From: Greg Kroah-Hartman Date: Mon, 27 Jan 2020 15:52:11 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.212~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=09d425f68612aded7fe72c32b23efc662b4584de;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch hwmon-core-do-not-use-device-managed-functions-for-memory-allocations.patch hwmon-core-fix-double-free-in-__hwmon_device_register.patch hwmon-core-simplify-sysfs-attribute-name-allocation.patch hwmon-deal-with-errors-from-the-thermal-subsystem.patch input-keyspan-remote-fix-control-message-timeouts.patch mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch mmc-tegra-fix-sdr50-tuning-override.patch --- diff --git a/queue-4.9/arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch b/queue-4.9/arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch new file mode 100644 index 00000000000..6d3a1d2d4db --- /dev/null +++ b/queue-4.9/arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch @@ -0,0 +1,129 @@ +From 927d780ee371d7e121cea4fc7812f6ef2cea461c Mon Sep 17 00:00:00 2001 +From: Alex Sverdlin +Date: Wed, 8 Jan 2020 15:57:47 +0100 +Subject: ARM: 8950/1: ftrace/recordmcount: filter relocation types + +From: Alex Sverdlin + +commit 927d780ee371d7e121cea4fc7812f6ef2cea461c upstream. + +Scenario 1, ARMv7 +================= + +If code in arch/arm/kernel/ftrace.c would operate on mcount() pointer +the following may be generated: + +00000230 : + 230: b5f8 push {r3, r4, r5, r6, r7, lr} + 232: b500 push {lr} + 234: f7ff fffe bl 0 <__gnu_mcount_nc> + 234: R_ARM_THM_CALL __gnu_mcount_nc + 238: f240 0600 movw r6, #0 + 238: R_ARM_THM_MOVW_ABS_NC __gnu_mcount_nc + 23c: f8d0 1180 ldr.w r1, [r0, #384] ; 0x180 + +FTRACE currently is not able to deal with it: + +WARNING: CPU: 0 PID: 0 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1ad/0x230() +... +CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.116-... #1 +... +[] (unwind_backtrace) from [] (show_stack+0x11/0x14) +[] (show_stack) from [] (dump_stack+0x81/0xa8) +[] (dump_stack) from [] (warn_slowpath_common+0x69/0x90) +[] (warn_slowpath_common) from [] (warn_slowpath_null+0x17/0x1c) +[] (warn_slowpath_null) from [] (ftrace_bug+0x1ad/0x230) +[] (ftrace_bug) from [] (ftrace_process_locs+0x27d/0x444) +[] (ftrace_process_locs) from [] (ftrace_init+0x91/0xe8) +[] (ftrace_init) from [] (start_kernel+0x34b/0x358) +[] (start_kernel) from [<00308095>] (0x308095) +---[ end trace cb88537fdc8fa200 ]--- +ftrace failed to modify [] prealloc_fixed_plts+0x8/0x60 + actual: 44:f2:e1:36 +ftrace record flags: 0 + (0) expected tramp: c03143e9 + +Scenario 2, ARMv4T +================== + +ftrace: allocating 14435 entries in 43 pages +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:2029 ftrace_bug+0x204/0x310 +CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.5 #1 +Hardware name: Cirrus Logic EDB9302 Evaluation Board +[] (unwind_backtrace) from [] (show_stack+0x20/0x2c) +[] (show_stack) from [] (dump_stack+0x20/0x30) +[] (dump_stack) from [] (__warn+0xdc/0x104) +[] (__warn) from [] (warn_slowpath_null+0x4c/0x5c) +[] (warn_slowpath_null) from [] (ftrace_bug+0x204/0x310) +[] (ftrace_bug) from [] (ftrace_init+0x3b4/0x4d4) +[] (ftrace_init) from [] (start_kernel+0x20c/0x410) +[] (start_kernel) from [<00000000>] ( (null)) +---[ end trace 0506a2f5dae6b341 ]--- +ftrace failed to modify +[] perf_trace_sys_exit+0x5c/0xe8 + actual: 1e:ff:2f:e1 +Initializing ftrace call sites +ftrace record flags: 0 + (0) + expected tramp: c000fb24 + +The analysis for this problem has been already performed previously, +refer to the link below. + +Fix the above problems by allowing only selected reloc types in +__mcount_loc. The list itself comes from the legacy recordmcount.pl +script. + +Link: https://lore.kernel.org/lkml/56961010.6000806@pengutronix.de/ +Cc: stable@vger.kernel.org +Fixes: ed60453fa8f8 ("ARM: 6511/1: ftrace: add ARM support for C version of recordmcount") +Signed-off-by: Alexander Sverdlin +Acked-by: Steven Rostedt (VMware) +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/recordmcount.