linux.git/drivers, branch v4.14.1

spi: fix use-after-free at controller deregistration

2017-11-21T08:49:24+00:00

commit 67f7b2781fafcc0f52464880154b320fea1ae982 upstream.

The controller is typically freed as part of device_unregister() so
store the bus id before deregistration to avoid use-after-free when the
id is later released.

Fixes: 9b61e302210e ("spi: Pick spi bus number from Linux idr or spi alias")
Signed-off-by: Johan Hovold 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

staging: rtl8188eu: Revert 4 commits breaking ARP

2017-11-21T08:49:24+00:00

commit 66d32fdcbf03851724a8b551d490ae1ddfe6eef2 upstream.

Commit 2ba8444c97b1 ("staging:r8188eu: move IV/ICV trimming into
decrypt() and also place it after rtl88eu_mon_recv_hook()") breaks ARP.

After this commit ssh-ing to a laptop with r8188eu wifi no longer works
if the machine connecting has never communicated with the laptop before.
This is 100% reproducable using "arp -d  && ssh " to ssh to
a laptop with r8188eu wifi.

This commit reverts 4 commits in total:

1. Commit 79650ffde38e ("staging:r8188eu: trim IV/ICV fields in
   validate_recv_data_frame()")
This commit depends on 2 of the other commits being reverted.

2. Commit 02b19b4c4920 ("staging:r8188eu: inline unprotect_frame() in
   mon_recv_decrypted_recv()")
The inline code is wrong the un-inlined version contains:
	if (skb->len < hdr_len + iv_len + icv_len)
		return;
	...
Where as the inline-ed code introduced by this commit does:
	if (skb->len < hdr_len + iv_len + icv_len) {
		...
Note the same check, but now to actually continue doing ... instead
of to not do it, so this commit is no good.

3. Commit d86e16da6a5d ("staging:r8188eu: use different mon_recv_decrypted()
   inside rtl88eu_mon_recv_hook() and rtl88eu_mon_xmit_hook().")
This commit introduced a 1:1 copy of a function so that one of the
2 copies can be modified in the 2 commits we're already reverting.

4. Commit 2ba8444c97b1 ("staging:r8188eu: move IV/ICV trimming into
   decrypt() and also place it after rtl88eu_mon_recv_hook()")
This is the commit actually breaking ARP.

Note this commit is a straight-forward squash of the revert of these
4 commits, without any changes.

Cc: Ivan Safonov 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

staging: vboxvideo: Fix reporting invalid suggested-offset-properties

2017-11-21T08:49:24+00:00

commit ce10d7b4e8e3574b9616e54a09d64521b9aeb8b6 upstream.

The x and y hints receives from the host are unsigned 32 bit integers and
they get set to -1 (0xffffffff) when invalid. Before this commit the
vboxvideo driver was storing them in an u16 causing the -1 to be truncated
to 65535 which, once reported to userspace, was breaking gnome 3.26+
in Wayland mode.

This commit stores the host values in 32 bit variables, removing the
truncation and checks for -1, replacing it with 0 as -1 is not a valid
suggested-offset-property value. Likewise the properties are now
initialized to 0 instead of -1, since -1 is not a valid value.
This fixes gnome 3.26+ in Wayland mode not working with the vboxvideo
driver.

Reported-by: Gianfranco Costamagna 
Cc: Michael Thayer 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman

staging: greybus: spilib: fix use-after-free after deregistration

2017-11-21T08:49:24+00:00

commit 770b03c2ca4aa44d226cf248f86aa23e546147d0 upstream.

Remove erroneous spi_master_put() after controller deregistration which
would access the already freed spi controller.

Note that spi_unregister_master() drops our only controller reference.

Fixes: ba3e67001b42 ("greybus: SPI: convert to a gpbridge driver")
Signed-off-by: Johan Hovold 
Reviewed-by: Rui Miguel Silva 
Acked-by: Viresh Kumar 
Signed-off-by: Greg Kroah-Hartman

staging: ccree: fix 64 bit scatter/gather DMA ops

2017-11-21T08:49:24+00:00

commit e0b3f39092a1cff5548cbaf40096ec25e7721de6 upstream.

Fix a wrong offset used in splitting a 64 DMA address to MSB/LSB
parts needed for scatter/gather HW descriptors causing operations
relying on them to fail on 64 bit platforms.

Fixes: c6f7f2f4591f ("staging: ccree: refactor LLI access macros")
Reported-by: Stuart Yoder 
Signed-off-by: Gilad Ben-Yossef 
Signed-off-by: Greg Kroah-Hartman

staging: sm750fb: Fix parameter mistake in poke32

2017-11-21T08:49:24+00:00

commit 16808dcf605e6302319a8c3266789b76d4c0983b upstream.

In commit c075b6f2d357ea9 ("staging: sm750fb: Replace POKE32 and PEEK32
by inline functions"), POKE32 has been replaced by the inline function
poke32. But it exchange the "addr" and "data" parameters by mistake, so
fix it.

Fixes: c075b6f2d357ea9 ("staging: sm750fb: Replace POKE32 and PEEK32 by inline functions"),
Signed-off-by: Huacai Chen 
Signed-off-by: Liangliang Huang 
Signed-off-by: Greg Kroah-Hartman

staging: wilc1000: Fix bssid buffer offset in Txq

2017-11-21T08:49:23+00:00

commit 1bbf6a6d4091affb27ec0a19d7aa7887ce72f610 upstream.

Commit 46949b48568b ("staging: wilc1000: New cfg packet
format in handle_set_wfi_drv_handler") updated the frame
format sent from host to the firmware. The code to update
the bssid offset in the new frame was part of a second
patch in the series which did not make it in and thus
causes connection problems after associating to an AP.

This fix adds the proper offset of the bssid value in the
Tx queue buffer to fix the connection issues.

Fixes: 46949b48568b ("staging: wilc1000: New cfg packet format in handle_set_wfi_drv_handler")
Signed-off-by: Aditya Shankar 
Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Add missing MODULE_LICENSE

2017-11-21T08:49:23+00:00

commit 1e0d5615bbc37deb7732491798abccf8d3c3d244 upstream.

The qcom_glink_native driver is missing a MODULE_LICENSE(), correct
this.

Fixes: 835764ddd9af ("rpmsg: glink: Move the common glink protocol implementation to glink_native.c")
Reported-by: Randy Dunlap 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection

2017-11-21T08:49:23+00:00

commit 885e89f601a52cc6fb025b009df58ba83d142734 upstream.

The WACOM_PEN_FIELD macro is used to determine if a given HID field should be
associated with pen input. This field includes several known collection types
that Wacom pen data is contained in, but the WACOM_HID_WD_PEN application
collection type is notably missing. This can result in fields within this
kind of collection being completely ignored by the `wacom_usage_mapping`
function, preventing the later '*_event' functions from being notified about
changes to their value.

Fixes: c9c095874a ("HID: wacom: generic: Support and use 'Custom HID' mode and usages")
Fixes: ac2423c975 ("HID: wacom: generic: add vendor defined touch")
Reviewed-by: Ping Cheng 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman

HID: cp2112: add HIDRAW dependency

2017-11-21T08:49:23+00:00

commit cde3076bdc38bf436e517a379759a9092c6ffd4f upstream.

Otherwise, with HIDRAW=n, the probe function crashes because of null
dereference of hdev->hidraw.

Fixes: 42cb6b35b9e6 ("HID: cp2112: use proper hidraw name with minor number")
Signed-off-by: Sébastien Szymanski 
Acked-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman