user/sven/linux.git/drivers/char, branch v3.6.9

tpm: Propagate error from tpm_transmit to fix a timeout hang

2012-10-21T16:32:43Z

commit abce9ac292e13da367bbd22c1f7669f988d931ac upstream. tpm_write calls tpm_transmit without checking the return value and assigns the return value unconditionally to chip->pending_data, even if it's an error value. This causes three bugs. So if we write to /dev/tpm0 with a tpm_param_size bigger than TPM_BUFSIZE=0x1000 (e.g. 0x100a) and a bufsize also bigger than TPM_BUFSIZE (e.g. 0x100a) tpm_transmit returns -E2BIG which is assigned to chip->pending_data as -7, but tpm_write returns that TPM_BUFSIZE bytes have been successfully been written to the TPM, altough this is not true (bug #1). As we did write more than than TPM_BUFSIZE bytes but tpm_write reports that only TPM_BUFSIZE bytes have been written the vfs tries to write the remaining bytes (in this case 10 bytes) to the tpm device driver via tpm_write which then blocks at /* cannot perform a write until the read has cleared either via tpm_read or a user_read_timer timeout */ while (atomic_read(&chip->data_pending) != 0) msleep(TPM_TIMEOUT); for 60 seconds, since data_pending is -7 and nobody is able to read it (since tpm_read luckily checks if data_pending is greater than 0) (#bug 2). After that the remaining bytes are written to the TPM which are interpreted by the tpm as a normal command. (bug #3) So if the last bytes of the command stream happen to be a e.g. tpm_force_clear this gets accidentally sent to the TPM. This patch fixes all three bugs, by propagating the error code of tpm_write and returning -E2BIG if the input buffer is too big, since the response from the tpm for a truncated value is bogus anyway. Moreover it returns -EBUSY to userspace if there is a response ready to be read. Signed-off-by: Peter Huewe Signed-off-by: Kent Yoder Signed-off-by: Greg Kroah-Hartman

TTY: ttyprintk, don't touch behind tty->write_buf

2012-10-07T15:39:31Z

commit ee8b593affdf893012e57f4c54a21984d1b0d92e upstream. If a user provides a buffer larger than a tty->write_buf chunk and passes '\r' at the end of the buffer, we touch an out-of-bound memory. Add a check there to prevent this. Signed-off-by: Jiri Slaby Cc: Samo Pogacnik Signed-off-by: Greg Kroah-Hartman

drm/i915: fix hsw uncached pte

2012-08-17T07:21:35Z

They've changed it ... for no apparent reason. Meh. V2: remove unused 'is_hsw' field. Signed-off-by: Daniel Vetter Signed-off-by: Paulo Zanoni Signed-off-by: Daniel Vetter

Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux

2012-08-14T04:52:41Z

Pull drm fixes from Dave Airlie: "Radeon and intel fixes mostly, one fix to the mgag200 driver to not hang on certain server variants." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (32 commits) drm/radeon: fix typo in function header comment drm/radeon/kms: implement timestamp userspace query (v2) drm/radeon/kms: add MSAA texture support for r600-evergreen drm/radeon/kms: reorder code in r600_check_texture_resource drm/radeon: fence virtual address and free it once idle v4 drm/radeon: fix some missing parens in asic macros drm/radeon: add some new SI pci ids drm/radeon: fix ordering in pll picking on dce4+ drm/radeon: do not reenable crtc after moving vram start address drm/radeon: fix bank tiling parameters on cayman drm/radeon: fix bank tiling parameters on evergreen drm/radeon: fix bank tiling parameters on SI drm/radeon: properly handle crtc powergating drm/radeon: properly handle SS overrides on TN (v2) drm/radeon/dce4+: set a more reasonable cursor watermark drm/radeon: fix handling for ddc type 5 on combios drm/mgag200: fix G200ER pll picking algorithm drm/edid: Fix potential memory leak in edid_load() drm/udl: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(.. [1] drm/radeon/kms: allow "invalid" DB formats as a means to disable DB ...

Merge tag 'pm-for-3.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2012-08-12T18:34:09Z

Pull power management fixes from Rafael J. Wysocki: - Fix for two recent regressions in the generic PM domains framework. - Revert of a commit that introduced a resume regression and is conceptually incorrect in my opinion. - Fix for a return value in pcc-cpufreq.c from Julia Lawall. - RTC wakeup signaling fix from Neil Brown. - Suppression of compiler warnings for CONFIG_PM_SLEEP unset in ACPI, platform/x86 and TPM drivers. * tag 'pm-for-3.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: tpm_tis / PM: Fix unused function warning for CONFIG_PM_SLEEP platform / x86 / PM: Fix unused function warnings for CONFIG_PM_SLEEP ACPI / PM: Fix unused function warnings for CONFIG_PM_SLEEP Revert "NMI watchdog: fix for lockup detector breakage on resume" PM: Make dev_pm_get_subsys_data() always return 0 on success drivers/cpufreq/pcc-cpufreq.c: fix error return code RTC: Avoid races between RTC alarm wakeup and suspend.

