Commit graph

448532 commits

Author SHA1 Message Date
Dan Carpenter
bc802a2742 staging: frontier: fix some indenting
There were a couple lines which were not indented far enough and it was
confusing.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:44:53 -04:00
Dan Carpenter
50b14a9e16 staging: r8188eu: indent for loop body
The for loop body wasn't indented so it upset my static checker.  Also
I removed an obsolete comment on the same line.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:44:53 -04:00
Dan Carpenter
d985a5840d staging: r8188eu: cleanup by using "len" consistently
"*(p + 1)" and "len" are the same thing.  For reviewers who don't know
that, then this code is worrying because we cap "len", but pass
"*(p + 1)" to memcpy().

I have changed the code to use "len" throughout.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:44:52 -04:00
Sarath Lakshman
472603137a staging: nokia_h4p: Fix a coding style problem
Fold a line to make it less than 80 characters

Signed-off-by: Sarath Lakshman <sarathlakshman@slynux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:44:52 -04:00
Daniele Forsi
6ed07d45d0 USB: Nokia 5300 should be treated as unusual dev
Signed-off-by: Daniele Forsi <dforsi@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:41:07 -04:00
Victor A. Santos
f0ef5d4179 USB: Nokia 305 should be treated as unusual dev
Signed-off-by: Victor A. Santos <victoraur.santos@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:41:07 -04:00
Fredrick John Berchmans
80db2734ac staging: lustre use kernel socket sockopt apis
Change old way of ops->setsockopt or ops->getsockopt in kernel
to kernel_setsockopt or kernel_getsockopt.

Signed-off-by: Fredrick John Berchmans <fredrickprashanth@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:38:09 -04:00
Geert Uytterhoeven
1d316792ac staging/lustre/llite: Fix unused variable warning if !CONFIG_FS_POSIX_ACL
If CONFIG_FS_POSIX_ACL=n:

drivers/staging/lustre/lustre/llite/xattr.c: In function 'll_setxattr_common':
drivers/staging/lustre/lustre/llite/xattr.c:115:27: warning: unused variable 'rce' [-Wunused-variable]

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:38:08 -04:00
Geert Uytterhoeven
b41a1fe067 staging: lustre: Use %zd to format ssize_t
drivers/staging/lustre/lustre/llite/rw26.c: In function 'll_direct_IO_26':
drivers/staging/lustre/lustre/llite/rw26.c:383:2: warning: format '%lu' expects argument of type 'long unsigned int', but argument 6 has type 'ssize_t' [-Wformat]
drivers/staging/lustre/lustre/llite/rw26.c:383:2: warning: format '%lu' expects argument of type 'long unsigned int', but argument 10 has type 'ssize_t' [-Wformat]

Join the quoted string split across lines to fix a checkpatch warning while
we're at it.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:38:08 -04:00
Geert Uytterhoeven
dab3aad369 staging/lustre/libcfs: Fix build errors for !CONFIG_SMP
When CONFIG_SMP=n:

drivers/staging/lustre/include/linux/libcfs/linux/linux-mem.h:58:31: fatal error: libcfs/libcfs_cpu.h: No such file or directory

drivers/staging/lustre/lustre/libcfs/libcfs_cpu.c:78:1: error: redefinition of 'cfs_cpt_table_print'
drivers/staging/lustre/include/linux/libcfs/libcfs_cpu.h:109:1: note: previous definition of 'cfs_cpt_table_print' was here

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:38:08 -04:00
Dan Carpenter
ee02eb4ae4 staging: lustre: integer overflow in obd_ioctl_is_invalid()
The obd_ioctl_getdata() function caps "data->ioc_len" at
OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check
that the other values inside data are valid.

There are several lengths inside data but when they are added together
they must not be larger than "data->ioc_len".  The checks against
"(data->ioc_inllen1 > (1<<30))" are supposed to ensure that the addition
does not have an integer overflow.  But "(1<<30) * 4" actually can
overflow 32 bits, so the checks are insufficient.

