Skip to contentSkip to conversation

2.6.32.49-longterm review

PATCH New Greg KH 1 participant 26 messages Nov 23, 2011

Subsystems (32)
lore
Share & tools
lore

Greg KH

author
#0 lore raw

cover 2.6.32.49-longterm review

This is the start of the longterm review cycle for the 2.6.32.49 release. There are 25 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.

Responses should be made by Friday, November 25, 2011, 20:00:00 UTC. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v2.6/longterm-review/patch-2.6.32.49-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

 Documentation/Makefile              |    2 +-
 Documentation/kbuild/makefiles.txt  |   12 ++
 Documentation/video4linux/Makefile  |    8 --
 Documentation/video4linux/v4lgrab.c |  201 -----------------------------------
 Makefile                            |    7 +-
 arch/ia64/hp/sim/simserial.c        |   12 +--
 drivers/base/sys.c                  |    6 +
 drivers/char/amiserial.c            |   56 ++++++-----
 drivers/char/cyclades.c             |   49 +++++----
 drivers/char/ip2/ip2main.c          |   72 ++++++++-----
 drivers/char/mxser.c                |   62 ++++++-----
 drivers/char/nozomi.c               |   37 +++----
 drivers/char/pcmcia/synclink_cs.c   |   60 +++++------
 drivers/char/synclink.c             |   73 ++++++-------
 drivers/char/synclink_gt.c          |   56 +++++-----
 drivers/char/synclinkmp.c           |   61 +++++------
 drivers/char/tty_io.c               |   21 ++++
 drivers/gpu/drm/i915/i915_gem.c     |   44 ++++----
 drivers/md/raid5.c                  |   32 ++++--
 drivers/mtd/mtdchar.c               |    1 +
 drivers/scsi/hosts.c                |    9 +-
 drivers/scsi/scsi_lib.c             |    9 ++
 drivers/scsi/st.c                   |    4 +-
 drivers/serial/68360serial.c        |   51 +++++-----
 drivers/serial/serial_core.c        |   35 +++----
 drivers/usb/core/quirks.c           |   27 +++++
 drivers/usb/serial/ftdi_sio.c       |   14 ++-
 drivers/usb/serial/pl2303.c         |    1 -
 drivers/usb/serial/pl2303.h         |    4 -
 drivers/usb/serial/usb-serial.c     |   13 +++
 drivers/usb/storage/protocol.c      |    7 +-
 drivers/xen/events.c                |    2 +-
 fs/hfs/trans.c                      |    2 +
 include/linux/interrupt.h           |    6 +
 include/linux/tty_driver.h          |    9 ++
 include/linux/usb/serial.h          |    2 +
 include/linux/vmalloc.h             |    1 +
 kernel/irq/pm.c                     |   35 +++++--
 kernel/power/suspend.c              |    2 +-
 lib/nlattr.c                        |    1 +
 mm/vmalloc.c                        |   67 +++++++++---
 net/bluetooth/rfcomm/tty.c          |    4 -
 net/ipv6/udp.c                      |    2 +-
 net/sunrpc/auth_unix.c              |    3 +
 scripts/Kbuild.include              |    5 +
 sound/pci/hda/patch_realtek.c       |    1 -
 sound/soc/codecs/wm8940.c           |    1 +
 47 files changed, 586 insertions(+), 603 deletions(-)
author
#1 lore raw

PATCH 1/25 st: fix race in st_scsi_execute_end

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1355
Lines: 44

From: Petr Uzel <[email protected]>

commit c68bf8eeaa57c852e74adcf597237be149eef830 upstream.

The call to complete() in st_scsi_execute_end() wakes up sleeping thread in write_behind_check(), which frees the st_request, thus invalidating the pointer to the associated bio structure, which is then passed to the blk_rq_unmap_user(). Fix by storing pointer to bio structure into temporary local variable.

This bug is present since at least linux-2.6.32.

---
 drivers/scsi/st.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/st.c +3 -1
@@ -461,14 +461,16 @@ static void st_scsi_execute_end(struct r
 {
 	struct st_request *SRpnt = req->end_io_data;
 	struct scsi_tape *STp = SRpnt->stp;
+	struct bio *tmp;
 
 	STp->buffer->cmdstat.midlevel_result = SRpnt->result = req->errors;
 	STp->buffer->cmdstat.residual = req->resid_len;
 
+	tmp = SRpnt->bio;
 	if (SRpnt->waiting)
 		complete(SRpnt->waiting);
 
-	blk_rq_unmap_user(SRpnt->bio);
+	blk_rq_unmap_user(tmp);
 	__blk_put_request(req->q, req);
 }
 
author
#2 lore raw

PATCH 2/25 Make scsi_free_queue() kill pending SCSI commands

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1913
Lines: 64

From: Bart Van Assche <[email protected]>

commit 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 upstream.

Make sure that SCSI device removal via scsi_remove_host() does finish all pending SCSI commands. Currently that's not the case and hence removal of a SCSI host during I/O can cause a deadlock. See also "blkdev_issue_discard() hangs forever if underlying storage device is removed" (http://bugzilla.kernel.org/show_bug.cgi?id=40472). See also
http://lkml.org/lkml/2011/8/27/6.

---
 drivers/scsi/hosts.c    |    9 ++++++---
 drivers/scsi/scsi_lib.c |    9 +++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)
drivers/scsi/hosts.c +6 -3
@@ -275,6 +275,7 @@ static void scsi_host_dev_release(struct
 {
 	struct Scsi_Host *shost = dev_to_shost(dev);
 	struct device *parent = dev->parent;
+	struct request_queue *q;
 
 	scsi_proc_hostdir_rm(shost->hostt);
 
@@ -282,9 +283,11 @@ static void scsi_host_dev_release(struct
 		kthread_stop(shost->ehandler);
 	if (shost->work_q)
 		destroy_workqueue(shost->work_q);
-	if (shost->uspace_req_q) {
-		kfree(shost->uspace_req_q->queuedata);
-		scsi_free_queue(shost->uspace_req_q);
+	q = shost->uspace_req_q;
+	if (q) {
+		kfree(q->queuedata);
+		q->queuedata = NULL;
+		scsi_free_queue(q);
 	}
 
 	scsi_destroy_command_freelist(shost);
drivers/scsi/scsi_lib.c +9 -0
@@ -1672,6 +1672,15 @@ struct request_queue *scsi_alloc_queue(s
 
 void scsi_free_queue(struct request_queue *q)
 {
+	unsigned long flags;
+
+	WARN_ON(q->queuedata);
+
+	/* cause scsi_request_fn() to kill all non-finished requests */
+	spin_lock_irqsave(q->queue_lock, flags);
+	q->request_fn(q);
+	spin_unlock_irqrestore(q->queue_lock, flags);
+
 	blk_cleanup_queue(q);
 }
 
author
#3 lore raw

PATCH 3/25 NFS/sunrpc: dont use a credential with extra groups.

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1289
Lines: 39

From: NeilBrown <[email protected]>

commit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream.

The sunrpc layer keeps a cache of recently used credentials and 'unx_match' is used to find the credential which matches the current process.

However unx_match allows a match when the cached credential has extra groups at the end of uc_gids list which are not in the process group list.

So if a process with a list of (say) 4 group accesses a file and gains access because of the last group in the list, then another process with the same uid and gid, and a gid list being the first tree of the gids of the original process tries to access the file, it will be granted access even though it shouldn't as the wrong rpc credential will be used.

---
 net/sunrpc/auth_unix.c |    3 +++
 1 file changed, 3 insertions(+)
net/sunrpc/auth_unix.c +3 -0
@@ -129,6 +129,9 @@ unx_match(struct auth_cred *acred, struc
 	for (i = 0; i < groups ; i++)
 		if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
 			return 0;
+	if (groups < NFS_NGROUPS &&
+	    cred->uc_gids[groups] != NOGROUP)
+		return 0;
 	return 1;
 }
 
author
#4 lore raw

PATCH 4/25 netlink: validate NLA_MSECS length

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1138
Lines: 39

From: Johannes Berg <[email protected]>

commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream.

L2TP for example uses NLA_MSECS like this:
policy:
[L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, },
code:

        if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
                cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);

As nla_get_msecs() is essentially nla_get_u64() plus the conversion to a HZ-based value, this will not properly reject attributes from userspace that aren't long enough and might overrun the message.

Add NLA_MSECS to the attribute minlen array to check the size properly.

---
 lib/nlattr.c |    1 +
 1 file changed, 1 insertion(+)
lib/nlattr.c +1 -0
@@ -20,6 +20,7 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+
 	[NLA_U16]	= sizeof(u16),
 	[NLA_U32]	= sizeof(u32),
 	[NLA_U64]	= sizeof(u64),
+	[NLA_MSECS]	= sizeof(u64),
 	[NLA_NESTED]	= NLA_HDRLEN,
 };
 
author
#5 lore raw

PATCH 5/25 mtd: mtdchar: add missing initializer on raw write

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 989
Lines: 31

From: Peter Wippich <[email protected]>

commit bf5140817b2d65faac9b32fc9057a097044ac35b upstream.

On writes in MODE_RAW the mtd_oob_ops struct is not sufficiently initialized which may cause nandwrite to fail. With this patch it is possible to write raw nand/oob data without additional ECC (either for testing or when some sectors need different oob layout e.g. bootloader) like
nandwrite -n -r -o /dev/mtd0 <myfile>

---
 drivers/mtd/mtdchar.c |    1 +
 1 file changed, 1 insertion(+)
drivers/mtd/mtdchar.c +1 -0
@@ -290,6 +290,7 @@ static ssize_t mtd_write(struct file *fi
 			ops.mode = MTD_OOB_RAW;
 			ops.datbuf = kbuf;
 			ops.oobbuf = NULL;
+			ops.ooboffs = 0;
 			ops.len = len;
 
 			ret = mtd->write_oob(mtd, *ppos, &ops);
author
#6 lore raw

PATCH 6/25 PM / Suspend: Off by one in pm_suspend()

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 833
Lines: 29

From: Dan Carpenter <[email protected]>

commit 528f7ce6e439edeac38f6b3f8561f1be129b5e91 upstream.

In enter_state() we use "state" as an offset for the pm_states[] array. The pm_states[] array only has PM_SUSPEND_MAX elements so this test is off by one.

---
 kernel/power/suspend.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/power/suspend.c +1 -1
@@ -293,7 +293,7 @@ int enter_state(suspend_state_t state)
  */
 int pm_suspend(suspend_state_t state)
 {
-	if (state > PM_SUSPEND_ON && state <= PM_SUSPEND_MAX)
+	if (state > PM_SUSPEND_ON && state < PM_SUSPEND_MAX)
 		return enter_state(state);
 	return -EINVAL;
 }
author
#7 lore raw

PATCH 7/25 hfs: add sanity check for file name length

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 749
Lines: 28

From: Dan Carpenter <[email protected]>

commit bc5b8a9003132ae44559edd63a1623b7b99dfb68 upstream.

On a corrupted file system the ->len field could be wrong leading to a buffer overflow.

---
 fs/hfs/trans.c |    2 ++
 1 file changed, 2 insertions(+)
fs/hfs/trans.c +2 -0
@@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb,
 
 	src = in->name;
 	srclen = in->len;
+	if (srclen > HFS_NAMELEN)
+		srclen = HFS_NAMELEN;
 	dst = out;
 	dstlen = HFS_MAX_NAMELEN;
 	if (nls_io) {
author
#8 lore raw

PATCH 8/25 kbuild: Disable -Wunused-but-set-variable for gcc 4.6.0

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 983
Lines: 33

From: Dave Jones <[email protected]>

commit af0e5d565d2fffcd97d1e2d89669d627cc04e8b8 upstream.

Disable the new -Wunused-but-set-variable that was added in gcc 4.6.0 It produces more false positives than useful warnings.

This can still be enabled using W=1
[gregkh - No it can not for 2.6.32, but we don't care]

---
 Makefile |    3 +++
 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -537,6 +537,9 @@ ifndef CONFIG_CC_STACKPROTECTOR
 KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
 endif
 
+# This warning generated too much noise in a regular build.
+KBUILD_CFLAGS += $(call cc-option, -Wno-unused-but-set-variable)
+
 ifdef CONFIG_FRAME_POINTER
 KBUILD_CFLAGS	+= -fno-omit-frame-pointer -fno-optimize-sibling-calls
 else
author
#9 lore raw

PATCH 9/25 ASoC: wm8940: Properly set codec->dapm.bias_level

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 624
Lines: 24

From: Axel Lin <[email protected]>

commit 5927f94700e860ae27ff24e7f3bc9e4f7b9922eb upstream.

---
 sound/soc/codecs/wm8940.c |    1 +
 1 file changed, 1 insertion(+)
sound/soc/codecs/wm8940.c +1 -0
@@ -472,6 +472,7 @@ static int wm8940_set_bias_level(struct
 		ret = snd_soc_write(codec, WM8940_POWER1, pwr_reg);
 		break;
 	}
+	codec->bias_level = level;
 
 	return ret;
 }
author
#10 lore raw

PATCH 10/25 md/raid5: abort any pending parity operations when array fails.

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 2351
Lines: 71

From: NeilBrown <[email protected]>

commit 9a3f530f39f4490eaa18b02719fb74ce5f4d2d86 upstream.

When the number of failed devices exceeds the allowed number we must abort any active parity operations (checks or updates) as they are no longer meaningful, and can lead to a BUG_ON in handle_parity_checks6.

This bug was introduce by commit 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8 in 2.6.29.

