aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2021-09-30PCI: endpoint: Use sysfs_emit() in "show" functionsKunihiko Hayashi2-9/+8
Convert sprintf() in sysfs "show" functions to sysfs_emit() in order to check for buffer overruns in sysfs outputs. Link: https://lore.kernel.org/r/1630472957-26857-1-git-send-email-hayashi.kunihiko@socionext.com Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
2021-09-30power: supply: core: Move psy_has_property() to fix buildGeert Uytterhoeven1-16/+16
If CONFIG_THERMAL=n: drivers/power/supply/power_supply_core.c: In function ‘__power_supply_register’: drivers/power/supply/power_supply_core.c:1137:6: error: implicit declaration of function ‘psy_has_property’ [-Werror=implicit-function-declaration] 1137 | if (psy_has_property(desc, POWER_SUPPLY_PROP_USB_TYPE) && | ^~~~~~~~~~~~~~~~ Fix this by moving psy_has_property() outside the section protected by CONFIG_THERMAL. Fixes: 9ba533eb99bb2acf ("power: supply: core: Add psy_has_property()") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2021-09-30drm/i915: Add ww context to intel_dpt_pin, v2.Maarten Lankhorst1-15/+25
Ensure i915_vma_pin_iomap and vma_unpin are done with dpt->obj lock held. I don't think there's much of a point in merging intel_dpt_pin() with intel_pin_fb_obj_dpt(), they touch different objects. Changes since v1: - Fix using the wrong pointer to retrieve error code (Julia) Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reported-by: kernel test robot <lkp@intel.com> Reported-by: Julia Lawall <julia.lawall@lip6.fr> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210929085950.3063191-1-maarten.lankhorst@linux.intel.com
2021-09-30PCI: xgene: Use PCI_VENDOR_ID_AMCC macroPali Rohár1-2/+1
Header file linux/pci_ids.h defines AMCC vendor id (0x10e8) macro named PCI_VENDOR_ID_AMCC. So use this macro instead of driver custom macro. Link: https://lore.kernel.org/r/20210927134356.11799-1-pali@kernel.org Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
2021-09-30PCI: dra7xx: Get an optional clockLuca Ceresoli1-0/+13
If the clock is provided externally we need to make sure it is enabled before starting PCI scan. Link: https://lore.kernel.org/r/20210531085934.2662457-5-luca@lucaceresoli.net Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
2021-09-30PCI: dra7xx: Remove unused includeLuca Ceresoli1-1/+0
Unused since commit e259c2926c01 ("PCI: pci-dra7xx: Prepare for deferred probe with module_platform_driver"). Link: https://lore.kernel.org/r/20210531085934.2662457-4-luca@lucaceresoli.net Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
2021-09-30PCI: dra7xx: Make it a kernel moduleLuca Ceresoli2-4/+10
Enable building the driver as a loadable kernel module. Link: https://lore.kernel.org/r/20210531085934.2662457-3-luca@lucaceresoli.net Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
2021-09-30PCI: dwc: Export more symbols to allow modular driversLuca Ceresoli2-0/+2
These symbols are used by the pci-dra7xx driver. Export them to allow building pci-dra7xx as a module. Link: https://lore.kernel.org/r/20210531085934.2662457-2-luca@lucaceresoli.net Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
2021-09-30drm/i915: Configure TRANSCONF just the once with bigjoinerVille Syrjälä1-2/+1
Let's not configure the single transcoder's TRANSCONF multiple times with bigjoiner. No real harm I suppose but since we already have the bigjoiner if statement directly above might as well suck this in there and skip the redundant programming. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210913144440.23008-11-ville.syrjala@linux.intel.com Reviewed-by: Manasi Navare <manasi.d.navare@intel.com>
2021-09-30drm/i915: Pimp HSW+ transcoder state readoutVille Syrjälä1-35/+95
Adjust the HSW+ transcoder state readout to just read through all the possible transcoders for the pipe, and stuff the results in a bitmask. We can conveniently cross check the bitmask for invalid combinations of enabled transcoders, and later we can easily extend the bitmask readout to handle the bigjoiner case. One slight change in behaviour is that we no longer read out the AONOFF->force_pfit.pfit bit for all the enabled "panel transcoders". But having more than one enabled would anyway be illegal so no big loss. Also the AONOFF selection should only ever be used on HSW, which only has the EDP transcoder an no DSI transcoders. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210913144440.23008-10-ville.syrjala@linux.intel.com Reviewed-by: Manasi Navare <manasi.d.navare@intel.com>
