summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2019-03-21staging: erofs: Replace NULL comparisonsVatsala Narang
Replace all NULL comparisons in the file to get rid of checkpatch warnings Signed-off-by: Vatsala Narang <vatsalanarang@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: gdm724x: Rename dftEpsId to dft_eps_idBranden Bonaby
Rename member element dftEpsId to dft_eps_id to avoid camelcase. checkpatch warning: Avoid CamelCase. Signed-off-by: Branden Bonaby <brandonbonaby94@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21Staging: rtl8723bs: Change return type and type of local variableMadhumitha Prabakaran
rtw_startbss_cmd can return the result of calling rtw_enqueue_cmd, which can return the result of calling _rtw_enqueue_cmd, but they all have different return types (u8, u32, and sint, respectively). As all of these functions return error codes, change all the return types to int, in preparation for converting these functions to use standard kernel error codes. Also, remove extern from the function declaration to maintain Linux kernel coding style. Issue suggested by Coccinelle. Signed-off-by: Madhumitha Prabakaran <madhumithabiw@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: r8188eu: refactor recvframe_defrag()Ivan Safonov
Local variables pfhdr and prframe always have a same value, so one of them is unnecessary. Signed-off-by: Ivan Safonov <insafonov@gmail.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: wlan-ng: Correct typo in comment messageBranden Bonaby
Add space between two words for better readability in the comments. Signed-off-by: Branden Bonaby <brandonbonaby94@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: wlan-ng: malformed SPDX-License-IdentifierBranden Bonaby
Correct malformed SPDX-License-Identifier so that it matches Linux kernel comment coding style. Signed-off-by: Branden Bonaby <brandonbonaby94@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: mt7621-spi: Remove references to nonexistent mt7621_spi_opsGeorge Hilliard
This struct does not exist, and when it is looked up in the compatibility tree, it returns null. Remove these nonfunctional lines. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: rtl8188eu: core: rtw_recv.c: Modify return type suggested by ↵Sanjana Sanikommu
Coccinelle. The last two lines in the function could be compressed into one. Avoid usage of local variable. Signed-off-by: Sanjana Sanikommu <sanjana99reddy99@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: rtl8192u: r8192U_dm: Remove unnecessary comments.Sanjana Sanikommu
Remove comments which are not necessary. Signed-off-by: Sanjana Sanikommu <sanjana99reddy99@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: netlogic: replace skb_put/pull pair with skb_reserveIvan Safonov
The sequence skb_put(skb); skb_pull(skb); leads to the same result as skb_reserve(skb); but second is a little shorter and clearer. Signed-off-by: Ivan Safonov <insafonov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21staging: rtl8192u: ieee80211: ieee80211_rx.c: Remove unnecessary braces.Sanjana Sanikommu
Remove braces around single statement block. Issue found by checkpatch.pl WARNING: braces {} are not necessary for a single statement block Signed-off-by: Sanjana Sanikommu <sanjana99reddy99@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21binder: fix race between munmap() and direct reclaimTodd Kjos
An munmap() on a binder device causes binder_vma_close() to be called which clears the alloc->vma pointer. If direct reclaim causes binder_alloc_free_page() to be called, there is a race where alloc->vma is read into a local vma pointer and then used later after the mm->mmap_sem is acquired. This can result in calling zap_page_range() with an invalid vma which manifests as a use-after-free in zap_page_range(). The fix is to check alloc->vma after acquiring the mmap_sem (which we were acquiring anyway) and skip zap_page_range() if it has changed to NULL. Signed-off-by: Todd Kjos <tkjos@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21binder: fix BUG_ON found by selinux-testsuiteTodd Kjos
The selinux-testsuite found an issue resulting in a BUG_ON() where a conditional relied on a size_t going negative when checking the validity of a buffer offset. Fixes: 7a67a39320df ("binder: add function to copy binder object from buffer") Reported-by: Paul Moore <paul@paul-moore.com> Tested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21drm/exynos/mixer: fix MIXER shadow registry synchronisation codeAndrzej Hajda
