This patch verifies two conditions before executing
a kmalloc call. First, it checks to see that
IoBuffer.OutputLength is not greater than an
unsigned short. If so, an invalid value may be
returned. The second change is a check to make
sure IoBuffer.OutputLength is not equal to
zero. Which simply keeps this code inline with
the other ioctl, IOCTL_BCM_REGISTER_READ_PRIVATE.
Signed-off-by: NKevin McKinney <klmckinney1@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Fix information leak in ioctl: IOCTL_BCM_REGISTER_READ_PRIVATE, IOCTL_BCM_EEPROM_REGISTER_READ

This patch fixes an information leak in ioctl
IOCTL_BCM_REGISTER_READ_PRIVATE and
IOCTL_BCM_EEPROM_REGISTER_READ when determining
the number of bytes to copy to user space.  Function,
usb_control_msg, returns the correct number of
bytes from the hardware.  Instead of using
this value, we were using a value derived from
user space. In this case, this value could be more
than the hardware allocated.  Therefore, this
patch copies the proper number of bytes from
the hardware, and uses this value as the maximum
number of bytes for user space.
Signed-off-by: NKevin McKinney <klmckinney1@gmail.com>
Reviewed-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NDiego F. Marfil <diegomarfil@gmail.com>
Reviewed-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NDiego F. Marfil <diegomarfil@gmail.com>
Reviewed-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NDiego F. Marfil <diegomarfil@gmail.com>
Reviewed-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use kmemdup rather than duplicating its implementation

The semantic patch that makes this change is available
in scripts/coccinelle/api/memdup.cocci.
Signed-off-by: NThomas Meyer <thomas@m3y3r.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Support hot-removing of scsi devices.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Support hot add of scsi disks.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In preparation for supporting hot add/remove of scsi devices,
upgrade the vmstor protocol version.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Get rid of an unnecessary forward declaration.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use the macro KBUILD_MODNAME.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use the unlocked version queuecommand.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use the accessor function shost_priv().
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix error handling storvsc_host_reset(). I would like to thank
Long Li <longli@microsoft.com> for reporting this.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Reported-by: NLong Li <longli@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fixup the error when processing SET_WINDOW command.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cleanup error handling in the probe function.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

We intend to use the storage driver to manage the root device.
To avoid deadlocks, use mempools to allocate struct storvsc_cmd_request.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use the KBUILD_MODNAME macro.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add a check to prevent memory corruption.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Deal with some style related issues. Also get rid of an unused macro.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Get rid of unnecessary include files.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add a new line to a debug string.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cleanup mousevsc_on_channel_callback(). This is based on the code provided
by Joe Perches <joe@perches.com>.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Inline the code for reportdesc_callback() as this function is called from
mousevsc_probe(). As part of this, cleanup the code in reportdesc_callback().
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Inline the code for mousevsc_on_device_add() as this only used from
the function mousevsc_probe().
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Make some state that is boolean in nature, a boolean variable.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

"tmp" is used to store the output from cpu_to_be16() so it should be
a __be16 bit type.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If the dummy evgen failed init, the irq allocation functions which assume
init succeeded may still be called - causing an OOPS due to wrong assumption.

Here's the oops:

