Commit graph

427952 commits

Author SHA1 Message Date
Malcolm Priestley
ebf5a3ccdf staging: vt6656: struct vnt_usb_send_context struct size optimization.
Reorder in size and remove dead member Next.

Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
599e4b5ca8 staging: vt6656: Remove pointer cast to urb->context.
Remove unnecessary cast to void * urb->context

Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
0b787d713b staging: vt6656: Cleanup PIPEnsBulkInUsbRead
Remove camel case and white space.

Camel case changes
pDevice -> priv
pRCB -> rcb
ntStatus -> status
pUrb -> urb

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
d4fa2ab067 staging: vt6656: clean up s_nsBulkInUsbIoCompleteRead
Clean up white space and camel case.

Camel case changes
pDevice -> priv
pRCB -> rcb
bReAllocSkb -> re_alloc_skb

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
67638980ef staging: vt6656: s_nsBulkInUsbIoCompleteRead Replace error handling.
Use switch on urb->status

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
1882c19c2d staging: vt6656: s_nsBulkInUsbIoCompleteRead Remove bytesRead/bIndicateReceive.
Replace with urb->actual_length.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
e3a8fa1748 staging: vt6656: s_nsBulkInUsbIoCompleteRead get rid of status.
Just use urb->status directly.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
3f38290e3b staging: vt6656: clean up PIPEnsSendBulkOut.
Remove commented out code, white space and camel case.

camel case changes
pDevice -> priv
pContext -> context
pUrb -> urb

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
da5c99fdf5 staging: vt6656: usb_fill_bulk_urb get rid of void* cast.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Malcolm Priestley
133383035f staging: vt6656: PIPEnsSendBulkOut reverse if statement
Get rid of unnessary else statement by !(MP_IS_READY(pDevice) &&
pDevice->Flags & fMP_POST_WRITES)

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 13:04:36 -08:00
Mark Hounschell
6c8b84efe5 staging: dgap: fix kernel oops on port open
This patch addresses the follow error message followed
by a kernel oops:

dgap: driver does not set tty->port. This will crash the kernel later. Fix the driver

It also renames the main function this patch addresses because
its name is misleading.

Signed-off-by: Mark Hounschell <markh@compro.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:58:16 -08:00
Masanari Iida
d7a078b827 staging: rtl8821ae: Fix C99 style comments in pci.c and pci.h
This patch fix C99 style comments in pci.c and pci.h

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:44:26 -08:00
Masanari Iida
977d68c320 staging: rtl8821ae: Fix C99 style comments in efuse.c
Fix C99 style comments in efuse.c.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:44:26 -08:00
Masanari Iida
fc4d82c057 staging: rtl8821ae: Fix typo in rtl8821ae/btcoexist
Fix spelling typo in rtl8821ae/btcoexist.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:44:26 -08:00
Masanari Iida
1d80d8426d staging: rtl8821ae: Fix typo in rtl8821ae/rtl8821ae.
Fix spelling typo in comment and printk within
rtl8821ae/rtl8821ae.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:44:26 -08:00
Masanari Iida
da4d20162c staging: rtl8821ae: Fix typo in comment and printk in rtl8821ae
Fix spelling typo in comment and printk within rtl8821ae.

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:44:26 -08:00
Philipp Zabel
628f435be4 imx-drm: parallel-display: Add drm_panel support
This patch allows to optionally attach the parallel-display to a panel
supported by a drm_panel driver instead of supplying the modes via
device tree.

Before:
	parallel-display {
		compatible = "fsl,imx-parallel-display";
		...

		display-timings {
			native-timing = <&timing1>;
			timing1: etm0700g0dh6 {
				hactive = <800>;
				vactive = <480>;
				clock-frequency = <33260000>;
				hsync-len = <128>;
				hback-porch = <88>;
				hfront-porch = <40>;
				vsync-len = <2>;
				vback-porch = <33>;
				vfront-porch = <10>;
				hsync-active = <0>;
				vsync-active = <0>;
				...
			};
		};
		...
	};

After:
	parallel-display {
		compatible = "fsl,imx-parallel-display";
		fsl,panel = <&panel>;
		...
	};

	panel: panel {
		compatible = "edt,etm0700g0dh6", "simple-panel";
	};

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:43:36 -08:00
Philipp Zabel
1f15b69b59 imx-drm: ipu-dc: Use usleep_range instead of msleep
Since msleep(2) can sleep up to 20ms anyway, make this explicit by using
usleep_range(2000, 20000).

