+++ /dev/null
-From ab3b8e5159b5335c81ba2d09ee5054d4a1b5a7a6 Mon Sep 17 00:00:00 2001
-From: Kailang Yang <kailang@realtek.com>
-Date: Wed, 25 Apr 2018 16:05:27 +0800
-Subject: ALSA: hda/realtek - Update ALC255 depop optimize
-
-From: Kailang Yang <kailang@realtek.com>
-
-commit ab3b8e5159b5335c81ba2d09ee5054d4a1b5a7a6 upstream.
-
-Add ALC255 its own depop functions for alc_init and alc_shutup.
-Assign it to ALC256 usage.
-
-Signed-off-by: Kailang Yang <kailang@realtek.com>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- sound/pci/hda/patch_realtek.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6300,6 +6300,8 @@ static int patch_alc269(struct hda_codec
- case 0x10ec0235:
- case 0x10ec0255:
- spec->codec_variant = ALC269_TYPE_ALC255;
-+ spec->shutup = alc256_shutup;
-+ spec->init_hook = alc256_init;
- break;
- case 0x10ec0236:
- case 0x10ec0256:
--- /dev/null
+From d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 10 Apr 2018 15:21:45 +0200
+Subject: ARM: amba: Don't read past the end of sysfs "driver_override" buffer
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 upstream.
+
+When printing the driver_override parameter when it is 4095 and 4094
+bytes long, the printing code would access invalid memory because we
+need count + 1 bytes for printing.
+
+Cfr. commits 4efe874aace57dba ("PCI: Don't read past the end of sysfs
+"driver_override" buffer") and bf563b01c2895a4b ("driver core: platform:
+Don't read past the end of "driver_override" buffer").
+
+Fixes: 3cf385713460eb2b ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/amba/bus.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -83,7 +83,8 @@ static ssize_t driver_override_store(str
+ struct amba_device *dev = to_amba_device(_dev);
+ char *driver_override, *old, *cp;
+
+- if (count > PATH_MAX)
++ /* We need to keep extra room for a newline */
++ if (count >= (PAGE_SIZE - 1))
+ return -EINVAL;
+
+ driver_override = kstrndup(buf, count, GFP_KERNEL);
--- /dev/null
+From 6a7228d90d42bcacfe38786756ba62762b91c20a Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 10 Apr 2018 15:21:44 +0200
+Subject: ARM: amba: Fix race condition with driver_override
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 6a7228d90d42bcacfe38786756ba62762b91c20a upstream.
+
+The driver_override implementation is susceptible to a race condition
+when different threads are reading vs storing a different driver
+override. Add locking to avoid this race condition.
+
+Cfr. commits 6265539776a0810b ("driver core: platform: fix race
+condition with driver_override") and 9561475db680f714 ("PCI: Fix race
+condition with driver_override").
+
+Fixes: 3cf385713460eb2b ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Todd Kjos <tkjos@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/amba/bus.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -68,8 +68,12 @@ static ssize_t driver_override_show(stru
+ struct device_attribute *attr, char *buf)
+ {
+ struct amba_device *dev = to_amba_device(_dev);
++ ssize_t len;
+
+- return sprintf(buf, "%s\n", dev->driver_override);
++ device_lock(_dev);
++ len = sprintf(buf, "%s\n", dev->driver_override);
++ device_unlock(_dev);
++ return len;
+ }
+
+ static ssize_t driver_override_store(struct device *_dev,
+@@ -77,7 +81,7 @@ static ssize_t driver_override_store(str
+ const char *buf, size_t count)
+ {
+ struct amba_device *dev = to_amba_device(_dev);
+- char *driver_override, *old = dev->driver_override, *cp;
++ char *driver_override, *old, *cp;
+
+ if (count > PATH_MAX)
+ return -EINVAL;
+@@ -90,12 +94,15 @@ static ssize_t driver_override_store(str
+ if (cp)
+ *cp = '\0';
+
++ device_lock(_dev);
++ old = dev->driver_override;
+ if (strlen(driver_override)) {
+ dev->driver_override = driver_override;
+ } else {
+ kfree(driver_override);
+ dev->driver_override = NULL;
+ }
++ device_unlock(_dev);
+
+ kfree(old);
+
--- /dev/null
+From 5f53624662eaac89598641cee6cd54fc192572d9 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 10 Apr 2018 15:21:43 +0200
+Subject: ARM: amba: Make driver_override output consistent with other buses
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 5f53624662eaac89598641cee6cd54fc192572d9 upstream.
