linux-stable.git/drivers/staging, branch v4.4.16

staging: iio: accel: fix error check

2016-07-27T16:47:36+00:00

commit ef3149eb3ddb7f9125e11c90f8330e371b55cffd upstream.

sca3000_read_ctrl_reg() returns a negative number on failure, check for
this instead of zero.

Signed-off-by: Luis de Bethencourt 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: das1800: fix possible NULL dereference

2016-06-01T19:15:52+00:00

commit d375278d666760e195693b57415ba0a125cadd55 upstream.

DMA is optional with this driver. If it was not enabled the devpriv->dma
pointer will be NULL.

Fix the possible NULL pointer dereference when trying to disable the DMA
channels in das1800_ai_cancel() and tidy up the comments to fix the
checkpatch.pl issues:
WARNING: line over 80 characters

It's probably harmless in das1800_ai_setup_dma() because the 'desc' pointer
will not be used if DMA is disabled but fix it there also.

Fixes: 99dfc3357e98 ("staging: comedi: das1800: remove depends on ISA_DMA_API limitation")
Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

IB/security: Restrict use of the write() interface

2016-05-04T21:48:48+00:00

commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 upstream.

The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: Jann Horn 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jason Gunthorpe 
[ Expanded check to all known write() entry points ]
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Set the length of the DMA sg entries in buffer

2016-04-20T06:42:16+00:00

commit 70bc916b2c80913753fb188d4daee50a64d21ba0 upstream.

ion_buffer_create() will allocate a buffer and then create a DMA
mapping for it, but it forgot to set the length of the page entries.

Signed-off-by: Liviu Dudau 
Signed-off-by: Jon Medhurst 
Acked-by: Laura Abbott 
Cc: Shawn Guo 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_mio_common: fix the ni_write[blw]() functions

2016-04-12T16:08:49+00:00

commit bd3a3cd6c27b117fb9a43a38c8072c95332beecc upstream.

Memory mapped io (dev->mmio) should not also be writing to the ioport
(dev->iobase) registers. Add the missing 'else' to these functions.

Fixes: 0953ee4acca0 ("staging: comedi: ni_mio_common: checkpatch.pl cleanup (else not useful)")
Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion_test: fix check of platform_device_register_simple() error code

2016-04-12T16:08:48+00:00

commit ccbc2a9e7878ff09bcaed4893c2a2d3adbb797e2 upstream.

On error platform_device_register_simple() returns ERR_PTR() value,
check for NULL always fails. The change corrects the check itself and
propagates the returned error upwards.

Fixes: 81fb0b901397 ("staging: android: ion_test: unregister the platform device")
Signed-off-by: Vladimir Zapolskiy 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg

2016-04-12T16:08:48+00:00

commit 1fd24a4702d2af0ea4d5845126cf57d4d1796216 upstream.

This fixes a bug in function ni_tio_input_inttrig().  The trigger number
should be compared to cmd->start_arg, not cmd->start_src.

Fixes: 6a760394d7eb ("staging: comedi: ni_tiocmd: clarify the cmd->start_arg validation and use")
Signed-off-by: Spencer E. Olson 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

Revert "Staging: panel: usleep_range is preferred over udelay"

2016-03-03T23:07:26+00:00

commit b64a1cbef6df47c986ad622b5b2e4d3d1940070c upstream.

This reverts commit ebd43516d3879f882a403836bba8bc5791f26a28.

We should not be sleeping inside spin_lock.

Fixes: ebd43516d387 ("Staging: panel: usleep_range is preferred over udelay")
Cc: Sirnam Swetha 
Signed-off-by: Sudip Mukherjee 
Reported-by: Huang, Ying 
Tested-by: Huang, Ying 
Signed-off-by: Greg Kroah-Hartman

Staging: speakup: Fix getting port information

2016-03-03T23:07:26+00:00

commit 327b882d3bcc1fba82dbd39b5cf5a838c81218e2 upstream.

Commit f79b0d9c223c ("staging: speakup: Fixed warning 
instead of ") broke the port information in the speakup
driver: SERIAL_PORT_DFNS only gets defined if asm/serial.h is included,
and no other header includes asm/serial.h.

We here make sure serialio.c does get the arch-specific definition of
SERIAL_PORT_DFNS from asm/serial.h, if any.

Along the way, this makes sure that we do have information for the
requested serial port number (index)

Fixes: f79b0d9c223c ("staging: speakup: Fixed warning  instead of ")
Signed-off-by: Samuel Thibault 
Signed-off-by: Greg Kroah-Hartman

staging/speakup: Use tty_ldisc_ref() for paste kworker

2016-02-25T20:01:14+00:00

commit f4f9edcf9b5289ed96113e79fa65a7bf27ecb096 upstream.

As the function documentation for tty_ldisc_ref_wait() notes, it is
only callable from a tty file_operations routine; otherwise there
is no guarantee the ref won't be NULL.

The key difference with the VT's paste_selection() is that is an ioctl,
where __speakup_paste_selection() is completely async kworker, kicked
off from interrupt context.

Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
       tty (ab)usage to match vt")
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman