unlock() safe for irq-off callsites
2018-03-11Merge tag 'irqchip-4.16-3' of ↵Thomas Gleixner
git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip updates for 4.16-rc5 from Marc Zyngier - IMX GPCv2 cleanup - GICv3 iomem annontation fixes - GICv3 ITS minimal ITE allocation now matching the LPIs'.
2018-03-11netfilter: nf_tables: release flowtable hooksPablo Neira Ayuso
Otherwise we leak this array. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-03-11netfilter: bridge: ebt_among: add more missing match size checksFlorian Westphal
ebt_among is special, it has a dynamic match size and is exempt from the central size checks. commit c4585a2823edf ("bridge: ebt_among: add missing match size checks") added validation for pool size, but missed fact that the macros ebt_among_wh_src/dst can already return out-of-bound result because they do not check value of wh_src/dst_ofs (an offset) vs. the size of the match that userspace gave to us. v2: check that offset has correct alignment. Paolo Abeni points out that we should also check that src/dst wormhash arrays do not overlap, and src + length lines up with start of dst (or vice versa). v3: compact wormhash_sizes_valid() part NB: Fixes tag is intentionally wrong, this bug exists from day one when match was added for 2.6 kernel. Tag is there so stable maintainers will notice this one too. Tested with same rules from the earlier patch. Fixes: c4585a2823edf ("bridge: ebt_among: add missing match size checks") Reported-by: <syzbot+bdabab6f1983a03fc009@syzkaller.appspotmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-03-11netfilter: x_tables: add and use xt_check_proc_nameFlorian Westphal
recent and hashlimit both create /proc files, but only check that name is 0 terminated. This can trigger WARN() from procfs when name is "" or "/". Add helper for this and then use it for both. Cc: Eric Dumazet <eric.dumazet@gmail.com> Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Reported-by: <syzbot+0502b00edac2a0680b61@syzkaller.appspotmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-03-11netfilter: ebtables: fix erroneous reject of last ruleFlorian Westphal
The last rule in the blob has next_entry offset that is same as total size. This made "ebtables32 -A OUTPUT -d de:ad:be:ef:01:02" fail on 64 bit kernel. Fixes: b71812168571fa ("netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-03-11Merge tag 'dmaengine-fix-4.16-rc5' of ↵Linus Torvalds
git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Two small fixes are for this cycle: - fix max_chunk_size for rcar-dmac for R-Car Gen3 - fix clock resource of mv_xor_v2" * tag 'dmaengine-fix-4.16-rc5' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: mv_xor_v2: Fix clock resource by adding a register clock dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3
2018-03-11Merge tag 'gpio-v4.16-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fix from Linus Walleij: "This is a single GPIO fix for the v4.16 series affecting the Renesas driver, and fixes wakeup from external stuff" * tag 'gpio-v4.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: rcar: Use wakeup_path i.s.o. explicit clock handling
2018-03-11dmaengine: mv_xor_v2: Fix clock resource by adding a register clockGregory CLEMENT
On the CP110 components which are present on the Armada 7K/8K SoC we need to explicitly enable the clock for the registers. However it is not needed for the AP8xx component, that's why this clock is optional. With this patch both clock have now a name, but in order to be backward compatible, the name of the first clock is not used. It allows to still use this clock with a device tree using the old binding. Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2018-03-11irqchip/irq-imx-gpcv2: Remove unused functionFabio Estevam
imx_gpcv2_get_wakeup_source() is not used anywhere, so remove it. This fixes the following sparse warning: drivers/irqchip/irq-imx-gpcv2.c:34:5: warning: symbol 'imx_gpcv2_get_wakeup_source' was not declared. Should it be static? Fixes: e324c4dc4a59 ("irqchip/imx-gpcv2: IMX GPCv2 driver for wakeup sources") Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
2018-03-11irqchip/gic-v3-its: Ensure nr_ites >= nr_lpisArd Biesheuvel
When struct its_device instances are created, the nr_ites member will be set to a power of 2 that equals or exceeds the requested number of MSIs passed to the msi_prepare() callback. At the same time, the LPI map is allocated to be some multiple of 32 in size, where the allocated size may be less than the requested size depending on whether a contiguous range of sufficient size is available in the global LPI bitmap. This may result in the situation where the nr_ites < nr_lpis, and since nr_ites is what we program into the hardware when we map the device, the additional LPIs will be non-functional. For bog standard hardware, this does not really matter. However, in cases where ITS device IDs are shared between different PCIe devices, we may end up allocating these additional LPIs without taking into account that they don't actually work. So let's make nr_ites at least 32. This ensures that all allocated LPIs are 'live', and that its_alloc_device_irq() will fail when attempts are made to allocate MSIs beyond what was allocated in the first place. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> [maz: updated comment] Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
2018-03-11ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()Takashi Iwai
snd_pcm_oss_get_formats() has an obvious use-after-free around snd_mask_test() calls, as spotted by syzbot. The passed format_mask argument is a pointer to the hw_params object that is freed before the loop. What a surprise that it has been present since the original code of decades ago... Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-03-10Merge tag 'kbuild-fixes-v4.16-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - make fixdep parse kconfig.h to fix missing rebuild - replace hyphens with underscores in builtin DTB label names - fix typos * tag 'kbuild-fixes-v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: Handle builtin dtb file names containing hyphens scripts/bloat-o-meter: fix typos in help fixdep: do not ignore kconfig.h fixdep: remove some false CONFIG_ matches fixdep: remove stale references to uml-config.h
2018-03-10Merge tag 'linux-watchdog-4.16-fixes-2' of ↵Linus Torvalds
git://www.linux-watchdog.org/linux-watchdog Pull watchdog fixes from Wim Van Sebroeck: - f71808e_wdt: Fix magic close handling - sbsa: 32-bit read fix for WCV - hpwdt: Remove legacy NMI sourcing * tag 'linux-watchdog-4.16-fixes-2' of git://www.linux-watchdog.org/linux-watchdog: watchdog: hpwdt: Remove legacy NMI sourcing. watchdog: sbsa: use 32-bit read for WCV watchdog: f71808e_wdt: Fix magic close handling
2018-03-10staging:iio:ad2s1210: Remove old_data from ad2s1210_stateRodrigo Siqueira
The variable old_data is a bool type, which only receives the value 'true' in the function ad2s1210_config_write and ad2s1210_config_read. There is no other use for this variable. This patch removes old_data from the ad2s1210_state and from all the function that use it. Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging:iio:ad2s1210: Remove unused #define directiveRodrigo Siqueira
This patch removes some #define directives not used in the code. Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10Merge tag 'for-linus-20180309' of git://git.kernel.dk/linux-blockLinus Torvalds
Pull block fixes from Jens Axboe: - a xen-blkfront fix from Bhavesh with a multiqueue fix when detaching/re-attaching - a few important NVMe fixes, including a revert for a sysfs fix that caused some user space confusion - two bcache fixes by way of Michael Lyle - a loop regression fix, fixing an issue with lost writes on DAX. * tag 'for-linus-20180309' of git://git.kernel.dk/linux-block: loop: Fix lost writes caused by missing flag nvme_fc: rework sqsize handling nvme-fabrics: Ignore nr_io_queues option for discovery controllers xen-blkfront: move negotiate_mq to cover all cases of new VBDs Revert "nvme: create 'slaves' and 'holders' entries for hidden controllers" bcache: don't attach backing with duplicate UUID bcache: fix crashes in duplicate cache device register nvme: pci: pass max vectors as num_possible_cpus() to pci_alloc_irq_vectors nvme-pci: Fix EEH failure on ppc
2018-03-10Merge tag 'for-4.16/dm-fixes-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix an uninitialized variable false warning in dm bufio - Fix DM's passthrough ioctl support to be race free against an underlying device being removed. - Fix corner-case of DM raid resync reporting if/when the raid becomes degraded during resync; otherwise automated raid repair will fail. - A few DM multipath fixes to make non-SCSI optimizations, that were introduced during the 4.16 merge, useful for all non-SCSI devices, rather than narrowly define this non-SCSI mode in terms of "nvme". This allows the removal of "queue_mode nvme" that really didn't need to be introduced. Instead DM core will internalize whether nvme-specific IO submission optimizations are doable and DM multipath will only do SCSI-specific device handler operations if SCSI is in use. * tag 'for-4.16/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm table: allow upgrade from bio-based to specialized bio-based variant dm mpath: remove unnecessary NVMe branching in favor of scsi_dh checks dm table: fix "nvme" test dm raid: fix incorrect sync_ratio when degraded dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl dm bufio: avoid false-positive Wmaybe-uninitialized warning
