--- /dev/null
+From f7dc569b07dc1ebc490ed63b65420e473799ce41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 May 2022 14:41:37 +0100
+Subject: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 97eea946b93961fffd29448dcda7398d0d51c4b2 ]
+
+The bounds checks in snd_soc_put_volsw_sx() are only being applied to the
+first channel, meaning it is possible to write out of bounds values to the
+second channel in stereo controls. Add appropriate checks.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-ops.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index b734bf911470..3f9db4102f38 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -465,6 +465,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
+ if (snd_soc_volsw_is_stereo(mc)) {
+ val_mask = mask << rshift;
+ val2 = (ucontrol->value.integer.value[1] + min) & mask;
++
++ if (mc->platform_max && val2 > mc->platform_max)
++ return -EINVAL;
++ if (val2 > max)
++ return -EINVAL;
++
+ val2 = val2 << rshift;
+
+ err = snd_soc_component_update_bits(component, reg2, val_mask,
+--
+2.35.1
+
--- /dev/null
+From 2a876690a0e7170237ecd74a66943f0372135cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 00:25:03 +0900
+Subject: can: mcba_usb: Fix termination command argument
+
+From: Yasushi SHOJI <yasushi.shoji@gmail.com>
+
+[ Upstream commit 1a8e3bd25f1e789c8154e11ea24dc3ec5a4c1da0 ]
+
+Microchip USB Analyzer can activate the internal termination resistors
+by setting the "termination" option ON, or OFF to to deactivate them.
+As I've observed, both with my oscilloscope and captured USB packets
+below, you must send "0" to turn it ON, and "1" to turn it OFF.
+
+From the schematics in the user's guide, I can confirm that you must
+drive the CAN_RES signal LOW "0" to activate the resistors.
+
+Reverse the argument value of usb_msg.termination to fix this.
+
+These are the two commands sequence, ON then OFF.
+
+> No. Time Source Destination Protocol Length Info
+> 1 0.000000 host 1.3.1 USB 46 URB_BULK out
+>
+> Frame 1: 46 bytes on wire (368 bits), 46 bytes captured (368 bits)
+> USB URB
+> Leftover Capture Data: a80000000000000000000000000000000000a8
+>
+> No. Time Source Destination Protocol Length Info
+> 2 4.372547 host 1.3.1 USB 46 URB_BULK out
+>
+> Frame 2: 46 bytes on wire (368 bits), 46 bytes captured (368 bits)
+> USB URB
+> Leftover Capture Data: a80100000000000000000000000000000000a9
+
+Signed-off-by: Yasushi SHOJI <yashi@spacecubics.com>
+Link: https://lore.kernel.org/all/20221124152504.125994-1-yashi@spacecubics.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/mcba_usb.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index f7c3fc3dabfe..01ef5cabdc11 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -58,6 +58,10 @@
+ #define MCBA_VER_REQ_USB 1
+ #define MCBA_VER_REQ_CAN 2
+
++/* Drive the CAN_RES signal LOW "0" to activate R24 and R25 */
++#define MCBA_VER_TERMINATION_ON 0
++#define MCBA_VER_TERMINATION_OFF 1
++
+ #define MCBA_SIDL_EXID_MASK 0x8
+ #define MCBA_DLC_MASK 0xf
+ #define MCBA_DLC_RTR_MASK 0x40
+@@ -480,7 +484,7 @@ static void mcba_usb_process_ka_usb(struct mcba_priv *priv,
+ priv->usb_ka_first_pass = false;
+ }
+
+- if (msg->termination_state)
++ if (msg->termination_state == MCBA_VER_TERMINATION_ON)
+ priv->can.termination = MCBA_TERMINATION_ENABLED;
+ else
+ priv->can.termination = MCBA_TERMINATION_DISABLED;
+@@ -800,9 +804,9 @@ static int mcba_set_termination(struct net_device *netdev, u16 term)
+ };
+
+ if (term == MCBA_TERMINATION_ENABLED)
+- usb_msg.termination = 1;
++ usb_msg.termination = MCBA_VER_TERMINATION_ON;
+ else
+- usb_msg.termination = 0;
++ usb_msg.termination = MCBA_VER_TERMINATION_OFF;
+
+ mcba_usb_xmit_cmd(priv, (struct mcba_usb_msg *)&usb_msg);
+
+--
+2.35.1
+
--- /dev/null
+From 3b3a8c72292a60af2f82a0fbb80d5bd92fb338aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 08:16:36 +0100
+Subject: can: sja1000: fix size of OCR_MODE_MASK define
+
+From: Heiko Schocher <hs@denx.de>
+
+[ Upstream commit 26e8f6a75248247982458e8237b98c9fb2ffcf9d ]
+
+bitfield mode in ocr register has only 2 bits not 3, so correct
+the OCR_MODE_MASK define.
+
+Signed-off-by: Heiko Schocher <hs@denx.de>
+Link: https://lore.kernel.org/all/20221123071636.2407823-1-hs@denx.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/can/platform/sja1000.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/can/platform/sja1000.h b/include/linux/can/platform/sja1000.h
+index 5755ae5a4712..6a869682c120 100644
+--- a/include/linux/can/platform/sja1000.h
++++ b/include/linux/can/platform/sja1000.h
+@@ -14,7 +14,7 @@
+ #define OCR_MODE_TEST 0x01
+ #define OCR_MODE_NORMAL 0x02
+ #define OCR_MODE_CLOCK 0x03
+-#define OCR_MODE_MASK 0x07
++#define OCR_MODE_MASK 0x03
+ #define OCR_TX0_INVERT 0x04
+ #define OCR_TX0_PULLDOWN 0x08
+ #define OCR_TX0_PULLUP 0x10
+--
+2.35.1
+
--- /dev/null
+From c7d9ed4ca22f619061f14e3b2b99dbaec0ec1955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 15:18:28 +0100
+Subject: net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 31d929de5a112ee1b977a89c57de74710894bbbf ]
+
+When the name_assign_type attribute was introduced (commit
+685343fc3ba6, "net: add name_assign_type netdev attribute"), the
+loopback device was explicitly mentioned as one which would make use
+of NET_NAME_PREDICTABLE:
+
+ The name_assign_type attribute gives hints where the interface name of a
+ given net-device comes from. These values are currently defined:
+...
+ NET_NAME_PREDICTABLE:
+ The ifname has been assigned by the kernel in a predictable way
+ that is guaranteed to avoid reuse and always be the same for a
+ given device. Examples include statically created devices like
+ the loopback device [...]
+
+Switch to that so that reading /sys/class/net/lo/name_assign_type
+produces something sensible instead of returning -EINVAL.
+
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/loopback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
+index 30612497643c..daef41ce2349 100644
+--- a/drivers/net/loopback.c
++++ b/drivers/net/loopback.c
+@@ -206,7 +206,7 @@ static __net_init int loopback_net_init(struct net *net)
+ int err;
+
+ err = -ENOMEM;
+- dev = alloc_netdev(0, "lo", NET_NAME_UNKNOWN, loopback_setup);
++ dev = alloc_netdev(0, "lo", NET_NAME_PREDICTABLE, loopback_setup);
+ if (!dev)
+ goto out;
+
+--
+2.35.1
+
mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-collapse-paths.patch
block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch
nfp-fix-use-after-free-in-area_cache_get.patch
+asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch
+can-sja1000-fix-size-of-ocr_mode_mask-define.patch
+can-mcba_usb-fix-termination-command-argument.patch
+net-loopback-use-net_name_predictable-for-name_assig.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
