10 Apr, 2016
1 commit
-
Pull USB fixes from Greg KH:
"Here are some USB fixes and new device ids for 4.6-rc3.Nothing major, the normal USB gadget fixes and usb-serial driver ids,
along with some other fixes mixed in. All except the USB serial ids
have been tested in linux-next, the id additions should be fine as
they are 'trivial'"* tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
USB: option: add "D-Link DWM-221 B1" device id
USB: serial: cp210x: Adding GE Healthcare Device ID
USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
usb: dwc3: keystone: drop dma_mask configuration
usb: gadget: udc-core: remove manual dma configuration
usb: dwc3: pci: add ID for one more Intel Broxton platform
usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
usb: dwc2: do not override forced dr_mode in gadget setup
usb: gadget: f_midi: unlock on error
USB: digi_acceleport: do sanity checking for the number of ports
USB: cypress_m8: add endpoint sanity check
USB: mct_u232: add sanity checking in probe
usb: fix regression in SuperSpeed endpoint descriptor parsing
USB: usbip: fix potential out-of-bounds write
usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
usb: phy: qcom-8x16: fix regulator API abuse
usb: ch9: Fix SSP Device Cap wFunctionalitySupport type
usb: gadget: composite: Access SSP Dev Cap fields properly
...
09 Apr, 2016
1 commit
-
…johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.6-rc3
Here are some new device ids.
Signed-off-by: Johan Hovold <johan@kernel.org>
07 Apr, 2016
4 commits
-
…balbi/usb into usb-linus
Felipe writes:
usb: fixes for v4.6-rc3
We have two more fixes to f_midi. It should now
behave much better.dwc3-keystone.c has gotten a fix which now allows it
to work on keystone device when running in
peripheral mode. A similar fix for DMA configuration
was made for udc-core, too.We have a new PCI ID for Intel's Broxton
platform. DWC3 can run on those platforms as well.And we also have some dwc2 got a fix for dr_mode
usage, while renesas controller got 3 important
fixes: a NULL pointer deref fix, IRQ <-> DMA race
fix, and a fix to prevent a situation where we would
queue a request to a disabled endpoint. -
Thomas reports:
"Windows:00 diagnostics
01 modem
02 at-port
03 nmea
04 nicLinux:
T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2001 ProdID=7e19 Rev=02.32
S: Manufacturer=Mobile Connect
S: Product=Mobile Connect
S: SerialNumber=0123456789ABCDEF
C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I: If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage"Reported-by: Thomas Schäfer
Cc:
Signed-off-by: Bjørn Mork
Signed-off-by: Johan Hovold -
The CP2105 is used in the GE Healthcare Remote Alarm Box, with the
Manufacturer ID of 0x1901 and Product ID of 0x0194.Signed-off-by: Martyn Welch
Cc: stable
Signed-off-by: Johan Hovold -
A Fedora user reports that the ftdi_sio driver works properly for the
ICP DAS I-7561U device. Further, the user manual for these devices
instructs users to load the driver and add the ids using the sysfs
interface.Add support for these in the driver directly so that the devices work
out of the box instead of needing manual configuration.Reported-by:
CC: stable
Signed-off-by: Josh Boyer
Signed-off-by: Johan Hovold
06 Apr, 2016
3 commits
-
The Keystone 2 supports DT-boot only, as result dma_mask will be
always configured properly from DT -
of_platform_device_create_pdata()->of_dma_configure(). More over,
dwc3-keystone.c can be built as module and in this case it's unsafe to
assign local variable as dma_mask.Hence, remove dma_mask configuration code.
Cc: Murali Karicheri
Signed-off-by: Grygorii Strashko
Signed-off-by: Felipe Balbi -
Since commit 7ace8fc8219e ("usb: gadget: udc: core: Fix argument of
dma_map_single for IOMMU") it is not necessary to configure DMA for
usb_gadget device manually, because all DMA operation are performed
using parent/controller device.Cc: Yoshihiro Shimoda
Signed-off-by: Grygorii Strashko
Signed-off-by: Felipe Balbi -
BXT-M is a Intel Broxton SoC based platform with unique PCI ID.