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -53,6 +53,10 @@ + #define R_AARCH64_ABS64 257 + #endif + ++#define R_ARM_PC24 1 ++#define R_ARM_THM_CALL 10 ++#define R_ARM_CALL 28 ++ + static int fd_map; /* File descriptor for file being modified. */ + static int mmap_failed; /* Boolean flag. */ + static char gpfx; /* prefix for global symbol name (sometimes '_') */ +@@ -374,6 +378,18 @@ is_mcounted_section_name(char const *con + #define RECORD_MCOUNT_64 + #include "recordmcount.h" + ++static int arm_is_fake_mcount(Elf32_Rel const *rp) ++{ ++ switch (ELF32_R_TYPE(w(rp->r_info))) { ++ case R_ARM_THM_CALL: ++ case R_ARM_CALL: ++ case R_ARM_PC24: ++ return 0; ++ } ++ ++ return 1; ++} ++ + /* 64-bit EM_MIPS has weird ELF64_Rela.r_info. + * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf + * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40] +@@ -463,6 +479,7 @@ do_file(char const *const fname) + break; + case EM_ARM: reltype = R_ARM_ABS32; + altmcount = "__gnu_mcount_nc"; ++ is_fake_mcount32 = arm_is_fake_mcount; + break; + case EM_AARCH64: + reltype = R_AARCH64_ABS64; diff --git a/queue-4.9/hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch b/queue-4.9/hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch new file mode 100644 index 00000000000..fb21584692f --- /dev/null +++ b/queue-4.9/hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch @@ -0,0 +1,44 @@ +From cf3ca1877574a306c0207cbf7fdf25419d9229df Mon Sep 17 00:00:00 2001 +From: Luuk Paulussen +Date: Fri, 6 Dec 2019 12:16:59 +1300 +Subject: hwmon: (adt7475) Make volt2reg return same reg as reg2volt input + +From: Luuk Paulussen + +commit cf3ca1877574a306c0207cbf7fdf25419d9229df upstream. + +reg2volt returns the voltage that matches a given register value. +Converting this back the other way with volt2reg didn't return the same +register value because it used truncation instead of rounding. + +This meant that values read from sysfs could not be written back to sysfs +to set back the same register value. + +With this change, volt2reg will return the same value for every voltage +previously returned by reg2volt (for the set of possible input values) + +Signed-off-by: Luuk Paulussen +Link: https://lore.kernel.org/r/20191205231659.1301-1-luuk.paulussen@alliedtelesis.co.nz +cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/adt7475.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -268,9 +268,10 @@ static inline u16 volt2reg(int channel, + long reg; + + if (bypass_attn & (1 << channel)) +- reg = (volt * 1024) / 2250; ++ reg = DIV_ROUND_CLOSEST(volt * 1024, 2250); + else +- reg = (volt * r[1] * 1024) / ((r[0] + r[1]) * 2250); ++ reg = DIV_ROUND_CLOSEST(volt * r[1] * 1024, ++ (r[0] + r[1]) * 2250); + return clamp_val(reg, 0, 1023) & (0xff << 2); + } + diff --git a/queue-4.9/hwmon-core-do-not-use-device-managed-functions-for-memory-allocations.patch b/queue-4.9/hwmon-core-do-not-use-device-managed-functions-for-memory-allocations.patch new file mode 100644 index 00000000000..90c475d13b6 --- /dev/null +++ b/queue-4.9/hwmon-core-do-not-use-device-managed-functions-for-memory-allocations.patch @@ -0,0 +1,235 @@ +From 3bf8bdcf3bada771eb12b57f2a30caee69e8ab8d Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Thu, 16 Jan 2020 10:44:17 -0800 +Subject: hwmon: (core) Do not use device managed functions for memory allocations + +From: Guenter Roeck + +commit 3bf8bdcf3bada771eb12b57f2a30caee69e8ab8d upstream. + +The hwmon core uses device managed functions, tied to the hwmon parent +device, for various internal memory allocations. This is problematic +since hwmon device lifetime does not necessarily match its parent's +device lifetime. If there is a mismatch, memory leaks will accumulate +until the parent device is released. + +Fix the problem by managing all memory allocations internally. The only +exception is memory allocation for thermal device registration, which +can be tied to the hwmon device, along with thermal device registration +itself. + +Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API") +Cc: stable@vger.kernel.org # v4.14.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem +Cc: stable@vger.kernel.org # v4.14.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register() +Cc: stable@vger.kernel.org # v4.9.x: 3a412d5e4a1c: hwmon: (core) Simplify sysfs attribute name allocation +Cc: stable@vger.kernel.org # v4.9.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem +Cc: stable@vger.kernel.org # v4.9.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register() +Cc: stable@vger.kernel.org # v4.9+ +Cc: Martin K. Petersen +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/hwmon.c | 68 ++++++++++++++++++++++++++++++-------------------- + 1 file changed, 41 insertions(+), 27 deletions(-) + +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -51,6 +51,7 @@ struct hwmon_device_attribute { + + #define to_hwmon_attr(d) \ + container_of(d, struct hwmon_device_attribute, dev_attr) ++#define to_dev_attr(a) container_of(a, struct device_attribute, attr) + + /* + * Thermal zone information +@@ -58,7 +59,7 @@ struct hwmon_device_attribute { + * also provides the sensor index. + */ + struct hwmon_thermal_data { +- struct hwmon_device *hwdev; /* Reference to hwmon device */ ++ struct device *dev; /* Reference to hwmon device */ + int index; /* sensor index */ + }; + +@@ -95,9 +96,27 @@ static const struct attribute_group *hwm + NULL + }; + ++static void hwmon_free_attrs(struct attribute **attrs) ++{ ++ int i; ++ ++ for (i = 0; attrs[i]; i++) { ++ struct device_attribute *dattr = to_dev_attr(attrs[i]); ++ struct hwmon_device_attribute *hattr = to_hwmon_attr(dattr); ++ ++ kfree(hattr); ++ } ++ kfree(attrs); ++} ++ + static void hwmon_dev_release(struct device *dev) + { +- kfree(to_hwmon_device(dev)); ++ struct hwmon_device *hwdev = to_hwmon_device(dev); ++ ++ if (hwdev->group.attrs) ++ hwmon_free_attrs(hwdev->group.attrs); ++ kfree(hwdev->groups); ++ kfree(hwdev); + } + + static struct class hwmon_class = { +@@ -121,11 +140,11 @@ static DEFINE_IDA(hwmon_ida); + static int hwmon_thermal_get_temp(void *data, int *temp) + { + struct hwmon_thermal_data *tdata = data; +- struct hwmon_device *hwdev = tdata->hwdev; ++ struct hwmon_device *hwdev = to_hwmon_device(tdata->dev); + int ret; + long t; + +- ret = hwdev->chip->ops->read(&hwdev->dev, hwmon_temp, hwmon_temp_input, ++ ret = hwdev->chip->ops->read(tdata->dev, hwmon_temp, hwmon_temp_input, + tdata->index, &t); + if (ret < 0) + return ret; +@@ -139,8 +158,7 @@ static struct thermal_zone_of_device_ops + .get_temp = hwmon_thermal_get_temp, + }; + +-static int hwmon_thermal_add_sensor(struct device *dev, +- struct hwmon_device *hwdev, int index) ++static int hwmon_thermal_add_sensor(struct device *dev, int index) + { + struct hwmon_thermal_data *tdata; + struct thermal_zone_device *tzd; +@@ -149,10 +167,10 @@ static int hwmon_thermal_add_sensor(stru + if (!tdata) + return -ENOMEM; + +- tdata->hwdev = hwdev; ++ tdata->dev = dev; + tdata->index = index; + +- tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata, ++ tzd = devm_thermal_zone_of_sensor_register(dev, index, tdata, + &hwmon_thermal_ops); + /* + * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV, +@@ -164,8 +182,7 @@ static int hwmon_thermal_add_sensor(stru + return 0; + } + #else +-static int hwmon_thermal_add_sensor(struct device *dev, +- struct hwmon_device *hwdev, int index) ++static int hwmon_thermal_add_sensor(struct device *dev, int index) + { + return 0; + } +@@ -215,8 +232,7 @@ static int hwmon_attr_base(enum hwmon_se + return 1; + } + +-static struct attribute *hwmon_genattr(struct device *dev, +- const void *drvdata, ++static struct attribute *hwmon_genattr(const void *drvdata, + enum hwmon_sensor_types type, + u32 attr, + int index, +@@ -242,7 +258,7 @@ static struct attribute *hwmon_genattr(s + if ((mode & S_IWUGO) && !ops->write) + return ERR_PTR(-EINVAL); + +- hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL); ++ hattr = kzalloc(sizeof(*hattr), GFP_KERNEL); + if (!hattr) + return ERR_PTR(-ENOMEM); + +@@ -441,8 +457,7 @@ static int hwmon_num_channel_attrs(const + return n; + } + +-static int hwmon_genattrs(struct device *dev, +- const void *drvdata, ++static int hwmon_genattrs(const void *drvdata, + struct attribute **attrs, + const struct hwmon_ops *ops, + const struct hwmon_channel_info *info) +@@ -468,7 +483,7 @@ static int hwmon_genattrs(struct device + attr_mask &= ~BIT(attr); + if (attr >= template_size) + return -EINVAL; +- a = hwmon_genattr(dev, drvdata, info->type, attr, i, ++ a = hwmon_genattr(drvdata, info->type, attr, i, + templates[attr], ops); + if (IS_ERR(a)) { + if (PTR_ERR(a) != -ENOENT) +@@ -482,8 +497,7 @@ static int hwmon_genattrs(struct device + } + + static struct attribute ** +-__hwmon_create_attrs(struct device *dev, const void *drvdata, +- const struct hwmon_chip_info *chip) ++__hwmon_create_attrs(const void *drvdata, const struct hwmon_chip_info *chip) + { + int ret, i, aindex = 0, nattrs = 0; + struct attribute **attrs; +@@ -494,15 +508,17 @@ __hwmon_create_attrs(struct device *dev, + if (nattrs == 0) + return ERR_PTR(-EINVAL); + +- attrs = devm_kcalloc(dev, nattrs + 1, sizeof(*attrs), GFP_KERNEL); ++ attrs = kcalloc(nattrs + 1, sizeof(*attrs), GFP_KERNEL); + if (!attrs) + return ERR_PTR(-ENOMEM); + + for (i = 0; chip->info[i]; i++) { +- ret = hwmon_genattrs(dev, drvdata, &attrs[aindex], chip->ops, ++ ret = hwmon_genattrs(drvdata, &attrs[aindex], chip->ops, + chip->info[i]); +- if (ret < 0) ++ if (ret < 0) { ++ hwmon_free_attrs(attrs); + return ERR_PTR(ret); ++ } + aindex += ret; + } + +@@ -542,14 +558,13 @@ __hwmon_device_register(struct device *d + for (i = 0; groups[i]; i++) + ngroups++; + +- hwdev->groups = devm_kcalloc(dev, ngroups, sizeof(*groups), +- GFP_KERNEL); ++ hwdev->groups = kcalloc(ngroups, sizeof(*groups), GFP_KERNEL); + if (!hwdev->groups) { + err = -ENOMEM; + goto free_hwmon; + } + +- attrs = __hwmon_create_attrs(dev, drvdata, chip); ++ attrs = __hwmon_create_attrs(drvdata, chip); + if (IS_ERR(attrs)) { + err = PTR_ERR(attrs); + goto free_hwmon; +@@ -594,8 +609,7 @@ __hwmon_device_register(struct device *d + hwmon_temp_input, j)) + continue; + if (info[i]->config[j] & HWMON_T_INPUT) { +- err = hwmon_thermal_add_sensor(dev, +- hwdev, j); ++ err = hwmon_thermal_add_sensor(hdev, j); + if (err) { + device_unregister(hdev); + goto ida_remove; +@@ -608,7 +622,7 @@ __hwmon_device_register(struct device *d + return hdev; + + free_hwmon: +- kfree(hwdev); ++ hwmon_dev_release(hdev); + ida_remove: + ida_simple_remove(&hwmon_ida, id); + return ERR_PTR(err); diff --git a/queue-4.9/hwmon-core-fix-double-free-in-__hwmon_device_register.patch b/queue-4.9/hwmon-core-fix-double-free-in-__hwmon_device_register.patch new file mode 100644 index 00000000000..9bdf4b966b9 --- /dev/null +++ b/queue-4.9/hwmon-core-fix-double-free-in-__hwmon_device_register.patch @@ -0,0 +1,132 @@ +From 74e3512731bd5c9673176425a76a7cc5efa8ddb6 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Wed, 24 Oct 2018 22:37:13 +0300 +Subject: hwmon: (core) Fix double-free in __hwmon_device_register() + +From: Dmitry Osipenko + +commit 74e3512731bd5c9673176425a76a7cc5efa8ddb6 upstream. + +Fix double-free that happens when thermal zone setup fails, see KASAN log +below. + +================================================================== +BUG: KASAN: double-free or invalid-free in __hwmon_device_register+0x5dc/0xa7c + +CPU: 0 PID: 132 Comm: kworker/0:2 Tainted: G B 4.19.0-rc8-next-20181016-00042-gb52cd80401e9-dirty #41 +Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) +Workqueue: events deferred_probe_work_func +Backtrace: +[] (dump_backtrace) from [] (show_stack+0x20/0x24) +[] (show_stack) from [] (dump_stack+0x9c/0xb0) +[] (dump_stack) from [] (print_address_description+0x68/0x250) +[] (print_address_description) from [] (kasan_report_invalid_free+0x68/0x88) +[] (kasan_report_invalid_free) from [] (__kasan_slab_free+0x1f4/0x200) +[] (__kasan_slab_free) from [] (kasan_slab_free+0x14/0x18) +[] (kasan_slab_free) from [] (kfree+0x90/0x294) +[] (kfree) from [] (__hwmon_device_register+0x5dc/0xa7c) +[] (__hwmon_device_register) from [] (hwmon_device_register_with_info+0xa0/0xa8) +[] (hwmon_device_register_with_info) from [] (devm_hwmon_device_register_with_info+0x74/0xb4) +[] (devm_hwmon_device_register_with_info) from [] (lm90_probe+0x414/0x578) +[] (lm90_probe) from [] (i2c_device_probe+0x35c/0x384) +[] (i2c_device_probe) from [] (really_probe+0x290/0x3e4) +[] (really_probe) from [] (driver_probe_device+0x80/0x1c4) +[] (driver_probe_device) from [] (__device_attach_driver+0x104/0x11c) +[] (__device_attach_driver) from [] (bus_for_each_drv+0xa4/0xc8) +[] (bus_for_each_drv) from [] (__device_attach+0xf0/0x15c) +[] (__device_attach) from [] (device_initial_probe+0x1c/0x20) +[] (device_initial_probe) from [] (bus_probe_device+0xdc/0xec) +[] (bus_probe_device) from [] (deferred_probe_work_func+0xa8/0xd4) +[] (deferred_probe_work_func) from [] (process_one_work+0x3dc/0x96c) +[] (process_one_work) from [] (worker_thread+0x4ec/0x8bc) +[] (worker_thread) from [] (kthread+0x230/0x240) +[] (kthread) from [] (ret_from_fork+0x14/0x38) +Exception stack(0xcf743fb0 to 0xcf743ff8) +3fa0: 00000000 00000000 00000000 00000000 +3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 + +Allocated by task 132: + kasan_kmalloc.part.1+0x58/0xf4 + kasan_kmalloc+0x90/0xa4 + kmem_cache_alloc_trace+0x90/0x2a0 + __hwmon_device_register+0xbc/0xa7c + hwmon_device_register_with_info+0xa0/0xa8 + devm_hwmon_device_register_with_info+0x74/0xb4 + lm90_probe+0x414/0x578 + i2c_device_probe+0x35c/0x384 + really_probe+0x290/0x3e4 + driver_probe_device+0x80/0x1c4 + __device_attach_driver+0x104/0x11c + bus_for_each_drv+0xa4/0xc8 + __device_attach+0xf0/0x15c + device_initial_probe+0x1c/0x20 + bus_probe_device+0xdc/0xec + deferred_probe_work_func+0xa8/0xd4 + process_one_work+0x3dc/0x96c + worker_thread+0x4ec/0x8bc + kthread+0x230/0x240 + ret_from_fork+0x14/0x38 + (null) + +Freed by task 132: + __kasan_slab_free+0x12c/0x200 + kasan_slab_free+0x14/0x18 + kfree+0x90/0x294 + hwmon_dev_release+0x1c/0x20 + device_release+0x4c/0xe8 + kobject_put+0xac/0x11c + device_unregister+0x2c/0x30 + __hwmon_device_register+0xa58/0xa7c + hwmon_device_register_with_info+0xa0/0xa8 + devm_hwmon_device_register_with_info+0x74/0xb4 + lm90_probe+0x414/0x578 + i2c_device_probe+0x35c/0x384 + really_probe+0x290/0x3e4 + driver_probe_device+0x80/0x1c4 + __device_attach_driver+0x104/0x11c + bus_for_each_drv+0xa4/0xc8 + __device_attach+0xf0/0x15c + device_initial_probe+0x1c/0x20 + bus_probe_device+0xdc/0xec + deferred_probe_work_func+0xa8/0xd4 + process_one_work+0x3dc/0x96c + worker_thread+0x4ec/0x8bc + kthread+0x230/0x240 + ret_from_fork+0x14/0x38 + (null) + +Cc: # v4.15+ +Fixes: 47c332deb8e8 ("hwmon: Deal with errors from the thermal subsystem") +Signed-off-by: Dmitry Osipenko +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/hwmon.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -596,8 +596,10 @@ __hwmon_device_register(struct device *d + if (info[i]->config[j] & HWMON_T_INPUT) { + err = hwmon_thermal_add_sensor(dev, + hwdev, j); +- if (err) +- goto free_device; ++ if (err) { ++ device_unregister(hdev); ++ goto ida_remove; ++ } + } + } + } +@@ -605,8 +607,6 @@ __hwmon_device_register(struct device *d + + return hdev; + +-free_device: +- device_unregister(hdev); + free_hwmon: + kfree(hwdev); + ida_remove: diff --git a/queue-4.9/hwmon-core-simplify-sysfs-attribute-name-allocation.patch b/queue-4.9/hwmon-core-simplify-sysfs-attribute-name-allocation.patch new file mode 100644 index 00000000000..2fdeeed4a07 --- /dev/null +++ b/queue-4.9/hwmon-core-simplify-sysfs-attribute-name-allocation.patch @@ -0,0 +1,68 @@ +From 3a412d5e4a1c831723d0aaf305f1cf9a78ad9c90 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 16 Oct 2016 10:52:04 -0700 +Subject: hwmon: (core) Simplify sysfs attribute name allocation + +From: Guenter Roeck + +commit 3a412d5e4a1c831723d0aaf305f1cf9a78ad9c90 upstream. + +Allocating the sysfs attribute name only if needed and only with the +required minimum length looks optimal, but does not take the additional +overhead for both devm_ data structures and the allocation header itself +into account. This also results in unnecessary memory fragmentation. +Move the sysfs name string into struct hwmon_device_attribute and give it +a sufficient length to reduce this overhead. + +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/hwmon.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -38,12 +38,15 @@ struct hwmon_device { + + #define to_hwmon_device(d) container_of(d, struct hwmon_device, dev) + ++#define MAX_SYSFS_ATTR_NAME_LENGTH 32 ++ + struct hwmon_device_attribute { + struct device_attribute dev_attr; + const struct hwmon_ops *ops; + enum hwmon_sensor_types type; + u32 attr; + int index; ++ char name[MAX_SYSFS_ATTR_NAME_LENGTH]; + }; + + #define to_hwmon_attr(d) \ +@@ -232,20 +235,18 @@ static struct attribute *hwmon_genattr(s + if ((mode & S_IWUGO) && !ops->write) + return ERR_PTR(-EINVAL); + ++ hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL); ++ if (!hattr) ++ return ERR_PTR(-ENOMEM); ++ + if (type == hwmon_chip) { + name = (char *)template; + } else { +- name = devm_kzalloc(dev, strlen(template) + 16, GFP_KERNEL); +- if (!name) +- return ERR_PTR(-ENOMEM); +- scnprintf(name, strlen(template) + 16, template, ++ scnprintf(hattr->name, sizeof(hattr->name), template, + index + hwmon_attr_base(type)); ++ name = hattr->name; + } + +- hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL); +- if (!hattr) +- return ERR_PTR(-ENOMEM); +- + hattr->type = type; + hattr->attr = attr; + hattr->index = index; diff --git a/queue-4.9/hwmon-deal-with-errors-from-the-thermal-subsystem.patch b/queue-4.9/hwmon-deal-with-errors-from-the-thermal-subsystem.patch new file mode 100644 index 00000000000..10c42faa28e --- /dev/null +++ b/queue-4.9/hwmon-deal-with-errors-from-the-thermal-subsystem.patch @@ -0,0 +1,78 @@ +From 47c332deb8e89f6c59b0bb2615945c6e7fad1a60 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Tue, 5 Dec 2017 09:36:14 +0100 +Subject: hwmon: Deal with errors from the thermal subsystem + +From: Linus Walleij + +commit 47c332deb8e89f6c59b0bb2615945c6e7fad1a60 upstream. + +If the thermal subsystem returne -EPROBE_DEFER or any other error +when hwmon calls devm_thermal_zone_of_sensor_register(), this is +silently ignored. + +I ran into this with an incorrectly defined thermal zone, making +it non-existing and thus this call failed with -EPROBE_DEFER +assuming it would appear later. The sensor was still added +which is incorrect: sensors must strictly be added after the +thermal zones, so deferred probe must be respected. + +Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API") +Signed-off-by: Linus Walleij +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/hwmon.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -143,6 +143,7 @@ static int hwmon_thermal_add_sensor(stru + struct hwmon_device *hwdev, int index) + { + struct hwmon_thermal_data *tdata; ++ struct thermal_zone_device *tzd; + + tdata = devm_kzalloc(dev, sizeof(*tdata), GFP_KERNEL); + if (!tdata) +@@ -151,8 +152,14 @@ static int hwmon_thermal_add_sensor(stru + tdata->hwdev = hwdev; + tdata->index = index; + +- devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata, +- &hwmon_thermal_ops); ++ tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata, ++ &hwmon_thermal_ops); ++ /* ++ * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV, ++ * so ignore that error but forward any other error. ++ */ ++ if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV)) ++ return PTR_ERR(tzd); + + return 0; + } +@@ -586,14 +593,20 @@ __hwmon_device_register(struct device *d + if (!chip->ops->is_visible(drvdata, hwmon_temp, + hwmon_temp_input, j)) + continue; +- if (info[i]->config[j] & HWMON_T_INPUT) +- hwmon_thermal_add_sensor(dev, hwdev, j); ++ if (info[i]->config[j] & HWMON_T_INPUT) { ++ err = hwmon_thermal_add_sensor(dev, ++ hwdev, j); ++ if (err) ++ goto free_device; ++ } + } + } + } + + return hdev; + ++free_device: ++ device_unregister(hdev); + free_hwmon: + kfree(hwdev); + ida_remove: diff --git a/queue-4.9/input-keyspan-remote-fix-control-message-timeouts.patch b/queue-4.9/input-keyspan-remote-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..4422a3ce752 --- /dev/null +++ b/queue-4.9/input-keyspan-remote-fix-control-message-timeouts.patch @@ -0,0 +1,63 @@ +From ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 13 Jan 2020 10:38:57 -0800 +Subject: Input: keyspan-remote - fix control-message timeouts + +From: Johan Hovold + +commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream. + +The driver was issuing synchronous uninterruptible control requests +without using a timeout. This could lead to the driver hanging on probe +due to a malfunctioning (or malicious) device until the device is +physically disconnected. While sleeping in probe the driver prevents +other devices connected to the same hub from being added to (or removed +from) the bus. + +The USB upper limit of five seconds per request should be more than +enough. + +Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote") +Signed-off-by: Johan Hovold +Reviewed-by: Greg Kroah-Hartman +Cc: stable # 2.6.13 +Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/misc/keyspan_remote.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/input/misc/keyspan_remote.c ++++ b/drivers/input/misc/keyspan_remote.c +@@ -344,7 +344,8 @@ static int keyspan_setup(struct usb_devi + int retval = 0; + + retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), +- 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0); ++ 0x11, 0x40, 0x5601, 0x0, NULL, 0, ++ USB_CTRL_SET_TIMEOUT); + if (retval) { + dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n", + __func__, retval); +@@ -352,7 +353,8 @@ static int keyspan_setup(struct usb_devi + } + + retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), +- 0x44, 0x40, 0x0, 0x0, NULL, 0, 0); ++ 0x44, 0x40, 0x0, 0x0, NULL, 0, ++ USB_CTRL_SET_TIMEOUT); + if (retval) { + dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n", + __func__, retval); +@@ -360,7 +362,8 @@ static int keyspan_setup(struct usb_devi + } + + retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), +- 0x22, 0x40, 0x0, 0x0, NULL, 0, 0); ++ 0x22, 0x40, 0x0, 0x0, NULL, 0, ++ USB_CTRL_SET_TIMEOUT); + if (retval) { + dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n", + __func__, retval); diff --git a/queue-4.9/mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch b/queue-4.9/mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch new file mode 100644 index 00000000000..1200df94d37 --- /dev/null +++ b/queue-4.9/mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch @@ -0,0 +1,55 @@ +From 2a187d03352086e300daa2044051db00044cd171 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Wed, 15 Jan 2020 10:54:35 +0100 +Subject: mmc: sdhci: fix minimum clock rate for v3 controller +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 2a187d03352086e300daa2044051db00044cd171 upstream. + +For SDHCIv3+ with programmable clock mode, minimal clock frequency is +still base clock / max(divider). Minimal programmable clock frequency is +always greater than minimal divided clock frequency. Without this patch, +SDHCI uses out-of-spec initial frequency when multiplier is big enough: + +mmc1: mmc_rescan_try_freq: trying to init card at 468750 Hz +[for 480 MHz source clock divided by 1024] + +The code in sdhci_calc_clk() already chooses a correct SDCLK clock mode. + +Fixes: c3ed3877625f ("mmc: sdhci: add support for programmable clock mode") +Cc: # 4f6aa3264af4: mmc: tegra: Only advertise UHS modes if IO regulator is present +Cc: +Signed-off-by: Michał Mirosław +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/ffb489519a446caffe7a0a05c4b9372bd52397bb.1579082031.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3243,11 +3243,13 @@ int sdhci_setup_host(struct sdhci_host * + if (host->ops->get_min_clock) + mmc->f_min = host->ops->get_min_clock(host); + else if (host->version >= SDHCI_SPEC_300) { +- if (host->clk_mul) { +- mmc->f_min = (host->max_clk * host->clk_mul) / 1024; ++ if (host->clk_mul) + max_clk = host->max_clk * host->clk_mul; +- } else +- mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300; ++ /* ++ * Divided Clock Mode minimum clock rate is always less than ++ * Programmable Clock Mode minimum clock rate. ++ */ ++ mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300; + } else + mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200; + diff --git a/queue-4.9/mmc-tegra-fix-sdr50-tuning-override.patch b/queue-4.9/mmc-tegra-fix-sdr50-tuning-override.patch new file mode 100644 index 00000000000..dece0fd4f12 --- /dev/null +++ b/queue-4.9/mmc-tegra-fix-sdr50-tuning-override.patch @@ -0,0 +1,40 @@ +From f571389c0b015e76f91c697c4c1700aba860d34f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Tue, 7 Jan 2020 10:47:34 +0100 +Subject: mmc: tegra: fix SDR50 tuning override +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit f571389c0b015e76f91c697c4c1700aba860d34f upstream. + +Commit 7ad2ed1dfcbe inadvertently mixed up a quirk flag's name and +broke SDR50 tuning override. Use correct NVQUIRK_ name. + +Fixes: 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes") +Cc: +Acked-by: Adrian Hunter +Reviewed-by: Thierry Reding +Tested-by: Thierry Reding +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/9aff1d859935e59edd81e4939e40d6c55e0b55f6.1578390388.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -174,7 +174,7 @@ static void tegra_sdhci_reset(struct sdh + misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50; + if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104) + misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104; +- if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50) ++ if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50) + clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE; + } + diff --git a/queue-4.9/series b/queue-4.9/series index 4c5c5240996..2b67935b720 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -241,3 +241,12 @@ net-sysfs-fix-reference-count-leak.patch tcp_bbr-improve-arithmetic-division-in-bbr_update_bw.patch net-usb-lan78xx-add-.ndo_features_check.patch gtp-make-sure-only-sock_dgram-udp-sockets-are-accepted.patch +hwmon-adt7475-make-volt2reg-return-same-reg-as-reg2volt-input.patch +hwmon-core-simplify-sysfs-attribute-name-allocation.patch +hwmon-deal-with-errors-from-the-thermal-subsystem.patch +hwmon-core-fix-double-free-in-__hwmon_device_register.patch +hwmon-core-do-not-use-device-managed-functions-for-memory-allocations.patch +input-keyspan-remote-fix-control-message-timeouts.patch +arm-8950-1-ftrace-recordmcount-filter-relocation-types.patch +mmc-tegra-fix-sdr50-tuning-override.patch +mmc-sdhci-fix-minimum-clock-rate-for-v3-controller.patch