NFC: microread: Potential overflows in microread_target_discovered()

Smatch says that skb->data is untrusted so we need to check to make sure
that the memcpy() doesn't overflow.

Fixes: cfad1ba87150 ('NFC: Initial support for Inside Secure microread')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
NFC: st21nfcb: Fix depmod dependency cycle

This fix issue reported here:
https://lists.01.org/pipermail/linux-nfc/2014-September/002871.html

depmod: WARNING: found 6 modules in dependency cycles!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/st21nfcb.ko
in dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/ndlc.ko
in dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/rfkill/rfkill.ko in
dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nfc.ko in
dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nci/nci.ko in
dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/lib/crc-ccitt.ko in
dependency cycle!
./scripts/depmod.sh: line 57: 23387 Segmentation fault      (core
dumped) "$DEPMOD" "$@" "$KERNELRELEASE" $SYMBOL_PREFIX
make: *** [_modinst_post] Error 139

Reported-by: Daniel Wagner <wagi@monom.org>
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
NFC: st21nfca: Fix potential depmod dependency cycle

In the previous makefile 2 modules were generated for CONFIG_NFC_ST21NFCA
(st21nfca.ko and st21nfca_dep.ko). Merge both of them into st21nfca_hci.ko
and fix a potential depmod dependency cycle, similar to the one we saw
on st21nfcb:

depmod: WARNING: found 6 modules in dependency cycles!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/st21nfcb.ko
in dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/ndlc.ko
in dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/rfkill/rfkill.ko in
dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nfc.ko in
dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nci/nci.ko in
dependency cycle!
depmod: WARNING:
/lib/modules/3.17.0-rc3-00002-g7505cea/kernel/lib/crc-ccitt.ko in
dependency cycle!
./scripts/depmod.sh: line 57: 23387 Segmentation fault      (core
dumped) "$DEPMOD" "$@" "$KERNELRELEASE" $SYMBOL_PREFIX
make: *** [_modinst_post] Error 139

Reported-by: Daniel Wagner <wagi@monom.org>
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
of: correct of_console_check()'s return value

The comments above of_console_check() say that it will return TRUE if it
registers a preferred console, but add_preferred_console() uses a
0-equals-success convention, so this leaves of_console_check() with an
inconsistent policy for its return values.

Fortunately, nobody was actually checking the return value of
of_console_check(), so this isn't significant at the moment.

But let's match the comments, so we're doing what we say.

Fixes: 3482f2c52b77 ('of: Create of_console_check() for selecting a console specified in /chosen')
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
of: Disabling OF functions that use sysfs if CONFIG_SYSFS disabled

This patch is to the fix the recent runtime bug in kernel reported by
<fengguang.wu@intel.com>. The bug was exposed by commit b951f9dc,
"Enabling OF selftest to run without machine's devicetree" and is
exposed when CONFIG_OF_SELFTEST is enabled and CONFIG_SYSFS is
disabled.

Mail Subject: [OF test] BUG: unable to handle kernel NULL pointer
dereference at 00000038

Tested on x86 and arm architecture

Signed-off-by: Gaurav Minocha <gaurav.minocha.os@gmail.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
of: Documentation regarding attaching OF Selftest testdata

This patch add a document that explains how the selftest test data is
dynamically attached into the live device tree irrespective of the
machine's architecture.

Signed-off-by: Gaurav Minocha <gaurav.minocha.os@gmail.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
of: make sure of_alias is initialized before accessing it

Simply swap of_alias and of_chosen initialization so
that of_alias ends up read first. This must be done
because it is accessed couple of lines below when
trying to initialize the of_stdout using the alias
based legacy method.

[Fixes a752ee5 - tty: Update hypervisor tty drivers to
use core stdout parsing code]

Signed-off-by: Laurentiu Tudor <Laurentiu.Tudor@freescale.com>
[glikely: Don't move the 'if (!of_aliases)' test]
Signed-off-by: Grant Likely <grant.likely@linaro.org>
of: Fix memory block alignment in early_init_dt_add_memory_arch()

If a memory block is not aligned to PAGE_SIZE, its base address must be
rounded up, not down, and its size must be reduced.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
hwmon: (fam15h_power) Make actual power reporting conditional

power1_input should only be reported for Fam15h, Models 00h-0fh
So, introduce a is_visible function to take care of this.

As suggested by Guenter here:
http://marc.info/?l=linux-kernel&m=141038145616437&w=2

Suggested-by: Guenter Roeck <linux@roeck-us.net>
Fixes: 22e32f4f5777 ('x86,AMD: Power driver support for AMD's family 16h processors')
Signed-off-by: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (fam15h_power) Add support for two more processors

Fam16h,M30h(Mullins) and Fam15hM30h(Kaveri) processors can
report 'power_crit' value. So, adding their respective device ids.

Signed-off-by: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
crypto: qat - Enable all 32 IRQs

Enable interrupts from all 32 bundles.

Signed-off-by: Conor McLoughlin <conor.mcloughlin@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
cgroup: fix unbalanced locking

cgroup_pidlist_start() holds cgrp->pidlist_mutex and then calls
pidlist_array_load(), and cgroup_pidlist_stop() releases the mutex.

It is wrong that we release the mutex in the failure path in
pidlist_array_load(), because cgroup_pidlist_stop() will be called
no matter if cgroup_pidlist_start() returns errno or not.

Fixes: 4bac00d16a8760eae7205e41d2c246477d42a210
Cc: <stable@vger.kernel.org> # 3.14+
Signed-off-by: Zefan Li <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
ALSA: hda - Add fixup model name lookup for Lemote A1205

Lemote A1004 is already added in commit a2dd933d01f (ALSA: hda - Add
fixup name lookup for CX5051 and 5066 codecs), but Lemote A1205 has
missing.

Signed-off-by: Huacai Chen <chenhc@lemote.com>
Cc: <stable@vger.kernel.org> # 3.15+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
RDMA/ocrdma: Report correct value of max_fast_reg_page_list_len

Fix ocrdma_query_device() to report correct value of max_fast_reg_page_list_len.

Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
Signed-off-by: Selvin Xavier <selvin.xavier@emulex.com>
Signed-off-by: Mitesh Ahuja <mitesh.ahuja@emulex.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
RDMA/ocrdma: Do not skip setting deferred_arm

When ib_request_notify_cq() is called for the first time, ocrdma tries
to skip setting deffered_arm flag. This may lead CQ to an un-armed
state thus never generating a CQ event and leaving consumer hung.

This patch removes the part of code that skips setting deferred_arm.

Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
Signed-off-by: Selvin Xavier <selvin.xavier@emulex.com>
Signed-off-by: Mitesh Ahuja <mitesh.ahuja@emulex.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
IB: ib_umem_release() should decrement mm->pinned_vm from ib_umem_get

In debugging an application that receives -ENOMEM from ib_reg_mr(), I
found that ib_umem_get() can fail because the pinned_vm count has
wrapped causing it to always be larger than the lock limit even with
RLIMIT_MEMLOCK set to RLIM_INFINITY.

The wrapping of pinned_vm occurs because the process that calls
ib_reg_mr() will have its mm->pinned_vm count incremented.  Later a
different process with a different mm_struct than the one that
allocated the ib_umem struct ends up releasing it which results in
decrementing the new processes mm->pinned_vm count past zero and
wrapping.

I'm not entirely sure what circumstances cause a different process to
release the ib_umem than the one that allocated it but the kernel
stack trace of the freeing process from my situation looks like the
following:

    Call Trace:
     [<ffffffff814d64b1>] dump_stack+0x19/0x1b
     [<ffffffffa0b522a5>] ib_umem_release+0x1f5/0x200 [ib_core]
     [<ffffffffa0b90681>] mlx4_ib_destroy_qp+0x241/0x440 [mlx4_ib]
     [<ffffffffa0b4d93c>] ib_destroy_qp+0x12c/0x170 [ib_core]
     [<ffffffffa0cc7129>] ib_uverbs_close+0x259/0x4e0 [ib_uverbs]
     [<ffffffff81141cba>] __fput+0xba/0x240
     [<ffffffff81141e4e>] ____fput+0xe/0x10
     [<ffffffff81060894>] task_work_run+0xc4/0xe0
     [<ffffffff810029e5>] do_notify_resume+0x95/0xa0
     [<ffffffff814e3dd0>] int_signal+0x12/0x17

The following patch fixes the issue by storing the pid struct of the
process that calls ib_umem_get() so that ib_umem_release and/or
ib_umem_account() can properly decrement the pinned_vm count of the
correct mm_struct.

Signed-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>
Reviewed-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Revert "PCI: Don't scan random busses in pci_scan_bridge()"

This reverts commit fc1b253141b3 ("PCI: Don't scan random busses in
pci_scan_bridge()") because it breaks CardBus on some machines.

David tested a Dell Latitude D505 that worked like this prior to
fc1b253141b3:

    pci 0000:00:1e.0: PCI bridge to [bus 01]
    pci 0000:01:01.0: CardBus bridge to [bus 02-05]

Note that the 01:01.0 CardBus bridge has a bus number aperture of
[bus 02-05], but those buses are all outside the 00:1e.0 PCI bridge bus
number aperture, so accesses to buses 02-05 never reach CardBus.  This is
later patched up by yenta_fixup_parent_bridge(), which changes the
subordinate bus number of the 00:1e.0 PCI bridge:

    pci_bus 0000:01: Raising subordinate bus# of parent bus (#01) from #01 to #05

With fc1b253141b3, pci_scan_bridge() fails immediately when it notices that
we can't allocate a valid secondary bus number for the CardBus bridge, and
CardBus doesn't work at all:

    pci 0000:01:01.0: can't allocate child bus 01 from [bus 01]

I'd prefer to fix this by integrating the yenta_fixup_parent_bridge() logic
into pci_scan_bridge() so we fix the bus number apertures up front.  But
I don't think we can do that before v3.17, so I'm going to revert this to
avoid the problem while we're working on the long-term fix.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=83441
Link: http://lkml.kernel.org/r/1409303414-5196-1-git-send-email-david.henningsson@canonical.com
Reported-by: David Henningsson <david.henningsson@canonical.com>
Tested-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: stable@vger.kernel.org	# v3.15+
IB/ipath: Change get_user_pages() usage to always NULL vmas

The static helper routine, __ipath_get_user_pages(), accepts a vma
arg, but current use always passes NULL.

This has caused some confusion associated with the correct use of this
argument, but since the current use case doesn't require the
flexiblity, the best thing to do is to simplfy the code to always pass
NULL to get_user_pages().

Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
IB/qib: Change get_user_pages() usage to always NULL vmas

The static helper routine, __qib_get_user_pages(), accepts a vma arg,
but current use always passes NULL.

This has caused some confusion associated with the correct use of this
argument, but since the current use case doesn't require the
flexiblity, the best thing to do is to simplfy the code to always pass
NULL to get_user_pages().

Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
IB/mlx4: Disable TSO for Connect-X rev. A0 HCAs

According to <http://marc.info/?t=138347640900004&r=1&w=2>, revision
A0 of Connect-X does not correctly assemble TSO packets.  Disable that
feature on that hardware revision.

Signed-off-by: Roland Dreier <roland@purestorage.com>