kernel/linux.git, branch v4.13.1

Linux 4.13.1

2017-09-10T05:45:52+00:00

rtlwifi: Fix fallback firmware loading

2017-09-09T15:39:28+00:00

commit 1d9b168d8ea9a0f51947d0e2f84856e77d2fe7ff upstream. Commit f70e4df2b384 ("rtlwifi: Add code to read new versions of firmware") added code to load an old firmware file if the new one is not available. Unfortunately that code is never reached because request_firmware_nowait() does not wait for the firmware to show up and returns 0 even if the file is not there. Use the existing fallback mechanism introduced by commit 62009b7f1279 ("rtlwifi: rtl8192cu: Add new firmware") instead. Fixes: f70e4df2b384 ("rtlwifi: Add code to read new versions of firmware") Signed-off-by: Sven Joachim Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman

rtlwifi: Fix memory leak when firmware request fails

2017-09-09T15:39:28+00:00

commit f2764f61fa10593204b0c5e4e9a68dba02112e50 upstream. This patch will fix memory leak when firmware request fails Signed-off-by: Souptick Joarder Acked-by: Larry Finger Signed-off-by: Kalle Valo Cc: Sven Joachim Signed-off-by: Greg Kroah-Hartman

of/device: Prevent buffer overflow in of_device_modalias()

2017-09-09T15:39:28+00:00

commit 08ab58d9de3eb8498ae0585001d0975e46217a39 upstream. As of_device_get_modalias() returns the number of bytes that would have been written to the target string, regardless of how much did fit in the buffer, it's possible that the returned index points beyond the buffer passed to of_device_modalias() - causing memory beyond the buffer to be null terminated. Fixes: 0634c2958927 ("of: Add function for generating a DT modalias with a newline") Cc: Rob Herring Signed-off-by: Bjorn Andersson Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman

scsi: sg: recheck MMAP_IO request length with lock held

2017-09-09T15:39:27+00:00

commit 8d26f491116feaa0b16de370b6a7ba40a40fa0b4 upstream. Commit 1bc0eb044615 ("scsi: sg: protect accesses to 'reserved' page array") adds needed concurrency protection for the "reserve" buffer. Some checks that are initially made outside the lock are replicated once the lock is taken to ensure the checks and resulting decisions are made using consistent state. The check that a request with flag SG_FLAG_MMAP_IO set fits in the reserve buffer also needs to be performed again under the lock to ensure the reserve buffer length compared against matches the value in effect when the request is linked to the reserve buffer. An -ENOMEM should be returned in this case, instead of switching over to an indirect buffer as for non-MMAP_IO requests. Signed-off-by: Todd Poynor Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE

2017-09-09T15:39:27+00:00

commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 upstream. Take f_mutex around mmap() processing to protect against races with the SG_SET_RESERVED_SIZE ioctl. Ensure the reserve buffer length remains consistent during the mapping operation, and set the "mmap called" flag to prevent further changes to the reserved buffer size as an atomic operation with the mapping. [mkp: fixed whitespace] Signed-off-by: Todd Poynor Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

cs5536: add support for IDE controller variant

2017-09-09T15:39:27+00:00

commit 591b6bb605785c12a21e8b07a08a277065b655a5 upstream. Several legacy devices such as Geode-based Cisco ASA appliances and DB800 development board do possess CS5536 IDE controller with different PCI id than existing one. Using pata_generic is not always feasible as at least DB800 requires MSR quirk from pata_cs5536 to be used with vendor firmware. Signed-off-by: Andrey Korolyov Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman

ahci: don't use MSI for devices with the silly Intel NVMe remapping scheme

2017-09-09T15:39:27+00:00

commit f723fa4e69920f6a5dd5fa0d10ce90e2f14d189c upstream. Intel AHCI controllers that also hide NVMe devices in their bar can't use MSI interrupts, so disable them. Reported-by: John Loy Tested-by: John Loy Signed-off-by: Christoph Hellwig Fixes: d684a90d38e2 ("ahci: per-port msix support") Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman

workqueue: Fix flag collision

2017-09-09T15:39:26+00:00

commit fbf1c41fc0f4d3574ac2377245efd666c1fa3075 upstream. Commit 0a94efb5acbb ("workqueue: implicit ordered attribute should be overridable") introduced a __WQ_ORDERED_EXPLICIT flag but gave it the same value as __WQ_LEGACY. I don't believe these were intended to mean the same thing, so renumber __WQ_ORDERED_EXPLICIT. Fixes: 0a94efb5acbb ("workqueue: implicit ordered attribute should be ...") Signed-off-by: Ben Hutchings Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman

drm/nouveau: Fix error handling in nv50_disp_atomic_commit

2017-09-09T15:39:26+00:00

commit 813a7e1604eaad1c2792d37d402e1b48b8d0eb3f upstream. Make it more clear that post commit return ret is really return 0, and add a missing drm_atomic_helper_cleanup_planes when drm_atomic_helper_wait_for_fences fails. Fixes: 839ca903f12e ("drm/nouveau/kms/nv50: transition to atomic interfaces internally") Cc: Ben Skeggs Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/20170711143314.2148-2-maarten.lankhorst@linux.intel.com Reviewed-by: Sean Paul [mlankhorst: Use if (ret) to remove the goto in success case.] Reviewed-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman