19 Apr, 2014
1 commit
-
Pull staging driver fixes from Greg KH:
"Here are a few staging driver fixes for issues that have been reported
for 3.15-rc2.Also dominating the diffstat for the pull request is the removal of
the rtl8187se driver. It's no longer needed in staging as a "real"
driver for this hardware is now merged in the tree in the "correct"
location in drivers/net/All of these patches have been tested in linux-next"
* tag 'staging-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: r8188eu: Fix case where ethtype was never obtained and always be checked against 0
staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL
staging: comedi: fix circular locking dependency in comedi_mmap()
staging: r8723au: Add missing initialization of change_inx in sort algorithm
Staging: unisys: use after free in list_for_each()
staging: unisys: use after free in error messages
staging: speakup: fix misuse of kstrtol() in handle_goto()
staging: goldfish: Call free_irq in error path
staging: delete rtl8187se wireless driver
staging: rtl8723au: Fix buffer overflow in rtw_get_wfd_ie()
staging: gs_fpgaboot: remove __TIMESTAMP__ macro
staging: vme: fix memory leak in vme_user_probe()
staging: fpgaboot: clean up Makefile
staging/usbip: fix store_attach() sscanf return value check
staging/usbip: userspace - fix usbipd SIGSEGV from refresh_exported_devices()
staging: rtl8188eu: remove spaces, correct counts to unbreak P2P ioctls
staging/rtl8821ae: Fix OOM handling in _rtl_init_deferred_work()
17 Apr, 2014
11 commits
-
The drivers/video directory is a mess. It contains generic video related
files, directories for backlight, console, linux logo, lots of fbdev
device drivers, fbdev framework files.Make some order into the chaos by creating drivers/video/fbdev
directory, and move all fbdev related files there.No functionality is changed, although I guess it is possible that some
subtle Makefile build order related issue could be created by this
patch.Signed-off-by: Tomi Valkeinen
Acked-by: Laurent Pinchart
Acked-by: Geert Uytterhoeven
Acked-by: Rob Clark
Acked-by: Jingoo Han
Acked-by: Daniel Vetter -
Zero-initializing ether_type masked that the ether type would never be
obtained for 8021x packets and the comparison against eapol_type
would always fail.Reported-by: Jes Sorensen
Signed-off-by: Larry Finger
Cc: Stable
Signed-off-by: Greg Kroah-Hartman -
Zero-initializing ether_type masked that the ether type would never be
obtained for 8021x packets and the comparison against eapol_type
would always fail.Reported-by: Jes Sorensen
Signed-off-by: Larry Finger
Cc: Stable
Signed-off-by: Greg Kroah-Hartman -
This makes the follow-on check for psta != NULL pointless and makes
the whole exercise rather pointless. This is another case of why
blindly zero-initializing variables when they are declared is bad.Reported-by: Jes Sorensen
Signed-off-by: Larry Finger
Cc: Stable
Signed-off-by: Greg Kroah-Hartman -
Mmapping a comedi data buffer with lockdep checking enabled produced the
following kernel debug messages:======================================================
[ INFO: possible circular locking dependency detected ]
3.5.0-rc3-ija1+ #9 Tainted: G C
-------------------------------------------------------
comedi_test/4160 is trying to acquire lock:
(&dev->mutex#2){+.+.+.}, at: [] comedi_mmap+0x57/0x1d9 [comedi]but task is already holding lock:
(&mm->mmap_sem){++++++}, at: [] vm_mmap_pgoff+0x41/0x76which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&mm->mmap_sem){++++++}:
[] lock_acquire+0x97/0x105
[] might_fault+0x6d/0x90