2018-03-10staging:iio:ad2s1210: Remove end of line with '['Rodrigo Siqueira
This patch fixes the checkpatch.pl check: iio/resolver/ad2s1210.c:202: CHECK: Lines should not end with a '[' Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma fixes from Doug Ledford: - Various driver bug fixes in mlx5, mlx4, bnxt_re and qedr, ranging from bugs under load to bad error case handling - There in one largish patch fixing the locking in bnxt_re to avoid a machine hard lock situation - A few core bugs on error paths - A patch to reduce stack usage in the new CQ API - One mlx5 regression introduced in this merge window - There were new syzkaller scripts written for the RDMA subsystem and we are fixing issues found by the bot - One of the commits (aa0de36a40f4 “RDMA/mlx5: Fix integer overflow while resizing CQ”) is missing part of the commit log message and one of the SOB lines. The original patch was from Leon Romanovsky, and a cut-n-paste separator in the commit message confused patchworks which then put the end of message separator in the wrong place in the downloaded patch, and I didn’t notice in time. The patch made it into the official branch, and the only way to fix it in-place was to rebase. Given the pain that a rebase causes, and the fact that the patch has relevant tags for stable and syzkaller, a revert of the munged patch and a reapplication of the original patch with the log message intact was done. * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (25 commits) RDMA/mlx5: Fix integer overflow while resizing CQ Revert "RDMA/mlx5: Fix integer overflow while resizing CQ" RDMA/ucma: Check that user doesn't overflow QP state RDMA/mlx5: Fix integer overflow while resizing CQ RDMA/ucma: Limit possible option size IB/core: Fix possible crash to access NULL netdev RDMA/bnxt_re: Avoid Hard lockup during error CQE processing RDMA/core: Reduce poll batch for direct cq polling IB/mlx5: Fix an error code in __mlx5_ib_modify_qp() IB/mlx5: When not in dual port RoCE mode, use provided port as native IB/mlx4: Include GID type when deleting GIDs from HW table under RoCE IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs RDMA/qedr: Fix iWARP write and send with immediate RDMA/qedr: Fix kernel panic when running fio over NFSoRDMA RDMA/qedr: Fix iWARP connect with port mapper RDMA/qedr: Fix ipv6 destination address resolution IB/core : Add null pointer check in addr_resolve RDMA/bnxt_re: Fix the ib_reg failure cleanup RDMA/bnxt_re: Fix incorrect DB offset calculation RDMA/bnxt_re: Unconditionly fence non wire memory operations ...
2018-03-10Merge tag 'platform-drivers-x86-v4.16-6' of ↵Linus Torvalds
git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixes from Darren Hart: "Correct a module loading race condition between the DELL_SMBIOS backend modules and the first user by converting them to bool features of the DELL_SMBIOS driver. Fixup the resulting Kconfig dependency issue with DCDBAS" * tag 'platform-drivers-x86-v4.16-6' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: dell-smbios: Resolve dependency error on DCDBAS platform/x86: Allow for SMBIOS backend defaults platform/x86: dell-smbios: Link all dell-smbios-* modules together platform/x86: dell-smbios: Rename dell-smbios source to dell-smbios-base platform/x86: dell-smbios: Correct some style warnings
2018-03-10ALSA: seq: Clear client entry before deleting else at closingTakashi Iwai
When releasing a client, we need to clear the clienttab[] entry at first, then call snd_seq_queue_client_leave(). Otherwise, the in-flight cell in the queue might be picked up by the timer interrupt via snd_seq_check_queue() before calling snd_seq_queue_client_leave(), and it's delivered to another queue while the client is clearing queues. This may eventually result in an uncleared cell remaining in a queue, and the later snd_seq_pool_delete() may need to wait for a long time until the event gets really processed. By moving the clienttab[] clearance at the beginning of release, any event delivery of a cell belonging to this client will fail at a later point, since snd_seq_client_ptr() returns NULL. Thus the cell that was picked up by the timer interrupt will be returned immediately without further delivery, and the long stall of snd_seq_delete_pool() can be avoided, too. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-03-10ALSA: seq: Fix possible UAF in snd_seq_check_queue()Takashi Iwai
