linux-stable.git/drivers/staging, branch v3.18.82

iio: trigger: free trigger resource correctly

2017-11-15T09:04:12+00:00

[ Upstream commit 10e840dfb0b7fc345082dd9e5fff3c1c02e7690e ]

These stand-alone trigger drivers were using iio_trigger_put()
where they should have been using iio_trigger_free().  The
iio_trigger_put() adds a module_put which is bad since they
never did a module_get.

In the sysfs driver, module_get/put's are used as triggers are
added & removed. This extra module_put() occurs on an error path
in the probe routine (probably rare).

In the bfin-timer & interrupt trigger drivers, the module resources
are not explicitly managed, so it's doing a put on something that
was never get'd.  It occurs on the probe error path and on the
remove path (not so rare).

Tested with the sysfs trigger driver.
The bfin & interrupt drivers were build tested & inspected only.

Signed-off-by: Alison Schofield 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

staging: r8712u: Fix Sparse warning in rtl871x_xmit.c

2017-11-08T09:03:50+00:00

[ Upstream commit 07222e535831b916221dd2a48a3047ec7e45dc72 ]

Sparse reports the following:
  CHECK   drivers/staging/rtl8712/rtl871x_xmit.c
drivers/staging/rtl8712/rtl871x_xmit.c:350:44: warning: restricted __le32 degrades to integer
drivers/staging/rtl8712/rtl871x_xmit.c:491:23: warning: incorrect type in initializer (different base types)
drivers/staging/rtl8712/rtl871x_xmit.c:491:23:    expected unsigned short [usertype] *fctrl
drivers/staging/rtl8712/rtl871x_xmit.c:491:23:    got restricted __le16 *
drivers/staging/rtl8712/rtl871x_xmit.c:580:36: warning: incorrect type in assignment (different base types)
drivers/staging/rtl8712/rtl871x_xmit.c:580:36:    expected unsigned short [unsigned] [short] [usertype] 
drivers/staging/rtl8712/rtl871x_xmit.c:580:36:    got restricted __be16 [usertype] 

Signed-off-by: Larry Finger 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

staging: lustre: ptlrpc: skip lock if export failed

2017-11-08T09:03:50+00:00

[ Upstream commit 4c43c27ddc461d8473cedd70f2549614641dfbc7 ]

This patch resolves IO vs eviction race.
After eviction failed export stayed at stale list,
a client had IO processing and reconnected during it.
A client sent brw rpc with last lock cookie and new connection.
The lock with failed export was found and assert was happened.
 (ost_handler.c:1812:ost_prolong_lock_one())
  ASSERTION( lock->l_export == opd->opd_exp ) failed:

 1. Skip the lock at ldlm_handle2lock if lock export failed.
 2. Validation of lock for IO was added at hpreq_check(). The lock
    searching is based on granted interval tree. If server doesn`t
    have a valid lock, it reply to client with ESTALE.

Signed-off-by: Alexander Boyko 
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-7702
Seagate-bug-id: MRP-2787
Reviewed-on: http://review.whamcloud.com/18120
Reviewed-by: Fan Yong 
Reviewed-by: Vitaly Fertman 
Reviewed-by: Oleg Drokin 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

staging: lustre: hsm: stack overrun in hai_dump_data_field

2017-11-08T09:03:50+00:00

[ Upstream commit 22aadb91c0a0055935109c175f5446abfb130702 ]

The function hai_dump_data_field will do a stack buffer
overrun when cat'ing /sys/fs/lustre/.../hsm/actions if an action has
some data in it.

hai_dump_data_field uses snprintf. But there is no check for
truncation, and the value returned by snprintf is used as-is.  The
coordinator code calls hai_dump_data_field with 12 bytes in the
buffer. The 6th byte of data is printed incompletely to make room for
the terminating NUL. However snprintf still returns 2, so when
hai_dump_data_field writes the final NUL, it does it outside the
reserved buffer, in the 13th byte of the buffer. This stack buffer
overrun hangs my VM.

Fix by checking that there is enough room for the next 2 characters
plus the NUL terminator. Don't print half bytes. Change the format to
02X instead of .2X, which makes more sense.

Signed-off-by: frank zago 
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8171
Reviewed-on: http://review.whamcloud.com/20338
Reviewed-by: John L. Hammond 
Reviewed-by: Jean-Baptiste Riaux 
Reviewed-by: Oleg Drokin 
Signed-off-by: James Simmons 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

staging: rtl8712u: Fix endian settings for structs describing network packets

2017-11-08T09:03:49+00:00

[ Upstream commit 221c46d28957bd6e2158abc2179ce4a8c9ce07d3 ]

The headers describing a number of network packets do not have the
correct endian settings for several types of data.

Signed-off-by: Larry Finger 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.

2017-10-12T07:18:02+00:00

commit f790923f146140a261ad211e5baf75d169f16fb2 upstream.

Depends on: 691c4b95d1 ("iio: ad_sigma_delta: Implement a dedicated reset function")

SPI host drivers can use DMA to transfer data, so the buffer should be properly allocated.
Keeping it on the stack could cause an undefined behavior.

The dedicated reset function solves this issue.

Signed-off-by: Stefan Popa 
Acked-by: Lars-Peter Clausen 
Acked-by: Michael Hennerich 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

staging: nvec: remove duplicated const

2017-10-08T08:11:22+00:00

commit 716baa7b430c66187a41e4d41eedf5de01343b21 upstream.

Sparse checking warning:
"drivers/staging/nvec/nvec_ps2.c:172:14: warning: duplicate const".
Remove the duplicated const to fix the warning.

Signed-off-by: Peng Fan 
Acked-by: Marc Dietrich 
Signed-off-by: Greg Kroah-Hartman

staging/rts5208: fix incorrect shift to extract upper nybble

2017-09-13T21:03:46+00:00

commit 34ff1bf4920471cff66775dc39537b15c5f0feff upstream.

The mask of sns_key_info1 suggests the upper nybble is being extracted
however the following shift of 8 bits is too large and always results in
0.  Fix this by shifting only by 4 bits to correctly get the upper nybble.

Detected by CoverityScan, CID#142891 ("Operands don't affect result")

Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288")
Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman

staging: rtl8188eu: add RNX-N150NUB support

2017-08-30T08:16:57+00:00

commit f299aec6ebd747298e35934cff7709c6b119ca52 upstream.

Add support for USB Device Rosewill RNX-N150NUB.
VendorID: 0x0bda, ProductID: 0xffef

Signed-off-by: Charles Milette 
Signed-off-by: Greg Kroah-Hartman

staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read

2017-08-16T20:35:31+00:00

commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream.

gcc-7 points out an older regression:

drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw':
drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]

The original code had 'unsigned short' here, but incorrectly got
converted to 'bool'. This reverts the regression and uses a normal
type instead.

Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman