summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2016-05-10iwlwifi: Edit the 8265 SDIO IDMordechai Goodstein
Add new 8265 series SDIO ID. Signed-off-by: Mordechai Goodstein <mordechay.goodstein@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: support p2p device frames tx on dqa queue #2Liad Kaufman
Support sending P2P device frames should be sent from queue #2, as required in DQA mode. Signed-off-by: Liad Kaufman <liad.kaufman@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: allocate queue for probe response in dqa modeLiad Kaufman
In DQA mode, allocate a dedicated queue (#9) for P2P GO/soft AP probe responses. Signed-off-by: Liad Kaufman <liad.kaufman@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10drm/exynos/decon5433: fix trigger configurationAndrzej Hajda
It seems trigger cannot be configured too early, otherwise it does not work in case of panel. The patch fixes also trigger flag logic, previously HW-TRIGGER flag was cleared in case of panel - as a result panel used always software trigger. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos/dsi: use of_graph_get_endpoint_by_regs helperPhilipp Zabel
This allows to remove the local of_graph_get_port_by_reg(), of_graph_get_endpoint_by_reg(), and of_get_child_by_name_reg() functions. Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> Reviewed-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos/dpi: use of_graph_get_endpoint_by_regs helperPhilipp Zabel
This allows to remove the local of_graph_get_port_by_reg(), of_graph_get_endpoint_by_reg(), of_get_child_by_name_reg(), and of_graph_get_remote_port_parent() functions. Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos: Nuke dummy fb->dirty callbackDaniel Vetter
It's an optional hook. Might be needed for frontbuffer rendering on manual upload displays, but a simple TODO doesn't explain at all what needs to be done or why. Cc: Inki Dae <inki.dae@samsung.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos: use directly DMA mapping APIs on g2dJoonyoung Shim
There is no reason to be wapper functions to use DMA mapping APIs. Use directly DMA mapping APIs and remove the wapper functions. Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos/hdmi: Don't print error on deferral due to regulatorsJavier Martinez Canillas
The regulators may not be available just because their driver's probe function was just not executed and so the regulators not registered. So, in this case the Exynos HDMI driver should not print logs since a -EPROBE_DEFER is not really an error and that will just pollute the kernel log and confuse users. This patch prevents the following misleading messages to be printed: [ 1.443638] [drm:hdmi_probe] *ERROR* failed to get regulators [ 1.449326] [drm:hdmi_probe] *ERROR* hdmi_resources_init failed Reported-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos: fix imported dma-buf to be mappedJoonyoung Shim
The imported dma-buf should be mapped by sub-system exporting it. Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos: support gem_prime_mmapJoonyoung Shim
This allows exported dma-bufs to be mapped using gem_prime_mmap. Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos: fimd: harden fimd_calc_clkdiv()Tobias Jakobi
Don't use the vrefresh field of the DRM mode since this one is supposed to only be used for debug purpose. Instead use the clock field which should also provide much more precise information. Also sanitize the case in which the clock value should be zero. We then just default to the maximum clock divisor. Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos: fix cancel page flip codeAndrzej Hajda
Driver code did not remove event from the list of pending events before destroy. As a result drm core later tried to inspect invalid memory location. The patch replaces removal code with call to core helper. The bug was detected using KASAN: [ 10.107249] ================================================================== [ 10.107518] BUG: KASAN: use-after-free in drm_release+0xe9c/0x1000 at addr ffffffc089154a18 [ 10.107784] Read of size 8 by task modetest/103 [ 10.107931] ============================================================================= [ 10.113191] BUG kmalloc-128 (Not tainted): kasan: bad access detected [ 10.119608] ----------------------------------------------------------------------------- [ 10.119608] [ 10.129243] Disabling lock debugging due to kernel