---
 drivers/md/raid5.c |   32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/md/raid5.c +20 -12
@@ -3038,12 +3038,16 @@ static void handle_stripe5(struct stripe
 	/* check if the array has lost two devices and, if so, some requests might
 	 * need to be failed
 	 */
-	if (s.failed > 1 && s.to_read+s.to_write+s.written)
-		handle_failed_stripe(conf, sh, &s, disks, &return_bi);
-	if (s.failed > 1 && s.syncing) {
-		md_done_sync(conf->mddev, STRIPE_SECTORS,0);
-		clear_bit(STRIPE_SYNCING, &sh->state);
-		s.syncing = 0;
+	if (s.failed > 1) {
+		sh->check_state = 0;
+		sh->reconstruct_state = 0;
+		if (s.to_read+s.to_write+s.written)
+			handle_failed_stripe(conf, sh, &s, disks, &return_bi);
+		if (s.syncing) {
+			md_done_sync(conf->mddev, STRIPE_SECTORS,0);
+			clear_bit(STRIPE_SYNCING, &sh->state);
+			s.syncing = 0;
+		}
 	}
 
 	/* might be able to return some write requests if the parity block
@@ -3314,12 +3318,16 @@ static void handle_stripe6(struct stripe
 	/* check if the array has lost >2 devices and, if so, some requests
 	 * might need to be failed
 	 */
-	if (s.failed > 2 && s.to_read+s.to_write+s.written)
-		handle_failed_stripe(conf, sh, &s, disks, &return_bi);
-	if (s.failed > 2 && s.syncing) {
-		md_done_sync(conf->mddev, STRIPE_SECTORS,0);
-		clear_bit(STRIPE_SYNCING, &sh->state);
-		s.syncing = 0;
+	if (s.failed > 2) {
+		sh->check_state = 0;
+		sh->reconstruct_state = 0;
+		if (s.to_read+s.to_write+s.written)
+			handle_failed_stripe(conf, sh, &s, disks, &return_bi);
+		if (s.syncing) {
+			md_done_sync(conf->mddev, STRIPE_SECTORS,0);
+			clear_bit(STRIPE_SYNCING, &sh->state);
+			s.syncing = 0;
+		}
 	}
 
 	/*
author
#11 lore raw

PATCH 11/25 Remove the old V4L1 v4lgrab.c file

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 7341
Lines: 242

From: Mauro Carvalho Chehab <[email protected]>

commit 55fe25b418640fad04190103274841b2c907bacd upstream.

This example file uses the old V4L1 API. It also doesn't use libv4l. So, it is completely obsolete. A good example already exists at v4l-utils (v4l2grab.c):
http://git.linuxtv.org/v4l-utils.git

---
 Documentation/Makefile              |    2 
 Documentation/video4linux/Makefile  |    8 -
 Documentation/video4linux/v4lgrab.c |  201 ------------------------------------
 3 files changed, 1 insertion(+), 210 deletions(-)
Documentation/Makefile +1 -1
@@ -1,3 +1,3 @@
 obj-m := DocBook/ accounting/ auxdisplay/ connector/ \
 	filesystems/configfs/ ia64/ networking/ \
-	pcmcia/ spi/ video4linux/ vm/ watchdog/src/
+	pcmcia/ spi/ vm/ watchdog/src/
Documentation/video4linux/Makefile deleted +0 -8
@@ -1,8 +0,0 @@
-# kbuild trick to avoid linker error. Can be omitted if a module is built.
-obj- := dummy.o
-
-# List of programs to build
-hostprogs-y := v4lgrab
-
-# Tell kbuild to always build the programs
-always := $(hostprogs-y)
Documentation/video4linux/v4lgrab.c deleted +0 -201

201 lines not on this page · raw message

author
#12 lore raw

PATCH 12/25 Revert "ALSA: hda: Fix quirk for Dell Inspiron 910"

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1031
Lines: 27

From: Herton Ronaldo Krzesinski <[email protected]>

This reverts commit fdb1e4e9d85b973679d56f23ccf9017ff85fd11f.

It was wrong included in 2.6.32 stable (was intended for 2.6.38+ in the original commit changelog in Linus tree), and causes a regression on 2.6.32 (https://launchpad.net/bugs/875300).

---
 sound/pci/hda/patch_realtek.c |    1 -
 1 file changed, 1 deletion(-)
sound/pci/hda/patch_realtek.c +0 -1
@@ -12664,7 +12664,6 @@ static struct snd_pci_quirk alc268_cfg_t
 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One",
 						ALC268_ACER_ASPIRE_ONE),
 	SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL),
-	SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO),
 	SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0,
 			"Dell Inspiron Mini9/Vostro A90", ALC268_DELL),
 	/* almost compatible with toshiba but with optional digital outs;
author
#13 lore raw

PATCH 13/25 drm/i915: Sanity check pread/pwrite

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 2249
Lines: 86

From: Chris Wilson <[email protected]>

commit ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 upstream.

Move the access control up from the fast paths, which are no longer universally taken first, up into the caller. This then duplicates some sanity checking along the slow paths, but is much simpler. Tracked as CVE-2010-2962.

---
 drivers/gpu/drm/i915/i915_gem.c |   28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/i915_gem.c +20 -8
@@ -488,8 +488,15 @@ i915_gem_pread_ioctl(struct drm_device *
 	 */
 	if (args->offset > obj->size || args->size > obj->size ||
 	    args->offset + args->size > obj->size) {
-		drm_gem_object_unreference(obj);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (!access_ok(VERIFY_WRITE,
+		       (char __user *)(uintptr_t)args->data_ptr,
+		       args->size)) {
+		ret = -EFAULT;
+		goto err;
 	}
 
 	if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -501,8 +508,8 @@ i915_gem_pread_ioctl(struct drm_device *
 							file_priv);
 	}
 
+err:
 	drm_gem_object_unreference(obj);
-
 	return ret;
 }
 
@@ -592,8 +599,6 @@ i915_gem_gtt_pwrite_fast(struct drm_devi
 
 	user_data = (char __user *) (uintptr_t) args->data_ptr;
 	remain = args->size;
-	if (!access_ok(VERIFY_READ, user_data, remain))
-		return -EFAULT;
 
 
 	mutex_lock(&dev->struct_mutex);
@@ -961,8 +966,15 @@ i915_gem_pwrite_ioctl(struct drm_device
 	 */
 	if (args->offset > obj->size || args->size > obj->size ||
 	    args->offset + args->size > obj->size) {
-		drm_gem_object_unreference(obj);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (!access_ok(VERIFY_READ,
+		       (char __user *)(uintptr_t)args->data_ptr,
+		       args->size)) {
+		ret = -EFAULT;
+		goto err;
 	}
 
 	/* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -995,8 +1007,8 @@ i915_gem_pwrite_ioctl(struct drm_device
 		DRM_INFO("pwrite failed %d\n", ret);
 #endif
 
+err:
 	drm_gem_object_unreference(obj);
-
 	return ret;
 }
 
author
#14 lore raw

PATCH 14/25 drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1407
Lines: 47

From: Chris Wilson <[email protected]>

commit 7dcd2499deab8f10011713c40bc2f309c9b65077 upstream

... and do the same for pread.