[] do_devinfo_ioctl.isra.7+0x11e/0x14c [comedi]
[] comedi_unlocked_ioctl+0x256/0xe48 [comedi]
[] vfs_ioctl+0x18/0x34
[] do_vfs_ioctl+0x382/0x43c
[] sys_ioctl+0x42/0x65
[] system_call_fastpath+0x16/0x1b-> #0 (&dev->mutex#2){+.+.+.}:
[] __lock_acquire+0x101d/0x1591
[] lock_acquire+0x97/0x105
[] mutex_lock_nested+0x46/0x2a4
[] comedi_mmap+0x57/0x1d9 [comedi]
[] mmap_region+0x281/0x492
[] do_mmap_pgoff+0x26b/0x2a7
[] vm_mmap_pgoff+0x5d/0x76
[] sys_mmap_pgoff+0xc7/0x10d
[] sys_mmap+0x16/0x20
[] system_call_fastpath+0x16/0x1bother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&mm->mmap_sem);
lock(&dev->mutex#2);
lock(&mm->mmap_sem);
lock(&dev->mutex#2);*** DEADLOCK ***
To avoid the circular dependency, just try to get the lock in
`comedi_mmap()` instead of blocking. Since the comedi device's main mutex
is heavily used, do a down-read of its `attach_lock` rwsemaphore
instead. Trying to down-read `attach_lock` should only fail if
some task has down-write locked it, and that is only done while the
comedi device is being attached to or detached from a low-level hardware
device.Unfortunately, acquiring the `attach_lock` doesn't prevent another
task replacing the comedi data buffer we are trying to mmap. The
details of the buffer are held in a `struct comedi_buf_map` and pointed
to by `s->async->buf_map` where `s` is the comedi subdevice whose buffer
we are trying to map. The `struct comedi_buf_map` is already reference
counted with a `struct kref`, so we can stop it being freed prematurely.Modify `comedi_mmap()` to call new function
`comedi_buf_map_from_subdev_get()` to read the subdevice's current
buffer map pointer and increment its reference instead of accessing
`async->buf_map` directly. Call `comedi_buf_map_put()` to decrement the
reference once the buffer map structure has been dealt with. (Note that
`comedi_buf_map_put()` does nothing if passed a NULL pointer.)`comedi_buf_map_from_subdev_get()` checks the subdevice's buffer map
pointer has been set and the buffer map has been initialized enough for
`comedi_mmap()` to deal with it (specifically, check the `n_pages`
member has been set to a non-zero value). If all is well, the buffer
map's reference is incremented and a pointer to it is returned. The
comedi subdevice's spin-lock is used to protect the checks. Also use
the spin-lock in `__comedi_buf_alloc()` and `__comedi_buf_free()` to
protect changes to the subdevice's buffer map structure pointer and the
buffer map structure's `n_pages` member. (This checking of `n_pages` is
a bit clunky and I [Ian Abbott] plan to deal with it in the future.)Signed-off-by: Ian Abbott
Cc: # 3.14.x, 3.15.x
Signed-off-by: Greg Kroah-Hartman -
drivers/staging/rtl8723au/core/rtw_wlan_util.c: In function ‘WMMOnAssocRsp23a’:
drivers/staging/rtl8723au/core/rtw_wlan_util.c:684: warning: ‘change_inx’ may be used uninitialized in this functionDepending on the uninitialized data on the stack, the array may not be
sorted correctly.Signed-off-by: Geert Uytterhoeven
Acked-by: Larry Finger
Signed-off-by: Greg Kroah-Hartman -
These should be using the _safe version of list_for_each() because we
free the current element and it leads to a use after free bug.Signed-off-by: Dan Carpenter
Signed-off-by: Greg Kroah-Hartman -
We dereference "bus" when we report the error so we have to move the
kfree() down a couple lines.Signed-off-by: Dan Carpenter
Signed-off-by: Greg Kroah-Hartman -
A string of goto_buf has a number followed by x or y.
e.g. "3x" means move 3 lines down.
The kstrtol() returns an error(-EINVAL) with this string so
go_pos has unsigned a value of that error.
And also "*cp" has not expected value.And fix sparse warnings:
drivers/staging/speakup/main.c:1901 handle_goto() warn: unsigned '(speakup_console[vc->vc_num]->go_pos)' is never less than zero.
drivers/staging/speakup/main.c:1911 handle_goto() warn: unsigned '(speakup_console[vc->vc_num]->go_pos)' is never less than zero.Signed-off-by: Daeseok Youn
Reviewed-by: Dan Carpenter
Signed-off-by: Greg Kroah-Hartman -
If misc_register failed in goldfish_audio_probe, the already requested
IRQ wouldn't get freed. Add a call to free_irq() like there is in
goldfish_audio_remove().Signed-off-by: Tuomas Tynkkynen
Acked-by: Alan Cox
Signed-off-by: Greg Kroah-Hartman -
There is a "real" driver for this hardware now in drivers/net/ so remove
the staging version as it's not needed anymore.Reported-by: Xose Vazquez Perez
Cc: Larry Finger
Cc: John W. Linville"
Signed-off-by: Greg Kroah-Hartman
16 Apr, 2014
8 commits
-
Add bounds checking to not allow WFD Information Elements larger than
128, and make sure we use the correct buffer size MAX_WFD_IE_LEN
instea of hardcoding the size.This also simplifies rtw_get_wfd_ie() by using the cfg80211
infrastructure.Reported-by: Dan Carpenter
Signed-off-by: Jes Sorensen
Signed-off-by: Greg Kroah-Hartman -
We specifically build the kernel with -Werror=date-time to detect
such macros, which gives us this error:gs_fpgaboot/gs_fpgaboot.c:376:44: error: macro "__TIMESTAMP__" might prevent reproducible builds [-Werror=date-time]
pr_info("built at %s UTC\n", __TIMESTAMP__);The obvious fix is to remove the printk output line.
Signed-off-by: Arnd Bergmann
Signed-off-by: Insop Song
Acked-by: Geert Uytterhoeven
Signed-off-by: Greg Kroah-Hartman -
If vme_master_request() returns NULL when it failed,
it need to free buffers for master.And also removes unreachable code in vme_user_probe().
Signed-off-by: Daeseok Youn
Signed-off-by: Greg Kroah-Hartman -
This Makefile tries to set the DEBUG macro but it uses an unknown
Kconfig macro to do so. Since no code appears to even care about the
DEBUG macro this line can safely be removed.Signed-off-by: Paul Bolle
Reviewed-by: Insop Song
Signed-off-by: Greg Kroah-Hartman -
sscanf() parses the input buffer for four input items. However,
the return value check is incorrect, as it checks for one input
item instead of four which is what it is expecting in the input
buffer. As a result, sscanf() will always fail even when the input
buffer is correct.Signed-off-by: Shuah Khan
Signed-off-by: Greg Kroah-Hartman -
refresh_exported_devices() doesn't check udev_device_new_from_syspath()
return value and passed in null dev to udev_device_get_driver() resulting
in a segmentation fault. Change it to check for null return value from
both udev_device_new_from_syspath() and udev_device_get_driver().Signed-off-by: Shuah Khan
Signed-off-by: Greg Kroah-Hartman -
staging: rtl8188eu: remove spaces, correct counts to unbreak P2P ioctls
It looks like someone did a search-and-replace on that driver, putting
spaces before "=" characters, without checking this is OK everywhere.
Also, in some places, there's memcpm()s/strncmp()s checking for some
different length than the fixed string argument.These things result in code not working as intended. Fix that.
Signed-off-by: Wilfried Klaebe
Signed-off-by: Greg Kroah-Hartman -
alloc_workqueue() can fail, handle this case.
Signed-off-by: Richard Weinberger
Signed-off-by: Greg Kroah-Hartman
13 Apr, 2014
3 commits
-
Pull yet more networking updates from David Miller:
1) Various fixes to the new Redpine Signals wireless driver, from
Fariya Fatima.2) L2TP PPP connect code takes PMTU from the wrong socket, fix from
Dmitry Petukhov.3) UFO and TSO packets differ in whether they include the protocol
header in gso_size, account for that in skb_gso_transport_seglen().
From Florian Westphal.4) If VLAN untagging fails, we double free the SKB in the bridging
output path. From Toshiaki Makita.5) Several call sites of sk->sk_data_ready() were referencing an SKB
just added to the socket receive queue in order to calculate the
second argument via skb->len. This is dangerous because the moment
the skb is added to the receive queue it can be consumed in another
context and freed up.It turns out also that none of the sk->sk_data_ready()
implementations even care about this second argument.So just kill it off and thus fix all these use-after-free bugs as a
side effect.6) Fix inverted test in tcp_v6_send_response(), from Lorenzo Colitti.