2021-09-30clk: imx: Rework all clk_hw_register_gate2 wrappersAbel Vesa1-51/+26
Instead of having multiple inline functions that were calling clk_hw_register_gate2, implement a generic low-level __imx_clk_hw_gate2 and implement the rest as macros that pass on as arguments whatever is needed in each case. Signed-off-by: Abel Vesa <abel.vesa@nxp.com> Link: https://lore.kernel.org/r/1631521490-17171-5-git-send-email-abel.vesa@nxp.com Reviewed-by: Stephen Boyd <sboyd@kernel.org>
2021-09-30drm/i915/fbc: Allow FBC with Yf tilingVille Syrjälä1-0/+1
FBC+Yf tiling seems to work just fine, and unlike with linear the hardware does appear to correctly calculate the CFB stride with using the override stride on both cfl and glk. So no need for any additional tweaks. Cc: Uma Shankar <uma.shankar@intel.com> #v2 Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210924141330.1515-1-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar <uma.shankar@intel.com>
2021-09-30soc: ti: omap-prm: Fix external abort for am335x prussTony Lindgren1-12/+15
Starting with v5.15-rc1, we may now see some am335x beaglebone black device produce the following error on pruss probe: Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0326000 This has started with the enabling of pruss for am335x in the dts files. Turns out the is caused by the PRM reset handling not waiting for the reset bit to clear. To fix the issue, let's always wait for the reset bit to clear, even if there is a separate reset status register. We attempted to fix a similar issue for dra7 iva with a udelay() in commit effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva"). There is no longer a need for the udelay() for dra7 iva reset either with the check added for reset bit clearing. Cc: Drew Fustini <pdp7pdp7@gmail.com> Cc: Grygorii Strashko <grygorii.strashko@ti.com> Cc: "H. Nikolaus Schaller" <hns@goldelico.com> Cc: Robert Nelson <robertcnelson@gmail.com> Cc: Yongqin Liu <yongqin.liu@linaro.org> Fixes: effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva") Reported-by: Matti Vaittinen <mazziesaccount@gmail.com> Tested-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2021-09-30drm/i915: Enable TPS3/4 on all platforms that support themVille Syrjälä4-26/+22
Stop using HBR2/3 support as a proxy for TPS3/4 support. The two are no longer 1:1 in the hardware, arguably they never were due to HSW ULX which does support TPS3 while being limited to HBR1. In more recent times GLK gained support for TPS4 while being limited to HBR2. And on CNL+ some ports support HBR3 while others are limited to HBR2, but all ports support TPS4. v2: s/INTEL_GEN/DISPLAY_VER/ Reviewed-by: Manasi Navare <manasi.d.navare@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210929162404.6717-1-ville.syrjala@linux.intel.com Acked-by: Jani Nikula <jani.nikula@intel.com>
2021-09-30drm/i915: Drop pointless fixed_mode checks from dsi codeVille Syrjälä2-33/+23
We don't support dsi displays without a fixed mode, so drop all the pointless checks. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210923200109.4459-7-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula <jani.nikula@intel.com>
2021-09-30drm/i915: Reject user modes that don't match fixed mode's refresh rateVille Syrjälä1-0/+15
When using a panel with a fixed mode we don't change the refresh rate of the display. Reject any user requested mode which doesn't match that fixed refresh rate. Unfortunately when Xorg sees the scaling_mode property on the connecor it likes to automagically cook up modes whose refresh rate is a fair bit off from the fixed refresh rate we use. So we have to give it some extra latitude so that we don't start to reject all of it. v2: sDVO now uses intel_panel_compute_config() too v3: Add a debug message to inform the user what happened References: https://gitlab.freedesktop.org/drm/intel/-/issues/2939 References: https://gitlab.freedesktop.org/drm/intel/-/issues/3969 Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210929184536.8332-1-ville.syrjala@linux.intel.com
2021-09-30drm/i915: Introduce intel_panel_compute_config()Ville Syrjälä8-12/+39
Let's introduce a compute_config() helper for fixed mode panels. For now all it does is the fixed_mode->adjusted_mode copy. Note that with sDVO we have to ask the external encoder chip to spit out our actual display timings for us, so the fixed_mode to adjusted_mode copy done by intel_panel_compute_config() is redundant, but we still want to use it to do other checks for us later. We'll be fine so long as we only call it before intel_sdvo_get_preferred_input_mode() overwrites adjusted_mode with the timings from the encoder. v2: Use intel_panel_compute_config() with sDVO Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210927185207.13620-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula <jani.nikula@intel.com>
2021-09-30drm/i915: Reject modes that don't match fixed_mode vrefreshVille Syrjälä1-0/+3
When using a fixed mode we won't change the refresh rate ever. So filter out all modes that don't match the fixed_mode's refresh rate. I'm going to declare the "rounded to nearest Hz refresh rates must match" approach good enough for now. Note that we could start supporting multiple refresh rates with panels that can do it, but that would mean replacing the single fixed mode concept with a list of fixed modes. Then we could look for the closest match to the user's requested refresh rate and use that. But all of that would be a fair bit of work so we'll leave it for later. References: https://gitlab.freedesktop.org/drm/intel/-/issues/2939 References: https://gitlab.freedesktop.org/drm/intel/-/issues/3969 Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210923200109.4459-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula <jani.nikula@intel.com>
2021-09-30drm/i915: Use intel_panel_mode_valid() for DSI/LVDS/(s)DVOVille Syrjälä4-22/+25
All fixed mode panels should behave the same way when it comes to mode filtering. Reuse the intel_panel_mode_valid() for all of them. This changes the behaviour to match what we do for eDP, ie. reject anything that doesn't exactly match the fixed mode dimensions. Users can still manually provide different sized modes which will be handled by the panel fitter just as before. The difference is that we can no longer report funny modes in the connector's mode list. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210923200109.4459-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula <jani.nikula@intel.com>
2021-09-30drm/i915: Extract intel_panel_mode_valid()Ville Syrjälä3-5/+24
Extract intel_panel_mode_valid() from the eDP code to a generic helper. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210923200109.4459-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula <jani.nikula@intel.com>
2021-09-30media: ir_toy: prevent device from hanging during transmitSean Young1-1/+20
If the IR Toy is receiving IR while a transmit is done, it may end up hanging. We can prevent this from happening by re-entering sample mode just before issuing the transmit command. Link: https://github.com/bengtmartensson/HarcHardware/discussions/25 Cc: stable@vger.kernel.org [mchehab: renamed: s/STATE_RESET/STATE_COMMAND_NO_RESP/ ] Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30platform/chrome: cros_ec_typec: Use cros_ec_command()Prashant Malani1-50/+19
Re-use the existing cros_ec_command() instead of relying on a duplicate version. Signed-off-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Link: https://lore.kernel.org/r/20210930022403.3358070-6-pmalani@chromium.org
2021-09-30platform/chrome: cros_ec_proto: Add version for ec_commandPrashant Malani2-1/+4
Add a version parameter to cros_ec_command() for callers that may want to specify which version of the host command they would like to use. Signed-off-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Link: https://lore.kernel.org/r/20210930022403.3358070-5-pmalani@chromium.org
2021-09-30platform/chrome: cros_ec_proto: Make data pointers voidPrashant Malani2-3/+3
Convert the input and output data pointers for cros_ec_command() to void pointers so that the callers don't have to cast their custom structs to uint8_t *. Signed-off-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Link: https://lore.kernel.org/r/20210930022403.3358070-4-pmalani@chromium.org
2021-09-30platform/chrome: cros_usbpd_notify: Move ec_command()Prashant Malani2-44/+45
cros_ec_command() can be used by other modules too. So, move it to a common location and export it. This patch does not introduce any functional changes. Signed-off-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Link: https://lore.kernel.org/r/20210930022403.3358070-3-pmalani@chromium.org
2021-09-30platform/chrome: cros_usbpd_notify: Rename cros_ec_pd_command()Prashant Malani1-11/+9
Rename cros_ec_pd_command()_to cros_ec_command() since it can be used for sending any host command, and not just PD related ones. This patch does not introduce any functional changes. Signed-off-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Link: https://lore.kernel.org/r/20210930022403.3358070-2-pmalani@chromium.org
2021-09-30platform/chrome: cros_ec: Fix spelling mistake "responsed" -> "response"Colin Ian King1-2/+2
There are spelling mistakes in dev_warn messages. Fix them. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> Link: https://lore.kernel.org/r/20210925171743.173219-1-colin.king@canonical.com
2021-09-30ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvmZelin Deng1-7/+2
hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements; if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is 64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with "src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and a wild pointer. Change it to "this_cpu_pvti()" which is guaranteed to be valid. Fixes: 95a3d4454bb1 ("Switch kvmclock data to a PER_CPU variable") Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com> Cc: <stable@vger.kernel.org> Message-Id: <1632892429-101194-3-git-send-email-zelin.deng@linux.alibaba.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-09-30media: s5p-jpeg: rename JPEG marker constants to prevent build warningsRandy Dunlap2-23/+23
The use of a macro named 'RST' conflicts with one of the same name in arch/mips/include/asm/mach-rc32434/rb.h. This causes build warnings on some MIPS builds. Change the names of the JPEG marker constants to be in their own namespace to fix these build warnings and to prevent other similar problems in the future. Fixes these build warnings: In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c:14: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 | ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-s5p.c:13: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos4.c:12: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) In file included from ../drivers/media/platform/s5p-jpeg/jpeg-core.c:31: ../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined 43 | #define RST 0xd0 ../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition 13 | #define RST (1 << 15) Also update the kernel-doc so that the word "marker" is not repeated. Link: https://lore.kernel.org/linux-media/20210907044022.30602-1-rdunlap@infradead.org Fixes: bb677f3ac434 ("[media] Exynos4 JPEG codec v4l2 driver") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: kernel test robot <lkp@intel.com> Cc: Andrzej Pietrasiewicz <andrzejtp2010@gmail.com> Cc: Jacek Anaszewski <jacek.anaszewski@gmail.com> Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: cedrus: Fix SUNXI tile size calculationNicolas Dufresne1-1/+1
Tiled formats requires full rows being allocated (even for Chroma planes). When the number of Luma tiles is odd, we need to round up to twice the tile width in order to roundup the number of Chroma tiles. This was notice with a crash running BA1_FT_C compliance test using sunxi tiles using GStreamer. Cedrus driver would allocate 9 rows for Luma, but only 4.5 rows for Chroma, causing userspace to crash. Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Fixes: 50e761516f2b8 ("media: platform: Add Cedrus VPU decoder driver") Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: hantro: Fix check for single irqJernej Skrabec1-1/+1
Some cores use only one interrupt and in such case interrupt name in DT is not needed. Driver supposedly accounted that, but due to the wrong field check it never worked. Fix that. Fixes: 18d6c8b7b4c9 ("media: hantro: add fallback handling for single irq/clk") Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com> Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com> Reviewed-by: Emil Velikov <emil.velikov@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30watchdog/sb_watchdog: fix compilation problem due to COMPILE_TESTJackie Liu1-1/+1
Compiling sb_watchdog needs to clearly define SIBYTE_HDR_FEATURES. In arch/mips/sibyte/Platform like: cflags-$(CONFIG_SIBYTE_BCM112X) += \ -I$(srctree)/arch/mips/include/asm/mach-sibyte \ -DSIBYTE_HDR_FEATURES=SIBYTE_HDR_FMASK_1250_112x_ALL Otherwise, SIBYTE_HDR_FEATURES is SIBYTE_HDR_FMASK_ALL. SIBYTE_HDR_FMASK_ALL is mean: #define SIBYTE_HDR_FMASK_ALL SIBYTE_HDR_FMASK_1250_ALL | SIBYTE_HDR_FMASK_112x_ALL \ | SIBYTE_HDR_FMASK_1480_ALL) So, If not limited to CPU_SB1, we will get such an error: arch/mips/include/asm/sibyte/bcm1480_scd.h:261: error: "M_SPC_CFG_CLEAR" redefined [-Werror] arch/mips/include/asm/sibyte/bcm1480_scd.h:262: error: "M_SPC_CFG_ENABLE" redefined [-Werror] Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") Signed-off-by: Jackie Liu <liuyun01@kylinos.cn> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-09-30HID: amd_sfh: Fix potential NULL pointer dereferenceBasavaraj Natikar1-8/+4
The cl_data field of a privdata must be allocated and updated before using in amd_sfh_hid_client_init() function. Hence handling NULL pointer cl_data accordingly. Fixes: d46ef750ed58 ("HID: amd_sfh: Fix potential NULL pointer dereference") Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-09-30HID: u2fzero: ignore incomplete packets without dataAndrej Shadura1-1/+3
Since the actual_length calculation is performed unsigned, packets shorter than 7 bytes (e.g. packets without data or otherwise truncated) or non-received packets ("zero" bytes) can cause buffer overflow. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437 Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-09-30HID: amd_sfh: Fix potential NULL pointer dereferenceEvgeny Novikov1-1/+5
devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at registration that will cause NULL pointer dereference since corresponding data is not initialized yet. The patch moves initialization of data before devm_add_action_or_reset(). Found by Linux Driver Verification project (linuxtesting.org). [jkosina@suse.cz: rebase] Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-09-30HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDsJoshua-Dickens1-0/+8
Add the new PIDs to wacom_wac.c to support the new models in the Intuos series. [jkosina@suse.cz: fix changelog] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-09-30HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JISMizuho Mori1-0/+7
Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong. Below is a report descriptor. 0x05, 0x01, /* Usage Page (Desktop), */ 0x09, 0x06, /* Usage (Keyboard), */ 0xA1, 0x01, /* Collection (Application), */ 0x85, 0x01, /* Report ID (1), */ 0x05, 0x07, /* Usage Page (Keyboard), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ 0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */ 0x29, 0xE7, /* Usage Maximum (KB Right GUI), */ 0x75, 0x01, /* Report Size (1), */ 0x95, 0x08, /* Report Count (8), */ 0x81, 0x02, /* Input (Variable), */ 0x95, 0x05, /* Report Count (5), */ 0x75, 0x01, /* Report Size (1), */ 0x05, 0x08, /* Usage Page (LED), */ 0x19, 0x01, /* Usage Minimum (01h), */ 0x29, 0x05, /* Usage Maximum (05h), */ 0x91, 0x02, /* Output (Variable), */ 0x95, 0x01, /* Report Count (1), */ 0x75, 0x03, /* Report Size (3), */ 0x91, 0x03, /* Output (Constant, Variable), */ 0x95, 0x08, /* Report Count (8), */ 0x75, 0x01, /* Report Size (1), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ here is a report descriptor which is parsed one in kernel. see sys/kernel/debug/hid/<dev>/rdesc 05 01 09 06 a1 01 85 01 05 07 15 00 25 01 19 e0 29 e7 75 01 95 08 81 02 95 05 75 01 05 08 19 01 29 05 91 02 95 01 75 03 91 03 95 08 75 01 15 00 25 01 06 00 ff 09 03 81 03 95 06 75 08 15 00 25 [65] 05 07 19 00 29 [65] 81 00 95 01 75 01 15 00 25 01 05 0c 09 b8 81 02 95 01 75 01 06 01 ff 09 03 81 02 95 01 75 06 81 03 06 02 ff 09 55 85 55 15 00 26 ff 00 75 08 95 40 b1 a2 c0 06 00 ff 09 14 a1 01 85 90 05 84 75 01 95 03 15 00 25 01 09 61 05 85 09 44 09 46 81 02 95 05 81 01 75 08 95 01 15 00 26 ff 00 09 65 81 02 c0 00 Position 64(Logical Maximum) and 70(Usage Maximum) are 101. Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support. position 117 is also 101 but not related(it is Usage 65h). There are no difference of product id between JIS and ANSI. They are same 0x0267. Signed-off-by: Mizuho Mori <morimolymoly@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-09-30HID: betop: fix slab-out-of-bounds Write in betop_probeF.A.Sulaiman1-3/+10
Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk> Reviewed-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2021-09-30media: dvb-frontends/cxd2099: Remove repeated verbose license textCai Huoqing2-18/+0
remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: dvb-frontends/stv0910: Remove repeated verbose license textCai Huoqing2-18/+0
remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: dvb-frontends/stv6111: Remove repeated verbose license textCai Huoqing2-18/+0
remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: dvb-frontend/mxl5xx: Remove repeated verbose license textCai Huoqing4-32/+0
remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: dvb-frontend/mxl692: Remove repeated verbose license textCai Huoqing3-27/+0
remove it because SPDX-License-Identifier is already used Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: mceusb: return without resubmitting URB in case of -EPROTO error.Rajat Asthana1-0/+1
Syzkaller reported a warning called "rcu detected stall in dummy_timer". The error seems to be an error in mceusb_dev_recv(). In the case of -EPROTO error, the routine immediately resubmits the URB. Instead it should return without resubmitting URB. Reported-by: syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com Signed-off-by: Rajat Asthana <rajatasthana4@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: mxl111sf: change mutex_init() locationPavel Skripkin1-2/+14
Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls: dvb_usbv2_init() dvb_usbv2_adapter_init() dvb_usbv2_adapter_frontend_init() props->frontend_attach() props->init() Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() internally we need to initialize state->msg_lock before frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* devices, which will simply initiaize mutex. Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com Fixes: 8572211842af ("[media] mxl111sf: convert to new DVB USB") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: meson-ir-tx: fix platform_no_drv_owner.cocci warningsjing yangyang1-1/+0
./drivers/media/rc/meson-ir-tx.c:398:3-8: No need to set .owner here. The core will do it. Remove .owner field if calls are used which set it automatically Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: jing yangyang <jing.yangyang@zte.com.cn> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: ir_toy: do not resubmit broken urbSean Young1-2/+12
This causes the same urb to resubmitted continuously, hogging up a cpu. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: ir_toy: deal with residual irdata before expected responseSean Young1-6/+2
After sending the start transmit command, the device is supposed to respond with the length of the buffer which can be sent. There might be some residual ir data there. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: ir_toy: print firmware version in correct formatSean Young1-2/+3
A value of 25 means firmware version 2.5. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-09-30media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receiversSean Young1-0/+1
The IR receiver has two issues: - Sometimes there is no response to a button press - Sometimes a button press is repeated when it should not have been Hanging the polling interval fixes this behaviour. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994050 Cc: stable@vger.kernel.org Suggested-by: Joaquín Alberto Calderón Pozo <kini_calderon@hotmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.