---
 drivers/gpu/drm/i915/i915_gem.c |   16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/gpu/drm/i915/i915_gem.c +4 -12
@@ -482,12 +482,8 @@ i915_gem_pread_ioctl(struct drm_device *
 		return -EBADF;
 	obj_priv = obj->driver_private;
 
-	/* Bounds check source.
-	 *
-	 * XXX: This could use review for overflow issues...
-	 */
-	if (args->offset > obj->size || args->size > obj->size ||
-	    args->offset + args->size > obj->size) {
+	/* Bounds check source.  */
+	if (args->offset > obj->size || args->size > obj->size - args->offset) {
 		ret = -EINVAL;
 		goto err;
 	}
@@ -960,12 +956,8 @@ i915_gem_pwrite_ioctl(struct drm_device
 		return -EBADF;
 	obj_priv = obj->driver_private;
 
-	/* Bounds check destination.
-	 *
-	 * XXX: This could use review for overflow issues...
-	 */
-	if (args->offset > obj->size || args->size > obj->size ||
-	    args->offset + args->size > obj->size) {
+	/* Bounds check destination. */
+	if (args->offset > obj->size || args->size > obj->size - args->offset) {
 		ret = -EINVAL;
 		goto err;
 	}
author
#15 lore raw

PATCH 15/25 genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 4751
Lines: 154

From: Ian Campbell <[email protected]>

commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream

This adds a mechanism to resume selected IRQs during syscore_resume instead of dpm_resume_noirq.

Under Xen we need to resume IRQs associated with IPIs early enough that the resched IPI is unmasked and we can therefore schedule ourselves out of the stop_machine where the suspend/resume takes place.

This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME".

Back ported to 2.6.32 (which lacks syscore support) by calling the relavant resume function directly from sysdev_resume).

v2: Fixed non-x86 build errors.

---
 drivers/base/sys.c        |    6 ++++++
 drivers/xen/events.c      |    2 +-
 include/linux/interrupt.h |    6 ++++++
 kernel/irq/pm.c           |   35 ++++++++++++++++++++++++++++-------
 4 files changed, 41 insertions(+), 8 deletions(-)
drivers/base/sys.c +6 -0
@@ -471,6 +471,12 @@ int sysdev_resume(void)
 {
 	struct sysdev_class *cls;
 
+	/*
+	 * Called from syscore in mainline but called directly here
+	 * since syscore does not exist in this tree.
+	 */
+	irq_pm_syscore_resume();
+
 	WARN_ONCE(!irqs_disabled(),
 		"Interrupts enabled while resuming system devices\n");
 
drivers/xen/events.c +1 -1
@@ -536,7 +536,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
 	if (irq < 0)
 		return irq;
 
-	irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME;
+	irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME | IRQF_EARLY_RESUME;
 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
 	if (retval != 0) {
 		unbind_from_irq(irq);
include/linux/interrupt.h +6 -0
@@ -54,6 +54,8 @@
  *                irq line disabled until the threaded handler has been run.
  * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
  * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set
+ * IRQF_EARLY_RESUME - Resume IRQ early during syscore instead of at device
+ *                resume time.
  */
 #define IRQF_DISABLED		0x00000020
 #define IRQF_SAMPLE_RANDOM	0x00000040
@@ -66,6 +68,7 @@
 #define IRQF_ONESHOT		0x00002000
 #define IRQF_NO_SUSPEND		0x00004000
 #define IRQF_FORCE_RESUME	0x00008000
+#define IRQF_EARLY_RESUME	0x00020000
 
 #define IRQF_TIMER		(__IRQF_TIMER | IRQF_NO_SUSPEND)
 
@@ -198,13 +201,16 @@ extern void suspend_device_irqs(void);
 extern void resume_device_irqs(void);
 #ifdef CONFIG_PM_SLEEP
 extern int check_wakeup_irqs(void);
+extern void irq_pm_syscore_resume(void);
 #else
 static inline int check_wakeup_irqs(void) { return 0; }
+static inline void irq_pm_syscore_resume(void) { };
 #endif
 #else
 static inline void suspend_device_irqs(void) { };
 static inline void resume_device_irqs(void) { };
 static inline int check_wakeup_irqs(void) { return 0; }
+static inline void irq_pm_syscore_resume(void) { };
 #endif
 
 #if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_HARDIRQS)
kernel/irq/pm.c +28 -7
@@ -39,25 +39,46 @@ void suspend_device_irqs(void)
 }
 EXPORT_SYMBOL_GPL(suspend_device_irqs);
 
-/**
- * resume_device_irqs - enable interrupt lines disabled by suspend_device_irqs()
- *
- * Enable all interrupt lines previously disabled by suspend_device_irqs() that
- * have the IRQ_SUSPENDED flag set.
- */
-void resume_device_irqs(void)
+static void resume_irqs(bool want_early)
 {
 	struct irq_desc *desc;
 	int irq;
 
 	for_each_irq_desc(irq, desc) {
 		unsigned long flags;
+		bool is_early = desc->action &&
+			desc->action->flags & IRQF_EARLY_RESUME;
+
+		if (is_early != want_early)
+			continue;
 
 		spin_lock_irqsave(&desc->lock, flags);
 		__enable_irq(desc, irq, true);
 		spin_unlock_irqrestore(&desc->lock, flags);
 	}
 }
+
+/**
+ * irq_pm_syscore_ops - enable interrupt lines early
+ *
+ * Enable all interrupt lines with %IRQF_EARLY_RESUME set.
+ */
+void irq_pm_syscore_resume(void)
+{
+	resume_irqs(true);
+}
+
+/**
+ * resume_device_irqs - enable interrupt lines disabled by suspend_device_irqs()
+ *
+ * Enable all non-%IRQF_EARLY_RESUME interrupt lines previously
+ * disabled by suspend_device_irqs() that have the IRQS_SUSPENDED flag
+ * set as well as those with %IRQF_FORCE_RESUME.
+ */
+void resume_device_irqs(void)
+{
+	resume_irqs(false);
+}
 EXPORT_SYMBOL_GPL(resume_device_irqs);
 
 /**
author
#16 lore raw

PATCH 16/25 mm: avoid null pointer access in vm_struct via /proc/vmallocinfo

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 5721
Lines: 166

From: Mitsuo Hayasaka <[email protected]>

commit f5252e009d5b87071a919221e4f6624184005368 upstream

The /proc/vmallocinfo shows information about vmalloc allocations in vmlist that is a linklist of vm_struct. It, however, may access pages field of vm_struct where a page was not allocated. This results in a null pointer access and leads to a kernel panic.

Why this happen:
In __vmalloc_node() called from vmalloc(), newly allocated vm_struct is added to vmlist at __get_vm_area_node() and then, some fields of vm_struct such as nr_pages and pages are set at __vmalloc_area_node(). In other words, it is added to vmlist before it is fully initialized. At the same time, when the /proc/vmallocinfo is read, it accesses the pages field of vm_struct according to the nr_pages field at show_numa_info(). Thus, a null pointer access happens.

Patch:
This patch adds newly allocated vm_struct to the vmlist *after* it is fully initialized. So, it can avoid accessing the pages field with unallocated page when show_numa_info() is called.