Although we've covered the races between concurrent write() and ioctl() in the previous patch series, there is still a possible UAF in the following scenario: A: user client closed B: timer irq -> snd_seq_release() -> snd_seq_timer_interrupt() -> snd_seq_free_client() -> snd_seq_check_queue() -> cell = snd_seq_prioq_cell_peek() -> snd_seq_prioq_leave() .... removing all cells -> snd_seq_pool_done() .... vfree() -> snd_seq_compare_tick_time(cell) ... Oops So the problem is that a cell is peeked and accessed without any protection until it's retrieved from the queue again via snd_seq_prioq_cell_out(). This patch tries to address it, also cleans up the code by a slight refactoring. snd_seq_prioq_cell_out() now receives an extra pointer argument. When it's non-NULL, the function checks the event timestamp with the given pointer. The caller needs to pass the right reference either to snd_seq_tick or snd_seq_realtime depending on the event timestamp type. A good news is that the above change allows us to remove the snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the code size. Reviewed-by: Nicolai Stange <nstange@suse.de> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-03-10iio: st_pressure: st_accel: pass correct platform data to initMichael Nosthoff
Commit 7383d44b added a pointer pdata which get set to the default platform_data when non was defined in the device. But it did not pass this pointer to the st_sensors_init_sensor call but still used the maybe uninitialized platform_data from dev. This breaks initialization when no platform_data is given and the optional st,drdy-int-pin devicetree option is not set. This commit fixes this. Cc: stable@vger.kernel.org Fixes: 7383d44b ("iio: st_pressure: st_accel: Initialise sensor platform data properly") Signed-off-by: Michael Nosthoff <committed@heine.so> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10Revert "iio: accel: st_accel: remove redundant pointer pdata"Jonathan Cameron
This reverts commit 585ed27d06151f98e39238298f43ee261314ae74. This removed code which was unused due to a bug in commit 7383d44b. To fix this bug the code is needed. Thus this revert. Signed-off-by: Michael Nosthoff <committed@heine.so> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging:iio:ad7150: Align arguments to match open parenthesisTom Lebreux
This fixes the following checkpatch.pl CHECK: Alignment should match open parenthesis Signed-off-by: Tom Lebreux <tomlebreux@cock.li> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging:iio:ad7152: Align arguments to match open parenthesisTom Lebreux
This patch fixes checkpatch.pl CHECK for alignment. Signed-off-by: Tom Lebreux <tomlebreux@cock.li> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10iio: potentiometer: mcp4018: driver for Microchip digital potentiometersPeter Rosin
Add support for Microchip digital potentiometers and rheostats MCP4017, MCP4018, MCP4019 They all have one wiper with 128 steps and come in 5, 10, 50 and 100 kOhm variations. Datasheet: http://www.microchip.com/downloads/en/DeviceDoc/22147a.pdf Signed-off-by: Peter Rosin <peda@axentia.se> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10Staging: iio: ad7746: Adjust arguments to match open parenthesisDavid Veenstra
This patch clears all checkpatch.pl CHECKS, about alignment not matching open parenthesis, whenever it is possible without going beyond 80 columns. Signed-off-by: David Veenstra <davidjulianveenstra@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10Staging: iio: adt7316: Move symbol export to definitionDavid Veenstra
This patch clears the following checkpatch.pl warning: WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable +EXPORT_SYMBOL_GPL(adt7316_pm_ops); Signed-off-by: David Veenstra <davidjulianveenstra@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10iio: adc: meson-saradc: unlock on error in meson_sar_adc_lock()Dan Carpenter
The meson_sar_adc_lock() function is not supposed to hold the "indio_dev->mlock" on the error path. Fixes: 3adbf3427330 ("iio: adc: add a driver for the SAR ADC found in Amlogic Meson SoCs") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10iio: potentiometer: ds1803: Remove VLA usageHimanshu Jha
In preparation to enabling -Wvla, remove VLA usage and replace it with fixed a fixed length array and therefore, prevent potential stack overflow attacks. Fixed as a part of the discussion to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621 Cc: keescook@chromium.org Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: make proximity sensor function correctlyBrian Masney