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:41:10 -08:00
Philipp Zabel
7f4392aa87 imx-drm: Move IPU_PIX_FMT_GBR24 definition into imx-ipu-v3.h
The IPU display controller supports a non-standard green-red-blue ordered
format that is used on the connection between IPU display interface 1 and
the TV encoder on i.MX53.
In preparation for the move of IPU core code out of staging, place the
IPU_PIX_FMT_GBR24 definition in imx-ipu-v3.h, so that both the IPU
display interface driver and the TVE encoder driver can access it.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:41:10 -08:00
Monam Agarwal
fe5d2e012a Staging: panel: Fix quoted string split across line in panel.c
This patch fixes the following checkpatch.pl warning in panel.c:
WARNING: quoted string split across lines

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:29:24 -08:00
Monam Agarwal
68d386bf3f Staging: panel: Fix space prohibited between function name and open paranthesis
This patch fixes the following checkpatch.pl issues in panel.c:
WARNING: space prohibited between function name and open parenthesis '('

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:29:24 -08:00
Ana Rey
7fba0100f2 staging: rtl8187se: Clean-up comment line style in r8180_core.c
This patch clean-up comment-line style in r8180_core.c as the CodingStyle
recommends.

Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:16:50 -08:00
Silvan Jegen
ffb8cc92a7 Staging: rtl8192e: Replace min macro with min_t
Instead of an explicit cast the min_t macro should be used.

Signed-off-by: Silvan Jegen <s.jegen@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:16:50 -08:00
Ana Rey
56f1411415 staging: rtl8187se: Convert CHANNEL_LIST typedef into a struct.
The Documentation/CodingStyle doesn't recommend the use of typedef, convert
this to structure.

While at it, I have also renamed the variable names that were used in
this typedef not to use Hungarian notation.

Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:16:50 -08:00
Ana Rey
899e5f9beb staging: rtl8187se: Deleted rtl8180_len2duration functions in r8180_core.c
After the next warning messages by sparse tools:

drivers/staging/rtl8187se/r8180_core.c:1621:5: warning: symbol 'rtl8180_len2duration' was not declared. Should it be static?
drivers/staging/rtl8187se/r8180_core.c:1621:12: warning: ‘rtl8180_len2duration’ defined but not used [-Wunused-function]
 static u16 rtl8180_len2duration(u32 len, short rate, short *ext)
            ^

And the next search:
$ grep -ir rtl8180_len2duration ./*
./r8180_core.c:u16 rtl8180_len2duration(u32 len, short rate, short *ext)
Binary file ./r8187se.ko matches
Binary file ./r8187se.o matches

I decided to delete rtl8180_len2duration function.

Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 12:16:50 -08:00
Alex Deucher
3803c8e5b5 drm/radeon: enable speaker allocation setup on dce3.2
Now that we disable audio while setting up the audio
hw, we should be able to set this up without hangs.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
2014-02-27 14:21:37 -05:00
Alex Deucher
832eafaf34 drm/radeon: change audio enable logic
Disable audio around audio hw setup.  This may avoid
hangs on certain asics.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
2014-02-27 14:21:31 -05:00
Alex Deucher
d7eb0a0940 drm/radeon: fix audio disable on dce6+
Properly clear the enable bit when audio disable is requested.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Cc: stable@vger.kernel.org
2014-02-27 14:13:06 -05:00
John Stultz
d0bdff0db8 staging: Fix build issues with new binder API
The new 64bit binder API causes build issues on 32bit ARM
due to the lack of 64bit __get_user_asm_* implementation.

Until that implementation is done, remove the choice for
32bit ARM, automatically enabling the old 32bit binder
protocol.

This can be reverted once a 64bit __get_user_asm_*
implementation is merged.

Cc: Colin Cross <ccross@android.com>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Serban Constantinescu <serban.constantinescu@arm.com>
Cc: Android Kernel Team <kernel-team@android.com>
Reported-by: Arnd Bergmann <arnd.bergmann@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 11:12:24 -08:00
Jerome Glisse
d965441342 drm/radeon: free uvd ring on unload
Need to free the uvd ring. Also reshuffle gart tear down to
happen after uvd tear down.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-02-27 14:10:35 -05:00
Alex Deucher
9ef4e1d000 drm/radeon: disable pll sharing for DP on DCE4.1
Causes display problems.  We had already disabled
sharing for non-DP displays.

Based on a patch from:
Niels Ole Salscheider <niels_ole@salscheider-online.de>

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=58121

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2014-02-27 14:10:34 -05:00
Christian König
5e386b574c drm/radeon: fix missing bo reservation
Otherwise we might get a crash here.

Signed-off-by: Christian König <christian.koenig@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-02-27 14:05:28 -05:00
Alex Deucher
9f050c7f97 drm/radeon: print the supported atpx function mask
Print the supported functions mask in addition to
the version.  This is useful in debugging PX
problems since we can see what functions are available.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2014-02-27 14:05:27 -05:00
Linus Torvalds
86c7654f4a Metag arch and asm-generic fixes for v3.14
- Add the new sched_setattr/sched_getattr syscalls to the asm-generic
   syscall list, which is used by arc, arm64, c6x, hexagon, metag,
   openrisc, score, tile, and unicore32.
 
 - An IRQ affinity bug fix for metag to prevent interrupts being vectored
   to offline CPUs when their affinity is changed via /proc/irq/ (thanks
   tglx).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.13 (GNU/Linux)
 
 iQIcBAABAgAGBQJTDwkFAAoJEKHZs+irPybfR/wP/RP4hhdad9i+Poc86PAj0vGT
 6KyNgUifceh9WfQbHom84GvBnhLB66J2Uc4uUX6F+xdUmPUvhhn4Nac39c4exMnf
 klWoqcKkm8jb1kGLVuUdlgSssqLudEca/C5ArbOpZfvVwQxFf+WNpyWUNsNlvS/I
 M1chio/jyWewVq2K4CmB/ZdoQ8lC7EVKH1FwCuMOsV9h7M32eqvpQgopSiKnKFw1
 0o9a775PUvEK9PvEMa16ALShjch72ATFM9cVgFULr9M3BjHCn2H/jaNBzAhBLGSa
 +sAcgFBQumLrK1HqyThW7Fm5rXQwMuru3nHYevBFXwLKrVSMjqN+tfCEY4oLGwSz
 ywGc0rqNR7AuBzL/dnsjdBNhg30rvMIvWb/F6o/SM2IJNvnQjNJbKA97qdCqOevH
 hpyycx/zAbEtX/8hsPHRkCNg9+Ms0wcH9NJ8u5ul24WVAd1rYCcgmHWNdIFpkE9G
 fA6qckAye9/3xREi7gA50sl02Dxq4xyYaAfv72lOLEy+MIK/e8xMJL+PuI2eVt+g
 J0AsjmuVNuNPK64eohmBBgXsS+7czMTuaHvHOCP6897bipUHAzx//UC347WOar1p
 LvbLUpK9T5YGUxfoZ/ZlD8hi9myxKqIFNJnfJRwIhMpkYebFkqOsYRYXuZ6zPtDT
 haQisQWsM7eLTMe9qRr+
 =fVZo
 -----END PGP SIGNATURE-----

Merge tag 'metag-fixes-v3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag

Pull Metag arch and asm-generic fixes from James Hogan:

 - Add the new sched_setattr/sched_getattr syscalls to the asm-generic
   syscall list, which is used by arc, arm64, c6x, hexagon, metag,
  openrisc, score, tile, and unicore32.

 - An IRQ affinity bug fix for metag to prevent interrupts being
   vectored to offline CPUs when their affinity is changed via
   /proc/irq/ (thanks tglx).

