summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2015-10-15iommu: Implement common IOMMU ops for DMA mappingRobin Murphy3-0/+532
Taking inspiration from the existing arch/arm code, break out some generic functions to interface the DMA-API to the IOMMU-API. This will do the bulk of the heavy lifting for IOMMU-backed dma-mapping. Since associating an IOVA allocator with an IOMMU domain is a fairly common need, rather than introduce yet another private structure just to do this for ourselves, extend the top-level struct iommu_domain with the notion. A simple opaque cookie allows reuse by other IOMMU API users with their various different incompatible allocator types. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2015-10-11Merge tag 'scsi-fixes' of ↵Linus Torvalds3-14/+33
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of three bug fixes, two of which are regressions from recent updates (the 3ware one from 4.1 and the device handler fixes from 4.2)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: 3w-9xxx: don't unmap bounce buffered commands scsi_dh: Use the correct module name when loading device handler libiscsi: Fix iscsi_check_transport_timeouts possible infinite loop
2015-10-11Merge tag 'md/4.3-rc4-fix' of git://neil.brown.name/mdLinus Torvalds2-4/+4
Pull md bugfix from Neil Brown: "One bug fix for raid1/raid10. Very careless bug earler in 4.3-rc, now fixed :-)" * tag 'md/4.3-rc4-fix' of git://neil.brown.name/md: crash in md-raid1 and md-raid10 due to incorrect list manipulation
2015-10-10Merge tag 'usb-4.3-rc5' of ↵Linus Torvalds7-3/+41
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB and PHY fixes and quirk updates for 4.3-rc5. Nothing major here, full details in the shortlog, and all of these have been in linux-next for a while" * tag 'usb-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: Add device quirk for Logitech PTZ cameras USB: chaoskey read offset bug USB: Add reset-resume quirk for two Plantronics usb headphones. usb: renesas_usbhs: Add support for R-Car H3 usb: renesas_usbhs: fix build warning if 64-bit architecture usb: gadget: bdc: fix memory leak phy: berlin-sata: Fix module autoload for OF platform driver phy: rockchip-usb: power down phy when rockchip phy probe phy: qcom-ufs: fix build error when the component is built as a module
2015-10-10Merge tag 'tty-4.3-rc5' of ↵Linus Torvalds6-28/+79
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are a few bug fixes for the tty core that resolve reported issues, and some serial driver fixes as well (including the much-reported imx driver problem) All of these have been in linux-next with no reported problems" * tag 'tty-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: drivers/tty: require read access for controlling terminal serial: 8250: add uart_config entry for PORT_RT2880 tty: fix data race on tty_buffer.commit tty: fix data race in tty_buffer_flush tty: fix data race in flush_to_ldisc tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c serial: atmel: fix error path of probe function tty: don't leak cdev in tty_cdev_add() Revert "serial: imx: remove unbalanced clk_prepare"
2015-10-10Merge tag 'staging-4.3-rc5' of ↵Linus Torvalds1-0/+1
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging fixes from Greg KH: "Here are two tiny staging tree fixes for 4.3-rc5. One fixes the broken speakup subsystem as reported by a user, and the other removes an entry in the MAINTAINERS file for a developer that doesn't want to be listed anymore" * tag 'staging-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: speakup: fix speakup-r regression MAINTAINERS: Remove myself as nvec co-maintainer
2015-10-10Merge tag 'char-misc-4.3-rc5' of ↵Linus Torvalds4-8/+19
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small fixes for some misc drivers that resolve some reported issues. All of these have been linux-next for a while" * tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mcb: Fix error handling in mcb_pci_probe() mei: hbm: fix error in state check logic nvmem: sunxi: Check for memory allocation failure nvmem: core: Fix memory leak in nvmem_cell_write nvmem: core: Handle shift bits in-place if cell->nbits is non-zero nvmem: core: fix the out-of-range leak in read/write()
2015-10-09Merge tag 'pm+acpi-4.3-rc5' of ↵Linus Torvalds3-4/+10
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management and ACPI fixes from Rafael Wysocki: "These are four fixes for bugs in the devfreq and cpufreq subsystems, including two regression fixes (one for a recent regression and one for a problem introduced in 4.2). Specifics: - Two fixes for cpufreq regressions, an acpi-cpufreq driver one introduced during the 4.2 cycle when we started to preserve cpufreq directories for offline CPUs and a general one introduced recently (Srinivas Pandruvada). - Two devfreq fixes, one for a double kfree() in an error code path and one for a confusing sysfs-related failure (Geliang Tang, Tobias Jakobi)" * tag 'pm+acpi-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: prevent lockup on reading scaling_available_frequencies cpufreq: acpi_cpufreq: prevent crash on reading freqdomain_cpus PM / devfreq: fix double kfree PM / devfreq: Fix governor_store()
2015-10-09Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds4-25/+9
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A Samsung driver fix and a handful of TI driver fixes" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: ti: dflt: fix enable_reg validity check clk: ti: fix dual-registration of uart4_ick clk: ti: clk-7xx: Remove hardwired ABE clock configuration clk: samsung: fix cpu clock's flags checking
2015-10-09Merge tag 'mmc-v4.3-rc4' of git://git.linaro.org/people/ulf.hansson/mmcLinus Torvalds5-6/+22
Pull MMC fixes from Ulf Hansson: "MMC host: - omap_hsmmc: Fix boot regressions for omap4430 - omap_hsmmc: Fix legacy boot regression for omap3 - sdhci-pxav3: Fix some clock issues for Armada 38x - sdhci-pxav3: Fix error handling at probe - sdhci-of-at91: Fix clock stabilization problem" * tag 'mmc-v4.3-rc4' of git://git.linaro.org/people/ulf.hansson/mmc: mmc: sdhci-of-at91: use SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST quirk mmc: sdhci: add quirk SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST mmc: sdhci-pxav3: fix error handling of armada_38x_quirks mmc: sdhci-pxav3: disable clock inversion for HS MMC cards mmc: sdhci-pxav3: remove broken clock base quirk for Armada 38x sdhci driver mmc: host: omap_hsmmc: Fix MMC for omap3 legacy booting Revert "mmc: host: omap_hsmmc: use regulator_is_enabled to find pbias status"
2015-10-09Merge tag 'dm-4.3-fixes-2' of ↵Linus Torvalds8-24/+37
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull dm fixes from Mike Snitzer: "Three stable fixes: - DM core AB-BA deadlock fix in the device destruction path (vs device creation's DM table swap). - DM raid fix to properly round up the region_size to the next power-of-2. - DM cache fix for a NULL pointer seen while switching from the "cleaner" cache policy. Two fixes for regressions introduced during the 4.3 merge: - request-based DM error propagation regressed due to incorrect changes introduced when adding the bi_error field to bio. - DM snapshot fix to only support snapshots that overflow if the client (e.g. lvm2) is prepared to deal with the associated snapshot status interface change" * tag 'dm-4.3-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm snapshot: add new persistent store option to support overflow dm cache: fix NULL pointer when switching from cleaner policy dm: fix request-based dm error reporting dm raid: fix round up of default region size dm: fix AB-BA deadlock in __dm_destroy()
2015-10-09Merge tag 'fixes-for-linus' of ↵Linus Torvalds1-1/+0
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "The fixes for this week include one small patch that was years in the making and that finally fixes using all eight CPUs on exynos542x. The rest are lots of minor changes for sunxi, imx, exynos and shmobile - fixing the minimum voltage for Allwinner A20 - thermal boot issue on SMDK5250. - invalid clock used for FIMD IOMMU. - audio on Renesas r8a7790/r8a7791 - invalid clock used for FIMD IOMMU - LEDs on exynos5422-odroidxu3-common - usb pin control for imx-rex - imx53: fix PMIC interrupt level - a Makefile typo" * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: dts: Fix wrong clock binding for sysmmu_fimd1_1 on exynos5420 ARM: dts: Fix bootup thermal issue on smdk5250 ARM: shmobile: r8a7791 dtsi: Add CPG/MSTP Clock Domain for sound ARM: shmobile: r8a7790 dtsi: Add CPG/MSTP Clock Domain for sound arm-cci500: Don't enable PMU driver by default ARM: dts: fix usb pin control for imx-rex dts ARM: imx53: qsrb: fix PMIC interrupt level ARM: imx53: include IRQ dt-bindings header ARM: dts: add suspend opp to exynos4412 ARM: dts: Fix LEDs on exynos5422-odroidxu3 ARM: EXYNOS: reset Little cores when cpu is up ARM: dts: Fix Makefile target for sun4i-a10-itead-iteaduino-plus ARM: dts: sunxi: Raise minimum CPU voltage for sun7i-a20 to meet SoC specifications
