linux-stable.git/drivers/misc, branch v3.16.35

drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors

2016-04-30T22:05:52+00:00

commit f3df53e4d70b5736368a8fe8aa1bb70c1cb1f577 upstream.

Fix RDAC read back errors caused by a typo. Value must shift by 2.

Fixes: a4bd394956f2 ("drivers/misc/ad525x_dpot.c: new features")
Signed-off-by: Michael Hennerich 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

mei: fix format string in debug prints

2016-04-30T22:05:49+00:00

commit 35bf7692e765c2275bf93fe573f7ca868ab73453 upstream.

buf_idx type was changed to size_t, and few places
missed out to change the print format from %ld to %zu.
Use also uz for buf.size which is also of size_t

Fixes:
commit 56988f22e097 ("mei: fix possible integer overflow issue")'

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

mei: fix possible integer overflow issue

2016-04-30T22:05:49+00:00

commit f862b6b24f0ffd954633a55f39251a6873b664ca upstream.

There is a possible integer overflow following by a buffer overflow
when accumulating messages coming from the FW to compose a full payload.
Occurrence of wrap around has to be prevented for next message size
calculation.
For unsigned integer the addition overflow has occurred when the
result is smaller than one of the arguments.
To simplify the fix, the types of buf.size and buf_idx are set to the
same width, namely size_t also to be aligned with the type of length
parameter in file read/write ops.

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16:
 - Adjust context, indentation
 - Return error directly, rather than through cb->status and the completion list
 - Fix up additional format string in mei_cl_write()]
Signed-off-by: Ben Hutchings

misc/bmp085: Enable building as a module

2016-04-30T22:05:47+00:00

commit 50e6315dba721cbc24ccd6d7b299f1782f210a98 upstream.

Commit 985087dbcb02 'misc: add support for bmp18x chips to the bmp085
driver' changed the BMP085 config symbol to a boolean.  I see no
reason why the shared code cannot be built as a module, so change it
back to tristate.

Fixes: 985087dbcb02 ("misc: add support for bmp18x chips to the bmp085 driver")
Cc: Eric Andersson 
Signed-off-by: Ben Hutchings 
Acked-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

mei: make device disabled on stop unconditionally

2015-03-18T15:06:06+00:00

commit 6c15a8516b8118eb19a59fd0bd22df41b9101c32 upstream.

Set the internal device state to to disabled after hardware reset in stop flow.
This will cover cases when driver was not brought to disabled state because of
an error and in stop flow we wish not to retry the reset.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Luis Henriques

mei: me: release hw from reset only during the reset flow

2015-03-02T13:17:06+00:00

commit 663b7ee9517eec6deea9a48c7a1392a9a34f7809 upstream.

We might enter the interrupt handler with hw_ready already set,
but prior we actually started the reset flow.
To soleve this we move the reset release from the interrupt handler
to the HW start wait function which is part of the reset sequence.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

mei: mask interrupt set bit on clean reset bit

2015-03-02T13:17:05+00:00

commit 1ab1e79b9fd4b01331490bbe2e630a0fc0b25449 upstream.

We should mask interrupt set bit when writing back
hcsr value in reset bit clean-up.

This is refinement for
mei: clean reset bit before reset
commit b13a65ef190e488e2761d65bdd2e1fe8a3a125f5

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Luis Henriques

mei: clean reset bit before reset

2015-01-22T16:33:24+00:00

commit b13a65ef190e488e2761d65bdd2e1fe8a3a125f5 upstream.

H_RST bit in H_CSR register may be found lit before reset is started,
for example if preceding reset flow hasn't completed.
In that case asserting H_RST will be ignored, therefore we need to clean
H_RST bit to start a successful reset sequence.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman 
[ luis: backported to 3.16:
  - replace dev->dev by &dev->pdev->dev ]
Signed-off-by: Luis Henriques

misc: genwqe: check for error from get_user_pages_fast()

2015-01-05T13:48:39+00:00

commit cf35d6e0475982667b0d2d318fb27be4b8849827 upstream.

`genwqe_user_vmap()` calls `get_user_pages_fast()` and if the return
value is less than the number of pages requested, it frees the pages and
returns an error (`-EFAULT`).  However, it fails to consider a negative
error return value from `get_user_pages_fast()`.  In that case, the test
`if (rc < m->nr_pages)` will be false (due to promotion of `rc` to a
large `unsigned int`) and the code will continue on to call
`genwqe_map_pages()` with an invalid list of page pointers.  Fix it by
bailing out if `get_user_pages_fast()` returns a negative error value.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Luis Henriques

mei: bus: fix possible boundaries violation

2014-10-30T16:40:13+00:00

commit cfda2794b5afe7ce64ee9605c64bef0e56a48125 upstream.

function 'strncpy' will fill whole buffer 'id.name' of fixed size (32)
with string value and will not leave place for NULL-terminator.
Possible buffer boundaries violation in following string operations.
Replace strncpy with strlcpy.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman