--- /dev/null
+From bd249b91977b768ea02bf84d04625d2690ad2b98 Mon Sep 17 00:00:00 2001
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Date: Mon, 17 Apr 2023 09:01:48 -0700
+Subject: HID: wacom: avoid integer overflow in wacom_intuos_inout()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream.
+
+If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
+operations and integer promotions are done, high bits in
+wacom->serial[idx] will be filled with 1s as well.
+Avoid this, albeit unlikely, issue by specifying left operand's __u64
+type for the right operand.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_wac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -743,7 +743,7 @@ static int wacom_intuos_inout(struct wac
+ /* Enter report */
+ if ((data[1] & 0xfc) == 0xc0) {
+ /* serial number of the tool */
+- wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
++ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
+ (data[4] << 20) + (data[5] << 12) +
+ (data[6] << 4) + (data[7] >> 4);
+
--- /dev/null
+From 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 Mon Sep 17 00:00:00 2001
+From: Jiakai Luo <jkluo@hust.edu.cn>
+Date: Sat, 22 Apr 2023 06:34:06 -0700
+Subject: iio: adc: mxs-lradc: fix the order of two cleanup operations
+
+From: Jiakai Luo <jkluo@hust.edu.cn>
+
+commit 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 upstream.
+
+Smatch reports:
+drivers/iio/adc/mxs-lradc-adc.c:766 mxs_lradc_adc_probe() warn:
+missing unwind goto?
+
+the order of three init operation:
+1.mxs_lradc_adc_trigger_init
+2.iio_triggered_buffer_setup
+3.mxs_lradc_adc_hw_init
+
+thus, the order of three cleanup operation should be:
+1.mxs_lradc_adc_hw_stop
+2.iio_triggered_buffer_cleanup
+3.mxs_lradc_adc_trigger_remove
+
+we exchange the order of two cleanup operations,
+introducing the following differences:
+1.if mxs_lradc_adc_trigger_init fails, returns directly;
+2.if trigger_init succeeds but iio_triggered_buffer_setup fails,
+goto err_trig and remove the trigger.
+
+In addition, we also reorder the unwind that goes on in the
+remove() callback to match the new ordering.
+
+Fixes: 6dd112b9f85e ("iio: adc: mxs-lradc: Add support for ADC driver")
+Signed-off-by: Jiakai Luo <jkluo@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230422133407.72908-1-jkluo@hust.edu.cn
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/mxs-lradc-adc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/adc/mxs-lradc-adc.c
++++ b/drivers/iio/adc/mxs-lradc-adc.c
+@@ -769,13 +769,13 @@ static int mxs_lradc_adc_probe(struct pl
+
+ ret = mxs_lradc_adc_trigger_init(iio);
+ if (ret)
+- goto err_trig;
++ return ret;
+
+ ret = iio_triggered_buffer_setup(iio, &iio_pollfunc_store_time,
+ &mxs_lradc_adc_trigger_handler,
+ &mxs_lradc_adc_buffer_ops);
+ if (ret)
+- return ret;
++ goto err_trig;
+
+ adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc];
+
+@@ -813,9 +813,9 @@ static int mxs_lradc_adc_probe(struct pl
+
+ err_dev:
+ mxs_lradc_adc_hw_stop(adc);
+- mxs_lradc_adc_trigger_remove(iio);
+-err_trig:
+ iio_triggered_buffer_cleanup(iio);
++err_trig:
++ mxs_lradc_adc_trigger_remove(iio);
+ return ret;
+ }
+
+@@ -826,8 +826,8 @@ static int mxs_lradc_adc_remove(struct p
+
+ iio_device_unregister(iio);
+ mxs_lradc_adc_hw_stop(adc);
+- mxs_lradc_adc_trigger_remove(iio);
+ iio_triggered_buffer_cleanup(iio);
++ mxs_lradc_adc_trigger_remove(iio);
+
+ return 0;
+ }
--- /dev/null
+From 09d3bec7009186bdba77039df01e5834788b3f95 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Thu, 11 May 2023 02:43:30 +0200
+Subject: iio: dac: mcp4725: Fix i2c_master_send() return value handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marex@denx.de>
+
+commit 09d3bec7009186bdba77039df01e5834788b3f95 upstream.
+
+The i2c_master_send() returns number of sent bytes on success,
+or negative on error. The suspend/resume callbacks expect zero
+on success and non-zero on error. Adapt the return value of the
+i2c_master_send() to the expectation of the suspend and resume
+callbacks, including proper validation of the return value.
+
+Fixes: cf35ad61aca2 ("iio: add mcp4725 I2C DAC driver")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230511004330.206942-1-marex@denx.de
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/mcp4725.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/dac/mcp4725.c
++++ b/drivers/iio/dac/mcp4725.c
+@@ -50,12 +50,18 @@ static int mcp4725_suspend(struct device
+ struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
+ to_i2c_client(dev)));
+ u8 outbuf[2];
++ int ret;
+
+ outbuf[0] = (data->powerdown_mode + 1) << 4;
+ outbuf[1] = 0;
+ data->powerdown = true;
+
+- return i2c_master_send(data->client, outbuf, 2);
++ ret = i2c_master_send(data->client, outbuf, 2);
++ if (ret < 0)
++ return ret;
++ else if (ret != 2)
++ return -EIO;
++ return 0;
+ }
+
+ static int mcp4725_resume(struct device *dev)
+@@ -63,13 +69,19 @@ static int mcp4725_resume(struct device
+ struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
+ to_i2c_client(dev)));
+ u8 outbuf[2];
++ int ret;
+
+ /* restore previous DAC value */
+ outbuf[0] = (data->dac_value >> 8) & 0xf;
+ outbuf[1] = data->dac_value & 0xff;
+ data->powerdown = false;
+
+- return i2c_master_send(data->client, outbuf, 2);
++ ret = i2c_master_send(data->client, outbuf, 2);
++ if (ret < 0)
++ return ret;
++ else if (ret != 2)
++ return -EIO;
++ return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
alsa-oss-avoid-missing-prototype-warnings.patch
atm-hide-unused-procfs-functions.patch
mailbox-mailbox-test-fix-a-locking-issue-in-mbox_tes.patch
+iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch
+hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch
+iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
