aboutsummaryrefslogtreecommitdiff
path: root/drivers
Commit message (Collapse)AuthorAgeFilesLines
...
* smc91x: avoid self-comparison warningArnd Bergmann2018-11-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | commit e3ebd894f084255fde19116955ba7054858ff5d6 upstream. The smc91x driver defines a macro that compares its argument to itself, apparently to get a true result while using its argument to avoid a warning about unused local variables. Unfortunately, this triggers a warning with gcc-6, as the comparison is obviously useless: drivers/net/ethernet/smsc/smc91x.c: In function 'smc_hardware_send_pkt': drivers/net/ethernet/smsc/smc91x.c:563:14: error: self-comparison always evaluates to true [-Werror=tautological-compare] if (!smc_special_trylock(&lp->lock, flags)) { This replaces the macro with another one that behaves similarly, with a cast to (void) to ensure the argument is used, and using a literal 'true' as its value. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mtd: blkdevs: fix switch-bool compilation warningTomer Barletz2018-11-301-6/+2
| | | | | | | | | | | commit cc7fce80229067890365c1ee196be5d304d36dea upstream. With gcc 5.1 I get: warning: switch condition has boolean value [-Wswitch-bool] Signed-off-by: Tomer Barletz <barletz@gmail.com> Signed-off-by: Brian Norris <computersforpeace@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Revert "GCC: Fix up for gcc 5+"Moyster2018-11-3013-15/+2
| | | | This reverts commit ff505baaf412985af758d5820cd620ed9f1a7e05.
* Replace <asm/uaccess.h> with <linux/uaccess.h> globallyLinus Torvalds2018-11-29809-826/+826
| | | | | | | | | | | | | | This was entirely automated, using the script by Al: PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*<asm/uaccess.h>' sed -i -e "s!$PATT!#include <linux/uaccess.h>!" \ $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h) to do the replacement at the end of the merge window. Requested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Moyster <oysterized@gmail.com>
* drivers: input: mouse: Use "static inline" instead of "inline" in "lifebook.h"demicro2018-11-291-3/+3
|
* net: core: move mac_pton() to lib/net_utils.cAndy Shevchenko2018-11-292-0/+2
| | | | | | | | | | | | | Since we have at least one user of this function outside of CONFIG_NET scope, we have to provide this function independently. The proposed solution is to move it under lib/net_utils.c with corresponding configuration variable and select wherever it is needed. Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reported-by: Arnd Bergmann <arnd@arndb.de> Acked-by: David S. Miller <davem@davemloft.net> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* USB: core: only clean up what we allocatedAndrey Konovalov2018-11-291-3/+6
| | | | | | | | | | | | | | | When cleaning up the configurations, make sure we only free the number of configurations and interfaces that we could have allocated. Change-Id: I07a2ddd088264030544284ad9680cd6d2b538d21 Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Git-commit: 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org> Signed-off-by: Dheeraj Kumar Chaudhary <dheech@codeaurora.org> Signed-off-by: Richard JK <rjk@codeaurora.org>
* driver: ltr559 fix defineMoyster2018-11-291-2/+2
|
* drivers: meizu: fix meizu-sensors.c (warning: type qualifiers ignored)Moyster2018-11-291-1/+1
|
* drivers: meizu: turn off meizu-sensors.c DEBUG flag (no more stupid ↵Moyster2018-11-291-2/+2
| | | | pr_*/dev_* redefine warnings)
* GCC: Fix up for gcc 5+mydongistiny2018-11-2913-2/+15
| | | | | Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: Mister Oyster <oysterized@gmail.com>
* ANDROID: HID: debug: check length in hid_debug_events_read() before ↵Daniel Rosenberg2018-11-291-1/+7
| | | | | | | | | | | copy_to_user() If our length is greater than the size of the buffer, we overflow the buffer Change-Id: I113a1955a2bac83c83084d5cd28d886175673219 Bug: 71361580 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.Martijn Coenen2018-11-291-0/+55
| | | | | | | | | | | | | | This allows the context manager to retrieve information about nodes that it holds a reference to, such as the current number of references to those nodes. Such information can for example be used to determine whether the servicemanager is the only process holding a reference to a node. This information can then be passed on to the process holding the node, which can in turn decide whether it wants to shut down to reduce resource usage. Signed-off-by: Martijn Coenen <maco@android.com>
* UPSTREAM: binder: replace "%p" with "%pK"Todd Kjos2018-11-291-4/+4
| | | | | | | | | | | | The format specifier "%p" can leak kernel addresses. Use "%pK" instead. There were 4 remaining cases in binder.c. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8ca86f1639ec5890d400fff9211aca22d0a392eb) Change-Id: I309241853c53bcdfa65c17cb05876e786597afdd
* UPSTREAM: binder: free memory on errorChristian Brauner2018-11-291-2/+6
| | | | | | | | | | | | | On binder_init() the devices string is duplicated and smashed into individual device names which are passed along. However, the original duplicated string wasn't freed in case binder_init() failed. Let's free it on error. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 22eb9476b5d80a393ac0ba235c42bccc90b82c76) Change-Id: I78fdeecf70c31ba4248b3de17130f97546288f84
* UPSTREAM: ANDROID: binder: change down_write to down_readMinchan Kim2018-11-292-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | binder_update_page_range needs down_write of mmap_sem because vm_insert_page need to change vma->vm_flags to VM_MIXEDMAP unless it is set. However, when I profile binder working, it seems every binder buffers should be mapped in advance by binder_mmap. It means we could set VM_MIXEDMAP in binder_mmap time which is already hold a mmap_sem as down_write so binder_update_page_range doesn't need to hold a mmap_sem as down_write. Please use proper API down_read. It would help mmap_sem contention problem as well as fixing down_write abuse. Ganesh Mahendran tested app launching and binder throughput test and he said he couldn't find any problem and I did binder latency test per Greg KH request(Thanks Martijn to teach me how I can do) I cannot find any problem, too. Cc: Ganesh Mahendran <opensource.ganesh@gmail.com> Cc: Joe Perches <joe@perches.com> Cc: Arve Hjønnevåg <arve@android.com> Cc: Todd Kjos <tkjos@google.com> Reviewed-by: Martijn Coenen <maco@android.com> Signed-off-by: Minchan Kim <minchan@kernel.org> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 720c241924046aff83f5f2323232f34a30a4c281) Change-Id: I8358ceaaab4030f7122c95308dcad59557cad411
* UPSTREAM: ANDROID: binder: correct the cmd print for BINDER_WORK_RETURN_ERROR宋金时2018-11-291-0/+1
| | | | | | | | | | | | | | | When to execute binder_stat_br the e->cmd has been modifying as BR_OK instead of the original return error cmd, in fact we want to know the original return error, such as BR_DEAD_REPLY or BR_FAILED_REPLY, etc. instead of always BR_OK, in order to avoid the value of the e->cmd is always BR_OK, so we need assign the value of the e->cmd to cmd before e->cmd = BR_OK. Signed-off-by: songjinshi <songjinshi@xiaomi.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 838d5565669aa5bb7deb605684a5970d51d5eaf6) Change-Id: I425b32c5419a491c6b9ceee7c00dde6513e0421d
* UPSTREAM: ANDROID: binder: remove 32-bit binder interface.Martijn Coenen2018-11-292-18/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New devices launching with Android P need to use the 64-bit binder interface, even on 32-bit SoCs [0]. This change removes the Kconfig option to select the 32-bit binder interface. We don't think this will affect existing userspace for the following reasons: 1) The latest Android common tree is 4.14, so we don't believe any Android devices are on kernels >4.14. 2) Android devices launch on an LTS release and stick with it, so we wouldn't expect devices running on <= 4.14 now to upgrade to 4.17 or later. But even if they did, they'd rebuild the world (kernel + userspace) anyway. 3) Other userspaces like 'anbox' are already using the 64-bit interface. Note that this change doesn't remove the 32-bit UAPI itself; the reason for that is that Android userspace always uses the latest UAPI headers from upstream, and userspace retains 32-bit support for devices that are upgrading. This will be removed as well in 2-3 years, at which point we can remove the code from the UAPI as well. Finally, this change introduces build errors on archs where 64-bit get_user/put_user is not supported, so make binder unavailable on m68k (which wouldn't want it anyway). [0]: https://android-review.googlesource.com/c/platform/build/+/595193 Signed-off-by: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1190b4e38f97023154e6b3bef61b251aa5f970d0) Change-Id: I73dadf1d7b45a42bb18be5d5d3f5c090e61866de
* UPSTREAM: ANDROID: binder: re-order some conditionsDan Carpenter2018-11-291-2/+2
| | | | | | | | | | | | | | | | It doesn't make any difference to runtime but I've switched these two checks to make my static checker happy. The problem is that "buffer->data_size" is user controlled and if it's less than "sizeo(*hdr)" then that means "offset" can be more than "buffer->data_size". It's just cleaner to check it in the other order. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 361f2ddbb0c9f9b4f336025a7bd0212cea4a34f0) Change-Id: I098d525ba63d125caa9840e6e1d5004bf70edc3c
* UPSTREAM: android: binder: use VM_ALLOC to get vm areaGanesh Mahendran2018-11-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VM_IOREMAP is used to access hardware through a mechanism called I/O mapped memory. Android binder is a IPC machanism which will not access I/O memory. And VM_IOREMAP has alignment requiement which may not needed in binder. __get_vm_area_node() { ... if (flags & VM_IOREMAP) align = 1ul << clamp_t(int, fls_long(size), PAGE_SHIFT, IOREMAP_MAX_ORDER); ... } This patch will save some kernel vm area, especially for 32bit os. In 32bit OS, kernel vm area is only 240MB. We may got below error when launching a app: <3>[ 4482.440053] binder_alloc: binder_alloc_mmap_handler: 15728 8ce67000-8cf65000 get_vm_area failed -12 <3>[ 4483.218817] binder_alloc: binder_alloc_mmap_handler: 15745 8ce67000-8cf65000 get_vm_area failed -12 Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com> Acked-by: Martijn Coenen <maco@android.com> Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> ---- V3: update comments V2: update comments Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit aac6830ec1cb681544212838911cdc57f2638216) Change-Id: Ide458abc6a4d3ec07973733aa223c4247eef20e6
* UPSTREAM: android: binder: Use true and false for boolean valuesGustavo A. R. Silva2018-11-291-3/+3
| | | | | | | | | | | | | | | Assign true or false to boolean variables instead of an integer value. This issue was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Cc: Todd Kjos <tkjos@android.com> Cc: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 197410ad884eb18b31d48e9d8e64cb5a9e326f2f) Change-Id: I30bed831d6b6ff2e9e3e521ccc5d6836f0b30944 Signed-off-by: Moyster <oysterized@gmail.com>
* UPSTREAM: android: binder: Use octal permissionsHarsh Shandilya2018-11-291-8/+8
| | | | | | | | | | | | | | | | | | checkpatch warns against the use of symbolic permissions, this patch migrates all symbolic permissions in the binder driver to octal permissions. Test: debugfs nodes created by binder have the same unix permissions prior to and after this patch was applied. Signed-off-by: Harsh Shandilya <harsh@prjkt.io> Cc: "Arve Hjønnevåg" <arve@android.com> Cc: Todd Kjos <tkjos@android.com> Cc: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 21d02ddf716669e182a13b69b4dd928cf8ef5e0f) Change-Id: I8152fe280ead1d04d89593e813a722f9eb5def27
* UPSTREAM: android: binder: Prefer __func__ to using hardcoded function nameElad Wexler2018-11-291-2/+2
| | | | | | | | | | Coding style fixup Signed-off-by: Elad Wexler <elad.wexler@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 00c41cddebde8d1a635bf81a7b255b7e56fd0d15) Change-Id: I795e2a9f525c4a8df5cd0a81842a88529ba54f21
* UPSTREAM: ANDROID: binder: make binder_alloc_new_buf_locked static and ↵Xiongwei Song2018-11-291-5/+6
| | | | | | | | | | | | | | | | | | | indent its arguments The function binder_alloc_new_buf_locked() is only used in this file, so make it static. Also clean up sparse warning: drivers/android/binder_alloc.c:330:23: warning: no previous prototype for ‘binder_alloc_new_buf_locked’ [-Wmissing-prototypes] In addition, the line of the function name exceeds 80 characters when add static for this function, hence indent its arguments anew. Signed-off-by: Xiongwei Song <sxwjean@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 3f827245463a57f5ef64a665e1ca64eed0da00a5) Change-Id: I6b379df815d30f9b3e9f1dd50334375123b25bbc
* UPSTREAM: ANDROID: binder: prevent transactions into own process.Martijn Coenen2018-11-291-0/+8
| | | | | | | | | | | | | This can't happen with normal nodes (because you can't get a ref to a node you own), but it could happen with the context manager; to make the behavior consistent with regular nodes, reject transactions into the context manager by the process owning it. Reported-by: syzbot+09e05aba06723a94d43d@syzkaller.appspotmail.com Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 7aa135fcf26377f92dc0680a57566b4c7f3e281b)
* UPSTREAM: ANDROID: binder: remove WARN() for redundant txn errorTodd Kjos2018-11-291-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | binder_send_failed_reply() is called when a synchronous transaction fails. It reports an error to the thread that is waiting for the completion. Given that the transaction is synchronous, there should never be more than 1 error response to that thread -- this was being asserted with a WARN(). However, when exercising the driver with syzbot tests, cases were observed where multiple "synchronous" requests were sent without waiting for responses, so it is possible that multiple errors would be reported to the thread. This testing was conducted with panic_on_warn set which forced the crash. This is easily reproduced by sending back-to-back "synchronous" transactions without checking for any response (eg, set read_size to 0): bwr.write_buffer = (uintptr_t)&bc1; bwr.write_size = sizeof(bc1); bwr.read_buffer = (uintptr_t)&br; bwr.read_size = 0; ioctl(fd, BINDER_WRITE_READ, &bwr); sleep(1); bwr2.write_buffer = (uintptr_t)&bc2; bwr2.write_size = sizeof(bc2); bwr2.read_buffer = (uintptr_t)&br; bwr2.read_size = 0; ioctl(fd, BINDER_WRITE_READ, &bwr2); sleep(1); The first transaction is sent to the servicemanager and the reply fails because no VMA is set up by this client. After binder_send_failed_reply() is called, the BINDER_WORK_RETURN_ERROR is sitting on the thread's todo list since the read_size was 0 and the client is not waiting for a response. The 2nd transaction is sent and the BINDER_WORK_RETURN_ERROR has not been consumed, so the thread's reply_error.cmd is still set (normally cleared when the BINDER_WORK_RETURN_ERROR is handled). Therefore when the servicemanager attempts to reply to the 2nd failed transaction, the error is already set and it triggers this warning. This is a user error since it is not waiting for the synchronous transaction to complete. If it ever does check, it will see an error. Changed the WARN() to a pr_warn(). Signed-off-by: Todd Kjos <tkjos@android.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e46a3b3ba7509cb7fda0e07bc7c63a2cd90f579b) Change-Id: I3365b0775ceee37bdb1d868e3ce066c260aa88ea
* UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE.Martijn Coenen2018-11-291-0/+9
| | | | | | | | | | | | | To prevent races with ep_remove_waitqueue() removing the waitqueue at the same time. Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable <stable@vger.kernel.org> # 4.14+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5eeb2ca02a2f6084fc57ae5c244a38baab07033a) Change-Id: Ia0089448079c78d0ab0b57303faf838e9e5ee797
* UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.Martijn Coenen2018-11-291-0/+12
| | | | | | | | | | | | | | | | | | | | | binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits. (cherry picked from commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f) Change-Id: Ib34b1cbb8ab2192d78c3d9956b2f963a66ecad2e Signed-off-by: Martijn Coenen <maco@android.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* wmt:fix an invalid condition checkdanielhk2018-11-271-1/+1
| | | | Signed-off-by: Moyster <oysterized@gmail.com>
* Input: gtco - fix potential out-of-bound accessDmitry Torokhov2018-11-271-7/+10
| | | | | | | | | | | | | | | | commit a50829479f58416a013a4ccca791336af3c584c7 upstream. parse_hid_report_descriptor() has a while (i < length) loop, which only guarantees that there's at least 1 byte in the buffer, but the loop body can read multiple bytes which causes out-of-bounds access. Bug: 69916367 Change-Id: Ic6a2fda77685b90d7642c09b20f5d57d6d48b726 Reported-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Siqi Lin <siqilin@google.com>
