| Commit message (Collapse) | Author | Age | Files | Lines |
|\ |
|
| |\
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Conflicts:
firmware/Makefile
firmware/epen/W9001_B713.bin.ihex
firmware/epen/W9001_B746.bin.ihex
firmware/epen/W9001_B746JD.bin.ihex
firmware/epen/W9001_B746L.bin.ihex
firmware/epen/W9001_B746S.bin.ihex
|
| | |
| | |
| | |
| | |
| | |
| | | |
Taken from GT-N7100_SEA_KK_Opensource
Change-Id: Ieb6da81ab9472c8e0a8114138b96b727b5f24fc7
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
%X is int. This is too wide for the chars used there, so use %hhx instead. Avoid
undefined pointer casts from char* to unsigned int* in sscanf calls.
Also use the already defined MACF and update it with %hhx instead of typing this
long format string all over again.
Add MACF_U which is the same as MACF but with uppercase hex (%hhX instead of %hhx).
Change-Id: Idd2465e0d05bca9b05566abeec05a5ad59a577ad
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
These were not detected by the stack protector, either because the functions
where not called or because the corruption hits a local variable.
Change-Id: I385c81b133ee09c28df56597df3fb25d9c063f43
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
An sprintf in dhd_write_macaddr wrote a rogue null byte after the buffer.
Found with CONFIG_CC_STACKPROTECTOR=y (idea of Lanchon at XDA Developers [1]).
[1]: http://forum.xda-developers.com/showthread.php?p=55306602
Panic, on a Samsung Galaxy S2 i9100, was:
<0>[ 26.412257] c1 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: bf013a2c
<0>[ 26.412315] c1
<4>[ 26.412334] c1 Backtrace:
<4>[ 26.412382] c1 [<c064e5b8>] (dump_backtrace+0x0/0x10c) from [<c0b91e6c>] (dump_stack+0x18/0x1c)
<4>[ 26.412439] c1 r6:e211e820 r5:c0ed4760 r4:c0f5c940 r3:271aed5c
<4>[ 26.412496] c1 [<c0b91e54>] (dump_stack+0x0/0x1c) from [<c0b92204>] (panic+0x80/0x1ac)
<4>[ 26.412561] c1 [<c0b92184>] (panic+0x0/0x1ac) from [<c0684be0>] (init_oops_id+0x0/0x58)
<4>[ 26.412613] c1 r3:271aed5c r2:271aed00 r1:bf013a2c r0:c0cb8880
<4>[ 26.412663] c1 r7:e273bc32
<4>[ 26.412742] c1 [<c0684bc4>] (__stack_chk_fail+0x0/0x1c) from [<bf013a2c>] (dhd_write_macaddr+0x2e4/0x310 [dhd])
<4>[ 26.412864] c1 [<bf013748>] (dhd_write_macaddr+0x0/0x310 [dhd]) from [<bf01a554>] (dhd_bus_start+0x1a4/0x2e0 [dhd])
<4>[ 26.412985] c1 [<bf01a3b0>] (dhd_bus_start+0x0/0x2e0 [dhd]) from [<bf020558>] (dhdsdio_probe+0x4a4/0x72c [dhd])
<4>[ 26.413097] c1 [<bf0200b4>] (dhdsdio_probe+0x0/0x72c [dhd]) from [<bf00c0ec>] (bcmsdh_probe+0xf8/0x150 [dhd])
<4>[ 26.413206] c1 [<bf00bff4>] (bcmsdh_probe+0x0/0x150 [dhd]) from [<bf00e038>] (bcmsdh_sdmmc_probe+0x54/0xbc [dhd])
<4>[ 26.413304] c1 [<bf00dfe4>] (bcmsdh_sdmmc_probe+0x0/0xbc [dhd]) from [<c09a7fe8>] (sdio_bus_probe+0xfc/0x108)
<4>[ 26.413368] c1 r5:e2d97000 r4:e2d97008
<4>[ 26.413414] c1 [<c09a7eec>] (sdio_bus_probe+0x0/0x108) from [<c0896764>] (driver_probe_device+0x94/0x1a8)
<4>[ 26.413474] c1 r8:00000000 r7:bf067414 r6:e2d9703c r5:c0f6ddb8 r4:e2d97008
<4>[ 26.413531] c1 r3:c09a7eec
<4>[ 26.413563] c1 [<c08966d0>] (driver_probe_device+0x0/0x1a8) from [<c089690c>] (__driver_attach+0x94/0x98)
<4>[ 26.413624] c1 r7:e2e631e0 r6:e2d9703c r5:bf067414 r4:e2d97008
<4>[ 26.413683] c1 [<c0896878>] (__driver_attach+0x0/0x98) from [<c0895678>] (bus_for_each_dev+0x4c/0x94)
<4>[ 26.413742] c1 r6:c0896878 r5:bf067414 r4:00000000 r3:c0896878
<4>[ 26.413799] c1 [<c089562c>] (bus_for_each_dev+0x0/0x94) from [<c0896428>] (driver_attach+0x24/0x28)
<4>[ 26.413857] c1 r6:c0f02af0 r5:bf067414 r4:bf067414
<4>[ 26.413904] c1 [<c0896404>] (driver_attach+0x0/0x28) from [<c08960c8>] (bus_add_driver+0x180/0x250)
<4>[ 26.413970] c1 [<c0895f48>] (bus_add_driver+0x0/0x250) from [<c0896e14>] (driver_register+0x80/0x150)
<4>[ 26.414037] c1 [<c0896d94>] (driver_register+0x0/0x150) from [<c09a8128>] (sdio_register_driver+0x2c/0x30)
<4>[ 26.414131] c1 [<c09a80fc>] (sdio_register_driver+0x0/0x30) from [<bf00e250>] (sdio_function_init+0x3c/0x8c [dhd])
<4>[ 26.414244] c1 [<bf00e214>] (sdio_function_init+0x0/0x8c [dhd]) from [<bf00c19c>] (bcmsdh_register+0x1c/0x24 [dhd])
<4>[ 26.414311] c1 r5:00000004 r4:bf06a3c4
<4>[ 26.414398] c1 [<bf00c180>] (bcmsdh_register+0x0/0x24 [dhd]) from [<bf027990>] (dhd_bus_register+0x24/0x48 [dhd])
<4>[ 26.414515] c1 [<bf02796c>] (dhd_bus_register+0x0/0x48 [dhd]) from [<bf07618c>] (init_module+0x18c/0x284 [dhd])
<4>[ 26.414610] c1 [<bf076000>] (init_module+0x0/0x284 [dhd]) from [<c06448f8>] (do_one_initcall+0x128/0x1a8)
<4>[ 26.414683] c1 [<c06447d0>] (do_one_initcall+0x0/0x1a8) from [<c06b9710>] (sys_init_module+0xdf8/0x1b1c)
<4>[ 26.414756] c1 [<c06b8918>] (sys_init_module+0x0/0x1b1c) from [<c064a8c0>] (ret_fast_syscall+0x0/0x30)
<2>[ 26.414861] c0 CPU0: stopping
<4>[ 26.414886] c0 Backtrace:
<4>[ 26.414920] c0 [<c064e5b8>] (dump_backtrace+0x0/0x10c) from [<c0b91e6c>] (dump_stack+0x18/0x1c)
<4>[ 26.414977] c0 r6:c0d54000 r5:c0eb5d08 r4:00000006 r3:271aed5c
<4>[ 26.415039] c0 [<c0b91e54>] (dump_stack+0x0/0x1c) from [<c06444bc>] (do_IPI+0x258/0x29c)
<4>[ 26.415102] c0 [<c0644264>] (do_IPI+0x0/0x29c) from [<c064a340>] (__irq_svc+0x80/0x130)
<4>[ 26.415156] c0 Exception stack(0xc0d55ef0 to 0xc0d55f38)
<4>[ 26.415197] c0 5ee0: 3b9ac9ff 540deacd 01c99e53 00072679
<4>[ 26.415258] c0 5f00: c0f5a468 00000000 c0d54000 00000000 c1b540a8 412fc091 00000000 c0d55f64
<4>[ 26.415317] c0 5f20: 540deacd c0d55f38 c06aa768 c065bd78 20000013 ffffffff
<4>[ 26.415380] c0 [<c065bd3c>] (exynos4_enter_idle+0x0/0x174) from [<c099a890>] (cpuidle_idle_call+0xa4/0x120)
<4>[ 26.415442] c0 r7:00000000 r6:00000001 r5:c0f815ac r4:c1b540b8
<4>[ 26.415498] c0 [<c099a7ec>] (cpuidle_idle_call+0x0/0x120) from [<c064bd40>] (cpu_idle+0xc4/0x100)
<4>[ 26.415554] c0 r8:4000406a r7:c0ba09a8 r6:c0f59ec4 r5:c0ebd8c4 r4:c0d54000
<4>[ 26.415610] c0 r3:c099a7ec
<4>[ 26.415641] c0 [<c064bc7c>] (cpu_idle+0x0/0x100) from [<c0b83238>] (rest_init+0x8c/0xa4)
<4>[ 26.415694] c0 r7:c1b51180 r6:c0f59e00 r5:00000002 r4:c0d54000
<4>[ 26.415752] c0 [<c0b831ac>] (rest_init+0x0/0xa4) from [<c00089c4>] (start_kernel+0x2dc/0x330)
<4>[ 26.415807] c0 r5:c063d944 r4:c0eb5d34
<4>[ 26.415845] c0 [<c00086e8>] (start_kernel+0x0/0x330) from [<40008044>] (0x40008044)
Change-Id: Iaa907383e196fdf787ae4660977b58de79212de1
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The driver keeps track of the "is this endpoint in the list" state with
the redundant flag ".is_in_transfer_ready_q". It should therefore always
be sync with the .next and .prev of the readyq_list list:
struct ed *ed;
otg_list_head *qlist = (typeof qlist) ed->readyq_list;
(qlist->prev == LIST_POISON2 || qlist->next == LIST_POISON1)
== !ed->ed_status.is_in_transfer_ready_q;
Should both properties be not in sync, bad things can happen. All code
paths in driver rely on the flag and then call list operations. If the
flag suggests the entry is in the list, otg_list_pop () will be called.
When the entry however is not in the list, the members .prev and .next
are poisoned and an attempt to do list operations on them results into a
NULL (or rather an invalid address which is the poison) pointer
dereference. Such a fault would then trigger a kernel panic and the
device rebooting.
In real life this happens when disconnecting USB devices frequently,
especially when in operation (transfering data while detaching).
While in most positions in the code, it was taken care to keep both
properties, the flag and the list entry state, consistent, one position
was left out, which is addressed with this patch.
Extensive testing shows that the device would crash easily and in a
reproducable manner without the patch but does not show any faults with
the patch applied.