I have changed it to "> OBD_MAX_IOCTL_BUFFER" instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:37:42 -04:00
Oleg Drokin
d36175e9d2 staging/lustre/lnet: fix potential null pointer dereference
Pointer 'ni' checked for NULL at line 1569 may be passed to
function and may be dereferenced there by passing argument 1 to
function 'lnet_ni_notify_locked' at line 1621.
found by Klocwork Insight tool

Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
CC: Dmitry Eremin <dmitry.eremin@intel.com>
CC: Liang Zhen <liang.zhen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:35:21 -04:00
Dmitry Eremin
109dae8dab staging/lustre/lnet: fix potential null pointer dereference in kiblnd_rejected
Null pointer 'cp' that comes from line 2544 may be dereferenced
at line 2618.
found by Klocwork Insight tool

Signed-off-by: Dmitry Eremin <dmitry.eremin@intel.com>
Reviewed-on: http://review.whamcloud.com/9386
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4629
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Isaac Huang <he.huang@intel.com>
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:35:21 -04:00
Dmitry Eremin
1ae2bdb21e staging/lustre/lnet: remove unused variable in lnet_destroy_remote_nets_table
Local variable 'hash' is never used
found by Klocwork Insight tool

Signed-off-by: Dmitry Eremin <dmitry.eremin@intel.com>
Reviewed-on: http://review.whamcloud.com/9386
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4629
Reviewed-by: John L. Hammond <john.hammond@intel.com>
Reviewed-by: Isaac Huang <he.huang@intel.com>
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:35:20 -04:00
Oleg Drokin
f39489e269 staging/lustre/lnet: Drop useless LASSERT in ksocknal_select_ips
It should never be NULL because our interface list is up to date,
and even if it does, we'll just crash anyway so we are no better off.

Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:35:20 -04:00
Oleg Drokin
76133e66b1 staging/lustre: Replace jobid acquiring with per node setting
Insted of meddling directly in process environment variables
(which is also not possible on certain platforms due to not exported
symbols), create jobid_name proc file to represent this info
(to be filled by job scheduler epilogue).

Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
CC: Andreas Dilger <andreas.dilger@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:33:15 -04:00
Vitaly Osipov
7bc3dfa37b staging: lustre: check for integer overflow
In ll_ioctl_fiemap(), a user-supplied value is used to calculate a
length of a buffer which is later allocated with user data.

Signed-off-by: Vitaly Osipov <vitaly.osipov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:33:15 -04:00
Rob Herring
4f0638100f misc: arm-charlcd: add DT probe support
Add the DT match table to enable DT based probe matching.

Signed-off-by: Rob Herring <robh@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:26:25 -04:00
Rob Herring
a48839509a dt/bindings: add binding for ARM Versatile character LCD
Add binding doc for Versatile platforms character LCD controller
interface.

Signed-off-by: Rob Herring <robh@kernel.org>
Cc: Pawel Moll <pawel.moll@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Ian Campbell <ijc+devicetree@hellion.org.uk>
Cc: Kumar Gala <galak@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:26:25 -04:00
Sebastien Bourdelin
403007457d misc: (ds1682) replace obsolete simple_strtoull() with kstrtoull()
simple_strtoull() is obsolete, use the newer kstrtoull() instead.

Signed-off-by: Sebastien Bourdelin <sebastien.bourdelin@savoirfairelinux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:26:24 -04:00
Masanari Iida
32d9dbe379 misc: genwqe: Fix format string mismatch in card_debugfs.c
Fix two format string mismatch in genwqe_init_debugfs()

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:25:17 -04:00
Jean Delvare
fc1a5dbe49 misc: Add hardware dependencies to Atmel drivers
According to the driver descriptions, the atmel_pwm and atmel-ssc
drivers are only useful on Atmel AT32 and AT91 systems. So add
hardware dependencies to these drivers to hide them on other systems.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:25:17 -04:00
K. Y. Srinivasan
ae339336dc Drivers: hv: balloon: Ensure pressure reports are posted regularly
The current code posts periodic memory pressure status from a dedicated thread.
Under some conditions, especially when we are releasing a lot of memory into
the guest, we may not send timely pressure reports back to the host. Fix this
issue by reporting pressure in all contexts that can be active in this driver.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:25:17 -04:00
Tobias Klauser
24b8a406bf hv: Remove unnecessary comparison of unsigned against 0
pfncount is of type u32 and thus can never be smaller than 0.

Found by the coverity scanner, CID 143213.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:24:26 -04:00
K. Y. Srinivasan
3a28fa35d6 Drivers: hv: vmbus: Implement per-CPU mapping of relid to channel
Currently the mapping of the relID to channel is done under the protection of a
single spin lock. Starting with ws2012, each channel is bound to a specific VCPU
in the guest. Use this binding to eliminate the spin lock by setting up
per-cpu state for mapping relId to the channel.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:24:26 -04:00
K. Y. Srinivasan
d3ba720dd5 Drivers: hv: Eliminate the channel spinlock in the callback path
By ensuring that we set the callback handler to NULL in the channel close
path on the same CPU that the channel is bound to, we can eliminate this lock
acquisition and release in a performance critical path.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:24:26 -04:00
Alexander Usyskin
e4d8270e60 mei: set connecting state just upon connection request is sent to the fw
Adding power gating introduced new waiting state for client also during
connection attempt, a connection request can be queued for later either due
device is power gated or due to other on going connection.
We setting client connection state before start of full connect procedure so
in both cased the client state will be MEI_FILE_CONNECTING
which create interlock between the two connection attempts, both
detecting that another connection is in progress.

The interlock is resolved by moving client to connecting state
only upon connection request transmission, so the  first
cb in queue can be processed.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:21:56 -04:00
Alexander Usyskin
86113500c0 mei: make return values consistent across the driver
Follow-up for bits missed in
commit 7ca96aa278
mei: make return values consistent across the driver

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:21:23 -04:00
Alexander Usyskin
04dd366195 mei: extract fw status registers
Fetch FW status registers, as they are important in
in understanding of FW reset reasons

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:21:22 -04:00
Tomas Winkler
61a1aea7c7 mei: me: bump hbm version to 1.1 to support power gating
Communicate hbm version 1.1 to firmware to tell that we
now support power gating isolation protocol

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:25 -04:00
Alexander Usyskin
d2d56faeba mei: txe: use runtime PG pm domain for non wakeable devices
For non wakeable devices we can't use pci runtime framework
as we are not able to wakeup from D3 states.
Instead we create new pg runtime domain that only drives TXE power
gating protocol to reduce the power consumption.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:25 -04:00
Tomas Winkler
e13fa90ce4 mei: me: use runtime PG pm domain for non wakeable devices
For non wakeable devices we can't use pci runtime framework
as we are not able to wakeup from D3 states.
Instead we create new pg runtime domain that only drives ME power
gating protocol to reduce the power consumption.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:25 -04:00
Tomas Winkler
04bb139a07 mei: use runtime pm in write and read flow
Take rpm token on operation start to initiate rpm resume if needed.
Mark last busy time, release token and advice rpm framework
to try to autosuspend on operation end.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:24 -04:00
Alexander Usyskin
cfe5ab8563 mei: txe: add runtime pm framework
Add runtime pm framework for TXE devices.
The runtime pm handlers are used to run
txe power gating isolation protocol.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:24 -04:00
Tomas Winkler
180ea05bce mei: me: add runtime pm framework
Add runtime pm framework for ME devices.
The runtime pm handlers are used to run
me power gating isolation protocol

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:24 -04:00
Tomas Winkler
a532bbedc8 mei: add function to check write queues
The driver needs to check whether the write
queue idle before entering power gating

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:24 -04:00
Tomas Winkler
ba9cdd0e1a mei: me: add pg exit and entry flow commands
For power gating entry we write hbm pg entry request command and
then we set pg register
For power gating exit we clear pg register and wait for exit request
hbm command.

Exit power gating request might also be initiated by the firmware
w/o explicit driver request

The power gating state is tracked by pg_state member of me_hw

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:24 -04:00
Tomas Winkler
964a2331e9 mei: expose hardware power gating state to mei layer
Since the runtime pm and the internal power gating
cannot be in complete sync in regards to I/O
operations, we need to expose the device
hardware internal power gating state to mei layer

2. We add pg_state handler that translate the hw
internal pg state to mei layer

2. We add power gating event variable to keep
power track of power gating transitions

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Reviewed-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:24 -04:00
Tomas Winkler
ee7e5afd2c mei: condition PGI support on HW and HBM version
Enable power gating isolation only if hw and fw support it.
This is indicated by ME_PGIC_HRA bit in ME_CSR_HA register
and on HBM protocol version.

The information is exported to MEI layer through
new pg_is_enabled hw op.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:23 -04:00
Tomas Winkler
b16c35716b mei: me: add power gating isolation register write wrappers
Add entry and exit power gating isolation register
write handler.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:23 -04:00
Tomas Winkler
ad4d355b4b mei: me: introduce power gating registers
LPT devices have internal power gating handled
through registers and hbm calls

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:23 -04:00
Tomas Winkler
4fcbc99b75 mei: implement power gating isolation hbm layer
Add send message functions and receive dispatch stubs
for power gating isolation hbm protocol.