MIXER on Exynos5 SoCs uses different synchronisation method than Exynos4 to update internal state (shadow registers). Apparently the driver implements it incorrectly. The rule should be as follows: - do not request updating registers until previous request was finished, ie. MXR_CFG_LAYER_UPDATE_COUNT must be 0. - before setting registers synchronisation on VSYNC should be turned off, ie. MXR_STATUS_SYNC_ENABLE should be reset, - after finishing MXR_STATUS_SYNC_ENABLE should be set again. The patch hopefully implements it correctly. Below sample kernel log from page fault caused by the bug: [ 25.670038] exynos-sysmmu 14650000.sysmmu: 14450000.mixer: PAGE FAULT occurred at 0x2247b800 [ 25.677888] ------------[ cut here ]------------ [ 25.682164] kernel BUG at ../drivers/iommu/exynos-iommu.c:450! [ 25.687971] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM [ 25.693778] Modules linked in: [ 25.696816] CPU: 5 PID: 1553 Comm: fb-release_test Not tainted 5.0.0-rc7-01157-g5f86b1566bdd #136 [ 25.705646] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 25.711710] PC is at exynos_sysmmu_irq+0x1c0/0x264 [ 25.716470] LR is at lock_is_held_type+0x44/0x64 v2: added missing MXR_CFG_LAYER_UPDATE bit setting in mixer_enable_sync Reported-by: Marian Mihailescu <mihailescu2m@gmail.com> Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2019-03-20scsi: ibmvscsi: Fix empty event pool access during host removalTyrel Datwyler
The event pool used for queueing commands is destroyed fairly early in the ibmvscsi_remove() code path. Since, this happens prior to the call so scsi_remove_host() it is possible for further calls to queuecommand to be processed which manifest as a panic due to a NULL pointer dereference as seen here: PANIC: "Unable to handle kernel paging request for data at address 0x00000000" Context process backtrace: DSISR: 0000000042000000 ????Syscall Result: 0000000000000000 4 [c000000002cb3820] memcpy_power7 at c000000000064204 [Link Register] [c000000002cb3820] ibmvscsi_send_srp_event at d000000003ed14a4 5 [c000000002cb3920] ibmvscsi_send_srp_event at d000000003ed14a4 [ibmvscsi] ?(unreliable) 6 [c000000002cb39c0] ibmvscsi_queuecommand at d000000003ed2388 [ibmvscsi] 7 [c000000002cb3a70] scsi_dispatch_cmd at d00000000395c2d8 [scsi_mod] 8 [c000000002cb3af0] scsi_request_fn at d00000000395ef88 [scsi_mod] 9 [c000000002cb3be0] __blk_run_queue at c000000000429860 10 [c000000002cb3c10] blk_delay_work at c00000000042a0ec 11 [c000000002cb3c40] process_one_work at c0000000000dac30 12 [c000000002cb3cd0] worker_thread at c0000000000db110 13 [c000000002cb3d80] kthread at c0000000000e3378 14 [c000000002cb3e30] ret_from_kernel_thread at c00000000000982c The kernel buffer log is overfilled with this log: [11261.952732] ibmvscsi: found no event struct in pool! This patch reorders the operations during host teardown. Start by calling the SRP transport and Scsi_Host remove functions to flush any outstanding work and set the host offline. LLDD teardown follows including destruction of the event pool, freeing the Command Response Queue (CRQ), and unmapping any persistent buffers. The event pool destruction is protected by the scsi_host lock, and the pool is purged prior of any requests for which we never received a response. Finally, move the removal of the scsi host from our global list to the end so that the host is easily locatable for debugging purposes during teardown. Cc: <stable@vger.kernel.org> # v2.6.12+ Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2019-03-20scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaitonTyrel Datwyler
For each ibmvscsi host created during a probe or destroyed during a remove we either add or remove that host to/from the global ibmvscsi_head list. This runs the risk of concurrent modification. This patch adds a simple spinlock around the list modification calls to prevent concurrent updates as is done similarly in the ibmvfc driver and ipr driver. Fixes: 32d6e4b6e4ea ("scsi: ibmvscsi: add vscsi hosts to global list_head") Cc: <stable@vger.kernel.org> # v4.10+ Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2019-03-20dpaa2-eth: Fix possible access beyond end of arrayIoana Ciocoi Radulescu
Make sure we don't try to enqueue XDP_REDIRECT frames to an inexistent FQ. While it is guaranteed not to have more than one queue per core, having fewer queues than CPUs on an interface is a valid configuration. Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support") Reported-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Ioana Radulescu <ruxandra.radulescu@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20net: ks8851: Deduplicate register macrosLukas Wunner
The ks8851 chip is sold either with an SPI interface (KSZ8851SNL) or with a so-called non-PCI interface (KSZ8851-16MLL). When the driver for the latter was introduced with commit a55c0a0ed415 ("drivers/net: ks8851_mll ethernet network driver"), it duplicated the register macros introduced by the driver for the former with commit 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver"). The chips are almost identical, so the duplication seems unwarranted. There are a handful of bits which are in use on the KSZ8851-16MLL but reserved on the KSZ8851SNL, and vice-versa, but there are no actual collisions. Thus, remove the duplicate definitions from the KSZ8851-16MLL driver. Mark all bits which differ between the two chips. Move the SPI frame opcodes, which are specific to KSZ8851SNL, to its driver. The KSZ8851-16MLL driver added a RXFCTR_THRESHOLD_MASK macro which is a duplication of the RXFCTR_RXFCT_MASK macro, rename it where it's used. Same for P1MBCR_FORCE_FDX, which duplicates the BMCR_FULLDPLX macro and OBCR_ODS_16MA, which duplicates OBCR_ODS_16mA. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20net: ks8851: Fix register macro misnomersLukas Wunner
In the header file accompanying the ks8851 driver, the P1SCLMD register macros are misnamed, they actually pertain to the P1CR register. The P1CR macros in turn pertain to the P1SR register, see pages 65 to 68 of the spec: http://www.hqchip.com/uploads/pdf/201703/47c98946d6c97a4766e14db3f24955f2.pdf The misnomers have no negative consequences so far because the macros aren't used by ks8851.c, but that's about to change. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20net: ks8851: Set initial carrier state to downLukas Wunner
The ks8851 chip's initial carrier state is down. A Link Change Interrupt is signaled once interrupts are enabled if the carrier is up. The ks8851 driver has it backwards by assuming that the initial carrier state is up. The state is therefore misrepresented if the interface is opened with no cable attached. Fix it. The Link Change interrupt is sometimes not signaled unless the P1MBSR register (which contains the Link Status bit) is read on ->ndo_open(). This might be a hardware erratum. Read the register by calling mii_check_link(), which has the desirable side effect of setting the carrier state to down if the cable was detached while the interface was closed. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20net: ks8851: Delay requesting IRQ until openedLukas Wunner
The ks8851 driver currently requests the IRQ before registering the net_device. Because the net_device name is used as IRQ name and is still "eth%d" when the IRQ is requested, it's impossibe to tell IRQs apart if multiple ks8851 chips are present. Most other drivers delay requesting the IRQ until the net_device is opened. Do the same. The driver doesn't enable interrupts on the chip before opening the net_device and disables them when closing it, so there doesn't seem to be a need to request the IRQ already on probe. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20net: ks8851: Reassert reset pin if chip ID check failsLukas Wunner
Commit 73fdeb82e963 ("net: ks8851: Add optional vdd_io regulator and reset gpio") amended the ks8851 driver to briefly assert the chip's reset pin on probe. It also amended the probe routine's error path to reassert the reset pin if a subsequent initialization step fails. However the commit misplaced reassertion of the reset pin in the error path such that it is not performed if the check of the Chip ID and Enable Register (CIDER) fails. The error path is therefore slightly asymmetrical to the probe routine's body. Fix it. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Stephen Boyd <sboyd@codeaurora.org> Cc: Nishanth Menon <nm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20net: ks8851: Dequeue RX packets explicitlyLukas Wunner
The ks8851 driver lets the chip auto-dequeue received packets once they have been read in full. It achieves that by setting the ADRFE flag in the RXQCR register ("Auto-Dequeue RXQ Frame Enable"). However if allocation of a packet's socket buffer or retrieval of the packet over the SPI bus fails, the packet will not have been read in full and is not auto-dequeued. Such partial retrieval of a packet confuses the chip's RX queue management: On the next RX interrupt, the first packet read from the queue will be the one left there previously and this one can be retrieved without issues. But for any newly received packets, the frame header status and byte count registers (RXFHSR and RXFHBCR) contain bogus values, preventing their retrieval. The chip allows explicitly dequeueing a packet from the RX queue by setting the RRXEF flag in the RXQCR register ("Release RX Error Frame"). This could be used to dequeue the packet in case of an error, but if that error is a failed SPI transfer, it is unknown if the packet was transferred in full and was auto-dequeued or if it was only transferred in part and requires an explicit dequeue. The safest approach is thus to always dequeue packets explicitly and forgo auto-dequeueing. Without this change, I've witnessed packet retrieval break completely when an SPI DMA transfer fails, requiring a chip reset. Explicit dequeueing magically fixes this and makes packet retrieval absolutely robust for me. The chip's documentation suggests auto-dequeuing and uses the RRXEF flag only to dequeue error frames which the driver doesn't want to retrieve. But that seems to be a fair-weather approach. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20scsi: hisi_sas: Add softreset in hisi_sas_I_T_nexus_reset()Luo Jiaxing