2015-10-09dm snapshot: add new persistent store option to support overflowMike Snitzer5-15/+30
Commit 76c44f6d80 introduced the possibly for "Overflow" to be reported by the snapshot device's status. Older userspace (e.g. lvm2) does not handle the "Overflow" status response. Fix this incompatibility by requiring newer userspace code, that can cope with "Overflow", request the persistent store with overflow support by using "PO" (Persistent with Overflow) for the snapshot store type. Reported-by: Zdenek Kabelac <zkabelac@redhat.com> Fixes: 76c44f6d80 ("dm snapshot: don't invalidate on-disk image on snapshot write overflow") Reviewed-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-10-09Merge branches 'pm-devfreq' and 'pm-cpufreq'Rafael J. Wysocki120-778/+880
* pm-devfreq: PM / devfreq: fix double kfree PM / devfreq: Fix governor_store() * pm-cpufreq: cpufreq: prevent lockup on reading scaling_available_frequencies cpufreq: acpi_cpufreq: prevent crash on reading freqdomain_cpus
2015-10-09dm cache: fix NULL pointer when switching from cleaner policyJoe Thornber1-1/+1
The cleaner policy doesn't make use of the per cache block hint space in the metadata (unlike the other policies). When switching from the cleaner policy to mq or smq a NULL pointer crash (in dm_tm_new_block) was observed. The crash was caused by bugs in dm-cache-metadata.c when trying to skip creation of the hint btree. The minimal fix is to change hint size for the cleaner policy to 4 bytes (only hint size supported). Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org
2015-10-09crash in md-raid1 and md-raid10 due to incorrect list manipulationMikulas Patocka2-4/+4
The commit 55ce74d4bfe1b9444436264c637f39a152d1e5ac (md/raid1: ensure device failure recorded before write request returns) is causing crash in the LVM2 testsuite test shell/lvchange-raid.sh. For me the crash is 100% reproducible. The reason for the crash is that the newly added code in raid1d moves the list from conf->bio_end_io_list to tmp, then tests if tmp is non-empty and then incorrectly pops the bio from conf->bio_end_io_list (which is empty because the list was alrady moved). Raid-10 has a similar bug. Kernel Fault: Code=15 regs=000000006ccb8640 (Addr=0000000100000000) CPU: 3 PID: 1930 Comm: mdX_raid1 Not tainted 4.2.0-rc5-bisect+ #35 task: 000000006cc1f258 ti: 000000006ccb8000 task.ti: 000000006ccb8000 YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI PSW: 00001000000001001111111000001111 Not tainted r00-03 000000ff0804fe0f 000000001059d000 000000001059f818 000000007f16be38 r04-07 000000001059d000 000000007f16be08 0000000000200200 0000000000000001 r08-11 000000006ccb8260 000000007b7934d0 0000000000000001 0000000000000000 r12-15 000000004056f320 0000000000000000 0000000000013dd0 0000000000000000 r16-19 00000000f0d00ae0 0000000000000000 0000000000000000 0000000000000001 r20-23 000000000800000f 0000000042200390 0000000000000000 0000000000000000 r24-27 0000000000000001 000000000800000f 000000007f16be08 000000001059d000 r28-31 0000000100000000 000000006ccb8560 000000006ccb8640 0000000000000000 sr00-03 0000000000249800 0000000000000000 0000000000000000 0000000000249800 sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 IASQ: 0000000000000000 0000000000000000 IAOQ: 000000001059f61c 000000001059f620 IIR: 0f8010c6 ISR: 0000000000000000 IOR: 0000000100000000 CPU: 3 CR30: 000000006ccb8000 CR31: 0000000000000000 ORIG_R28: 000000001059d000 IAOQ[0]: call_bio_endio+0x34/0x1a8 [raid1] IAOQ[1]: call_bio_endio+0x38/0x1a8 [raid1] RP(r2): raid_end_bio_io+0x88/0x168 [raid1] Backtrace: [<000000001059f818>] raid_end_bio_io+0x88/0x168 [raid1] [<00000000105a4f64>] raid1d+0x144/0x1640 [raid1] [<000000004017fd5c>] kthread+0x144/0x160 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Fixes: 55ce74d4bfe1 ("md/raid1: ensure device failure recorded before write request returns.") Fixes: 95af587e95aa ("md/raid10: ensure device failure recorded before write request returns.") Signed-off-by: NeilBrown <neilb@suse.com>
2015-10-08cpufreq: prevent lockup on reading scaling_available_frequenciesSrinivas Pandruvada1-1/+3
When scaling_available_frequencies is read on an offlined cpu, then either lockup or junk values are displayed. This is caused by freed freq_table, which policy is using. Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-10-08cpufreq: acpi_cpufreq: prevent crash on reading freqdomain_cpusSrinivas Pandruvada1-0/+3
When freqdomain_cpus attribute is read from an offlined cpu, it will cause crash. This change prevents calling cpufreq_show_cpus when policy driver_data is NULL. Crash info: [ 170.814949] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 170.814990] IP: [<ffffffff813b2490>] _find_next_bit.part.0+0x10/0x70 [ 170.815021] PGD 227d30067 PUD 229e56067 PMD 0 [ 170.815043] Oops: 0000 [#2] SMP [ 170.816022] CPU: 3 PID: 3121 Comm: cat Tainted: G D OE 4.3.0-rc3+ #33 ... ... [ 170.816657] Call Trace: [ 170.816672] [<ffffffff813b2505>] ? find_next_bit+0x15/0x20 [ 170.816696] [<ffffffff8160e47c>] cpufreq_show_cpus+0x5c/0xd0 [ 170.816722] [<ffffffffa031a409>] show_freqdomain_cpus+0x19/0x20 [acpi_cpufreq] [ 170.816749] [<ffffffff8160e65b>] show+0x3b/0x60 [ 170.816769] [<ffffffff8129b31c>] sysfs_kf_seq_show+0xbc/0x130 [ 170.816793] [<ffffffff81299be3>] kernfs_seq_show+0x23/0x30 [ 170.816816] [<ffffffff81240f2c>] seq_read+0xec/0x390 [ 170.816837] [<ffffffff8129a64a>] kernfs_fop_read+0x10a/0x160 [ 170.816861] [<ffffffff8121d9b7>] __vfs_read+0x37/0x100 [ 170.816883] [<ffffffff813217c0>] ? security_file_permission+0xa0/0xc0 [ 170.816909] [<ffffffff8121e2e3>] vfs_read+0x83/0x130 [ 170.816930] [<ffffffff8121f035>] SyS_read+0x55/0xc0 ... ... [ 170.817185] ---[ end trace bc6eadf82b2b965a ]--- Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Cc: 4.2+ <stable@vger.kernel.org> # 4.2+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2015-10-08mmc: sdhci-of-at91: use SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST quirkludovic.desroches@atmel.com1-0/+1
The Atmel sdhci device needs the SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RST quirk. Without it, the internal clock could never stabilised when changing the sd clock frequency. Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-08mmc: sdhci: add quirk SDHCI_QUIRK2_NEED_DELAY_AFTER_INT_CLK_RSTludovic.desroches@atmel.com2-0/+7
The Atmel sdhci device needs a new quirk. sdhci_set_clock set the Clock Control Register to 0 before computing the new value and writing it. It disables the internal clock which causes a reset mecanism. If we write the new value before this reset mecanism is done, it will prevent the stabilisation of the internal clock, so a delay is needed. This delay is about 2-3 cycles of the base clock. To be safe, a 1 ms delay is used. Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-08mmc: sdhci-pxav3: fix error handling of armada_38x_quirksMarcin Wojtas1-1/+1
In case of armada_38x_quirks error, all clocks should be cleaned-up, same as after mv_conf_mbus_windows failure. Signed-off-by: Marcin Wojtas <mw@semihalf.com> Cc: <stable@vger.kernel.org> # v4.2 Reviewed-by: Gregory CLEMENT <gregory.clement@free-electrons.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-08mmc: sdhci-pxav3: disable clock inversion for HS MMC cardsNadav Haklai1-0/+3
According to 'FE-2946959' erratum the clock inversion option is needed to support slow frequencies when the card input hold time requirement is high. This setting is not required for high speed MMC and might cause timing violation. Signed-off-by: Nadav Haklai <nadavh@marvell.com> Cc: <stable@vger.kernel.org> # v4.2 Reviewed-by: Gregory CLEMENT <gregory.clement@free-electrons.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-08mmc: sdhci-pxav3: remove broken clock base quirk for Armada 38x sdhci driverNadav Haklai1-0/+1
shci-pxav3 driver is enabling by default the SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN quirk. However this quirk is not required for Armada 38x and leads to wrong clock setting in the divider. Signed-off-by: Nadav Haklai <nadavh@marvell.com> Signed-off-by: Marcin Wojtas <mw@semihalf.com> Cc: <stable@vger.kernel.org> # v4.2 Reviewed-by: Gregory CLEMENT <gregory.clement@free-electrons.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-08mmc: host: omap_hsmmc: Fix MMC for omap3 legacy bootingTony Lindgren1-3/+3
Starting with commit 7d607f917008 ("mmc: host: omap_hsmmc: use devm_regulator_get_optional() for vmmc") MMC on omap3 stopped working for legacy booting. This is because legacy booting sets up some of the resource in the platform init code, and for optional regulators always seem to return -EPROBE_DEFER for the legacy booting. Let's fix the issue by checking for device tree based booting for now. Then when omap3 boots in device tree only mode, this patch can be just reverted. Fixes: 7d607f917008 ("mmc: host: omap_hsmmc: use devm_regulator_get_optional() for vmmc") Cc: Felipe Balbi <balbi@ti.com> Cc: Kishon Vijay Abraham I <kishon@ti.com> Cc: Nishanth Menon <nm@ti.com> Cc: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Tony Lindgren <tony@atomide.com> Tested-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-08Revert "mmc: host: omap_hsmmc: use regulator_is_enabled to find pbias status"Tony Lindgren1-2/+6
This reverts commit c55d7a0553643a7e8f120688b82b594471084d3c. Without reverting this commit we get "unbalanced disables for pbias_mmc_omap4" errors on omap4430. It seems that 4430 and 4460 behave in a different way for the PBIAS regulator registers and until that has been debugged further we cannot rely on the regulator status registers in hardare on 4430. Fixes: 7d607f917008 ("mmc: host: omap_hsmmc: use devm_regulator_get_optional() for vmmc") Cc: Felipe Balbi <balbi@ti.com> Cc: Kishon Vijay Abraham I <kishon@ti.com> Cc: Nishanth Menon <nm@ti.com> Cc: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Tony Lindgren <tony@atomide.com> Tested-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2015-10-073w-9xxx: don't unmap bounce buffered commandsChristoph Hellwig1-7/+21
3w controller don't dma map small single SGL entry commands but instead bounce buffer them. Add a helper to identify these commands and don't call scsi_dma_unmap for them. Based on an earlier patch from James Bottomley. Fixes: 118c85 ("3w-9xxx: fix command completion race") Reported-by: Tóth Attila <atoth@atoth.sote.hu> Tested-by: Tóth Attila <atoth@atoth.sote.hu> Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Adam Radford <aradford@gmail.com> Signed-off-by: James Bottomley <JBottomley@Odin.com>
2015-10-07Merge tag 'fbdev-fixes-4.3' of ↵Linus Torvalds7-8/+26
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fixes from Tomi Valkeinen: - fbdev: Minor fixes to broadsheetfb, fsl-diu-fb, mb862xxfb, tridentfb, omapfb - display-timing: Fix memory leak in error path * tag 'fbdev-fixes-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: video: of: fix memory leak fbdev: broadsheetfb: fix memory leak OMAPDSS: panel-sony-acx565akm: Export OF module alias information fbdev: omap2: connector-dvi: use of_get_i2c_adapter_by_node interface tridentfb: Fix set_lwidth on TGUI9440 and CYBER9320 tridentfb: fix hang on Blade3D with CONFIG_CC_OPTIMIZE_FOR_SIZE video: fbdev: mb862xx: Fix module autoload for OF platform driver video: fbdev: fsl: Fix the sleep function for FSL DIU module
2015-10-07Merge tag 'regmap-fix-v4.3-rc4' of ↵Linus Torvalds1-3/+2
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "A couple of fixes for the debugfs information on the register map, fixing issues with very small reads potentially causing underflows and wraparounds" * tag 'regmap-fix-v4.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: debugfs: Don't bother actually printing when calculating max length regmap: debugfs: Ensure we don't underflow when printing access masks
2015-10-07Merge tag 'spi-fix-v4.3-rc4' of ↵Linus Torvalds1-3/+4
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of very minor fixes, one for error handling in the Davinci driver probe function and another making the Renesas sh-msiof DT binding documentation correspond to what's actually implemented" * tag 'spi-fix-v4.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: sh-msiof: Match renesas,rx-fifo-size in DT bindings doc with driver spi: davinci: fix handling platform_get_irq result
2015-10-07Merge tag 'regulator-fix-v4.3-rc4' of ↵Linus Torvalds2-2/+6
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Two fixes here, one device specific fix for axp20x and a core fix for cases where one regulator is supplying another which broke probe deferral, substituting in a dummy regulator too aggressively" * tag 'regulator-fix-v4.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: Handle probe deferral from DT when resolving supplies regulator: axp20x: Fix enable bit indexes for DCDC4 and DCDC5
2015-10-07video: of: fix memory leakSudip Mukherjee1-0/+1
If of_parse_display_timing() fails we are printing an error message and jumping to the error path but we missed freeing "dt". Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2015-10-07Merge remote-tracking branches 'spi/fix/davinci' and 'spi/fix/sh-msiof' into ↵Mark Brown1-3/+4
spi-linus
2015-10-07Merge tag 'for-linus-20151006' of git://git.infradead.org/linux-mtdLinus Torvalds2-18/+11
Pull MTD fixes from Brian Norris: "A few MTD fixes: - mxc_nand: a "refactoring only" change in 4.3-rc1 had some bad pointer (array) arithmetic. Fix that - sunxi_nand: - Fix an old list manipulation / memory management bug in the device release() code path - Correct a few mistakes in OOB write support" * tag 'for-linus-20151006' of git://git.infradead.org/linux-mtd: mxc_nand: fix copy_spare mtd: nand: sunxi: fix sunxi_nand_chips_cleanup() mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions
2015-10-06dm: fix request-based dm error reportingJunichi Nomura1-2/+3
end_clone_bio() is a endio callback for clone bio and should check and save the clone's bi_error for error reporting. However, 4246a0b63bd8 ("block: add a bi_error field to struct bio") changed the function to check the original bio's bi_error, which is 0. Without this fix, clone's error is ignored and reported to the original request as success. Thus data corruption will be observed. Fixes: 4246a0b63bd8 ("block: add a bi_error field to struct bio") Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2015-10-06Merge remote-tracking branch 'regulator/fix/axp20x' into regulator-linusMark Brown1-2/+2
2015-10-06Merge remote-tracking branch 'regulator/fix/core' into regulator-linusMark Brown1-0/+4
2015-10-05mcb: Fix error handling in mcb_pci_probe()Alexey Khoroshilov1-2/+4
If a MCB PCI Carrier device is IO mapped insted of memory-mapped, the memory of the PCI device is still not unmapped. Also the patch adds deallocation of the bus if chameleon_parse_cells() fails. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04staging: speakup: fix speakup-r regressioncovici@ccs.covici.com1-0/+1
Here is a patch to make speakup-r work again. It broke in 3.6 due to commit 4369c64c79a22b98d3b7eff9d089196cd878a10a "Input: Send events one packet at a time) The problem was that the fakekey.c routine to fake a down arrow no longer functioned properly and putting the input_sync fixed it. Fixes: 4369c64c79a22b98d3b7eff9d089196cd878a10a Cc: stable <stable@vger.kernel.org> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Signed-off-by: John Covici <covici@ccs.covici.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04drivers/tty: require read access for controlling terminalJann Horn1-4/+27
This is mostly a hardening fix, given that write-only access to other users' ttys is usually only given through setgid tty executables. Signed-off-by: Jann Horn <jann@thejh.net> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04serial: 8250: add uart_config entry for PORT_RT2880Mans Rullgard1-0/+8
This adds an entry to the uart_config table for PORT_RT2880 enabling rx/tx FIFOs. The UART is actually a Palmchip BK-3103 which is found in several devices from Alchemy/RMI, Ralink, and Sigma Designs. Signed-off-by: Mans Rullgard <mans@mansr.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04tty: fix data race on tty_buffer.commitDmitry Vyukov1-3/+12
Race on buffer data happens when newly committed data is picked up by an old flush work in the following scenario: __tty_buffer_request_room does a plain write of tail->commit, no barriers were executed before that. At this point flush_to_ldisc reads this new value of commit, and reads buffer data, no barriers in between. The committed buffer data is not necessary visible to flush_to_ldisc. Similar bug happens when tty_schedule_flip commits data. Update commit with smp_store_release and read commit with smp_load_acquire, as it is commit that signals data readiness. This is orthogonal to the existing synchronization on tty_buffer.next, which is required to not dismiss a buffer with unconsumed data. The data race was found with KernelThreadSanitizer (KTSAN). Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04tty: fix data race in tty_buffer_flushDmitry Vyukov1-1/+4