Cc Andrew Morton <[email protected]>
Cc David Rientjes <[email protected]>
Cc Namhyung Kim <[email protected]>
Cc "Paul E. McKenney" <[email protected]>
Cc Jeremy Fitzhardinge <[email protected]>

---

 include/linux/vmalloc.h |    1 
 mm/vmalloc.c            |   67 +++++++++++++++++++++++++++++++++++-------------
 2 files changed, 51 insertions(+), 17 deletions(-)
include/linux/vmalloc.h +1 -0
@@ -13,6 +13,7 @@ struct vm_area_struct;		/* vma defining
 #define VM_MAP		0x00000004	/* vmap()ed pages */
 #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
 #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
+#define VM_UNLIST	0x00000020	/* vm_struct is not listed in vmlist */
 /* bits [20..32] reserved for arch specific ioremap internals */
 
 /*
mm/vmalloc.c +50 -17

111 lines not on this page · raw message

author
#17 lore raw

PATCH 17/25 ipv6: udp: fix the wrong headroom check

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1099
Lines: 35

From: Shan Wei <[email protected]>

commit a9cf73ea7ff78f52662c8658d93c226effbbedde upstream.

At this point, skb->data points to skb_transport_header. So, headroom check is wrong.

For some case:bridge(UFO is on) + eth device(UFO is off), there is no enough headroom for IPv6 frag head. But headroom check is always false.

This will bring about data be moved to there prior to skb->head, when adding IPv6 frag header to skb.

---
 net/ipv6/udp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/udp.c +1 -1
@@ -1141,7 +1141,7 @@ static struct sk_buff *udp6_ufo_fragment
 	skb->ip_summed = CHECKSUM_NONE;
 
 	/* Check if there is enough headroom to insert fragment header. */
-	if ((skb_headroom(skb) < frag_hdr_sz) &&
+	if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
 	    pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
 		goto out;
 
author
#18 lore raw

PATCH 18/25 kbuild: Fix passing -Wno-* options to gcc 4.4+

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 3254
Lines: 78

From: Michal Marek <[email protected]>

commit 8417da6f2128008c431c7d130af6cd3d9079922e upstream.

Starting with 4.4, gcc will happily accept -Wno-<anything> in the cc-option test and complain later when compiling a file that has some other warning. This rather unexpected behavior is intentional as per
http://gcc.gnu.org/PR28322, so work around it by testing for support of the opposite option (without the no-). Introduce a new Makefile function cc-disable-warning that does this and update two uses of cc-option in the toplevel Makefile.

---
 Documentation/kbuild/makefiles.txt |   12 ++++++++++++
 Makefile                           |    4 ++--
 scripts/Kbuild.include             |    5 +++++
 3 files changed, 19 insertions(+), 2 deletions(-)
Documentation/kbuild/makefiles.txt +12 -0
@@ -502,6 +502,18 @@ more details, with real examples.
 	gcc >= 3.00. For gcc < 3.00, -malign-functions=4 is used.
 	Note: cc-option-align uses KBUILD_CFLAGS for $(CC) options
 
+    cc-disable-warning
+	cc-disable-warning checks if gcc supports a given warning and returns
+	the commandline switch to disable it. This special function is needed,
+	because gcc 4.4 and later accept any unknown -Wno-* option and only
+	warn about it if there is another warning in the source file.
+
+	Example:
+		KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+
+	In the above example, -Wno-unused-but-set-variable will be added to
+	KBUILD_CFLAGS only if gcc really accepts it.
+
     cc-version
 	cc-version returns a numerical version of the $(CC) compiler version.
 	The format is <major><minor> where both are two digits. So for example
Makefile +2 -2
@@ -538,7 +538,7 @@ KBUILD_CFLAGS += $(call cc-option, -fno-
 endif
 
 # This warning generated too much noise in a regular build.
-KBUILD_CFLAGS += $(call cc-option, -Wno-unused-but-set-variable)
+KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
 
 ifdef CONFIG_FRAME_POINTER
 KBUILD_CFLAGS	+= -fno-omit-frame-pointer -fno-optimize-sibling-calls
@@ -568,7 +568,7 @@ CHECKFLAGS     += $(NOSTDINC_FLAGS)
 KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
 
 # disable pointer signed / unsigned warnings in gcc 4.0
-KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
+KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
 
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
scripts/Kbuild.include +5 -0
@@ -118,6 +118,11 @@ cc-option-yn = $(call try-run,\
 cc-option-align = $(subst -functions=0,,\
 	$(call cc-option,-falign-functions=0,-malign-functions=0))
 
+# cc-disable-warning
+# Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
+cc-disable-warning = $(call try-run,\
+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -xc /dev/null -o "$$TMP",-Wno-$(strip $(1)))
+
 # cc-version
 # Usage gcc-ver := $(call cc-version)
 cc-version = $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
author
#19 lore raw

PATCH 19/25 USB: serial: pl2303: rm duplicate id

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1792
Lines: 54

From: wangyanqing <[email protected]>

commit 0c16595539b612fe948559433dda08ff96a8bdc7 upstream.

I get report from customer that his usb-serial converter doesn't work well,it sometimes work, but sometimes it doesn't.

The usb-serial converter's id:
vendor_id product_id
0x4348 0x5523

Then I search the usb-serial codes, and there are
two drivers announce support this device, pl2303
and ch341, commit 026dfaf1 cause it. Through many times to test, ch341 works well with this device,
and pl2303 doesn't work quite often(it just work quite little).

ch341 works well with this device, so we doesn't need pl2303 to support.I try to revert 026dfaf1 first, but it failed. So I prepare this patch by hand to revert it.

---
 drivers/usb/serial/pl2303.c |    1 -
 drivers/usb/serial/pl2303.h |    4 ----
 2 files changed, 5 deletions(-)
drivers/usb/serial/pl2303.c +0 -1
@@ -101,7 +101,6 @@ static struct usb_device_id id_table []
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
 	{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
 	{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
-	{ USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
 	{ USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
 	{ }					/* Terminating entry */
 };
drivers/usb/serial/pl2303.h +0 -4
@@ -145,10 +145,6 @@
 #define ADLINK_VENDOR_ID		0x0b63
 #define ADLINK_ND6530_PRODUCT_ID	0x6530
 
-/* WinChipHead USB->RS 232 adapter */
-#define WINCHIPHEAD_VENDOR_ID		0x4348
-#define WINCHIPHEAD_USBSER_PRODUCT_ID	0x5523
-
 /* SMART USB Serial Adapter */
 #define SMART_VENDOR_ID	0x0b8c
 #define SMART_PRODUCT_ID	0x2303
author
#20 lore raw

PATCH 20/25 USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 2222
Lines: 62

From: Andrew Worsley <[email protected]>

commit b1ffb4c851f185e9051ba837c16d9b84ef688d26 upstream.

Fix for ftdi_set_termios() glitching output

ftdi_set_termios() is constantly setting the baud rate, data bits and parity unnecessarily on every call, . When called while characters are being transmitted can cause the FTDI chip to corrupt the serial port bit stream output by stalling the output half a bit during the output of a character. Simple fix by skipping this setting if the baud rate/data bits/parity are unchanged.