We found out that for v2 hw, a SATA disk can not be written to after the system comes up. In commit ffb1c820b8b6 ("scsi: hisi_sas: remove the check of sas_dev status in hisi_sas_I_T_nexus_reset()"), we introduced a path where we may issue an internal abort for a SATA device, but without following it with a softreset. We need to always follow an internal abort with a software reset, as per HW programming flow, so add this. Fixes: ffb1c820b8b6 ("scsi: hisi_sas: remove the check of sas_dev status in hisi_sas_I_T_nexus_reset()") Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com> Signed-off-by: John Garry <john.garry@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2019-03-20irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmpRasmus Villemoes
The lpi_range_list is supposed to be sorted in ascending order of ->base_id (at least if the range merging is to work), but the current comparison function returns a positive value if rb->base_id > ra->base_id, which means that list_sort() will put A after B in that case - and vice versa, of course. Fixes: 880cb3cddd16 (irqchip/gic-v3-its: Refactor LPI allocator) Cc: stable@vger.kernel.org (v4.19+) Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
2019-03-20i2c: i801: Add support for Intel Comet LakeJarkko Nikula
Add PCI ID for Intel Comet Lake PCH. Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2019-03-20rbd: drop wait_for_latest_osdmap()Ilya Dryomov
Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Jason Dillaman <dillaman@redhat.com>
2019-03-20HID: logitech: Handle 0 scroll events for the m560Peter Hutterer
hidpp_scroll_counter_handle_scroll() doesn't expect a 0-value scroll event, it gets interpreted as a negative scroll direction event. This can cause scroll direction resets and thus broken scrolling. Fixes: 4435ff2f09a2fc ("HID: logitech: Enable high-resolution scrolling on Logitech mice") Cc: stable@vger.kernel.org # v5.0 Reported-and-tested-by: Aimo Metsälä <aimetsal@outlook.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2019-03-20USB: serial: mos7720: fix mos_parport refcount imbalance on error pathLin Yi
The write_parport_reg_nonblock() helper takes a reference to the struct mos_parport, but failed to release it in a couple of error paths after allocation failures, leading to a memory leak. Johan said that move the kref_get() and mos_parport assignment to the end of urbtrack initialisation is a better way, so move it. and mos_parport do not used until urbtrack initialisation. Signed-off-by: Lin Yi <teroincn@163.com> Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715") Cc: stable <stable@vger.kernel.org> # 2.6.35 Signed-off-by: Johan Hovold <johan@kernel.org>
2019-03-20rtc: sd3078: fix manufacturer nameAlexandre Belloni
The proper manufacturer name is Shenzhen whwave. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2019-03-20rtc: sh: Fix invalid alarm warning for non-enabled alarmGeert Uytterhoeven
When no alarm has been programmed on RSK-RZA1, an error message is printed during boot: rtc rtc0: invalid alarm value: 2019-03-14T255:255:255 sh_rtc_read_alarm_value() returns 0xff when querying a hardware alarm field that is not enabled. __rtc_read_alarm() validates the received alarm values, and fills in missing fields when needed. While 0xff is handled fine for the year, month, and day fields, and corrected as considered being out-of-range, this is not the case for the hour, minute, and second fields, where -1 is expected for missing fields. Fix this by returning -1 instead, as this value is handled fine for all fields. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2019-03-20rtc: cros-ec: Fail suspend/resume if wake IRQ can't be configuredStephen Boyd
If we encounter a failure during suspend where this RTC was programmed to wakeup the system from suspend, but that wakeup couldn't be configured because the system didn't support wakeup interrupts, we'll run into the following warning: Unbalanced IRQ 166 wake disable WARNING: CPU: 7 PID: 3071 at kernel/irq/manage.c:669 irq_set_irq_wake+0x108/0x278 This happens because the suspend process isn't aborted when the RTC fails to configure the wakeup IRQ. Instead, we continue suspending the system and then another suspend callback fails the suspend process and "unwinds" the previously suspended drivers by calling their resume callbacks. When we get back to resuming this RTC driver, we'll call disable_irq_wake() on an IRQ that hasn't been configured for wake. Let's just fail suspend/resume here if we can't configure the system to wake and the user has chosen to wakeup with this device. This fixes this warning and makes the code more robust in case there are systems out there that can't wakeup from suspend on this line but the user has chosen to do so. Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com> Cc: Evan Green <evgreen@chromium.org> Cc: Benson Leung <bleung@chromium.org> Cc: Guenter Roeck <groeck@chromium.org> Signed-off-by: Stephen Boyd <swboyd@chromium.org> Acked-By: Benson Leung <bleung@chromium.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2019-03-20staging: rtl8188eu: remove unused WFD definesMichael Straube
All defined WFD* in wifi.h are unused in the driver code, so remove them. Signed-off-by: Michael Straube <straube.linux@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20Staging: unisys: Correct malformed SPDX-License-IdentifierWentao Cai
Correct SPDX-License-Identifier comment characters to silence checkpatch.pl warning: WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 Signed-off-by: Wentao Cai <etsai042@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20USB: gadget: f_hid: fix deadlock in f_hidg_write()Radoslav Gerganov
In f_hidg_write() the write_spinlock is acquired before calling usb_ep_queue() which causes a deadlock when dummy_hcd is being used. This is because dummy_queue() callbacks into f_hidg_req_complete() which tries to acquire the same spinlock. This is (part of) the backtrace when the deadlock occurs: 0xffffffffc06b1410 in f_hidg_req_complete 0xffffffffc06a590a in usb_gadget_giveback_request 0xffffffffc06cfff2 in dummy_queue 0xffffffffc06a4b96 in usb_ep_queue 0xffffffffc06b1eb6 in f_hidg_write 0xffffffff8127730b in __vfs_write 0xffffffff812774d1 in vfs_write 0xffffffff81277725 in SYSC_write Fix this by releasing the write_spinlock before calling usb_ep_queue() Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com> Tested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: stable@vger.kernel.org # 4.11+ Fixes: 749494b6bdbb ("usb: gadget: f_hid: fix: Move IN request allocation to set_alt()") Signed-off-by: Radoslav Gerganov <rgerganov@vmware.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2019-03-20staging: comedi: ni_mio_common: use insn->n in ni_m_series_eeprom_insn_read()Ian Abbott
The `insn_read` handler for the EEPROM subdevice on M-series boards (`ni_m_series_eeprom_insn_read()`) currently ignores `insn->n` (the number of samples to read) and assumes a single sample is to be read into `data[0]`. Fortunately, the Comedi core ensures that `data[]` has a length of at least 16 so there is no problem with array bounds. The usual Comedi convention for `insn_read` handlers is to read the same channel `insn->n` times into successive elements of `data[]` so let's do that. (Each channel corresponds to a single EEPROM address.) In this case, the data value comes from a local copy of the EEPROM contents. Also, follow the usual Comedi convention and return `insn->n` from the handler to indicate success (although any non-negative value will do). Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: comedi: ni_mio_common: use insn->n in ni_eeprom_insn_read()Ian Abbott
The `insn_read` handler for the EEPROM subdevice on E-series boards (`ni_eeprom_insn_read()`) currently ignores `insn->n` (the number of samples to read) and assumes a single sample is to be read into `data[0]`. Fortunately, the Comedi core ensures that `data[]` has a length of at least 16 so there is no problem with array bounds. The usual Comedi convention for `insn_read` handlers is to read the same channel `insn->n` times into successive elements of `data[]` so let's do that. (Each channel number corresponds to a single EEPROM address.) Since we do not expect the EEPROM data at a particular address to change between readings, let's just read it once and copy the value `insn->n` times. Also, follow the usual Comedi convention and return `insn->n` from the handler to indicate success (although any non-negative value will do). Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: comedi: ni_mio_common: use insn->n in ni_calib_insn_read()Ian Abbott
The `insn_read` handler for the calibration subdevice (`ni_calib_insn_read()`) currently ignores `insn->n` (the number of samples to read) and assumes a single sample is to be read into `data[0]`. Fortunately, the Comedi core ensures that `data[]` has a length of at least 16, so there is no problem with array bounds. The usual Comedi convention for `insn_read` handlers is to read the same channel `insn->n` times into successive elements of `data[]`, so let's do that. Also, follow the usual Comedi convention and return `insn->n` from the handler to indicate success (although any non-negative value will do). Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: comedi: ni_mio_common: Use insn->n in ni_calib_insn_write()Ian Abbott
The `insn_write` handler for the calibration subdevice (`ni_calib_insn_write()`) currently ignores `insn->n` (the number of samples to write) and assumes a single sample is to be written, but `insn->n` could be 0, meaning no samples should be written, in which case `data[0]` is invalid. Change `ni_calib_insn_write()` to only write to the calibration device if `insn->n > 0`. There isn't much point writing all the values when `insn->n > 1`, so just write the last one (`data[insn->n - 1]`). Also follow the usual Comedi convention and return `insn->n` from the handler to indicate success (although any non-negative return value will do as far as the Comedi core is concerned). Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Only unmap_sg if mappedGeorge Hilliard
A failure while processing the start command could cause dma_unmap_sg() to be called without first calling dma_map_sg(). Since calling dma_unmap_sg() is only needed when data != NULL, move the unmap call into the corresponding if {} block. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Fix BRUST -> BURST typoGeorge Hilliard
Obvious typo. It is specified as BURST in the datasheet. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Immediately notify mmc layer of card change detectionGeorge Hilliard
There is no need to delay notifying the mmc layer. Schedule the delayed work to run immediately. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Remove redundant host->mmc->f_max writeGeorge Hilliard
This is set once during initialization and never changed. Don't bother setting it again in the interrupt handler. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Bill the caller for I/O timeGeorge Hilliard
When waiting on completions, use the _io variant so the caller is charged as using I/O. This should have no effect on the module's functionality, only improve CPU accounting. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Use pinctrl subsystem to select SDXC pin modeGeorge Hilliard
The driver previously grabbed the SD pins for itself, ignoring the pin controller. Remove this, and allow the pinctrl subsystem to set up the pins using the device tree mappings. This allows this driver to work on related devices that have a different pin controller mapping, such as the MT7688. The hardcoded bit index was incorrect on that device. The driver now needs a pin controller reference in its device tree node: sdhci: /* ... */ { compatible = "ralink,mt7620-sdhci"; pinctrl-names = "default"; pinctrl-0 = <&sdhci_pins>; // ... }; This change could break SD controller functionality on existing devices whose device trees do not specify a pin controller and state for the SD node. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: Remove obsolete comments and variablesGeorge Hilliard
These comments don't contain useful code or alternate implementation ideas. Remove them. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20staging: mt7621-mmc: fix unused variable compiler warningGeorge Hilliard
The compiler complains: drivers/staging/mt7621-mmc/dbg.c: In function ‘msdc_debug_proc_write’: drivers/staging/mt7621-mmc/dbg.c:237:12: warning: unused variable ‘size’ [-Wunused-variable] int mode, size; ^~~~ drivers/staging/mt7621-mmc/dbg.c:237:6: warning: unused variable ‘mode’ [-Wunused-variable] int mode, size; ^~~~ Remove these declarations. Signed-off-by: George Hilliard <thirtythreeforty@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20drm/vmwgfx: Don't double-free the mode stored in par->set_modeThomas Zimmermann
When calling vmw_fb_set_par(), the mode stored in par->set_mode gets free'd twice. The first free is in vmw_fb_kms_detach(), the second is near the end of vmw_fb_set_par() under the name of 'old_mode'. The mode-setting code only works correctly if the mode doesn't actually change. Removing 'old_mode' in favor of using par->set_mode directly fixes the problem. Cc: <stable@vger.kernel.org> Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2") Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Deepak Rawat <drawat@vmware.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
2019-03-20staging: fsl-dpaa2: ethsw: Remove return variableNishka Dasgupta
Remove return variable and return return value directly. Issue found by Coccinelle using ret.cocci. Signed-off-by: Nishka Dasgupta <nishka.dasgupta@yahoo.com> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-20Staging: unisys: visorhba: Replace '--help--' with 'help' in KconfigWentao Cai
Replace '--help--' in Kconfig and indent the subsequent text to silence checkpatch.pl warning: WARNING: prefer 'help' over '---help---' for new help texts Signed-off-by: Wentao Cai <etsai042@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>