From a7b594b4905828b3bfc36be39d48b5e07a23c8e1 Mon Sep 17 00:00:00 2001 From: Jonathan Corbet Date: Tue, 30 Apr 2013 22:42:33 +0200 Subject: [PATCH 1/8] dummy-irq: require the user to specify an IRQ number Make sure that we let the user know that without specifying IRQ#, dummy-irq driver is useless. Reported-by: Dave Jones Signed-off-by: Jonathan Corbet Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/misc/dummy-irq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/misc/dummy-irq.c b/drivers/misc/dummy-irq.c index 7014167e2c61..c37eeedfe215 100644 --- a/drivers/misc/dummy-irq.c +++ b/drivers/misc/dummy-irq.c @@ -19,7 +19,7 @@ #include #include -static int irq; +static int irq = -1; static irqreturn_t dummy_interrupt(int irq, void *dev_id) { @@ -36,6 +36,10 @@ static irqreturn_t dummy_interrupt(int irq, void *dev_id) static int __init dummy_irq_init(void) { + if (irq < 0) { + printk(KERN_ERR "dummy-irq: no IRQ given. Use irq=N\n"); + return -EIO; + } if (request_irq(irq, &dummy_interrupt, IRQF_SHARED, "dummy_irq", &irq)) { printk(KERN_ERR "dummy-irq: cannot register IRQ %d\n", irq); return -EIO; From 221ba151731133c8b0e1cdb9bfd2a45b3ba8764b Mon Sep 17 00:00:00 2001 From: "salina@us.ibm.com" Date: Tue, 7 May 2013 16:18:09 +0200 Subject: [PATCH 2/8] Char: lp, protect LPGETSTATUS with port_mutex The patch fixes a problem in the lp driver that can cause oopses as follows: process A: calls lp_write, which in turn calls parport_ieee1284_write_compat, and that invokes parport_wait_peripheral process B: meanwhile does an ioctl(LPGETSTATUS), which call lp_release_parport when done. This function will set physport->cad = NULL. process A: parport_wait_peripheral tries to dereference physport->cad and dies So, protect that code with the port_mutex in order to protect against simultaneous calls to lp_read/lp_write. Similar protection is probably required for ioctl(LPRESET)... This patch was done by IBM a while back and we (at suse) have that since at least 2004 in our repos. Let's make it upstream. Signed-off-by: okir@suse.de Signed-off-by: Jiri Slaby Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/char/lp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/char/lp.c b/drivers/char/lp.c index dafd9ac6428f..0913d79424d3 100644 --- a/drivers/char/lp.c +++ b/drivers/char/lp.c @@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd, return -EFAULT; break; case LPGETSTATUS: + if (mutex_lock_interruptible(&lp_table[minor].port_mutex)) + return -EINTR; lp_claim_parport_or_block (&lp_table[minor]); status = r_str(minor); lp_release_parport (&lp_table[minor]); + mutex_unlock(&lp_table[minor].port_mutex); if (copy_to_user(argp, &status, sizeof(int))) return -EFAULT; From 46e0cd87d90056383c8b5408fb297f18c1bdddf3 Mon Sep 17 00:00:00 2001 From: Tomas Winkler Date: Tue, 7 May 2013 21:12:31 +0300 Subject: [PATCH 3/8] mei: fix out of array access to me clients array The patch 9f81abdac362: "mei: implement mei_cl_connect function" from Jan 8, 2013, leads to the following static checker warning: "drivers/misc/mei/main.c:522 mei_ioctl_connect_client() warn: check 'dev->me_clients[]' for negative offsets (-2)" Reported-by: Dan Carpenter Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/main.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c index 7c44c8dbae42..053139f61086 100644 --- a/drivers/misc/mei/main.c +++ b/drivers/misc/mei/main.c @@ -489,11 +489,16 @@ static int mei_ioctl_connect_client(struct file *file, /* find ME client we're trying to connect to */ i = mei_me_cl_by_uuid(dev, &data->in_client_uuid); - if (i >= 0 && !dev->me_clients[i].props.fixed_address) { - cl->me_client_id = dev->me_clients[i].client_id; - cl->state = MEI_FILE_CONNECTING; + if (i < 0 || dev->me_clients[i].props.fixed_address) { + dev_dbg(&dev->pdev->dev, "Cannot connect to FW Client UUID = %pUl\n", + &data->in_client_uuid); + rets = -ENODEV; + goto end; } + cl->me_client_id = dev->me_clients[i].client_id; + cl->state = MEI_FILE_CONNECTING; + dev_dbg(&dev->pdev->dev, "Connect to FW Client ID = %d\n", cl->me_client_id); dev_dbg(&dev->pdev->dev, "FW Client - Protocol Version = %d\n", @@ -527,11 +532,6 @@ static int mei_ioctl_connect_client(struct file *file, goto end; } - if (cl->state != MEI_FILE_CONNECTING) { - rets = -ENODEV; - goto end; - } - /* prepare the output buffer */ client = &data->out_client_properties; @@ -543,7 +543,6 @@ static int mei_ioctl_connect_client(struct file *file, rets = mei_cl_connect(cl, file); end: - dev_dbg(&dev->pdev->dev, "free connect cb memory."); return rets; } From d2242a384355773c711a936522bcfae0f35f8c2a Mon Sep 17 00:00:00 2001 From: "K. Y. Srinivasan" Date: Fri, 17 May 2013 09:30:35 -0700 Subject: [PATCH 4/8] Drivers: hv: Fix a bug in get_vp_index() Linux' notion of cpuid is different from the Host's notion of CPUID. In the call to bind the channel interrupts, we should use the host's notion of CPU Ids. Fix this bug. Signed-off-by: K. Y. Srinivasan Cc: Stable (V3.9) Signed-off-by: Greg Kroah-Hartman --- drivers/hv/channel_mgmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c index bad8128b283a..21ef68934a20 100644 --- a/drivers/hv/channel_mgmt.c +++ b/drivers/hv/channel_mgmt.c @@ -329,7 +329,7 @@ static u32 get_vp_index(uuid_le *type_guid) return 0; } cur_cpu = (++next_vp % max_cpus); - return cur_cpu; + return hv_context.vp_index[cur_cpu]; } /* From bbedf2fc207bbd89c109123caee7cf0497030762 Mon Sep 17 00:00:00 2001 From: Samuel Ortiz Date: Tue, 21 May 2013 18:52:09 +0200 Subject: [PATCH 5/8] mei: bus: Reset event_cb when disabling a device After cancelling all reads from the disable hook, we need to reset the event_cb pointer as well or else we won't be able to set a new one up when re-enabling the device. Acked-by: Tomas Winkler Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/bus.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index 1e935eacaa7f..9ecd49a7be1b 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -496,6 +496,8 @@ int mei_cl_disable_device(struct mei_cl_device *device) } } + device->event_cb = NULL; + mutex_unlock(&dev->device_lock); if (!device->ops || !device->ops->disable) From a4162747b79683b163d54cfd9c9319d9a8bad111 Mon Sep 17 00:00:00 2001 From: Haiyang Zhang Date: Thu, 9 May 2013 14:34:55 -0700 Subject: [PATCH 6/8] MAINTAINERS: update Hyper-V file list Signed-off-by: Haiyang Zhang Reviewed-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman --- MAINTAINERS | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 3d7782b9f90d..8f190f5532ee 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3865,9 +3865,16 @@ M: K. Y. Srinivasan M: Haiyang Zhang L: devel@linuxdriverproject.org S: Maintained -F: drivers/hv/ +F: arch/x86/include/asm/mshyperv.h +F: arch/x86/include/uapi/asm/hyperv.h +F: arch/x86/kernel/cpu/mshyperv.c F: drivers/hid/hid-hyperv.c +F: drivers/hv/ F: drivers/net/hyperv/ +F: drivers/scsi/storvsc_drv.c +F: drivers/video/hyperv_fb.c +F: include/linux/hyperv.h +F: tools/hv/ I2C OVER PARALLEL PORT M: Jean Delvare From 89fb9e7c3423662f4969a1e8ef0f5d44835d2381 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Thu, 9 May 2013 23:04:51 +0200 Subject: [PATCH 7/8] uio: UIO_DMEM_GENIRQ should depend on HAS_DMA If NO_DMA=y: drivers/built-in.o: In function `uio_dmem_genirq_release': drivers/uio/uio_dmem_genirq.c:95: undefined reference to `dma_free_coherent' drivers/built-in.o: In function `uio_dmem_genirq_open': drivers/uio/uio_dmem_genirq.c:61: undefined reference to `dma_alloc_coherent' Signed-off-by: Geert Uytterhoeven Cc: Hans J. Koch Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/uio/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/uio/Kconfig b/drivers/uio/Kconfig index e92eeaf251fe..5295be0342c1 100644 --- a/drivers/uio/Kconfig +++ b/drivers/uio/Kconfig @@ -45,6 +45,7 @@ config UIO_PDRV_GENIRQ config UIO_DMEM_GENIRQ tristate "Userspace platform driver with generic irq and dynamic memory" + depends on HAS_DMA help Platform driver for Userspace I/O devices, including generic interrupt handling code. Shared interrupts are not supported. From b5325a02aa84c794cf520d6d68cae4b150988a32 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Fri, 10 May 2013 15:40:13 -0700 Subject: [PATCH 8/8] ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port tty_port_init() zeroes out the tty port, which means that we have to set the ops pointer /after/, not before this call. Otherwise, tty_port_open will crash when it tries to deref ops, which is now a NULL pointer. Signed-off-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman --- drivers/char/ttyprintk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c index 4945bd3d18d0..d5d2e4a985aa 100644 --- a/drivers/char/ttyprintk.c +++ b/drivers/char/ttyprintk.c @@ -179,7 +179,6 @@ static int __init ttyprintk_init(void) { int ret = -ENOMEM; - tpk_port.port.ops = &null_ops; mutex_init(&tpk_port.port_write_mutex); ttyprintk_driver = tty_alloc_driver(1, @@ -190,6 +189,7 @@ static int __init ttyprintk_init(void) return PTR_ERR(ttyprintk_driver); tty_port_init(&tpk_port.port); + tpk_port.port.ops = &null_ops; ttyprintk_driver->driver_name = "ttyprintk"; ttyprintk_driver->name = "ttyprintk";