taint [ 10.134551] INFO: Allocated in drm_mode_page_flip_ioctl+0x500/0xa98 age=4 cpu=0 pid=103 [ 10.142532] alloc_debug_processing+0x18c/0x198 [ 10.147043] ___slab_alloc.constprop.28+0x360/0x380 [ 10.151906] __slab_alloc.isra.25.constprop.27+0x54/0xa0 [ 10.157197] kmem_cache_alloc_trace+0x370/0x3b0 [ 10.161709] drm_mode_page_flip_ioctl+0x500/0xa98 [ 10.166400] drm_ioctl+0x4c4/0xb68 [ 10.169787] do_vfs_ioctl+0x16c/0xeb8 [ 10.173429] SyS_ioctl+0x8c/0xa0 [ 10.176642] el0_svc_naked+0x24/0x28 [ 10.180204] INFO: Freed in exynos_drm_crtc_cancel_page_flip+0xe0/0x160 age=0 cpu=0 pid=103 [ 10.188447] free_debug_processing+0x174/0x388 [ 10.192871] __slab_free+0x2e8/0x438 [ 10.196431] kfree+0x350/0x360 [ 10.199469] exynos_drm_crtc_cancel_page_flip+0xe0/0x160 [ 10.204762] exynos_drm_preclose+0x58/0xa0 [ 10.208844] drm_release+0x1f0/0x1000 [ 10.212491] __fput+0x1c4/0x5b8 [ 10.215613] ____fput+0xc/0x18 [ 10.218654] task_work_run+0x130/0x198 [ 10.222385] do_exit+0x700/0x2278 [ 10.225681] do_group_exit+0xe4/0x2c8 [ 10.229327] SyS_exit_group+0x1c/0x20 [ 10.232973] el0_svc_naked+0x24/0x28 [ 10.236532] INFO: Slab 0xffffffbdc2a45500 objects=32 used=10 fp=0xffffffc089154a00 flags=0x4080 [ 10.245210] INFO: Object 0xffffffc089154a00 @offset=2560 fp=0xffffffc089157600 [ 10.245210] ... [ 10.384532] CPU: 0 PID: 103 Comm: modetest Tainted: G B 4.5.0-rc3-00748-gd5e2881 #271 [ 10.398325] Call trace: [ 10.400764] [<ffffffc000091428>] dump_backtrace+0x0/0x328 [ 10.406141] [<ffffffc000091764>] show_stack+0x14/0x20 [ 10.411176] [<ffffffc00089c550>] dump_stack+0xb0/0xe8 [ 10.416210] [<ffffffc000395778>] print_trailer+0xf8/0x160 [ 10.421592] [<ffffffc00039b5cc>] object_err+0x3c/0x50 [ 10.426626] [<ffffffc00039d630>] kasan_report_error+0x248/0x550 [ 10.432527] [<ffffffc00039da50>] __asan_report_load8_noabort+0x40/0x48 [ 10.439039] [<ffffffc000b5b724>] drm_release+0xe9c/0x1000 [ 10.444419] [<ffffffc0003d340c>] __fput+0x1c4/0x5b8 [ 10.449280] [<ffffffc0003d3884>] ____fput+0xc/0x18 [ 10.454055] [<ffffffc000101aa8>] task_work_run+0x130/0x198 [ 10.459522] [<ffffffc0000bc058>] do_exit+0x700/0x2278 [ 10.464557] [<ffffffc0000bdcfc>] do_group_exit+0xe4/0x2c8 [ 10.469939] [<ffffffc0000bdefc>] SyS_exit_group+0x1c/0x20 [ 10.475320] [<ffffffc000087530>] el0_svc_naked+0x24/0x28 Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos/decon5433: do not use unnecessary software triggerAndrzej Hajda
Software trigger should not be used if hardware trigger is configured. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos/decon5433: handle vblank in vblank interruptAndrzej Hajda
vblank should be signaled to userspace after reading framebuffers not before, signaling it in TE interrupt looks wrong. TE triggers reading framebuffers so it is the worst moment. Tearing is not observable because hardware prevents it, but there are frequently skipped vblank events. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10drm/exynos/hdmi: expose HDMI-PHY clock as pipeline clockAndrzej Hajda
HDMI-PHY clock should be accessible from other components in the pipeline. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-05-10pinctrl: stm32: Implement .pin_config_dbg_show()Patrice Chotard
Signed-off-by: Patrice Chotard <patrice.chotard@st.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2016-05-10gpio: of: make it possible to name GPIO linesLinus Walleij
Make it possible to name the producer side of a GPIO line using a "gpio-line-names" property array, modeled on the "clock-output-names" property from the clock bindings. This naming is especially useful for: - Debugging: lines are named after function, not just opaque offset numbers. - Exploration: systems where some or all GPIO lines are available to end users, such as prototyping, one-off's "makerspace usecases" users are helped by the names of the GPIO lines when tinkering. This usecase has been surfacing recently. The gpio-line-names attribute is completely optional. Example output from lsgpio on a patched Snowball tree: GPIO chip: gpiochip6, "8000e180.gpio", 32 GPIO lines line 0: unnamed unused line 1: "AP_GPIO161" "extkb3" [kernel] line 2: "AP_GPIO162" "extkb4" [kernel] line 3: "ACCELEROMETER_INT1_RDY" unused [kernel] line 4: "ACCELEROMETER_INT2" unused line 5: "MAG_DRDY" unused [kernel] line 6: "GYRO_DRDY" unused [kernel] line 7: "RSTn_MLC" unused line 8: "RSTn_SLC" unused line 9: "GYRO_INT" unused line 10: "UART_WAKE" unused line 11: "GBF_RESET" unused line 12: unnamed unused Cc: Grant Likely <grant.likely@linaro.org> Cc: Amit Kucheria <amit.kucheria@linaro.org> Cc: David Mandala <david.mandala@linaro.org> Cc: Lee Campbell <leecam@google.com> Cc: devicetree@vger.kernel.org Acked-by: Rob Herring <robh@kernel.org> Reviewed-by: Michael Welling <mwelling@ieee.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2016-05-10s390: make couple of variables and functions staticHeiko Carstens