---
 drivers/usb/serial/ftdi_sio.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/usb/serial/ftdi_sio.c +11 -3
@@ -2355,13 +2355,19 @@ static void ftdi_set_termios(struct tty_
 
 	cflag = termios->c_cflag;
 
-	/* FIXME -For this cut I don't care if the line is really changing or
-	   not  - so just do the change regardless  - should be able to
-	   compare old_termios and tty->termios */
+	if (old_termios->c_cflag == termios->c_cflag
+	    && old_termios->c_ispeed == termios->c_ispeed
+	    && old_termios->c_ospeed == termios->c_ospeed)
+		goto no_c_cflag_changes;
+
 	/* NOTE These routines can get interrupted by
 	   ftdi_sio_read_bulk_callback  - need to examine what this means -
 	   don't see any problems yet */
 
+	if ((old_termios->c_cflag & (CSIZE|PARODD|PARENB|CMSPAR|CSTOPB)) ==
+	    (termios->c_cflag & (CSIZE|PARODD|PARENB|CMSPAR|CSTOPB)))
+		goto no_data_parity_stop_changes;
+
 	/* Set number of data bits, parity, stop bits */
 
 	termios->c_cflag &= ~CMSPAR;
@@ -2398,6 +2404,7 @@ static void ftdi_set_termios(struct tty_
 	}
 
 	/* Now do the baudrate */
+no_data_parity_stop_changes:
 	if ((cflag & CBAUD) == B0) {
 		/* Disable flow control */
 		if (usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
@@ -2423,6 +2430,7 @@ static void ftdi_set_termios(struct tty_
 
 	/* Set flow control */
 	/* Note device also supports DTR/CD (ugh) and Xon/Xoff in hardware */
+no_c_cflag_changes:
 	if (cflag & CRTSCTS) {
 		dbg("%s Setting to CRTSCTS flow control", __func__);
 		if (usb_control_msg(dev,
author
#21 lore raw

PATCH 21/25 usb-storage: Accept 8020i-protocol commands longer than 12 bytes

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1895
Lines: 50

From: Alan Stern <[email protected]>

commit 2f640bf4c94324aeaa1b6385c10aab8c5ad1e1cf upstream.

The 8020i protocol (also 8070i and QIC-157) uses 12-byte commands; shorter commands must be padded. Simon Detheridge reports that his 3-TB USB disk drive claims to use the 8020i protocol (which is normally meant for ATAPI devices like CD drives), and because of its large size, the disk drive requires the use of 16-byte commands. However the usb_stor_pad12_command() routine in usb-storage always sets the command length to 12, making the drive impossible to use.

Since the SFF-8020i specification allows for 16-byte commands in future extensions, we may as well accept them. This patch (as1490) changes usb_stor_pad12_command() to leave commands larger than 12 bytes alone rather than truncating them.

---
 drivers/usb/storage/protocol.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/usb/storage/protocol.c +3 -4
@@ -58,7 +58,9 @@
 
 void usb_stor_pad12_command(struct scsi_cmnd *srb, struct us_data *us)
 {
-	/* Pad the SCSI command with zeros out to 12 bytes
+	/*
+	 * Pad the SCSI command with zeros out to 12 bytes.  If the
+	 * command already is 12 bytes or longer, leave it alone.
 	 *
 	 * NOTE: This only works because a scsi_cmnd struct field contains
 	 * a unsigned char cmnd[16], so we know we have storage available
@@ -66,9 +68,6 @@ void usb_stor_pad12_command(struct scsi_
 	for (; srb->cmd_len<12; srb->cmd_len++)
 		srb->cmnd[srb->cmd_len] = 0;
 
-	/* set command length to 12 bytes */
-	srb->cmd_len = 12;
-
 	/* send the command to the transport layer */
 	usb_stor_invoke_transport(srb, us);
 }
author
#22 lore raw

PATCH 22/25 USB: add quirk for Logitech C600 web cam

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 823
Lines: 27

From: Josh Boyer <[email protected]>

commit 60c71ca972a2dd3fd9d0165b405361c8ad48349b upstream.

We've had another report of the "chipmunk" sound on a Logitech C600 webcam. This patch resolves the issue.

---
 drivers/usb/core/quirks.c |    3 +++
 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -47,6 +47,9 @@ static const struct usb_device_id usb_qu
 	/* Logitech Webcam B/C500 */
 	{ USB_DEVICE(0x046d, 0x0807), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Logitech Webcam C600 */
+	{ USB_DEVICE(0x046d, 0x0808), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Logitech Webcam Pro 9000 */
 	{ USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME },
 
author
#23 lore raw

PATCH 23/25 USB: quirks: adding more quirky webcams to avoid squeaky audio

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 1917
Lines: 56

From: sordna <[email protected]>

commit 0d145d7d4a241c321c832a810bb6edad18e2217b upstream.

The following patch contains additional affected webcam models, on top of the patches commited to linux-next 2394d67e446bf616a0885167d5f0d397bdacfdfc and 5b253d88cc6c65a23cefc457a5a4ef139913c5fc

---
 drivers/usb/core/quirks.c |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
drivers/usb/core/quirks.c +24 -0
@@ -53,12 +53,36 @@ static const struct usb_device_id usb_qu
 	/* Logitech Webcam Pro 9000 */
 	{ USB_DEVICE(0x046d, 0x0809), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Logitech Webcam C905 */
+	{ USB_DEVICE(0x046d, 0x080a), .driver_info = USB_QUIRK_RESET_RESUME },
+
+	/* Logitech Webcam C210 */
+	{ USB_DEVICE(0x046d, 0x0819), .driver_info = USB_QUIRK_RESET_RESUME },
+
+	/* Logitech Webcam C260 */
+	{ USB_DEVICE(0x046d, 0x081a), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Logitech Webcam C310 */
 	{ USB_DEVICE(0x046d, 0x081b), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Logitech Webcam C910 */
+	{ USB_DEVICE(0x046d, 0x0821), .driver_info = USB_QUIRK_RESET_RESUME },
+
+	/* Logitech Webcam C160 */
+	{ USB_DEVICE(0x046d, 0x0824), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Logitech Webcam C270 */
 	{ USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Logitech Quickcam Pro 9000 */
+	{ USB_DEVICE(0x046d, 0x0990), .driver_info = USB_QUIRK_RESET_RESUME },
+
+	/* Logitech Quickcam E3500 */
+	{ USB_DEVICE(0x046d, 0x09a4), .driver_info = USB_QUIRK_RESET_RESUME },
+
+	/* Logitech Quickcam Vision Pro */
+	{ USB_DEVICE(0x046d, 0x09a6), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Logitech Harmony 700-series */
 	{ USB_DEVICE(0x046d, 0xc122), .driver_info = USB_QUIRK_DELAY_INIT },
 
author
#24 lore raw

PATCH 24/25 tty: Make tiocgicount a handler

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 6894
Lines: 206

From: Alan Cox <[email protected]>

commit d281da7ff6f70efca0553c288bb883e8605b3862 upstream

Dan Rosenberg noted that various drivers return the struct with uncleared fields. Instead of spending forever trying to stomp all the drivers that get it wrong (and every new driver) do the job in one place.

