Currently the user can set ff_effects_max to zero with the EV_FF bit (and
the FF_GAIN and/or FF_AUTOCENTER bits) set, in this case the uninitialized
methods ff->set_gain and/or ff->set_autocenter can be dereferenced,
resulting in a kernel oops.
Check in uinput_create_device() and print a helpful message and return
-EINVAL in case the check fails.
Signed-off-by: Elias Vanderstuyft <elias.vds@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Rework the uinput ABS validation to check passed absinfo data immediately,
but do ABS initialization as last step in UI_DEV_CREATE. The behavior
observed by user-space is not changed, as ABS initialization was never
checked for errors.
With this in place, the order of device initialization and abs
configuration is no longer fixed. Userspace can initialize the device and
afterwards set absinfo just fine.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This adds two new ioctls, UINPUT_DEV_SETUP and UI_ABS_SETUP, that replaces
the old device setup method (by write()'ing "struct uinput_user_dev" to the
node). The old method is not easily extendable and requires huge payloads.
Furthermore, overloading write() without properly versioned objects is
error-prone.
Therefore, we introduce two new ioctls to replace the old method. These
ioctls support all features of the old method, plus a "resolution" field
for absinfo. Furthermore, it's properly forward-compatible to new ABS codes
and a growing "struct input_absinfo" structure.
UI_ABS_SETUP also allows user-space to skip unknown axes if not set. There
is no need to copy the whole array temporarily into the kernel, but instead
the caller issues several ioctl where we copy each value manually.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Seems I lied in my last drm-misc pull request and suddenly there's a big
pile of random stuff. Boris dug out Thierry's drm-trivial branch and
resubmitted everything since that branch didn't really work out.
On top of that Nicolas' changes to drm_dev_set_unique - this might
conflict with new driver pulls (I double checked and current drm-next
should be fine), so please beware. The -next/-fixes conflict in vmwgfx
will change slightly with this here too.
* tag 'topic/drm-misc-2015-12-18' of git://anongit.freedesktop.org/drm-intel: (36 commits)
drm: use dev_name as default unique name in drm_dev_alloc()
drm: make drm_dev_set_unique() not use a format string
drm/vmwgfx: Constify function pointer structs
drm/udl: Constify function pointer structs
drm/tegra: Constify function pointer structs
drm/rockchip: Constify function pointer structs
drm/nouveau: Constify function pointer structs
drm/mgag200: Constify function pointer structs
drm/imx: Constify function pointer structs
drm/i2c/sil164: Constify function pointer structs
drm/i2c/adv7511: Constify function pointer structs
drm/exynos: Constify function pointer structs
drm/cirrus: Constify function pointer structs
drm/i2c/ch7006: Constify function pointer structs
drm/bridge/nxp-ptn3460: Constify function pointer structs
drm/bridge/dw_hdmi: Constify function pointer structs
drm/bochs: Constify function pointer structs
drm/atmel-hlcdc: Constify function pointer structs
drm/armada: Constify function pointer structs
drm: Constify drm_encoder_slave_funcs
...
Device tree bindings for display panels have moved to a new location.
Unfortunately some of the new bindings added recently ended up in the
old location. Move them to their proper place.
Reported-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Reported-by: Rob Herring <robh@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This fixes CVE-2015-7550.
There's a race between keyctl_read() and keyctl_revoke(). If the revoke
happens between keyctl_read() checking the validity of a key and the key's
semaphore being taken, then the key type read method will see a revoked key.
This causes a problem for the user-defined key type because it assumes in
its read method that there will always be a payload in a non-revoked key
and doesn't check for a NULL pointer.
Fix this by making keyctl_read() check the validity of a key after taking
semaphore instead of before.
I think the bug was introduced with the original keyrings code.
This was discovered by a multithreaded test program generated by syzkaller
(http://github.com/google/syzkaller). Here's a cleaned up version:
#include <sys/types.h>
#include <keyutils.h>
#include <pthread.h>
void *thr0(void *arg)
{
key_serial_t key = (unsigned long)arg;
keyctl_revoke(key);
return 0;
}
void *thr1(void *arg)
{
key_serial_t key = (unsigned long)arg;
char buffer[16];
keyctl_read(key, buffer, 16);
return 0;
}
int main()
{
key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING);
pthread_t th[5];
pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key);
pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key);
pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key);
pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key);
pthread_join(th[0], 0);
pthread_join(th[1], 0);
pthread_join(th[2], 0);
pthread_join(th[3], 0);
return 0;
}
Build as:
cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread
Run as:
while keyctl-race; do :; done
as it may need several iterations to crash the kernel. The crash can be
summarised as:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [<ffffffff81279b08>] user_read+0x56/0xa3
...
Call Trace:
[<ffffffff81276aa9>] keyctl_read_key+0xb6/0xd7
[<ffffffff81277815>] SyS_keyctl+0x83/0xe0
[<ffffffff815dbb97>] entry_SYSCALL_64_fastpath+0x12/0x6f
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>
Use kernel.h macro definition.
