linux-stable.git/drivers/staging, branch v3.12.2

staging: comedi: avoid memleak for subdevice private

2013-11-29T19:27:56+00:00

commit 67aa4acbc97f6a55b328e4e2305ef19cbe949d85 upstream.

`comedi_alloc_spriv()` allocates private storage for a comedi subdevice
and sets the `SRF_FREE_SPRIV` flag in the `runflags` member of the
subdevice to allow the private storage to be automatically freed when
the comedi device is being cleaned up.  Unfortunately, the flag gets
clobbered by `do_cmd_ioctl()` which calls
`comedi_set_subdevice_runflags()` with a mask value `~0` and only the
`SRF_USER` and `SRF_RUNNING` flags set, all the other SRF flags being
cleared.

Change the calls to `comedi_set_subdevice_runflags()` that currently use
a mask value of `~0` to use a more relevant mask value.  For
`do_cmd_ioctl()`, the relevant SRF flags are `SRF_USER`, `SRF_ERROR` and
`SRF_RUNNING`.  (At one time, `SRF_RT` would be included in that set of
flags, but it is no longer used.)  For `comedi_alloc_spriv()` replace
the call to `comedi_set_subdevice_runflags()` with a simple
OR-assignment to avoid unnecessary use of a spin-lock.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: r8188eu: Set device type to wlan

2013-11-29T19:27:56+00:00

commit 0d1206be229697f897f00822bc142e66da731417 upstream.

The latest version of NetworkManager does not recognize the device as wireless
without this change.

Signed-off-by: Larry Finger 
Signed-off-by: Greg Kroah-Hartman

Staging: zram: Fix access of NULL pointer

2013-11-29T19:27:56+00:00

commit 46a51c80216cb891f271ad021f59009f34677499 upstream.

This patch fixes the bug in reset_store caused by accessing NULL pointer.

The bdev gets its value from bdget_disk() which could fail when memory
pressure is severe and hence can return NULL because allocation of
inode in bdget could fail.

Hence, this patch introduces a check for bdev to prevent reference to a
NULL pointer in the later part of the code. It also removes unnecessary
check of bdev for fsync_bdev().

Acked-by: Jerome Marchand 
Signed-off-by: Rashika Kheria 
Acked-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

staging: ashmem: Fix ASHMEM_PURGE_ALL_CACHES return value

2013-11-29T19:27:54+00:00

commit 5957324045ba2c127c9401fa3ac61ac52e043ca8 upstream.

Hopefully this isn't too late for 3.12.

In commit 7dc19d5aff (convert shrinkers to new count/scan API)
the return value to PURGE_ALL_CACHES was dropped, causing -EPERM
to always be returned.

This patch re-adds the ret assignment, setting it to the the
ashmem_shrink_count(), which is the lru_count.

(Sorry this was missed in the review!)

Fixes: 7dc19d5affd7 ("convert shrinkers to new count/scan API")
Cc: Colin Cross 
Cc: Android Kernel Team 
Cc: Glauber Costa 
Reported-by: YongQin Liu 
Signed-off-by: John Stultz 
Acked-by: Dave Chinner 
Signed-off-by: Greg Kroah-Hartman

Staging: sb105x: info leak in mp_get_count()

2013-10-30T19:24:50+00:00

The icount.reserved[] array isn't initialized so it leaks stack
information to userspace.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds

Staging: bcm: info leak in ioctl

2013-10-30T19:24:49+00:00

The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
information to user space.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds

staging: wlags49_h2: buffer overflow setting station name

2013-10-30T19:24:49+00:00

We need to check the length parameter before doing the memcpy().  I've
actually changed it to strlcpy() as well so that it's NUL terminated.

You need CAP_NET_ADMIN to trigger these so it's not the end of the
world.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds

staging: ozwpan: prevent overflow in oz_cdev_write()

2013-10-30T19:24:49+00:00

We need to check "count" so we don't overflow the ei->data buffer.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds

Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2013-10-23T06:52:36+00:00

Pull media fixes from Mauro Carvalho Chehab:
 - Compilation fixes for GCC < 4.4.6
 - one Kbuild dependency select fix (selecting videobuf on msi3101)
 - driver fixes on tda10071, e4000, msi3101, soc_camera, s5p-jpeg,
   saa7134 and adv7511
 - some device quirks needed to make them work properly
 - some videobuf2 core regression fixes for some features used only on
   embedded drivers

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] saa7134: Fix crash when device is closed before streamoff
  [media] adv7511: fix error return code in adv7511_probe()
  [media] ths8200: fix compilation with GCC < 4.4.6
  [media] ad9389b: fix compilation with GCC < 4.4.6
  [media] adv7511: fix compilation with GCC < 4.4.6
  [media] adv7842: fix compilation with GCC < 4.4.6
  [media] s5p-jpeg: Initialize vfd_decoder->vfl_dir field
  [media] videobuf2-dc: Fix support for mappings without struct page in userptr mode
  [media] vb2: Allow queuing OUTPUT buffers with zeroed 'bytesused'
  [media] mx3-camera: locking cleanup in mx3_videobuf_queue()
  [media] sh_vou: almost forever loop in sh_vou_try_fmt_vid_out()
  [media] tda10071: change firmware download condition
  [media] msi3101: correct max videobuf2 alloc
  [media] Add HCL T12Rg-H to STK webcam upside-down table
  [media] msi3101: Kconfig select VIDEOBUF2_VMALLOC
  [media] msi3101: msi3101_ioctl_ops can be static
  [media] e4000: fix PLL calc bug on 32-bit arch
  [media] uvcvideo: quirk PROBE_DEF for Microsoft Lifecam NX-3000
  [media] uvcvideo: quirk PROBE_DEF for Dell SP2008WFP monitor

staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdevice

2013-10-03T21:27:32+00:00

The `insn_bits` handler `ni_65xx_dio_insn_bits()` has a `for` loop that
currently writes (optionally) and reads back up to 5 "ports" consisting
of 8 channels each.  It reads up to 32 1-bit channels but can only read
and write a whole port at once - it needs to handle up to 5 ports as the
first channel it reads might not be aligned on a port boundary.  It
breaks out of the loop early if the next port it handles is beyond the
final port on the card.  It also breaks out early on the 5th port in the
loop if the first channel was aligned.  Unfortunately, it doesn't check
that the current port it is dealing with belongs to the comedi subdevice
the `insn_bits` handler is acting on.  That's a bug.

Redo the `for` loop to terminate after the final port belonging to the
subdevice, changing the loop variable in the process to simplify things
a bit.  The `for` loop could now try and handle more than 5 ports if the
subdevice has more than 40 channels, but the test `if (bitshift >= 32)`
ensures it will break out early after 4 or 5 ports (depending on whether
the first channel is aligned on a port boundary).  (`bitshift` will be
between -7 and 7 inclusive on the first iteration, increasing by 8 for
each subsequent operation.)

Signed-off-by: Ian Abbott 
Cc:  # 3.10.y 3.11.y 3.12.y
Signed-off-by: Greg Kroah-Hartman