This first patch adds the needed operations and hooks them up, including the needed USB midlayer and serial core plumbing.

---
 drivers/char/tty_io.c           |   21 +++++++++++++++++++++
 drivers/serial/serial_core.c    |   35 ++++++++++++++++-------------------
 drivers/usb/serial/usb-serial.c |   13 +++++++++++++
 include/linux/tty_driver.h      |    9 +++++++++
 include/linux/usb/serial.h      |    2 ++
 5 files changed, 61 insertions(+), 19 deletions(-)
drivers/char/tty_io.c +21 -0
@@ -96,6 +96,7 @@
 #include <linux/bitops.h>
 #include <linux/delay.h>
 #include <linux/seq_file.h>
+#include <linux/serial.h>
 
 #include <linux/uaccess.h>
 #include <asm/system.h>
@@ -2436,6 +2437,20 @@ static int tty_tiocmset(struct tty_struc
 	return tty->ops->tiocmset(tty, file, set, clear);
 }
 
+static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
+{
+	int retval = -EINVAL;
+	struct serial_icounter_struct icount;
+	memset(&icount, 0, sizeof(icount));
+	if (tty->ops->get_icount)
+		retval = tty->ops->get_icount(tty, &icount);
+	if (retval != 0)
+		return retval;
+	if (copy_to_user(arg, &icount, sizeof(icount)))
+		return -EFAULT;
+	return 0;
+}
+
 struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
 {
 	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
@@ -2556,6 +2571,12 @@ long tty_ioctl(struct file *file, unsign
 	case TIOCMBIC:
 	case TIOCMBIS:
 		return tty_tiocmset(tty, file, cmd, p);
+	case TIOCGICOUNT:
+		retval = tty_tiocgicount(tty, p);
+		/* For the moment allow fall through to the old method */
+        	if (retval != -EINVAL)
+			return retval;
+		break;
 	case TCFLSH:
 		switch (arg) {
 		case TCIFLUSH:
drivers/serial/serial_core.c +16 -19
@@ -1067,10 +1067,10 @@ uart_wait_modem_status(struct uart_state
  * NB: both 1->0 and 0->1 transitions are counted except for
  *     RI where only 0->1 is counted.
  */
-static int uart_get_count(struct uart_state *state,
-			  struct serial_icounter_struct __user *icnt)
+static int uart_get_icount(struct tty_struct *tty,
+			  struct serial_icounter_struct *icount)
 {
-	struct serial_icounter_struct icount;
+	struct uart_state *state = tty->driver_data;
 	struct uart_icount cnow;
 	struct uart_port *uport = state->uart_port;
 
@@ -1078,19 +1078,19 @@ static int uart_get_count(struct uart_st
 	memcpy(&cnow, &uport->icount, sizeof(struct uart_icount));
 	spin_unlock_irq(&uport->lock);
 
-	icount.cts         = cnow.cts;
-	icount.dsr         = cnow.dsr;
-	icount.rng         = cnow.rng;
-	icount.dcd         = cnow.dcd;
-	icount.rx          = cnow.rx;
-	icount.tx          = cnow.tx;
-	icount.frame       = cnow.frame;
-	icount.overrun     = cnow.overrun;
-	icount.parity      = cnow.parity;
-	icount.brk         = cnow.brk;
-	icount.buf_overrun = cnow.buf_overrun;
+	icount->cts         = cnow.cts;
+	icount->dsr         = cnow.dsr;
+	icount->rng         = cnow.rng;
+	icount->dcd         = cnow.dcd;
+	icount->rx          = cnow.rx;
+	icount->tx          = cnow.tx;
+	icount->frame       = cnow.frame;
+	icount->overrun     = cnow.overrun;
+	icount->parity      = cnow.parity;
+	icount->brk         = cnow.brk;
+	icount->buf_overrun = cnow.buf_overrun;
 
-	return copy_to_user(icnt, &icount, sizeof(icount)) ? -EFAULT : 0;
+	return 0;
 }
 
 /*
@@ -1143,10 +1143,6 @@ uart_ioctl(struct tty_struct *tty, struc
 	case TIOCMIWAIT:
 		ret = uart_wait_modem_status(state, arg);
 		break;
-
-	case TIOCGICOUNT:
-		ret = uart_get_count(state, uarg);
-		break;
 	}
 
 	if (ret != -ENOIOCTLCMD)
@@ -2322,6 +2318,7 @@ static const struct tty_operations uart_
 #endif
 	.tiocmget	= uart_tiocmget,
 	.tiocmset	= uart_tiocmset,
+	.get_icount	= uart_get_icount,
 #ifdef CONFIG_CONSOLE_POLL
 	.poll_init	= uart_poll_init,
 	.poll_get_char	= uart_poll_get_char,
drivers/usb/serial/usb-serial.c +13 -0
@@ -562,6 +562,18 @@ static int serial_tiocmset(struct tty_st
 	return -EINVAL;
 }
 
+static int serial_get_icount(struct tty_struct *tty,
+				struct serial_icounter_struct *icount)
+{
+	struct usb_serial_port *port = tty->driver_data;
+
+	dbg("%s - port %d", __func__, port->number);
+
+	if (port->serial->type->get_icount)
+		return port->serial->type->get_icount(tty, icount);
+	return -EINVAL;
+}
+
 /*
  * We would be calling tty_wakeup here, but unfortunately some line
  * disciplines have an annoying habit of calling tty->write from
@@ -1214,6 +1226,7 @@ static const struct tty_operations seria
 	.chars_in_buffer =	serial_chars_in_buffer,
 	.tiocmget =		serial_tiocmget,
 	.tiocmset =		serial_tiocmset,
+	.get_icount = 		serial_get_icount,
 	.cleanup = 		serial_cleanup,
 	.install = 		serial_install,
 	.proc_fops =		&serial_proc_fops,
include/linux/tty_driver.h +9 -0
@@ -224,6 +224,12 @@
  *	unless the tty also has a valid tty->termiox pointer.
  *
  *	Optional: Called under the termios lock
+ *
+ * int (*get_icount)(struct tty_struct *tty, struct serial_icounter *icount);
+ *
+ *	Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
+ *	structure to complete. This method is optional and will only be called
+ *	if provided (otherwise EINVAL will be returned).
  */
 
 #include <linux/fs.h>
@@ -232,6 +238,7 @@
 
 struct tty_struct;
 struct tty_driver;
+struct serial_icounter_struct;
 
 struct tty_operations {
 	struct tty_struct * (*lookup)(struct tty_driver *driver,
@@ -268,6 +275,8 @@ struct tty_operations {
 			unsigned int set, unsigned int clear);
 	int (*resize)(struct tty_struct *tty, struct winsize *ws);
 	int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
+	int (*get_icount)(struct tty_struct *tty,
+				struct serial_icounter_struct *icount);
 #ifdef CONFIG_CONSOLE_POLL
 	int (*poll_init)(struct tty_driver *driver, int line, char *options);
 	int (*poll_get_char)(struct tty_driver *driver, int line);
include/linux/usb/serial.h +2 -0
@@ -259,6 +259,8 @@ struct usb_serial_driver {
 	int  (*tiocmget)(struct tty_struct *tty, struct file *file);
 	int  (*tiocmset)(struct tty_struct *tty, struct file *file,
 			 unsigned int set, unsigned int clear);
+	int  (*get_icount)(struct tty_struct *tty,
+			struct serial_icounter_struct *icount);
 	/* Called by the tty layer for port level work. There may or may not
 	   be an attached tty at this point */
 	void (*dtr_rts)(struct usb_serial_port *port, int on);
author
#25 lore raw

PATCH 25/25 tty: icount changeover for other main devices

In reply to Greg KH

2.6.32-longterm review patch. If anyone has any objections, please let me know.

------------------
Content-Length: 29486
Lines: 956

From: Alan Cox <[email protected]>

commit 0587102cf9f427c185bfdeb2cef41e13ee0264b1 upstream

Again basically cut and paste

Convert the main driver set to use the hooks for GICOUNT

---
 arch/ia64/hp/sim/simserial.c      |   12 ------
 drivers/char/amiserial.c          |   56 ++++++++++++++++-------------
 drivers/char/cyclades.c           |   49 +++++++++++++------------
 drivers/char/ip2/ip2main.c        |   72 ++++++++++++++++++++++---------------
 drivers/char/mxser.c              |   62 ++++++++++++++++++--------------
 drivers/char/nozomi.c             |   35 ++++++++----------
 drivers/char/pcmcia/synclink_cs.c |   60 ++++++++++++++-----------------
 drivers/char/synclink.c           |   73 +++++++++++++++++---------------------
 drivers/char/synclink_gt.c        |   56 +++++++++++++++--------------
 drivers/char/synclinkmp.c         |   61 ++++++++++++++-----------------
 drivers/serial/68360serial.c      |   51 +++++++++++++-------------
 net/bluetooth/rfcomm/tty.c        |    4 --
 12 files changed, 296 insertions(+), 295 deletions(-)
arch/ia64/hp/sim/simserial.c +1 -11
@@ -395,7 +395,7 @@ static int rs_ioctl(struct tty_struct *t
 {
 	if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
 	    (cmd != TIOCSERCONFIG) && (cmd != TIOCSERGSTRUCT) &&
-	    (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT)) {
+	    (cmd != TIOCMIWAIT)) {
 		if (tty->flags & (1 << TTY_IO_ERROR))
 		    return -EIO;
 	}
@@ -433,16 +433,6 @@ static int rs_ioctl(struct tty_struct *t
 		case TIOCMIWAIT:
 			printk(KERN_INFO "rs_ioctl: TIOCMIWAIT: called\n");
 			return 0;
-		/*
-		 * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
-		 * Return: write counters to the user passed counter struct
-		 * NB: both 1->0 and 0->1 transitions are counted except for
-		 *     RI where only 0->1 is counted.
-		 */
-		case TIOCGICOUNT:
-			printk(KERN_INFO "rs_ioctl: TIOCGICOUNT called\n");
-			return 0;
-
 		case TIOCSERGWILD:
 		case TIOCSERSWILD:
 			/* "setserial -W" is called in Debian boot */
drivers/char/amiserial.c +31 -25

74 lines not on this page · raw message

drivers/char/cyclades.c +26 -23

67 lines not on this page · raw message

drivers/char/ip2/ip2main.c +43 -29

102 lines not on this page · raw message

drivers/char/mxser.c +35 -27

86 lines not on this page · raw message

drivers/char/nozomi.c +17 -18
@@ -1783,24 +1783,24 @@ static int ntty_cflags_changed(struct po
 	return ret;
 }
 
-static int ntty_ioctl_tiocgicount(struct port *port, void __user *argp)
+static int ntty_tiocgicount(struct tty_struct *tty,
+				struct serial_icounter_struct *icount)
 {
+	struct port *port = tty->driver_data;
 	const struct async_icount cnow = port->tty_icount;
-	struct serial_icounter_struct icount;
-
-	icount.cts = cnow.cts;
-	icount.dsr = cnow.dsr;
-	icount.rng = cnow.rng;
-	icount.dcd = cnow.dcd;
-	icount.rx = cnow.rx;
-	icount.tx = cnow.tx;
-	icount.frame = cnow.frame;
-	icount.overrun = cnow.overrun;
-	icount.parity = cnow.parity;
-	icount.brk = cnow.brk;
-	icount.buf_overrun = cnow.buf_overrun;
 
-	return copy_to_user(argp, &icount, sizeof(icount)) ? -EFAULT : 0;
+	icount->cts = cnow.cts;
+	icount->dsr = cnow.dsr;
+	icount->rng = cnow.rng;
+	icount->dcd = cnow.dcd;
+	icount->rx = cnow.rx;
+	icount->tx = cnow.tx;
+	icount->frame = cnow.frame;
+	icount->overrun = cnow.overrun;
+	icount->parity = cnow.parity;
+	icount->brk = cnow.brk;
+	icount->buf_overrun = cnow.buf_overrun;
+	return 0;
 }
 
 static int ntty_ioctl(struct tty_struct *tty, struct file *file,
@@ -1819,9 +1819,7 @@ static int ntty_ioctl(struct tty_struct
 		rval = wait_event_interruptible(port->tty_wait,
 				ntty_cflags_changed(port, arg, &cprev));
 		break;
-	} case TIOCGICOUNT:
-		rval = ntty_ioctl_tiocgicount(port, argp);
-		break;
+	}
 	default:
 		DBG1("ERR: 0x%08X, %d", cmd, cmd);
 		break;
@@ -1895,6 +1893,7 @@ static const struct tty_operations tty_o
 	.chars_in_buffer = ntty_chars_in_buffer,
 	.tiocmget = ntty_tiocmget,
 	.tiocmset = ntty_tiocmset,
+	.get_icount = ntty_tiocgicount,
 };
 
 /* Module initialization */
drivers/char/pcmcia/synclink_cs.c +27 -33

85 lines not on this page · raw message

drivers/char/synclink.c +34 -39

104 lines not on this page · raw message

drivers/char/synclink_gt.c +29 -27

92 lines not on this page · raw message

drivers/char/synclinkmp.c +28 -33

91 lines not on this page · raw message

drivers/serial/68360serial.c +25 -26

69 lines not on this page · raw message

net/bluetooth/rfcomm/tty.c +0 -4
@@ -844,10 +844,6 @@ static int rfcomm_tty_ioctl(struct tty_s
 		BT_DBG("TIOCMIWAIT");
 		break;
 
-	case TIOCGICOUNT:
-		BT_DBG("TIOCGICOUNT");
-		break;
-
 	case TIOCGSERIAL:
 		BT_ERR("TIOCGSERIAL is not supported");
 		return -ENOIOCTLCMD;