The protocol consist of requests for entering and exiting
the power gating isolation state and their responses.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 19:20:23 -04:00
Rob Herring
e26f1db9b8 tty/serial: fix generic earlycon option parsing
Commit 9aac588759 (tty/serial: add generic serial earlycon) moved
console option parsing from 8250_early.c and converted to kstrto*
functions from simple_strtoul along the way. However, kstrto* functions
are not equivalent in that they do not allow non-convertible characters
at the end such as "115200n8". Fix this by changing back to
simple_strtoul and ignore what checkpatch.pl says.

Reported-by: Yinghai Lu <yinghai@kernel.org>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: linux-serial@vger.kernel.org

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:16:38 -04:00
Rob Herring
fe1cf8af91 tty/serial: add back missing setup_early_serial8250_console
Commit d2fd6810a8 (tty/serial: convert 8250 to generic earlycon)
removed setup_early_serial8250_console, but there are still 2 callers
in:

arch/mips/mti-malta/malta-init.c
drivers/firmware/pcdp.c

Add back the function implemented as a wrapper to setup_earlycon.

Reported-by: Yinghai Lu <yinghai@kernel.org>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: linux-serial@vger.kernel.org

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:16:38 -04:00
Peter Hurley
62a0d8d7c2 tty: Fix lockless tty buffer race
Commit 6a20dbd6ca,
"tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
correctly identifies an unsafe race condition between
__tty_buffer_request_room() and flush_to_ldisc(), where the consumer
flush_to_ldisc() prematurely advances the head before consuming the
last of the data committed. For example:

           CPU 0                     |            CPU 1
__tty_buffer_request_room            | flush_to_ldisc
  ...                                |   ...
                                     |   count = head->commit - head->read
  n = tty_buffer_alloc()             |
  b->commit = b->used                |
  b->next = n                        |
                                     |   if (!count)                /* T */
                                     |     if (head->next == NULL)  /* F */
                                     |     buf->head = head->next

In this case, buf->head has been advanced but head->commit may have
been updated with a new value.

Instead of reintroducing an unnecessary lock, fix the race locklessly.
Read the commit-next pair in the reverse order of writing, which guarantees
the commit value read is the latest value written if the head is
advancing.

Reported-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
Cc: <stable@vger.kernel.org> # 3.12.x+
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:14:28 -04:00
Peter Hurley
5fbf1a65dd Revert "tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
This reverts commit 6a20dbd6ca.

Although the commit correctly identifies an unsafe race condition
between __tty_buffer_request_room() and flush_to_ldisc(), the commit
fixes the race with an unnecessary spinlock in a lockless algorithm.

The follow-on commit, "tty: Fix lockless tty buffer race" fixes
the race locklessly.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:14:28 -04:00
Tomoki Sekiyama
501fed45b7 drivers/tty/hvc: don't free hvc_console_setup after init
When 'console=hvc0' is specified to the kernel parameter in x86 KVM guest,
hvc console is setup within a kthread. However, that will cause SEGV
and the boot will fail when the driver is builtin to the kernel,
because currently hvc_console_setup() is annotated with '__init'. This
patch removes '__init' to boot the guest successfully with 'console=hvc0'.

Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:14:28 -04:00
Peter Hurley
4291086b1f n_tty: Fix n_tty_write crash when echoing in raw mode
The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:13:05 -04:00
Michael Welling
b790f210fe tty: serial: 8250_core.c Bug fix for Exar chips.
The sleep function was updated to put the serial port to sleep only when necessary.
This appears to resolve the errant behavior of the driver as described in
Kernel Bug 61961 – "My Exar Corp. XR17C/D152 Dual PCI UART modem does not
work with 3.8.0".

Signed-off-by: Michael Welling <mwelling@ieee.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:13:05 -04:00
Nikita Yushchenko
d183c81929 fsl-usb: do not test for PHY_CLK_VALID bit on controller version 1.6
Per reference manuals of Freescale P1020 and P2020 SoCs, USB controller
present in these SoCs has bit 17 of USBx_CONTROL register marked as
Reserved - there is no PHY_CLK_VALID bit there.

Testing for this bit in ehci_fsl_setup_phy() behaves differently on two
P1020RDB boards available here - on one board test passes and fsl-usb
init succeeds, but on other board test fails, causing fsl-usb init to
fail.

This patch changes ehci_fsl_setup_phy() not to test PHY_CLK_VALID on
controller version 1.6 that (per manual) does not have this bit.

Signed-off-by: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:04:28 -04:00