7) pktgen needs to do locking properly for LLTX devices, from Daniel
Borkmann.8) xen-netfront driver initializes TX array entries in RX loop :-) From
Vincenzo Maffione.9) After refactoring, some tunnel drivers allow a tunnel to be
configured on top itself. Fix from Nicolas Dichtel.* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (46 commits)
vti: don't allow to add the same tunnel twice
gre: don't allow to add the same tunnel twice
drivers: net: xen-netfront: fix array initialization bug
pktgen: be friendly to LLTX devices
r8152: check RTL8152_UNPLUG
net: sun4i-emac: add promiscuous support
net/apne: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO
net: ipv6: Fix oif in TCP SYN+ACK route lookup.
drivers: net: cpsw: enable interrupts after napi enable and clearing previous interrupts
drivers: net: cpsw: discard all packets received when interface is down
net: Fix use after free by removing length arg from sk_data_ready callbacks.
Drivers: net: hyperv: Address UDP checksum issues
Drivers: net: hyperv: Negotiate suitable ndis version for offload support
Drivers: net: hyperv: Allocate memory for all possible per-pecket information
bridge: Fix double free and memory leak around br_allowed_ingress
bonding: Remove debug_fs files when module init fails
i40evf: program RSS LUT correctly
i40evf: remove open-coded skb_cow_head
ixgb: remove open-coded skb_cow_head
igbvf: remove open-coded skb_cow_head
... -
Pull media fixes from Mauro Carvalho Chehab:
"A series of bug fix patches for v3.15-rc1. Most are just driver
fixes. There are some changes at remote controller core level, fixing
some definitions on a new API added for Kernel v3.15.It also adds the missing include at include/uapi/linux/v4l2-common.h,
to allow its compilation on userspace, as pointed by you"* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (24 commits)
[media] gpsca: remove the risk of a division by zero
[media] stk1160: warrant a NUL terminated string
[media] v4l: ti-vpe: retain v4l2_buffer flags for captured buffers
[media] v4l: ti-vpe: Set correct field parameter for output and capture buffers
[media] v4l: ti-vpe: zero out reserved fields in try_fmt
[media] v4l: ti-vpe: Fix initial configuration queue data
[media] v4l: ti-vpe: Use correct bus_info name for the device in querycap
[media] v4l: ti-vpe: report correct capabilities in querycap
[media] v4l: ti-vpe: Allow usage of smaller images
[media] v4l: ti-vpe: Use video_device_release_empty
[media] v4l: ti-vpe: Make sure in job_ready that we have the needed number of dst_bufs
[media] lgdt3305: include sleep functionality in lgdt3304_ops
[media] drx-j: use customise option correctly
[media] m88rs2000: fix sparse static warnings
[media] r820t: fix size and init values
[media] rc-core: remove generic scancode filter
[media] rc-core: split dev->s_filter
[media] rc-core: do not change 32bit NEC scancode format for now
[media] rtl28xxu: remove duplicate ID 0458:707f Genius TVGo DVB-T03
[media] xc2028: add missing break to switch
... -
Pull vfs updates from Al Viro:
"The first vfs pile, with deep apologies for being very late in this
window.Assorted cleanups and fixes, plus a large preparatory part of iov_iter
work. There's a lot more of that, but it'll probably go into the next
merge window - it *does* shape up nicely, removes a lot of
boilerplate, gets rid of locking inconsistencie between aio_write and
splice_write and I hope to get Kent's direct-io rewrite merged into
the same queue, but some of the stuff after this point is having
(mostly trivial) conflicts with the things already merged into
mainline and with some I want more testing.This one passes LTP and xfstests without regressions, in addition to
usual beating. BTW, readahead02 in ltp syscalls testsuite has started
giving failures since "mm/readahead.c: fix readahead failure for
memoryless NUMA nodes and limit readahead pages" - might be a false
positive, might be a real regression..."* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
missing bits of "splice: fix racy pipe->buffers uses"
cifs: fix the race in cifs_writev()
ceph_sync_{,direct_}write: fix an oops on ceph_osdc_new_request() failure
kill generic_file_buffered_write()
ocfs2_file_aio_write(): switch to generic_perform_write()
ceph_aio_write(): switch to generic_perform_write()
xfs_file_buffered_aio_write(): switch to generic_perform_write()
export generic_perform_write(), start getting rid of generic_file_buffer_write()
generic_file_direct_write(): get rid of ppos argument
btrfs_file_aio_write(): get rid of ppos
kill the 5th argument of generic_file_buffered_write()
kill the 4th argument of __generic_file_aio_write()
lustre: don't open-code kernel_recvmsg()
ocfs2: don't open-code kernel_recvmsg()
drbd: don't open-code kernel_recvmsg()
constify blk_rq_map_user_iov() and friends
lustre: switch to kernel_sendmsg()
ocfs2: don't open-code kernel_sendmsg()
take iov_iter stuff to mm/iov_iter.c
process_vm_access: tidy up a bit
...
12 Apr, 2014
1 commit
-
Several spots in the kernel perform a sequence like:
skb_queue_tail(&sk->s_receive_queue, skb);
sk->sk_data_ready(sk, skb->len);But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up. So this skb->len access is potentially
to freed up memory.Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.And finally, no actual implementation of this callback actually uses
the length argument. And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.Signed-off-by: David S. Miller
09 Apr, 2014
2 commits
-
Pull more staging patches from Greg KH:
"Here are some more staging patches for 3.15-rc1.They include a late-submission of a wireless driver that a bunch of
people seem to have the hardware for now. As it's stand-alone, it
should be fine (now passes the 0-day random build bot tests).There are also some fixes for the unisys drivers, as they were causing
havoc on a number of different machines. To resolve all of those
issues, we just mark the driver as BROKEN now, and we can fix it up
"properly" over time"* tag 'staging-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723au: The 8723 only has two paths
Staging: unisys: mark drivers as BROKEN
Staging: unisys: verify that a control channel exists
staging: unisys: Add missing close parentheses in filexfer.c
staging: r8723au: Fix build problem when RFKILL is not selected
staging: r8723au: Fix randconfig build errors
staging: r8723au: Turn on build of new driver
staging: r8723au: Additional source patches
staging: r8723au: Add source files for new driver - part 4
staging: r8723au: Add source files for new driver - part 3
staging: r8723au: Add source files for new driver - part 2
staging: r8723au: Add source files for new driver - part 1 -
Pull drm updates from Dave Airlie:
"Highlights:- drm:
Generic display port aux features, primary plane support, drm
master management fixes, logging cleanups, enforced locking checks
(instead of docs), documentation improvements, minor number
handling cleanup, pseudofs for shared inodes.- ttm:
add ability to allocate from both ends
- i915:
broadwell features, power domain and runtime pm, per-process
address space infrastructure (not enabled)- msm:
power management, hdmi audio support
- nouveau:
ongoing GPU fault recovery, initial maxwell support, random fixes
- exynos:
refactored driver to clean up a lot of abstraction, DP support
moved into drm, LVDS bridge support added, parallel panel support- gma500:
SGX MMU support, SGX irq handling, asle irq work fixes
- radeon:
video engine bringup, ring handling fixes, use dp aux helpers
- vmwgfx:
add rendernode support"
* 'drm-next' of git://people.freedesktop.org/~airlied/linux: (849 commits)
DRM: armada: fix corruption while loading cursors
drm/dp_helper: don't return EPROTO for defers (v2)
drm/bridge: export ptn3460_init function
drm/exynos: remove MODULE_DEVICE_TABLE definitions
ARM: dts: exynos4412-trats2: enable exynos/fimd node
ARM: dts: exynos4210-trats: enable exynos/fimd node
ARM: dts: exynos4412-trats2: add panel node
ARM: dts: exynos4210-trats: add panel node
ARM: dts: exynos4: add MIPI DSI Master node
drm/panel: add S6E8AA0 driver
ARM: dts: exynos4210-universal_c210: add proper panel node
drm/panel: add ld9040 driver
panel/ld9040: add DT bindings
panel/s6e8aa0: add DT bindings
drm/exynos: add DSIM driver
exynos/dsim: add DT bindings
drm/exynos: disallow fbdev initialization if no device is connected
drm/mipi_dsi: create dsi devices only for nodes with reg property
drm/mipi_dsi: add flags to DSI messages
Skip intel_crt_init for Dell XPS 8700
...
08 Apr, 2014
4 commits
-
Converting the driver from the original RTL provided version, by error
converted the code to use four, which caused all sorts of issues. The
confusion was caused by the RTL driver having support for both two and
four paths, and in some places had RF_PATH_MAX = 3. At the same time
it kept the data structures hard coded for two paths, in particular
the ones matching the efuse data.Signed-off-by: Jes Sorensen
Signed-off-by: Greg Kroah-Hartman -
Turns out these drivers like to mess around with the system even if the
hardware they control isn't present. That's not good, and people are
starting to report lots of issues with this in their build/boot testing.So for now, let's just mark them as BROKEN, until the code gets
converted to use the proper driver model interaction (i.e. don't do
anything until the hardware is actually found in the system.)Reported-by: Fengguang Wu
Reported-by: Sasha Levin
Cc: Benjamin Romer
Cc: David Kershner
Cc: someone
Cc: Ken Cox
Signed-off-by: Greg Kroah-Hartman -
The code didn't verify that a control channel exists before trying to
use it. It caused NULL ptr derefs which were easy to trigger by an
unpriviliged user simply by reading the proc file, causing:[ 68.161404] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 68.162442] IP: visorchannel_read (drivers/staging/unisys/visorchannel/visorchannel_funcs.c:225)
[ 68.163165] PGD 5ca21067 PUD 5ca20067 PMD 0
[ 68.163712] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 68.164390] Dumping ftrace buffer:
[ 68.164793] (ftrace buffer empty)
[ 68.165220] Modules linked in:
[ 68.165601] CPU: 0 PID: 7915 Comm: cat Tainted: G W 3.14.0-next-20140403-sasha-00012-gef5fa7d-dirty #373
[ 68.166821] task: ffff88006e8c3000 ti: ffff88005ca30000 task.ti: ffff88005ca30000
[ 68.167689] RIP: visorchannel_read (drivers/staging/unisys/visorchannel/visorchannel_funcs.c:225)
[ 68.168683] RSP: 0018:ffff88005ca31e58 EFLAGS: 00010282
[ 68.169302] RAX: ffff88005ca10000 RBX: ffff88005ca31e97 RCX: 0000000000000001
[ 68.170019] RDX: ffff88005ca31e97 RSI: 0000000000000bd6 RDI: 0000000000000000
[ 68.170019] RBP: ffff88005ca31e78 R08: 0000000000000000 R09: 0000000000000000
[ 68.170019] R10: ffff880000000000 R11: 0000000000000001 R12: 0000000000000001
[ 68.170019] R13: 0000000000000bd6 R14: 0000000000000000 R15: 0000000000008000
[ 68.170019] FS: 00007f0e8c041700(0000) GS:ffff88007be00000(0000) knlGS:0000000000000000
[ 68.170019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 68.170019] CR2: 0000000000000000 CR3: 000000006efe9000 CR4: 00000000000006b0
[ 68.170019] Stack:
[ 68.170019] ffff88005ca31f50 ffff88005ca10000 000000000060e000 ffff88005ca31f50
[ 68.170019] ffff88005ca31ec8 ffffffff83e6f983 ffff8800780db810 0000000000008000
[ 68.170019] ffff88005ca31ec8 ffff88006da5f908 ffff8800780db800 000000000060e000
[ 68.170019] Call Trace:
[ 68.170019] proc_read_toolaction (drivers/staging/unisys/visorchipset/visorchipset_main.c:2541)
[ 68.170019] proc_reg_read (fs/proc/inode.c:211)
[ 68.170019] vfs_read (fs/read_write.c:408)
[ 68.170019] SyS_read (fs/read_write.c:519 fs/read_write.c:511)
[ 68.170019] tracesys (arch/x86/kernel/entry_64.S:749)
[ 68.170019] Code: 00 00 66 66 66 66 90 55 48 89 e5 48 83 ec 20 48 89 5d e0 48 89 d3 4c 89 65 e8 49 89 cc 4c 89 6d f0 49 89 f5 4c 89 75 f8 49 89 fe 8b 3f e8 4f f9 ff ff 85 c0 0f 88 97 00 00 00 4d 85 ed 0f 85
[ 68.170019] RIP visorchannel_read (drivers/staging/unisys/visorchannel/visorchannel_funcs.c:225)
[ 68.170019] RSP
[ 68.170019] CR2: 0000000000000000Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman -
Add missing close parentheses in filexfer.c
Signed-off-by: Masanari Iida
Signed-off-by: Greg Kroah-Hartman
07 Apr, 2014
2 commits
-
The kbuild test robot reports the following build errors for x86_64-randconfig-c1-0407:
All error/warnings:
net/built-in.o: In function `wiphy_new':
>> (.text+0x7684c): undefined reference to `rfkill_alloc'
net/built-in.o: In function `wiphy_rfkill_start_polling':
>> (.text+0x76da4): undefined reference to `rfkill_resume_polling'
net/built-in.o: In function `wiphy_rfkill_stop_polling':
>> (.text+0x76de9): undefined reference to `rfkill_pause_polling'
net/built-in.o: In function `wiphy_unregister':
>> (.text+0x76ec9): undefined reference to `rfkill_unregister'
net/built-in.o: In function `wiphy_rfkill_set_hw_state':
>> (.text+0x771bc): undefined reference to `rfkill_set_hw_state'
net/built-in.o: In function `wiphy_register':
>> (.text+0x77968): undefined reference to `rfkill_register'
net/built-in.o: In function `wiphy_register':
>> (.text+0x77981): undefined reference to `rfkill_destroy'
net/built-in.o: In function `cfg80211_rfkill_sync_work':
>> core.c:(.text+0x788ad): undefined reference to `rfkill_blocked'
net/built-in.o: In function `cfg80211_dev_free':
>> (.text+0x78a7b): undefined reference to `rfkill_destroy'
net/built-in.o: In function `cfg80211_netdev_notifier_call':
>> core.c:(.text+0x79203): undefined reference to `rfkill_blocked'
net/built-in.o: In function `nl80211_start_p2p_device':These undefined sysbols are all satisfied if a "select RFKILL" is added to
Kconfig. This "fix" leads to another problem as follows:>> nl80211.c:(.text+0x9032e): undefined reference to `rfkill_blocked'
net/rfkill/Kconfig:4:error: recursive dependency detected!
net/rfkill/Kconfig:4: symbol RFKILL is selected by R8723AU
drivers/staging/rtl8723au/Kconfig:1: symbol R8723AU depends on USB
drivers/usb/Kconfig:41: symbol USB is selected by MOUSE_APPLETOUCH
drivers/input/mouse/Kconfig:162: symbol MOUSE_APPLETOUCH depends on INPUT
drivers/input/Kconfig:8: symbol INPUT is selected by ACPI_CMPC
drivers/platform/x86/Kconfig:635: symbol ACPI_CMPC depends on RFKILLTo avoid substituting one build error for another, I added a "depends on RFKILL".
My suspicion is that this particular error is caused by a kbuild bug, or that the
selection of INPUT by ACPI_CMPC is wrong. In any case, that will be solved separately.Reported-by: kbuild test robot
Signed-off-by: Larry Finger
Cc: Jes Sorensen
Cc: kbuild-all@01.org
Signed-off-by: Greg Kroah-Hartman -
Pull module updates from Rusty Russell:
"Nothing major: the stricter permissions checking for sysfs broke a
staging driver; fix included. Greg KH said he'd take the patch but
hadn't as the merge window opened, so it's included here to avoid
breaking build"* tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
staging: fix up speakup kobject mode
Use 'E' instead of 'X' for unsigned module taint flag.
VERIFY_OCTAL_PERMISSIONS: stricter checking for sysfs perms.
kallsyms: fix percpu vars on x86-64 with relocation.
kallsyms: generalize address range checking
module: LLVMLinux: Remove unused function warning from __param_check macro
Fix: module signature vs tracepoints: add new TAINT_UNSIGNED_MODULE
module: remove MODULE_GENERIC_TABLE
module: allow multiple calls to MODULE_DEVICE_TABLE() per module
module: use pr_cont
06 Apr, 2014
8 commits
-
Coverity CID 1196496: Unchecked return value (CHECKED_RETURN)
Calling "msi3101_ctrl_msg" without checking return value (as is done
elsewhere 8 out of 10 times).Reported-by:
Signed-off-by: Antti Palosaari
Signed-off-by: Mauro Carvalho Chehab -
Coverity CID 1196508: Unused pointer value (UNUSED_VALUE)
Pointer "bandwidth" returned by "v4l2_ctrl_find(&s->hdl, 10619148U)"
is overwritten.Reported-by:
Signed-off-by: Antti Palosaari
Signed-off-by: Mauro Carvalho Chehab -
Coverity CID 1196502: Unintentional integer overflow
(OVERFLOW_BEFORE_WIDEN)Potentially overflowing expression "(f_rf + f_if + f_if1) * lo_div"
with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit
arithmetic before being used in a context which expects an expression
of type "u64" (64 bits, unsigned). To avoid overflow, cast either
operand to "u64" before performing the multiplication.Reported-by:
Signed-off-by: Antti Palosaari
Signed-off-by: Mauro Carvalho Chehab -
The kbuild test robot got the following errors for i386-randconfig-c0-04060652:
ERROR: "wiphy_free" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "bridge_tunnel_header" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "ieee80211_frequency_to_channel" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_rx_mgmt" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "ieee80211_channel_to_frequency" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_mgmt_tx_status" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "rfc1042_header" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "__ieee80211_get_channel" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "wiphy_unregister" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_connect_result" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_michael_mic_failure" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_roamed" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_put_bss" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "wiphy_new" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "wiphy_register" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_inform_bss_width_frame" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_disconnected" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "ieee80211_amsdu_to_8023s" [drivers/staging/rtl8723au/r8723au.ko] undefined!
ERROR: "cfg80211_scan_done" [drivers/staging/rtl8723au/r8723au.ko] undefined!All of these are fixed by forcing the selection of CFG80211 in Kconfig.
Reported-by: kbuild test robot
Signed-off-by: Larry Finger
Cc: Jes Sorensen
Cc: kbuild-all@01.org
Signed-off-by: Greg Kroah-Hartman -
This commit also creates a TODO file.
Signed-off-by: Larry Finger
Cc: Jes Sorensen
Signed-off-by: Greg Kroah-Hartman -
These changes are fixes that were discovered late in the testing
cycle.Signed-off-by: Larry Finger
Cc: Jes Sorensen
Signed-off-by: Greg Kroah-Hartman -
The Realtek USB device RTL8723AU is found in Lenovo Yoga 13 tablets.
A driver for it has been available in a GitHub repo for several months.
This commit contains the fourth part of source files. The source
is arbitrarily split to avoid E-mail files that are too large.Jes Sorensen at RedHat has made many improvements to the vendor code,
and he has been doing the testing. I do not have access to this device.Signed-off-by: Larry Finger
Cc: Jes Sorensen
Signed-off-by: Greg Kroah-Hartman -
The Realtek USB device RTL8723AU is found in Lenovo Yoga 13 tablets.
A driver for it has been available in a GitHub repo for several months.
This commit contains the third part of source files. The source
is arbitrarily split to avoid E-mail files that are too large.Jes Sorensen at RedHat has made many improvements to the vendor code,
and he has been doing the testing. I do not have access to this device.Signed-off-by: Larry Finger
Cc: Jes Sorensen
Signed-off-by: Greg Kroah-Hartman
