linux-stable.git/drivers/staging, branch v4.19.22

staging: speakup: fix tty-operation NULL derefs

2019-02-12T18:47:25+00:00

commit a1960e0f1639cb1f7a3d94521760fc73091f6640 upstream.

The send_xchar() and tiocmset() tty operations are optional. Add the
missing sanity checks to prevent user-space triggerable NULL-pointer
dereferences.

Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
Cc: stable      # 4.13
Cc: Okash Khawaja 
Cc: Samuel Thibault 
Signed-off-by: Johan Hovold 
Reviewed-by: Samuel Thibault 
Signed-off-by: Greg Kroah-Hartman

staging: pi433: fix potential null dereference

2019-02-12T18:47:02+00:00

[ Upstream commit 64c4c4ca6c129a4191e8e1e91b2d5d9b8d08c518 ]

Add a test for successful call to cdev_alloc() to avoid
potential null dereference. Issue reported by smatch.

Signed-off-by: Michael Straube 
Fixes: 874bcba65f9a ("staging: pi433: New driver")
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: erofs: fix the definition of DBG_BUGON

2019-02-12T18:47:01+00:00

[ Upstream commit eef168789866514e5d4316f030131c9fe65b643f ]

It's better not to positively BUG_ON the kernel, however developers
need a way to locate issues as soon as possible.

DBG_BUGON is introduced and it could only crash when EROFS_FS_DEBUG
(EROFS developping feature) is on. It is helpful for developers
to find and solve bugs quickly by eng builds.

Previously, DBG_BUGON is defined as ((void)0) if EROFS_FS_DEBUG is off,
but some unused variable warnings as follows could occur:

drivers/staging/erofs/unzip_vle.c: In function `init_alway:':
drivers/staging/erofs/unzip_vle.c:61:33: warning: unused variable `work' [-Wunused-variable]
  struct z_erofs_vle_work *const work =
                                 ^~~~

Fix it to #define DBG_BUGON(x) ((void)(x)).

Reviewed-by: Chao Yu 
Signed-off-by: Gao Xiang 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: iio: ad7780: update voltage on read

2019-02-12T18:47:00+00:00

[ Upstream commit 336650c785b62c3bea7c8cf6061c933a90241f67 ]

The ad7780 driver previously did not read the correct device output, as
it read an outdated value set at initialization. It now updates its
voltage on read.

Signed-off-by: Renato Lui Geh 
Acked-by: Alexandru Ardelean 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin

staging:iio:ad2s90: Make probe handle spi_setup failure

2019-02-12T18:46:59+00:00

[ Upstream commit b3a3eafeef769c6982e15f83631dcbf8d1794efb ]

Previously, ad2s90_probe ignored the return code from spi_setup, not
handling its possible failure. This patch makes ad2s90_probe check if
the code is an error code and, if so, do the following:

- Call dev_err with an appropriate error message.
- Return the spi_setup's error code.

Note: The 'return ret' statement could be out of the 'if' block, but
this whole block will be moved up in the function in the patch:
'staging:iio:ad2s90: Move device registration to the end of probe'.

Signed-off-by: Matheus Tavares 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin

dpaa2-ptp: defer probe when portal allocation failed

2019-02-12T18:46:59+00:00

[ Upstream commit 5500598abbfb5b46201b9768bd9ea873a5eeaece ]

The fsl_mc_portal_allocate can fail when the requested MC portals are
not yet probed by the fsl_mc_allocator. In this situation, the driver
should defer the probe.

Signed-off-by: Ioana Ciornei 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

staging: iio: adc: ad7280a: handle error from __ad7280_read32()

2019-02-12T18:46:56+00:00

[ Upstream commit 0559ef7fde67bc6c83c6eb6329dbd6649528263e ]

Inside __ad7280_read32(), the spi_sync_transfer() can fail with negative
error code. This change will ensure that this error is being passed up
in the call stack, so it can be handled.

Signed-off-by: Slawomir Stepien 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin

staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1

2019-01-31T07:14:36+00:00

commit 5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a upstream.

This device was added to the stand-alone driver on github.
Add it to the staging driver as well.

Link: https://github.com/lwfinger/rtl8188eu/commit/a0619a07cd1e
Signed-off-by: Michael Straube 
Acked-by: Larry Finger 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

staging: erofs: fix use-after-free of on-stack `z_erofs_vle_unzip_io'

2019-01-26T08:32:38+00:00

[ Upstream commit 848bd9acdcd00c164b42b14aacec242949ecd471 ]

The root cause is the race as follows:
 Thread #0                         Thread #1

 z_erofs_vle_unzip_kickoff         z_erofs_submit_and_unzip

                                    struct z_erofs_vle_unzip_io io[]
   atomic_add_return()
                                    wait_event()
                                    [end of function]
   wake_up()

Fix it by taking the waitqueue lock between atomic_add_return and
wake_up to close such the race.

kernel message:

Unable to handle kernel paging request at virtual address 97f7052caa1303dc
...
Workqueue: kverityd verity_work
task: ffffffe32bcb8000 task.stack: ffffffe3298a0000
PC is at __wake_up_common+0x48/0xa8
LR is at __wake_up+0x3c/0x58
...
Call trace:
...
[] __wake_up_common+0x48/0xa8
[] __wake_up+0x3c/0x58
[] z_erofs_vle_unzip_kickoff+0x40/0x64
[] z_erofs_vle_read_endio+0x94/0x134
[] bio_endio+0xe4/0xf8
[] dec_pending+0x134/0x32c
[] clone_endio+0x90/0xf4
[] bio_endio+0xe4/0xf8
[] verity_work+0x210/0x368
[] process_one_work+0x188/0x4b4
[] worker_thread+0x140/0x458
[] kthread+0xec/0x108
[] ret_from_fork+0x10/0x1c
Code: d1006273 54000260 f9400804 b9400019 (b85fc081)
---[ end trace be9dde154f677cd1 ]---

Reviewed-by: Chao Yu 
Signed-off-by: Gao Xiang 
Signed-off-by: Greg Kroah-Hartman 

Signed-off-by: Sasha Levin

staging: rtl8188eu: Fix module loading from tasklet for WEP encryption

2019-01-16T21:04:29+00:00

commit 7775665aadc48a562051834a73519129bf717d73 upstream.

Commit 2b2ea09e74a5 ("staging:r8188eu: Use lib80211 to decrypt WEP-frames")
causes scheduling while atomic bugs followed by a hard freeze whenever
the driver tries to connect to a WEP-encrypted network. Experimentation
showed that the freezes were eliminated when module lib80211 was
preloaded, which can be forced by calling lib80211_get_crypto_ops()
directly rather than indirectly through try_then_request_module().
With this change, no BUG messages are logged.

Fixes: 2b2ea09e74a5 ("staging:r8188eu: Use lib80211 to decrypt WEP-frames")
Cc: Stable  # v4.17+
Cc: Michael Straube 
Cc: Ivan Safonov 
Signed-off-by: Larry Finger 
Signed-off-by: Greg Kroah-Hartman