]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Dec 2021 11:05:55 +0000 (12:05 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Dec 2021 11:05:55 +0000 (12:05 +0100)
added patches:
input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch
mac80211-validate-extended-element-id-is-present.patch
mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch

queue-5.4/input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch [new file with mode: 0644]
queue-5.4/mac80211-validate-extended-element-id-is-present.patch [new file with mode: 0644]
queue-5.4/mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch [new file with mode: 0644]
queue-5.4/series

diff --git a/queue-5.4/input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch b/queue-5.4/input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch
new file mode 100644 (file)
index 0000000..b7662e3
--- /dev/null
@@ -0,0 +1,78 @@
+From a02dcde595f7cbd240ccd64de96034ad91cffc40 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Fri, 15 Oct 2021 13:13:06 -0700
+Subject: Input: touchscreen - avoid bitwise vs logical OR warning
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit a02dcde595f7cbd240ccd64de96034ad91cffc40 upstream.
+
+A new warning in clang points out a few places in this driver where a
+bitwise OR is being used with boolean types:
+
+drivers/input/touchscreen.c:81:17: warning: use of bitwise '|' with boolean operands [-Wbitwise-instead-of-logical]
+        data_present = touchscreen_get_prop_u32(dev, "touchscreen-min-x",
+                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This use of a bitwise OR is intentional, as bitwise operations do not
+short circuit, which allows all the calls to touchscreen_get_prop_u32()
+to happen so that the last parameter is initialized while coalescing the
+results of the calls to make a decision after they are all evaluated.
+
+To make this clearer to the compiler, use the '|=' operator to assign
+the result of each touchscreen_get_prop_u32() call to data_present,
+which keeps the meaning of the code the same but makes it obvious that
+every one of these calls is expected to happen.
+
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/r/20211014205757.3474635-1-nathan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/of_touchscreen.c |   18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/input/touchscreen/of_touchscreen.c
++++ b/drivers/input/touchscreen/of_touchscreen.c
+@@ -81,8 +81,8 @@ void touchscreen_parse_properties(struct
+                      touchscreen_get_prop_u32(dev, "touchscreen-size-x",
+                                               input_abs_get_max(input,
+                                                                 axis) + 1,
+-                                              &maximum) |
+-                     touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x",
++                                              &maximum);
++      data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x",
+                                               input_abs_get_fuzz(input, axis),
+                                               &fuzz);
+       if (data_present)
+@@ -95,8 +95,8 @@ void touchscreen_parse_properties(struct
+                      touchscreen_get_prop_u32(dev, "touchscreen-size-y",
+                                               input_abs_get_max(input,
+                                                                 axis) + 1,
+-                                              &maximum) |
+-                     touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y",
++                                              &maximum);
++      data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y",
+                                               input_abs_get_fuzz(input, axis),
+                                               &fuzz);
+       if (data_present)
+@@ -106,11 +106,11 @@ void touchscreen_parse_properties(struct
+       data_present = touchscreen_get_prop_u32(dev,
+                                               "touchscreen-max-pressure",
+                                               input_abs_get_max(input, axis),
+-                                              &maximum) |
+-                     touchscreen_get_prop_u32(dev,
+-                                              "touchscreen-fuzz-pressure",
+-                                              input_abs_get_fuzz(input, axis),
+-                                              &fuzz);
++                                              &maximum);
++      data_present |= touchscreen_get_prop_u32(dev,
++                                               "touchscreen-fuzz-pressure",
++                                               input_abs_get_fuzz(input, axis),
++                                               &fuzz);
+       if (data_present)
+               touchscreen_set_params(input, axis, 0, maximum, fuzz);
diff --git a/queue-5.4/mac80211-validate-extended-element-id-is-present.patch b/queue-5.4/mac80211-validate-extended-element-id-is-present.patch
new file mode 100644 (file)
index 0000000..13230c6
--- /dev/null
@@ -0,0 +1,33 @@
+From 768c0b19b50665e337c96858aa2b7928d6dcf756 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sat, 11 Dec 2021 20:10:24 +0100
+Subject: mac80211: validate extended element ID is present
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 768c0b19b50665e337c96858aa2b7928d6dcf756 upstream.
