summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-08-03ath10k: add tdls support for 10.4 firmwaresManikanta Pubbisetty
This patch adds the support of TDLS feature for 10.4 firmware versions. A new WMI service is added to advertise the support of TDLS for 10.4 firmwares. Signed-off-by: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03ath10k: extend wmi service map to accommodate new servicesManikanta Pubbisetty
Though there is room to accommodate 512 services in wmi service ready event, target uses only first 4-bits of each 32-bit word for advertising wmi services thereby limiting max wmi services to 64. TDLS implementation for 10.4 firmwares introduces new wmi services by making use of remaining unused bits of each 32-bit word, therefore the wmi service mapping in host needs to be extended. This patch adds the logic to extend the wmi SVCMAP to accommodate new wmi services. Signed-off-by: Manikanta Pubbisetty <mpubbise@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03ath10k: sdio: fix compile warningErik Stromdahl
As suggested by Arnd Bergmann, replace "while (time_before_...) {}" with "do {} while (time_before_...)" This fixes the following warnings detected by gcc 4.1.2: drivers/net/wireless/ath/ath10k/sdio.c: In function ‘ath10k_sdio_mbox_rxmsg_pending_handler’: drivers/net/wireless/ath/ath10k/sdio.c:676: warning: ‘ret’ may be used uninitialized in this function ... drivers/net/wireless/ath/ath10k/sdio.c: In function ‘ath10k_sdio_irq_handler’: drivers/net/wireless/ath/ath10k/sdio.c:1331: warning: ‘ret’ may be used uninitialized in this function Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03ath10k: add initial USB supportErik Stromdahl
Chipsets like QCA9377 have support for USB so add initial USB bus support to ath10k. With this patch we have the low level HIF and HTC protocol working and it's possible to boot the firmware, but it's still not possible to connect or anything like. More changes are needed for full functionality. For that reason we print during initialisation: WARNING: ath10k USB support is incomplete, don't expect anything to work! Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03ath10k: various usb related definitionsErik Stromdahl
Definitions for USB based chipsets Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03ath10k: set a-mpdu receiver reference numberMatthias Frei
Set the a-mpdu reference number in ath10k to make it accessible in the receivers radiotap header. Implemented as in ath9k. The reference number is needed for troubleshooting and research at the receivers site (e.g. to identify mpdu's that were aggregated in an a-mpdu) Signed-off-by: Matthias Frei <mf@frei.media> [kvalo@qca.qualcomm.com: fix checkpatch warning, commit log cleanup] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-08-03rtlwifi: Replace hardcode value with macroSouptick Joarder
In _rtl_init_mac80211(), hardcoded value for hw->max_listen_interval and hw->max_rate_tries are replaced by macro and removed the comment. Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03mwifiex: pcie: compatible with wifi-only image while extract wifi-part fwXinming Hu
Sometimes, we might using wifi-only firmware with a combo firmware name, in this case, do not need to filter bluetooth part from header. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Reviewed-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03mwifiex: make addba request command cleanXinming Hu
uninitilized variable, such as .add_req_result might be magic stack value. Initialize the structure to make it clean. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03net: qtnfmac: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03hostap: Fix outdated comment about dev->destructorStefano Brivio
After commit cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state."), setting 'dev->needs_free_netdev' ensures device data is released, and 'dev->destructor' is not used anymore. Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.") Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8192ee: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 1899 928 0 2827 b0b realtek/rtlwifi/rtl8192ee/sw.o File size After adding 'const': text data bss dec hex filename 1963 864 0 2827 b0b realtek/rtlwifi/rtl8192ee/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8188ee: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 3090 912 0 4002 fa2 realtek/rtlwifi/rtl8188ee/sw.o File size After adding 'const': text data bss dec hex filename 3154 848 0 4002 fa2 realtek/rtlwifi/rtl8188ee/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8723be: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 3032 912 0 3944 f68 realtek/rtlwifi/rtl8723be/sw.o File size After adding 'const': text data bss dec hex filename 3096 848 0 3944 f68 realtek/rtlwifi/rtl8723be/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8723ae: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 2775 912 0 3687 e67 realtek/rtlwifi/rtl8723ae/sw.o File size After adding 'const': text data bss dec hex filename 2839 848 0 3687 e67 realtek/rtlwifi/rtl8723ae/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8821ae: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 2491 960 0 3451 d7b realtek/rtlwifi/rtl8821ae/sw.o File size After adding 'const': text data bss dec hex filename 2587 864 0 3451 d7b realtek/rtlwifi/rtl8821ae/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8192se: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 2817 1040 0 3857 f11 realtek/rtlwifi/rtl8192se/sw.o File size After adding 'const': text data bss dec hex filename 3009 848 0 3857 f11 realtek/rtlwifi/rtl8192se/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: rtl8192de: constify pci_device_id.Arvind Yadav
pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 2833 945 12 3790 ece realtek/rtlwifi/rtl8192de/sw.o File size After adding 'const': text data bss dec hex filename 2929 849 12 3790 ece realtek/rtlwifi/rtl8192de/sw.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: Tidy up DMA mask settingRobin Murphy
As the only caller of dma_supported() outside of DMA API internals, the qtfnmac driver stands out and invites scrutiny. Thankfully, it's not being used for evil, but it is entirely redundant, since it open-codes a check that the DMA mask setting functions are going to perform anyway. In fact, the whole qtnf_pcie_init_dma_mask() function is nothing more than a rather long-winded implementation of dma_set_mask_and_coherent(), so let's just use that directly. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Acked-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: prepare for AP_VLAN interface type supportSergey Matyukevich
Modify qlink command structures and interface types handling to prepare adding AP_VLAN support to qtnfmac driver. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: remove function qtnf_cmd_skb_put_actionSergey Matyukevich
This function is not used anymore, so remove it. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: fix handling of iftype mask reported by firmwareSergey Matyukevich
Firmware sends supported interface type rather than mask. As a result, types field of ieee80211_iface_limit structure may end up having multiple iftype bits set. This leads to WARN_ON from wiphy_verify_combinations. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: implement scan timeoutSergey Matyukevich
Userspace tools may hang on scan in the case when scan completion event is not returned by firmware. This patch implements the scan timeout to avoid such situation. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: implement cfg80211 channel_switch handlerSergey Matyukevich
This patch implements cfg80211 channel_switch handler enabling CSA channel-switch procedure. Driver performs only basic validation of the requested new channel and then sends command to firmware. Beacon IEs are not sent since beacon update is handled by firmware. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: move current channel info from vif to macSergey Matyukevich
Wireless cfg80211 core supplies channel settings in cfg80211_ap_settings structure for each BSS in multiple BSS configuration. On the other hand all the virtual interfaces on one radio are using the same PHY settings including channel. Move chandef structure from vif to mac structure in order to mantain the only instance of cfg80211_chan_def structure in qtnf_wmac rather than its multiple copies in qtnf_vif. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: fix station leave reason endiannessSergey Matyukevich
Use proper endianness conversion for client station leave reason. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: implement reporting current channelSergey Matyukevich
Implement current channel reporting functionality. Current operating channel can be obtained either directly using cfg80211 get_channel callback or from stats reported by cfg80211 survey_dump callback. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: implement cfg80211 dump_survey handlerSergey Matyukevich
This patch implements cfg80211 dump_survey handler enabling per-channel survey data reports. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: add missing bus lockSergey Matyukevich
Add missing bus lock into get_mac_chan_info command. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: regulatory configuration for self-managed setupSergey Matyukevich
Regdomain information needs to be registered with cfg80211 for devices with REGULATORY_WIPHY_SELF_MANAGED flag set. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03qtnfmac: updates for regulatory supportSergey Matyukevich
On startup driver obtains regulatory rules from firmware and enables them during wiphy registration. Later on regulatory domain change can be requested by host. In this case firmware is notified about the upcoming changes. If the change is valid, then firmware updates hardware channel configuration and host driver receives updated channel info for each band. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Avinash Patil <avinashp@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03rtlwifi: Fix fallback firmware loadingSven Joachim
Commit f70e4df2b384 ("rtlwifi: Add code to read new versions of firmware") added code to load an old firmware file if the new one is not available. Unfortunately that code is never reached because request_firmware_nowait() does not wait for the firmware to show up and returns 0 even if the file is not there. Use the existing fallback mechanism introduced by commit 62009b7f1279 ("rtlwifi: rtl8192cu: Add new firmware") instead. Fixes: f70e4df2b384 ("rtlwifi: Add code to read new versions of firmware") Cc: stable@vger.kernel.org Signed-off-by: Sven Joachim <svenjoac@gmx.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03mwifiex: correct IE parse during associationXinming Hu
It is observed that some IEs get missed during association. This patch correct the old IE parse code. sme->ie will be store as wpa ie, wps ie, wapi ie and gen ie accordingly. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03usb: renesas_usbhs: gadget: fix unused-but-set-variable warningYoshihiro Shimoda
The commit b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps when the driver stops") causes the unused-but-set-variable warning. But, if the usbhsg_ep_disable() will return non-zero value, udc/core.c doesn't clear the ep->enabled flag. So, this driver should not return non-zero value, if the pipe is zero because this means the pipe is already disabled. Otherwise, the ep->enabled flag is never cleared when the usbhsg_ep_disable() is called by the renesas_usbhs driver first. Fixes: b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps when the driver stops") Fixes: 11432050f070 ("usb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable()") Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-08-03rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapterMalcolm Priestley
_rtl_pci_find_adapter fail path will jump to label fail3 for unsupported adapter types. However, on course for fail3 there will be call rtl_deinit_core before rtl_init_core. For the inclusion of checking pci_iounmap this fail can be moved to fail2. Fixes [ 4.492963] BUG: unable to handle kernel NULL pointer dereference at (null) [ 4.493067] IP: rtl_deinit_core+0x31/0x90 [rtlwifi] Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-08-03usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3Yoshihiro Shimoda
The latest HW manual (Rev.0.55) shows us this UGCTRL2.VBUSSEL bit. If the bit sets to 1, the VBUS drive is controlled by phy related registers (called "UCOM Registers" on the manual). Since R-Car Gen3 environment will control VBUS by phy-rcar-gen3-usb2 driver, the UGCTRL2.VBUSSEL bit should be set to 1. So, this patch fixes the register's value. Otherwise, even if the ID pin indicates to peripheral, the R-Car will output USBn_PWEN to 1 when a host driver is running. Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control" Cc: <stable@vger.kernel.org> # v4.6+ Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-08-03usb: phy: phy-msm-usb: Fix usage of devm_regulator_bulk_get()Rajendra Nayak
The regulator_bulk_data pointer passed to devm_regulator_bulk_get() is used to store the client handles for the regulators, which is later used by devm_regulator_bulk_release() to free the regulators. Passing a local array as is done here means the memory used to store the handles is freed causing the handles to be corrupted, resulting in a crash when devm_regulator_bulk_release() tries to free them. Fix this my moving the array inside of the msm_otg structure. Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-08-03usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() callingYoshihiro Shimoda
According to the gadget.h, a "complete" function will always be called with interrupts disabled. However, sometimes usb3_request_done() function is called with interrupts enabled. So, this function should be held by spin_lock_irqsave() to disable interruption. Also, this driver has to call spin_unlock() to avoid spinlock recursion by this driver before calling usb_gadget_giveback_request(). Reported-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> Tested-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") Cc: <stable@vger.kernel.org> # v4.5+ Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-08-03usb: dwc3: gadget: Correct ISOC DATA PIDs for short packetsManu Gautam
The PIDs for Isochronous data transfers are incorrect for high bandwidth IN endpoints when the request length is less than EP wMaxPacketSize. As per spec correct PIDs for ISOC data transfers are: 1) For request length <= maxpacket - DATA0, 2) For maxpacket < length <= (2 * maxpacket) - DATA1, DATA0 3) For (2 * maxpacket) < length <= (3 * maxpacket) - DATA2, DATA1, DATA0. But driver always sets PCM fields based on wMaxPacketSize due to which DATA2 happens even for small requests. Fix this by setting the PCM field of trb->size depending on request length rather than fixing it to the value depending on wMaxPacketSize. Ideally it shouldn't give any issues as dwc3 will send 0-length packet for next IN token if host sends (even after receiving a short packet). Windows seems to ignore this but with MacOS frame loss observed when using f_uvc. Signed-off-by: Manu Gautam <mgautam@codeaurora.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-08-03Merge tag 'iwlwifi-next-for-kalle-2017-08-01' of ↵Kalle Valo
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next First batch of iwlwifi patches for 4.14 * Reorganization of the code into separate directories continues; * A couple of new minor features; * Fixes and cleanups here and there.
