tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'char-misc-4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
"Here are a few small char/misc driver fixes for reported issues.

The "biggest" are two binder fixes for reported issues that have been
shipping in Android phones for a while now, the others are various
fixes for reported problems.

And there's a MAINTAINERS update for good measure.

All have been in linux-next with no reported issues"

* tag 'char-misc-4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
MAINTAINERS: Add entry for genwqe driver
VMCI: Doorbell create and destroy fixes
GenWQE: Fix bad page access during abort of resource allocation
vme: vme_get_size potentially returning incorrect value on failure
extcon: qcom-spmi-misc: Sync the extcon state on interrupt
hv: do not lose pending heartbeat vmbus packets
mei: txe: don't clean an unprocessed interrupt cause.
ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct
ANDROID: binder: Add strong ref checks

Linus Torvalds 2a290036 c636e176

+67 -18
+6
MAINTAINERS
··· 5287 5287 S: Maintained 5288 5288 F: scripts/get_maintainer.pl 5289 5289 5290 + GENWQE (IBM Generic Workqueue Card) 5291 + M: Frank Haverkamp <haver@linux.vnet.ibm.com> 5292 + M: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com> 5293 + S: Supported 5294 + F: drivers/misc/genwqe/ 5295 + 5290 5296 GFS2 FILE SYSTEM 5291 5297 M: Steven Whitehouse <swhiteho@redhat.com> 5292 5298 M: Bob Peterson <rpeterso@redhat.com>
+26 -9
drivers/android/binder.c
··· 1002 1002 1003 1003 1004 1004 static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1005 - uint32_t desc) 1005 + u32 desc, bool need_strong_ref) 1006 1006 { 1007 1007 struct rb_node *n = proc->refs_by_desc.rb_node; 1008 1008 struct binder_ref *ref; ··· 1010 1010 while (n) { 1011 1011 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1012 1012 1013 - if (desc < ref->desc) 1013 + if (desc < ref->desc) { 1014 1014 n = n->rb_left; 1015 - else if (desc > ref->desc) 1015 + } else if (desc > ref->desc) { 1016 1016 n = n->rb_right; 1017 - else 1017 + } else if (need_strong_ref && !ref->strong) { 1018 + binder_user_error("tried to use weak ref as strong ref\n"); 1019 + return NULL; 1020 + } else { 1018 1021 return ref; 1022 + } 1019 1023 } 1020 1024 return NULL; 1021 1025 } ··· 1289 1285 } break; 1290 1286 case BINDER_TYPE_HANDLE: 1291 1287 case BINDER_TYPE_WEAK_HANDLE: { 1292 - struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1288 + struct binder_ref *ref; 1289 + 1290 + ref = binder_get_ref(proc, fp->handle, 1291 + fp->type == BINDER_TYPE_HANDLE); 1293 1292 1294 1293 if (ref == NULL) { 1295 1294 pr_err("transaction release %d bad handle %d\n", ··· 1387 1380 if (tr->target.handle) { 1388 1381 struct binder_ref *ref; 1389 1382 1390 - ref = binder_get_ref(proc, tr->target.handle); 1383 + ref = binder_get_ref(proc, tr->target.handle, true); 1391 1384 if (ref == NULL) { 1392 1385 binder_user_error("%d:%d got transaction to invalid handle\n", 1393 1386 proc->pid, thread->pid); ··· 1584 1577 fp->type = BINDER_TYPE_HANDLE; 1585 1578 else 1586 1579 fp->type = BINDER_TYPE_WEAK_HANDLE; 1580 + fp->binder = 0; 1587 1581 fp->handle = ref->desc; 1582 + fp->cookie = 0; 1588 1583 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1589 1584 &thread->todo); 1590 1585 ··· 1598 1589 } break; 1599 1590 case BINDER_TYPE_HANDLE: 1600 1591 case BINDER_TYPE_WEAK_HANDLE: { 1601 - struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1592 + struct binder_ref *ref; 1593 + 1594 + ref = binder_get_ref(proc, fp->handle, 1595 + fp->type == BINDER_TYPE_HANDLE); 1602 1596 1603 1597 if (ref == NULL) { 1604 1598 binder_user_error("%d:%d got transaction with invalid handle, %d\n", ··· 1636 1624 return_error = BR_FAILED_REPLY; 1637 1625 goto err_binder_get_ref_for_node_failed; 1638 1626 } 1627 + fp->binder = 0; 1639 1628 fp->handle = new_ref->desc; 1629 + fp->cookie = 0; 1640 1630 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1641 1631 trace_binder_transaction_ref_to_ref(t, ref, 1642 1632 new_ref); ··· 1692 1678 binder_debug(BINDER_DEBUG_TRANSACTION, 1693 1679 " fd %d -> %d\n", fp->handle, target_fd); 1694 1680 /* TODO: fput? */ 1681 + fp->binder = 0; 1695 1682 fp->handle = target_fd; 