* tag 'metag-fixes-v3.14' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag:
  irq-metag*: stop set_affinity vectoring to offline cpus
  asm-generic: add sched_setattr/sched_getattr syscalls
2014-02-27 10:54:52 -08:00
Linus Torvalds
3ebd3da699 pwm: Fixes for v3.14-rc5
Just a single trivial patch to plug a memory leak in an error path.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTDgK7AAoJEN0jrNd/PrOh6c4P/iBytP1gTlfTjleUO5/2n0vt
 ILn6JWPoYx9hP+Zt+rjGqezIHAc60exGyANJOf8T+/BU9moHVHK9uCEzEu0vP8SR
 qQyVxhXC55xL/6aHrQWtD47q13PNG989MGC4W/jWkPHbvtxg0YzWAu/Nq12ueZA8
 vmkQKLVBG1Z9YQ9u1c4H4cP5XkLCZWTZAnImpcX35Nop74bTtOg+izoWm+3Yrt+K
 vHlonTE7DsYdrjDoD+c0b1FjE7F376ywJAh9zEJox0OR+wLOdKCTqA6/qSwuv8dR
 l5DLUbbmeTD+gOLEjDYcAw5FDmYDC5KygM7PtS7M+wmaHISHATlTlosmbozukbu/
 Xit/IeRYRF+6t1JejO2cMGGZuDJ9uT1rKVl5KqA6mVAlrsYuFK+uzCcXNv6KwNxK
 VrUG76KlBmy7ALn3dCBw6+dqFwmxBRUkRjaPByF9nvCAqBNud/uWVvfDGFF+dgo4
 j1SKOrRq9N89uwYQpofLsLeVCWqm8QTbUuNLkz6z23xy2hItDYupLn0DRj2ND3ud
 qF3QnEGx515ZlShAgkzkGCu6kRXMuUHAIMd7juZVjp5HDJJXK23zktSxflley5yX
 Za8nRtIlM716TJxXQuJIjW14BKDmdoBvy/SRuGfa+lywfrgMKwndWHIt9VD5QLYo
 xF6gRl4CuZqRuxF8RRbw
 =zhst
 -----END PGP SIGNATURE-----

Merge tag 'pwm/for-3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm

Pull pwm fix from Thierry Reding:
 "Just a single trivial patch to plug a memory leak in an error path"

* tag 'pwm/for-3.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm:
  pwm: lp3943: Fix potential memory leak during request
2014-02-27 10:54:20 -08:00
Linus Torvalds
8d7531825c Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull filesystem fixes from Jan Kara:
 "Notification, writeback, udf, quota fixes

  The notification patches are (with one exception) a fallout of my
  fsnotify rework which went into -rc1 (I've extented LTP to cover these
  cornercases to avoid similar breakage in future).

  The UDF patch is a nasty data corruption Al has recently reported,
  the revert of the writeback patch is due to possibility of violating
  sync(2) guarantees, and a quota bug can lead to corruption of quota
  files in ocfs2"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fsnotify: Allocate overflow events with proper type
  fanotify: Handle overflow in case of permission events
  fsnotify: Fix detection whether overflow event is queued
  Revert "writeback: do not sync data dirtied after sync start"
  quota: Fix race between dqput() and dquot_scan_active()
  udf: Fix data corruption on file type conversion
  inotify: Fix reporting of cookies for inotify events
2014-02-27 10:37:22 -08:00
Linus Torvalds
bb7d43b149 Just a single fix for the UBI module unload path which makes sure we do not
touch freed memory.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTDdwqAAoJECmIfjd9wqK0+LUP/35Ds9kdee6XawmaVCFegmgJ
 FeW+2yBwwZyHqY77xkjZy2nrl7A9+LSzGnQocQdsHBy2PKtqlrt+ksx2Vz83nk3g
 Qtqzzz3uW7iiWSz6vI3PuD1Ye4Z6ebvq5IFeSnInBMTBZUGY+bdX+wWZe/xtuXAh
 a67nynajQRXWotg58WRJD0MUXYNbPY3S174NHr3BQV7DMzqtZyOiZmVDd1uIFIbu
 5JNyXxCprydey0lFvDef7oVueCk/VD9mQha2ogYizta4NR+gjuTjQWdyTxXvri+A
 48gQHEXAWgRR7YBeiOWeUvHquNL4G6im+HoXNwJ93IK19xY5UeGU/MuyPJzhqPNc
 ysxdDOi760Vggdc86Yx//+8W5EnSA3q0vnIKRGA+oWeZxR9Y+83Eg87bRFVa9Zdi
 TpvdegXzj/ZCwx3AKVAb2NBfrcQP8RucVHw8CsNY7a1WfpKL/k70JWqbGeGkp/iB
 LZyQQjOmweUv6h41wOrsvJHNeKKuUi280tP2Eck1KPebfI8kZCpjV3rqaqxdTIYB
 5l0+eI2JFD4KIsJr0Xv+QjDwRO+wKXXGUKcsj0FlEzzIK5b7iV7jKRYfYw0VRg/X
 ZCtO16nBZ+mmGt6kyEoToOt+YhOoqGL/HglbXUxvjRQL19LwpRbINvN/54f5idGy
 J1IXvzLyhkxO8s48QWmD
 =J2Up
 -----END PGP SIGNATURE-----