Signed-off-by: Heikki Krogerus
Signed-off-by: Felipe Balbi
05 Apr, 2016
1 commit
-
PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} macros were introduced *long* time
ago with promise that one day it will be possible to implement page
cache with bigger chunks than PAGE_SIZE.This promise never materialized. And unlikely will.
We have many places where PAGE_CACHE_SIZE assumed to be equal to
PAGE_SIZE. And it's constant source of confusion on whether
PAGE_CACHE_* or PAGE_* constant should be used in a particular case,
especially on the border between fs and mm.Global switching to PAGE_CACHE_SIZE != PAGE_SIZE would cause to much
breakage to be doable.Let's stop pretending that pages in page cache are special. They are
not.The changes are pretty straight-forward:
- << (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> ;
- >> (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> ;
- PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} -> PAGE_{SIZE,SHIFT,MASK,ALIGN};
- page_cache_get() -> get_page();
- page_cache_release() -> put_page();
This patch contains automated changes generated with coccinelle using
script below. For some reason, coccinelle doesn't patch header files.
I've called spatch for them manually.The only adjustment after coccinelle is revert of changes to
PAGE_CAHCE_ALIGN definition: we are going to drop it later.There are few places in the code where coccinelle didn't reach. I'll
fix them manually in a separate patch. Comments and documentation also
will be addressed with the separate patch.virtual patch
@@
expression E;
@@
- E << (PAGE_CACHE_SHIFT - PAGE_SHIFT)
+ E@@
expression E;
@@
- E >> (PAGE_CACHE_SHIFT - PAGE_SHIFT)
+ E@@
@@
- PAGE_CACHE_SHIFT
+ PAGE_SHIFT@@
@@
- PAGE_CACHE_SIZE
+ PAGE_SIZE@@
@@
- PAGE_CACHE_MASK
+ PAGE_MASK@@
expression E;
@@
- PAGE_CACHE_ALIGN(E)
+ PAGE_ALIGN(E)@@
expression E;
@@
- page_cache_get(E)
+ get_page(E)@@
expression E;
@@
- page_cache_release(E)
+ put_page(E)Signed-off-by: Kirill A. Shutemov
Acked-by: Michal Hocko
Signed-off-by: Linus Torvalds
04 Apr, 2016
3 commits
-
This patch fixes an issue that usbhsg_queue_done() may cause kernel
panic when dma callback is running and usb_ep_disable() is called
by interrupt handler. (Especially, we can reproduce this issue using
g_audio with usb-dmac driver.)For example of a flow:
usbhsf_dma_complete (on tasklet)
--> usbhsf_pkt_handler (on tasklet)
--> usbhsg_queue_done (on tasklet)
*** interrupt happened and usb_ep_disable() is called ***
--> usbhsg_queue_pop (on tasklet)
Then, oops happened.Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: # v3.1+
Signed-off-by: Yoshihiro Shimoda
Signed-off-by: Felipe Balbi -
The host/device mode set with dr_mode should be kept all the time,
not being changed to OTG in gadget setup (by overriding CFGUSB_FORCEDEVMODE
and CFGUSB_FORCEHOSTMODE bits).Acked-by: John Youn
Tested-by: John Youn
Signed-off-by: Przemek Rudy
Signed-off-by: Felipe Balbi -
We added some new locking here, but missed an error path where we need
to unlock.Fixes: 9acdf4df2fc4 ('usb: gadget: f_midi: added spinlock on transmit function')
Acked-by: Michal Nazarewicz
Acked-by: Felipe F. Tonello
Signed-off-by: Dan Carpenter
Signed-off-by: Felipe Balbi
01 Apr, 2016
3 commits
-
The driver can be crashed with devices that expose crafted descriptors
with too few endpoints.See: http://seclists.org/bugtraq/2016/Mar/61
Signed-off-by: Oliver Neukum
[johan: fix OOB endpoint check and add error messages ]
Cc: stable
Signed-off-by: Johan Hovold
Signed-off-by: Greg Kroah-Hartman -
An attack using missing endpoints exists.
CVE-2016-3137
Signed-off-by: Oliver Neukum
CC: stable@vger.kernel.org
Signed-off-by: Johan Hovold
Signed-off-by: Greg Kroah-Hartman -
An attack using the lack of sanity checking in probe is known. This
patch checks for the existence of a second port.CVE-2016-3136
Signed-off-by: Oliver Neukum
CC: stable@vger.kernel.org
[johan: add error message ]
Signed-off-by: Johan Hovold
Signed-off-by: Greg Kroah-Hartman
31 Mar, 2016
2 commits
-
commit b37d83a6a414 ("usb: Parse the new USB 3.1 SuperSpeedPlus Isoc
endpoint companion descriptor") caused a regression in 4.6-rc1 and fails
to parse SuperSpeed endpoint companion descriptors.The new SuperSpeedPlus Isoc endpoint companion parsing code incorrectly
decreased the the remaining buffer size before comparing the size with the
expected length of the descriptor.This lead to possible failure in reading the SuperSpeed endpoint companion
descriptor of the last endpoint, displaying a message like:"No SuperSpeed endpoint companion for config 1 interface 0 altsetting 0
ep 129: using minimum values"Fix it by decreasing the size after comparing it.
Also finish all the SS endpoint companion parsing before calling SSP isoc
endpoint parsing function.Fixes: b37d83a6a414
Signed-off-by: Mathias Nyman
Signed-off-by: Greg Kroah-Hartman -
Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.Signed-off-by: Ignat Korchagin
Signed-off-by: Greg Kroah-Hartman
30 Mar, 2016
4 commits
-
This patch adds a code to surely disable TX IRQ of the pipe before
starting TX DMAC transfer. Otherwise, a lot of unnecessary TX IRQs
may happen in rare cases when DMAC is used.Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: # v3.1+
Signed-off-by: Yoshihiro Shimoda
Signed-off-by: Felipe Balbi -
When unexpected situation happened (e.g. tx/rx irq happened while
DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL
pointer dereference like the followings:Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 80000007 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial g_serial libcomposite
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63
Hardware name: Generic R8A7790 (Flattened Device Tree)
task: c0729c00 ti: c0724000 task.ti: c0724000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xac/0x118
pc : [] lr : [] psr: 60000193
sp : c0725db8 ip : 00000000 fp : c0725df4
r10: 00000001 r9 : 00000193 r8 : ef3ccab4
r7 : ef3cca10 r6 : eea4586c r5 : 00000000 r4 : ef19ceb4
r3 : 00000000 r2 : 0000009c r1 : c0725dc4 r0 : ef19ceb4This patch adds a condition to avoid the dereference.
Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Cc: # v3.1+
Signed-off-by: Yoshihiro Shimoda
Signed-off-by: Felipe Balbi -
buflen by default (256) is smaller than wMaxPacketSize (512) in high-speed
devices.That caused the OUT endpoint to freeze if the host send any data packet of
length greater than 256 bytes.This is an example dump of what happended on that enpoint:
HOST: [DATA][Length=260][...]
DEVICE: [NAK]
HOST: [PING]
DEVICE: [NAK]
HOST: [PING]
DEVICE: [NAK]
...
HOST: [PING]
DEVICE: [NAK]This patch fixes this problem by setting the minimum usb_request's buffer size
for the OUT endpoint as its wMaxPacketSize.Acked-by: Michal Nazarewicz
Signed-off-by: Felipe F. Tonello
Signed-off-by: Felipe Balbi -
gcc warns about the use of regulators in phy_8x16_probe:
drivers/usb/phy/phy-qcom-8x16-usb.c: In function 'phy_8x16_probe':
drivers/usb/phy/phy-qcom-8x16-usb.c:284:13: error: 'regs[0].consumer' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/usb/phy/phy-qcom-8x16-usb.c:285:13: error: 'regs[1].consumer' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/usb/phy/phy-qcom-8x16-usb.c:286:12: error: 'regs[2].consumer' may be used uninitialized in this function [-Werror=maybe-uninitialized]According to Mark Brown, this is the result of various abuses
of the PHY interfaces [1], so let's fix the driver instead.This puts the regulator bulk data into the device structure so it
gets properly initialized and lets us call regulator_bulk_enable()
and regulator_bulk_disable() rather than open-coding them.Setting the voltages the way the driver does is rather pointless
because for each regulator there is only one valid voltage
range, so that can just get set up in the DT. As there doesn't
seem to be any user of the newly added driver yet, we can simply
make sure the DTs are setting this up right when they get added.I'm also fixing the handling of regulator_bulk_enable() failure.
Right now, the driver just ignores any failure, which doesn't make
sense, so I'm changing it to loudly complain (in case we actually
had a bug here) and error out.Doing a fly-by review of the driver, I notice a couple of other
problems that I'm not addressing here:- It really should not have been written as a USB PHY driver, but
instead should use the PHY subsystem.- The DT compatible string does not follow the usual conventions,
and it should have a proper identifier in it rather than a wildcard.- The example in the devicetree binding lists a register address
that is the same as the actual EHCI host controller in the SoC
as well as the otg-snps and the ci-hdrc device, which indicates
that these are probably not even distinct devices (or all but
one of them are wrong), and if more than one of them tries to
request the resources correctly, they fail.[1] https://lkml.org/lkml/2016/1/26/267
Signed-off-by: Arnd Bergmann
Signed-off-by: Felipe Balbi
29 Mar, 2016
6 commits
-
Access multi-byte fields of the SSP Dev Cap descriptor using the correct
endianness.Fixes: f228a8de242a ("usb: gadget: composite: Return SSP Dev Cap descriptor")
Signed-off-by: John Youn
Signed-off-by: Felipe Balbi -
UDC driver should NEVER do anything behind
udc-core's back, so let's stop disabling endpoints
we don't exactly own - rather we provide as
resources for gadget drivers. This fixes the
regression reported by Gil.Reported-by: Gil Weber
Tested-by: Gil Weber
Signed-off-by: Felipe Balbi -
We were exitting the function before actually
renaming anything. While at that, also always leave
control endpoint un-renamed.Signed-off-by: Felipe Balbi
-
It's a requirement that we release controller's lock
while calling gadget API function pointers. This
patch just fixes that long standing bug.Signed-off-by: Jiebing Li
Signed-off-by: Felipe Balbi -
According to Synopsys Databook, we shouldn't be
relying on GCTL.CORESOFTRESET bit as that's only for
debugging purposes. Instead, let's use DCTL.CSFTRST
if we're OTG or PERIPHERAL mode.Host side block will be reset by XHCI driver if
necessary. Note that this reduces amount of time
spent on dwc3_probe() by a long margin.We're still gonna wait for reset to finish for a
long time (default to 1ms max), but tests show that
the reset polling loop executed at most 19 times
(modprobe dwc3 && modprobe -r dwc3 executed 1000
times in a row).Suggested-by: Mian Yousaf Kaukab
Signed-off-by: Felipe Balbi -
Since f_midi_transmit is called by both ALSA and USB sub-systems, it can
potentially cause a race condition between both calls because f_midi_transmit
is not reentrant nor thread-safe. This is due to an implementation detail that
the transmit function looks for the next available usb request from the fifo
and only enqueues it if there is data to send, otherwise just re-uses it. So,
if both ALSA and USB frameworks calls this function at the same time,
kfifo_seek() will return the same usb_request, which will cause a race
condition.To solve this problem a syncronization mechanism is necessary. In this case it
is used a spinlock since f_midi_transmit is also called by usb_request->complete
callback in interrupt context.Cc: # v4.5+
Fixes: e1e3d7ec5da3 ("usb: gadget: f_midi: pre-allocate IN requests")
Signed-off-by: Felipe F. Tonello
Signed-off-by: Felipe Balbi
23 Mar, 2016
2 commits
-
Pull clk updates from Stephen Boyd:
"The clk changes for this release cycle are mostly dominated by new
device support in terms of LoC, but there has been some cleanup in the
core as well as the usual minor clk additions to various drivers.Core:
- parent tracking has been simplified
- CLK_IS_ROOT is now a no-op flag, cleaning up drivers has started
- of_clk_init() doesn't consider disabled DT nodes anymore
- clk_unregister() had an error path bug squashed
- of_clk_get_parent_count() has been fixed to only return unsigned ints
- HAVE_MACH_CLKDEV is removed now that the last arch user (ARM) is goneNew Drivers:
- NXP LPC18xx creg
- QCOM IPQ4019 GCC
- TI dm814x ADPLL
- i.MX6QPUpdates:
- Cyngus audio clks found on Broadcom iProc devices
- Non-critical fixes for BCM2385 PLLs
- Samsung exynos5433 updates for clk id errors, HDMI support,
suspend/resume simplifications
- USB, CAN, LVDS, and FCP clks on shmobile devices
- sunxi got support for more clks on new SoCs and went through a
minor refactoring/rewrite to use a simpler factor clk construct
- rockchip added some more clk ids and added suport for fraction
dividers
- QCOM GDSCs in msm8996
- A new devm helper to make adding custom actions simpler (acked by Greg)"* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (197 commits)
clk: bcm2835: fix check of error code returned by devm_ioremap_resource()
clk: renesas: div6: use RENESAS for #define
clk: renesas: Rename header file renesas.h
clk: max77{686,802}: Remove CLK_IS_ROOT
clk: versatile: Remove CLK_IS_ROOT
clk: sunxi: Remove use of variable length array
clk: fixed-rate: Remove CLK_IS_ROOT
clk: qcom: Remove CLK_IS_ROOT
doc: dt: add documentation for lpc1850-creg-clk driver
clk: add lpc18xx creg clk driver
clk: lpc32xx: fix compilation warning
clk: xgene: Add missing parenthesis when clearing divider value
clk: mb86s7x: Remove CLK_IS_ROOT
clk: x86: Remove clkdev.h and clk.h includes
clk: x86: Remove CLK_IS_ROOT
clk: mvebu: Remove CLK_IS_ROOT
clk: renesas: move drivers to renesas directory
clk: si5{14,351,70}: Remove CLK_IS_ROOT
clk: scpi: Remove CLK_IS_ROOT
clk: s2mps11: Remove CLK_IS_ROOT
... -
Pull SCSI target updates from Nicholas Bellinger:
"The highlights this round include:- Add target_alloc_session() w/ callback helper for doing se_session
allocation + tag + se_node_acl lookup. (HCH + nab)- Tree-wide fabric driver conversion to use target_alloc_session()
- Convert sbp-target to use percpu_ida tag pre-allocation, and
TARGET_SCF_ACK_KREF I/O krefs (Chris Boot + nab)- Convert usb-gadget to use percpu_ida tag pre-allocation, and
TARGET_SCF_ACK_KREF I/O krefs (Andrzej Pietrasiewicz + nab)- Convert xen-scsiback to use percpu_ida tag pre-allocation, and
TARGET_SCF_ACK_KREF I/O krefs (Juergen Gross + nab)- Convert tcm_fc to use TARGET_SCF_ACK_KREF I/O + TMR krefs
- Convert ib_srpt to use percpu_ida tag pre-allocation
- Add DebugFS node for qla2xxx target sess list (Quinn)
- Rework iser-target connection termination (Jenny + Sagi)
- Convert iser-target to new CQ API (HCH)
- Add pass-through WRITE_SAME support for IBLOCK (Mike Christie)
- Introduce data_bitmap for asynchronous access of data area (Sheng
Yang + Andy)- Fix target_release_cmd_kref shutdown comp leak (Himanshu Madhani)
Also, there is a separate PULL request coming for cxgb4 NIC driver
prerequisites for supporting hw iscsi segmentation offload (ISO), that
will be the base for a number of v4.7 developments involving
iscsi-target hw offloads"* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (36 commits)
target: Fix target_release_cmd_kref shutdown comp leak
target: Avoid DataIN transfers for non-GOOD SAM status
target/user: Report capability of handling out-of-order completions to userspace
target/user: Fix size_t format-spec build warning
target/user: Don't free expired command when time out
target/user: Introduce data_bitmap, replace data_length/data_head/data_tail
target/user: Free data ring in unified function
target/user: Use iovec[] to describe continuous area
target: Remove enum transport_lunflags_table
target/iblock: pass WRITE_SAME to device if possible
iser-target: Kill the ->isert_cmd back pointer in struct iser_tx_desc
iser-target: Kill struct isert_rdma_wr
iser-target: Convert to new CQ API
iser-target: Split and properly type the login buffer
iser-target: Remove ISER_RECV_DATA_SEG_LEN
iser-target: Remove impossible condition from isert_wait_conn
iser-target: Remove redundant wait in release_conn
iser-target: Rework connection termination
iser-target: Separate flows for np listeners and connections cma events
iser-target: Add new state ISER_CONN_BOUND to isert_conn
...
21 Mar, 2016
1 commit
-
Pull ARM SoC driver updates from Arnd Bergmann:
"Driver updates for ARM SoCs, these contain various things that touch
the drivers/ directory but got merged through arm-soc for practical
reasons:- Rockchip rk3368 gains power domain support
- Small updates for the ARM spmi driver
- The Atmel PMC driver saw a larger rework, touching both
arch/arm/mach-at91 and drivers/clk/at91
- All reset controller driver changes alway get merged through
arm-soc, though this time the largest change is the addition of a
MIPS pistachio reset driver
- One bugfix for the NXP (formerly Freescale) i.MX weim bus driver"* tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (43 commits)
bus: imx-weim: Take the 'status' property value into account
clk: at91: remove useless includes
clk: at91: pmc: remove useless capacities handling
clk: at91: pmc: drop at91_pmc_base
usb: gadget: atmel: access the PMC using regmap
ARM: at91: remove useless includes and function prototypes
ARM: at91: pm: move idle functions to pm.c
ARM: at91: pm: find and remap the pmc
ARM: at91: pm: simply call at91_pm_init
clk: at91: pmc: move pmc structures to C file
clk: at91: pmc: merge at91_pmc_init in atmel_pmc_probe
clk: at91: remove IRQ handling and use polling
clk: at91: make use of syscon/regmap internally
clk: at91: make use of syscon to share PMC registers in several drivers
hwmon: (scpi) add energy meter support
firmware: arm_scpi: add support for 64-bit sensor values
firmware: arm_scpi: decrease Tx timeout to 20ms
firmware: arm_scpi: fix send_message and sensor_get_value for big-endian
reset: sti: Make reset_control_ops const
reset: zynq: Make reset_control_ops const
...
19 Mar, 2016
7 commits
-
Merge second patch-bomb from Andrew Morton:
- a couple of hotfixes
- the rest of MM
- a new timer slack control in procfs
- a couple of procfs fixes
- a few misc things
- some printk tweaks
- lib/ updates, notably to radix-tree.
- add my and Nick Piggin's old userspace radix-tree test harness to
tools/testing/radix-tree/. Matthew said it was a godsend during the
radix-tree work he did.- a few code-size improvements, switching to __always_inline where gcc
screwed up.- partially implement character sets in sscanf
* emailed patches from Andrew Morton : (118 commits)
sscanf: implement basic character sets
lib/bug.c: use common WARN helper
param: convert some "on"/"off" users to strtobool
lib: add "on"/"off" support to kstrtobool
lib: update single-char callers of strtobool()
lib: move strtobool() to kstrtobool()
include/linux/unaligned: force inlining of byteswap operations
include/uapi/linux/byteorder, swab: force inlining of some byteswap operations
include/asm-generic/atomic-long.h: force inlining of some atomic_long operations
usb: common: convert to use match_string() helper
ide: hpt366: convert to use match_string() helper
ata: hpt366: convert to use match_string() helper
power: ab8500: convert to use match_string() helper
power: charger_manager: convert to use match_string() helper
drm/edid: convert to use match_string() helper
pinctrl: convert to use match_string() helper
device property: convert to use match_string() helper
lib/string: introduce match_string() helper
radix-tree tests: add test for radix_tree_iter_next
radix-tree tests: add regression3 test
... -
Pull USB fixes from Greg KH:
"Here is a USB fix for the reported issue with commit 69bec7259853
("USB: core: let USB device know device node") as well as some other
issues that have been reported so far with this merge window"* tag 'usb-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
USB: uas: Reduce can_queue to MAX_CMNDS
USB: cdc-acm: more sanity checking
USB: usb_driver_claim_interface: add sanity checking
usb/core: usb_alloc_dev(): fix setting of ->portnum
USB: iowarrior: fix oops with malicious USB descriptors -
The uas driver can never queue more then MAX_CMNDS (- 1) tags and tags
are shared between luns, so there is no need to claim that we can_queue
some random large number.Not claiming that we can_queue 65536 commands, fixes the uas driver
failing to initialize while allocating the tag map with a "Page allocation
failure (order 7)" error on systems which have been running for a while
and thus have fragmented memory.Cc: stable@vger.kernel.org
Reported-and-tested-by: Yves-Alexis Perez
Signed-off-by: Hans de Goede
Signed-off-by: Greg Kroah-Hartman -
An attack has become available which pretends to be a quirky
device circumventing normal sanity checks and crashes the kernel
by an insufficient number of interfaces. This patch adds a check
to the code path for quirky devices.Signed-off-by: Oliver Neukum
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman -
Attacks that trick drivers into passing a NULL pointer
to usb_driver_claim_interface() using forged descriptors are
known. This thwarts them by sanity checking.Signed-off-by: Oliver Neukum
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman -
With commit 69bec7259853 ("USB: core: let USB device know device node"),
the port1 argument of usb_alloc_dev() gets overwritten as follows:... usb_alloc_dev(..., unsigned port1)
{
...
if (!parent->parent) {
port1 = usb_hcd_find_raw_port_number(..., port1);
}
...
}Later on, this now overwritten port1 gets assigned to ->portnum:
dev->portnum = port1;
However, since xhci_find_raw_port_number() isn't idempotent, the
aforementioned commit causes a number of KASAN splats like the following:BUG: KASAN: slab-out-of-bounds in xhci_find_raw_port_number+0x98/0x170
at addr ffff8801d9311670
Read of size 8 by task kworker/2:1/87
[...]
Workqueue: usb_hub_wq hub_event
0000000000000188 000000005814b877 ffff8800cba17588 ffffffff8191447e
0000000041b58ab3 ffffffff82a03209 ffffffff819143a2 ffffffff82a252f4
ffff8801d93115e0 0000000000000188 ffff8801d9311628 ffff8800cba17588
Call Trace:
[] dump_stack+0xdc/0x15e
[] ? _atomic_dec_and_lock+0xa2/0xa2
[] ? print_section+0x61/0xb0
[] print_trailer+0x179/0x2c0
[] object_err+0x34/0x40
[] kasan_report_error+0x2f8/0x8b0
[] ? __slab_alloc+0x5e/0x90
[] ? __lock_is_held+0x90/0x130
[] kasan_report+0x71/0xa0
[] ? kmem_cache_alloc_trace+0x212/0x560
[] ? xhci_find_raw_port_number+0x98/0x170
[] __asan_load8+0x64/0x70
[] xhci_find_raw_port_number+0x98/0x170
[] xhci_setup_addressable_virt_dev+0x235/0xa10
[] xhci_setup_device+0x3c1/0x1430
[] ? trace_hardirqs_on+0xd/0x10
[] ? xhci_setup_device+0x1430/0x1430
[] xhci_address_device+0x13/0x20
[] hub_port_init+0x55a/0x1550
[] hub_event+0xef5/0x24d0
[] ? hub_port_debounce+0x2f0/0x2f0
[] ? debug_object_deactivate+0x1be/0x270
[] ? print_rt_rq+0x53/0x2d0
[] ? trace_hardirqs_off+0xd/0x10
[] ? _raw_spin_unlock_irqrestore+0x5b/0x60
[] ? irq_domain_set_hwirq_and_chip+0x30/0xb0
[] ? debug_lockdep_rcu_enabled+0x39/0x40
[] ? __lock_is_held+0x90/0x130
[] process_one_work+0x567/0xec0
[...]Afterwards, xhci reports some functional errors:
xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
code 0x11.
xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion
code 0x11.
usb 4-3: device not accepting address 2, error -22Fix this by not overwriting the port1 argument in usb_alloc_dev(), but
storing the raw port number as required by OF in an additional variable,
raw_port.Fixes: 69bec7259853 ("USB: core: let USB device know device node")
Signed-off-by: Nicolai Stange
Acked-by: Alan Stern
Signed-off-by: Greg Kroah-Hartman -
The iowarrior driver expects at least one valid endpoint. If given
malicious descriptors that specify 0 for the number of endpoints,
it will crash in the probe function. Ensure there is at least
one endpoint on the interface before using it.The full report of this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/87Reported-by: Ralf Spenneberg
Cc: stable
Signed-off-by: Josh Boyer
Signed-off-by: Greg Kroah-Hartman
18 Mar, 2016
2 commits
-
Pull trivial tree updates from Jiri Kosina.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial:
drivers/rtc: broken link fix
drm/i915 Fix typos in i915_gem_fence.c
Docs: fix missing word in REPORTING-BUGS
lib+mm: fix few spelling mistakes
MAINTAINERS: add git URL for APM driver
treewide: Fix typo in printk -
Pull GPIO updates from Linus Walleij:
"This is the bulk of GPIO changes for kernel v4.6. There is quite a
lot of interesting stuff going on.The patches to other subsystems and arch-wide are ACKed as far as
possible, though I consider things like per-arch as
essentially a part of the GPIO subsystem so it should not be needed.Core changes:
- The gpio_chip is now a *real device*. Until now the gpio chips
were just piggybacking the parent device or (gasp) floating in
space outside of the device model.We now finally make GPIO chips devices. The gpio_chip will create
a gpio_device which contains a struct device, and this gpio_device
struct is kept private. Anything that needs to be kept private
from the rest of the kernel will gradually be moved over to the
gpio_device.- As a result of making the gpio_device a real device, we have added
resource management, so devm_gpiochip_add_data() will cut down on
overhead and reduce code lines. A huge slew of patches convert
almost all drivers in the subsystem to use this.- Building on making the GPIO a real device, we add the first step of
a new userspace ABI: the GPIO character device. We take small
steps here, so we first add a pure *information* ABI and the tool
"lsgpio" that will list all GPIO devices on the system and all
lines on these devices.We can now discover GPIOs properly from userspace. We still have
not come up with a way to actually *use* GPIOs from userspace.- To encourage people to use the character device for the future, we
have it always-enabled when using GPIO. The old sysfs ABI is still
opt-in (and can be used in parallel), but is marked as deprecated.We will keep it around for the foreseeable future, but it will not
be extended to cover ever more use cases.Cleanup:
- Bjorn Helgaas removed a whole slew of per-architecture
includes.This dates back to when GPIO was an opt-in feature and no shared
library even existed: just a header file with proper prototypes was
provided and all semantics were up to the arch to implement. These
patches make the GPIO chip even more a proper device and cleans out
leftovers of the old in-kernel API here and there.Still some cruft is left but it's very little now.
- There is still some clamping of return values for .get() going on,
but we now return sane values in the vast majority of drivers and
the errorpath is sanitized. Some patches for powerpc, blackfin and
unicore still drop in.- We continue to switch the ARM, MIPS, blackfin, m68k local GPIO
implementations to use gpiochip_add_data() and cut down on code
lines.- MPC8xxx is converted to use the generic GPIO helpers.
- ATH79 is converted to use the generic GPIO helpers.
New drivers:
- WinSystems WS16C48
- Acces 104-DIO-48E
- F81866 (a F7188x variant)
- Qoric (a MPC8xxx variant)
- TS-4800
- SPI serializers (pisosr): simple 74xx shift registers connected to
SPI to obtain a dirt-cheap output-only GPIO expander.- Texas Instruments TPIC2810
- Texas Instruments TPS65218
- Texas Instruments TPS65912
- X-Gene (ARM64) standby GPIO controller"
* tag 'gpio-v4.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (194 commits)
Revert "Share upstreaming patches"
gpio: mcp23s08: Fix clearing of interrupt.
gpiolib: Fix comment referring to gpio_*() in gpiod_*()
gpio: pca953x: Fix pca953x_gpio_set_multiple() on 64-bit
gpio: xgene: Fix kconfig for standby GIPO contoller
gpio: Add generic serializer DT binding
gpio: uapi: use 0xB4 as ioctl() major
gpio: tps65912: fix bad merge
Revert "gpio: lp3943: Drop pin_used and lp3943_gpio_request/lp3943_gpio_free"
gpio: omap: drop dev field from gpio_bank structure
gpio: mpc8xxx: Slightly update the code for better readability
gpio: mpc8xxx: Remove *read_reg and *write_reg from struct mpc8xxx_gpio_chip
gpio: mpc8xxx: Fixup setting gpio direction output
gpio: mcp23s08: Add support for mcp23s18
dt-bindings: gpio: altera: Fix altr,interrupt-type property
gpio: add driver for MEN 16Z127 GPIO controller
gpio: lp3943: Drop pin_used and lp3943_gpio_request/lp3943_gpio_free
gpio: timberdale: Switch to devm_ioremap_resource()
gpio: ts4800: Add IMX51 dependency
gpiolib: rewrite gpiodev_add_to_list
...