summaryrefslogtreecommitdiffstats
path: root/drivers (follow)
Commit message (Collapse)AuthorAgeFilesLines
* treewide: Switch DEFINE_TIMER callbacks to struct timer_list *Kees Cook2017-11-2226-56/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes all DEFINE_TIMER() callbacks to use a struct timer_list pointer instead of unsigned long. Since the data argument has already been removed, none of these callbacks are using their argument currently, so this renames the argument to "unused". Done using the following semantic patch: @match_define_timer@ declarer name DEFINE_TIMER; identifier _timer, _callback; @@ DEFINE_TIMER(_timer, _callback); @change_callback depends on match_define_timer@ identifier match_define_timer._callback; type _origtype; identifier _origarg; @@ void -_callback(_origtype _origarg) +_callback(struct timer_list *unused) { ... } Signed-off-by: Kees Cook <keescook@chromium.org>
* lightnvm: Convert timers to use timer_setup()Kees Cook2017-11-226-13/+13
| | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Matias Bjorling <mb@lightnvm.io> Cc: linux-block@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
* drivers/net: cris: Convert timers to use timer_setup()Kees Cook2017-11-221-19/+17
| | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: "David S. Miller" <davem@davemloft.net> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "yuval.shaia@oracle.com" <yuval.shaia@oracle.com> Cc: Paul Gortmaker <paul.gortmaker@windriver.com> Cc: Philippe Reynes <tremyfr@gmail.com> Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
* drm/vc4: Convert timers to use timer_setup()Kees Cook2017-11-222-12/+7
| | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Eric Anholt <eric@anholt.net> Cc: David Airlie <airlied@linux.ie> Cc: dri-devel@lists.freedesktop.org Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Eric Anholt <eric@anholt.net> Link: https://patchwork.freedesktop.org/patch/msgid/20171024151648.GA104538@beast Reviewed-by: Eric Anholt <eric@anholt.net>
* drm/i915/selftests: Convert timers to use timer_setup()Kees Cook2017-11-221-3/+3
| | | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: David Airlie <airlied@linux.ie> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Jani Nikula <jani.nikula@intel.com>
* usb: usbatm: Convert timers to use timer_setup()Kees Cook2017-11-223-20/+29
| | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Additionally corrects and on-stack timer usage. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Duncan Sands <duncan.sands@free.fr> Cc: "Gustavo A. R. Silva" <garsilva@embeddedor.com> Cc: accessrunner-general@lists.sourceforge.net Cc: linux-usb@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Allen Pais <allen.lkml@gmail.com>
* drivers/firmware: psci: Convert timers to use timer_setup()Kees Cook2017-11-221-2/+2
| | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Also adds missing call to destroy_timer_on_stack(). Cc: Mark Rutland <mark.rutland@arm.com> Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Kees Cook <keescook@chromium.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds2017-11-2111-33/+60
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull networking fixes from David Miller: 1) Fix a reference to a module parameter which was lost during the GREv6 receive path rewrite, from Alexey Kodanev. 2) Fix deref before NULL check in ipheth, from Gustavo A. R. Silva. 3) RCU read lock imbalance in tun_build_skb(), from Xin Long. 4) Some stragglers from the mac80211 folks: a) Timer conversions from Kees Cook b) Fix some sequencing issue when cfg80211 is built statically, from Johannes Berg c) Memory leak in mac80211_hwsim, from Ben Hutchings. 5) Add new qmi_wwan device ID, from Sebastian Sjoholm. 6) Fix use after free in tipc, from Jon Maloy. 7) Missing kdoc in nfp driver, from Jakub Kicinski. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: nfp: flower: add missing kdoc tipc: fix access of released memory net: qmi_wwan: add Quectel BG96 2c7c:0296 mlxsw: spectrum: Do not try to create non-existing ports during unsplit mac80211: properly free requested-but-not-started TX agg sessions mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() cfg80211: initialize regulatory keys/database later mac80211: aggregation: Convert timers to use timer_setup() nl80211: don't expose wdev->ssid for most interfaces mac80211: Convert timers to use timer_setup() net: vxge: Fix some indentation issues net: ena: fix race condition between device reset and link up setup r8169: use same RTL8111EVL green settings as in vendor driver r8169: fix RTL8111EVL EEE and green settings tun: fix rcu_read_lock imbalance in tun_build_skb tcp: when scheduling TLP, time of RTO should account for current ACK usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set gre6: use log_ecn_error module parameter in ip6_tnl_rcv()
| * Merge tag 'mac80211-for-davem-2017-11-20' of ↵David S. Miller2017-11-211-1/+4
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A few things: * straggler timer conversions from Kees * memory leak fix in hwsim * fix some fallout from regdb changes if wireless is built-in * also free aggregation sessions in startup state when station goes away, to avoid crashing the timer ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| | * mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()Ben Hutchings2017-11-201-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hwsim_new_radio_nl() now copies the name attribute in order to add a null-terminator. mac80211_hwsim_new_radio() (indirectly) copies it again into the net_device structure, so the first copy is not used or freed later. Free the first copy before returning. Fixes: ff4dd73dd2b4 ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length") Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| * | nfp: flower: add missing kdocJakub Kicinski2017-11-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 0115552eac14 ("nfp: remove false positive offloads in flower vxlan") missed adding kdoc for a new parameter of nfp_flower_add_offload(). Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net: qmi_wwan: add Quectel BG96 2c7c:0296Sebastian Sjoholm2017-11-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quectel BG96 is an Qualcomm MDM9206 based IoT modem, supporting both CAT-M and NB-IoT. Tested hardware is BG96 mounted on Quectel development board (EVB). The USB id is added to qmi_wwan.c to allow QMI communication with the BG96. Signed-off-by: Sebastian Sjoholm <ssjoholm@mac.com> Acked-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | mlxsw: spectrum: Do not try to create non-existing ports during unsplitIdo Schimmel2017-11-212-2/+8
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On some systems, when we unsplit a port we need to re-create two ports instead. On other systems, only one needs to be re-created. Do not try to create a port if during driver initialization it was assigned a negative module number, which is invalid. This avoids the following error during unsplit: [ 941.012478] mlxsw_spectrum 0000:01:00.0: Port 43: Failed to map module The error is harmless and caused by the fact that a local port is already mapped to module 0. Fixes: be94535f9531 ("mlxsw: spectrum: Make split flow match firmware requirements") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Reviewed-by: Arkadi Sharshevsky <arkadis@mellanox.com> Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * net: vxge: Fix some indentation issuesChristophe JAILLET2017-11-201-19/+18
| | | | | | | | | | | | | | | | Some statements are not enough or too much indented. Fix it to improve readalbility. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
| * net: ena: fix race condition between device reset and link up setupNetanel Belgazal2017-11-202-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In rare cases, ena driver would reset and re-start the device, for example, in case of misbehaving application that causes transmit timeout The first step in the reset procedure is to stop the Tx traffic by calling ena_carrier_off(). After the driver have just started the device reset procedure, device happens to send an asynchronous notification (via AENQ) to the driver than there was a link change (to link-up state). This link change is mapped to a call to netif_carrier_on() which re-activates the Tx queues, violating the assumption of no tx traffic until device reset is completed, as the reset task might still be in the process of queues initialization, leading to an access to uninitialized memory. Signed-off-by: Netanel Belgazal <netanel@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * r8169: use same RTL8111EVL green settings as in vendor driverHeiner Kallweit2017-11-191-0/+5
| | | | | | | | | | | | | | | | Adjust the code to use the same green settings as in the latest vendor driver. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * r8169: fix RTL8111EVL EEE and green settingsHeiner Kallweit2017-11-191-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Name of functions rtl_w0w1_eri and rtl_w0w1_phy is somewhat misleading regarding order of arguments. One could assume that w0w1 means argument with bits to be reset comes before argument with bits to set. However this is not the case. So fix the order of arguments in several statements. In addition fix EEE advertisement. The current code resets the bits for 100BaseT and 1000BaseT EEE advertisement what is not what we want. I have a little of a hard time to find a proper "Fixes" line as the issue seems to have been there forever (at least it existed already when the driver was moved to the current place in 2011). The patch was tested on a Zotac Mini-PC with a RTL8111E-VL chip. Before the patch EEE was disabled, now it's properly advertised and works fine. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * tun: fix rcu_read_lock imbalance in tun_build_skbXin Long2017-11-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rcu_read_lock in tun_build_skb is used to rcu_dereference tun->xdp_prog safely, rcu_read_unlock should be done in every return path. Now I could see one place missing it, where it returns NULL in switch-case XDP_REDIRECT, another palce using rcu_read_lock wrongly, where it returns NULL in if (xdp_xmit) chunk. So fix both in this patch. Fixes: 761876c857cb ("tap: XDP support") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_setGustavo A. R. Silva2017-11-191-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | _dev_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after _dev_ has been null checked. Addresses-Coverity-ID: 1462020 Fixes: bb1b40c7cb86 ("usbnet: ipheth: prevent TX queue timeouts when device not ready") Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge tag 'ceph-for-4.15-rc1' of git://github.com/ceph/ceph-clientLinus Torvalds2017-11-211-52/+13
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull ceph updates from Ilya Dryomov: "We have a set of file locking improvements from Zheng, rbd rw/ro state handling code cleanup from myself and some assorted CephFS fixes from Jeff. rbd now defaults to single-major=Y, lifting the limit of ~240 rbd images per host for everyone" * tag 'ceph-for-4.15-rc1' of git://github.com/ceph/ceph-client: rbd: default to single-major device number scheme libceph: don't WARN() if user tries to add invalid key rbd: set discard_alignment to zero ceph: silence sparse endianness warning in encode_caps_cb ceph: remove the bump of i_version ceph: present consistent fsid, regardless of arch endianness ceph: clean up spinlocking and list handling around cleanup_cap_releases() rbd: get rid of rbd_mapping::read_only rbd: fix and simplify rbd_ioctl_set_ro() ceph: remove unused and redundant variable dropping ceph: mark expected switch fall-throughs ceph: -EINVAL on decoding failure in ceph_mdsc_handle_fsmap() ceph: disable cached readdir after dropping positive dentry ceph: fix bool initialization/comparison ceph: handle 'session get evicted while there are file locks' ceph: optimize flock encoding during reconnect ceph: make lock_to_ceph_filelock() static ceph: keep auth cap when inode has flocks or posix locks
| * | rbd: default to single-major device number schemeIlya Dryomov2017-11-131-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's been 3.5 years, let's turn it on by default. Support in rbd(8) utility goes back to pre-firefly, "rbd map" has been loading the module with single_major=Y ever since. However, if the module is already loaded (whether by hand or at boot time), we end up with single_major=N. Also, some people don't install rbd(8) and use the sysfs interface directly. (With single-major=N, a major number is consumed for every mapping, imposing a limit of ~240 rbd images per host. single-major=Y allows mapping thousands of rbd images on a single machine.) Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Jason Dillaman <dillaman@redhat.com>
| * | rbd: set discard_alignment to zeroDavid Disseldorp2017-11-131-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RBD devices are currently incorrectly initialised with the block queue discard_alignment set to the underlying RADOS object size. As per Documentation/ABI/testing/sysfs-block: The discard_alignment parameter indicates how many bytes the beginning of the device is offset from the internal allocation unit's natural alignment. Correcting the discard_alignment parameter from the RADOS object size to zero (the blk_set_default_limits() default) has no effect on how discard requests are propagated through the block layer - @alignment in __blkdev_issue_discard() remains zero. However, it does fix the UNMAP granularity alignment value advertised to SCSI initiators via the Block Limits VPD. Signed-off-by: David Disseldorp <ddiss@suse.de> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| * | rbd: get rid of rbd_mapping::read_onlyIlya Dryomov2017-11-131-19/+4
| | | | | | | | | | | | | | | | | | | | | It is redundant -- rw/ro state is stored in hd_struct and managed by the block layer. Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
| * | rbd: fix and simplify rbd_ioctl_set_ro()Ilya Dryomov2017-11-131-28/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ->open_count/-EBUSY check is bogus and wrong: when an open device is set read-only, blkdev_write_iter() refuses further writes with -EPERM. This is standard behaviour and all other block devices allow this. set_disk_ro() call is also problematic: we affect the entire device when called on a single partition. All rbd_ioctl_set_ro() needs to do is refuse ro -> rw transition for mapped snapshots. Everything else can be handled by generic code. Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
* | | Merge tag 'fbdev-v4.15' of git://github.com/bzolnier/linuxLinus Torvalds2017-11-2126-723/+147
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull fbdev updates from Bartlomiej Zolnierkiewicz: "There is nothing really major here (though removal of the dead igafb driver stands out in diffstat). Summary: - convert timers to use timer_setup() (Kees Cook, Thierry Reding) - fix panels support on iMX boards in mxsfb driver (Stefan Agner) - fix timeout on EDID read in udlfb driver (Ladislav Michl) - add missing modes to fix out of bounds access in controlfb driver (Geert Uytterhoeven) - update initialisation paths in sa1100fb driver to be more robust (Russell King) - fix error handling path of ->probe method in au1200fb driver (Christophe JAILLET) - fix handling of cases when either panel or crt is defined in sm501fb driver (Sudip Mukherjee, Colin Ian King) - add ability to the Goldfish FB driver to be recognized by OS via DT (Aleksandar Markovic) - structures constifications (Bhumika Goyal) - misc fixes (Allen Pais, Gustavo A. R. Silva, Dan Carpenter) - misc cleanups (Colin Ian King, Himanshu Jha, Markus Elfring) - remove dead igafb driver" * tag 'fbdev-v4.15' of git://github.com/bzolnier/linux: (42 commits) OMAPFB: prevent buffer underflow in omapfb_parse_vram_param() video: fbdev: sm501fb: fix potential null pointer dereference on fbi fbcon: Initialize ops->info early video: fbdev: Convert timers to use timer_setup() video: fbdev: pxa3xx_gcu: Convert timers to use timer_setup() fbdev: controlfb: Add missing modes to fix out of bounds access video: fbdev: sis_main: mark expected switch fall-throughs video: fbdev: cirrusfb: mark expected switch fall-throughs video: fbdev: aty: radeon_pm: mark expected switch fall-throughs video: fbdev: sm501fb: mark expected switch fall-through in sm501fb_blank_crt video: fbdev: intelfb: remove redundant variables video/fbdev/dnfb: Use common error handling code in dnfb_probe() sm501fb: suspend and resume fb if it exists sm501fb: unregister framebuffer only if registered sm501fb: deallocate colormap only if allocated video: goldfishfb: Add support for device tree bindings Documentation: Add device tree binding for Goldfish FB driver video: udlfb: Fix read EDID timeout video: fbdev: remove dead igafb driver video: fbdev: mxsfb: fix pixelclock polarity ...
| * | | OMAPFB: prevent buffer underflow in omapfb_parse_vram_param()Dan Carpenter2017-11-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We cap the upper bound of "fbnum" but we also need to check for negatives or make the type unsigned. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: sm501fb: fix potential null pointer dereference on fbiColin Ian King2017-11-171-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pointer fbi is dereferenced with par = fbi->par before there is a null check on fbi, hence there is a potential null pointer dereference on a null par. Fix this by moving the dereference after the null pointer check. Detected by CoverityScan, CID#1461301 ("Dereference before null check") Signed-off-by: Colin Ian King <colin.king@canonical.com> Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | fbcon: Initialize ops->info earlyThierry Reding2017-11-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During console takeover, which happens for all DRM/KMS setups using the fbdev helpers, fbcon_startup() is called before fbcon_init() and as a result con2fb_acquire_newinfo() will not be called (info->fbcon_par was set to non-NULL in fbcon_startup()) to assign ops->info. This causes the cursor_timer_handler() to unreference a NULL pointer. Avoid this by unconditionally assigning ops->info during fbcon_startup() so that it will be available early, but keep the additional assignment in con2fb_acquire_newinfo() to support console remapping at runtime. Signed-off-by: Thierry Reding <treding@nvidia.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: Convert timers to use timer_setup()Kees Cook2017-11-105-18/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. One tracking pointer was added. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: David Lechner <david@lechnology.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Sean Paul <seanpaul@chromium.org> Cc: Jean Delvare <jdelvare@suse.de> Cc: Hans de Goede <hdegoede@redhat.com> Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com> [b.zolnierkie: ported it over pxa3xx_gcu changes] Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: pxa3xx_gcu: Convert timers to use timer_setup()Kees Cook2017-11-101-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. This also fixes the use of the "priv" variable in QERROR(), since it was pointing to struct timer_list, not struct pxa3xx_gcu_priv. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com> Cc: Himanshu Jha <himanshujha199640@gmail.com> [b.zolnierkie: trivial build fixup] Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | fbdev: controlfb: Add missing modes to fix out of bounds accessGeert Uytterhoeven2017-11-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dan's static analysis says: drivers/video/fbdev/controlfb.c:560 control_setup() error: buffer overflow 'control_mac_modes' 20 <= 21 Indeed, control_mac_modes[] has only 20 elements, while VMODE_MAX is 22, which may lead to an out of bounds read when parsing vmode commandline options. The bug was introduced in v2.4.5.6, when 2 new modes were added to macmodes.h, but control_mac_modes[] wasn't updated: https://kernel.opensuse.org/cgit/kernel/diff/include/video/macmodes.h?h=v2.5.2&id=29f279c764808560eaceb88fef36cbc35c529aad Augment control_mac_modes[] with the two new video modes to fix this. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: sis_main: mark expected switch fall-throughsGustavo A. R. Silva2017-11-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 115025 Addresses-Coverity-ID: 115026 Addresses-Coverity-ID: 115027 Addresses-Coverity-ID: 115028 Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Cc: Thomas Winischhofer <thomas@winischhofer.net> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: cirrusfb: mark expected switch fall-throughsGustavo A. R. Silva2017-11-091-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case I placed the "fall through" comment on its own line, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: aty: radeon_pm: mark expected switch fall-throughsGustavo A. R. Silva2017-11-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: sm501fb: mark expected switch fall-through in sm501fb_blank_crtGustavo A. R. Silva2017-11-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: intelfb: remove redundant variablesColin Ian King2017-11-091-7/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Variables err_max, err_target and f_best are being assigned values but these are never read, hence they are redundant variables and can be removed. Cleans up clang warnings: drivers/video/fbdev/intelfb/intelfbhw.c:946:2: warning: Value stored to 'err_max' is never read drivers/video/fbdev/intelfb/intelfbhw.c:947:2: warning: Value stored to 'err_target' is never read drivers/video/fbdev/intelfb/intelfbhw.c:995:6: warning: Value stored to 'f_best' is never read Signed-off-by: Colin Ian King <colin.king@canonical.com> Cc: Maik Broemme <mbroemme@libmpq.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video/fbdev/dnfb: Use common error handling code in dnfb_probe()Markus Elfring2017-11-091-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | sm501fb: suspend and resume fb if it existsSudip Mukherjee2017-11-091-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are cases when panel and crt both are not defined and only one of them is defined and initialized. In such cases, suspend or resume it only if it is defined. Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | sm501fb: unregister framebuffer only if registeredSudip Mukherjee2017-11-091-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are cases when panel and crt both are not defined and only one of them is defined and initialized. In such cases, while removing the device, unregister the framebuffer only if it was registered. Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | sm501fb: deallocate colormap only if allocatedSudip Mukherjee2017-11-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are cases when panel and crt both are not defined and only one of them is defined and initialized. In such cases, while removing the device deallocate the colormap only if that particular fb is defined. Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: goldfishfb: Add support for device tree bindingsAleksandar Markovic2017-11-091-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ability to the Goldfish FB driver to be recognized by OS via DT. Signed-off-by: Miodrag Dinic <miodrag.dinic@mips.com> Signed-off-by: Goran Ferenc <goran.ferenc@mips.com> Signed-off-by: Aleksandar Markovic <aleksandar.markovic@mips.com> Cc: Douglas Leung <douglas.leung@mips.com> Cc: James Hogan <james.hogan@mips.com> Cc: Paul Burton <paul.burton@mips.com> Cc: Petar Jovanovic <petar.jovanovic@mips.com> Cc: Raghu Gandham <raghu.gandham@mips.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: udlfb: Fix read EDID timeoutLadislav Michl2017-11-091-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While usb_control_msg function expects timeout in miliseconds, a value of HZ is used. Replace it with USB_CTRL_GET_TIMEOUT and also fix error message which looks like: udlfb: Read EDID byte 78 failed err ffffff92 as error is either negative errno or number of bytes transferred use %d format specifier. Returned EDID is in second byte, so return error when less than two bytes are received. Fixes: 18dffdf8913a ("staging: udlfb: enhance EDID and mode handling support") Signed-off-by: Ladislav Michl <ladis@linux-mips.org> Cc: Bernie Thompson <bernie@plugable.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: remove dead igafb driverBartlomiej Zolnierkiewicz2017-11-093-590/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | igafb driver hasn't compiled since at least kernel v2.6.34 as commit 6016a363f6b5 ("of: unify phandle name in struct device_node") missed updating igafb.c to use dp->phandle instead of dp->node. Cc: "David S. Miller" <davem@davemloft.net> Cc: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: mxsfb: fix pixelclock polarityStefan Agner2017-11-091-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PIXDATA flags of the display_flags enum are controller centric, e.g. NEGEDGE means the controller shall drive the data signals on pixelclocks negative edge. However, the drivers flag is display centric: Sample the data on negative (falling) edge. Therefore, change the if statement to check for the POSEDGE flag (which is typically not set): Drive on positive edge => sample on negative edge Signed-off-by: Stefan Agner <stefan@agner.ch> Acked-by: Shawn Guo <shawnguo@kernel.org> Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com> Cc: Sascha Hauer <s.hauer@pengutronix.de> Cc: Liu Ying <Ying.Liu@freescale.com> Cc: Lothar Waßmann <LW@KARO-electronics.de> Cc: Fabio Estevam <fabio.estevam@freescale.com> Cc: Max Krummenacher <max.krummenacher@toradex.com> Cc: Mauro Salvini <mauro.salvini@smigroup.net> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: au1200fb: Style clean upChristophe JAILLET2017-11-091-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Style clean-up. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: au1200fb: Propagate an error codeChristophe JAILLET2017-11-091-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We should propagate the error code returned by 'fb_alloc_cmap()' instead of returning -EFAULT. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: au1200fb: Remove some dead codeChristophe JAILLET2017-11-091-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no need to shut gcc up. It should not complain. Axe 'fbdev', it is never used in this function. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: au1200fb: Fix error handling pathChristophe JAILLET2017-11-091-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite the exit path based on 'au1200fb_drv_remove()'. We can safely iterate for all already handled planes. Even if not completely initialized, the functions that are called will silently accept the 'fb_info' structure that is passed. As soon as we find a NULL in the '_au1200fb_infos' array, we know that we have released all what we needed to release. So we can 'break'. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: au1200fb: Fix incorrect IRQ freeingChristophe JAILLET2017-11-091-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'au1200fb_drv_probe()' can not fail after a successful call to 'request_irq()'. So there is no point to call 'free_irq()' in the error handling path. Moreover, the hard coded AU1200_LCD_INT looks boggus since commit 1630d85a8312 ("au1200fb: fix hardcoded IRQ"). So, remove it. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Tejun Heo <tj@kernel.org> [b.zolnierkie: patch summary and description fixups] Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
| * | | video: fbdev: au1200fb: Release some resources if a memory allocation failsChristophe JAILLET2017-11-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We should go through the error handling code instead of returning -ENOMEM directly. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Tejun Heo <tj@kernel.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 07:18:10 +0100