+
+Before attempting to parse an extended element, verify that
+the extended element ID is present.
+
+Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
+Reported-by: syzbot+59bdff68edce82e393b6@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20211211201023.f30a1b128c07.I5cacc176da94ba316877c6e10fe3ceec8b4dbd7d@changeid
+Cc: stable@vger.kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/util.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1227,6 +1227,8 @@ _ieee802_11_parse_elems_crc(const u8 *st
+                               elems->max_idle_period_ie = (void *)pos;
+                       break;
+               case WLAN_EID_EXTENSION:
++                      if (!elen)
++                              break;
+                       if (pos[0] == WLAN_EID_EXT_HE_MU_EDCA &&
+                           elen >= (sizeof(*elems->mu_edca_param_set) + 1)) {
+                               elems->mu_edca_param_set = (void *)&pos[1];
diff --git a/queue-5.4/mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch b/queue-5.4/mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch
new file mode 100644 (file)
index 0000000..dce02dc
--- /dev/null
@@ -0,0 +1,72 @@
+From 6a953dc4dbd1c7057fb765a24f37a5e953c85fb0 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Tue, 1 Sep 2020 00:08:34 -0700
+Subject: mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 6a953dc4dbd1c7057fb765a24f37a5e953c85fb0 upstream.
+
+A new warning in clang points out when macro expansion might result in a
+GNU C statement expression. There is an instance of this in the mwifiex
+driver:
+
+drivers/net/wireless/marvell/mwifiex/cmdevt.c:217:34: warning: '}' and
+')' tokens terminating statement expression appear in different macro
+expansion contexts [-Wcompound-token-split-by-macro]
+        host_cmd->seq_num = cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
+                                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/wireless/marvell/mwifiex/fw.h:519:46: note: expanded from
+macro 'HostCmd_SET_SEQ_NO_BSS_INFO'
+        (((type) & 0x000f) << 12);                  }
+                                                    ^
+
+This does not appear to be a real issue. Removing the braces and
+replacing them with parentheses will fix the warning and not change the
+meaning of the code.
+
+Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1146
+Reported-by: Andy Lavr <andy.lavr@gmail.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200901070834.1015754-1-natechancellor@gmail.com
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cmdevt.c |    4 ++--
+ drivers/net/wireless/marvell/mwifiex/fw.h     |    8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
++++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+@@ -322,9 +322,9 @@ static int mwifiex_dnld_sleep_confirm_cm
+       adapter->seq_num++;
+       sleep_cfm_buf->seq_num =
+-              cpu_to_le16((HostCmd_SET_SEQ_NO_BSS_INFO
++              cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
+                                       (adapter->seq_num, priv->bss_num,
+-                                       priv->bss_type)));
++                                       priv->bss_type));
+       mwifiex_dbg(adapter, CMD,
+                   "cmd: DNLD_CMD: %#x, act %#x, len %d, seqno %#x\n",
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -512,10 +512,10 @@ enum mwifiex_channel_flags {
+ #define RF_ANTENNA_AUTO                 0xFFFF
+-#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) {   \
+-      (((seq) & 0x00ff) |                             \
+-       (((num) & 0x000f) << 8)) |                     \
+-      (((type) & 0x000f) << 12);                  }
++#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) \
++      ((((seq) & 0x00ff) |                        \
++       (((num) & 0x000f) << 8)) |                 \
++      (((type) & 0x000f) << 12))
+ #define HostCmd_GET_SEQ_NO(seq)       \
+       ((seq) & HostCmd_SEQ_NUM_MASK)
index 2ba378e8e10979c46cb380de40357e6f24614ee8..dbe94f4c9eb96d671e5e94dba2df7d31632f2d6d 100644 (file)
@@ -51,3 +51,6 @@ usb-serial-option-add-telit-fn990-compositions.patch
 timekeeping-really-make-sure-wall_to_monotonic-isn-t-positive.patch
 libata-if-t_length-is-zero-dma-direction-should-be-dma_none.patch
 drm-amdgpu-correct-register-access-for-rlc_jump_table_restore.patch
+mac80211-validate-extended-element-id-is-present.patch
+mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch
+input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch