Merge branch 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/gi…

…t/gregkh/driver-core-2.6 * 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: Connector: Correctly set the error code in case of success when dispatching receive callbacks Connector: Set the CN_NETLINK_USERS correctly pti: PTI semantics fix in pti_tty_cleanup. pti: ENXIO error case memory leak PTI fix. pti: double-free security PTI fix drivers:misc: ti-st: fix skipping of change remote baud drivers/base/platform.c: don't mark platform_device_register_resndata() as __init_or_module st_kim: Handle case of no device found for ID 0 firmware: fix GOOGLE_SMI kconfig dependency warning

Merge branch 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/gi…
…t/gregkh/driver-core-2.6 * 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: Connector: Correctly set the error code in case of success when dispatching receive callbacks Connector: Set the CN_NETLINK_USERS correctly pti: PTI semantics fix in pti_tty_cleanup. pti: ENXIO error case memory leak PTI fix. pti: double-free security PTI fix drivers:misc: ti-st: fix skipping of change remote baud drivers/base/platform.c: don't mark platform_device_register_resndata() as __init_or_module st_kim: Handle case of no device found for ID 0 firmware: fix GOOGLE_SMI kconfig dependency warning
Linus Torvalds
2 parents 2e34b429a4 663dd6dcaf
Showing 7 changed files Side-by-side Diff
drivers/base/platform.c
drivers/connector/connector.c
drivers/firmware/google/Kconfig
drivers/misc/pti.c
drivers/misc/ti-st/st_core.c
drivers/misc/ti-st/st_kim.c
include/linux/connector.h
@@ -367,7 +367,7 @@
  *
  * Returns &struct platform_device pointer on success, or ERR_PTR() on error.
  */
-struct platform_device *__init_or_module platform_device_register_resndata(
+struct platform_device *platform_device_register_resndata(
 		struct device *parent,
 		const char *name, int id,
 		const struct resource *res, unsigned int num,
@@ -139,6 +139,7 @@
 	spin_unlock_bh(&dev->cbdev->queue_lock);
  
 	if (cbq != NULL) {
+		err = 0;
 		cbq->callback(msg, nsp);
 		kfree_skb(skb);
 		cn_queue_release_callback(cbq);
@@ -13,6 +13,7 @@
 config GOOGLE_SMI
 	tristate "SMI interface for Google platforms"
 	depends on ACPI && DMI
+	select EFI
 	select EFI_VARS
 	help
 	  Say Y here if you want to enable SMI callbacks for Google
@@ -317,7 +317,8 @@
  *				a master, channel ID address
  *				used to write to PTI HW.
  *
- * @mc: master, channel apeture ID address to be released.
+ * @mc: master, channel apeture ID address to be released.  This
+ *      will de-allocate the structure via kfree().
  */
 void pti_release_masterchannel(struct pti_masterchannel *mc)
 {
  
@@ -475,8 +476,10 @@
 		else
 			pti_tty_data->mc = pti_request_masterchannel(2);
  
-		if (pti_tty_data->mc == NULL)
+		if (pti_tty_data->mc == NULL) {
+			kfree(pti_tty_data);
 			return -ENXIO;
+		}
 		tty->driver_data = pti_tty_data;
 	}
  
@@ -495,7 +498,7 @@
 	if (pti_tty_data == NULL)
 		return;
 	pti_release_masterchannel(pti_tty_data->mc);
-	kfree(tty->driver_data);
+	kfree(pti_tty_data);
 	tty->driver_data = NULL;
 }
  
@@ -581,7 +584,7 @@
 static int pti_char_release(struct inode *inode, struct file *filp)
 {
 	pti_release_masterchannel(filp->private_data);
-	kfree(filp->private_data);
+	filp->private_data = NULL;
 	return 0;
 }
  
@@ -605,7 +605,7 @@
 	pr_debug("%s: %d ", __func__, proto->chnl_id);
  
 	st_kim_ref(&st_gdata, 0);
-	if (proto->chnl_id >= ST_MAX_CHANNELS) {
+	if (!st_gdata || proto->chnl_id >= ST_MAX_CHANNELS) {
 		pr_err(" chnl_id %d not supported", proto->chnl_id);
 		return -EPROTONOSUPPORT;
 	}
@@ -245,9 +245,9 @@
 		pr_err("invalid action after change remote baud command");
 	} else {
 		*ptr = *ptr + sizeof(struct bts_action) +
-			((struct bts_action *)nxt_action)->size;
+			((struct bts_action *)cur_action)->size;
 		*len = *len - (sizeof(struct bts_action) +
-				((struct bts_action *)nxt_action)->size);
+				((struct bts_action *)cur_action)->size);
 		/* warn user on not commenting these in firmware */
 		pr_warn("skipping the wait event of change remote baud");
 	}
@@ -604,6 +604,10 @@
 	struct kim_data_s	*kim_gdata;
 	/* get kim_gdata reference from platform device */
 	pdev = st_get_plat_device(id);
+	if (!pdev) {
+		*core_data = NULL;
+		return;
+	}
 	kim_gdata = dev_get_drvdata(&pdev->dev);
 	*core_data = kim_gdata->core_data;
 }
@@ -44,7 +44,7 @@
 #define CN_VAL_DRBD			0x1
 #define CN_KVP_IDX			0x9	/* HyperV KVP */
  
-#define CN_NETLINK_USERS		9
+#define CN_NETLINK_USERS		10	/* Highest index + 1 */
  
 /*
  * Maximum connector's message size.
...	...	@@ -367,7 +367,7 @@
367	367	*
368	368	* Returns &struct platform_device pointer on success, or ERR_PTR() on error.
369	369	*/
370		-struct platform_device *__init_or_module platform_device_register_resndata(
	370	+struct platform_device *platform_device_register_resndata(
371	371	struct device *parent,
372	372	const char *name, int id,
373	373	const struct resource *res, unsigned int num,
...	...	@@ -139,6 +139,7 @@
139	139	spin_unlock_bh(&dev->cbdev->queue_lock);
140	140
141	141	if (cbq != NULL) {
	142	+ err = 0;
142	143	cbq->callback(msg, nsp);
143	144	kfree_skb(skb);
144	145	cn_queue_release_callback(cbq);
...	...	@@ -13,6 +13,7 @@
13	13	config GOOGLE_SMI
14	14	tristate "SMI interface for Google platforms"
15	15	depends on ACPI && DMI
	16	+ select EFI
16	17	select EFI_VARS
17	18	help
18	19	Say Y here if you want to enable SMI callbacks for Google
...	...	@@ -317,7 +317,8 @@
317	317	* a master, channel ID address
318	318	* used to write to PTI HW.
319	319	*
320		- * @mc: master, channel apeture ID address to be released.
	320	+ * @mc: master, channel apeture ID address to be released. This
	321	+ * will de-allocate the structure via kfree().
321	322	*/
322	323	void pti_release_masterchannel(struct pti_masterchannel *mc)
323	324	{
324	325
...	...	@@ -475,8 +476,10 @@
475	476	else
476	477	pti_tty_data->mc = pti_request_masterchannel(2);
477	478
478		- if (pti_tty_data->mc == NULL)
	479	+ if (pti_tty_data->mc == NULL) {
	480	+ kfree(pti_tty_data);
479	481	return -ENXIO;
	482	+ }
480	483	tty->driver_data = pti_tty_data;
481	484	}
482	485
...	...	@@ -495,7 +498,7 @@
495	498	if (pti_tty_data == NULL)
496	499	return;
497	500	pti_release_masterchannel(pti_tty_data->mc);
498		- kfree(tty->driver_data);
	501	+ kfree(pti_tty_data);
499	502	tty->driver_data = NULL;
500	503	}
501	504
...	...	@@ -581,7 +584,7 @@
581	584	static int pti_char_release(struct inode inode, struct file filp)
582	585	{
583	586	pti_release_masterchannel(filp->private_data);
584		- kfree(filp->private_data);
	587	+ filp->private_data = NULL;
585	588	return 0;
586	589	}
587	590
...	...	@@ -605,7 +605,7 @@
605	605	pr_debug("%s: %d ", __func__, proto->chnl_id);
606	606
607	607	st_kim_ref(&st_gdata, 0);
608		- if (proto->chnl_id >= ST_MAX_CHANNELS) {
	608	+ if (!st_gdata \|\| proto->chnl_id >= ST_MAX_CHANNELS) {
609	609	pr_err(" chnl_id %d not supported", proto->chnl_id);
610	610	return -EPROTONOSUPPORT;
611	611	}
...	...	@@ -245,9 +245,9 @@
245	245	pr_err("invalid action after change remote baud command");
246	246	} else {
247	247	ptr = ptr + sizeof(struct bts_action) +
248		- ((struct bts_action *)nxt_action)->size;
	248	+ ((struct bts_action *)cur_action)->size;
249	249	len = len - (sizeof(struct bts_action) +
250		- ((struct bts_action *)nxt_action)->size);
	250	+ ((struct bts_action *)cur_action)->size);
251	251	/* warn user on not commenting these in firmware */
252	252	pr_warn("skipping the wait event of change remote baud");
253	253	}
...	...	@@ -604,6 +604,10 @@
604	604	struct kim_data_s *kim_gdata;
605	605	/* get kim_gdata reference from platform device */
606	606	pdev = st_get_plat_device(id);
	607	+ if (!pdev) {
	608	+ *core_data = NULL;
	609	+ return;
	610	+ }
607	611	kim_gdata = dev_get_drvdata(&pdev->dev);
608	612	*core_data = kim_gdata->core_data;
609	613	}
...	...	@@ -44,7 +44,7 @@
44	44	#define CN_VAL_DRBD 0x1
45	45	#define CN_KVP_IDX 0x9 /* HyperV KVP */
46	46
47		-#define CN_NETLINK_USERS 9
	47	+#define CN_NETLINK_USERS 10 /* Highest index + 1 */
48	48
49	49	/*
50	50	* Maximum connector's message size.