Merge tag 'staging-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging fixes from Greg KH: "Here are some staging driver fixes for 3.18-rc3. Mostly iio and comedi driver fixes for issues reported by people. All of these have been in linux-next for a while with no reported issues" * tag 'staging-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: fix memory leak / bad pointer freeing for chanlist staging: comedi: Kconfig: fix config COMEDI_ADDI_APCI_3120 dependants staging: comedi: widen subdevice number argument in ioctl handlers staging: rtl8723au: Fix alignment of mac_addr for ether_addr_copy() usage drivers/staging/comedi/Kconfig: Let COMEDI_II_PCI20KC depend on HAS_IOMEM staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl iio: adc: mxs-lradc: Disable the clock on probe failure iio: st_sensors: Fix buffer copy staging:iio:ad5933: Drop "raw" from channel names staging:iio:ad5933: Fix NULL pointer deref when enabling buffer

Merge tag 'staging-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging fixes from Greg KH: "Here are some staging driver fixes for 3.18-rc3. Mostly iio and comedi driver fixes for issues reported by people. All of these have been in linux-next for a while with no reported issues" * tag 'staging-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: fix memory leak / bad pointer freeing for chanlist staging: comedi: Kconfig: fix config COMEDI_ADDI_APCI_3120 dependants staging: comedi: widen subdevice number argument in ioctl handlers staging: rtl8723au: Fix alignment of mac_addr for ether_addr_copy() usage drivers/staging/comedi/Kconfig: Let COMEDI_II_PCI20KC depend on HAS_IOMEM staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl iio: adc: mxs-lradc: Disable the clock on probe failure iio: st_sensors: Fix buffer copy staging:iio:ad5933: Drop "raw" from channel names staging:iio:ad5933: Fix NULL pointer deref when enabling buffer
Linus Torvalds
2 parents 528a506e4b 238b5ad855
Showing 6 changed files Side-by-side Diff
drivers/iio/common/st_sensors/st_sensors_buffer.c
drivers/staging/comedi/Kconfig
drivers/staging/comedi/comedi_fops.c
drivers/staging/iio/adc/mxs-lradc.c
drivers/staging/iio/impedance-analyzer/ad5933.c
drivers/staging/rtl8723au/include/rtw_eeprom.h
@@ -71,7 +71,7 @@
 				goto st_sensors_free_memory;
 			}
  
-			for (i = 0; i < n * num_data_channels; i++) {
+			for (i = 0; i < n * byte_for_channel; i++) {
 				if (i < n)
 					buf[i] = rx_array[i];
 				else
@@ -426,6 +426,7 @@
  
 config COMEDI_II_PCI20KC
 	tristate "Intelligent Instruments PCI-20001C carrier support"
+	depends on HAS_IOMEM
 	---help---
 	  Enable support for Intelligent Instruments PCI-20001C carrier
 	  PCI-20001, PCI-20006 and PCI-20341
@@ -667,7 +668,6 @@
 config COMEDI_ADDI_APCI_3120
 	tristate "ADDI-DATA APCI_3120/3001 support"
 	depends on HAS_DMA
-	depends on VIRT_TO_BUS
 	---help---
 	  Enable support for ADDI-DATA APCI_3120/3001 cards
  
@@ -1462,10 +1462,7 @@
 	unsigned int *chanlist;
 	int ret;
  
-	/* user_chanlist could be NULL for do_cmdtest ioctls */
-	if (!user_chanlist)
-		return 0;
-
+	cmd->chanlist = NULL;
 	chanlist = memdup_user(user_chanlist,
 			       cmd->chanlist_len * sizeof(unsigned int));
 	if (IS_ERR(chanlist))
  
@@ -1609,13 +1606,18 @@
  
 	s = &dev->subdevices[cmd.subdev];
  
-	/* load channel/gain list */
-	ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
-	if (ret)
-		return ret;
+	/* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
+	if (user_chanlist) {
+		/* load channel/gain list */
+		ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
+		if (ret)
+			return ret;
+	}
  
 	ret = s->do_cmdtest(dev, s, &cmd);
  
+	kfree(cmd.chanlist);	/* free kernel copy of user chanlist */
+
 	/* restore chanlist pointer before copying back */
 	cmd.chanlist = (unsigned int __force *)user_chanlist;
  