tpm_tis / PM: Fix unused function warning for CONFIG_PM_SLEEP

2012-08-10T12:29:50Z

According to a compiler warning, the tpm_tis_resume() function is not used for CONFIG_PM_SLEEP unset, so add a #ifdef to prevent it from being built in that case. Signed-off-by: Rafael J. Wysocki

omap-rng: fix use of SIMPLE_DEV_PM_OPS

2012-08-10T10:28:05Z

omap_rng_suspend and omap_rng_resume are unused if CONFIG_PM is enabled but CONFIG_PM_SLEEP is disabled. I found this while building all defconfig files on ARM. It's not clear to me if this is the right solution, but at least it makes the code consistent again. Without this patch, building omap1_defconfig results in: drivers/char/hw_random/omap-rng.c:165:12: warning: 'omap_rng_suspend' defined but not used [-Wunused-function] drivers/char/hw_random/omap-rng.c:171:12: warning: 'omap_rng_resume' defined but not used [-Wunused-function] Signed-off-by: Arnd Bergmann Acked-by: Kevin Hilman Cc: Rafael J. Wysocki Cc: Herbert Xu

Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-next

2012-08-08T23:54:49Z

Daniel writes: "- Regression fixer for an OOPS at boot when i915.ko is built-in and CONFIG_PM=n, introduce in 3.5 (patch from Hunt Xu) - Regression fixer for occlusion query failures, the required w/a wasn't applied in all cases (thanks to Eric for tracking this on down). - dmar vs. dma_buf imprt fix (Dave Airlie) - 2 patches to fight down forcewake issues on snb. This is the stuff I've talked about 2 weeks ago already, it's a minefield. Investigation still going on, but afaict this is the best we have for now. - a few minor things to keep coverty&compiler happy (Alan, Davendra, Stéphane) - tons of hsw pci ids - this one is a bit late because internal approval sometimes takes a while, but ppl in charge finally agreed that world+dog already knows about ult and crw haswell variants ;-) Wrt regressions I'm aware of: - the power regression due to semaphores=1. Ben is running around with a killawatt, unfortunately we have a hard time reproducing this one. And this /shouldn't/ increase power usage. Ben has turned up a few odds bits though already. - the lvds fix in 3.6-rc1 broke a backlight after lid close/open (but can be resurrected with a modeset cycle). I guess we anger the bios - I'm still looking into this one. - gmbus broke edid reading on an odd-ball monitor, we need to fall-back. Due to vacation (both mine&the reporter's) this is stalling for a final patch and a tested-by on it. But issue is fully diagnosed." * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: correctly order the ring init sequence drm/i915: add more Haswell PCI IDs drm/i915: make rc6 in sysfs functions conditional drm/i915: Workaround hang with BSD and forcewake on SandyBridge drm/i915: Make intel_panel_get_backlight static. i915: don't map imported dma-bufs for dmar. drm/i915: remove unused variable drm/i915: Don't forget to apply SNB PIPE_CONTROL GTT workaround. drm/i915: fix forcewake related hangs on snb i915: Remove silly test i915: fix error path leak in intel_sdvo_write_cmd vlv: it might be wise if we initialised the flag value...

drm/i915: add more Haswell PCI IDs

2012-08-07T11:17:33Z

Also properly indent the HB IDs. Reviewed-by: Rodrigo Vivi Signed-off-by: Paulo Zanoni Signed-off-by: Daniel Vetter

Merge tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random

2012-08-01T02:07:42Z

Pull random subsystem patches from Ted Ts'o: "This patch series contains a major revamp of how we collect entropy from interrupts for /dev/random and /dev/urandom. The goal is to addresses weaknesses discussed in the paper "Mining your Ps and Qs: Detection of Widespread Weak Keys in Network Devices", by Nadia Heninger, Zakir Durumeric, Eric Wustrow, J. Alex Halderman, which will be published in the Proceedings of the 21st Usenix Security Symposium, August 2012. (See https://factorable.net for more information and an extended version of the paper.)" Fix up trivial conflicts due to nearby changes in drivers/{mfd/ab3100-core.c, usb/gadget/omap_udc.c} * tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: (33 commits) random: mix in architectural randomness in extract_buf() dmi: Feed DMI table to /dev/random driver random: Add comment to random_initialize() random: final removal of IRQF_SAMPLE_RANDOM um: remove IRQF_SAMPLE_RANDOM which is now a no-op sparc/ldc: remove IRQF_SAMPLE_RANDOM which is now a no-op [ARM] pxa: remove IRQF_SAMPLE_RANDOM which is now a no-op board-palmz71: remove IRQF_SAMPLE_RANDOM which is now a no-op isp1301_omap: remove IRQF_SAMPLE_RANDOM which is now a no-op pxa25x_udc: remove IRQF_SAMPLE_RANDOM which is now a no-op omap_udc: remove IRQF_SAMPLE_RANDOM which is now a no-op goku_udc: remove IRQF_SAMPLE_RANDOM which was commented out uartlite: remove IRQF_SAMPLE_RANDOM which is now a no-op drivers: hv: remove IRQF_SAMPLE_RANDOM which is now a no-op xen-blkfront: remove IRQF_SAMPLE_RANDOM which is now a no-op n2_crypto: remove IRQF_SAMPLE_RANDOM which is now a no-op pda_power: remove IRQF_SAMPLE_RANDOM which is now a no-op i2c-pmcmsp: remove IRQF_SAMPLE_RANDOM which is now a no-op input/serio/hp_sdc.c: remove IRQF_SAMPLE_RANDOM which is now a no-op mfd: remove IRQF_SAMPLE_RANDOM which is now a no-op ...