tty_buffer_flush frees not acquired buffers. As the result, for example, read of b->size in tty_buffer_free can return garbage value which will lead to a huge buffer hanging in the freelist. This is just the benignest manifestation of freeing of a not acquired object. If the object is passed to kfree, heap can be corrupted. Acquire visibility over the buffer before freeing it. The data race was found with KernelThreadSanitizer (KTSAN). Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04tty: fix data race in flush_to_ldiscDmitry Vyukov1-1/+1
flush_to_ldisc reads port->itty and checks that it is not NULL, concurrently release_tty sets port->itty to NULL. It is possible that flush_to_ldisc loads port->itty once, ensures that it is not NULL, but then reloads it again and uses. The second load can already return NULL, which will cause a crash. Use READ_ONCE to read port->itty. The data race was found with KernelThreadSanitizer (KTSAN). Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.cKosuke Tatsukawa1-10/+5
My colleague ran into a program stall on a x86_64 server, where n_tty_read() was waiting for data even if there was data in the buffer in the pty. kernel stack for the stuck process looks like below. #0 [ffff88303d107b58] __schedule at ffffffff815c4b20 #1 [ffff88303d107bd0] schedule at ffffffff815c513e #2 [ffff88303d107bf0] schedule_timeout at ffffffff815c7818 #3 [ffff88303d107ca0] wait_woken at ffffffff81096bd2 #4 [ffff88303d107ce0] n_tty_read at ffffffff8136fa23 #5 [ffff88303d107dd0] tty_read at ffffffff81368013 #6 [ffff88303d107e20] __vfs_read at ffffffff811a3704 #7 [ffff88303d107ec0] vfs_read at ffffffff811a3a57 #8 [ffff88303d107f00] sys_read at ffffffff811a4306 #9 [ffff88303d107f50] entry_SYSCALL_64_fastpath at ffffffff815c86d7 There seems to be two problems causing this issue. First, in drivers/tty/n_tty.c, __receive_buf() stores the data and updates ldata->commit_head using smp_store_release() and then checks the wait queue using waitqueue_active(). However, since there is no memory barrier, __receive_buf() could return without calling wake_up_interactive_poll(), and at the same time, n_tty_read() could start to wait in wait_woken() as in the following chart. __receive_buf() n_tty_read() ------------------------------------------------------------------------ if (waitqueue_active(&tty->read_wait)) /* Memory operations issued after the RELEASE may be completed before the RELEASE operation has completed */ add_wait_queue(&tty->read_wait, &wait); ... if (!input_available_p(tty, 0)) { smp_store_release(&ldata->commit_head, ldata->read_head); ... timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); ------------------------------------------------------------------------ The second problem is that n_tty_read() also lacks a memory barrier call and could also cause __receive_buf() to return without calling wake_up_interactive_poll(), and n_tty_read() to wait in wait_woken() as in the chart below. __receive_buf() n_tty_read() ------------------------------------------------------------------------ spin_lock_irqsave(&q->lock, flags); /* from add_wait_queue() */ ... if (!input_available_p(tty, 0)) { /* Memory operations issued after the RELEASE may be completed before the RELEASE operation has completed */ smp_store_release(&ldata->commit_head, ldata->read_head); if (waitqueue_active(&tty->read_wait)) __add_wait_queue(q, wait); spin_unlock_irqrestore(&q->lock,flags); /* from add_wait_queue() */ ... timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); ------------------------------------------------------------------------ There are also other places in drivers/tty/n_tty.c which have similar calls to waitqueue_active(), so instead of adding many memory barrier calls, this patch simply removes the call to waitqueue_active(), leaving just wake_up*() behind. This fixes both problems because, even though the memory access before or after the spinlocks in both wake_up*() and add_wait_queue() can sneak into the critical section, it cannot go past it and the critical section assures that they will be serialized (please see "INTER-CPU ACQUIRING BARRIER EFFECTS" in Documentation/memory-barriers.txt for a better explanation). Moreover, the resulting code is much simpler. Latency measurement using a ping-pong test over a pty doesn't show any visible performance drop. Signed-off-by: Kosuke Tatsukawa <tatsu@ab.jp.nec.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04serial: atmel: fix error path of probe functionUwe Kleine-König1-1/+1
