user/sven/linux.git/drivers, branch v4.12.12

rtlwifi: Fix fallback firmware loading

2017-09-09T15:39:35Z

commit 1d9b168d8ea9a0f51947d0e2f84856e77d2fe7ff upstream. Commit f70e4df2b384 ("rtlwifi: Add code to read new versions of firmware") added code to load an old firmware file if the new one is not available. Unfortunately that code is never reached because request_firmware_nowait() does not wait for the firmware to show up and returns 0 even if the file is not there. Use the existing fallback mechanism introduced by commit 62009b7f1279 ("rtlwifi: rtl8192cu: Add new firmware") instead. Fixes: f70e4df2b384 ("rtlwifi: Add code to read new versions of firmware") Signed-off-by: Sven Joachim Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman

rtlwifi: Fix memory leak when firmware request fails

2017-09-09T15:39:35Z

commit f2764f61fa10593204b0c5e4e9a68dba02112e50 upstream. This patch will fix memory leak when firmware request fails Signed-off-by: Souptick Joarder Acked-by: Larry Finger Signed-off-by: Kalle Valo Cc: Sven Joachim Signed-off-by: Greg Kroah-Hartman

of/device: Prevent buffer overflow in of_device_modalias()

2017-09-09T15:39:35Z

commit 08ab58d9de3eb8498ae0585001d0975e46217a39 upstream. As of_device_get_modalias() returns the number of bytes that would have been written to the target string, regardless of how much did fit in the buffer, it's possible that the returned index points beyond the buffer passed to of_device_modalias() - causing memory beyond the buffer to be null terminated. Fixes: 0634c2958927 ("of: Add function for generating a DT modalias with a newline") Cc: Rob Herring Signed-off-by: Bjorn Andersson Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman

scsi: sg: recheck MMAP_IO request length with lock held

2017-09-09T15:39:35Z

commit 8d26f491116feaa0b16de370b6a7ba40a40fa0b4 upstream. Commit 1bc0eb044615 ("scsi: sg: protect accesses to 'reserved' page array") adds needed concurrency protection for the "reserve" buffer. Some checks that are initially made outside the lock are replicated once the lock is taken to ensure the checks and resulting decisions are made using consistent state. The check that a request with flag SG_FLAG_MMAP_IO set fits in the reserve buffer also needs to be performed again under the lock to ensure the reserve buffer length compared against matches the value in effect when the request is linked to the reserve buffer. An -ENOMEM should be returned in this case, instead of switching over to an indirect buffer as for non-MMAP_IO requests. Signed-off-by: Todd Poynor Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE

2017-09-09T15:39:35Z

commit 6a8dadcca81fceff9976e8828cceb072873b7bd5 upstream. Take f_mutex around mmap() processing to protect against races with the SG_SET_RESERVED_SIZE ioctl. Ensure the reserve buffer length remains consistent during the mapping operation, and set the "mmap called" flag to prevent further changes to the reserved buffer size as an atomic operation with the mapping. [mkp: fixed whitespace] Signed-off-by: Todd Poynor Acked-by: Douglas Gilbert Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

cs5536: add support for IDE controller variant

2017-09-09T15:39:34Z

commit 591b6bb605785c12a21e8b07a08a277065b655a5 upstream. Several legacy devices such as Geode-based Cisco ASA appliances and DB800 development board do possess CS5536 IDE controller with different PCI id than existing one. Using pata_generic is not always feasible as at least DB800 requires MSR quirk from pata_cs5536 to be used with vendor firmware. Signed-off-by: Andrey Korolyov Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman

ahci: don't use MSI for devices with the silly Intel NVMe remapping scheme

2017-09-09T15:39:34Z

commit f723fa4e69920f6a5dd5fa0d10ce90e2f14d189c upstream. Intel AHCI controllers that also hide NVMe devices in their bar can't use MSI interrupts, so disable them. Reported-by: John Loy Tested-by: John Loy Signed-off-by: Christoph Hellwig Fixes: d684a90d38e2 ("ahci: per-port msix support") Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman

drm/nouveau: Fix error handling in nv50_disp_atomic_commit

2017-09-09T15:39:34Z

commit 813a7e1604eaad1c2792d37d402e1b48b8d0eb3f upstream. Make it more clear that post commit return ret is really return 0, and add a missing drm_atomic_helper_cleanup_planes when drm_atomic_helper_wait_for_fences fails. Fixes: 839ca903f12e ("drm/nouveau/kms/nv50: transition to atomic interfaces internally") Cc: Ben Skeggs Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/20170711143314.2148-2-maarten.lankhorst@linux.intel.com Reviewed-by: Sean Paul [mlankhorst: Use if (ret) to remove the goto in success case.] Reviewed-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman

drm/nouveau/pci/msi: disable MSI on big-endian platforms by default

2017-09-09T15:39:33Z

commit bc60c90f472b6e762ea96ef384072145adc8d4af upstream. It appears that MSI does not work on either G5 PPC nor on a E5500-based platform, where other hardware is reported to work fine with MSI. Both tests were conducted with NV4x hardware, so perhaps other (or even this) hardware can be made to work. It's still possible to force-enable with config=NvMSI=1 on load. Signed-off-by: Ilia Mirkin Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman

MCB: add support for SC31 to mcb-lpc

2017-09-09T15:39:33Z

commit acf5e051ac44d5dc60b21bc4734ef1b844d55551 upstream. This patch adds the resources and DMI ID's for the MEN SC31, which uses a different address region to map the LPC bus than the one used for the existing SC24. Signed-off-by: Michael Moese [jth add stable tag] Signed-off-by: Johannes Thumshirn Signed-off-by: Greg Kroah-Hartman