Change-Id: I80f3a8e7d866c699ddcd1c61b04d956e39d2197c
|
| | |
| | |
| | |
| | | |
Change-Id: Icbc7f7b0d6e52485eadc2d801224e01eaffe29e1
|
| | |
| | |
| | |
| | | |
Change-Id: I4af44a979e5ab3b9d29888ce178ea9c0f71432b3
|
| | |
| | |
| | |
| | |
| | |
| | | |
d710 needs to use old mali drivers due to new ones causing signal to be completely killed
Change-Id: I450c356b50e3f3521a63717a1c241e3b818b936f
|
| | |
| | |
| | |
| | | |
Change-Id: I21c2828a547f8387dada2e6393d92fe115e2491f
|
| | |
| | |
| | |
| | |
| | | |
Change-Id: I3b9e6cee7343c9dd3a7ae68694e60991047db50d
Signed-off-by: Jorge Ruesga <jorge@ruesga.com>
|
| | |
| | |
| | |
| | |
| | |
| | | |
from GT-N7100_SEA_KK_Opensource
Change-Id: I1ddaa2c88660427348f359a6477aced196c4d7dc
|
| | |\ |
|
| | | |
| | | |
| | | |
| | | | |
Change-Id: I5af258d2245024918f08a1a7c93c6efcc4d177b3
|
| | |\ \ |
|
| | | |/
| | | |
| | | |
| | | | |
Change-Id: I85efd4c5b2d6a7283c430f5eca2a730ef6b03d18
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.
If we look into tty_insert_flip_string_fixed_flag, there is:
int space = __tty_buffer_request_room(port, goal, flags);
struct tty_buffer *tb = port->buf.tail;
...
memcpy(char_buf_ptr(tb, tb->used), chars, space);
...
tb->used += space;
so the race of the two can result in something like this:
A B
__tty_buffer_request_room
__tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
memcpy(buf(tb->used), ...) ->BOOM
B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.
Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.
Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.
js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]
Change-Id: I11d1685056e18f107c970fbe2cab5176ca3a91c4
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Includes updated kernel source from i9305
Change-Id: I91ae18b30d02de037701250c46a457d035da56e1
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Add optional parameter field to dmcrypt table and support
"allow_discards" option.
Discard requests bypass crypt queue processing. Bio is simple remapped
to underlying device.
Note that discard will be never enabled by default because of security
consequences. It is up to the administrator to enable it for encrypted
devices.
(Note that userspace cryptsetup does not understand new optional
parameters yet. Support for this will come later. Until then, you
should use 'dmsetup' to enable and disable this.)
Signed-off-by: Milan Broz <mbroz@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Move multipath target argument parsing code into dm-table so other
targets can share it.
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Add a new flag DMF_MERGE_IS_OPTIONAL to struct mapped_device to indicate
whether the device can accept bios larger than the size its merge
function returns. When set, use this to send large bios to snapshots
which can split them if necessary. Snapshot I/O may be significantly
fragmented and this approach seems to improve peformance.
Before the patch, dm_set_device_limits restricted bio size to page size
if the underlying device had a merge function and the target didn't
provide a merge function. After the patch, dm_set_device_limits
restricts bio size to page size if the underlying device has a merge
function, doesn't have DMF_MERGE_IS_OPTIONAL flag and the target doesn't
provide a merge function.
The snapshot target can't provide a merge function because when the merge
function is called, it is impossible to determine where the bio will be
remapped. Previously this led us to impose a 4k limit, which we can
now remove if the snapshot store is located on a device without a merge
function. Together with another patch for optimizing full chunk writes,
it improves performance from 29MB/s to 40MB/s when writing to the
filesystem on snapshot store.
If the snapshot store is placed on a non-dm device with a merge function
(such as md-raid), device mapper still limits all bios to page size.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
|
| | |/
| | |
| | |
| | |
| | |
| | |
| | | |
Suppress sparse warnings about cpu_to_le32() by using __le32 types for
on-disk data etc.
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
-updates are from i605 4.3 kernel source
-updates + small hack fixes front cam on kona
Change-Id: If8348be6dbef50bb322a60d554d177e046eec429
|
| | |
| | |
| | |
| | | |
Change-Id: I21144c9f3146c9043b137f180c064627ebeed71e
|
| | |
| | |
| | |
| | | |
Change-Id: Ic5542259e9ff91ba20216844cf8a65f4a252c111
|
| | |\ |
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
in some crowded WLANs, with a lot of multicast packages circulating,
the device would not enter deep sleep.
this will allow the device to enter deep sleep.
Change-Id: I72cfefe89af64a7152e644d5095a57823ef04f4e
|
| | |\ \ |
|
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
when charger is plugged in or disconnected while cover is closed
and then opened.
Change-Id: Ifa74d3d0689e1a5c84a4683c2fe24918bc5ab87a
|
| | | |/
| | |/|
| | | |
| | | |
| | | |
| | | |
| | | | |
This fixes the need to set an initial delay in the sensor hal
in order for the sensors to enable and report data
Change-Id: I1aa639e2cc30be60d00df253a90ea9dd1a6d501f
|
| | |/
| | |
| | |
| | | |
Change-Id: I264ee04c7c6726e68cdd186f22ab45dc8bf5be0f
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
fixes front cam for some that broke from update 11 merge
http://forum.xda-developers.com/showpost.php?p=48429637&postcount=576
Change-Id: I4a654f10e9ccd50a744a710ecd01d2d26f67401d
|
| | |
| | |
| | |
| | | |
Change-Id: I20b9c19bd6d7fa67c9edd80261224414cde8c53c
|
| | |
| | |
| | |
| | |
| | |
| | | |
Courtesy of a similar commit from OMNI ROM. Requires updated mali blobs
Change-Id: I9ee55b653b57b7c390f8e0e8cd4fc068f1c751c3
|
| | |
| | |
| | |
| | | |
Change-Id: I7f6dbdd97e3ed66634bf123d43224a79524c04e9
|
| | |
| | |
| | |
| | | |
Change-Id: I6c9798682f9f6349b37cb452353bd0c0e6958401
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
others files using this implements this flag and ifdef
to keep compat with gcc 4.4.3
Change-Id: I290caa7727b750be2f82f13eb5260b877700f81d
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This reverts commit 1a05356029493b29f866cf04f7550243ef3ae687, the
enumerator breakage introduced by change Iafbd9fb45253b02d539ac0ba114f57b3bf9eeed4
can be reverted cleanly without further impact and it's a cleaner fix
Change-Id: I351c320f98691241fbe321a0b1ac54152802deb4
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Return "0" when no power supply is present
Fixes CYAN-2138
Change-Id: I4a4391a454e8e1c5681f8a27ce498f77b4934e28
|
| | |
| | |
| | |
| | | |
Change-Id: I1dd142d0b168101a8170e742d115bf70a47daa48
|
| | |
| | |
| | |
| | | |
Change-Id: I1191517240ae7bcfb2fcbbffc98e22f28e8fa151
|
| | |
| | |
| | |
| | | |
Change-Id: If25044f5eb36ea0374c691c8fee3965b785b8cbf
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Userspace implementation:
http://review.cyanogenmod.org/48796
http://review.cyanogenmod.org/48872
http://review.cyanogenmod.org/48884
Change-Id: Id4ac50168220310e82aa4aae367dad4e72e3a9c3
|
| | |
| | |
| | |
| | | |
Change-Id: Iddecb0688e758eca3ba77b520510a6728ad1e3bb
|
| | |
| | |
| | |
| | | |
Change-Id: I42e3ec88452239a6b953dff0e636a8c2e5dbf958
|
| | |\
| | | |
| | | |
| | | | |
thresholds" into cm-10.2
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
8-level table was always used, resulting in increased voltages for
1400MHz devices. Now, the right table (5-level) can be picked at
runtime.
Restore the thresholds to stock value for more stable frequencies.
Change-Id: I29900535c15557e75c72793b7169771982fce7f9
|
| | |/
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Devices using the 1400MHz Exynos 4210 are using 1280*800 screens. This
is a much bigger resolution than the Galaxy S2. 100MHz as the lowest GPU
step is too low for these devices, resulting in lag. Bump it up to
134MHz.
Change-Id: Ifd08cdc2e263695232d034890e54585f122453ff
|
| | |
| | |
| | |
| | | |
Change-Id: I50b353531a1ee581217305b257d30317ce73b0c7
|