This patch fixes the below array index out of bounds issue.
Buffer overflow, array index of 'aInfo' may be out of
bounds. Array 'aInfo' of size 78 may use index value(s) 6..84
The data stored in 'aInfo' array exceeds the array size of 78.
This patch increases the size of this array to hold the string
correctly without any memory corruption.
This issue was reported by Klockwork tool.
Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch fixes the following NULL pointer dereference issue.
Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.
============
Code Snippet
============
748: request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
csr &= ~(MUSB_RXCSR_AUTOCLEAR
| MUSB_RXCSR_DMAENAB
| MUSB_RXCSR_DMAMODE);
musb_writew(epio, MUSB_RXCSR,
MUSB_RXCSR_P_WZC_BITS | csr);
792: request->actual += musb_ep->dma->actual_len;
Signed-off-by: Maulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Since a DMA transfer may need to be kicked off several times to complete,
the DMA start must include the length that has already been transferred.
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gadget stalling a zero-length SETUP request results in this error message:
SetupEnd came in a wrong ep0stage idle
In order to avoid it, always set the CSR0.DataEnd bit after detecting a zero-
length request. Add the missing '\n' to the error message itself as well...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Race condition exists between the cppi_interrupt handler and
davinci_interrupt handler w.r.t completing a TX IO. Since DM646x
has seperate DMA and USB endpoint interrupts cppi_interrupt handler
needs to hold the lock while operating on the endpoint.
Update over previous patch to avoid taking the lock if already
taken. Tested on DM644x, DM355 and DM646x platforms.
Signed-off-by: Swaminathan S <swami.iyer@ti.com>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On OTG and gadget-only configurations, we need a gadget driver
in order to work properly, so avoid changing operation modes
when there's no gadget driver loaded.
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When registering gadget driver, the state of the transceiver
must be set from undefined (no gadget) to b_idle.
Module unload sets the transceiver state to undefined state.
After the first load/unload pair, the reset irq will be lost.
Signed-off-by: Arnaud Mandy <ext-arnaud.2.mandy@nokia.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes a null-pointer dereference bug.
Signed-off-by: Swaminathan S <swami.iyer@ti.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Current musb gadget dma code produces the warning:
drivers/usb/musb/musb_gadget.c: In function 'txstate':
drivers/usb/musb/musb_gadget.c:312: warning: comparison of distinct
pointer types lacks a cast
So switch to min_t(size_t, ...).
Signed-off-by: Cliff Cai <cliff.cai@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
probe() already was on __init, so moving remove() to __exit.
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit 7723de7e19 (USB: musb_gadget: remove
pointless loop) included uncalled for (and incorrect) optimization that
might cause a kernel oops in txstate() -- undo it.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a (almost) sort-only patch to sort FTDI device
product ID definitions in new ftdi_sio_ids.h header.
Advantage is that new device ID submissions will now have a specific (sorted)
position - less future merge conflicts.
Compile-tested, based on _current_ mainline git.
Minor checkpatch.pl warnings were eliminated whereever it made sense,
very minor text changes.
Signed-off-by: Andreas Mohr <andi@lisas.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a strictly move-only patch to relocate all FTDI device
product ID definitions to their own ftdi_sio_ids.h header
(following the usual *_ids.h kernel tree convention, too),
thus correcting the slightly too messy appearance
(crucial driver defines were stuck somewhere in the decaying middle swamp
of the huge existing header).
Compile-tested, based on latest mainline git.
Signed-off-by: Andreas Mohr <andi@lisas.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix new kernel-doc warnings in usb core:
Warning(drivers/usb/core/usb.c:79): No description found for parameter 'config'
Warning(drivers/usb/core/usb.c:79): No description found for parameter 'iface_num'
Warning(drivers/usb/core/usb.c:79): No description found for parameter 'alt_num'
Warning(drivers/usb/core/hcd.c:1622): No description found for parameter 'udev'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit 917778267f removed __init from
ehci_wait_for_port(), but left it in place on ehci_reset_port(), which
is being called from the former function.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Acked-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
While converting emi62 to use request_firmware(), the driver was also
changed to use the ihex helper functions. However, this broke the loading
of the FPGA firmware because the code tries to access the addr field of
the EOF record which works with a plain array that has an empty last
record but not with the ihex helper functions where the end of the data is
signaled with a NULL record pointer, resulting in:
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<f80d248c>] emi62_load_firmware+0x33c/0x740 [emi62]
This can be fixed by changing the loop condition to test the return value
of ihex_next_binrec() directly (like in emi26.c).
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-and-tested-by: Der Mickster <retroeffective@gmail.com>
Acked-by: David Woodhouse <David.Woodhouse@intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch corrects a problem where drivers/usb/otg is linked twice
if CONFIG_USB_ULPI is selected, resulting in a build error (symbol
conflict). The files in that directory are properly linked already
as part of CONFIG_USB, and need not be indicated specifically for
CONFIG_USB_ULPI.
Signed-off-by: Bill Gatliff <bgat@billgatliff.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Use ERR_PTR and IS_ERR rather than mixing integers and pointers.
The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression *E;
@@
* E < 0
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1315) fixes some bugs in the USB core authorization
code:
usb_deauthorize_device() should deallocate the device strings
instead of leaking them, and it should invoke
usb_destroy_configuration() (which does proper reference
counting) instead of freeing the config information directly.
usb_authorize_device() shouldn't change the device strings
until it knows that the authorization will succeed, and it should
autosuspend the device at the end (having autoresumed the
device at the start).
Because the device strings can be changed, the sysfs routines
to display the strings must protect the string pointers by
locking the device.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Acked-by: David Vrabel <david.vrabel@csr.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1314) renames usb_configure_device() and
usb_configure_device_otg() in the hub driver. Neither name is
appropriate because these routines enumerate devices, they don't
configure them. That's handled by usb_choose_configuration() and
usb_set_configuration().
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch (as1313) updates the documentation concerning USB power
management.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (35 commits)
drm/radeon/kms: add definitions for v4 power tables
drm/radeon/kms: never combine LVDS with another encoder
drm/radeon/kms: Check module arguments to be valid V2
drm/radeon/kms: Avoid crash when trying to cleanup uninitialized structure
drm/radeon/kms: add cvt mode if we only have lvds w/h and no edid (v4)
drm/radeon/kms: add 3DC compression support
drm/radeon/kms: allow rendering while no colorbuffer is set on r300
drm/radeon/kms: enable memory clock reading on legacy (V2)
drm/radeon/kms: prevent parallel AtomBIOS calls
drm/radeon/kms: set proper default tv standard
drm/radeon/kms: fix legacy rmx
drm/radeon/kms/atom: fill in proper defines for digital setup
drm/kms: silencing a false positive warning.
drm/mm: fix logic for selection of best fit block
drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.
drm/vmwgfx: Return -ERESTARTSYS when interrupted by a signal.
drm/vmwgfx: Fix unlocked ioctl and add proper access control
drm/radeon: fix build on 64-bit with some compilers.
drivers/gpu: Use kzalloc for allocating only one thing
DRM: Rename clamp variable
...
The USB serial code was a new user of the kfifo API, and it was missed
when porting things to the new kfifo API.
Please make the write_fifo in place. Here is my patch to fix the
regression and full ported version.
Signed-off-by: Stefani Seibold <stefani@seibold.net>
Reported-and-tested-by: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Greg KH <greg@kroah.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* korg/drm-radeon-next:
drm/radeon/kms: add definitions for v4 power tables
drm/radeon/kms: never combine LVDS with another encoder
drm/radeon/kms: Check module arguments to be valid V2
drm/radeon/kms: Avoid crash when trying to cleanup uninitialized structure
drm/radeon/kms: add cvt mode if we only have lvds w/h and no edid (v4)
drm/radeon/kms: add 3DC compression support
drm/radeon/kms: allow rendering while no colorbuffer is set on r300
drm/radeon/kms: enable memory clock reading on legacy (V2)
drm/radeon/kms: prevent parallel AtomBIOS calls
drm/radeon/kms: set proper default tv standard
drm/radeon/kms: fix legacy rmx
drm/radeon/kms/atom: fill in proper defines for digital setup
[airlied: just adding this for completeness to avoid drift between
public atombios.h files]
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
When linking multiple encoders to a connector, make sure
to not link LVDS with another connector. Some bioses
have the same i2c line for LVDS and VGA.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This patch add a function which check module argument to be
valid. On invalid argument it prints a warning and setback
the default value.
V2: Allow 0 for vram limit & agp mode which are the default
value
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Add boolean to record if some part of the driver are initialized or
not this allow to avoid a crash when trying to cleanup uninitialized
structure members.
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This fixes LVDS on some mac laptops without a panel edid.
v2 - Set proper mode type flags
v3 - Note that this is not neceesarily the exact panel mode,
but an approximation based on the cvt formula. For these
systems we should ideally read the mode info out of the
registers or add a mode table, but this works and is much
simpler.
v4 - Update comments and debug message.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
There are 2 formats:
ATI1N: 64 bits per 4x4 block, one-channel format
ATI2N: 128 bits per 4x4 block, two-channel format
Signed-off-by: Dave Airlie <airlied@redhat.com>
Because hardware cannot disable all colorbuffers directly to do depth-only
rendering, a user should:
- disable reading from a colorbuffer in blending
- disable fastfill
- set the color channel mask to 0 to prevent writing to a colorbuffer
Signed-off-by: Dave Airlie <airlied@redhat.com>
This just adds a mutex around the atombios table execution
so we don't call it from two contexts at once.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
we were just using 1 before.
reported on irc by soreau
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This makes 640x480 on my R100 work again, both
in aspect and centered mode.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Tested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* nouveau/for-airlied:
drm/nouveau: fix bug causing pinned buffers to lose their NO_EVICT flag
drm/nv50: fix suspend/resume delays without firmware present
drm/nouveau: prevent all channel creation if accel not available
drm/nv50: fix two potential suspend/resume oopses
drm/nv40: implement ctxprog/state generation
drm/nv10: Add the initial graph context and soft methods needed for LMA.
drm/nouveau: Fix up buffer eviction, and evict them to GART, if possible.
drm/nouveau: Add proper error handling to nouveau_card_init
drm/nv04: Fix NV04 set_operation software method.
drm/nouveau: Kill global state in BIOS script interpreter
drm/nouveau: Kill global state in NvShadowBIOS
drm/nouveau: use drm debug levels
drm/i2c/ch7006: Fix load detection false positives right after system init.
drm/nv04-nv40: Fix "conflicting memory types" when saving/restoring VGA fonts.
warning: 'width' may be used uninitialized in this function
drivers/gpu/drm/drm_edid.c
Signed-off-by: Marin Mitov <mitov@issp.bas.bg>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This is from bug 25728.
[airlied: I'm just forwarding the patch for review, Thomas, ickle?]
Acked-by: Jerome Glisse <jglisse@redhat.com>
Acked-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Improve the command verifier to catch all occurences of surface handles,
and translate to SIDs.
This way DMA buffers and 3D surfaces share a common handle space,
which makes it possible for the kms code to differentiate.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Fixes for TTM API change.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This fixes up vmwgfx for the unlocked ioctl code to avoid
doing it in the driver. Also adds ioctl flags.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/radeon/radeon_test.c:45: undefined reference to `__udivdi3'
Reported-by: Mr. James W. Laferriere <babydr@baby-dragons.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Use kzalloc rather than kcalloc(1,...)
The use of the allocated memory that looks like an array is &p->relocs[0],
but this should be the same as p->relocs.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
@@
- kcalloc(1,
+ kzalloc(
...)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
linux/kernel.h has a "clamp" macro, but r300_cmdbuf also uses a variable
with the same name. Right now it doesn't seem to include the header,
but sooner or later someone will. So better rename the variable
now.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6:
PM: Runtime PM documentation update
PM / Runtime: Use device type and device class callbacks
PM: Use pm_runtime_put_sync in system resume
PM: Measure device suspend and resume times
PM: Make the initcall_debug style timing for suspend/resume complete