Merge tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs

Pull ubifs fix from Artem Bityutskiy:
 "Just a single fix for the UBI module unload path which makes sure we
  do not touch freed memory"

* tag 'upstream-3.14-rc5' of git://git.infradead.org/linux-ubifs:
  UBI: fix some use after free bugs
2014-02-27 10:36:50 -08:00
Andrew Honig
a08d3b3b99 kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
The problem occurs when the guest performs a pusha with the stack
address pointing to an mmio address (or an invalid guest physical
address) to start with, but then extending into an ordinary guest
physical address.  When doing repeated emulated pushes
emulator_read_write sets mmio_needed to 1 on the first one.  On a
later push when the stack points to regular memory,
mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.

As a result, KVM exits to userspace, and then returns to
complete_emulated_mmio.  In complete_emulated_mmio
vcpu->mmio_cur_fragment is incremented.  The termination condition of
vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
The code bounces back and fourth to userspace incrementing
mmio_cur_fragment past it's buffer.  If the guest does nothing else it
eventually leads to a a crash on a memcpy from invalid memory address.

However if a guest code can cause the vm to be destroyed in another
vcpu with excellent timing, then kvm_clear_async_pf_completion_queue
can be used by the guest to control the data that's pointed to by the
call to cancel_work_item, which can be used to gain execution.

Fixes: f78146b0f9
Signed-off-by: Andrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org (3.5+)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-02-27 19:35:22 +01:00
Marc Zyngier
b20c9f29c5 arm/arm64: KVM: detect CPU reset on CPU_PM_EXIT
Commit 1fcf7ce0c6 (arm: kvm: implement CPU PM notifier) added
support for CPU power-management, using a cpu_notifier to re-init
KVM on a CPU that entered CPU idle.

The code assumed that a CPU entering idle would actually be powered
off, loosing its state entierely, and would then need to be
reinitialized. It turns out that this is not always the case, and
some HW performs CPU PM without actually killing the core. In this
case, we try to reinitialize KVM while it is still live. It ends up
badly, as reported by Andre Przywara (using a Calxeda Midway):

[    3.663897] Kernel panic - not syncing: unexpected prefetch abort in Hyp mode at: 0x685760
[    3.663897] unexpected data abort in Hyp mode at: 0xc067d150
[    3.663897] unexpected HVC/SVC trap in Hyp mode at: 0xc0901dd0

The trick here is to detect if we've been through a full re-init or
not by looking at HVBAR (VBAR_EL2 on arm64). This involves
implementing the backend for __hyp_get_vectors in the main KVM HYP
code (rather small), and checking the return value against the
default one when the CPU notifier is called on CPU_PM_EXIT.

Reported-by: Andre Przywara <osp@andrep.de>
Tested-by: Andre Przywara <osp@andrep.de>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Rob Herring <rob.herring@linaro.org>
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-02-27 19:27:10 +01:00
Mike Snitzer
7d48935eff dm thin: allow metadata space larger than supported to go unused
It was always intended that a user could provide a thin metadata device
that is larger than the max supported by the on-disk format.  The extra
space would just go unused.

