linux-stable.git/drivers/staging, branch v3.16.52 Linux kernel stable tree staging: iio: ade7759: fix signed extension bug on shift of a u8 2018-01-01T20:51:45+00:00 Colin Ian King colin.king@canonical.com 2017-09-13T17:02:02+00:00 91a6bec9bfc73ccf549d2810a014e20dd62a1182 commit 13ffe9a26df4e156363579b25c904dd0b1e31bfb upstream. The current shift of st->rx[2] left shifts a u8 24 bits left, promotes the integer to a an int and then to a unsigned u64. If the top bit of st->rx[2] is set then we end up with all the upper bits being set to 1. Fix this by casting st->rx[2] to a u64 before the 24 bit left shift. Detected by CoverityScan CID#144940 ("Unintended sign extension") Fixes: 2919fa54ef64 ("staging: iio: meter: new driver for ADE7759 devices") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 13ffe9a26df4e156363579b25c904dd0b1e31bfb upstream.

The current shift of st->rx[2] left shifts a u8 24 bits left,
promotes the integer to a an int and then to a unsigned u64. If
the top bit of st->rx[2] is set then we end up with all the upper
bits being set to 1. Fix this by casting st->rx[2] to a u64 before
the 24 bit left shift.

Detected by CoverityScan CID#144940 ("Unintended sign extension")

Fixes: 2919fa54ef64 ("staging: iio: meter: new driver for ADE7759 devices")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack. 2018-01-01T20:51:39+00:00 Stefan Popa stefan.popa@analog.com 2017-09-14T13:50:28+00:00 d93e9ca95b52a8d07431aecf7c1434cec4be5dc4 commit f790923f146140a261ad211e5baf75d169f16fb2 upstream. Depends on: 691c4b95d1 ("iio: ad_sigma_delta: Implement a dedicated reset function") SPI host drivers can use DMA to transfer data, so the buffer should be properly allocated. Keeping it on the stack could cause an undefined behavior. The dedicated reset function solves this issue. Signed-off-by: Stefan Popa <stefan.popa@analog.com> Acked-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Michael Hennerich <michael.hennerich@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit f790923f146140a261ad211e5baf75d169f16fb2 upstream.

Depends on: 691c4b95d1 ("iio: ad_sigma_delta: Implement a dedicated reset function")

SPI host drivers can use DMA to transfer data, so the buffer should be properly allocated.
Keeping it on the stack could cause an undefined behavior.

The dedicated reset function solves this issue.

Signed-off-by: Stefan Popa <stefan.popa@analog.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
staging: lustre: obdclass: return -EFAULT if copy_from_user() fails 2017-11-26T13:50:24+00:00 Dan Carpenter dan.carpenter@oracle.com 2017-08-26T06:04:18+00:00 ddee76d516bf4fe103a9a31f9655a4a4ae01e11d commit 092c3def24bb68a00ff58c76ed67b9ff448387ce upstream. The copy_from_user() function returns the number of bytes which we weren't able to copy. We don't want to return that to the user but instead we want to return -EFAULT. Fixes: d7e09d0397e8 ("staging: add Lustre file system client support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 092c3def24bb68a00ff58c76ed67b9ff448387ce upstream.

The copy_from_user() function returns the number of bytes which we
weren't able to copy.  We don't want to return that to the user but
instead we want to return -EFAULT.

Fixes: d7e09d0397e8 ("staging: add Lustre file system client support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
staging/rts5208: fix incorrect shift to extract upper nybble 2017-11-26T13:50:22+00:00 Colin Ian King colin.king@canonical.com 2017-08-18T13:34:16+00:00 790599d78a22183a94157402a6a412fd080fda43 commit 34ff1bf4920471cff66775dc39537b15c5f0feff upstream. The mask of sns_key_info1 suggests the upper nybble is being extracted however the following shift of 8 bits is too large and always results in 0. Fix this by shifting only by 4 bits to correctly get the upper nybble. Detected by CoverityScan, CID#142891 ("Operands don't affect result") Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 34ff1bf4920471cff66775dc39537b15c5f0feff upstream.

The mask of sns_key_info1 suggests the upper nybble is being extracted
however the following shift of 8 bits is too large and always results in
0.  Fix this by shifting only by 4 bits to correctly get the upper nybble.

Detected by CoverityScan, CID#142891 ("Operands don't affect result")

Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
media: lirc_zilog: driver only sends LIRCCODE 2017-11-26T13:50:22+00:00 Sean Young sean@mess.org 2017-08-03T21:42:28+00:00 5c3bd83c33085d5b54c6f8634d9710bac908c6d7 commit 89d8a2cc51d1f29ea24a0b44dde13253141190a0 upstream. This driver cannot send pulse, it only accepts driver-dependent codes. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 89d8a2cc51d1f29ea24a0b44dde13253141190a0 upstream.

This driver cannot send pulse, it only accepts driver-dependent codes.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation 2017-11-26T13:50:15+00:00 Dan Carpenter dan.carpenter@oracle.com 2017-07-13T07:43:23+00:00 8be2ac4557f88851605332a56a23c795e93bc672 commit d28ac7be15c70343cb270648e252f54d770eca6a upstream. The cast here is wrong. We want to cast the pointer but we accidentally do a no-op cast of the value. We normally want to set us_nav_upper to WIFI_NAV_UPPER_US (30000) but because of this bug we instead set it to 184 on little endian systems and 0 on big endian ones. Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> [bwh: Backported to 3.16: adjust filename, context, indentation] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit d28ac7be15c70343cb270648e252f54d770eca6a upstream.

The cast here is wrong.  We want to cast the pointer but we accidentally
do a no-op cast of the value.  We normally want to set us_nav_upper to
WIFI_NAV_UPPER_US (30000) but because of this bug we instead set it to
184 on little endian systems and 0 on big endian ones.

Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.16: adjust filename, context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
staging: r8192ee: prorperly format warning message 2017-11-11T13:34:01+00:00 Arnd Bergmann arnd@arndb.de 2017-05-09T10:04:49+00:00 c6291fcd19e1eab1fa5fdf7030e285b57580d57f In stable/linux-3.16.y, we get a warning for 64-bit architectures: drivers/staging/rtl8192ee/pci.c: In function '_rtl_pci_rx_interrupt': include/linux/kern_levels.h:4:18: warning: format '%d' expects argument of type 'int', but argument 2 has type 'sk_buff_data_t {aka unsigned char *}' [-Wformat=] include/linux/kern_levels.h:4:18: warning: format '%d' expects argument of type 'int', but argument 3 has type 'sk_buff_data_t {aka unsigned char *}' [-Wformat=] The driver was removed in 3.18 before this was fixed, so there is no workaround to backport, but it's easy enough to avoid the problem by changing the printk message to something similar that uses proper accessors for the skb fields. Fixes: 78de2c063710 ("staging: r8192ee: Add source files for core driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
In stable/linux-3.16.y, we get a warning for 64-bit architectures:

drivers/staging/rtl8192ee/pci.c: In function '_rtl_pci_rx_interrupt':
include/linux/kern_levels.h:4:18: warning: format '%d' expects argument of type 'int', but argument 2 has type 'sk_buff_data_t {aka unsigned char *}' [-Wformat=]
include/linux/kern_levels.h:4:18: warning: format '%d' expects argument of type 'int', but argument 3 has type 'sk_buff_data_t {aka unsigned char *}' [-Wformat=]

The driver was removed in 3.18 before this was fixed, so there is no
workaround to backport, but it's easy enough to avoid the problem
by changing the printk message to something similar that uses
proper accessors for the skb fields.

Fixes: 78de2c063710 ("staging: r8192ee: Add source files for core driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
staging: dgnc: Fix frame size is larger than 1024B 2017-11-11T13:33:57+00:00 Konrad Zapalowicz bergo.torino@gmail.com 2014-08-06T12:21:21+00:00 287b80fac2c69c490e5163414cd11a24d765b786 commit ea6e9dea2e72a7abd146a2c5bab726b27f34b36c upstream. This comit fixes the following sparse warnign: drivers/staging/dgnc/dgnc_tty.c:572:1: warning: the frame size of 1060 bytes is larger than 1024 bytes [-Wframe-larger-than=] This was caused by having buffer as an automatic variable. This commit moves it from the stack to the heap. Signed-off-by: Konrad Zapalowicz <bergo.torino@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit ea6e9dea2e72a7abd146a2c5bab726b27f34b36c upstream.

This comit fixes the following sparse warnign:

drivers/staging/dgnc/dgnc_tty.c:572:1:
    warning: the frame size of 1060 bytes is larger than 1024 bytes
    [-Wframe-larger-than=]

This was caused by having buffer as an automatic variable. This commit
moves it from the stack to the heap.

Signed-off-by: Konrad Zapalowicz <bergo.torino@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Staging: wlan-ng: fix sparse warning in prism2fw.c 2017-11-11T13:33:57+00:00 A Raghavendra Rao raghav3276@gmail.com 2014-08-07T08:40:39+00:00 e1ecc17d38b93a8230a96d6723f88b57d0477a95 commit 41cb65c4854e14f12b1cbb8215e509d8ad4d0c88 upstream. Fix the following sparse warning : In file included from drivers/staging/wlan-ng/prism2usb.c:5:0: drivers/staging/wlan-ng/prism2fw.c: In function ‘read_cardpda.constprop.43’: drivers/staging/wlan-ng/prism2fw.c:792:1: warning: the frame size of 1068 bytes is larger than 1024 bytes [-Wframe-larger-than=] The variable to 'struct p80211msg_p2req_readpda' was previously being created on the stack, which inturn exeeded the frame size limit, resulting in a sparse warning. This patch alloctes the memory to the structure dynamically and the operations are left unchanged. Signed-off-by: A Raghavendra Rao <arrao@cdac.in> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 41cb65c4854e14f12b1cbb8215e509d8ad4d0c88 upstream.

Fix the following sparse warning :

In file included from drivers/staging/wlan-ng/prism2usb.c:5:0:
drivers/staging/wlan-ng/prism2fw.c: In function
‘read_cardpda.constprop.43’:
drivers/staging/wlan-ng/prism2fw.c:792:1: warning: the frame size of
1068 bytes is larger than 1024 bytes [-Wframe-larger-than=]

The variable to 'struct p80211msg_p2req_readpda' was previously being created
on the stack, which inturn exeeded the frame size limit, resulting in a
sparse warning. This patch alloctes the memory to the structure dynamically
and the operations are left unchanged.

Signed-off-by: A Raghavendra Rao <arrao@cdac.in>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
staging: rtl8723au: core: rtw_wlan_util: fix misleading indentation 2017-11-11T13:33:57+00:00 Luis de Bethencourt luisbg@osg.samsung.com 2015-10-21T17:32:38+00:00 aa7b5447a50ef901407ad1d465be54755320e556 commit 8c182ae20791d638c07ff499709c4a1d4697bd7c upstream. For loop is outside of the else branch of the above conditional statement. Fixing misleading indentation. Fix a smatch warning: drivers/staging/rtl8723au/core/rtw_wlan_util.c:528 WMMOnAssocRsp23a() warn: curly braces intended? Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com> Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 8c182ae20791d638c07ff499709c4a1d4697bd7c upstream.

For loop is outside of the else branch of the above conditional statement.
Fixing misleading indentation.

Fix a smatch warning:
drivers/staging/rtl8723au/core/rtw_wlan_util.c:528
WMMOnAssocRsp23a() warn: curly braces intended?

Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>