@@ -1642,7 +1644,7 @@
  
 */
  
-static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_lock_ioctl(struct comedi_device *dev, unsigned long arg,
 			 void *file)
 {
 	int ret = 0;
@@ -1679,7 +1681,7 @@
 	This function isn't protected by the semaphore, since
 	we already own the lock.
 */
-static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_unlock_ioctl(struct comedi_device *dev, unsigned long arg,
 			   void *file)
 {
 	struct comedi_subdevice *s;
@@ -1714,7 +1716,7 @@
 		nothing
  
 */
-static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_cancel_ioctl(struct comedi_device *dev, unsigned long arg,
 			   void *file)
 {
 	struct comedi_subdevice *s;
@@ -1751,7 +1753,7 @@
 		nothing
  
 */
-static int do_poll_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_poll_ioctl(struct comedi_device *dev, unsigned long arg,
 			 void *file)
 {
 	struct comedi_subdevice *s;
@@ -1559,14 +1559,16 @@
 	/* Grab all IRQ sources */
 	for (i = 0; i < of_cfg->irq_count; i++) {
 		lradc->irq[i] = platform_get_irq(pdev, i);
-		if (lradc->irq[i] < 0)
-			return lradc->irq[i];
+		if (lradc->irq[i] < 0) {
+			ret = lradc->irq[i];
+			goto err_clk;
+		}
  
 		ret = devm_request_irq(dev, lradc->irq[i],
 					mxs_lradc_handle_irq, 0,
 					of_cfg->irq_name[i], iio);
 		if (ret)
-			return ret;
+			goto err_clk;
 	}
  
 	lradc->vref_mv = of_cfg->vref_mv;
@@ -1588,7 +1590,7 @@
 				&mxs_lradc_trigger_handler,
 				&mxs_lradc_buffer_ops);
 	if (ret)
-		return ret;
+		goto err_clk;
  
 	ret = mxs_lradc_trigger_init(iio);
 	if (ret)
@@ -1643,6 +1645,8 @@
 	mxs_lradc_trigger_remove(iio);
 err_trig:
 	iio_triggered_buffer_cleanup(iio);
+err_clk:
+	clk_disable_unprepare(lradc->clk);
 	return ret;
 }
  
@@ -115,6 +115,7 @@
 		.channel = 0,
 		.info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
 		.address = AD5933_REG_TEMP_DATA,
+		.scan_index = -1,
 		.scan_type = {
 			.sign = 's',
 			.realbits = 14,
@@ -124,9 +125,7 @@
 		.type = IIO_VOLTAGE,
 		.indexed = 1,
 		.channel = 0,
-		.extend_name = "real_raw",
-		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-		BIT(IIO_CHAN_INFO_SCALE),
+		.extend_name = "real",
 		.address = AD5933_REG_REAL_DATA,
 		.scan_index = 0,
 		.scan_type = {
@@ -138,9 +137,7 @@
 		.type = IIO_VOLTAGE,
 		.indexed = 1,
 		.channel = 0,
-		.extend_name = "imag_raw",
-		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-		BIT(IIO_CHAN_INFO_SCALE),
+		.extend_name = "imag",
 		.address = AD5933_REG_IMAG_DATA,
 		.scan_index = 1,
 		.scan_type = {
  
@@ -749,14 +746,14 @@
 	indio_dev->name = id->name;
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->channels = ad5933_channels;
-	indio_dev->num_channels = 1; /* only register temp0_input */
+	indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
  
 	ret = ad5933_register_ring_funcs_and_init(indio_dev);
 	if (ret)
 		goto error_disable_reg;
  
-	/* skip temp0_input, register in0_(real|imag)_raw */
-	ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2);
+	ret = iio_buffer_register(indio_dev, ad5933_channels,
+		ARRAY_SIZE(ad5933_channels));
 	if (ret)
 		goto error_unreg_ring;
  
@@ -107,12 +107,12 @@
 };
  
 struct eeprom_priv {
+	u8		mac_addr[6];	/* PermanentAddress */
 	u8		bautoload_fail_flag;
 	u8		bloadfile_fail_flag;
 	u8		bloadmac_fail_flag;
 	/* u8		bempty; */
 	/* u8		sys_config; */
-	u8		mac_addr[6];	/* PermanentAddress */
 	/* u8		config0; */
 	u16		channel_plan;
 	/* u8		country_string[3]; */
...	...	@@ -71,7 +71,7 @@
71	71	goto st_sensors_free_memory;
72	72	}
73	73
74		- for (i = 0; i < n * num_data_channels; i++) {
	74	+ for (i = 0; i < n * byte_for_channel; i++) {
75	75	if (i < n)
76	76	buf[i] = rx_array[i];
77	77	else
...	...	@@ -426,6 +426,7 @@
426	426
427	427	config COMEDI_II_PCI20KC
428	428	tristate "Intelligent Instruments PCI-20001C carrier support"
	429	+ depends on HAS_IOMEM
429	430	---help---
430	431	Enable support for Intelligent Instruments PCI-20001C carrier
431	432	PCI-20001, PCI-20006 and PCI-20341
...	...	@@ -667,7 +668,6 @@
667	668	config COMEDI_ADDI_APCI_3120
668	669	tristate "ADDI-DATA APCI_3120/3001 support"
669	670	depends on HAS_DMA
670		- depends on VIRT_TO_BUS
671	671	---help---
672	672	Enable support for ADDI-DATA APCI_3120/3001 cards
673	673
...	...	@@ -1462,10 +1462,7 @@
1462	1462	unsigned int *chanlist;
1463	1463	int ret;
1464	1464
1465		- /* user_chanlist could be NULL for do_cmdtest ioctls */
1466		- if (!user_chanlist)
1467		- return 0;
1468		-
	1465	+ cmd->chanlist = NULL;
1469	1466	chanlist = memdup_user(user_chanlist,
1470	1467	cmd->chanlist_len * sizeof(unsigned int));
1471	1468	if (IS_ERR(chanlist))
1472	1469
...	...	@@ -1609,13 +1606,18 @@
1609	1606
1610	1607	s = &dev->subdevices[cmd.subdev];
1611	1608
1612		- /* load channel/gain list */
1613		- ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
1614		- if (ret)
1615		- return ret;
	1609	+ /* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
	1610	+ if (user_chanlist) {
	1611	+ /* load channel/gain list */
	1612	+ ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
	1613	+ if (ret)
	1614	+ return ret;
	1615	+ }
1616	1616
1617	1617	ret = s->do_cmdtest(dev, s, &cmd);
1618	1618
	1619	+ kfree(cmd.chanlist); /* free kernel copy of user chanlist */
	1620	+
1619	1621	/* restore chanlist pointer before copying back */
1620	1622	cmd.chanlist = (unsigned int __force *)user_chanlist;
1621	1623
...	...	@@ -1642,7 +1644,7 @@
1642	1644
1643	1645	*/
1644	1646
1645		-static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
	1647	+static int do_lock_ioctl(struct comedi_device *dev, unsigned long arg,
1646	1648	void *file)
1647	1649	{
1648	1650	int ret = 0;
...	...	@@ -1679,7 +1681,7 @@
1679	1681	This function isn't protected by the semaphore, since
1680	1682	we already own the lock.
1681	1683	*/
1682		-static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
	1684	+static int do_unlock_ioctl(struct comedi_device *dev, unsigned long arg,
1683	1685	void *file)
1684	1686	{
1685	1687	struct comedi_subdevice *s;
...	...	@@ -1714,7 +1716,7 @@
1714	1716	nothing
1715	1717
1716	1718	*/
1717		-static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
	1719	+static int do_cancel_ioctl(struct comedi_device *dev, unsigned long arg,
1718	1720	void *file)
1719	1721	{
1720	1722	struct comedi_subdevice *s;
...	...	@@ -1751,7 +1753,7 @@
1751	1753	nothing
1752	1754
1753	1755	*/
1754		-static int do_poll_ioctl(struct comedi_device *dev, unsigned int arg,
	1756	+static int do_poll_ioctl(struct comedi_device *dev, unsigned long arg,
1755	1757	void *file)
1756	1758	{
1757	1759	struct comedi_subdevice *s;
...	...	@@ -1559,14 +1559,16 @@
1559	1559	/* Grab all IRQ sources */
1560	1560	for (i = 0; i < of_cfg->irq_count; i++) {
1561	1561	lradc->irq[i] = platform_get_irq(pdev, i);
1562		- if (lradc->irq[i] < 0)
1563		- return lradc->irq[i];
	1562	+ if (lradc->irq[i] < 0) {
	1563	+ ret = lradc->irq[i];
	1564	+ goto err_clk;
	1565	+ }
1564	1566
1565	1567	ret = devm_request_irq(dev, lradc->irq[i],
1566	1568	mxs_lradc_handle_irq, 0,
1567	1569	of_cfg->irq_name[i], iio);
1568	1570	if (ret)
1569		- return ret;
	1571	+ goto err_clk;
1570	1572	}
1571	1573
1572	1574	lradc->vref_mv = of_cfg->vref_mv;
...	...	@@ -1588,7 +1590,7 @@
1588	1590	&mxs_lradc_trigger_handler,
1589	1591	&mxs_lradc_buffer_ops);
1590	1592	if (ret)
1591		- return ret;
	1593	+ goto err_clk;
1592	1594
1593	1595	ret = mxs_lradc_trigger_init(iio);
1594	1596	if (ret)
...	...	@@ -1643,6 +1645,8 @@
1643	1645	mxs_lradc_trigger_remove(iio);
1644	1646	err_trig:
1645	1647	iio_triggered_buffer_cleanup(iio);
	1648	+err_clk:
	1649	+ clk_disable_unprepare(lradc->clk);
1646	1650	return ret;
1647	1651	}
1648	1652
...	...	@@ -115,6 +115,7 @@
115	115	.channel = 0,
116	116	.info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
117	117	.address = AD5933_REG_TEMP_DATA,
	118	+ .scan_index = -1,
118	119	.scan_type = {
119	120	.sign = 's',
120	121	.realbits = 14,
...	...	@@ -124,9 +125,7 @@
124	125	.type = IIO_VOLTAGE,
125	126	.indexed = 1,
126	127	.channel = 0,
127		- .extend_name = "real_raw",
128		- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) \|
129		- BIT(IIO_CHAN_INFO_SCALE),
	128	+ .extend_name = "real",
130	129	.address = AD5933_REG_REAL_DATA,
131	130	.scan_index = 0,
132	131	.scan_type = {
...	...	@@ -138,9 +137,7 @@
138	137	.type = IIO_VOLTAGE,
139	138	.indexed = 1,
140	139	.channel = 0,
141		- .extend_name = "imag_raw",
142		- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) \|
143		- BIT(IIO_CHAN_INFO_SCALE),
	140	+ .extend_name = "imag",
144	141	.address = AD5933_REG_IMAG_DATA,
145	142	.scan_index = 1,
146	143	.scan_type = {
147	144
...	...	@@ -749,14 +746,14 @@
749	746	indio_dev->name = id->name;
750	747	indio_dev->modes = INDIO_DIRECT_MODE;
751	748	indio_dev->channels = ad5933_channels;
752		- indio_dev->num_channels = 1; /* only register temp0_input */
	749	+ indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
753	750
754	751	ret = ad5933_register_ring_funcs_and_init(indio_dev);
755	752	if (ret)
756	753	goto error_disable_reg;
757	754
758		- /* skip temp0_input, register in0_(real\|imag)_raw */
759		- ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2);
	755	+ ret = iio_buffer_register(indio_dev, ad5933_channels,
	756	+ ARRAY_SIZE(ad5933_channels));
760	757	if (ret)
761	758	goto error_unreg_ring;
762	759
...	...	@@ -107,12 +107,12 @@
107	107	};
108	108
109	109	struct eeprom_priv {
	110	+ u8 mac_addr[6]; /* PermanentAddress */
110	111	u8 bautoload_fail_flag;
111	112	u8 bloadfile_fail_flag;
112	113	u8 bloadmac_fail_flag;
113	114	/* u8 bempty; */
114	115	/* u8 sys_config; */
115		- u8 mac_addr[6]; /* PermanentAddress */
116	116	/* u8 config0; */
117	117	u16 channel_plan;
118	118	/* u8 country_string[3]; */