Unfortunately that never worked.  If the user attempted to use a larger
metadata device on creation they would get an error like the following:

 device-mapper: space map common: space map too large
 device-mapper: transaction manager: couldn't create metadata space map
 device-mapper: thin metadata: tm_create_with_sm failed
 device-mapper: table: 252:17: thin-pool: Error creating metadata object
 device-mapper: ioctl: error adding target to table

Fix this by allowing the initial metadata space map creation to cap its
size at the max number of blocks supported (DM_SM_METADATA_MAX_BLOCKS).
get_metadata_dev_size() must also impose DM_SM_METADATA_MAX_BLOCKS (via
THIN_METADATA_MAX_SECTORS), otherwise extending metadata would cap at
THIN_METADATA_MAX_SECTORS_WARNING (which is larger than supported).

Also, the calculation for THIN_METADATA_MAX_SECTORS didn't account for
the sizeof the disk_bitmap_header.  So the supported maximum metadata
size is a bit smaller (reduced from 33423360 to 33292800 sectors).

Lastly, remove the "excess space will not be used" warning message from
get_metadata_dev_size(); it resulted in printing the warning multiple
times.  Factor out warn_if_metadata_device_too_big(), call it from
pool_ctr() and maybe_resize_metadata_dev().

Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <ejt@redhat.com>
2014-02-27 11:49:08 -05:00
Monam Agarwal
f5bde4476b Staging: cxt1e1: Fix line length over 80 characters in functions.c
This patch fixes the following checkpatch.pl warning in functions.c
WARNING: Line length over 80 characters

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:39:27 -08:00
Monam Agarwal
08e624a092 Staging: cxt1e1: Fix space prohibited between function name and open parenthesis '('
This patch fixes the following checkpatch.pl warning in functions.c
WARNING: space prohibited between function name and open parenthesis '('

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:39:27 -08:00
Monam Agarwal
bc4d6dafa5 Staging: cxt1e1: Fix no spaces at the start of a line in functions.c
This patch fixes the following checkpatch.pl warning in functions.c
WARNING: please no spaces at the start of a line in

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:39:27 -08:00
Daeseok Youn
223eaa377d staging: ced401: fix double unlock bug
After spin_lock() is called, all of if-else conditions in this brace
should reach the end of else and spin_unlock() must be called.
So It doesn't need to call spin_unlock() without a return statement
for handling an error.

Also sparse says:
drivers/staging/ced1401/usb1401.c:1080:28: warning:
 context imbalance in 'Handle1401Esc' - unexpected unlock

Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daeseok Youn <daeseok.youn@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:39:27 -08:00
Chase Southwood
ea6ff788fe Staging: comedi: addi-data: clean-up variable use in hwdrv_apci035.c
The variable ui_Command is as of right now being cleared to a
value of zero between everytime that it writes to a port and then takes a
new value from a port.  Seems like this zeroing is unnecessary, so we can
just remove these lines.

Signed-off-by: Chase Southwood <chase.southwood@yahoo.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:38:12 -08:00
Kumar Amit Mehta
c095fad35e staging: comedi: drivers: fix for a potential NULL pointer dereference
Return -ENOMEM in ni_E_init if ni_gpct_device_construct returns NULL

Signed-off-by: Kumar Amit Mehta <gmate.amit@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:38:12 -08:00
Monam Agarwal
0cb4c151c3 Staging: comedi: Fix unnecessary space after function pointer
This patch fixes the following checkpatch.pl warning in comedidev.h
WARNING: Fix unnecessary space after function pointer

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-27 08:38:12 -08:00
Ingo Molnar
b6e53f321e perf/urgent fixes:
. Fix annotation on stdio/GTK+ interfaces (Namhyung Kim)
 