copy_oldmem_user() and ap_jumptable are private to the files they are being used in. Therefore make them static. Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2016-05-10s390/3270: hangup the 3270 tty after a disconnectMartin Schwidefsky
The disconnect and later reconnect of a 3270 terminal does not do a tty hangup. The current session is resumed which is a security issue. Do a tty hangup after a unit check has been received. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2016-05-10s390/3270: handle reconnect of a tty with a different sizeMartin Schwidefsky
If an existing 3270 terminal disconnects and reconnects with a different size, the 3270 driver still works with the old size. If the new dimensions are larger the output merely looks funny, if the new dimensions are smaller the terminal is unusable. To fix this restart the size detection after a unit check has been received. Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2016-05-10video: AMBA CLCD: Remove unncessary include in amba-clcd.cWang Hongcheng
The header file asm/sizes.h is unnecessary. And it can also be compiled under X86 arch after the removal. Signed-off-by: Wang Hongcheng <annie.wang@amd.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-05-10fbdev: ssd1307fb: Fix charge pump settingJulian Scheel
Make sure bit 4 is set for the charge pump setting. It is required according to SSD1306 App Note. Signed-off-by: Julian Scheel <julian@jusst.de> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-05-10crypto: caam - fix caam_jr_alloc() ret codeCatalin Vasile
caam_jr_alloc() used to return NULL if a JR device could not be allocated for a session. In turn, every user of this function used IS_ERR() function to verify if anything went wrong, which does NOT look for NULL values. This made the kernel crash if the sanity check failed, because the driver continued to think it had allocated a valid JR dev instance to the session and at some point it tries to do a caam_jr_free() on a NULL JR dev pointer. This patch is a fix for this issue. Cc: <stable@vger.kernel.org> Signed-off-by: Catalin Vasile <cata.vasile@nxp.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2016-05-10crypto: vmx - comply with ABIs that specify vrsave as reserved.Paulo Flabiano Smorigo
It gives significant improvements ( ~+15%) on some modes. These code has been adopted from OpenSSL project in collaboration with the original author (Andy Polyakov <appro@openssl.org>). Signed-off-by: Paulo Flabiano Smorigo <pfsmorigo@linux.vnet.ibm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2016-05-10fbdev: fbmem: implement error handling in fbmem_init()Alexey Khoroshilov
fbmem_init() ignores all errors, while fbmem_exit() does not check if deallocating resources are valid. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-05-10Merge tag 'iwlwifi-for-kalle-2016-05-04' of ↵Luca Coelho
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes * fix P2P rates (and possibly other issues) Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10fbdev: sh_mipi_dsi: remove driverSimon Horman
Remove the sh_mipi_dsi driver as it appears to be unused since c0bb9b302769 ("ARCH: ARM: shmobile: Remove ag5evm board support"). Signed-off-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-05-10video: fbdev: imxfb: add some error handlingUwe Kleine-König
clk_prepare_enable can fail and if it does the controller must not be considered enabled. So check for errors, properly unwind and give the error code back to the caller. While touching the clock code also enable the clocks in the same direction and disable in reverse order. Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-05-10video: fbdev: imxfb: fix semantic of .get_power and .set_powerUwe Kleine-König
.set_power gets passed an FB_BLANK_XXX value, not a bool. So 0 signals on; and >1 means off. The same applies for return values of .get_power. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2016-05-10mmc: core: remove the invalid message in mmc_select_timingDong Aisheng
mmc_select_hs200() and mmc_select_hs() will keep the timing as before if switch fails. So it's meaningless to print the failed switched mode outside based on the current host timing. Furthermore, the original print is wrong, it should be: pr_warn("%s: switch to %s failed\n", mmc_hostname(card->host), mmc_card_hs(card) ? "high-speed" : (mmc_card_hs200(card) ? "hs200" : "")); Since we already have error message in mmc_select_hs200(), simply remove it outside. Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2016-05-10mmc: core: fix using wrong io voltage if mmc_select_hs200 failsDong Aisheng
Currently MMC core will keep going if HS200/HS timing switch failed with -EBADMSG error by the assumption that the old timing is still valid. However, for mmc_select_hs200 case, the signal voltage may have already been switched. If the timing switch failed, we should fall back to the old voltage in case the card is continue run with legacy timing. If fall back signal voltage failed, we explicitly report an EIO error to force retry during the next power cycle. Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2016-05-10tcm_qla2xxx Add SCSI command jammer/discard capabilityLaurence Oberman
This patch introduces support for TCM_QLA2XXX_DEBUG and associated tcm_qla2xxx_tpg->tpg_attrib.jam_host checking used to test dropped packets to FC host environments. Tested by: Laurence Oberman <loberman@redhat.com> Signed-off-by: Laurence Oberman <loberman@redhat.com> Acked-by: Himanshu Madhani <himanshu.madhani@qlogic.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10iscsi-target: graceful disconnect on invalid mapping to iovecImran Haider
Ensures the first page entry is within bounds. A failed check would terminate the iSCSI connection instead of causing a NULL-dereference. This violation seems to happen with certain iSCSI commands where the computed CDB length is zero but the expected transfer length is non-zero. The real problem is probably on the iSCSI initiator side since there is a discrepancy between the iSCSI header and the encapsulated CDB Opcode. Signed-off-by: Imran Haider <imran1008@gmail.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10target: need_to_release is always false, remove redundant check and kfreeColin Ian King
The removal the #ifdef'd code on CONFIG_ARCH_HAS_SG_CHAIN in commit 02c4de53add1b79 ("target/rd: always chain S/G list") removed the setting of need_to_release to true, so we are now left with need_to_release always being false and hence the conditional kfree is never reached. Clean up the dead code by removing need_to_release and the conditional kfree. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10target: remove sess_kref and ->shutdown_sessionChristoph Hellwig
Both of them are unused now that drivers handle any delayed session shutdown internally. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10iscsi-target: remove usage of ->shutdown_sessionChristoph Hellwig
->shutdown session only decideѕ if the target core calls ->close_session directly, or if the fabrics drivers calls it manually later through target_put_session, which at this point will always close the session as it has been removed from the lookup list and thus no new references will be acquired from the core. So instead remove ->shutdown and have the core call ->close_session directly, and replace all calls to target_put_session in the iSCSI target with direct calls to iscsit_close_session. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10tcm_qla2xxx: introduce a private sess_krefChristoph Hellwig
This stops abusing the common sess_kref to overload it for private usage, which allows removing the shutdown_session method as well. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10target: make close_session optionalChristoph Hellwig
Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10target: make ->shutdown_session optionalChristoph Hellwig
Turns out the template and thus many drivers got the return value wrong: 0 means the fabrics driver needs to put a session reference, which no driver except for the iSCSI target drivers did. Fortunately none of these drivers supports explicit Node ACLs, so the bug was harmless. Even without that only qla2xxx and iscsi every did real work in shutdown_session, so get rid of the boilerplate code in all other drivers. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10target: remove acl_stopChristoph Hellwig
