linux-stable.git/drivers/staging, branch v3.18.6

vm: add VM_FAULT_SIGSEGV handling support

2015-02-06T06:36:01+00:00

commit 33692f27597fcab536d7cbbcc8f52905133e4aa7 upstream.

The core VM already knows about VM_FAULT_SIGBUS, but cannot return a
"you should SIGSEGV" error, because the SIGSEGV case was generally
handled by the caller - usually the architecture fault handler.

That results in lots of duplication - all the architecture fault
handlers end up doing very similar "look up vma, check permissions, do
retries etc" - but it generally works.  However, there are cases where
the VM actually wants to SIGSEGV, and applications _expect_ SIGSEGV.

In particular, when accessing the stack guard page, libsigsegv expects a
SIGSEGV.  And it usually got one, because the stack growth is handled by
that duplicated architecture fault handler.

However, when the generic VM layer started propagating the error return
from the stack expansion in commit fee7e49d4514 ("mm: propagate error
from stack expansion even for guard page"), that now exposed the
existing VM_FAULT_SIGBUS result to user space.  And user space really
expected SIGSEGV, not SIGBUS.

To fix that case, we need to add a VM_FAULT_SIGSEGV, and teach all those
duplicate architecture fault handlers about it.  They all already have
the code to handle SIGSEGV, so it's about just tying that new return
value to the existing code, but it's all a bit annoying.

This is the mindless minimal patch to do this.  A more extensive patch
would be to try to gather up the mostly shared fault handling logic into
one generic helper routine, and long-term we really should do that
cleanup.

Just from this patch, you can generally see that most architectures just
copied (directly or indirectly) the old x86 way of doing things, but in
the meantime that original x86 model has been improved to hold the VM
semaphore for shorter times etc and to handle VM_FAULT_RETRY and other
"newer" things, so it would be a good idea to bring all those
improvements to the generic case and teach other architectures about
them too.

Reported-and-tested-by: Takashi Iwai 
Tested-by: Jan Engelhardt 
Acked-by: Heiko Carstens  # "s390 still compiles and boots"
Cc: linux-arch@vger.kernel.org
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

move d_rcu from overlapping d_child to overlapping d_alias

2014-12-16T17:39:06+00:00

commit 946e51f2bf37f1656916eb75bd0742ba33983c28 upstream.

Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman

staging: r8188eu: Add new device ID for DLink GO-USB-N150

2014-11-27T16:55:01+00:00

The DLink GO-USB-N150 with revision B1 uses this driver.

Signed-off-by: Larry Finger 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd

2014-11-26T22:03:48+00:00

In commit fadbe0cd5292851608e2e01b91d9295fa287b9fe entitled "staging:
rtl8188eu:Remove rtw_zmalloc(), wrapper for kzalloc()", the author failed
to note that the original code in the wrapper tested whether the caller
could sleep, and set the flags argument to kzalloc() appropriately.
After the patch, GFP_KERNEL is used unconditionally. Unfortunately, several
of the routines may be entered from an interrupt routine and generate
a BUG splat for every such call. Routine rtw_sitesurvey_cmd() is used in the
example below:

BUG: sleeping function called from invalid context at mm/slub.c:1240
in_atomic(): 1, irqs_disabled(): 0, pid: 756, name: wpa_supplicant
INFO: lockdep is turned off.
CPU: 2 PID: 756 Comm: wpa_supplicant Tainted: G        WC O   3.18.0-rc4+ #34
Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.20   04/17/2014
ffffc90005557000 ffff880216fafaa8 ffffffff816b0bbf 0000000000000000
ffff8800c3b58000 ffff880216fafac8 ffffffff8107af77 0000000000000001
0000000000000010 ffff880216fafb18 ffffffff811b06ce 0000000000000000
Call Trace:
 [] dump_stack+0x4e/0x71
 [] __might_sleep+0xf7/0x120
 [] kmem_cache_alloc_trace+0x4e/0x1f0
 [] ? rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu]
 [] rtw_sitesurvey_cmd+0x56/0x2a0 [r8188eu]
 [] rtw_do_join+0x22d/0x370 [r8188eu]
 [] rtw_set_802_11_ssid+0x218/0x3d0 [r8188eu]
 [] rtw_wx_set_essid+0x1e5/0x410 [r8188eu]
 [] ? rtw_wx_get_rate+0x50/0x50 [r8188eu]
 [] ioctl_standard_iw_point+0x151/0x3f0
 [] ioctl_standard_call+0xb2/0xe0
 [] ? rtnl_lock+0x17/0x20
 [] ? iw_handler_get_private+0x70/0x70
 [] ? call_commit_handler+0x40/0x40
 [] wireless_process_ioctl+0x176/0x1c0
 [] wext_handle_ioctl+0x69/0xc0
 [] dev_ioctl+0x309/0x5e0
 [] ? call_rcu+0x17/0x20
 [] sock_ioctl+0x142/0x2e0
 [] do_vfs_ioctl+0x300/0x520
 [] ? __audit_syscall_entry+0xb4/0x110
 [] ? __audit_syscall_entry+0xb4/0x110
 [] ? do_audit_syscall_entry+0x6c/0x70
 [] SyS_ioctl+0x81/0xa0
 [] system_call_fastpath+0x12/0x17

Additional routines that generate this BUG are rtw_joinbss_cmd(),
rtw_dynamic_chk_wk_cmd(), rtw_lps_ctrl_wk_cmd(), rtw_rpt_timer_cfg_cmd(),
rtw_ps_cmd(), report_survey_event(), report_join_res(), survey_timer_hdl(),
and rtw_check_bcn_info().

Signed-off-by: Larry Finger 
Cc: navin patidar 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'iio-fixes-for-3.18b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

2014-11-05T19:30:45+00:00

Jonathan writes:

Second round of IIO fixes for the 3.18 cycle.

* tsl4531 - fix a compile error when CONFIG_PM_OPS not set.
* kxcjk-1013 - event spec direction was invalid - leading to 'interesting'
  attrribute names.
* as3935 - sizeof(st) used instead of sizeof(*st) leading to allocation of
  space for a pointer rather than the structure desired.
* ade7758 - Another null pointer deref fix due to different channels
  being provided to the the buffer register than used for the sysfs
  side of things.
* ade7758 - Check there is a channel enabled in preenable for the buffer
  before doing anything.
* ade7758 - Drop a stray raw from the channel name that leads to _raw_raw
  postfix.

staging:iio:ade7758: Remove "raw" from channel name

2014-11-05T18:33:48+00:00

"raw" is a property of a channel, but should not be part of the name of
channel.

Signed-off-by: Lars-Peter Clausen 
Cc: 
Signed-off-by: Jonathan Cameron

staging:iio:ade7758: Fix check if channels are enabled in prenable

2014-11-05T18:33:47+00:00

We should check if a channel is enabled, not if no channels are enabled.

Fixes: 550268ca1111 ("staging:iio: scrap scan_count and ensure all drivers use active_scan_mask")
Signed-off-by: Lars-Peter Clausen 
Cc: 
Signed-off-by: Jonathan Cameron

staging:iio:ade7758: Fix NULL pointer deref when enabling buffer

2014-11-05T18:33:47+00:00

In older versions of the IIO framework it was possible to pass a completely
different set of channels to iio_buffer_register() as the one that is
assigned to the IIO device. Commit 959d2952d124 ("staging:iio: make
iio_sw_buffer_preenable much more general.") introduced a restriction that
requires that the set of channels that is passed to iio_buffer_register() is
a subset of the channels assigned to the IIO device as the IIO core will use
the list of channels that is assigned to the device to lookup a channel by
scan index in iio_compute_scan_bytes(). If it can not find the channel the
function will crash. This patch fixes the issue by making sure that the same
set of channels is assigned to the IIO device and passed to
iio_buffer_register().

Note that we need to remove the IIO_CHAN_INFO_RAW and IIO_CHAN_INFO_SCALE
info attributes from the channels since we don't actually want those to be
registered.