[    3.914332] BUG: unable to handle kernel NULL pointer dereference at 0000000000000148
[    3.915310] IP: [<ffffffff810b3008>] __lock_acquire+0xac/0xe50
[    3.915310] PGD 0
[    3.915310] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[    3.915310] CPU 1
[    3.915310] Pid: 1, comm: swapper Not tainted 3.2.0-rc2-sasha-00279-gd7bfb12-dirty #20
[    3.915310] RIP: 0010:[<ffffffff810b3008>]  [<ffffffff810b3008>] __lock_acquire+0xac/0xe50
[    3.915310] RSP: 0018:ffff880012499bc0  EFLAGS: 00010046
[    3.915310] RAX: 0000000000000086 RBX: ffff880012490000 RCX: 0000000000000000
[    3.915310] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000148
[    3.915310] RBP: ffff880012499c90 R08: 0000000000000002 R09: 0000000000000000
[    3.915310] R10: 0000000000000148 R11: 0000000000000000 R12: 0000000000000148
[    3.915310] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000
[    3.915310] FS:  0000000000000000(0000) GS:ffff880013c00000(0000) knlGS:0000000000000000
[    3.915310] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    3.915310] CR2: 0000000000000148 CR3: 0000000002605000 CR4: 00000000000406e0
[    3.915310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    3.915310] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    3.915310] Process swapper (pid: 1, threadinfo ffff880012498000, task ffff880012490000)
[    3.915310] Stack:
[    3.915310]  ffff880012490000 ffffffff81e6fd38 ffffffff00000000 0000000000000000
[    3.915310]  0000000000000148 0000000012499c08 ffffffff00000000 000000000000002e
[    3.915310]  0000000000000001 ffff880012499ce0 ffffffff8161620e 0000000000000000
[    3.915310] Call Trace:
[    3.915310]  [<ffffffff81e6fd38>] ? retint_restore_args+0x13/0x13
[    3.915310]  [<ffffffff8161620e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[    3.915310]  [<ffffffff81e6fd38>] ? retint_restore_args+0x13/0x13
[    3.915310]  [<ffffffff81af8883>] ? iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff810b4255>] lock_acquire+0x8a/0xa7
[    3.915310]  [<ffffffff81af8883>] ? iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff81e6db81>] __mutex_lock_common+0x63/0x491
[    3.915310]  [<ffffffff81af8883>] ? iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff810b474d>] ? debug_check_no_locks_freed+0x135/0x14a
[    3.915310]  [<ffffffff810b2c3a>] ? lock_is_held+0x92/0x9d
[    3.915310]  [<ffffffff81e6dfe5>] mutex_lock_nested+0x36/0x3b
[    3.915310]  [<ffffffff81af8883>] iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff81af8594>] iio_simple_dummy_events_register+0x1b/0x69
[    3.915310]  [<ffffffff82ad4a91>] iio_dummy_init+0x105/0x18d
[    3.915310]  [<ffffffff82ad498c>] ? iio_init+0x7d/0x7d
[    3.915310]  [<ffffffff82a8dc02>] do_one_initcall+0x7a/0x135
[    3.915310]  [<ffffffff82a8dda7>] kernel_init+0xea/0x16f
[    3.915310]  [<ffffffff81e727c4>] kernel_thread_helper+0x4/0x10
[    3.915310]  [<ffffffff81e6fd38>] ? retint_restore_args+0x13/0x13
[    3.915310]  [<ffffffff82a8dcbd>] ? do_one_initcall+0x135/0x135
[    3.915310]  [<ffffffff81e727c0>] ? gs_change+0x13/0x13
[    3.915310] Code: 95 50 ff ff ff 74 24 e8 1f 3f 56 00 85 c0 0f 84 4e 0d 00 00 be cf 0b 00 00 83 3d 63 7c 58 02 00 0f 85 3c 0d 00 00 e9 c1 0c 00 00
[    3.915310]  81 3a a0 17 ca 82 b8 01 00 00 00 44 0f 44 e8 83 fe 01 77 0c
[    3.915310] RIP  [<ffffffff810b3008>] __lock_acquire+0xac/0xe50
[    3.915310]  RSP <ffff880012499bc0>
[    3.915310] CR2: 0000000000000148
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NSasha Levin <levinsasha928@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Quite a few iio drivers provide no MODULE_DEVICE_TABLE or MODULE_ALIAS or only
provide a MODULE_ALIAS while they have support for multiple device ids. This
prevents auto module loading from working correctly.

This patch fixes it by adding the missing MODULE_DEVICE_TABLEs and
MODULE_ALIAS'.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Commit e6477000 ("staging:iio:dummy Add event support + fake event
generator") added "select IIO_SIMPLE_DUMMY_EVGEN if [...]". But there
is no Kconfig symbol named IIO_SIMPLE_DUMMY_EVGEN. The select statement
for that symbol is a nop. Drop it.
Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
Acked-by: NJonathan Cameron <jic23@camd.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The AD5662 is compatible to the AD5660, but uses an external reference instead
of an internal.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds support for the Analog Devices AD5421 Loop-Powered, 4mA to 20mA
DAC.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Make sure we only use the allotted space for channel numbers in the event mask
and do not let them override other fields.

Since negative values are valid channel number, cast the channel number to
signed when extracting it from an event mask.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some devices have fixed thresholds which can not be modified so make the
write_event_value callback optional, so the drivers for these devices do not
have to implement a boilerplate no-op callback.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

ad5360_get_channel_vref() returns an int and scale_uv should be the
same.  Making it unsigned here breaks the error handling.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

regulator_get_voltage() returns an int so "scale_uv" should be an
int.  Making it unsigned here breaks the error handling.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Internally the fact that say scale is shared across channels is
actually of remarkably little interest.  Hence lets not store it.
Numerous devices have weird combinations of channels sharing
scale anyway so it is not as though this was really telling
us much. Note however that we do still use the shared sysfs
attrs thus massively reducing the number of attrs in complex
drivers.

Side effect is that certain drivers that were abusing this
(mostly my work) needed to do a few more checks on what the
channel they are being queried on actually is.

This is also helpful for in kernel interfaces where we
just want to query the scale and don't care whether it
is shared with other channels or not.
Signed-off-by: NJonathan Cameron <jic23@cam.ac.uk>
Acked-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>