1696 1683 } break; 1697 1684 ··· 1815 1800 ref->desc); 1816 1801 } 1817 1802 } else 1818 - ref = binder_get_ref(proc, target); 1803 + ref = binder_get_ref(proc, target, 1804 + cmd == BC_ACQUIRE || 1805 + cmd == BC_RELEASE); 1819 1806 if (ref == NULL) { 1820 1807 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1821 1808 proc->pid, thread->pid, target); ··· 2013 1996 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2014 1997 return -EFAULT; 2015 1998 ptr += sizeof(binder_uintptr_t); 2016 - ref = binder_get_ref(proc, target); 1999 + ref = binder_get_ref(proc, target, false); 2017 2000 if (ref == NULL) { 2018 2001 binder_user_error("%d:%d %s invalid ref %d\n", 2019 2002 proc->pid, thread->pid,
+1 -1
drivers/extcon/extcon-qcom-spmi-misc.c
··· 51 51 if (ret) 52 52 return; 53 53 54 - extcon_set_state(info->edev, EXTCON_USB_HOST, !id); 54 + extcon_set_state_sync(info->edev, EXTCON_USB_HOST, !id); 55 55 } 56 56 57 57 static irqreturn_t qcom_usb_irq_handler(int irq, void *dev_id)
+7 -3
drivers/hv/hv_util.c
··· 314 314 u8 *hbeat_txf_buf = util_heartbeat.recv_buffer; 315 315 struct icmsg_negotiate *negop = NULL; 316 316 317 - vmbus_recvpacket(channel, hbeat_txf_buf, 318 - PAGE_SIZE, &recvlen, &requestid); 317 + while (1) { 319 318 320 - if (recvlen > 0) { 319 + vmbus_recvpacket(channel, hbeat_txf_buf, 320 + PAGE_SIZE, &recvlen, &requestid); 321 + 322 + if (!recvlen) 323 + break; 324 + 321 325 icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[ 322 326 sizeof(struct vmbuspipe_hdr)]; 323 327
+11 -1
drivers/misc/genwqe/card_utils.c
··· 352 352 if (copy_from_user(sgl->lpage, user_addr + user_size - 353 353 sgl->lpage_size, sgl->lpage_size)) { 354 354 rc = -EFAULT; 355 - goto err_out1; 355 + goto err_out2; 356 356 } 357 357 } 358 358 return 0; 359 359 360 + err_out2: 361 + __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage, 362 + sgl->lpage_dma_addr); 363 + sgl->lpage = NULL; 364 + sgl->lpage_dma_addr = 0; 360 365 err_out1: 361 366 __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage, 362 367 sgl->fpage_dma_addr); 368 + sgl->fpage = NULL; 369 + sgl->fpage_dma_addr = 0; 363 370 err_out: 364 371 __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl, 365 372 sgl->sgl_dma_addr); 373 + sgl->sgl = NULL; 374 + sgl->sgl_dma_addr = 0; 375 + sgl->sgl_size = 0; 366 376 return -ENOMEM; 367 377 } 368 378
+4 -2
drivers/misc/mei/hw-txe.c
··· 981 981 hisr = mei_txe_br_reg_read(hw, HISR_REG); 982 982 983 983 aliveness = mei_txe_aliveness_get(dev); 984 - if (hhisr & IPC_HHIER_SEC && aliveness) 984 + if (hhisr & IPC_HHIER_SEC && aliveness) { 985 985 ipc_isr = mei_txe_sec_reg_read_silent(hw, 986 986 SEC_IPC_HOST_INT_STATUS_REG); 987 - else 987 + } else { 988 988 ipc_isr = 0; 989 + hhisr &= ~IPC_HHIER_SEC; 990 + } 989 991 990 992 generated = generated || 991 993 (hisr & HISR_INT_STS_MSK) ||
+7 -1
drivers/misc/vmw_vmci/vmci_doorbell.c
··· 431 431 if (vmci_handle_is_invalid(*handle)) { 432 432 u32 context_id = vmci_get_context_id(); 433 433 434 + if (context_id == VMCI_INVALID_ID) { 435 + pr_warn("Failed to get context ID\n"); 436 + result = VMCI_ERROR_NO_RESOURCES; 437 + goto free_mem; 438 + } 439 + 434 440 /* Let resource code allocate a free ID for us */ 435 441 new_handle = vmci_make_handle(context_id, VMCI_INVALID_ID); 436 442 } else { ··· 531 525 532 526 entry = container_of(resource, struct dbell_entry, resource); 533 527 534 - if (vmci_guest_code_active()) { 528 + if (!hlist_unhashed(&entry->node)) { 535 529 int result; 536 530 537 531 dbell_index_table_remove(entry);
+1 -1
drivers/misc/vmw_vmci/vmci_driver.c
··· 113 113 114 114 MODULE_AUTHOR("VMware, Inc."); 115 115 MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface."); 116 - MODULE_VERSION("1.1.4.0-k"); 116 + MODULE_VERSION("1.1.5.0-k"); 117 117 MODULE_LICENSE("GPL v2");
+4
drivers/vme/vme.c
··· 156 156 case VME_MASTER: 157 157 retval = vme_master_get(resource, &enabled, &base, &size, 158 158 &aspace, &cycle, &dwidth); 159 + if (retval) 160 + return 0; 159 161 160 162 return size; 161 163 break; 162 164 case VME_SLAVE: 163 165 retval = vme_slave_get(resource, &enabled, &base, &size, 164 166 &buf_base, &aspace, &cycle); 167 + if (retval) 168 + return 0; 165 169 166 170 return size; 167 171 break;