The bits for setting up the proximity diode were not setup correctly and this was causing the proximity sensor to not function correctly. This patch sets up the correct bit mask in tsl2x7x_chip_on() based on what the data sheet expects. From page 35 of the TSL2771 data sheet: https://ams.com/eng/content/download/250264/976045/file/TSL2771_DS000105_3-00.pdf - Bits 0-1 is the ALS gain control - Bits 2-3 is reserved (The proximity gain control on other tsl2x7x chips) - Bits 4-5 is the proximity diode select - Bits 6-7 is the LED drive strength tsl2x7x_chip_on() had the power and diode hardcoded, so these are extracted out into the settings so that these fields can be configured in the platform data. The default prox_gain is changed from 1 (2X gain) to 0 (1X gain) since the proximity gain control on the TSL2771, TMD2771, and other chips have these fields listed as reserved, and to write 0 into those bits. Verified that the proximity sensor now works correctly on a TSL2771 hooked up to a Raspberry Pi 2. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: remove unnecessary sysfs attributeBrian Masney
The tsl2771 and tmd2771 devices create the in_proximity0_calibscale_available sysfs attribute. These two particular devices do not support changing the proximity gain value on the chip so this patch removes that sysfs attribute. As expected, these two devices already did not create the IIO_CHAN_INFO_CALIBSCALE channel and proximity0_calibrate sysfs attribute. Page 38 of the tsl2772 data sheet shows that the proximity gain can be adjusted with bits 2-3 on the control register: https://ams.com/eng/content/download/291503/1066377/file/TSL2772_DS000181_2-00.pdf Page 35 of the tsl2771 and tmd2771 data sheets shows that bits 2-3 on the control register are reserved and changing the proximity gain is not supported: https://ams.com/eng/content/download/250264/976045/file/TSL2771_DS000105_3-00.pdf https://ams.com/eng/content/download/250283/976077/file/TMD2771_DS000177_2-00.pdf Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: add missing error checksBrian Masney
The functions in_illuminance0_calibrate_store() and in_illuminance0_lux_table_store() did not have complete error handling in place. This patch adds the missing error handling. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: add error handling to tsl2x7x_prox_cal()Brian Masney
tsl2x7x_prox_cal() did not have any error checks. This patch adds the missing error handling and ensures that any errors are reported to user space via in_proximity0_calibrate_store(). Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: correct 'Avoid CamelCase' warning from checkpatchBrian Masney
The statP and calP variables triggered an 'Avoid CamelCase' warning from checkpatch.pl. This patch renames these variables to stat and cal to fix this warning. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: correctly return errors in tsl2x7x_get_prox()Brian Masney
Not all errors that occurred in tsl2x7x_get_prox() were correctly reported in the return value. This patch changes the error handling so that errors are now returned properly. Note that the ret variable is from the call to tsl2x7x_read_status(), and it already has the correct error check. The -EINVAL error code is for an unexpected value in the register. This patch also corrects an unnecessary word wrap in the call to le16_to_cpup() while changes are being made to this code. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: convert mutex_trylock() to mutex_lock()Brian Masney
The driver uses mutex_lock() and mutex_trylock() in several places. Convert the mutex_trylock() to mutex_lock() for consistency with other IIO light drivers in mainline. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: add common function for writing to the control registerBrian Masney
There were four places where the same chunk of code was used to write to the control register. This patch creates a common function tsl2x7x_write_control_reg() to reduce duplicate code. The function tsl2x7x_chip_off() did not correctly return an error code so this patch also corrects that issue. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-03-10staging: iio: tsl2x7x: add common function for reading chip statusBrian Masney
There were three places where the same chunk of code was used to read the chip status. This patch creates a common function tsl2x7x_read_status() to reduce duplicate code. This patch also corrects tsl2x7x_event_handler() to properly check for an error after reading the chip status. Signed-off-by: Brian Masney <masneyb@onstation.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>