* Security Patch: WLAN Gen2: Security Vulnerability Issue 72312071David Chu2018-11-272-2/+10
| | | | | | | | | | | | | | | [Detail] Multiple Kernel Memory Corruption Issues in Mediatek cfg80211 Subsystem [Solution] In mtk_cfg80211_vendor_set_config the value num_buckets must be validated to ensure it is not greater than size of the buckets array. CVE-2018-9395 Change-Id: If07b758108922dd12ac4eb5d93ce2eab0ce06dae Signed-off-by: Ben Fennema <fennema@google.com> Signed-off-by: Moyster <oysterized@gmail.com>
* Security Patch: fix ioctl vulnerability for WMT_IOCTL_SET_PATCH_INFODavid Chu2018-11-271-4/+5
| | | | | | | | | | | | | [Detail] If dowloadSeq is 0, it'll pass the error handle and cause KE issue. [Solution] Add condition that downloadSeq can not equal to zero. CVE-2018-9397 Change-Id: I68a2d501c873c4d665634893066b6c0f03e1537c Signed-off-by: Ben Fennema <fennema@google.com>
* usb: replace %p with %pKManu Gautam2018-11-2797-599/+599
| | | | | | | | | | | | | | | Format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. When kptr_restrict is set to (1), kernel pointers printed using the %pK format specifier will be replaced with 0's. Debugging Note : &pK prints only Zeros as address. If you need actual address information, write 0 to kptr_restrict. echo 0 > /proc/sys/kernel/kptr_restrict CRs-fixed: 1052849 Change-Id: I0e98145730380ea983fa8f46a28d15dd6c2c31df Signed-off-by: Manu Gautam <mgautam@codeaurora.org> Signed-off-by: Yasir Malik <ymalik@codeaurora.org> Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
* mediatek: touchpanel: disable some configsfire8552018-05-162-10/+10
| | | | | | modified to match meizu m2 note Signed-off-by: Moyster <oysterized@gmail.com>
* Fix make cleanfire8552018-05-161-4/+0
| | | | Signed-off-by: Moyster <oysterized@gmail.com>
* ANDROID: usb: gadget: function: Fix Coding StyleAnson Jacob2018-05-163-10/+10
| | | | | | | | | | | Fix warning by checkpatch.pl: Prefer 'unsigned int' to bare use of 'unsigned' Patch applied by running fix inplace capability of checkpatch: checkpatch.pl -f *.[ch] --types UNSPECIFIED_INT --fix-inplace Change-Id: I2ba09a70e3a748ea8440f77d5c8e0349db248d49 Signed-off-by: Anson Jacob <ansonjacob.aj@gmail.com>
* ANDROID: usb: gadget: function: Fix commenting styleAnson Jacob2018-05-161-7/+8
| | | | | | | | Fix checkpatch.pl warning: Block comments use * on subsequent lines Change-Id: I9c92f128fdb3aeeb6ab9c7039e11f857bebb9539 Signed-off-by: Anson Jacob <ansonjacob.aj@gmail.com>
* ANDROID: usb: gadget: function: cleanup: Add blank line after declarationAnson Jacob2018-05-163-0/+6
| | | | | | | | Fix warning generated by checkpatch.pl: Missing a blank line after declarations Change-Id: I8c1b069a57f90027edfdb3cd8fa011dfe87e44b7 Signed-off-by: Anson Jacob <ansonjacob.aj@gmail.com>
* usb: gadget: cleanup: removing duplicate bulk out ep allocAnson Jacob2018-05-161-9/+0
| | | | | | | | | Removing duplicate allocation of usb accessory's bulk out endpoint Issue: 67180 Change-Id: Icfb8111cdafa487e54b66f9450d49e52a02ae7a6 Signed-off-by: Anson Jacob <ansonkuzhumbil@gmail.com>
* usb: gadget: add audio dependencies to USB_G_ANDROIDGreg Hackmann2018-05-161-0/+3
| | | | | | | | Since the Android gadget is a superset of the audio and MIDI gadgets, it needs to take on their dependencies too Change-Id: Ib7444962dcdb197e8b7ad66f7a41f7bc40879d2c Signed-off-by: Greg Hackmann <ghackmann@google.com>
* USB: gadget: android: Integrate f_midi USB MIDI gadget driver part deuxMark Salyzyn2018-05-161-7/+7
| | | | | | | | | free_ep_req and alloc_ep_req are static open coded and conflicting in f_midi.c. The exported versions are present in f_sourcesink.c. Changed names to protect the innocent. Change-Id: I4aee40054b5715d0532d433d23dea2bccff7ec30 Signed-off-by: Mark Salyzyn <salyzyn@google.com>
* USB: gadget: android: Integrate f_midi USB MIDI gadget driverMike Lockwood2018-05-162-14/+90
| | | | | Change-Id: I4c4b99f9d54314fc31445cf42b825527ca483af9 Signed-off-by: Mike Lockwood <lockwood@google.com>
* USB: gadget: f_audio_source: Rename symbols to avoid conflicts with f_midiMike Lockwood2018-05-161-45/+45
| | | | | Change-Id: I424b942d64c9f818351e49ee2150f466b9cc7f84 Signed-off-by: Mike Lockwood <lockwood@google.com>
* USB: gadget: midi: Fix deadlock unbinding driver while it is in useMike Lockwood2018-05-161-1/+1
| | | | | | | | | Using snd_card_free_when_closed rather than snd_card_free in f_midi_unbind makes it safe to disable the driver while a userspace client has the ALSA device open. Change-Id: Ibc40c01e7b1ce90fc61d3ea654b4816fadfc7ffd Signed-off-by: Mike Lockwood <lockwood@google.com>
* usb: gadget: check for accessory device before disconnecting HIDsAmit Pundir2018-05-161-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | While disabling ConfigFS Android gadget, android_disconnect() calls kill_all_hid_devices(), if CONFIG_USB_CONFIGFS_F_ACC is enabled, to free the registered HIDs without checking whether the USB accessory device really exist or not. If USB accessory device doesn't exist then we run into following kernel panic: ----8<---- [  136.724761] Unable to handle kernel NULL pointer dereference at virtual address 00000064 [  136.724809] pgd = c0204000 [  136.731924] [00000064] *pgd=00000000 [  136.737830] Internal error: Oops: 5 [#1] SMP ARM [  136.738108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.18.0-rc4-00400-gf75300e-dirty #76 [  136.742788] task: c0fb19d8 ti: c0fa4000 task.ti: c0fa4000 [  136.750890] PC is at _raw_spin_lock_irqsave+0x24/0x60 [  136.756246] LR is at kill_all_hid_devices+0x24/0x114 ---->8---- This patch adds a test to check if USB Accessory device exists before freeing HIDs. Change-Id: Ie229feaf0de3f4f7a151fcaa9a994e34e15ff73b Signed-off-by: Amit Pundir <amit.pundir@linaro.org> (cherry picked from commit 32a71bce154cb89a549b9b7d28e8cf03b889d849)
* usb: gadget: android: Save/restore ep0 completion functionJack Pham2018-05-161-0/+7
| | | | | | | | | | | | | | | | | | | | The android_setup() function currently gives the f_accessory setup function first opportunity to handle control requests in order to support Android Open Accessory (AOA) hosts. That function makes use of cdev->req and overrides its completion function, but not in all cases. Thus, if a later request uses the same request pointer but doesn't (re)set req->complete it could result in the wrong completion function being called and causing invalid memory access. One way to fix this would be to explicitly set req->complete in all cases but that might require auditing all function drivers that have ep0 handling. Instead, note that the composite device had already initially set cdev->req->complete and simply cache and restore that pointer at the start of android_setup(). Change-Id: I33bcd17bd20687a349d537d1013b52a2afef6996 Signed-off-by: Jack Pham <jackp@codeaurora.org>
* meizu: drivers: touchscreen: cleanup windows ^MMoyster2018-05-166-329/+329
|
* UPSTREAM: scsi: sg: don't return bogus Sg_requestsJohannes Thumshirn2018-05-161-2/+3
| | | | | | | | | | | | | | | | | | | | | | | If the list search in sg_get_rq_mark() fails to find a valid request, we return a bogus element. This then can later lead to a GPF in sg_remove_scat(). So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case the list search doesn't find a valid request. Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de> Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: Hannes Reinecke <hare@suse.de> Cc: Christoph Hellwig <hch@lst.de> Cc: Doug Gilbert <dgilbert@interlog.com> Reviewed-by: Hannes Reinecke <hare@suse.de> Acked-by: Doug Gilbert <dgilbert@interlog.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Chenbo Feng <fengc@google.com> (cherry picked from commit 48ae8484e9fc324b4968d33c585e54bc98e44d61) Change-Id: If95d1a8eef3748c9937201e524184b89a5eaaf2e Bug: 75300370
* staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctlViktor Slavkovic2018-05-161-0/+2
| | | | | | | | | | | | | | commit 443064cb0b1fb4569fe0a71209da7625129fb760 upstream. A lock-unlock is missing in ASHMEM_SET_SIZE ioctl which can result in a race condition when mmap is called. After the !asma->file check, before setting asma->size, asma->file can be set in mmap. That would result in having different asma->size than the mapped memory size. Combined with ASHMEM_UNPIN ioctl and shrinker invocation, this can result in memory corruption. Signed-off-by: Viktor Slavkovic <viktors@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mediatek: mmc-host: disable debug procfire8552018-05-161-1/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-14 22:12:08 +0000