linux-stable.git/drivers/staging, branch v3.16.67

staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1

2019-05-02T20:41:21+00:00

commit 5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a upstream.

This device was added to the stand-alone driver on github.
Add it to the staging driver as well.

Link: https://github.com/lwfinger/rtl8188eu/commit/a0619a07cd1e
Signed-off-by: Michael Straube 
Acked-by: Larry Finger 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: rtl8712: Fix possible buffer overrun

2019-02-11T17:54:19+00:00

commit 300cd664865bed5d50ae0a42fb4e3a6f415e8a10 upstream.

In commit 8b7a13c3f404 ("staging: r8712u: Fix possible buffer
overrun") we fix a potential off by one by making the limit smaller.
The better fix is to make the buffer larger.  This makes it match up
with the similar code in other drivers.

Fixes: 8b7a13c3f404 ("staging: r8712u: Fix possible buffer overrun")
Signed-off-by: Young Xiao 
Reviewed-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

staging: comedi: ni_mio_common: protect register write overflow

2019-02-11T17:53:30+00:00

commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 upstream.

Fixes two problems introduced as early as
commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
    not unduly overwritten on e-series devices.  On e-series devices, the
    first three of the last four bits are reserved.  The last bit defines
    the output selection of the RGOUT0 pin, otherwise known as
    RTSI_Sub_Selection.  For m-series devices, these last four bits are
    indeed used as the output selection of the RTSI7 pin (and the
    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
    RTSI_Trig_Direction register.
(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
    lines.

This patch also cleans up the ni_get_rtsi_routing command for readability.

Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
Signed-off-by: Spencer E. Olson 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16:
 - Use NI_RTSI_OUTPUT_RTSI_BRD_0 + n instead of NI_RTSI_OUTPUT_RTSI_BRD(n)
 - Use num_configurable_rtsi_channels() instead of NISTC_RTSI_TRIG_NUM_CHAN()
 - Use old_RTSI_clock_channel instead of NISTC_RTSI_TRIG_OLD_CLK_CHAN
 - Adjust context]
Signed-off-by: Ben Hutchings

staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()

2019-02-11T17:53:15+00:00

commit 1376b0a2160319125c3a2822e8c09bd283cd8141 upstream.

There is a '>' vs '<' typo so this loop is a no-op.

Fixes: d35dcc89fc93 ("staging: comedi: quatech_daqp_cs: fix daqp_ao_insn_write()")
Signed-off-by: Dan Carpenter 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: comedi: quatech_daqp_cs: use comedi_timeout() in ao (*insn_write)

2019-02-11T17:53:15+00:00

commit e031642eccc040648b09cfc7d632e2e8d0b6f94f upstream.

The data link between the D/A data port and the D/A converter is a serial
link. The serial link requires about 8ms to complete a transfer. Use the
comedi_timeout() helper to ensure that there is not a previous transfer
still happening before trying to write new data to the channel.

Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
[ija: Backported to 3.16: No 'readback' member in subdevice.]
Signed-off-by: Ian Abbott 
Signed-off-by: Ben Hutchings

staging: comedi: quatech_daqp_cs: fix bug in daqp_ao_insn_write()

2019-02-11T17:53:15+00:00

commit e024181b02ed6b833358bede3f2d0c52cb5fb6bc upstream.

The comedi core expects (*insn_write) functions to write insn->n values
to the hardware and return the number of values written.

Currently, this function only writes the first value. Fix it to work
like the core expects.

Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

usb: usbip: Fix BUG: KASAN: slab-out-of-bounds in vhci_hub_control()

2018-12-16T22:09:39+00:00

commit 81f7567c51ad97668d1c3a48e8ecc482e64d4161 upstream.

vhci_hub_control() accesses port_status array with out of bounds port
value. Fix it to reference port_status[] only with a valid rhport value
when invalid_rhport flag is true.

The invalid_rhport flag is set early on after detecting in port value
is within the bounds or not.

The following is used reproduce the problem and verify the fix:
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14ed8ab6400000

Reported-by: syzbot+bccc1fe10b70fadc78d0@syzkaller.appspotmail.com
Signed-off-by: Shuah Khan (Samsung OSG) 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16:
 - s/VHCI_HC_PORTS/VHCI_NPORTS/
 - Mask wIndex before using it, as done upstream in commit 1c9de5bf4286
   "usbip: vhci-hcd: Add USB3 SuperSpeed support"
 - Drop inapplicable changes
 - Adjust filename]
Signed-off-by: Ben Hutchings

staging: rts5208: fix missing error check on call to rtsx_write_register

2018-12-16T22:08:10+00:00

commit c5fae4f4fd28189b1062fb8ef7b21fec37cb8b17 upstream.

Currently the check on error return from the call to rtsx_write_register
is checking the error status from the previous call. Fix this by adding
in the missing assignment of retval.

Detected by CoverityScan, CID#709877

Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288")
Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

iio: iio-trig-periodic-rtc: Free trigger resource correctly

2018-11-20T18:06:01+00:00

This is based on upstream commit 10e840dfb0b7, which did not touch the
iio-trig-periodic-rtc driver because it has been removed upstream.

The following explanation comes from that commit:

    These stand-alone trigger drivers were using iio_trigger_put()
    where they should have been using iio_trigger_free().  The
    iio_trigger_put() adds a module_put which is bad since they
    never did a module_get.

    In the sysfs driver, module_get/put's are used as triggers are
    added & removed. This extra module_put() occurs on an error path
    in the probe routine (probably rare).

    In the bfin-timer & interrupt trigger drivers, the module resources
    are not explicitly managed, so it's doing a put on something that
    was never get'd.  It occurs on the probe error path and on the
    remove path (not so rare).

    Tested with the sysfs trigger driver.
    The bfin & interrupt drivers were build tested & inspected only.

This was build tested only.

Cc: Alison Schofield 
Cc: Jonathan Cameron 
Signed-off-by: Ben Hutchings 
Signed-off-by: Ben Hutchings

usbip: stub_rx: fix static checker warning on unnecessary checks

2018-11-20T18:06:00+00:00

commit 10c90120930628e8b959bf58d4a0aaef3ae5d945 upstream.

Fix the following static checker warnings:

The patch c6688ef9f297: "usbip: fix stub_rx: harden CMD_SUBMIT path
to handle malicious input" from Dec 7, 2017, leads to the following
static checker warning:

    drivers/usb/usbip/stub_rx.c:346 get_pipe()
    warn: impossible condition
'(pdu->u.cmd_submit.transfer_buffer_length > ((~0 >> 1))) =>
(s32min-s32max > s32max)'
    drivers/usb/usbip/stub_rx.c:486 stub_recv_cmd_submit()
    warn: always true condition
'(pdu->u.cmd_submit.transfer_buffer_length <= ((~0 >> 1))) =>
(s32min-s32max <= s32max)'

Reported-by: Dan Carpenter 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings