| Age | Commit message (Collapse) | Author |
|---|
|
Some additional Gobi3K IDs found in the BSD/GPL licensed
out-of-tree GobiNet driver from Sierra Wireless.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 5e071b5d1aa6928f8d695c15f52a949d70b8d7fb)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit f7142e6c226076fd40c2ebaad9fb0c9a631b790e)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Add the ZTE (Vodafone) K3765-Z to the whitelist. This requires the
previous patch to make the whitelist with forced interface 4 generic
or the device fails to initialise. After applying this patch and
loading the Option driver without usb-modeswitch's bind all
interfaces trick, a wwan0 net interface and /dev/cdc-wdm0 device
file were created. Using Bjorn Mork's perl connection script a
connection was made to a mobile network using QMI and the network
interface's IPv4 address was configured OK.
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 8965c98fdebedce077257241957b205515dd1a5f)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Change the forced interface 4 whitelist to use the generic shared
binder instead of the Gobi specific one. Certain ZTE devices
(K3520-Z & K3765-Z) don't work with the Gobi version, but function
quite happily with the generic. This has been tested with the following
devices:
K3520-Z
K3565-Z
K3765-Z
K4505-Z
It hasn't been tested with the ZTE MF820D, which is the only other
device that uses this whitelist at present. Although Bjorn doesn't
expect any problems, any testing with that device would be appreciated.
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 00001880cd8faaa349fe2ebb158f7e0cd8026048)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Tested-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 88c16dc3bb61a1c1e9d4c78f45cc2107bc8d5249)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
The MC77xx devices can operate in two modes: "Direct IP" or "QMI",
switchable using a password protected AT command. Both product ID
and USB interface configuration will change when switched.
The "sierra_net" driver supports the "Direct IP" mode. This driver
supports the "QMI" mode.
There are also multiple possible USB interface configurations in each
mode, some providing more than one wwan interface. Like many other
devices made for Windows, different interface types are identified
using a static interface number. We define a Sierra specific
interface whitelist to support this.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 3bc17d10c9f8ac67eb474737d74894ef2e60d27c)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Now that we have the beginnings of an OSS method to use the network
interfaces on these USB broadband modems, add the ZTE manufactured
Vodafone items to the whitelist
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit dbb6d0956877b99e78b8e0dc0e4e56d9e936b5ab)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Now that we have the beginnings of an OSS method to use the network
interfaces on these USB broadband modems, add the ZTE manufactured
Vodafone items to the whitelist
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 1aa35a24a4451e414eddf3bd489dd362513ad246)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
ZTE have yet to discover the magic of USB descriptors. These
devices use ff/ff/ff for class/subclass/protocol regardless of
function, except for usb-storage. Use an interface number
whitelist to force the driver to bind only to the QMI/wwan
interface.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 11207b6fe05438b2e87a26435cd98db3d55e6fa7)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Adding the Pantech UML290 and all non-QDL Gobi device IDs from the
qcserial driver now that we have support for shared net/QMI USB
interfaces. Most of these are not yet tested with this driver, but
should be mostly identical to tested devices, except for device IDs.
Gobi devices provide several different interfaces (serial/net/other)
using the exact same class, subclass and protocol values. This driver
will only support the net/QMI function while there are other drivers
supporting other device functions. The net/QMI interface number may
also differ from device to device. It has been noted that all the
other interfaces have additional functional descriptors, so we use that
to detect the interface supported by this driver.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b086cf04fc1bfc89b306aab2fb0f67e3cc294037)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Use the new cdc-wdm subdriver interface to create a device management
device even for USB devices having a single combined QMI/wwan USB
interface with three endpoints (int, bulk in, bulk out) instead of
separate data and control interfaces.
Some Huawei devices can be switched to a single interface mode for
use with other operating systems than Linux. This adds support
for these devices when they run in such non-Linux modes.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c3ecb08abef7690c6bc2d22f099cf3ee56881a30)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Some WWAN LTE/3G devices based on chipsets from Qualcomm provide
near standard CDC ECM interfaces in addition to the usual serial
interfaces. The Huawei E392/E398 are examples of such devices.
These typically cannot be fully configured using AT commands
over a serial interface. It is necessary to speak the proprietary
Qualcomm MSM Interface (QMI) protocol to the device to enable the
ethernet proxy functionality.
The devices embed the QMI protocol in CDC on the control interface,
using standard CDC commands and notifications. The do not otherwise
use CDC commands for the ethernet function. This driver does
therefore not need access to any other aspects of the control
interface than the descriptors attached to it.
Another driver, cdc-wdm, will provide userspace access to the
QMI protocol independently of this driver. To facilitate this,
this driver avoids binding to the control interface, and uses
only the associated data interface after parsing the common CDC
functional descriptors on the control interface.
You will want both the cdc-wdm and option drivers as companions to
this driver, to have full access to all interfaces and protocols
exported by the device.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 423ce8caab7ea2b13f4a29ce0839369528aafaeb)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Prevents dereferencing an invalid struct usb_interface
pointer.
Always delete entry from device list whether or not the
rest of the device state cleanup is postponed. The device
list uses desc->intf as key, and wdm_open will dereference
this key while searching for a matching device. A device
should not appear in the list unless probe() has succeeded
and disconnect() has not finished.
Cc: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6286d85e8efdb59252d1ceb99a56fa6b0b11526c)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
We cannot dereference a removed USB interface for
dev_printk. Use pr_debug instead where necessary.
Flush errors are expected if device is unplugged and are
therefore best ingored at this point.
Move the kill_urbs() call in wdm_release with dev_dbg()
for the non disconnect, as we know it has already been
called if WDM_DISCONNECTING is set. This does not
actually fix anything, but keeps the code more consistent.
Cc: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6b0b79d38806481c1c8fffa7c5842f3c83679a42)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The internal error codes returned in the write() code
path cannot be simply passed on to user space.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Tested-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 12a98b2bd8050b3cf28b50da612c484cdf174368)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Device state cleanup is done in either wdm_disconnect or
wdm_release depending on the order they are called. Adding
a couple of debug messages to document the program flow.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 880bca3a2a6f159d7453e0cbcbfe2f1d8204d907)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
cleanup() is not called if the last close() comes after
disconnect(). That leads to a memory leak. Rectified
by checking for an earlier disconnect() in release()
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2f338c8a1904e2e7aa5a8bd12fb0cf2422d17da4)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
wdm_flush() returns unsanitized USB error codes.
They must be cleaned up to before being anded to user space
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 24a85bae5da2b43fed423859c09c5a81ab359473)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
This driver can be used as a subdriver of another USB driver, allowing
it to export a Device Managment interface consisting of a single interrupt
endpoint with no dedicated USB interface.
Some devices provide a Device Management function combined with a wwan
function in a single USB interface having three endpoints (bulk in/out
+ interrupt). If the interrupt endpoint is used exclusively for DM
notifications, then this driver can support that as a subdriver
provided that the wwan driver calls the appropriate entry points on
probe, suspend, resume, pre_reset, post_reset and disconnect.
The main driver must have full control over all interface related
settings, including the needs_remote_wakeup flag. A manage_power
function must be provided by the main driver.
A manage_power stub doing direct flag manipulation is used in normal
driver mode.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 3cc3615749dbd1b891512d5c9a5bf4559cfa9741)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Register all interfaces handled by this driver in a list, getting
rid of the dependency on usb_set_intfdata. This allows further
generalization and simplification of the probe/create functions.
This is needed to decouple wdm_open from the driver owning the
interface, and it also allows us to share all the code in
wdm_create with drivers unable to do usb_set_intfdata.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b0c13860808a528cd580fdca61aef9f73352a331)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Preparing for the addition of subdriver registering as an alternative
to probe for interface-less usage. This should not change anything
apart from minor code reordering.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0dffb4862a5f109dc9b72e3a4e0ecc85a87ce397)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
As Documentation/usb/dma.txt states:
Most drivers should *NOT* be using these primitives; they don't need
to use this type of memory (dma-coherent), and memory returned from
kmalloc() will work just fine.
This driver handle only very low bandwith transfers. It is not an
obvious candidate for usb_alloc_coherent().
Using these calls only serves to complicate the code for no gain,
as has been shown by multiple bugs related to this allocation path.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 8457d99cab81e91724b43363f7fccd851d766187)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Add a flag to tell wdm_read/wdm_write that a reset is in progress,
and wake any blocking read/write before taking the mutexes. This
allows the device to reset without waiting for blocking IO to
finish.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 88044202756925ad47c51c2f634a4f2c17afe068)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
[v2: Editorial changes suggested by Sergei Shtylyov]
These modems use the Qualcomm MSM Interface (QMI) protocol for
management of their CDC ECM like wwan interface. This driver
is perfect for exporting the protocol to userspace.
The created character device will be indistinguishable from a
common AT command based Device Management interface, so
userspace applications must do some intelligent matching
on the USB device.
Cc: Sergei Shtylyov <sshtylyov@mvista.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit fec67b45bf045582c3172101970090d640cd56d9)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
usb_register_dev() will change our .minor_base to 0 if
CONFIG_USB_DYNAMIC_MINORS is set. And it usually is, of
course.
Use dev_name() to print the proper interface name instead
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 820c629a595ad8d8f2694641e494738b18d29e7b)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
We don't need bMaxPacketSize0, and keeping all these different size fields
around will only cause us to use the wrong one.
Seems the udev variable was only used for getting bMaxPacketSize0. We
could have used it for the usb_fill_*_urb() calls, but as it wasn't
before - why start now? Instead make the interface_to_usbdev()
calls consistent.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 8143a8963c374116f84aba15dcaeaf02370c8098)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
Filling the same URB with the exact same data is pointless. It can be filled
once and resubmitted. And not doing buffer allocation and URB filling at the
same place only serves to hide size mismatch bugs
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 19b85b3b87fd1388df1f4a35969823521d35d243)
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
This reverts commit 811c72ba0a81cbbca676656341413dbbde20b438.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
This reverts commit 7569109b102712a5b04d5be7820d54f8dad93b90.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
This reverts commit 0c68ab1b23871bbfa1bb7e792d476e9618a749c0.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
This reverts commit 8fd4242d5ce7514591eff1b1170ab253b215a787.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
|
|
|
|
commit ea17e7414bc62e8d3bde8d08e3df1d921c518c17 upstream.
The symbol jiffies is created in the linker script as an alias to
jiffies_64. Unfortunately this is done outside any section, and
apparently GNU ld 2.21 doesn't carry the section with it, so we end up
with an absolute symbol and therefore a broken kernel.
Add jiffies and jiffies_64 to the whitelist.
The most disturbing bit with this discovery is that it shows that we
have had multiple linker bugs in this area crossing multiple
generations, and have been silently building bad kernels for some time.
Link: http://lkml.kernel.org/r/20120524171604.0d98284f3affc643e9714470@canb.auug.org.au
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit fd952815307f0f272bf49fd364a7fd2f9992bc42 upstream.
As noted in checkin:
a3e854d95 x86, relocs: Workaround for binutils 2.22.52.0.1 section bug
ld version 2.22.52.0.[12] can incorrectly promote relative symbols to
absolute, if the output section they appear in is otherwise empty.
Since checkin:
6520fe55 x86, realmode: 16-bit real-mode code support for relocs tool
we actually check for this and error out rather than silently creating
a kernel which will malfunction if relocated.
Ingo found a configuration in which __start_builtin_fw triggered the
warning.
Go through the linker script sources and look for more symbols that
could plausibly get bogusly promoted to absolute, and add them to the
whitelist.
In general, if the following error triggers:
Invalid absolute R_386_32 relocation: <symbol>
... then we should verify that <symbol> is really meant to be
relocated, and add it and any related symbols manually to the S_REL
regexp.
Please note that 6520fe55 does not introduce the error, only the check
for the error -- without 6520fe55 this version of ld will simply
produce a corrupt kernel if CONFIG_RELOCATABLE is set on x86-32.
Reported-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit b2d668da9307c4c163dd603d2bb3cadb10f9fd37 upstream.
relocs was not cleaned up when "make clean" is issued. This
patch fixes the issue.
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
Link: http://lkml.kernel.org/r/1337622684-6834-1-git-send-email-jarkko.sakkinen@intel.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 24ab82bd9bf18f3efc69a131d73577940941e1b7 upstream.
When the relocs tool throws an error, let the error message say if it
is an absolute or relative symbol. This should make it a lot more
clear what action the programmer needs to take and should help us find
the reason if additional symbol bugs show up.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit a3e854d95a76862cd37937e0b0438f540536771a upstream.
GNU ld 2.22.52.0.1 has a bug that it blindly changes symbols from
section-relative to absolute if they are in a section of zero length.
This turns the symbols __init_begin and __init_end into absolute
symbols. Let the relocs program know that those should be treated as
relative symbols.
Reported-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Cc: H.J. Lu <hjl.tools@gmail.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 6520fe5564acf07ade7b18a1272db1184835c487 upstream.
A new option is added to the relocs tool called '--realmode'.
This option causes the generation of 16-bit segment relocations
and 32-bit linear relocations for the real-mode code. When
the real-mode code is moved to the low-memory during kernel
initialization, these relocation entries can be used to
relocate the code properly.
In the assembly code 16-bit segment relocations must be relative
to the 'real_mode_seg' absolute symbol. Linear relocations must be
relative to a symbol prefixed with 'pa_'.
16-bit segment relocation is used to load cs:ip in 16-bit code.
Linear relocations are used in the 32-bit code for relocatable
data references. They are declared in the linker script of the
real-mode code.
The relocs tool is moved to arch/x86/tools/relocs.c, and added new
target archscripts that can be used to build scripts needed building
an architecture. be compiled before building the arch/x86 tree.
[ hpa: accelerating this because it detects invalid absolute
relocations, a serious bug in binutils 2.22.52.0.x which currently
produces bad kernels. ]
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1336501366-28617-2-git-send-email-jarkko.sakkinen@intel.com
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@vger.kernel.org>
[bwh: Backported to 3.2:
- Adjust context (no archheaders; no insn_sanity)
- Expand put_unaligned_le32()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 9868a060ccf769c08ec378a9829137e272e9a92c upstream.
The freed IRQ is not necessary the one requested in probe.
Even if it was, with two or more i2c-controllers it will fails anyway.
Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit c889e91d2cc22123f20f40dde0c0a91856a20eea upstream.
The notification of the transfer complete by calling complete()
should be done after clearing all interrupt status.
This avoids the race condition of misconfigure the i2c controller
in multi-core environment.
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 5794d21ef4639f0e33440927bb903f9598c21e92 upstream.
When attempting to cache ACLs returned from the server, if the bitmap
size + the ACL size is greater than a PAGE_SIZE but the ACL size itself
is smaller than a PAGE_SIZE, we can read past the buffer page boundary.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reported-by: Jian Li <jiali@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 5a00689930ab975fdd1b37b034475017e460cf2a upstream.
Bug noticed in commit
bf118a342f10dafe44b14451a1392c3254629a1f
When calling GETACL, if the size of the bitmap array, the length
attribute and the acl returned by the server is greater than the
allocated buffer(args.acl_len), we can Oops with a General Protection
fault at _copy_from_pages() when we attempt to read past the pages
allocated.
This patch allocates an extra PAGE for the bitmap and checks to see that
the bitmap + attribute_length + ACLs don't exceed the buffer space
allocated to it.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reported-by: Jian Li <jiali@redhat.com>
[Trond: Fixed a size_t vs unsigned int printk() warning]
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit de040beccd52bb5fcac90031505384d037b1111c upstream.
compile in nfs-for-3.3 branch shows following warnings. Fix it here.
fs/nfs/nfs4proc.c: In function ‘__nfs4_get_acl_uncached’:
fs/nfs/nfs4proc.c:3589: warning: format ‘%ld’ expects type ‘long int’, but argument 4 has type ‘size_t’
fs/nfs/nfs4proc.c:3589: warning: format ‘%ld’ expects type ‘long int’, but argument 6 has type ‘size_t’
Signed-off-by: Peng Tao <peng_tao@emc.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit a7959c1394d4126a70a53b914ce4105f5173d0aa upstream.
The current version of rtlwifi for USB operations uses kmalloc to
acquire a 32-bit buffer for each read of the device. When
_usb_read_sync() is called with the rcu_lock held, the result is
a "sleeping function called from invalid context" BUG. This is
reported for two cases in https://bugzilla.kernel.org/show_bug.cgi?id=42775.
The first case has the lock originating from within rtlwifi and could
be fixed by rearranging the locking; however, the second originates from
within mac80211. The kmalloc() call is removed from _usb_read_sync()
by creating a ring buffer pointer in the private area and
allocating the buffer data in the probe routine.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
[This version will apply to 3.2 and earlier. - Larry]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit c0a5f4a05af588a0f9951f8d24e2564b09501918 upstream.
The reset date of the ST Micro version of PL031 is 2000-01-01. The
correct weekday for 2000-01-01 is saturday, but pl031 is initialized to
sunday. This may lead to alarm malfunction, so configure the correct
wday if RTC_DR indicates reset.
Signed-off-by: Rajkumar Kasirajan <rajkumar.kasirajan@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Cc: Mattias Wallin <mattias.wallin@stericsson.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 080399aaaf3531f5b8761ec0ac30ff98891e8686 upstream.
Hi,
We have a bug report open where a squashfs image mounted on ppc64 would
exhibit errors due to trying to read beyond the end of the disk. It can
easily be reproduced by doing the following:
[root@ibm-p750e-02-lp3 ~]# ls -l install.img
-rw-r--r-- 1 root root 142032896 Apr 30 16:46 install.img
[root@ibm-p750e-02-lp3 ~]# mount -o loop ./install.img /mnt/test
[root@ibm-p750e-02-lp3 ~]# dd if=/dev/loop0 of=/dev/null
dd: reading `/dev/loop0': Input/output error
277376+0 records in
277376+0 records out
142016512 bytes (142 MB) copied, 0.9465 s, 150 MB/s
In dmesg, you'll find the following:
squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 43.106012] attempt to access beyond end of device
[ 43.106029] loop0: rw=0, want=277410, limit=277408
[ 43.106039] Buffer I/O error on device loop0, logical block 138704
[ 43.106053] attempt to access beyond end of device
[ 43.106057] loop0: rw=0, want=277412, limit=277408
[ 43.106061] Buffer I/O error on device loop0, logical block 138705
[ 43.106066] attempt to access beyond end of device
[ 43.106070] loop0: rw=0, want=277414, limit=277408
[ 43.106073] Buffer I/O error on device loop0, logical block 138706
[ 43.106078] attempt to access beyond end of device
[ 43.106081] loop0: rw=0, want=277416, limit=277408
[ 43.106085] Buffer I/O error on device loop0, logical block 138707
[ 43.106089] attempt to access beyond end of device
[ 43.106093] loop0: rw=0, want=277418, limit=277408
[ 43.106096] Buffer I/O error on device loop0, logical block 138708
[ 43.106101] attempt to access beyond end of device
[ 43.106104] loop0: rw=0, want=277420, limit=277408
[ 43.106108] Buffer I/O error on device loop0, logical block 138709
[ 43.106112] attempt to access beyond end of device
[ 43.106116] loop0: rw=0, want=277422, limit=277408
[ 43.106120] Buffer I/O error on device loop0, logical block 138710
[ 43.106124] attempt to access beyond end of device
[ 43.106128] loop0: rw=0, want=277424, limit=277408
[ 43.106131] Buffer I/O error on device loop0, logical block 138711
[ 43.106135] attempt to access beyond end of device
[ 43.106139] loop0: rw=0, want=277426, limit=277408
[ 43.106143] Buffer I/O error on device loop0, logical block 138712
[ 43.106147] attempt to access beyond end of device
[ 43.106151] loop0: rw=0, want=277428, limit=277408
[ 43.106154] Buffer I/O error on device loop0, logical block 138713
[ 43.106158] attempt to access beyond end of device
[ 43.106162] loop0: rw=0, want=277430, limit=277408
[ 43.106166] attempt to access beyond end of device
[ 43.106169] loop0: rw=0, want=277432, limit=277408
...
[ 43.106307] attempt to access beyond end of device
[ 43.106311] loop0: rw=0, want=277470, limit=2774
Squashfs manages to read in the end block(s) of the disk during the
mount operation. Then, when dd reads the block device, it leads to
block_read_full_page being called with buffers that are beyond end of
disk, but are marked as mapped. Thus, it would end up submitting read
I/O against them, resulting in the errors mentioned above. I fixed the
problem by modifying init_page_buffers to only set the buffer mapped if
it fell inside of i_size.
Cheers,
Jeff
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Acked-by: Nick Piggin <npiggin@kernel.dk>
--
Changes from v1->v2: re-used max_block, as suggested by Nick Piggin.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 786f528119722f564a22ad953411374e06116333 upstream.
The parameters for ETHTOOL_FLASHDEV include a filename, which ought to
be null-terminated. Currently the only driver that implements
ethtool_ops::flash_device attempts to add a null terminator if
necessary, but does it wrongly. Do it in the ethtool core instead.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit e2ad23d04c1304431ab5176c89b7b476ded2d995 upstream.
Add device info into list before doing context mapping, because device
info will be used by iommu_enable_dev_iotlb(). Without it, ATS won't get
enabled as it should be.
ATS, while a dubious decision from a security point of view, can be very
important for performance.
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
Signed-off-by: Xiantao Zhang <xiantao.zhang@intel.com>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 9f1d62bed7f015d11b9164078b7fea433b474114 upstream.
This is because __builtin_clz(0) returns 64 for the "undefined" case
of 0, since the builtin just does a right-shift 32 and "clz" instruction.
So, use the alpha approach of casting to u32 and using __builtin_clzll().
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
commit 875e26648cf9b6db9d8dc07b7959d7c61fb3f49c upstream.
Linus pointed out that there was no value is checking whether m->ip
was zero - because zero is a legimate value. If we have a reliable
(or faked in the VM86 case) "m->cs" we can use it to tell whether we
were in user mode or kernelwhen the machine check hit.
Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
Bjørn Mork
Andrew Bird (Sphere Systems)
Oliver Neukum
Ben Hutchings
H. Peter Anvin
Jarkko Sakkinen
H. Peter Anvin
Marcus Folkesson
Laxman Dewangan
Sachin Prabhu
Peng Tao
Larry Finger
Rajkumar Kasirajan
Jeff Moyer
Ben Hutchings
David Woodhouse
Chris Metcalf
Tony Luck