Ensure we can use list_empty on the sess_acl_list to remove the need for this flag. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10target: consolidate and fix session shutdownChristoph Hellwig
Factor out a helper to shutdown sessions for a Node ACL, and make it properly restart the list walk after dropping the lock. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2016-05-10drm/i915: Bail out of pipe config compute loop on LPTDaniel Vetter
LPT is pch, so might run into the fdi bandwidth constraint (especially since it has only 2 lanes). But right now we just force pipe_bpp back to 24, resulting in a nice loop (which we bail out with a loud WARN_ON). Fix this. Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> References: https://bugs.freedesktop.org/show_bug.cgi?id=93477 Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Tested-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1462264381-7573-1-git-send-email-daniel.vetter@ffwll.ch (cherry picked from commit f58a1acc7e4a1f37d26124ce4c875c647fbcc61f) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2016-05-10USB: serial: fix minor-number allocationJohan Hovold
Due to a missing upper bound, invalid minor numbers could be assigned to ports. Such devices would later fail to register, but let's catch this early as intended and avoid having devices with only a subset of their ports registered (potentially the empty set). Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-10USB: serial: quatech2: fix use-after-free in probe error pathJohan Hovold
The interface read URB is submitted in attach, but was only unlinked by the driver at disconnect. In case of a late probe error (e.g. due to failed minor allocation), disconnect is never called and we would end up with active URBs for an unbound interface. This in turn could lead to deallocated memory being dereferenced in the completion callback. Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: stable <stable@vger.kernel.org> # v3.5: 40d04738491d Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-10USB: serial: mxuport: fix use-after-free in probe error pathJohan Hovold
The interface read and event URBs are submitted in attach, but were never explicitly unlinked by the driver. Instead the URBs would have been killed by usb-serial core on disconnect. In case of a late probe error (e.g. due to failed minor allocation), disconnect is never called and we could end up with active URBs for an unbound interface. This in turn could lead to deallocated memory being dereferenced in the completion callbacks. Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") Cc: stable <stable@vger.kernel.org> # v3.14 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-10USB: serial: keyspan: fix debug and error messagesJohan Hovold
The URB status is signed and should be printed using %d rather than %x. Also print endpoint addresses consistently using %x rather than %d, and merge a broken-up error message string. Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-10USB: serial: keyspan: fix URB unlinkJohan Hovold
A driver must not rely on the URB status field to try to determine if an URB is active. Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-10USB: serial: keyspan: fix use-after-free in probe error pathJohan Hovold
The interface instat and indat URBs were submitted in attach, but never unlinked in release before deallocating the corresponding transfer buffers. In the case of a late probe error (e.g. due to failed minor allocation), disconnect would not have been called before release, causing the buffers to be freed while the URBs are still in use. We'd also end up with active URBs for an unbound interface. Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, release") Cc: stable <stable@vger.kernel.org> # v2.6.31 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-10USB: serial: io_edgeport: fix memory leaks in probe error pathJohan Hovold
URBs and buffers allocated in attach for Epic devices would never be deallocated in case of a later probe error (e.g. failure to allocate minor numbers) as disconnect is then never called. Fix by moving deallocation to release and making sure that the URBs are first unlinked. Fixes: f9c99bb8b3a1 ("USB: usb-serial: replace shutdown with disconnect, release") Cc: stable <stable@vger.kernel.org> # v2.6.31 Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>