linux-stable.git/drivers/staging, branch v3.7.7

staging: vt6656: Fix inconsistent structure packing

2013-01-21T19:44:47+00:00

commit 1ee4c55fc9620451b2a825d793042a7e0775391b upstream.

vt6656 has several headers that use the #pragma pack(1) directive to
enable structure packing, but never disable it.  The layout of
structures defined in other headers can then depend on which order the
various headers are included in, breaking the One Definition Rule.

In practice this resulted in crashes on x86_64 until the order of header
inclusion was changed for some files in commit 11d404cb56ecd ('staging:
vt6656: fix headers and add cfg80211.').  But we need a proper fix that
won't be affected by future changes to the order of inclusion.

This removes the #pragma pack(1) directives and adds __packed to the
structure definitions for which packing appears to have been intended.

Reported-and-tested-by: Malcolm Priestley 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

staging: wlan-ng: Fix clamping of returned SSID length

2013-01-21T19:44:46+00:00

commit 811a37effdb11e54e1ff1ddaa944286c88f58487 upstream.

Commit 2e254212 broke listing of available network names, since it
clamped the length of the returned SSID to WLAN_BSSID_LEN (6) instead of
WLAN_SSID_MAXLEN (32).

https://bugzilla.kernel.org/show_bug.cgi?id=52501

Signed-off-by: Tormod Volden 
Signed-off-by: Greg Kroah-Hartman

staging: zram: fix invalid memory references during disk write

2013-01-17T16:46:36+00:00

commit 397c60668aa5ae7130b5ad4e73870d7b8a787085 upstream.

Fixes a bug introduced by commit c8f2f0db1 ("zram: Fix handling
of incompressible pages") which caused invalid memory references
during disk write. Invalid references could occur in two cases:
 - Incoming data expands on compression: In this case, reference was
made to kunmap()'ed bio page.
 - Partial (non PAGE_SIZE) write with incompressible data: In this
case, reference was made to a kfree()'ed buffer.

Fixes bug 50081:
https://bugzilla.kernel.org/show_bug.cgi?id=50081

Signed-off-by: Nitin Gupta 
Reported-by: Mihail Kasadjikov 
Reported-by: Tomas M 
Reviewed-by: Minchan Kim 
Signed-off-by: Greg Kroah-Hartman

staging: zram: factor-out zram_decompress_page() function

2013-01-17T16:46:36+00:00

commit 37b51fdddf64e7ba0971d070428655f8d6f36578 upstream.

zram_bvec_read() shared decompress functionality with zram_read_before_write() function.
Factor-out and make commonly used zram_decompress_page() function, which also simplified
error handling in zram_bvec_read().

Signed-off-by: Sergey Senozhatsky 
Reviewed-by: Nitin Gupta 
Signed-off-by: Greg Kroah-Hartman

staging: speakup: avoid out-of-range access in synth_add()

2013-01-17T16:46:35+00:00

commit 6102c48bd421074a33e102f2ebda3724e8d275f9 upstream.

Check that array index is in-bounds before accessing the synths[] array.

Signed-off-by: Samuel Thibault 
Cc: Nickolai Zeldovich 
Signed-off-by: Greg Kroah-Hartman

staging: speakup: avoid out-of-range access in synth_init()

2013-01-17T16:46:35+00:00

commit ae428655b826f2755a8101b27beda42a275ef8ad upstream.

Check that array index is in-bounds before accessing the synths[] array.

Signed-off-by: Nickolai Zeldovich 
Cc: Samuel Thibault 
Signed-off-by: Greg Kroah-Hartman

staging: r8712u: Add new device ID

2013-01-17T16:46:35+00:00

commit da849a92d3bafaf24d770e971c2c9e5c3f60b5d1 upstream.

The ISY IWL 1000 USB WLAN stick with USB ID 050d:11f1 is a clone of
the Belkin F7D1101 V1 device.

Reported-by: Thomas Hartmann 
Signed-off-by: Larry Finger 
Cc: Thomas Hartmann 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: comedi_test: fix race when cancelling command

2013-01-17T16:46:35+00:00

commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream.

Éric Piel reported a kernel oops in the "comedi_test" module.  It was a
NULL pointer dereference within `waveform_ai_interrupt()` (actually a
timer function) that sometimes occurred when a running asynchronous
command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing
the device file).

This seems to be a race between the caller of `waveform_ai_cancel()`
which on return from that function goes and tears down the running
command, and the timer function which uses the command.  In particular,
`async->cmd.chanlist` gets freed (and the pointer set to NULL) by
`do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled
`waveform_ai_interrupt()` timer function will dereference that pointer
regardless, leading to the oops.

Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()`
with `del_timer_sync()`.

Signed-off-by: Ian Abbott 
Reported-by: Éric Piel 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: Kconfig: COMEDI_NI_AT_A2150 should select COMEDI_FC

2013-01-17T16:46:35+00:00

commit 34ffb33e09132401872fe79e95c30824ce194d23 upstream.

The 'ni_at_a2150' module links to `cfc_write_to_buffer` in the
'comedi_fc' module, so selecting 'COMEDI_NI_AT_A2150' in the kernel config
needs to also select 'COMEDI_FC'.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: fix minimum AO period for NI 625x and NI 628x

2013-01-17T16:46:31+00:00

commit 34b55d8c48f4f76044d8f4d6ec3dc786cf210312 upstream.

The minimum period was set to 357 ns, while the divider for these boards is 50
ns. This prevented to output at maximum speed as ni_ao_cmdtest() would return
357 but would not accept it.

Not sure why it was set to 357 ns (this was done before the git history,
which starts 5 years ago). My guess is that it comes from reading the
specification stating a 2.8 MHz rate (~ 357 ns). The latest
specification states a 2.86 MHz rate (~ 350 ns), which makes a lot
more sense.

Tested on a pci-6251.

Signed-off-by: Éric Piel 
Acked-By: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman