From 423de92f56bdfc3e68503af31e6ec041d59a6a25 Mon Sep 17 00:00:00 2001 From: Rasmus Villemoes Date: Thu, 24 Mar 2016 10:38:04 +0200 Subject: mei: bus: use scnprintf in *_show There's no reason to duplicate the logic provided by scnprintf(). Signed-off-by: Rasmus Villemoes Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/bus.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index 5d5996e39a67..04dc05150898 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -634,11 +634,8 @@ static ssize_t name_show(struct device *dev, struct device_attribute *a, char *buf) { struct mei_cl_device *cldev = to_mei_cl_device(dev); - size_t len; - len = snprintf(buf, PAGE_SIZE, "%s", cldev->name); - - return (len >= PAGE_SIZE) ? (PAGE_SIZE - 1) : len; + return scnprintf(buf, PAGE_SIZE, "%s", cldev->name); } static DEVICE_ATTR_RO(name); @@ -647,11 +644,8 @@ static ssize_t uuid_show(struct device *dev, struct device_attribute *a, { struct mei_cl_device *cldev = to_mei_cl_device(dev); const uuid_le *uuid = mei_me_cl_uuid(cldev->me_cl); - size_t len; - - len = snprintf(buf, PAGE_SIZE, "%pUl", uuid); - return (len >= PAGE_SIZE) ? (PAGE_SIZE - 1) : len; + return scnprintf(buf, PAGE_SIZE, "%pUl", uuid); } static DEVICE_ATTR_RO(uuid); @@ -660,11 +654,8 @@ static ssize_t version_show(struct device *dev, struct device_attribute *a, { struct mei_cl_device *cldev = to_mei_cl_device(dev); u8 version = mei_me_cl_ver(cldev->me_cl); - size_t len; - - len = snprintf(buf, PAGE_SIZE, "%02X", version); - return (len >= PAGE_SIZE) ? (PAGE_SIZE - 1) : len; + return scnprintf(buf, PAGE_SIZE, "%02X", version); } static DEVICE_ATTR_RO(version); @@ -673,10 +664,8 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a, { struct mei_cl_device *cldev = to_mei_cl_device(dev); const uuid_le *uuid = mei_me_cl_uuid(cldev->me_cl); - size_t len; - len = snprintf(buf, PAGE_SIZE, "mei:%s:%pUl:", cldev->name, uuid); - return (len >= PAGE_SIZE) ? (PAGE_SIZE - 1) : len; + return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:", cldev->name, uuid); } static DEVICE_ATTR_RO(modalias); -- cgit v1.2.3-59-g8ed1b From 9bf292bfca94694a721449e3fd752493856710f6 Mon Sep 17 00:00:00 2001 From: Ashutosh Dixit Date: Wed, 27 Apr 2016 14:36:05 -0700 Subject: misc: mic: Fix for double fetch security bug in VOP driver The MIC VOP driver does two successive reads from user space to read a variable length data structure. Kernel memory corruption can result if the data structure changes between the two reads. This patch disallows the chance of this happening. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116651 Reported by: Pengfei Wang Reviewed-by: Sudeep Dutt Signed-off-by: Ashutosh Dixit Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mic/vop/vop_vringh.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'drivers/misc') diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c index e94c7fb6712a..88e45234d527 100644 --- a/drivers/misc/mic/vop/vop_vringh.c +++ b/drivers/misc/mic/vop/vop_vringh.c @@ -945,6 +945,11 @@ static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg) ret = -EFAULT; goto free_ret; } + /* Ensure desc has not changed between the two reads */ + if (memcmp(&dd, dd_config, sizeof(dd))) { + ret = -EINVAL; + goto free_ret; + } mutex_lock(&vdev->vdev_mutex); mutex_lock(&vi->vop_mutex); ret = vop_virtio_add_device(vdev, dd_config); -- cgit v1.2.3-59-g8ed1b From 9c88345e68922a72060317af2b5dc678915ab6d6 Mon Sep 17 00:00:00 2001 From: Sudeep Dutt Date: Mon, 4 Apr 2016 21:32:30 -0700 Subject: misc: mic: Fix randconfig build error Fixes randconfig build error reported at https://lkml.org/lkml/2016/4/3/135 by ensuring that the VOP driver selects VIRTIO. Reported-by: Fengguang Wu Reviewed-by: Ashutosh Dixit Signed-off-by: Sudeep Dutt Acked-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mic/Kconfig | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/misc') diff --git a/drivers/misc/mic/Kconfig b/drivers/misc/mic/Kconfig index 2e4f3ba75c8e..89e5917e1c33 100644 --- a/drivers/misc/mic/Kconfig +++ b/drivers/misc/mic/Kconfig @@ -132,6 +132,7 @@ config VOP tristate "VOP Driver" depends on 64BIT && PCI && X86 && VOP_BUS select VHOST_RING + select VIRTIO help This enables VOP (Virtio over PCIe) Driver support for the Intel Many Integrated Core (MIC) family of PCIe form factor coprocessor -- cgit v1.2.3-59-g8ed1b From 05c4569b7f74889ac206fcdc0ac50afa24aca0fc Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 13 Apr 2016 09:47:42 +0300 Subject: misc: mic: silence uninitialized variable warning My static checker complains that we still use "mark" even when the _scif_fence_mark() call fails so it can be uninitialized. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mic/scif/scif_fence.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c index 7f2c96f57066..cac3bcc308a7 100644 --- a/drivers/misc/mic/scif/scif_fence.c +++ b/drivers/misc/mic/scif/scif_fence.c @@ -27,7 +27,8 @@ void scif_recv_mark(struct scif_dev *scifdev, struct scifmsg *msg) { struct scif_endpt *ep = (struct scif_endpt *)msg->payload[0]; - int mark, err; + int mark = 0; + int err; err = _scif_fence_mark(ep, &mark); if (err) -- cgit v1.2.3-59-g8ed1b From fee268767ce8bfdb5389b84cd02ba7837b5350d5 Mon Sep 17 00:00:00 2001 From: Amitoj Kaur Chawla Date: Sat, 19 Mar 2016 00:40:58 +0530 Subject: misc: mic: Remove return statements from void functions Return statements at the end of void functions are useless. The Coccinelle semantic patch used to make this change is as follows: // @@ identifier f; expression e; @@ void f(...) { <... - return e; ...> } // Signed-off-by: Amitoj Kaur Chawla Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mic/host/mic_boot.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mic/host/mic_boot.c b/drivers/misc/mic/host/mic_boot.c index 8c91c9950b54..e047efd83f57 100644 --- a/drivers/misc/mic/host/mic_boot.c +++ b/drivers/misc/mic/host/mic_boot.c @@ -76,7 +76,7 @@ static void __mic_free_irq(struct vop_device *vpdev, { struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev); - return mic_free_irq(mdev, cookie, data); + mic_free_irq(mdev, cookie, data); } static void __mic_ack_interrupt(struct vop_device *vpdev, int num) @@ -272,7 +272,7 @@ ___mic_free_irq(struct scif_hw_dev *scdev, { struct mic_device *mdev = scdev_to_mdev(scdev); - return mic_free_irq(mdev, cookie, data); + mic_free_irq(mdev, cookie, data); } static void ___mic_ack_interrupt(struct scif_hw_dev *scdev, int num) @@ -362,7 +362,7 @@ _mic_request_threaded_irq(struct mbus_device *mbdev, static void _mic_free_irq(struct mbus_device *mbdev, struct mic_irq *cookie, void *data) { - return mic_free_irq(mbdev_to_mdev(mbdev), cookie, data); + mic_free_irq(mbdev_to_mdev(mbdev), cookie, data); } static void _mic_ack_interrupt(struct mbus_device *mbdev, int num) -- cgit v1.2.3-59-g8ed1b From b9c79543efcd0235d2fc1485c31ec9e9584f3ad7 Mon Sep 17 00:00:00 2001 From: Alexey Khoroshilov Date: Fri, 1 Apr 2016 23:53:01 +0300 Subject: mei: do not pin module if cldrv->probe() failed If cldrv->probe() failed in mei_cl_device_probe(), the mei module is left pinned. The patch moves __module_get(THIS_MODULE) after cldrv->probe(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/bus.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index 04dc05150898..bc13f5f35a19 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -580,6 +580,7 @@ static int mei_cl_device_probe(struct device *dev) struct mei_cl_device *cldev; struct mei_cl_driver *cldrv; const struct mei_cl_device_id *id; + int ret; cldev = to_mei_cl_device(dev); cldrv = to_mei_cl_driver(dev->driver); @@ -594,9 +595,12 @@ static int mei_cl_device_probe(struct device *dev) if (!id) return -ENODEV; - __module_get(THIS_MODULE); + ret = cldrv->probe(cldev, id); + if (ret) + return ret; - return cldrv->probe(cldev, id); + __module_get(THIS_MODULE); + return 0; } /** -- cgit v1.2.3-59-g8ed1b From cc25aa94e43779b86300c443acb6947dd739fdd1 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Sun, 17 Apr 2016 12:16:02 -0400 Subject: mei: drop global me_client_index Global me_client_index is used only during the enumeration process and can be effectively replaced by me_addr data from the last enumeration response as we always enumerate clients in the increasing order. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/hbm.c | 23 ++++++++--------------- drivers/misc/mei/mei_dev.h | 2 -- 2 files changed, 8 insertions(+), 17 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c index 5e305d2605f3..5eaa4638e824 100644 --- a/drivers/misc/mei/hbm.c +++ b/drivers/misc/mei/hbm.c @@ -113,8 +113,6 @@ void mei_hbm_idle(struct mei_device *dev) */ void mei_hbm_reset(struct mei_device *dev) { - dev->me_client_index = 0; - mei_me_cl_rm_all(dev); mei_hbm_idle(dev); @@ -530,24 +528,22 @@ static void mei_hbm_cl_notify(struct mei_device *dev, * mei_hbm_prop_req - request property for a single client * * @dev: the device structure + * @start_idx: client index to start search * * Return: 0 on success and < 0 on failure */ - -static int mei_hbm_prop_req(struct mei_device *dev) +static int mei_hbm_prop_req(struct mei_device *dev, unsigned long start_idx) { - struct mei_msg_hdr *mei_hdr = &dev->wr_msg.hdr; struct hbm_props_request *prop_req; const size_t len = sizeof(struct hbm_props_request); - unsigned long next_client_index; + unsigned long addr; int ret; - next_client_index = find_next_bit(dev->me_clients_map, MEI_CLIENTS_MAX, - dev->me_client_index); + addr = find_next_bit(dev->me_clients_map, MEI_CLIENTS_MAX, start_idx); /* We got all client properties */ - if (next_client_index == MEI_CLIENTS_MAX) { + if (addr == MEI_CLIENTS_MAX) { dev->hbm_state = MEI_HBM_STARTED; mei_host_client_init(dev); @@ -560,7 +556,7 @@ static int mei_hbm_prop_req(struct mei_device *dev) memset(prop_req, 0, sizeof(struct hbm_props_request)); prop_req->hbm_cmd = HOST_CLIENT_PROPERTIES_REQ_CMD; - prop_req->me_addr = next_client_index; + prop_req->me_addr = addr; ret = mei_write_message(dev, mei_hdr, dev->wr_msg.data); if (ret) { @@ -570,7 +566,6 @@ static int mei_hbm_prop_req(struct mei_device *dev) } dev->init_clients_timer = MEI_CLIENTS_INIT_TIMEOUT; - dev->me_client_index = next_client_index; return 0; } @@ -1152,10 +1147,8 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr) mei_hbm_me_cl_add(dev, props_res); - dev->me_client_index++; - /* request property for the next client */ - if (mei_hbm_prop_req(dev)) + if (mei_hbm_prop_req(dev, props_res->me_addr + 1)) return -EIO; break; @@ -1181,7 +1174,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr) dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES; /* first property request */ - if (mei_hbm_prop_req(dev)) + if (mei_hbm_prop_req(dev, 0)) return -EIO; break; diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h index db78e6d99456..87586bbc4a41 100644 --- a/drivers/misc/mei/mei_dev.h +++ b/drivers/misc/mei/mei_dev.h @@ -396,7 +396,6 @@ const char *mei_pg_state_str(enum mei_pg_state state); * @me_clients : list of FW clients * @me_clients_map : FW clients bit map * @host_clients_map : host clients id pool - * @me_client_index : last FW client index in enumeration * * @allow_fixed_address: allow user space to connect a fixed client * @override_fixed_address: force allow fixed address behavior @@ -486,7 +485,6 @@ struct mei_device { struct list_head me_clients; DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX); DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX); - unsigned long me_client_index; bool allow_fixed_address; bool override_fixed_address; -- cgit v1.2.3-59-g8ed1b From 6a8d648c8d1824117a9e9edb948ed1611fb013c0 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Sun, 17 Apr 2016 12:16:03 -0400 Subject: mei: fix NULL dereferencing during FW initiated disconnection In the case when disconnection is initiated from the FW the driver is flushing items from the write control list while iterating over it: mei_irq_write_handler() list_for_each_entry_safe(ctrl_wr_list) <-- outer loop mei_cl_irq_disconnect_rsp() mei_cl_set_disconnected() mei_io_list_flush(ctrl_wr_list) <-- destorying list We move the list flushing to the completion routine. Cc: #4.2+ Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/client.c | 4 ++++ drivers/misc/mei/hbm.c | 3 +-- drivers/misc/mei/interrupt.c | 5 +---- 3 files changed, 6 insertions(+), 6 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index bab17e4197b6..09f5280fa021 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -1766,6 +1766,10 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb) if (waitqueue_active(&cl->wait)) wake_up(&cl->wait); + break; + case MEI_FOP_DISCONNECT_RSP: + mei_io_cb_free(cb); + mei_cl_set_disconnected(cl); break; default: BUG_ON(0); diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c index 5eaa4638e824..5aa606c8a827 100644 --- a/drivers/misc/mei/hbm.c +++ b/drivers/misc/mei/hbm.c @@ -877,8 +877,7 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev, cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT_RSP, NULL); if (!cb) return -ENOMEM; - cl_dbg(dev, cl, "add disconnect response as first\n"); - list_add(&cb->list, &dev->ctrl_wr_list.list); + list_add_tail(&cb->list, &dev->ctrl_wr_list.list); } return 0; } diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c index 1e5cb1f704f8..704dc6caad6d 100644 --- a/drivers/misc/mei/interrupt.c +++ b/drivers/misc/mei/interrupt.c @@ -194,10 +194,7 @@ static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb, return -EMSGSIZE; ret = mei_hbm_cl_disconnect_rsp(dev, cl); - mei_cl_set_disconnected(cl); - mei_io_cb_free(cb); - mei_me_cl_put(cl->me_cl); - cl->me_cl = NULL; + list_move_tail(&cb->list, &cmpl_list->list); return ret; } -- cgit v1.2.3-59-g8ed1b From 9d04ee11db7bf0d848266cbfd7db336097a0e239 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Sun, 17 Apr 2016 12:16:04 -0400 Subject: mei: amthif: discard not read messages When a message is received and amthif client is not in reading state the message is ignored and left dangling in the queue. This may happen after one of the amthif host connections is closed w/o completing the reading. Another client will pick up a wrong message on next read attempt which will lead to link reset. To prevent this the driver has to properly discard the message when amthif client is not in reading state. Cc: #4.2+ Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/amthif.c | 4 +++- drivers/misc/mei/interrupt.c | 1 - drivers/misc/mei/mei_dev.h | 2 ++ 3 files changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c index 194360a5f782..a039a5df6f21 100644 --- a/drivers/misc/mei/amthif.c +++ b/drivers/misc/mei/amthif.c @@ -380,8 +380,10 @@ int mei_amthif_irq_read_msg(struct mei_cl *cl, dev = cl->dev; - if (dev->iamthif_state != MEI_IAMTHIF_READING) + if (dev->iamthif_state != MEI_IAMTHIF_READING) { + mei_irq_discard_msg(dev, mei_hdr); return 0; + } ret = mei_cl_irq_read_msg(cl, mei_hdr, cmpl_list); if (ret) diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c index 704dc6caad6d..3831a7ba2531 100644 --- a/drivers/misc/mei/interrupt.c +++ b/drivers/misc/mei/interrupt.c @@ -76,7 +76,6 @@ static inline int mei_cl_hbm_equal(struct mei_cl *cl, * @dev: mei device * @hdr: message header */ -static inline void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr) { /* diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h index 87586bbc4a41..c9e01021eadf 100644 --- a/drivers/misc/mei/mei_dev.h +++ b/drivers/misc/mei/mei_dev.h @@ -702,6 +702,8 @@ bool mei_hbuf_acquire(struct mei_device *dev); bool mei_write_is_idle(struct mei_device *dev); +void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr); + #if IS_ENABLED(CONFIG_DEBUG_FS) int mei_dbgfs_register(struct mei_device *dev, const char *name); void mei_dbgfs_deregister(struct mei_device *dev); -- cgit v1.2.3-59-g8ed1b From 4a8eaa96d8eebf5818ddf1aca92e775a2c2d3f7e Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Wed, 20 Apr 2016 11:03:54 -0400 Subject: mei: don't clean control queues on notify request timeout Timeout on notify request is not a fatal condition, and actually cleaning control queues will disrupt other control flows of the same client. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/client.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index 09f5280fa021..85ae11d410cc 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -1337,12 +1337,8 @@ int mei_cl_notify_request(struct mei_cl *cl, mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); mutex_lock(&dev->device_lock); - if (cl->notify_en != request) { - mei_io_list_flush(&dev->ctrl_rd_list, cl); - mei_io_list_flush(&dev->ctrl_wr_list, cl); - if (!cl->status) - cl->status = -EFAULT; - } + if (cl->notify_en != request && !cl->status) + cl->status = -EFAULT; rets = cl->status; -- cgit v1.2.3-59-g8ed1b From 7ff4bdd45448936363dc6dc6c851112b5c08e209 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Wed, 20 Apr 2016 11:03:55 -0400 Subject: mei: fix waiting for wr_ctrl for corner cases. A control message reply may not be received if either a link reset has occurred or disconnection is initiated by the FW. In the both cases the client state will be set straight to DISCONNECTED and the driver will wait till timeout. Adding DISCONNECTED state in the waiting condition will release the client from the stall. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/client.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index 85ae11d410cc..eed254da63a8 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -727,6 +727,11 @@ static void mei_cl_wake_all(struct mei_cl *cl) cl_dbg(dev, cl, "Waking up waiting for event clients!\n"); wake_up_interruptible(&cl->ev_wait); } + /* synchronized under device mutex */ + if (waitqueue_active(&cl->wait)) { + cl_dbg(dev, cl, "Waking up ctrl write clients!\n"); + wake_up_interruptible(&cl->wait); + } } /** @@ -879,12 +884,15 @@ static int __mei_cl_disconnect(struct mei_cl *cl) } mutex_unlock(&dev->device_lock); - wait_event_timeout(cl->wait, cl->state == MEI_FILE_DISCONNECT_REPLY, + wait_event_timeout(cl->wait, + cl->state == MEI_FILE_DISCONNECT_REPLY || + cl->state == MEI_FILE_DISCONNECTED, mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); mutex_lock(&dev->device_lock); rets = cl->status; - if (cl->state != MEI_FILE_DISCONNECT_REPLY) { + if (cl->state != MEI_FILE_DISCONNECT_REPLY && + cl->state != MEI_FILE_DISCONNECTED) { cl_dbg(dev, cl, "timeout on disconnect from FW client.\n"); rets = -ETIME; } @@ -1085,6 +1093,7 @@ int mei_cl_connect(struct mei_cl *cl, struct mei_me_client *me_cl, mutex_unlock(&dev->device_lock); wait_event_timeout(cl->wait, (cl->state == MEI_FILE_CONNECTED || + cl->state == MEI_FILE_DISCONNECTED || cl->state == MEI_FILE_DISCONNECT_REQUIRED || cl->state == MEI_FILE_DISCONNECT_REPLY), mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); @@ -1333,8 +1342,9 @@ int mei_cl_notify_request(struct mei_cl *cl, } mutex_unlock(&dev->device_lock); - wait_event_timeout(cl->wait, cl->notify_en == request, - mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); + wait_event_timeout(cl->wait, + cl->notify_en == request || !mei_cl_is_connected(cl), + mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT)); mutex_lock(&dev->device_lock); if (cl->notify_en != request && !cl->status) -- cgit v1.2.3-59-g8ed1b From d449d69d216854a8cab049fe035ffefbf383a2e1 Mon Sep 17 00:00:00 2001 From: Vladimir Zapolskiy Date: Wed, 23 Mar 2016 04:52:45 +0200 Subject: misc: sram: fix check of devm_ioremap*() return value Both devm_ioremap() and devm_ioremap_wc() functions return either a pointer to valid iomem region or NULL, check for IS_ERR() is improper and may result in oops on error path. Now on error -ENOMEM is returned. Fixes: 0ab163ad1ea0 ("misc: sram: switch to ioremap_wc from ioremap") Signed-off-by: Vladimir Zapolskiy Signed-off-by: Greg Kroah-Hartman --- drivers/misc/sram.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c index 69cdabea9c03..f84b53d6ce50 100644 --- a/drivers/misc/sram.c +++ b/drivers/misc/sram.c @@ -364,8 +364,8 @@ static int sram_probe(struct platform_device *pdev) sram->virt_base = devm_ioremap(sram->dev, res->start, size); else sram->virt_base = devm_ioremap_wc(sram->dev, res->start, size); - if (IS_ERR(sram->virt_base)) - return PTR_ERR(sram->virt_base); + if (!sram->virt_base) + return -ENOMEM; sram->pool = devm_gen_pool_create(sram->dev, ilog2(SRAM_GRANULARITY), NUMA_NO_NODE, NULL); -- cgit v1.2.3-59-g8ed1b From cf0361a2d2b809c6f5b73313544711648fd7afdd Mon Sep 17 00:00:00 2001 From: Srinivas Kandagatla Date: Sun, 24 Apr 2016 20:28:06 +0100 Subject: eeprom: at24: remove nvmem regmap dependency This patch moves to nvmem support in the driver to use callback instead of regmap. Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman --- drivers/misc/eeprom/Kconfig | 1 - drivers/misc/eeprom/at24.c | 103 ++++++++++---------------------------------- 2 files changed, 22 insertions(+), 82 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig index cfc493c2e30a..2d70464e8c8d 100644 --- a/drivers/misc/eeprom/Kconfig +++ b/drivers/misc/eeprom/Kconfig @@ -3,7 +3,6 @@ menu "EEPROM support" config EEPROM_AT24 tristate "I2C EEPROMs / RAMs / ROMs from most vendors" depends on I2C && SYSFS - select REGMAP select NVMEM help Enable this driver to get read/write support to most I2C EEPROMs diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 089d6943f68a..de550a605f7d 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -23,7 +23,6 @@ #include #include #include -#include #include /* @@ -69,7 +68,6 @@ struct at24_data { unsigned write_max; unsigned num_addresses; - struct regmap_config regmap_config; struct nvmem_config nvmem_config; struct nvmem_device *nvmem; @@ -252,10 +250,10 @@ static ssize_t at24_eeprom_read(struct at24_data *at24, char *buf, return -ETIMEDOUT; } -static ssize_t at24_read(struct at24_data *at24, - char *buf, loff_t off, size_t count) +static int at24_read(void *priv, unsigned int off, void *val, size_t count) { - ssize_t retval = 0; + struct at24_data *at24 = priv; + char *buf = val; if (unlikely(!count)) return count; @@ -267,23 +265,21 @@ static ssize_t at24_read(struct at24_data *at24, mutex_lock(&at24->lock); while (count) { - ssize_t status; + int status; status = at24_eeprom_read(at24, buf, off, count); - if (status <= 0) { - if (retval == 0) - retval = status; - break; + if (status < 0) { + mutex_unlock(&at24->lock); + return status; } buf += status; off += status; count -= status; - retval += status; } mutex_unlock(&at24->lock); - return retval; + return 0; } /* @@ -372,13 +368,13 @@ static ssize_t at24_eeprom_write(struct at24_data *at24, const char *buf, return -ETIMEDOUT; } -static ssize_t at24_write(struct at24_data *at24, const char *buf, loff_t off, - size_t count) +static int at24_write(void *priv, unsigned int off, void *val, size_t count) { - ssize_t retval = 0; + struct at24_data *at24 = priv; + char *buf = val; if (unlikely(!count)) - return count; + return -EINVAL; /* * Write data to chip, protecting against concurrent updates @@ -387,70 +383,23 @@ static ssize_t at24_write(struct at24_data *at24, const char *buf, loff_t off, mutex_lock(&at24->lock); while (count) { - ssize_t status; + int status; status = at24_eeprom_write(at24, buf, off, count); - if (status <= 0) { - if (retval == 0) - retval = status; - break; + if (status < 0) { + mutex_unlock(&at24->lock); + return status; } buf += status; off += status; count -= status; - retval += status; } mutex_unlock(&at24->lock); - return retval; -} - -/*-------------------------------------------------------------------------*/ - -/* - * Provide a regmap interface, which is registered with the NVMEM - * framework -*/ -static int at24_regmap_read(void *context, const void *reg, size_t reg_size, - void *val, size_t val_size) -{ - struct at24_data *at24 = context; - off_t offset = *(u32 *)reg; - int err; - - err = at24_read(at24, val, offset, val_size); - if (err) - return err; - return 0; -} - -static int at24_regmap_write(void *context, const void *data, size_t count) -{ - struct at24_data *at24 = context; - const char *buf; - u32 offset; - size_t len; - int err; - - memcpy(&offset, data, sizeof(offset)); - buf = (const char *)data + sizeof(offset); - len = count - sizeof(offset); - - err = at24_write(at24, buf, offset, len); - if (err) - return err; return 0; } -static const struct regmap_bus at24_regmap_bus = { - .read = at24_regmap_read, - .write = at24_regmap_write, - .reg_format_endian_default = REGMAP_ENDIAN_NATIVE, -}; - -/*-------------------------------------------------------------------------*/ - #ifdef CONFIG_OF static void at24_get_ofdata(struct i2c_client *client, struct at24_platform_data *chip) @@ -482,7 +431,6 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id) struct at24_data *at24; int err; unsigned i, num_addresses; - struct regmap *regmap; if (client->dev.platform_data) { chip = *(struct at24_platform_data *)client->dev.platform_data; @@ -612,19 +560,6 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id) } } - at24->regmap_config.reg_bits = 32; - at24->regmap_config.val_bits = 8; - at24->regmap_config.reg_stride = 1; - at24->regmap_config.max_register = chip.byte_len - 1; - - regmap = devm_regmap_init(&client->dev, &at24_regmap_bus, at24, - &at24->regmap_config); - if (IS_ERR(regmap)) { - dev_err(&client->dev, "regmap init failed\n"); - err = PTR_ERR(regmap); - goto err_clients; - } - at24->nvmem_config.name = dev_name(&client->dev); at24->nvmem_config.dev = &client->dev; at24->nvmem_config.read_only = !writable; @@ -632,6 +567,12 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id) at24->nvmem_config.owner = THIS_MODULE; at24->nvmem_config.compat = true; at24->nvmem_config.base_dev = &client->dev; + at24->nvmem_config.reg_read = at24_read; + at24->nvmem_config.reg_write = at24_write; + at24->nvmem_config.priv = at24; + at24->nvmem_config.stride = 4; + at24->nvmem_config.word_size = 1; + at24->nvmem_config.size = chip.byte_len; at24->nvmem = nvmem_register(&at24->nvmem_config); -- cgit v1.2.3-59-g8ed1b From 01973a01f9ec34b706bf474dc4fb8c2bd9741d2b Mon Sep 17 00:00:00 2001 From: Srinivas Kandagatla Date: Sun, 24 Apr 2016 20:28:07 +0100 Subject: eeprom: at25: remove nvmem regmap dependency This patch moves to nvmem support in the driver to use callback instead of regmap. Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman --- drivers/misc/eeprom/Kconfig | 1 - drivers/misc/eeprom/at25.c | 89 ++++++++++----------------------------------- 2 files changed, 19 insertions(+), 71 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig index 2d70464e8c8d..c4e41c26649e 100644 --- a/drivers/misc/eeprom/Kconfig +++ b/drivers/misc/eeprom/Kconfig @@ -31,7 +31,6 @@ config EEPROM_AT24 config EEPROM_AT25 tristate "SPI EEPROMs from most vendors" depends on SPI && SYSFS - select REGMAP select NVMEM help Enable this driver to get read/write support to most SPI EEPROMs, diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c index fa36a6e37084..a2858b33585e 100644 --- a/drivers/misc/eeprom/at25.c +++ b/drivers/misc/eeprom/at25.c @@ -17,7 +17,6 @@ #include #include -#include #include #include #include @@ -34,7 +33,6 @@ struct at25_data { struct mutex lock; struct spi_eeprom chip; unsigned addrlen; - struct regmap_config regmap_config; struct nvmem_config nvmem_config; struct nvmem_device *nvmem; }; @@ -65,14 +63,11 @@ struct at25_data { #define io_limit PAGE_SIZE /* bytes */ -static ssize_t -at25_ee_read( - struct at25_data *at25, - char *buf, - unsigned offset, - size_t count -) +static int at25_ee_read(void *priv, unsigned int offset, + void *val, size_t count) { + struct at25_data *at25 = priv; + char *buf = val; u8 command[EE_MAXADDRLEN + 1]; u8 *cp; ssize_t status; @@ -81,11 +76,11 @@ at25_ee_read( u8 instr; if (unlikely(offset >= at25->chip.byte_len)) - return 0; + return -EINVAL; if ((offset + count) > at25->chip.byte_len) count = at25->chip.byte_len - offset; if (unlikely(!count)) - return count; + return -EINVAL; cp = command; @@ -131,28 +126,14 @@ at25_ee_read( count, offset, (int) status); mutex_unlock(&at25->lock); - return status ? status : count; + return status; } -static int at25_regmap_read(void *context, const void *reg, size_t reg_size, - void *val, size_t val_size) +static int at25_ee_write(void *priv, unsigned int off, void *val, size_t count) { - struct at25_data *at25 = context; - off_t offset = *(u32 *)reg; - int err; - - err = at25_ee_read(at25, val, offset, val_size); - if (err) - return err; - return 0; -} - -static ssize_t -at25_ee_write(struct at25_data *at25, const char *buf, loff_t off, - size_t count) -{ - ssize_t status = 0; - unsigned written = 0; + struct at25_data *at25 = priv; + const char *buf = val; + int status = 0; unsigned buf_size; u8 *bounce; @@ -161,7 +142,7 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off, if ((off + count) > at25->chip.byte_len) count = at25->chip.byte_len - off; if (unlikely(!count)) - return count; + return -EINVAL; /* Temp buffer starts with command and address */ buf_size = at25->chip.page_size; @@ -256,40 +237,15 @@ at25_ee_write(struct at25_data *at25, const char *buf, loff_t off, off += segment; buf += segment; count -= segment; - written += segment; } while (count > 0); mutex_unlock(&at25->lock); kfree(bounce); - return written ? written : status; + return status; } -static int at25_regmap_write(void *context, const void *data, size_t count) -{ - struct at25_data *at25 = context; - const char *buf; - u32 offset; - size_t len; - int err; - - memcpy(&offset, data, sizeof(offset)); - buf = (const char *)data + sizeof(offset); - len = count - sizeof(offset); - - err = at25_ee_write(at25, buf, offset, len); - if (err) - return err; - return 0; -} - -static const struct regmap_bus at25_regmap_bus = { - .read = at25_regmap_read, - .write = at25_regmap_write, - .reg_format_endian_default = REGMAP_ENDIAN_NATIVE, -}; - /*-------------------------------------------------------------------------*/ static int at25_fw_to_chip(struct device *dev, struct spi_eeprom *chip) @@ -349,7 +305,6 @@ static int at25_probe(struct spi_device *spi) { struct at25_data *at25 = NULL; struct spi_eeprom chip; - struct regmap *regmap; int err; int sr; int addrlen; @@ -394,18 +349,6 @@ static int at25_probe(struct spi_device *spi) spi_set_drvdata(spi, at25); at25->addrlen = addrlen; - at25->regmap_config.reg_bits = 32; - at25->regmap_config.val_bits = 8; - at25->regmap_config.reg_stride = 1; - at25->regmap_config.max_register = chip.byte_len - 1; - - regmap = devm_regmap_init(&spi->dev, &at25_regmap_bus, at25, - &at25->regmap_config); - if (IS_ERR(regmap)) { - dev_err(&spi->dev, "regmap init failed\n"); - return PTR_ERR(regmap); - } - at25->nvmem_config.name = dev_name(&spi->dev); at25->nvmem_config.dev = &spi->dev; at25->nvmem_config.read_only = chip.flags & EE_READONLY; @@ -413,6 +356,12 @@ static int at25_probe(struct spi_device *spi) at25->nvmem_config.owner = THIS_MODULE; at25->nvmem_config.compat = true; at25->nvmem_config.base_dev = &spi->dev; + at25->nvmem_config.reg_read = at25_ee_read; + at25->nvmem_config.reg_write = at25_ee_write; + at25->nvmem_config.priv = at25; + at25->nvmem_config.stride = 4; + at25->nvmem_config.word_size = 1; + at25->nvmem_config.size = chip.byte_len; at25->nvmem = nvmem_register(&at25->nvmem_config); if (IS_ERR(at25->nvmem)) -- cgit v1.2.3-59-g8ed1b From a8ab316ab12501908cc355fee6aff7065609f4e2 Mon Sep 17 00:00:00 2001 From: Srinivas Kandagatla Date: Sun, 24 Apr 2016 20:28:16 +0100 Subject: nvmem: 93xx46: remove nvmem regmap dependency This patch moves to nvmem support in the driver to use callback instead of regmap. Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman --- drivers/misc/eeprom/eeprom_93xx46.c | 90 ++++++++----------------------------- 1 file changed, 18 insertions(+), 72 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c index 426fe2fd5238..5004d72c9f42 100644 --- a/drivers/misc/eeprom/eeprom_93xx46.c +++ b/drivers/misc/eeprom/eeprom_93xx46.c @@ -20,7 +20,6 @@ #include #include #include -#include #include #define OP_START 0x4 @@ -43,7 +42,6 @@ struct eeprom_93xx46_dev { struct spi_device *spi; struct eeprom_93xx46_platform_data *pdata; struct mutex lock; - struct regmap_config regmap_config; struct nvmem_config nvmem_config; struct nvmem_device *nvmem; int addrlen; @@ -60,11 +58,12 @@ static inline bool has_quirk_instruction_length(struct eeprom_93xx46_dev *edev) return edev->pdata->quirks & EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH; } -static ssize_t -eeprom_93xx46_read(struct eeprom_93xx46_dev *edev, char *buf, - unsigned off, size_t count) +static int eeprom_93xx46_read(void *priv, unsigned int off, + void *val, size_t count) { - ssize_t ret = 0; + struct eeprom_93xx46_dev *edev = priv; + char *buf = val; + int err = 0; if (unlikely(off >= edev->size)) return 0; @@ -84,7 +83,6 @@ eeprom_93xx46_read(struct eeprom_93xx46_dev *edev, char *buf, u16 cmd_addr = OP_READ << edev->addrlen; size_t nbytes = count; int bits; - int err; if (edev->addrlen == 7) { cmd_addr |= off & 0x7f; @@ -120,21 +118,20 @@ eeprom_93xx46_read(struct eeprom_93xx46_dev *edev, char *buf, if (err) { dev_err(&edev->spi->dev, "read %zu bytes at %d: err. %d\n", nbytes, (int)off, err); - ret = err; break; } buf += nbytes; off += nbytes; count -= nbytes; - ret += nbytes; } if (edev->pdata->finish) edev->pdata->finish(edev); mutex_unlock(&edev->lock); - return ret; + + return err; } static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on) @@ -230,10 +227,11 @@ eeprom_93xx46_write_word(struct eeprom_93xx46_dev *edev, return ret; } -static ssize_t -eeprom_93xx46_write(struct eeprom_93xx46_dev *edev, const char *buf, - loff_t off, size_t count) +static int eeprom_93xx46_write(void *priv, unsigned int off, + void *val, size_t count) { + struct eeprom_93xx46_dev *edev = priv; + char *buf = val; int i, ret, step = 1; if (unlikely(off >= edev->size)) @@ -275,52 +273,9 @@ eeprom_93xx46_write(struct eeprom_93xx46_dev *edev, const char *buf, /* erase/write disable */ eeprom_93xx46_ew(edev, 0); - return ret ? : count; -} - -/* - * Provide a regmap interface, which is registered with the NVMEM - * framework -*/ -static int eeprom_93xx46_regmap_read(void *context, const void *reg, - size_t reg_size, void *val, - size_t val_size) -{ - struct eeprom_93xx46_dev *eeprom_93xx46 = context; - off_t offset = *(u32 *)reg; - int err; - - err = eeprom_93xx46_read(eeprom_93xx46, val, offset, val_size); - if (err) - return err; - return 0; -} - -static int eeprom_93xx46_regmap_write(void *context, const void *data, - size_t count) -{ - struct eeprom_93xx46_dev *eeprom_93xx46 = context; - const char *buf; - u32 offset; - size_t len; - int err; - - memcpy(&offset, data, sizeof(offset)); - buf = (const char *)data + sizeof(offset); - len = count - sizeof(offset); - - err = eeprom_93xx46_write(eeprom_93xx46, buf, offset, len); - if (err) - return err; - return 0; + return ret; } -static const struct regmap_bus eeprom_93xx46_regmap_bus = { - .read = eeprom_93xx46_regmap_read, - .write = eeprom_93xx46_regmap_write, - .reg_format_endian_default = REGMAP_ENDIAN_NATIVE, -}; - static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev) { struct eeprom_93xx46_platform_data *pd = edev->pdata; @@ -480,7 +435,6 @@ static int eeprom_93xx46_probe(struct spi_device *spi) { struct eeprom_93xx46_platform_data *pd; struct eeprom_93xx46_dev *edev; - struct regmap *regmap; int err; if (spi->dev.of_node) { @@ -515,20 +469,6 @@ static int eeprom_93xx46_probe(struct spi_device *spi) edev->pdata = pd; edev->size = 128; - - edev->regmap_config.reg_bits = 32; - edev->regmap_config.val_bits = 8; - edev->regmap_config.reg_stride = 1; - edev->regmap_config.max_register = edev->size - 1; - - regmap = devm_regmap_init(&spi->dev, &eeprom_93xx46_regmap_bus, edev, - &edev->regmap_config); - if (IS_ERR(regmap)) { - dev_err(&spi->dev, "regmap init failed\n"); - err = PTR_ERR(regmap); - goto fail; - } - edev->nvmem_config.name = dev_name(&spi->dev); edev->nvmem_config.dev = &spi->dev; edev->nvmem_config.read_only = pd->flags & EE_READONLY; @@ -536,6 +476,12 @@ static int eeprom_93xx46_probe(struct spi_device *spi) edev->nvmem_config.owner = THIS_MODULE; edev->nvmem_config.compat = true; edev->nvmem_config.base_dev = &spi->dev; + edev->nvmem_config.reg_read = eeprom_93xx46_read; + edev->nvmem_config.reg_write = eeprom_93xx46_write; + edev->nvmem_config.priv = edev; + edev->nvmem_config.stride = 4; + edev->nvmem_config.word_size = 1; + edev->nvmem_config.size = edev->size; edev->nvmem = nvmem_register(&edev->nvmem_config); if (IS_ERR(edev->nvmem)) { -- cgit v1.2.3-59-g8ed1b From 96b2a45c66fdca543cd94da3aa2c2542b11b9188 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Wed, 20 Apr 2016 10:16:35 +0100 Subject: eeprom: at25: Fix SPI device leak The at25 driver is using spi_dev_get() apparently just to take a copy of the SPI device used to instantiate it but never calls spi_dev_put() to free it. Since the device is guaranteed to exist between probe() and remove() there should be no need for the driver to take an extra reference to it so fix the leak by just using a straight assignment. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman --- drivers/misc/eeprom/at25.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/misc') diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c index a2858b33585e..2c6c7c8e3ead 100644 --- a/drivers/misc/eeprom/at25.c +++ b/drivers/misc/eeprom/at25.c @@ -345,7 +345,7 @@ static int at25_probe(struct spi_device *spi) mutex_init(&at25->lock); at25->chip = chip; - at25->spi = spi_dev_get(spi); + at25->spi = spi; spi_set_drvdata(spi, at25); at25->addrlen = addrlen; -- cgit v1.2.3-59-g8ed1b From dd69a18ae71070ffd8805fcdfed6404762eaffa2 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Wed, 20 Apr 2016 10:16:36 +0100 Subject: eeprom: 93xx46: Fix SPI device leak The 93xx46 driver is using spi_dev_get() apparently just to take a copy of the SPI device used to instantiate it but never calls spi_dev_put() to free it. Since the device is guaranteed to exist between probe() and remove() there should be no need for the driver to take an extra reference to it so fix the leak by just using a straight assignment. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman --- drivers/misc/eeprom/eeprom_93xx46.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/misc') diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c index 5004d72c9f42..94cc035aa841 100644 --- a/drivers/misc/eeprom/eeprom_93xx46.c +++ b/drivers/misc/eeprom/eeprom_93xx46.c @@ -465,7 +465,7 @@ static int eeprom_93xx46_probe(struct spi_device *spi) mutex_init(&edev->lock); - edev->spi = spi_dev_get(spi); + edev->spi = spi; edev->pdata = pd; edev->size = 128; -- cgit v1.2.3-59-g8ed1b From 66b58edf592fd7a6fc0f106e0809e52b52d4722f Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 13 Apr 2016 09:45:11 +0300 Subject: ARM: qcom: silence an uninitialized variable warning It's harmless but, if "enable" isn't set, then we pass uninitialized values to qcom_coincell_chgr_config(). The values aren't used, but let's silence the warning anyway. Signed-off-by: Dan Carpenter Acked-by: Tim Bird Signed-off-by: Greg Kroah-Hartman --- drivers/misc/qcom-coincell.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/misc') diff --git a/drivers/misc/qcom-coincell.c b/drivers/misc/qcom-coincell.c index 7b4a2da487a5..829a61dbd65f 100644 --- a/drivers/misc/qcom-coincell.c +++ b/drivers/misc/qcom-coincell.c @@ -94,7 +94,8 @@ static int qcom_coincell_probe(struct platform_device *pdev) { struct device_node *node = pdev->dev.of_node; struct qcom_coincell chgr; - u32 rset, vset; + u32 rset = 0; + u32 vset = 0; bool enable; int rc; -- cgit v1.2.3-59-g8ed1b From 8d026465ecf68823c633f7b60d39a8a17dd3bc27 Mon Sep 17 00:00:00 2001 From: Daniel Wagner Date: Fri, 15 Apr 2016 10:22:27 +0200 Subject: ti-st: Fix complete_all() wrong usage complete_all() should only be called once, doing it twice is a clear bug. 8565adbc8214 ("drivers/misc/ti-st: fix read fw version cmd") added the additional complete_all() call. Since we call complete_all() when leaving the function we can drop the complete_all() call inside true branch of the if statement. Signed-off-by: Daniel Wagner Cc: Pavan Savoy Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/misc/ti-st/st_kim.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers/misc') diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c index 71b64550b591..bf0d7708beac 100644 --- a/drivers/misc/ti-st/st_kim.c +++ b/drivers/misc/ti-st/st_kim.c @@ -78,7 +78,6 @@ static void validate_firmware_response(struct kim_data_s *kim_gdata) memcpy(kim_gdata->resp_buffer, kim_gdata->rx_skb->data, kim_gdata->rx_skb->len); - complete_all(&kim_gdata->kim_rcvd); kim_gdata->rx_state = ST_W4_PACKET_TYPE; kim_gdata->rx_skb = NULL; kim_gdata->rx_count = 0; -- cgit v1.2.3-59-g8ed1b From bc46b45a421a64a0895dd41a34d3d2086e1ac7f6 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Tue, 3 May 2016 18:54:21 -0400 Subject: mei: bus: call mei_cl_read_start under device lock Ensure that mei_cl_read_start is called under the device lock also in the bus layer. The function updates global ctrl_wr_list which should be locked. Cc: #4.4+ Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/bus.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index bc13f5f35a19..1f33fea9299f 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -220,17 +220,23 @@ EXPORT_SYMBOL_GPL(mei_cldev_recv); static void mei_cl_bus_event_work(struct work_struct *work) { struct mei_cl_device *cldev; + struct mei_device *bus; cldev = container_of(work, struct mei_cl_device, event_work); + bus = cldev->bus; + if (cldev->event_cb) cldev->event_cb(cldev, cldev->events, cldev->event_context); cldev->events = 0; /* Prepare for the next read */ - if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) + if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) { + mutex_lock(&bus->device_lock); mei_cl_read_start(cldev->cl, 0, NULL); + mutex_unlock(&bus->device_lock); + } } /** @@ -304,6 +310,7 @@ int mei_cldev_register_event_cb(struct mei_cl_device *cldev, unsigned long events_mask, mei_cldev_event_cb_t event_cb, void *context) { + struct mei_device *bus = cldev->bus; int ret; if (cldev->event_cb) @@ -316,15 +323,17 @@ int mei_cldev_register_event_cb(struct mei_cl_device *cldev, INIT_WORK(&cldev->event_work, mei_cl_bus_event_work); if (cldev->events_mask & BIT(MEI_CL_EVENT_RX)) { + mutex_lock(&bus->device_lock); ret = mei_cl_read_start(cldev->cl, 0, NULL); + mutex_unlock(&bus->device_lock); if (ret && ret != -EBUSY) return ret; } if (cldev->events_mask & BIT(MEI_CL_EVENT_NOTIF)) { - mutex_lock(&cldev->cl->dev->device_lock); + mutex_lock(&bus->device_lock); ret = mei_cl_notify_request(cldev->cl, NULL, event_cb ? 1 : 0); - mutex_unlock(&cldev->cl->dev->device_lock); + mutex_unlock(&bus->device_lock); if (ret) return ret; } -- cgit v1.2.3-59-g8ed1b