--- /dev/null
+From 535a836fe325c7d6648f02e9cf45a8887cdaeac5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Apr 2018 11:57:47 +0300
+Subject: iio: adc: at91-sama5d2_adc: fix channel configuration for
+ differential channels
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff ]
+
+When iterating through the channels, the index in the array is not the
+scan index. Added an xlate function to translate to the proper index.
+The result of the bug is that the channel array is indexed with a wrong index,
+thus instead of the proper channel, we access invalid memory, which may
+lead to invalid results and/or corruption.
+This will be used also for devicetree channel xlate.
+
+Fixes: 5e1a1da0f ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
+Fixes: 073c66201 ("iio: adc: at91-sama5d2_adc: add support for DMA")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/at91-sama5d2_adc.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index a70ef7fec95f0..0898f40c2b892 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -300,6 +300,27 @@ static const struct iio_chan_spec at91_adc_channels[] = {
+ + AT91_SAMA5D2_DIFF_CHAN_CNT + 1),
+ };
+
++static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan)
++{
++ int i;
++
++ for (i = 0; i < indio_dev->num_channels; i++) {
++ if (indio_dev->channels[i].scan_index == chan)
++ return i;
++ }
++ return -EINVAL;
++}
++
++static inline struct iio_chan_spec const *
++at91_adc_chan_get(struct iio_dev *indio_dev, int chan)
++{
++ int index = at91_adc_chan_xlate(indio_dev, chan);
++
++ if (index < 0)
++ return NULL;
++ return indio_dev->channels + index;
++}
++
+ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ {
+ struct iio_dev *indio = iio_trigger_get_drvdata(trig);
+@@ -317,8 +338,10 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ at91_adc_writel(st, AT91_SAMA5D2_TRGR, status);
+
+ for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+- struct iio_chan_spec const *chan = indio->channels + bit;
++ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
+
++ if (!chan)
++ continue;
+ if (state) {
+ at91_adc_writel(st, AT91_SAMA5D2_CHER,
+ BIT(chan->channel));
+@@ -398,8 +421,11 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
+ u8 bit;
+
+ for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+- struct iio_chan_spec const *chan = indio->channels + bit;
++ struct iio_chan_spec const *chan =
++ at91_adc_chan_get(indio, bit);
+
++ if (!chan)
++ continue;
+ st->buffer[i] = at91_adc_readl(st, chan->address);
+ i++;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0122fb1846bd7bb205cf4425664f95ad4a1ca7bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 12:57:39 +0000
+Subject: iio: adc: at91-sama5d2_adc: fix differential channels in triggered
+ mode
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit a500f3bd787f8224341e44b238f318c407b10897 ]
+
+The differential channels require writing the channel offset register (COR).
+Otherwise they do not work in differential mode.
+The configuration of COR is missing in triggered mode.
+
+Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/at91-sama5d2_adc.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index 0898f40c2b892..34639ee2d2ce6 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -339,9 +339,24 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+
+ for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
++ u32 cor;
+
+ if (!chan)
+ continue;
++ if (state) {
++ cor = at91_adc_readl(st, AT91_SAMA5D2_COR);
++
++ if (chan->differential)
++ cor |= (BIT(chan->channel) |
++ BIT(chan->channel2)) <<
++ AT91_SAMA5D2_COR_DIFF_OFFSET;
++ else
++ cor &= ~(BIT(chan->channel) <<
++ AT91_SAMA5D2_COR_DIFF_OFFSET);
++
++ at91_adc_writel(st, AT91_SAMA5D2_COR, cor);
++ }
++
+ if (state) {
+ at91_adc_writel(st, AT91_SAMA5D2_CHER,
+ BIT(chan->channel));
+--
+2.20.1
+
--- /dev/null
+From 0627691d8a1c7110a9757a4864c3d4d8abc4f041 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2020 12:41:21 -0700
+Subject: kbuild: Disable -Wpointer-to-enum-cast
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f upstream.
+
+Clang's -Wpointer-to-int-cast deviates from GCC in that it warns when
+casting to enums. The kernel does this in certain places, such as device
+tree matches to set the version of the device being used, which allows
+the kernel to avoid using a gigantic union.
+
+https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L428
+https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L402
+https://elixir.bootlin.com/linux/v5.5.8/source/include/linux/mod_devicetable.h#L264
+
+To avoid a ton of false positive warnings, disable this particular part
+of the warning, which has been split off into a separate diagnostic so
+that the entire warning does not need to be turned off for clang. It
+will be visible under W=1 in case people want to go about fixing these
+easily and enabling the warning treewide.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/ClangBuiltLinux/linux/issues/887
+Link: https://github.com/llvm/llvm-project/commit/2a41b31fcdfcb67ab7038fc2ffb606fd50b83a84
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.extrawarn | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index 8d5357053f865..486e135d3e30a 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -72,5 +72,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format)
+ KBUILD_CFLAGS += $(call cc-disable-warning, sign-compare)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length)
+ KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized)
++KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
+ endif
+ endif
+--
+2.20.1
+
mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch
page-flags-fix-a-crash-at-setpageerror-thp_swap.patch
x86-mm-split-vmalloc_sync_all.patch
+usb-cdc-acm-fix-close_delay-and-closing_wait-units-i.patch
+usb-cdc-acm-fix-rounding-error-in-tiocsserial.patch
+iio-adc-at91-sama5d2_adc-fix-channel-configuration-f.patch
+iio-adc-at91-sama5d2_adc-fix-differential-channels-i.patch
+kbuild-disable-wpointer-to-enum-cast.patch
--- /dev/null
+From 66de0c615e1b5aa3ccc89699fbce4745313b866a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 14:31:00 +0100
+Subject: USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
+
+From: Anthony Mallet <anthony.mallet@laas.fr>
+
+[ Upstream commit 633e2b2ded739a34bd0fb1d8b5b871f7e489ea29 ]
+
+close_delay and closing_wait are specified in hundredth of a second but stored
+internally in jiffies. Use the jiffies_to_msecs() and msecs_to_jiffies()
+functions to convert from each other.
+
+Signed-off-by: Anthony Mallet <anthony.mallet@laas.fr>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200312133101.7096-1-anthony.mallet@laas.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-acm.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0453f0eb11781..74d0a91e84273 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -926,10 +926,10 @@ static int get_serial_info(struct acm *acm, struct serial_struct __user *info)
+ memset(&tmp, 0, sizeof(tmp));
+ tmp.xmit_fifo_size = acm->writesize;
+ tmp.baud_base = le32_to_cpu(acm->line.dwDTERate);
+- tmp.close_delay = acm->port.close_delay / 10;
++ tmp.close_delay = jiffies_to_msecs(acm->port.close_delay) / 10;
+ tmp.closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+ ASYNC_CLOSING_WAIT_NONE :
+- acm->port.closing_wait / 10;
++ jiffies_to_msecs(acm->port.closing_wait) / 10;
+
+ if (copy_to_user(info, &tmp, sizeof(tmp)))
+ return -EFAULT;
+@@ -947,9 +947,10 @@ static int set_serial_info(struct acm *acm,
+ if (copy_from_user(&new_serial, newinfo, sizeof(new_serial)))
+ return -EFAULT;
+
+- close_delay = new_serial.close_delay * 10;
++ close_delay = msecs_to_jiffies(new_serial.close_delay * 10);
+ closing_wait = new_serial.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+- ASYNC_CLOSING_WAIT_NONE : new_serial.closing_wait * 10;
++ ASYNC_CLOSING_WAIT_NONE :
++ msecs_to_jiffies(new_serial.closing_wait * 10);
+
+ mutex_lock(&acm->port.mutex);
+
+--
+2.20.1
+
--- /dev/null
+From 6a7e197860c705d9a3011cdeb01ed187b6f64423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 14:31:01 +0100
+Subject: USB: cdc-acm: fix rounding error in TIOCSSERIAL
+
+From: Anthony Mallet <anthony.mallet@laas.fr>
+
+[ Upstream commit b401f8c4f492cbf74f3f59c9141e5be3071071bb ]
+
+By default, tty_port_init() initializes those parameters to a multiple
+of HZ. For instance in line 69 of tty_port.c:
+ port->close_delay = (50 * HZ) / 100;
+https://github.com/torvalds/linux/blob/master/drivers/tty/tty_port.c#L69
+
+With e.g. CONFIG_HZ = 250 (as this is the case for Ubuntu 18.04
+linux-image-4.15.0-37-generic), the default setting for close_delay is
+thus 125.
+
+When ioctl(fd, TIOCGSERIAL, &s) is executed, the setting returned in
+user space is '12' (125/10). When ioctl(fd, TIOCSSERIAL, &s) is then
+executed with the same setting '12', the value is interpreted as '120'
+which is different from the current setting and a EPERM error may be
+raised by set_serial_info() if !CAP_SYS_ADMIN.
+https://github.com/torvalds/linux/blob/master/drivers/usb/class/cdc-acm.c#L919
+
+Fixes: ba2d8ce9db0a6 ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)")
+Signed-off-by: Anthony Mallet <anthony.mallet@laas.fr>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200312133101.7096-2-anthony.mallet@laas.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-acm.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 74d0a91e84273..30a124b74d459 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -942,6 +942,7 @@ static int set_serial_info(struct acm *acm,
+ {
+ struct serial_struct new_serial;
+ unsigned int closing_wait, close_delay;
++ unsigned int old_closing_wait, old_close_delay;
+ int retval = 0;
+
+ if (copy_from_user(&new_serial, newinfo, sizeof(new_serial)))
+@@ -952,18 +953,24 @@ static int set_serial_info(struct acm *acm,
+ ASYNC_CLOSING_WAIT_NONE :
+ msecs_to_jiffies(new_serial.closing_wait * 10);
+
++ /* we must redo the rounding here, so that the values match */
++ old_close_delay = jiffies_to_msecs(acm->port.close_delay) / 10;
++ old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
++ ASYNC_CLOSING_WAIT_NONE :
++ jiffies_to_msecs(acm->port.closing_wait) / 10;
++
+ mutex_lock(&acm->port.mutex);
+
+- if (!capable(CAP_SYS_ADMIN)) {
+- if ((close_delay != acm->port.close_delay) ||
+- (closing_wait != acm->port.closing_wait))
++ if ((new_serial.close_delay != old_close_delay) ||
++ (new_serial.closing_wait != old_closing_wait)) {
++ if (!capable(CAP_SYS_ADMIN))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+- } else {
+- acm->port.close_delay = close_delay;
+- acm->port.closing_wait = closing_wait;
+- }
++ else {
++ acm->port.close_delay = close_delay;
++ acm->port.closing_wait = closing_wait;
++ }
++ } else
++ retval = -EOPNOTSUPP;
+
+ mutex_unlock(&acm->port.mutex);
+ return retval;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