If atmel_init_gpios fails the port has already been marked as busy (in line 2629), so this must be undone in the error path. This bug was introduced because I created the patch that finally became 722ccf416ac2 ("serial: atmel: fix error handling when mctrl_gpio_init fails") on top of 3.19 which didn't have commit 6fbb9bdf0f3f ("tty/serial: at91: fix error handling in atmel_serial_probe()") yet. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Fixes: 722ccf416ac2 ("serial: atmel: fix error handling when mctrl_gpio_init fails") Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04tty: don't leak cdev in tty_cdev_add()Leon Yu1-2/+7
Commit a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly dynamic") which mixes using cdev_alloc() and cdev_init() is problematic. Subsequent call to cdev_init() after cdev_alloc() sets kobj release method from cdev_dynamic_release() to cdev_default_release() and thus makes it impossible to free allocated cdev. This patch also consolidates error path of cdev_add() as cdev can also leak here if things went wrong. Signed-off-by: Leon Yu <chianglungyu@gmail.com> Fixes: a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly dynamic") Acked-by: Richard Watts <rrw@kynesim.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04Revert "serial: imx: remove unbalanced clk_prepare"Fabio Estevam1-6/+14
This reverts commit 9e7b399d6528eac33a6fbfceb2b92af209c3454d. Commit ("9e7b399d6528ea") causes the following warning and sometimes also hangs the system: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/locking/mutex.c:868 mutex_trylock+0x20c/0x22c() DEBUG_LOCKS_WARN_ON(in_interrupt()) Modules linked in: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.0-rc7-next-20150818-00001-g14418a6 #4 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Backtrace: [<80012f08>] (dump_backtrace) from [<800130a4>] (show_stack+0x18/0x1c) r6:00000364 r5:00000000 r4:00000000 r3:00000000 [<8001308c>] (show_stack) from [<807902b8>] (dump_stack+0x88/0xa4) [<80790230>] (dump_stack) from [<8002a604>] (warn_slowpath_common+0x80/0xbc) r5:807945c4 r4:80ab3b50 [<8002a584>] (warn_slowpath_common) from [<8002a6e4>] (warn_slowpath_fmt+0x38/0x40) r8:00000000 r7:8131100c r6:8054c3cc r5:8131300c r4:80b0a570 [<8002a6b0>] (warn_slowpath_fmt) from [<807945c4>] (mutex_trylock+0x20c/0x22c) r3:8095d0d8 r2:8095ab28 [<807943b8>] (mutex_trylock) from [<8054c3cc>] (clk_prepare_lock+0x14/0xf4) r7:8131100c r6:be3f0c80 r5:00000037 r4:be3f0c80 [<8054c3b8>] (clk_prepare_lock) from [<8054dbfc>] (clk_prepare+0x18/0x30) r5:00000037 r4:be3f0c80 [<8054dbe4>] (clk_prepare) from [<8036a600>] (imx_console_write+0x30/0x244) r4:812d0bc8 r3:8132b9a4 To reproduce the problem we only need to let the board idle for something like 30 seconds. Tested on a imx6q-sabresd. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Reviewed-by: Eduardo Valentin <edubezval@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04mei: hbm: fix error in state check logicAlexander Usyskin1-1/+1
Use || instead && in state check. The latter is bogus and leads to following warning: drivers/misc/mei/hbm.c:1212:46: warning: logical ‘and’ of mutually exclusive tests is always false [-Wlogical-op] Fixes: 70ef835c84b3 ("mei: support for dynamic clients") Reported-by: David Binderman <dcb314@hotmail.com> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04nvmem: sunxi: Check for memory allocation failureMaxime Ripard1-1/+10
The sunxi_sid driver doesn't check for kmalloc return status before derefencing the returned pointer, which could lead to a NULL pointer dereference if kmalloc failed. Check for its return code to make sure it deosn't happen. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-04nvmem: core: Fix memory leak in nvmem_cell_writeAxel Lin1-1/+1
A tmp buffer is allocated if cell->bit_offset || cell->nbits. So the tmp buffer needs to be freed at the same condition to avoid leak. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-22 23:41:27 +0000