+
+For AMBA devices with unconfigured driver override, the
+"driver_override" sysfs virtual file is empty, while it contains
+"(null)" for platform and PCI devices.
+
+Make AMBA consistent with other buses by dropping the test for a NULL
+pointer.
+
+Note that contrary to popular belief, sprintf() handles NULL pointers
+fine; they are printed as "(null)".
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Todd Kjos <tkjos@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/amba/bus.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -69,9 +69,6 @@ static ssize_t driver_override_show(stru
+ {
+ struct amba_device *dev = to_amba_device(_dev);
+
+- if (!dev->driver_override)
+- return 0;
+-
+ return sprintf(buf, "%s\n", dev->driver_override);
+ }
+
--- /dev/null
+From c656941df9bc80f7ec65b92ca73c42f8b0b62628 Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+Date: Sun, 8 Apr 2018 16:57:35 -0700
+Subject: ASoC: fsl_esai: Fix divisor calculation failure at lower ratio
+
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+
+commit c656941df9bc80f7ec65b92ca73c42f8b0b62628 upstream.
+
+When the desired ratio is less than 256, the savesub (tolerance)
+in the calculation would become 0. This will then fail the loop-
+search immediately without reporting any errors.
+
+But if the ratio is smaller enough, there is no need to calculate
+the tolerance because PM divisor alone is enough to get the ratio.
+
+So a simple fix could be just to set PM directly instead of going
+into the loop-search.
+
+Reported-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Tested-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/fsl_esai.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -143,6 +143,13 @@ static int fsl_esai_divisor_cal(struct s
+
+ psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8;
+
++ /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */
++ if (ratio <= 256) {
++ pm = ratio;
++ fp = 1;
++ goto out;
++ }
++
+ /* Set the max fluctuation -- 0.1% of the max devisor */
+ savesub = (psr ? 1 : 8) * 256 * maxfp / 1000;
+
--- /dev/null
+From 9c55ad1c214d9f8c4594ac2c3fa392c1c32431a7 Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Tue, 24 Apr 2018 19:10:55 +0200
+Subject: libceph: validate con->state at the top of try_write()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 9c55ad1c214d9f8c4594ac2c3fa392c1c32431a7 upstream.
+
+ceph_con_workfn() validates con->state before calling try_read() and
+then try_write(). However, try_read() temporarily releases con->mutex,
+notably in process_message() and ceph_con_in_msg_alloc(), opening the
+window for ceph_con_close() to sneak in, close the connection and
+release con->sock. When try_write() is called on the assumption that
+con->state is still valid (i.e. not STANDBY or CLOSED), a NULL sock
+gets passed to the networking stack:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
+ IP: selinux_socket_sendmsg+0x5/0x20
+
+Make sure con->state is valid at the top of try_write() and add an
+explicit BUG_ON for this, similar to try_read().
+
+Cc: stable@vger.kernel.org
+Link: https://tracker.ceph.com/issues/23706
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Jason Dillaman <dillaman@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ceph/messenger.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2531,6 +2531,11 @@ static int try_write(struct ceph_connect
+ int ret = 1;
+
+ dout("try_write start %p state %lu\n", con, con->state);
++ if (con->state != CON_STATE_PREOPEN &&
++ con->state != CON_STATE_CONNECTING &&
++ con->state != CON_STATE_NEGOTIATING &&
++ con->state != CON_STATE_OPEN)
++ return 0;
+
+ more:
+ dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
+@@ -2556,6 +2561,8 @@ more:
+ }
+
+ more_kvec:
++ BUG_ON(!con->sock);
++
+ /* kvec data queued? */
+ if (con->out_kvec_left) {
+ ret = write_partial_kvec(con);
alsa-seq-oss-hardening-for-potential-spectre-v1.patch
alsa-hda-hardening-for-potential-spectre-v1.patch
alsa-hda-realtek-add-some-fixes-for-alc233.patch
-alsa-hda-realtek-update-alc255-depop-optimize.patch
mtd-cfi-cmdset_0001-do-not-allow-read-write-to-suspend-erase-block.patch
mtd-cfi-cmdset_0001-workaround-micron-erase-suspend-bug.patch
mtd-cfi-cmdset_0002-do-not-allow-read-write-to-suspend-erase-block.patch
kobject-don-t-use-warn-for-registration-failures.patch
scsi-sd-defer-spinning-up-drive-while-sanitize-is-in-progress.patch
+arm-amba-make-driver_override-output-consistent-with-other-buses.patch
+arm-amba-fix-race-condition-with-driver_override.patch
+arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch
+asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch
+libceph-validate-con-state-at-the-top-of-try_write.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
