1. 13 Feb, 2016 13 commits
    • Uri Mashiach's avatar
      wlcore/wl12xx: spi: fix oops on firmware load · b6a44d86
      Uri Mashiach authored
      commit 9b2761cb upstream.
      
      The maximum chunks used by the function is
      (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
      The original commands array had space for
      (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
      When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
      command is stored outside the bounds of the commands array.
      
      Oops 5 (page fault) is generated during current wl1271 firmware load
      attempt:
      
      root@debian-armhf:~# ifconfig wlan0 up
      [  294.312399] Unable to handle kernel paging request at virtual address
      00203fc4
      [  294.320173] pgd = de528000
      [  294.323028] [00203fc4] *pgd=00000000
      [  294.326916] Internal error: Oops: 5 [#1] SMP ARM
      [  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
      wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
      wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
      hwmon
      [  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
      4.2.0-00002-g3e9ad27-dirty #78
      [  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
      [  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
      [  294.372236] PC is at __spi_validate+0xa8/0x2ac
      [  294.376902] LR is at __spi_sync+0x78/0x210
      [  294.381200] pc : [<c049c760>]    lr : [<c049ebe0>]    psr: 60000013
      [  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
      [  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
      [  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
      00203fbc
      [  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
      de3a9000
      [  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
      Segment user
      [  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
      [  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
      [  294.432437] Stack: (0xde551998 to 0xde552000)
      
      ...
      
      [  294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>]
      (__spi_sync+0x78/0x210)
      [  294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>]
      (wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
      [  294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from
      [<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
      [  294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from
      [<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx])
      [  294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>]
      (wl1271_op_add_interface+0x5b0/0x910 [wlcore])
      [  294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from
      [<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211])
      [  294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from
      [<c0537978>] (__dev_open+0xa8/0x110)
      [  294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>]
      (__dev_change_flags+0x88/0x148)
      [  294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>]
      (dev_change_flags+0x18/0x48)
      [  294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>]
      (devinet_ioctl+0x6b4/0x7d0)
      [  294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>]
      (sock_ioctl+0x1e4/0x2bc)
      [  294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>]
      (do_vfs_ioctl+0x420/0x6b0)
      [  294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>]
      (SyS_ioctl+0x6c/0x7c)
      [  295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>]
      (ret_fast_syscall+0x0/0x54)
      [  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
      [  295.021544] ---[ end trace 66ed188198f4e24e ]---
      Signed-off-by: default avatarUri Mashiach <uri.mashiach@compulab.co.il>
      Acked-by: default avatarIgor Grinberg <grinberg@compulab.co.il>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      [bwh: Backported to 3.2: adjust filename, context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      b6a44d86
    • Janusz.Dziedzic@tieto.com's avatar
      wlcore: SPI - fix spi transfer_list · 2cb83853
      Janusz.Dziedzic@tieto.com authored
      commit 4eeac22c upstream.
      
      In corner case for wl12xx_spi_raw_write() when
      	len == SPI_AGGR_BUFFER_SIZE
      we don't setup correctly spi transfer_list.
      Next we will have garbage and strange errors
      reported by SPI framework (eg. wrong speed_hz,
      failed to transfer one message from queue)
      when iterate transfer_list.
      Signed-off-by: default avatarJanusz Dziedzic <janusz.dziedzic@tieto.com>
      Signed-off-by: default avatarLuciano Coelho <luca@coelho.fi>
      [bwh: Backported to 3.2: adjust filename, context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      2cb83853
    • Peter Wu's avatar
      rtlwifi: fix memory leak for USB device · 5ad6094b
      Peter Wu authored
      commit 17bc5586 upstream.
      
      Free skb for received frames with a wrong checksum. This can happen
      pretty rapidly, exhausting all memory.
      
      This fixes a memleak (detected with kmemleak). Originally found while
      using monitor mode, but it also appears during managed mode (once the
      link is up).
      Signed-off-by: default avatarPeter Wu <peter@lekensteyn.nl>
      ACKed-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      [bwh: Backported to 3.2: adjust filename, context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      5ad6094b
    • Oliver Neukum's avatar
      xhci: refuse loading if nousb is used · bc53b1e2
      Oliver Neukum authored
      commit 1eaf35e4 upstream.
      
      The module should fail to load.
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      [bwh: Backported to 3.2: xhci_hcd_init() registers the PCI driver, so
       check before doing that rather than at the end of the function]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      bc53b1e2
    • Alex Deucher's avatar
      drm/radeon: call hpd_irq_event on resume · 9b6775a5
      Alex Deucher authored
      commit dbb17a21 upstream.
      
      Need to call this on resume if displays changes during
      suspend in order to properly be notified of changes.
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      [bwh: Backported to 3.2: adjust context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      9b6775a5
    • Boris BREZILLON's avatar
      mtd: nand: fix ONFI parameter page layout · f247d52a
      Boris BREZILLON authored
      commit de64aa9e upstream.
      
      src_ssync_features field is only 1 byte large, and the 4th reserved area
      is actually 8 bytes large.
      
      Fixes: d1e1f4e4 ("mtd: nand: add support for reading ONFI parameters from NAND device")
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
      Signed-off-by: default avatarBrian Norris <computersforpeace@gmail.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      f247d52a
    • Dan Carpenter's avatar
      ath9k_htc: check for underflow in ath9k_htc_rx_msg() · 63610964
      Dan Carpenter authored
      commit 3a318426 upstream.
      
      We check for overflow here, but we don't check for underflow so it
      causes a static checker warning.
      
      Fixes: fb9987d0 ('ath9k_htc: Support for AR9271 chipset.')
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      63610964
    • Paolo Bonzini's avatar
      KVM: x86: correctly print #AC in traces · c2456538
      Paolo Bonzini authored
      commit aba2f06c upstream.
      
      Poor #AC was so unimportant until a few days ago that we were
      not even tracing its name correctly.  But now it's all over
      the place.
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      c2456538
    • Paolo Bonzini's avatar
      KVM: x86: expose MSR_TSC_AUX to userspace · bc48f6f5
      Paolo Bonzini authored
      commit 9dbe6cf9 upstream.
      
      If we do not do this, it is not properly saved and restored across
      migration.  Windows notices due to its self-protection mechanisms,
      and is very upset about it (blue screen of death).
      
      Cc: Radim Krcmar <rkrcmar@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      [bwh: Backported to 3.2:
       - We didn't yet have the switch() in kvm_init_msr_list as MPX is not
         supported at all
       - Adjust context]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      bc48f6f5
    • Arnd Bergmann's avatar
      SCSI: initio: remove duplicate module device table · 558c1f07
      Arnd Bergmann authored
      commit d282e2b3 upstream.
      
      The initio driver has for many years had two copies of the
      same module device table. One of them is also used for registering
      the other driver, the other one is entirely useless after the
      large scale cleanup that Alan Cox did back in 2007.
      
      The compiler warns about this whenever the driver is built-in:
      
      drivers/scsi/initio.c:131:29: warning: 'i91u_pci_devices' defined but not used [-Wunused-variable]
      
      This removes the extraneous table and the warning.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Fixes: 72d39fea ("[SCSI] initio: Convert into a real Linux driver and update to modern style")
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      558c1f07
    • Russell King's avatar
      rc: allow rc modules to be loaded if rc-main is not a module · a3277e20
      Russell King authored
      commit 2ff56fad upstream.
      
      rc-main mistakenly uses #ifdef MODULE to determine whether it should
      load the rc keymap modules.  This symbol is only defined if rc-main
      is being built as a module itself, and bears no relation to whether
      the rc keymaps are modules.
      
      Fix this to use CONFIG_MODULES instead.
      
      Fixes: 631493ec ("[media] rc-core: merge rc-map.c into rc-main.c")
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      a3277e20
    • Malcolm Priestley's avatar
      media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode · 5f18d55c
      Malcolm Priestley authored
      commit c9d57de6 upstream.
      
      When in FE_TUNE_MODE_ONESHOT the frontend must report
      the actual capabilities so user can take appropriate
      action.
      
      With frontends that can't do auto inversion this is done
      by dvb-core automatically so CAN_INVERSION_AUTO is valid.
      
      However, when in FE_TUNE_MODE_ONESHOT this is not true.
      
      So only set FE_CAN_INVERSION_AUTO in modes other than
      FE_TUNE_MODE_ONESHOT
      Signed-off-by: default avatarMalcolm Priestley <tvboxspy@gmail.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      [bwh: Backported to 3.2: adjust filename]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      5f18d55c
    • Antonio Ospite's avatar
      gspca: ov534/topro: prevent a division by 0 · 125ccb64
      Antonio Ospite authored
      commit dcc7fdbe upstream.
      
      v4l2-compliance sends a zeroed struct v4l2_streamparm in
      v4l2-test-formats.cpp::testParmType(), and this results in a division by
      0 in some gspca subdrivers:
      
        divide error: 0000 [#1] SMP
        Modules linked in: gspca_ov534 gspca_main ...
        CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1
        Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS
          ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010
        task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000
        RIP: 0010:[<ffffffffa079bd62>]  [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
        RSP: 0018:ffff880095c4fce8  EFLAGS: 00010296
        RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140
        RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000
        RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc
        R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400
        R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000
        FS:  00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0
        Stack:
         ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616
         ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000
         ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016
        Call Trace:
         [<ffffffffa07a6431>] ? v4l_s_parm+0x21/0x50 [videodev]
         [<ffffffffa077656e>] ? vidioc_s_parm+0x4e/0x60 [gspca_main]
         [<ffffffffa07a5e20>] ? __video_do_ioctl+0x280/0x2f0 [videodev]
         [<ffffffffa07a5ba0>] ? video_ioctl2+0x20/0x20 [videodev]
         [<ffffffffa07a59b9>] ? video_usercopy+0x319/0x4e0 [videodev]
         [<ffffffff81182dc1>] ? page_add_new_anon_rmap+0x71/0xa0
         [<ffffffff811afb92>] ? mem_cgroup_commit_charge+0x52/0x90
         [<ffffffff81179b18>] ? handle_mm_fault+0xc18/0x1680
         [<ffffffffa07a15cc>] ? v4l2_ioctl+0xac/0xd0 [videodev]
         [<ffffffff811c846f>] ? do_vfs_ioctl+0x28f/0x480
         [<ffffffff811c86d4>] ? SyS_ioctl+0x74/0x80
         [<ffffffff8154a8b6>] ? entry_SYSCALL_64_fastpath+0x16/0x75
        Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00
          00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 <f7>
          76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f
        RIP  [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
         RSP <ffff880095c4fce8>
        ---[ end trace 279710c2c6c72080 ]---
      
      Following what the doc says about a zeroed timeperframe (see
      http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html):
      
        ...
        To reset manually applications can just set this field to zero.
      
      fix the issue by resetting the frame rate to a default value in case of
      an unusable timeperframe.
      
      The fix is done in the subdrivers instead of gspca.c because only the
      subdrivers have notion of a default frame rate to reset the camera to.
      Signed-off-by: default avatarAntonio Ospite <ao2@ao2.it>
      Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      [bwh: Backported to 3.2: adjust filenames]
      Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
      125ccb64
  2. 22 Jan, 2016 27 commits