Fixes the following crash:
	Unable to handle kernel NULL pointer dereference at virtual address 00000016
	pgd = d2094000
	[00000016] *pgd=16e39831, *pte=00000000, *ppte=00000000
	Internal error: Oops: 17 [#1] PREEMPT SMP ARM
	Modules linked in:
	CPU: 1 PID: 1695 Comm: bash Not tainted 3.17.0-06329-g29461ee #9686
	task: d7768040 ti: d5bd4000 task.ti: d5bd4000
	PC is at iio_compute_scan_bytes+0x38/0xc0
	LR is at iio_compute_scan_bytes+0x34/0xc0
	pc : []    lr : []    psr: 60070013
	sp : d5bd5ec0  ip : 00000000  fp : 00000000
	r10: d769f934  r9 : 00000000  r8 : 00000001
	r7 : 00000000  r6 : c8fc6240  r5 : d769f800  r4 : 00000000
	r3 : d769f800  r2 : 00000000  r1 : ffffffff  r0 : 00000000
	Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
	Control: 18c5387d  Table: 1209404a  DAC: 00000015
	Process bash (pid: 1695, stack limit = 0xd5bd4240)
	Stack: (0xd5bd5ec0 to 0xd5bd6000)
	5ec0: d769f800 d7435640 c8fc6240 d769f984 00000000 c03175a4 d7435690 d7435640
	5ee0: d769f990 00000002 00000000 d769f800 d5bd4000 00000000 000b43a8 c03177f4
	5f00: d769f810 0162b8c8 00000002 c8fc7e00 d77f1d08 d77f1da8 c8fc7e00 c01faf1c
	5f20: 00000002 c010694c c010690c d5bd5f88 00000002 c8fc6840 c8fc684c c0105e08
	5f40: 00000000 00000000 d20d1580 00000002 000af408 d5bd5f88 c000de84 c00b76d4
	5f60: d20d1580 000af408 00000002 d20d1580 d20d1580 00000002 000af408 c000de84
	5f80: 00000000 c00b7a44 00000000 00000000 00000002 b6ebea78 00000002 000af408
	5fa0: 00000004 c000dd00 b6ebea78 00000002 00000001 000af408 00000002 00000000
	5fc0: b6ebea78 00000002 000af408 00000004 bee96a4c 000a6094 00000000 000b43a8
	5fe0: 00000000 bee969cc b6e2eb77 b6e6525c 40070010 00000001 00000000 00000000
	[] (iio_compute_scan_bytes) from [] (__iio_update_buffers+0x248/0x438)
	[] (__iio_update_buffers) from [] (iio_buffer_store_enable+0x60/0x7c)
	[] (iio_buffer_store_enable) from [] (dev_attr_store+0x18/0x24)
	[] (dev_attr_store) from [] (sysfs_kf_write+0x40/0x4c)
	[] (sysfs_kf_write) from [] (kernfs_fop_write+0x110/0x154)
	[] (kernfs_fop_write) from [] (vfs_write+0xbc/0x170)
	[] (vfs_write) from [] (SyS_write+0x40/0x78)
	[] (SyS_write) from [] (ret_fast_syscall+0x0/0x30)

Fixes: 959d2952d124 ("staging:iio: make iio_sw_buffer_preenable much more general.")
Signed-off-by: Lars-Peter Clausen 
Cc: 
Signed-off-by: Jonathan Cameron

iio: adc: mxs-lradc: Disable the clock on probe failure

2014-11-05T18:33:44+00:00

We should disable lradc->clk in the case of errors in the probe function.

Signed-off-by: Fabio Estevam 
Reviewed-by: Marek Vasut 
Signed-off-by: Jonathan Cameron 
Cc:

staging:iio:ad5933: Drop "raw" from channel names

2014-11-05T18:33:42+00:00

"raw" is the name of a channel property, but should not be part of the
channel name itself.

Signed-off-by: Lars-Peter Clausen 
Cc: 
Signed-off-by: Jonathan Cameron