--- /dev/null
+From e4d8716c3dcec47f1557024add24e1f3c09eb24b Mon Sep 17 00:00:00 2001
+From: Jean Delvare <jdelvare@suse.de>
+Date: Tue, 25 May 2021 17:03:36 +0200
+Subject: i2c: i801: Don't generate an interrupt on bus reset
+
+From: Jean Delvare <jdelvare@suse.de>
+
+commit e4d8716c3dcec47f1557024add24e1f3c09eb24b upstream.
+
+Now that the i2c-i801 driver supports interrupts, setting the KILL bit
+in a attempt to recover from a timed out transaction triggers an
+interrupt. Unfortunately, the interrupt handler (i801_isr) is not
+prepared for this situation and will try to process the interrupt as
+if it was signaling the end of a successful transaction. In the case
+of a block transaction, this can result in an out-of-range memory
+access.
+
+This condition was reproduced several times by syzbot:
+https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e
+https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e
+https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e
+https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb
+https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a
+https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79
+
+So disable interrupts while trying to reset the bus. Interrupts will
+be enabled again for the following transaction.
+
+Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions")
+Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -379,11 +379,9 @@ static int i801_check_post(struct i801_p
+ dev_err(&priv->pci_dev->dev, "Transaction timeout\n");
+ /* try to stop the current command */
+ dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n");
+- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL,
+- SMBHSTCNT(priv));
++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv));
+ usleep_range(1000, 2000);
+- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL),
+- SMBHSTCNT(priv));
++ outb_p(0, SMBHSTCNT(priv));
+
+ /* Check if it worked */
+ status = inb_p(SMBHSTSTS(priv));
--- /dev/null
+From 24990423267ec283b9d86f07f362b753eb9b0ed5 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Date: Wed, 26 May 2021 08:39:37 -0400
+Subject: i2c: s3c2410: fix possible NULL pointer deref on read message after write
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+commit 24990423267ec283b9d86f07f362b753eb9b0ed5 upstream.
+
+Interrupt handler processes multiple message write requests one after
+another, till the driver message queue is drained. However if driver
+encounters a read message without preceding START, it stops the I2C
+transfer as it is an invalid condition for the controller. At least the
+comment describes a requirement "the controller forces us to send a new
+START when we change direction". This stop results in clearing the
+message queue (i2c->msg = NULL).
+
+The code however immediately jumped back to label "retry_write" which
+dereferenced the "i2c->msg" making it a possible NULL pointer
+dereference.
+
+The Coverity analysis:
+1. Condition !is_msgend(i2c), taking false branch.
+ if (!is_msgend(i2c)) {
+
+2. Condition !is_lastmsg(i2c), taking true branch.
+ } else if (!is_lastmsg(i2c)) {
+
+3. Condition i2c->msg->flags & 1, taking true branch.
+ if (i2c->msg->flags & I2C_M_RD) {
+
+4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
+ s3c24xx_i2c_stop(i2c, -EINVAL);
+
+5. Jumping to label retry_write.
+ goto retry_write;
+
+6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
+ if (!is_msgend(i2c)) {"
+
+All previous calls to s3c24xx_i2c_stop() in this interrupt service
+routine are followed by jumping to end of function (acknowledging
+the interrupt and returning). This seems a reasonable choice also here
+since message buffer was entirely emptied.
+
+Addresses-Coverity: Explicit null dereferenced
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-s3c2410.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -484,7 +484,10 @@ static int i2c_s3c_irq_nextbyte(struct s
+ * forces us to send a new START
+ * when we change direction
+ */
++ dev_dbg(i2c->dev,
++ "missing START before write->read\n");
+ s3c24xx_i2c_stop(i2c, -EINVAL);
++ break;
+ }
+
+ goto retry_write;
--- /dev/null
+From c4740e293c93c747e65d53d9aacc2ba8521d1489 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Thu, 6 May 2021 13:15:40 +0200
+Subject: i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit c4740e293c93c747e65d53d9aacc2ba8521d1489 upstream.
+
+When switching the Gen3 SoCs to the new clock calculation formulas, the
+match entry for RZ/G2E added in commit 51243b73455f2d12 ("i2c:
+sh_mobile: Add support for r8a774c0 (RZ/G2E)") was forgotten.
+
+Fixes: e8a27567509b2439 ("i2c: sh_mobile: use new clock calculation formulas for Gen3")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-sh_mobile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -813,7 +813,7 @@ static const struct sh_mobile_dt_config
+ static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
+ { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config },
+- { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config },
++ { .compatible = "renesas,iic-r8a774c0", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7791", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7792", .data = &v2_freq_calc_dt_config },
--- /dev/null
+From a269333fa5c0c8e53c92b5a28a6076a28cde3e83 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 8 May 2021 16:30:35 +0300
+Subject: net: dsa: fix a crash if ->get_sset_count() fails
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream.
+
+If ds->ops->get_sset_count() fails then it "count" is a negative error
+code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
+error code is type promoted to a very high value and the loop will
+corrupt memory until the system crashes.
+
+Fix this by checking for error codes and changing the type of "i" to
+just int.
+
+Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/master.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -147,8 +147,7 @@ static void dsa_master_get_strings(struc
+ struct dsa_switch *ds = cpu_dp->ds;
+ int port = cpu_dp->index;
+ int len = ETH_GSTRING_LEN;
+- int mcount = 0, count;
+- unsigned int i;
++ int mcount = 0, count, i;
+ uint8_t pfx[4];
+ uint8_t *ndata;
+
+@@ -178,6 +177,8 @@ static void dsa_master_get_strings(struc
+ */
+ ds->ops->get_strings(ds, port, stringset, ndata);
+ count = ds->ops->get_sset_count(ds, port, stringset);
++ if (count < 0)
++ return;
+ for (i = 0; i < count; i++) {
+ memmove(ndata + (i * len + sizeof(pfx)),
+ ndata + i * len, len - sizeof(pfx));
--- /dev/null
+From 474a2ddaa192777522a7499784f1d60691cd831a Mon Sep 17 00:00:00 2001
+From: DENG Qingfang <dqfext@gmail.com>
+Date: Sun, 23 May 2021 22:51:54 +0800
+Subject: net: dsa: mt7530: fix VLAN traffic leaks
+
+From: DENG Qingfang <dqfext@gmail.com>
+
+commit 474a2ddaa192777522a7499784f1d60691cd831a upstream.
+
+PCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but
+was not reset when it is disabled, which may cause traffic leaks:
+
+ ip link add br0 type bridge vlan_filtering 1
+ ip link add br1 type bridge vlan_filtering 1
+ ip link set swp0 master br0
+ ip link set swp1 master br1
+ ip link set br0 type bridge vlan_filtering 0
+ ip link set br1 type bridge vlan_filtering 0
+ # traffic in br0 and br1 will start leaking to each other
+
+As port_bridge_{add,del} have set up PCR_MATRIX properly, remove the
+PCR_MATRIX write from mt7530_port_set_vlan_aware.
+
+Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530")
+Signed-off-by: DENG Qingfang <dqfext@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mt7530.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -809,14 +809,6 @@ mt7530_port_set_vlan_aware(struct dsa_sw
+ {
+ struct mt7530_priv *priv = ds->priv;
+
+- /* The real fabric path would be decided on the membership in the
+- * entry of VLAN table. PCR_MATRIX set up here with ALL_MEMBERS
+- * means potential VLAN can be consisting of certain subset of all
+- * ports.
+- */
+- mt7530_rmw(priv, MT7530_PCR_P(port),
+- PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS));
+-
+ /* Trapped into security mode allows packet forwarding through VLAN
+ * table lookup. CPU port is set to fallback mode to let untagged
+ * frames pass through.
--- /dev/null
+From 6729188d2646709941903052e4b78e1d82c239b9 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Mon, 24 May 2021 12:25:25 +0300
+Subject: net: dsa: sja1105: error out on unsupported PHY mode
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 6729188d2646709941903052e4b78e1d82c239b9 upstream.
+
+The driver continues probing when a port is configured for an
+unsupported PHY interface type, instead it should stop.
+
+Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -178,6 +178,7 @@ static int sja1105_init_mii_settings(str
+ default:
+ dev_err(dev, "Unsupported PHY mode %s!\n",
+ phy_modes(ports[i].phy_mode));
++ return -EINVAL;
+ }
+
+ mii->phy_mac[i] = ports[i].role;
--- /dev/null
+From 75ea44e356b5de8c817f821c9dd68ae329e82add Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 25 May 2021 18:07:58 +0200
+Subject: perf jevents: Fix getting maximum number of fds
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 75ea44e356b5de8c817f821c9dd68ae329e82add upstream.
+
+On some hosts, rlim.rlim_max can be returned as RLIM_INFINITY.
+By casting it to int, it is interpreted as -1, which will cause get_maxfds
+to return 0, causing "Invalid argument" errors in nftw() calls.
+Fix this by casting the second argument of min() to rlim_t instead.
+
+Fixes: 80eeb67fe577 ("perf jevents: Program to convert JSON file")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Link: http://lore.kernel.org/lkml/20210525160758.97829-1-nbd@nbd.name
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/pmu-events/jevents.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -862,7 +862,7 @@ static int get_maxfds(void)
+ struct rlimit rlim;
+
+ if (getrlimit(RLIMIT_NOFILE, &rlim) == 0)
+- return min((int)rlim.rlim_max / 2, 512);
++ return min(rlim.rlim_max / 2, (rlim_t)512);
+
+ return 512;
+ }
tipc-wait-and-exit-until-all-work-queues-are-done.patch
tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch
spi-spi-fsl-dspi-fix-a-resource-leak-in-an-error-handling-path.patch
+net-dsa-mt7530-fix-vlan-traffic-leaks.patch
+net-dsa-fix-a-crash-if-get_sset_count-fails.patch
+net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch
+i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch
+i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch
+i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch
+perf-jevents-fix-getting-maximum-number-of-fds.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
