Commit f19e6c69 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging fixes from Greg KH:
 "Here are some tiny drivers/staging/ fixes for 3.11-rc3

  A number of bugfixes, all pretty tiny, but resolve issues that have
  been reported (the kstrtos32 change fixes a data corruption problem
  that Dan found).  And a MAINTAINERS file update for the comedi
  drivers"

* tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  MAINTAINERS: Update the list of maintainers for staging/comedi driver.
  staging: tidspbridge: replace strict_strtol() with kstrtos32()
  staging: android: logger: Correct write offset reset on error
  staging: zram: protect zram_reset_device() call
  staging: gdm72xx: potential use after free in send_qos_list()
  staging: drm/imx: drop "select OF_VIDEOMODE"
  staging: frontier: use after free in disconnect()
  staging: comedi: fix a race between do_cmd_ioctl() and read/write
  staging: comedi: COMEDI_CANCEL ioctl should wake up read/write
parents 05e4cb7c 81b884c9
...@@ -7818,7 +7818,7 @@ F: drivers/staging/asus_oled/ ...@@ -7818,7 +7818,7 @@ F: drivers/staging/asus_oled/
STAGING - COMEDI STAGING - COMEDI
M: Ian Abbott <abbotti@mev.co.uk> M: Ian Abbott <abbotti@mev.co.uk>
M: Mori Hess <fmhess@users.sourceforge.net> M: H Hartley Sweeten <hsweeten@visionengravers.com>
S: Odd Fixes S: Odd Fixes
F: drivers/staging/comedi/ F: drivers/staging/comedi/
......
...@@ -469,7 +469,7 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov, ...@@ -469,7 +469,7 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
unsigned long nr_segs, loff_t ppos) unsigned long nr_segs, loff_t ppos)
{ {
struct logger_log *log = file_get_log(iocb->ki_filp); struct logger_log *log = file_get_log(iocb->ki_filp);
size_t orig = log->w_off; size_t orig;
struct logger_entry header; struct logger_entry header;
struct timespec now; struct timespec now;
ssize_t ret = 0; ssize_t ret = 0;
...@@ -490,6 +490,8 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov, ...@@ -490,6 +490,8 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
mutex_lock(&log->mutex); mutex_lock(&log->mutex);
orig = log->w_off;
/* /*
* Fix up any readers, pulling them forward to the first readable * Fix up any readers, pulling them forward to the first readable
* entry after (what will be) the new write offset. We do this now * entry after (what will be) the new write offset. We do this now
......
...@@ -9,4 +9,4 @@ TODO: ...@@ -9,4 +9,4 @@ TODO:
Please send patches to Greg Kroah-Hartman <greg@kroah.com> and Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
copy: copy:
Ian Abbott <abbotti@mev.co.uk> Ian Abbott <abbotti@mev.co.uk>
Frank Mori Hess <fmhess@users.sourceforge.net> H Hartley Sweeten <hsweeten@visionengravers.com>
...@@ -1413,22 +1413,19 @@ static int do_cmd_ioctl(struct comedi_device *dev, ...@@ -1413,22 +1413,19 @@ static int do_cmd_ioctl(struct comedi_device *dev,
DPRINTK("subdevice busy\n"); DPRINTK("subdevice busy\n");
return -EBUSY; return -EBUSY;
} }
s->busy = file;
/* make sure channel/gain list isn't too long */ /* make sure channel/gain list isn't too long */
if (cmd.chanlist_len > s->len_chanlist) { if (cmd.chanlist_len > s->len_chanlist) {
DPRINTK("channel/gain list too long %u > %d\n", DPRINTK("channel/gain list too long %u > %d\n",
cmd.chanlist_len, s->len_chanlist); cmd.chanlist_len, s->len_chanlist);
ret = -EINVAL; return -EINVAL;
goto cleanup;
} }
/* make sure channel/gain list isn't too short */ /* make sure channel/gain list isn't too short */
if (cmd.chanlist_len < 1) { if (cmd.chanlist_len < 1) {
DPRINTK("channel/gain list too short %u < 1\n", DPRINTK("channel/gain list too short %u < 1\n",
cmd.chanlist_len); cmd.chanlist_len);
ret = -EINVAL; return -EINVAL;
goto cleanup;
} }
async->cmd = cmd; async->cmd = cmd;
...@@ -1438,8 +1435,7 @@ static int do_cmd_ioctl(struct comedi_device *dev, ...@@ -1438,8 +1435,7 @@ static int do_cmd_ioctl(struct comedi_device *dev,
kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL); kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
if (!async->cmd.chanlist) { if (!async->cmd.chanlist) {
DPRINTK("allocation failed\n"); DPRINTK("allocation failed\n");
ret = -ENOMEM; return -ENOMEM;
goto cleanup;
} }
if (copy_from_user(async->cmd.chanlist, user_chanlist, if (copy_from_user(async->cmd.chanlist, user_chanlist,
...@@ -1491,6 +1487,9 @@ static int do_cmd_ioctl(struct comedi_device *dev, ...@@ -1491,6 +1487,9 @@ static int do_cmd_ioctl(struct comedi_device *dev,
comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING); comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
/* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
* comedi_read() or comedi_write() */
s->busy = file;
ret = s->do_cmd(dev, s); ret = s->do_cmd(dev, s);
if (ret == 0) if (ret == 0)
return 0; return 0;
...@@ -1705,6 +1704,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg, ...@@ -1705,6 +1704,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
void *file) void *file)
{ {
struct comedi_subdevice *s; struct comedi_subdevice *s;
int ret;
if (arg >= dev->n_subdevices) if (arg >= dev->n_subdevices)
return -EINVAL; return -EINVAL;
...@@ -1721,7 +1721,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg, ...@@ -1721,7 +1721,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
if (s->busy != file) if (s->busy != file)
return -EBUSY; return -EBUSY;
return do_cancel(dev, s); ret = do_cancel(dev, s);
if (comedi_get_subdevice_runflags(s) & SRF_USER)
wake_up_interruptible(&s->async->wait_head);
return ret;
} }
/* /*
...@@ -2053,11 +2057,13 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, ...@@ -2053,11 +2057,13 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
if (!comedi_is_subdevice_running(s)) { if (!comedi_is_subdevice_running(s)) {
if (count == 0) { if (count == 0) {
mutex_lock(&dev->mutex);
if (comedi_is_subdevice_in_error(s)) if (comedi_is_subdevice_in_error(s))
retval = -EPIPE; retval = -EPIPE;
else else
retval = 0; retval = 0;
do_become_nonbusy(dev, s); do_become_nonbusy(dev, s);
mutex_unlock(&dev->mutex);
} }
break; break;
} }
...@@ -2156,11 +2162,13 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, ...@@ -2156,11 +2162,13 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
if (n == 0) { if (n == 0) {
if (!comedi_is_subdevice_running(s)) { if (!comedi_is_subdevice_running(s)) {
mutex_lock(&dev->mutex);
do_become_nonbusy(dev, s); do_become_nonbusy(dev, s);
if (comedi_is_subdevice_in_error(s)) if (comedi_is_subdevice_in_error(s))
retval = -EPIPE; retval = -EPIPE;
else else
retval = 0; retval = 0;
mutex_unlock(&dev->mutex);
break; break;
} }
if (file->f_flags & O_NONBLOCK) { if (file->f_flags & O_NONBLOCK) {
...@@ -2198,9 +2206,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, ...@@ -2198,9 +2206,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
buf += n; buf += n;
break; /* makes device work like a pipe */ break; /* makes device work like a pipe */
} }
if (comedi_is_subdevice_idle(s) && if (comedi_is_subdevice_idle(s)) {
async->buf_read_count - async->buf_write_count == 0) { mutex_lock(&dev->mutex);
if (async->buf_read_count - async->buf_write_count == 0)
do_become_nonbusy(dev, s); do_become_nonbusy(dev, s);
mutex_unlock(&dev->mutex);
} }
set_current_state(TASK_RUNNING); set_current_state(TASK_RUNNING);
remove_wait_queue(&async->wait_head, &wait); remove_wait_queue(&async->wait_head, &wait);
......
...@@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf) ...@@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf)
mutex_unlock(&dev->mtx); mutex_unlock(&dev->mtx);
usb_alphatrack_delete(dev); usb_alphatrack_delete(dev);
} else { } else {
atomic_set(&dev->writes_pending, 0);
dev->intf = NULL; dev->intf = NULL;
mutex_unlock(&dev->mtx); mutex_unlock(&dev->mtx);
} }
atomic_set(&dev->writes_pending, 0);
mutex_unlock(&disconnect_mutex); mutex_unlock(&disconnect_mutex);
dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n", dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n",
......
...@@ -250,8 +250,8 @@ static void send_qos_list(struct nic *nic, struct list_head *head) ...@@ -250,8 +250,8 @@ static void send_qos_list(struct nic *nic, struct list_head *head)
list_for_each_entry_safe(entry, n, head, list) { list_for_each_entry_safe(entry, n, head, list) {
list_del(&entry->list); list_del(&entry->list);
free_qos_entry(entry);
gdm_wimax_send_tx(entry->skb, entry->dev); gdm_wimax_send_tx(entry->skb, entry->dev);
free_qos_entry(entry);
} }
} }
......
...@@ -33,7 +33,6 @@ config DRM_IMX_TVE ...@@ -33,7 +33,6 @@ config DRM_IMX_TVE
config DRM_IMX_LDB config DRM_IMX_LDB
tristate "Support for LVDS displays" tristate "Support for LVDS displays"
depends on DRM_IMX depends on DRM_IMX
select OF_VIDEOMODE
help help
Choose this to enable the internal LVDS Display Bridge (LDB) Choose this to enable the internal LVDS Display Bridge (LDB)
found on i.MX53 and i.MX6 processors. found on i.MX53 and i.MX6 processors.
......
...@@ -1120,8 +1120,11 @@ static int dbll_rmm_alloc(struct dynamic_loader_allocate *this, ...@@ -1120,8 +1120,11 @@ static int dbll_rmm_alloc(struct dynamic_loader_allocate *this,
or DYN_EXTERNAL, then mem granularity information is present or DYN_EXTERNAL, then mem granularity information is present
within the section name - only process if there are at least three within the section name - only process if there are at least three
tokens within the section name (just a minor optimization) */ tokens within the section name (just a minor optimization) */
if (count >= 3) if (count >= 3) {
strict_strtol(sz_last_token, 10, (long *)&req); status = kstrtos32(sz_last_token, 10, &req);
if (status)
goto func_cont;
}
if ((req == 0) || (req == 1)) { if ((req == 0) || (req == 1)) {
if (strcmp(sz_sec_last_token, "DYN_DARAM") == 0) { if (strcmp(sz_sec_last_token, "DYN_DARAM") == 0) {
......
...@@ -527,8 +527,11 @@ static void zram_reset_device(struct zram *zram) ...@@ -527,8 +527,11 @@ static void zram_reset_device(struct zram *zram)
size_t index; size_t index;
struct zram_meta *meta; struct zram_meta *meta;
if (!zram->init_done) down_write(&zram->init_lock);
if (!zram->init_done) {
up_write(&zram->init_lock);
return; return;
}
meta = zram->meta; meta = zram->meta;
zram->init_done = 0; zram->init_done = 0;
...@@ -549,6 +552,7 @@ static void zram_reset_device(struct zram *zram) ...@@ -549,6 +552,7 @@ static void zram_reset_device(struct zram *zram)
zram->disksize = 0; zram->disksize = 0;
set_capacity(zram->disk, 0); set_capacity(zram->disk, 0);
up_write(&zram->init_lock);
} }
static void zram_init_device(struct zram *zram, struct zram_meta *meta) static void zram_init_device(struct zram *zram, struct zram_meta *meta)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment