--- /dev/null
+From efabcc2123f0ed47870033b8d6fc73b50d76d635 Mon Sep 17 00:00:00 2001
+From: José Miguel Gonçalves <jose.goncalves@inov.pt>
+Date: Wed, 11 Dec 2013 11:11:13 +0000
+Subject: hwmon: HIH-6130: Support I2C bus drivers without I2C_FUNC_SMBUS_QUICK
+
+From: José Miguel Gonçalves <jose.goncalves@inov.pt>
+
+commit efabcc2123f0ed47870033b8d6fc73b50d76d635 upstream.
+
+Some I2C bus drivers do not allow zero-length data transfers which are
+required to start a measurement with the HIH6130/1 sensor. Nevertheless,
+we can overcome this limitation by writing a zero dummy byte. This byte
+is ignored by the sensor and was verified to be working with the OMAP
+I2C bus driver in a BeagleBone board.
+
+Signed-off-by: José Miguel Gonçalves <jose.goncalves@inov.pt>
+[Guenter Roeck: Simplified complexity of write_length initialization]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/hih6130.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/hih6130.c
++++ b/drivers/hwmon/hih6130.c
+@@ -43,6 +43,7 @@
+ * @last_update: time of last update (jiffies)
+ * @temperature: cached temperature measurement value
+ * @humidity: cached humidity measurement value
++ * @write_length: length for I2C measurement request
+ */
+ struct hih6130 {
+ struct device *hwmon_dev;
+@@ -51,6 +52,7 @@ struct hih6130 {
+ unsigned long last_update;
+ int temperature;
+ int humidity;
++ size_t write_length;
+ };
+
+ /**
+@@ -121,8 +123,15 @@ static int hih6130_update_measurements(s
+ */
+ if (time_after(jiffies, hih6130->last_update + HZ) || !hih6130->valid) {
+
+- /* write to slave address, no data, to request a measurement */
+- ret = i2c_master_send(client, tmp, 0);
++ /*
++ * Write to slave address to request a measurement.
++ * According with the datasheet it should be with no data, but
++ * for systems with I2C bus drivers that do not allow zero
++ * length packets we write one dummy byte to allow sensor
++ * measurements on them.
++ */
++ tmp[0] = 0;
++ ret = i2c_master_send(client, tmp, hih6130->write_length);
+ if (ret < 0)
+ goto out;
+
+@@ -252,6 +261,9 @@ static int hih6130_probe(struct i2c_clie
+ goto fail_remove_sysfs;
+ }
+
++ if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_QUICK))
++ hih6130->write_length = 1;
++
+ return 0;
+
+ fail_remove_sysfs:
--- /dev/null
+From 3806b45ba4655147a011df03242cc197ab986c43 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 12 Dec 2013 08:05:33 +0100
+Subject: hwmon: Prevent some divide by zeros in FAN_TO_REG()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3806b45ba4655147a011df03242cc197ab986c43 upstream.
+
+The "rpm * div" operations can overflow here, so this patch adds an
+upper limit to rpm to prevent that. Jean Delvare helped me with this
+patch.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Roger Lucas <vt8231@hiddenengine.co.uk>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/lm78.c | 2 ++
+ drivers/hwmon/sis5595.c | 2 ++
+ drivers/hwmon/vt8231.c | 2 +-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm78.c
++++ b/drivers/hwmon/lm78.c
+@@ -94,6 +94,8 @@ static inline u8 FAN_TO_REG(long rpm, in
+ {
+ if (rpm <= 0)
+ return 255;
++ if (rpm > 1350000)
++ return 1;
+ return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
+ }
+
+--- a/drivers/hwmon/sis5595.c
++++ b/drivers/hwmon/sis5595.c
+@@ -141,6 +141,8 @@ static inline u8 FAN_TO_REG(long rpm, in
+ {
+ if (rpm <= 0)
+ return 255;
++ if (rpm > 1350000)
++ return 1;
+ return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
+ }
+
+--- a/drivers/hwmon/vt8231.c
++++ b/drivers/hwmon/vt8231.c
+@@ -145,7 +145,7 @@ static const u8 regtempmin[] = { 0x3a, 0
+ */
+ static inline u8 FAN_TO_REG(long rpm, int div)
+ {
+- if (rpm == 0)
++ if (rpm <= 0 || rpm > 1310720)
+ return 0;
+ return clamp_val(1310720 / (rpm * div), 1, 255);
+ }
--- /dev/null
+From 33a7ab91d509fa33b4bcd3ce0038cc80298050da Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 12 Dec 2013 08:05:32 +0100
+Subject: hwmon: (w83l768ng) Fix fan speed control range
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 33a7ab91d509fa33b4bcd3ce0038cc80298050da upstream.
+
+The W83L786NG stores the fan speed on 4 bits while the sysfs interface
+uses a 0-255 range. Thus the driver should scale the user input down
+to map it to the device range, and scale up the value read from the
+device before presenting it to the user. The reserved register nibble
+should be left unchanged.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/w83l786ng.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/w83l786ng.c
++++ b/drivers/hwmon/w83l786ng.c
+@@ -481,9 +481,11 @@ store_pwm(struct device *dev, struct dev
+ if (err)
+ return err;
+ val = clamp_val(val, 0, 255);
++ val = DIV_ROUND_CLOSEST(val, 0x11);
+
+ mutex_lock(&data->update_lock);
+- data->pwm[nr] = val;
++ data->pwm[nr] = val * 0x11;
++ val |= w83l786ng_read_value(client, W83L786NG_REG_PWM[nr]) & 0xf0;
+ w83l786ng_write_value(client, W83L786NG_REG_PWM[nr], val);
+ mutex_unlock(&data->update_lock);
+ return count;
+@@ -777,8 +779,9 @@ static struct w83l786ng_data *w83l786ng_
+ ? 0 : 1;
+ data->pwm_enable[i] =
+ ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1;
+- data->pwm[i] = w83l786ng_read_value(client,
+- W83L786NG_REG_PWM[i]);
++ data->pwm[i] =
++ (w83l786ng_read_value(client, W83L786NG_REG_PWM[i])
++ & 0x0f) * 0x11;
+ }
+
+
--- /dev/null
+From cf7559bc053471f32373d71d04a9aa19e0b48d59 Mon Sep 17 00:00:00 2001
+From: Brian Carnes <bmcarnes@gmail.com>
+Date: Thu, 12 Dec 2013 08:05:32 +0100
+Subject: hwmon: (w83l786ng) Fix fan speed control mode setting and reporting
+
+From: Brian Carnes <bmcarnes@gmail.com>
+
+commit cf7559bc053471f32373d71d04a9aa19e0b48d59 upstream.
+
+The wrong mask is used, which causes some fan speed control modes
+(pwmX_enable) to be incorrectly reported, and some modes to be
+impossible to set.
+
+[JD: add subject and description.]
+
+Signed-off-by: Brian Carnes <bmcarnes@gmail.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/w83l786ng.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/w83l786ng.c
++++ b/drivers/hwmon/w83l786ng.c
+@@ -510,7 +510,7 @@ store_pwm_enable(struct device *dev, str
+ mutex_lock(&data->update_lock);
+ reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG);
+ data->pwm_enable[nr] = val;
+- reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
++ reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
+ reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr];
+ w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg);
+ mutex_unlock(&data->update_lock);
+@@ -776,7 +776,7 @@ static struct w83l786ng_data *w83l786ng_
+ ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1)
+ ? 0 : 1;
+ data->pwm_enable[i] =
+- ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1;
++ ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1;
+ data->pwm[i] = w83l786ng_read_value(client,
+ W83L786NG_REG_PWM[i]);
+ }
kvm-x86-fix-potential-divide-by-0-in-lapic-cve-2013-6367.patch
kvm-x86-convert-vapic-synchronization-to-_cached-functions-cve-2013-6368.patch
kvm-x86-fix-guest-initiated-crash-with-x2apic-cve-2013-6376.patch
+hwmon-prevent-some-divide-by-zeros-in-fan_to_reg.patch
+hwmon-hih-6130-support-i2c-bus-drivers-without-i2c_func_smbus_quick.patch
+hwmon-w83l786ng-fix-fan-speed-control-mode-setting-and-reporting.patch
+hwmon-w83l768ng-fix-fan-speed-control-range.patch
+xfs-growfs-overruns-agfl-buffer-on-v4-filesystems.patch
+xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
--- /dev/null
+From f94c44573e7c22860e2c3dfe349c45f72ba35ad3 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Thu, 21 Nov 2013 15:41:06 +1100
+Subject: xfs: growfs overruns AGFL buffer on V4 filesystems
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit f94c44573e7c22860e2c3dfe349c45f72ba35ad3 upstream.
+
+This loop in xfs_growfs_data_private() is incorrect for V4
+superblocks filesystems:
+
+ for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++)
+ agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK);
+
+For V4 filesystems, we don't have a agfl header structure, and so
+XFS_AGFL_SIZE() returns an entire sector's worth of entries, which
+we then index from an offset into the sector. Hence: buffer overrun.
+
+This problem was introduced in 3.10 by commit 77c95bba ("xfs: add
+CRC checks to the AGFL") which changed the AGFL structure but failed
+to update the growfs code to handle the different structures.
+
+Fix it by using the correct offset into the buffer for both V4 and
+V5 filesystems.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Jie Liu <jeff.liu@oracle.com>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_fsops.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_fsops.c
++++ b/fs/xfs/xfs_fsops.c
+@@ -217,6 +217,8 @@ xfs_growfs_data_private(
+ */
+ nfree = 0;
+ for (agno = nagcount - 1; agno >= oagcount; agno--, new -= agsize) {
++ __be32 *agfl_bno;
++
+ /*
+ * AG freespace header block
+ */
+@@ -276,8 +278,10 @@ xfs_growfs_data_private(
+ agfl->agfl_seqno = cpu_to_be32(agno);
+ uuid_copy(&agfl->agfl_uuid, &mp->m_sb.sb_uuid);
+ }
++
++ agfl_bno = XFS_BUF_TO_AGFL_BNO(mp, bp);
+ for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++)
+- agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK);
++ agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK);
+
+ error = xfs_bwrite(bp);
+ xfs_buf_relse(bp);
--- /dev/null
+From 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 31 Oct 2013 21:00:10 +0300
+Subject: xfs: underflow bug in xfs_attrlist_by_handle()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 31978b5cc66b8ba8a7e8eef60b12395d41b7b890 upstream.
+
+If we allocate less than sizeof(struct attrlist) then we end up
+corrupting memory or doing a ZERO_PTR_SIZE dereference.
+
+This can only be triggered with CAP_SYS_ADMIN.
+
+Reported-by: Nico Golde <nico@ngolde.de>
+Reported-by: Fabian Yamaguchi <fabs@goesec.de>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_ioctl.c | 3 ++-
+ fs/xfs/xfs_ioctl32.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -443,7 +443,8 @@ xfs_attrlist_by_handle(
+ return -XFS_ERROR(EPERM);
+ if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
+ return -XFS_ERROR(EFAULT);
+- if (al_hreq.buflen > XATTR_LIST_MAX)
++ if (al_hreq.buflen < sizeof(struct attrlist) ||
++ al_hreq.buflen > XATTR_LIST_MAX)
+ return -XFS_ERROR(EINVAL);
+
+ /*
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -357,7 +357,8 @@ xfs_compat_attrlist_by_handle(
+ if (copy_from_user(&al_hreq, arg,
+ sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
+ return -XFS_ERROR(EFAULT);
+- if (al_hreq.buflen > XATTR_LIST_MAX)
++ if (al_hreq.buflen < sizeof(struct attrlist) ||
++ al_hreq.buflen > XATTR_LIST_MAX)
+ return -XFS_ERROR(EINVAL);
+
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
