4.4-stable patches

added patches:
	arm64-dts-stratix10-correct-system-manager-register-size.patch
	cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
	soc-tegra-pmc-fix-child-node-lookup.patch

diff --git a/queue-4.4/arm64-dts-stratix10-correct-system-manager-register-size.patch b/queue-4.4/arm64-dts-stratix10-correct-system-manager-register-size.patch
new file mode 100644 (file)
index 0000000..0cab10e
--- /dev/null
+++ b/queue-4.4/arm64-dts-stratix10-correct-system-manager-register-size.patch
@@ -0,0 +1,32 @@
+From 74121b9aa3cd571ddfff014a9f47db36cae3cda9 Mon Sep 17 00:00:00 2001
+From: Thor Thayer <thor.thayer@linux.intel.com>
+Date: Tue, 25 Sep 2018 10:31:52 -0500
+Subject: arm64: dts: stratix10: Correct System Manager register size
+
+From: Thor Thayer <thor.thayer@linux.intel.com>
+
+commit 74121b9aa3cd571ddfff014a9f47db36cae3cda9 upstream.
+
+Correct the register size of the System Manager node.
+
+Cc: stable@vger.kernel.org
+Fixes: 78cd6a9d8e154 ("arm64: dts: Add base stratix 10 dtsi")
+Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -249,7 +249,7 @@
+ 
+               sysmgr: sysmgr@ffd12000 {
+                       compatible = "altr,sys-mgr", "syscon";
+-                      reg = <0xffd12000 0x1000>;
++                      reg = <0xffd12000 0x228>;
+               };
+ 
+               /* Local timer */

diff --git a/queue-4.4/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch b/queue-4.4/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
new file mode 100644 (file)
index 0000000..6640fe4
--- /dev/null
+++ b/queue-4.4/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
@@ -0,0 +1,34 @@
+From 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Tue, 30 Oct 2018 13:26:15 -0400
+Subject: Cramfs: fix abad comparison when wrap-arounds occur
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 upstream.
+
+It is possible for corrupted filesystem images to produce very large
+block offsets that may wrap when a length is added, and wrongly pass
+the buffer size test.
+
+Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cramfs/inode.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -185,7 +185,8 @@ static void *cramfs_read(struct super_bl
+                       continue;
+               blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_CACHE_SHIFT;
+               blk_offset += offset;
+-              if (blk_offset + len > BUFFER_SIZE)
++              if (blk_offset > BUFFER_SIZE ||
++                  blk_offset + len > BUFFER_SIZE)
+                       continue;
+               return read_buffers[i] + blk_offset;
+       }

diff --git a/queue-4.4/series b/queue-4.4/series
index 015f36870e5dc33cd9148e9615d370304110684b..46698640201bac47886c394f205167ec04134ba0 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -82,3 +82,6 @@ media-em28xx-use-a-default-format-if-try_fmt-fails.patch
 media-em28xx-fix-input-name-for-terratec-av-350.patch
 media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch
 ext4-avoid-running-out-of-journal-credits-when-appending-to-an-inline-file.patch
+cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
+arm64-dts-stratix10-correct-system-manager-register-size.patch
+soc-tegra-pmc-fix-child-node-lookup.patch

diff --git a/queue-4.4/soc-tegra-pmc-fix-child-node-lookup.patch b/queue-4.4/soc-tegra-pmc-fix-child-node-lookup.patch
new file mode 100644 (file)
index 0000000..af6efb1
--- /dev/null
+++ b/queue-4.4/soc-tegra-pmc-fix-child-node-lookup.patch
@@ -0,0 +1,39 @@
+From 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 15 Nov 2017 10:44:58 +0100
+Subject: soc/tegra: pmc: Fix child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e upstream.
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent pmc node could end up being prematurely
+freed as of_find_node_by_name() drops a reference to its first argument.
+
+Fixes: 3568df3d31d6 ("soc: tegra: Add thermal reset (thermtrip) support to PMC")
+Cc: stable <stable@vger.kernel.org>     # 4.0
+Cc: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/tegra/pmc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -738,7 +738,7 @@ void tegra_pmc_init_tsense_reset(struct
+       if (!pmc->soc->has_tsense_reset)
+               return;
+ 
+-      np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
++      np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip");
+       if (!np) {
+               dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+               return;