2017-08-03mmc: block: bypass the queue even if usage is present for hotplugShawn Lin
The commit 304419d8a7e9 ("mmc: core: Allocate per-request data using the block layer core") refactored mechanism of queue handling caused mmc_init_request() can be called just after mmc_cleanup_queue() caused null pointer dereference. Another commit bbdc74dc19e0 ("mmc: block: Prevent new req entering queue after its cleanup") tried to fix the problem. However it actually miss one corner case. We could still reproduce the issue mentioned with these steps: (1) insert a SD card and mount it (2) hotplug it, so it will leave md->usage still be counted (3) reboot the system which will sync data and umount the card [Unable to handle kernel NULL pointer dereference at virtual address 00000000 [user pgtable: 4k pages, 48-bit VAs, pgd = ffff80007bab3000 [[0000000000000000] *pgd=000000007a828003, *pud=0000000078dce003, *pmd=000000007aab6003, *pte=0000000000000000 [Internal error: Oops: 96000007 [#1] PREEMPT SMP [Modules linked in: [CPU: 3 PID: 3507 Comm: umount Tainted: G W 4.13.0-rc1-next-20170720-00012-g9d9bf45 #33 [Hardware name: Firefly-RK3399 Board (DT) [task: ffff80007a1de200 task.stack: ffff80007a01c000 [PC is at mmc_init_request+0x14/0xc4 [LR is at alloc_request_size+0x4c/0x74 [pc : [<ffff0000087d7150>] lr : [<ffff000008378fe0>] pstate: 600001c5 [sp : ffff80007a01f8f0 .... [[<ffff0000087d7150>] mmc_init_request+0x14/0xc4 [[<ffff000008378fe0>] alloc_request_size+0x4c/0x74 [[<ffff00000817ac28>] mempool_create_node+0xb8/0x17c [[<ffff00000837aadc>] blk_init_rl+0x9c/0x120 [[<ffff000008396580>] blkg_alloc+0x110/0x234 [[<ffff000008396ac8>] blkg_create+0x424/0x468 [[<ffff00000839877c>] blkg_lookup_create+0xd8/0x14c [[<ffff0000083796bc>] generic_make_request_checks+0x368/0x3b0 [[<ffff00000837b050>] generic_make_request+0x1c/0x240 So mmc_blk_put wouldn't calling blk_cleanup_queue which actually the QUEUE_FLAG_DYING and QUEUE_FLAG_BYPASS should stay. Block core expect blk_queue_bypass_{start, end} internally to bypass/drain the queue before actually dying the queue, so it didn't expose API to set the queue bypass. I think we should set QUEUE_FLAG_BYPASS whenever queue is removed, although the md->usage is still counted, as no dispatch queue could be found then. Fixes: 304419d8a7e9 ("mmc: core: Allocate per-request data using the block layer core") Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2017-08-03mmc: sdhci-of-at91: force card detect value for non removable devicesLudovic Desroches
When the device is non removable, the card detect signal is often used for another purpose i.e. muxed to another SoC peripheral or used as a GPIO. It could lead to wrong behaviors depending the default value of this signal if not muxed to the SDHCI controller. Fixes: bb5f8ea4d514 ("mmc: sdhci-of-at91: introduce driver for the Atmel SDMMC") Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2017-08-03pinctrl: cherryview: Add Setzer models to the Chromebook DMI quirkAndy Shevchenko
Add one more model to the Chromebook DMI quirk to make it working again. Link: https://bugzilla.kernel.org/show_bug.cgi?id=194945 Fixes: 2a8209fa6823 ("pinctrl: cherryview: Extend the Chromebook DMI quirk to Intel_Strago systems") Reported-by: mail@abhishek.geek.nz Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2017-08-03xfrm: policy: check policy direction valueVladis Dronov
The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used as an array index. This can lead to an out-of-bound access, kernel lockup and DoS. Add a check for the 'dir' value. This fixes CVE-2017-11600. References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928 Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)") Cc: <stable@vger.kernel.org> # v2.6.21-rc1 Reported-by: "bo Zhang" <zhangbo5891001@gmail.com> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-03Merge tag 'iwlwifi-for-kalle-2017-08-02' of ↵Kalle Valo
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes Some fixes in iwlwifi for 4.13 * Some simple PCI HW ID fix-ups and additions for family 9000; * A couple of bugzilla fixes: - Remove a bogus warning message with new FWs (196915) - Don't allow illegal channel options to be used (195299) * A fix for checksum offload in family 9000; * A fix serious throughput degradation in 11ac with multiple streams; * An old bug in SMPS where the firmware was not aware of SMPS changes;
2017-08-03crypto: inside-secure - fix the sha state length in hmac_sha1_setkeyAntoine Ténart
A check is performed on the ipad/opad in the safexcel_hmac_sha1_setkey function, but the index used by the loop doing it is wrong. It is currently the size of the state array while it should be the size of a sha1 state. This patch fixes it. Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2017-08-03crypto: inside-secure - fix invalidation check in hmac_sha1_setkeyAntoine Ténart
The safexcel_hmac_sha1_setkey function checks if an invalidation command should be issued, i.e. when the context ipad/opad change. This checks is done after filling the ipad/opad which and it can't be true. The patch fixes this by moving the check before the ipad/opad memcpy operations. Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2017-08-02Merge tag 'nfs-for-4.13-4' of git://git.linux-nfs.org/projects/anna/linux-nfsLinus Torvalds
Pull NFS client fixes from Anna Schumaker: "Two fixes from Trond this time, now that he's back from his vacation. The first is a stable fix for the EXCHANGE_ID issue on the mailing list, and the other fixes a double-free situation that he found at the same time. Stable fix: - Fix EXCHANGE_ID corrupt verifier issue Other fix: - Fix double frees in nfs4_test_session_trunk()" * tag 'nfs-for-4.13-4' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4: Fix double frees in nfs4_test_session_trunk() NFSv4: Fix EXCHANGE_ID corrupt verifier issue
2017-08-02isdn/i4l: fix buffer overflowAnnie Cherkaev
This fixes a potential buffer overflow in isdn_net.c caused by an unbounded strcpy. [ ISDN seems to be effectively unmaintained, and the I4L driver in particular is long deprecated, but in case somebody uses this.. - Linus ] Signed-off-by: Jiten Thakkar <jitenmt@gmail.com> Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-08-02clk: keystone: sci-clk: Fix sci_clk_getTero Kristo
Currently a bug in the sci_clk_get implementation causes it to always return a clock belonging to the last device in the static list of clock data. This is due to a bug in the init code that causes the array used by sci_clk_get to only be populated with the clocks for the last device, as each device overwrites the entire array with its own clocks. Fix this by calculating the actual number of clocks for the SoC, and allocating the whole array in one go. Also, we don't need the handle to the init data array anymore after doing this, instead we can just compare the dev_id / clk_id against the registered clocks and use binary search for speed. Signed-off-by: Tero Kristo <t-kristo@ti.com> Reported-by: Dave Gerlach <d-gerlach@ti.com> Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support") Cc: Nishanth Menon <nm@ti.com> Tested-by: Franklin Cooper <fcooper@ti.com> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
generated by cgit (git 2.34.1) at 2025-09-23 10:11:42 +0000