 . Fix file descriptor leaking while searching DSOs for suitable symtab (Namhyung Kim).
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTC5StAAoJENZQFvNTUqpAzkAP/itdo0ORFbRxhV3LZSDrjw38
 UqzaDCUueZS7Uz4JJT2RPegOZydEoNRDzaPDfJayfuRlRKNqM6jN59QaNTGCbqJa
 p738wuLhRRDAGH6w+ilbW52pN6SiA9p33llWFmm8KocrurPNSQQP/40Ea7UjMPAT
 Rn/vFyR/sLbamISv5y1r6PRuYj+dnpRdPaJsM9d4tPCzw0URMvE76JzhKkMyDve5
 0vlaCezsPb+caJhsaa3Qn5zsqMQ6WDL7feNA1dGVidDUZ+OpQVkf9SS4t+vqSVB8
 3S6ISalveIfVxsmc+WOEq2rPEwtxK5ng2PxlUq/bOBGKoGHfPVS6ev3etTtaD+OC
 ByrCCCdRqlQ3LYqsZX/4QvGW0mF91BHpF0cLr1cV1bKLDdeZ5ART6hwI0AZLJvk/
 qV1zkTBxphq7Nyh2q1KUHK5d2KyVOUh8KhmnUXLMWX5w87rkAVh8rawH/ZghPBPn
 WfPbkf3Dzk5yghc9PIiaPKmxPl1ijW0/ylh+FksfOOAZi7TOj6b/zZ96A5r020Xh
 ouGho81yVpCqZ41oljI2VsPQXDDPthw2VVzfLtVGQKPbeTbvtFU0ygau+RqitcoZ
 rxZvWXK1I4szAhIvD3RjiJnNaIRexXzOvGYEVXm1pm/67DzPIrY7hOUvccmoBj/F
 yVVMOeRpvxQ9oz3Scegn
 =MmHA
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent

Pull perf/urgent fixes from Arnaldo Carvalho de Melo:

  * Fix annotation on stdio/GTK+ interfaces (Namhyung Kim)

  * Fix file descriptor leaking while searching DSOs for suitable symtab (Namhyung Kim).

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2014-02-27 12:47:59 +01:00
Takashi Iwai
997e7547ab ASoC: Updates for v3.14
A few more driver specific bug fixes, all driver specific things that
 only affect users of those devices.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTDyNMAAoJELSic+t+oim9ar0P/2J7YHzqD/gs9SR4ufqr2JK9
 yudP5Stt81np6IZwJHJTF3n33RMXTanAdaFr5usJn0Mn8THuMzL6vCOr9zhoEOxu
 j3HDvR6rLnVQ9N0Cw9L7uM+goQzbw3N/rAfyUd6UckT1raKCErtLRZvvb7BV9FLX
 gu3K3b4w7LtTYqoFPPGpxjTENwNkX5rNWD5egDVnaiL9maAoCUal9HtznDSLu0pa
 uo8ggJRXEQYXAQ1rpEvSKwwYrZ2fQ3IxTMi3ucm9KxGvO3xyK/aXt32yp0qH5Poz
 v3FWDbXU8DsVYFXlRNrAIiAuMERBCsZQHismp3mt/yn+IOvcJHNVeRSJbIROddRr
 TCU7vo/OoBzsN5BJ4McoHtmfJXKaN+xY5yJJ7xczBcYPcfQlIXiXZbSJC8WNFVet
 MlNcvqpVzo9BIXwrGDbPofUBiruyOcbXg79QW1xWfR122BNoF2Ut+dKfXsoXfW5Y
 oETCw5oMO4dOifLvWp+0q0GXOG0EK1fqiHoHxhU/fksr/WQeJS7bplixXpPZoiqV
 PC6RKnFEeMHMdFmPyo7kQ94KVn4uQ/SomL+MQUIi+7+e2iC0vqql2A5kmE9iO+dS
 V7KuVgwcQ3QkIHEVeHKwKH3ETsKB7yktqlnqysPgwAf8fNKeokNk7eALsxkeSkt3
 b00TyEOk9oRYPlhmpcTd
 =GL3V
 -----END PGP SIGNATURE-----

Merge tag 'asoc-v3.14-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v3.14

A few more driver specific bug fixes, all driver specific things that
only affect users of those devices.
2014-02-27 12:46:25 +01:00
Peter Zijlstra
e3703f8cdf perf: Fix hotplug splat
Drew Richardson reported that he could make the kernel go *boom* when hotplugging
while having perf events active.

It turned out that when you have a group event, the code in
__perf_event_exit_context() fails to remove the group siblings from
the context.

We then proceed with destroying and freeing the event, and when you
re-plug the CPU and try and add another event to that CPU, things go
*boom* because you've still got dead entries there.

Reported-by: Drew Richardson <drew.richardson@arm.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/n/tip-k6v5wundvusvcseqj1si0oz0@git.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2014-02-27 12:38:03 +01:00