Thanks to Julia Lawall for Coccinelle scripting support.
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Use kernel.h macro definition.
Thanks to Julia Lawall for Coccinelle scripting support.
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Looks like we're missing the wakeirq for the console uart for
duovero parlor. Let's add that as without it console acess just
hangs with PM enabled.
Cc: Arun Bharadwaj <arun@gumstix.com>
Cc: Ash Charles <ash@gumstix.com>
Cc: Florian Vaussard <florian.vaussard@epfl.ch>
Signed-off-by: Tony Lindgren <tony@atomide.com>
When sending "SLEEP" command to the controller it ceases scanning
completely and is unable to wake the system up from sleep, so if it is
configured as a wakeup source we should simply configure interrupt for
wakeup and rely on idle logic within the controller to reduce power
consumption while it is not used.
Signed-off-by: James Chen <james.chen@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Pull btrfs fixes from Chris Mason:
"A couple of small fixes"
* 'for-linus-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: check prepare_uptodate_page() error code earlier
Btrfs: check for empty bitmap list in setup_cluster_bitmaps
btrfs: fix misleading warning when space cache failed to load
Btrfs: fix transaction handle leak in balance
Btrfs: fix unprotected list move from unused_bgs to deleted_bgs list
Move write data register before excute command to avoid
missing first byte write to nor flash
Signed-off-by: Bayi Cheng <bayi.cheng@mediatek.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Rename these functions so they have namespace associated with the driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename these functions so they have namespace associated with the driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
An (*insn_read) can only happen if the subdevice is in a non-busy state,
i.e. an async command is not running. The board reset and subdevice
(*cancel) will ensure that the control bits (devpriv->ctrl) are already
cleared.
The (*insn_read) only needs to enable the software trigger before reading
samples. It should also disable the software trigger when done. Fix the
(*insn_read) to do this.
For aesthetics, rename the function so it has namespace associated with
the driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There are a number of descrepencies in the various manuals for the boards
that this driver supports. Some show a 10 MHz clock for counters 1 and 2
others show a 1 MHz clock. Counter 0 can use either a div 10 of that clock
or an external clock (up to 10 MHz).
Currently this driver initializes counters 1 and 2 with a 10 MHz clock.
For consistency, return 1 MHz (10 MHz/10) for counter 0 when the user
queries the internal clock source with INSN_CONFIG_GET_CLOCK_SRC.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change the return type to void, this function always succeeds and the
caller does not check the return value anyway.
Fix the initial programming of the control register. The SW bit enables
the software trigger and should not be set here. Setting CNT0 selects the
external clock source for counter 0 (the user counter). It makes more
sense to select the internal 1 MHz clock.
Remove the unnecessary initialization of the private data members. This
function is only called during the (*auto_attach) after the private
data was kzalloc'ed.
Remove the redundant clearing of the A/D FIFO and pending interrupts.
Just do it once.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The (*cancel) operation should do just that. Remove the setting of the SW bit
which enables the software trigger.
For aesthetics, rename the function so it has namespace associated with the
driver and add a couple comments.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For aesthetics, post-increment the 'subdev' index when used to get a
comedi_subdevice pointer instead of incrementing it after the subdevice
is initialized.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the SDF_COMMON flag, the analog reference is not programmable and
the default aref (AREF_GROUND -> SDF_GROUND) provides adequate information
about the reference.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the SDF_COMMON flag, the analog reference is not programmable and
the default aref (AREF_GROUND -> SDF_GROUND) provides adequate information
about the reference.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The analog outputs can use an external reference to create the D/A output
range. Add an entry to the comedi_lrange table for it and modify the
(*insn_write) to support it.
Note that the D/A output range is 0 to +Vref with a -Vref. The comedi_lrange
does not include the sign of the range. It simmply allows the user to convert
between the 12-bit samples values (0x0000 - 0x0fff) and a physical value (0.0
to 1.0) using the comedilib comedi_to_phys() and comedi_from_phys() functions.
A physical value of 0.0 would actually be 0V with a -Vref and -V with a +Vref
and 1.0 would be +V with a -Vref and 0V with a -Vref. Ths user will need to
work this out but at least they can now use the external reference.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename this function so it has namespace associated with the driver.
For aesthetics, move the function so it is located in the middle of
the analog input support functions.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename these functions so they have namespace associated with the driver.
For aesthetics, move the functions so they are not located in the middle
of the analog input/output support functions.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename this function so it has namespace associated with the driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Rename this function so it has namespace associated with the driver.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the unnecessary comments and rename the 'rangelist_ai' member for
aesthetics.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The pci1711/31 boards are the only ones that have a smaller FIFO (1K vs 4K) and
single-ended analog inputs (no differential).
Replace the 'has_large_fifo' and 'has_diff_ai' members of the boardinfo with
'is_pci1711' and use that to determine how to initialize the analog input
subdev_flags as well as the private data 'max_samples'.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This member of the boardinfo isn't really necessary. All the boards
except the pci1713 have 16 digital inputs and 16 digital outputs.
There is already a 'is_pci1713' member in the boardinfo so that can
be used to determine the subdevices for the digital inputs and outputs
need to be allocated and initialized.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This member of the boardinfo isn't really necessary. All the boards
have analog inputs, the pci1713 has 32 channels the rest have 16
channels.
There is already a 'is_pci1713' member in the boardinfo so that can
be used to determine the number of channels for the analog input
subdevice.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For aesthetics, define some macros to set the bits in the mux control
register. Also, rename the 'mux_ext' member of the private data.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The gain codes used to program the analog output range are currently
stored in const char arrays. The values look a bit "magic" and it's
not clear how they associate with the comedi_lrange without looking
through user manuals.
Refactor the ai range programming to clarify the driver and remove
the magic numbers. Also, refine the bits in the range register that
set the differential and unipolar modes.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Currently this driver calls pci1710_reset() during the (*detach) of
the driver. That function does the following:
1) program the control register to stop any operations
2) clears the analog input FIFO
3) clears any pending interrupts
4) sets all the analog output channels to unipolar 5V range and 0V output
5) sets all the digital outputs to 0V
Before detaching the comedi core will (*cancel) any running async commands.
This will handle 1-3 above.
Depending on the application, it might not be safe to reset the analog and
digital outputs when the driver is detached.
Remove the board reset when detaching and just use comedi_pci_detach()
directly for the driver (*detach).
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All the boards supported by this driver have a 8254 counter. Channels
1 and 2 are used to create the cascaded 32-bit analog input pacer.
Counter 0 is available for the user on all the boards except the PCI-1713.
Remove the 'has_counter' boardinfo and use the 'is_pci1713' boardinfo to
determine if the user counter subdevice needs to be allocated and
initialized.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All the boards supported by this driver can use an interrupt. Remove
the unnecessary boardinfo.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The PCI-1760 is board unique. It uses an outgoing/incoming mailbox
programming sequence to access the hardware. The other boards supported
by this driver use simple register mapping. Including support for the
PCI-1760 in this driver just makes it harder to understand.
Separate out the PCI-1760 support into a new driver, adv_pci1760.
Clean up the new driver. The original code had a bunch of CamelCase and
other checkpatch.pl issues.
The code used to access the outgoing/incoming mailboxes was also a bit
awkward with the passing of the arrays for the outgoing and incoming
mailbox bytes. Replace them with two new functions that send a command
and return the feedback data from the command based on the programming
flow chart in the datasheet for the PCI-1760.
The new adv_pci1760 driver also fixes the incomplete timer subdevice.
This subdevice is actually the 2 PWM outputs so the subdevice type
has been changed to COMEDI_SUBD_PWM.
The counter subdevice support was not complete in the original code.
They are also a bit strange since they are up counters connected to
each of the digital inputs. For now that subdevice has been disabled
(COMEDI_SUBD_UNUSED).
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This silences a sparse warning about incompatible comparisons, while making the
intent of the check a bit clearer.
Signed-off-by: Mario J. Rugiero <mrugiero@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch fix some spelling typo in wilc_msgqueue.h
Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This fixes all "comparison to NULL could be written like ..."
Signed-off-by: Bogicevic Sasa <brutallesale@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- 'if' which is always false is removed
- variable associated with this 'if' is deleted
Signed-off-by: Chandra S Gorentla <csgorentla@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel crashes when load and unload driver several times. I used git bisect to
track down and found that removing NULL setting caused the panic.
This reverts only related codes of the patch(a4ab1ade75a3).
Fixes: a4ab1ade75 ("staging: wilc1000: replace drvHandler and hWFIDrv with hif_drv")
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch fixes the warning reported by smatch.
- Handle_SetMulticastFilter() warn: right shifting more than type allows
That is unnecessary action of boolean type. just assign 0.
Signed-off-by: Leo Kim <leo.kim@atmel.com>
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The if statement should be else if since it is part of whole if condition.
Signed-off-by: Leo Kim <leo.kim@atmel.com>
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch removes unused a function Handle_AddBASession.
And, removes the relation define.
Signed-off-by: Leo Kim <leo.kim@atmel.com>
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch fixes the checks reported by checkpatch.pl
for Blank lines aren't necessary after an open brace '{' and
Blank lines aren't necessary before a close brace '}'.
Signed-off-by: Leo Kim <leo.kim@atmel.com>
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There are over-commenting in the wilc_wfi_cfgoperations.c file and most of them
are not helpful to explain what the code does and generate 80 ending
line over warnings. So, all of comments are removed in this patch and the
comments will later be added if necessary with the preferred Linux style.
Signed-off-by: Leo Kim <leo.kim@atmel.com>
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch fixes rmmod failure. wilc->firmware needs to be set to NULL because
it is used again to check firmware is released when module exit.
Fixes: 8b8ad7bc90 ("staging: wilc1000: rename wilc_firmware in the struct wilc")
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Return proper linux error value -ETIMEDOUT instead of -1.
Signed-off-by: Glen Lee <glen.lee@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
