BMC/Intel-BMC/linux.git/drivers/staging, branch v4.18.18

staging: pi433: fix race condition in pi433_ioctl

2018-10-03T23:59:16+00:00

[ Upstream commit 6de4ef65a8c6f53ce7eef06666410bc3b6e4b624 ] In the PI433_IOC_WR_TX_CFG case in pi433_ioctl, instance->tx_cfg is modified via copy_from_user(&instance->tx_cfg, argp, sizeof(struct pi433_tx_cfg))) without any kind of synchronization. In the case where two threads would execute this same command concurrently the tx_cfg field might enter in an inconsistent state. Additionally: if ioctl(PI433_IOC_WR_TX_CFG) and write() execute concurrently the tx config might be modified while it is being copied to the fifo, resulting in potential data corruption. Fix: Get instance->tx_cfg_lock before modifying tx config in the PI433_IOC_WR_TX_CFG case in pi433_ioctl. Also, do not copy data directly from user space to instance->tx_cfg. Instead use a temporary buffer allowing future checks for correctness of copied data and simpler code. Signed-off-by: Hugo Lefeuvre Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: mt7621-dts: Fix remaining pcie warnings

2018-10-03T23:59:11+00:00

[ Upstream commit d0233204fbc10f003d1ef077f57341c2feca4002 ] This currently fixes the remaining dtb warnings: Node /pcie@1e140000/pcie0 has a reg or ranges property, but no unit name Node /pcie@1e140000/pcie1 has a reg or ranges property, but no unit name Node /pcie@1e140000/pcie2 has a reg or ranges property, but no unit name Node /pcie@1e140000/pcie0 node name is not "pci" or "pcie" Node /pcie@1e140000/pcie0 missing ranges for PCI bridge (or not a bridge) Node /pcie@1e140000/pcie0 missing bus-range for PCI bridge Node /pcie@1e140000/pcie1 node name is not "pci" or "pcie" Node /pcie@1e140000/pcie1 missing ranges for PCI bridge (or not a bridge) Node /pcie@1e140000/pcie1 missing bus-range for PCI bridge Node /pcie@1e140000/pcie2 node name is not "pci" or "pcie" Node /pcie@1e140000/pcie2 missing ranges for PCI bridge (or not a bridge) Node /pcie@1e140000/pcie2 missing bus-range for PCI bridge Warning (unit_address_format): Failed prerequisite 'pci_bridge' Warning (pci_device_reg): Failed prerequisite 'pci_bridge' Warning (pci_device_bus_num): Failed prerequisite 'pci_bridge' device_type was removed since according to documentation, it's deprecated for pci(e) devices. Signed-off-by: Rosen Penev Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: mt7621-eth: Fix memory leak in mtk_add_mac() error path

2018-10-03T23:59:11+00:00

[ Upstream commit 85e1d42663a0c163002961d2685be952067b0dc2 ] Fix memory leak in error path of mtk_add_mac() by make sure to free the allocated netdev. Fixes: e3cbf478f846 ('staging: mt7621-eth: add the drivers core files') Signed-off-by: Kamal Heib Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: Fix mmap size validation

2018-10-03T23:59:11+00:00

[ Upstream commit 8632c614565d0c5fdde527889601c018e97b6384 ] The ashmem driver did not check that the size/offset of the vma passed to its .mmap() function was not larger than the ashmem object being mapped. This could cause mmap() to succeed, even though accessing parts of the mapping would later fail with a segmentation fault. Ensure an error is returned by the ashmem_mmap() function if the vma size is larger than the ashmem object size. This enables safer handling of the problem in userspace. Cc: Todd Kjos Cc: devel@driverdev.osuosl.org Cc: linux-kernel@vger.kernel.org Cc: kernel-team@android.com Cc: Joel Fernandes Signed-off-by: Alistair Strachan Acked-by: Joel Fernandes (Google) Reviewed-by: Martijn Coenen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

media: staging/imx: fill vb2_v4l2_buffer field entry

2018-10-03T23:59:07+00:00

[ Upstream commit a38d4b71cb7a12b65317f4e3d59883a918957719 ] - fixes gstreamer v4l2src warning: 0:00:00.716640334 349 0x164f720 WARN v4l2bufferpool gstv4l2bufferpool.c:1195:gst_v4l2_buffer_pool_dqbuf: Driver should never set v4l2_buffer.field to ANY - fixes v4l2-compliance test failure: Streaming ioctls: test read/write: OK (Not Supported) Video Capture: Buffer: 0 Sequence: 0 Field: Any Timestamp: 58.383658s fail: v4l2-test-buffers.cpp(297): g_field() == V4L2_FIELD_ANY Signed-off-by: Peter Seiderer Reviewed-by: Steve Longerbeam Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rts5208: fix missing error check on call to rtsx_write_register

2018-10-03T23:59:04+00:00

[ Upstream commit c5fae4f4fd28189b1062fb8ef7b21fec37cb8b17 ] Currently the check on error return from the call to rtsx_write_register is checking the error status from the previous call. Fix this by adding in the missing assignment of retval. Detected by CoverityScan, CID#709877 Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288") Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: fsl-dpaa2/eth: Fix DMA mapping direction

2018-09-26T06:39:42+00:00

[ Upstream commit 466bcdc1fa303be175c45d054bb00effc575033a ] We are using DMA_FROM_DEVICE when mapping RX frame buffers, but DMA_BIDIRECTIONAL for unmap. Fix the direction for DMA unmapping operation. Fixes: 87eb55e418b7 ("staging: fsl-dpaa2/eth: Fix potential endless loop") Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: bcm2835-audio: Don't leak workqueue if open fails

2018-09-26T06:39:40+00:00

[ Upstream commit 678c5b119307c40f9a17152512f9c949d0ec7292 ] Currently, if bcm2835_audio_open() fails partway, the allocated workqueue is leaked. Avoid that. While at it, propagate the return value of bcm2835_audio_open_connection() on failure instead of returning -1. Signed-off-by: Tuomas Tynkkynen Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: bcm2835-camera: handle wait_for_completion_timeout return properly

2018-09-26T06:39:26+00:00

[ Upstream commit 5b70084f6cbcd53f615433f9d216e01bd71de0bb ] wait_for_completion_timeout returns unsigned long not int so a variable of proper type is introduced. Further the check for <= 0 is ambiguous and should be == 0 here indicating timeout. Signed-off-by: Nicholas Mc Guire Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.") Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: bcm2835-camera: fix timeout handling in wait_for_completion_timeout

2018-09-26T06:39:26+00:00

[ Upstream commit b7afce51d95726a619743aaad8870db66dfa1479 ] wait_for_completion_timeout returns unsigned long not int so a variable of proper type is introduced. Further the check for <= 0 is ambiguous and should be == 0 here indicating timeout which is the only error case so no additional check needed here. Signed-off-by: Nicholas Mc Guire Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.") Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman