From: Greg Kroah-Hartman Date: Mon, 5 Sep 2022 16:00:04 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.10.142~63 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1c0cc58a7fb79b76a2ec63421dd90c4ef92e51a4;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: iio-ad7292-prevent-regulator-double-disable.patch iio-adc-mcp3911-use-correct-formula-for-ad-conversion.patch input-iforce-wake-up-after-clearing-iforce_xmit_running-flag.patch misc-fastrpc-fix-memory-corruption-on-open.patch misc-fastrpc-fix-memory-corruption-on-probe.patch tty-serial-lpuart-disable-flow-control-while-waiting-for-the-transmit-engine-to-complete.patch usb-serial-ftdi_sio-add-omron-cs1w-cif31-device-id.patch --- diff --git a/queue-5.10/iio-ad7292-prevent-regulator-double-disable.patch b/queue-5.10/iio-ad7292-prevent-regulator-double-disable.patch new file mode 100644 index 00000000000..7d82dfe19a9 --- /dev/null +++ b/queue-5.10/iio-ad7292-prevent-regulator-double-disable.patch @@ -0,0 +1,44 @@ +From 22b4277641c6823ec03d5b1cd82628e5e53e75b7 Mon Sep 17 00:00:00 2001 +From: Matti Vaittinen +Date: Fri, 19 Aug 2022 11:51:07 +0300 +Subject: iio: ad7292: Prevent regulator double disable + +From: Matti Vaittinen + +commit 22b4277641c6823ec03d5b1cd82628e5e53e75b7 upstream. + +The ad7292 tries to add an devm_action for disabling a regulator at +device detach using devm_add_action_or_reset(). The +devm_add_action_or_reset() does call the release function should adding +action fail. The driver inspects the value returned by +devm_add_action_or_reset() and manually calls regulator_disable() if +adding the action has failed. This leads to double disable and messes +the enable count for regulator. + +Do not manually call disable if devm_add_action_or_reset() fails. + +Fixes: 506d2e317a0a ("iio: adc: Add driver support for AD7292") +Signed-off-by: Matti Vaittinen +Tested-by: Marcelo Schmitt +Link: https://lore.kernel.org/r/Yv9O+9sxU7gAv3vM@fedora +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7292.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/iio/adc/ad7292.c ++++ b/drivers/iio/adc/ad7292.c +@@ -289,10 +289,8 @@ static int ad7292_probe(struct spi_devic + + ret = devm_add_action_or_reset(&spi->dev, + ad7292_regulator_disable, st); +- if (ret) { +- regulator_disable(st->reg); ++ if (ret) + return ret; +- } + + ret = regulator_get_voltage(st->reg); + if (ret < 0) diff --git a/queue-5.10/iio-adc-mcp3911-use-correct-formula-for-ad-conversion.patch b/queue-5.10/iio-adc-mcp3911-use-correct-formula-for-ad-conversion.patch new file mode 100644 index 00000000000..e83460c42f1 --- /dev/null +++ b/queue-5.10/iio-adc-mcp3911-use-correct-formula-for-ad-conversion.patch @@ -0,0 +1,58 @@ +From 9e2238e3ae40d371a1130226e0e740aa1601efa6 Mon Sep 17 00:00:00 2001 +From: Marcus Folkesson +Date: Fri, 22 Jul 2022 15:07:20 +0200 +Subject: iio: adc: mcp3911: use correct formula for AD conversion + +From: Marcus Folkesson + +commit 9e2238e3ae40d371a1130226e0e740aa1601efa6 upstream. + +The ADC conversion is actually not rail-to-rail but with a factor 1.5. +Make use of this factor when calculating actual voltage. + +Fixes: 3a89b289df5d ("iio: adc: add support for mcp3911") +Signed-off-by: Marcus Folkesson +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220722130726.7627-4-marcus.folkesson@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/mcp3911.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/iio/adc/mcp3911.c ++++ b/drivers/iio/adc/mcp3911.c +@@ -38,8 +38,8 @@ + #define MCP3911_CHANNEL(x) (MCP3911_REG_CHANNEL0 + x * 3) + #define MCP3911_OFFCAL(x) (MCP3911_REG_OFFCAL_CH0 + x * 6) + +-/* Internal voltage reference in uV */ +-#define MCP3911_INT_VREF_UV 1200000 ++/* Internal voltage reference in mV */ ++#define MCP3911_INT_VREF_MV 1200 + + #define MCP3911_REG_READ(reg, id) ((((reg) << 1) | ((id) << 5) | (1 << 0)) & 0xff) + #define MCP3911_REG_WRITE(reg, id) ((((reg) << 1) | ((id) << 5) | (0 << 0)) & 0xff) +@@ -137,11 +137,18 @@ static int mcp3911_read_raw(struct iio_d + + *val = ret / 1000; + } else { +- *val = MCP3911_INT_VREF_UV; ++ *val = MCP3911_INT_VREF_MV; + } + +- *val2 = 24; +- ret = IIO_VAL_FRACTIONAL_LOG2; ++ /* ++ * For 24bit Conversion ++ * Raw = ((Voltage)/(Vref) * 2^23 * Gain * 1.5 ++ * Voltage = Raw * (Vref)/(2^23 * Gain * 1.5) ++ */ ++ ++ /* val2 = (2^23 * 1.5) */ ++ *val2 = 12582912; ++ ret = IIO_VAL_FRACTIONAL; + break; + } + diff --git a/queue-5.10/input-iforce-wake-up-after-clearing-iforce_xmit_running-flag.patch b/queue-5.10/input-iforce-wake-up-after-clearing-iforce_xmit_running-flag.patch new file mode 100644 index 00000000000..873ae234ae4 --- /dev/null +++ b/queue-5.10/input-iforce-wake-up-after-clearing-iforce_xmit_running-flag.patch @@ -0,0 +1,121 @@ +From 98e01215708b6d416345465c09dce2bd4868c67a Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Sat, 27 Aug 2022 20:36:27 -0700 +Subject: Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag + +From: Tetsuo Handa + +commit 98e01215708b6d416345465c09dce2bd4868c67a upstream. + +syzbot is reporting hung task at __input_unregister_device() [1], for +iforce_close() waiting at wait_event_interruptible() with dev->mutex held +is blocking input_disconnect_device() from __input_unregister_device(). + +It seems that the cause is simply that commit c2b27ef672992a20 ("Input: +iforce - wait for command completion when closing the device") forgot to +call wake_up() after clear_bit(). + +Fix this problem by introducing a helper that calls clear_bit() followed +by wake_up_all(). + +Reported-by: syzbot +Fixes: c2b27ef672992a20 ("Input: iforce - wait for command completion when closing the device") +Tested-by: syzbot +Suggested-by: Fabio M. De Francesco +Co-developed-by: Hillf Danton +Signed-off-by: Hillf Danton +Signed-off-by: Tetsuo Handa +Link: https://lore.kernel.org/r/887021c3-4f13-40ce-c8b9-aa6e09faa3a7@I-love.SAKURA.ne.jp +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/iforce/iforce-serio.c | 6 +++--- + drivers/input/joystick/iforce/iforce-usb.c | 8 ++++---- + drivers/input/joystick/iforce/iforce.h | 6 ++++++ + 3 files changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/input/joystick/iforce/iforce-serio.c ++++ b/drivers/input/joystick/iforce/iforce-serio.c +@@ -39,7 +39,7 @@ static void iforce_serio_xmit(struct ifo + + again: + if (iforce->xmit.head == iforce->xmit.tail) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ iforce_clear_xmit_and_wake(iforce); + spin_unlock_irqrestore(&iforce->xmit_lock, flags); + return; + } +@@ -64,7 +64,7 @@ again: + if (test_and_clear_bit(IFORCE_XMIT_AGAIN, iforce->xmit_flags)) + goto again; + +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ iforce_clear_xmit_and_wake(iforce); + + spin_unlock_irqrestore(&iforce->xmit_lock, flags); + } +@@ -169,7 +169,7 @@ static irqreturn_t iforce_serio_irq(stru + iforce_serio->cmd_response_len = iforce_serio->len; + + /* Signal that command is done */ +- wake_up(&iforce->wait); ++ wake_up_all(&iforce->wait); + } else if (likely(iforce->type)) { + iforce_process_packet(iforce, iforce_serio->id, + iforce_serio->data_in, +--- a/drivers/input/joystick/iforce/iforce-usb.c ++++ b/drivers/input/joystick/iforce/iforce-usb.c +@@ -30,7 +30,7 @@ static void __iforce_usb_xmit(struct ifo + spin_lock_irqsave(&iforce->xmit_lock, flags); + + if (iforce->xmit.head == iforce->xmit.tail) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ iforce_clear_xmit_and_wake(iforce); + spin_unlock_irqrestore(&iforce->xmit_lock, flags); + return; + } +@@ -58,9 +58,9 @@ static void __iforce_usb_xmit(struct ifo + XMIT_INC(iforce->xmit.tail, n); + + if ( (n=usb_submit_urb(iforce_usb->out, GFP_ATOMIC)) ) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); + dev_warn(&iforce_usb->intf->dev, + "usb_submit_urb failed %d\n", n); ++ iforce_clear_xmit_and_wake(iforce); + } + + /* The IFORCE_XMIT_RUNNING bit is not cleared here. That's intended. +@@ -175,15 +175,15 @@ static void iforce_usb_out(struct urb *u + struct iforce *iforce = &iforce_usb->iforce; + + if (urb->status) { +- clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); + dev_dbg(&iforce_usb->intf->dev, "urb->status %d, exiting\n", + urb->status); ++ iforce_clear_xmit_and_wake(iforce); + return; + } + + __iforce_usb_xmit(iforce); + +- wake_up(&iforce->wait); ++ wake_up_all(&iforce->wait); + } + + static int iforce_usb_probe(struct usb_interface *intf, +--- a/drivers/input/joystick/iforce/iforce.h ++++ b/drivers/input/joystick/iforce/iforce.h +@@ -119,6 +119,12 @@ static inline int iforce_get_id_packet(s + response_data, response_len); + } + ++static inline void iforce_clear_xmit_and_wake(struct iforce *iforce) ++{ ++ clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags); ++ wake_up_all(&iforce->wait); ++} ++ + /* Public functions */ + /* iforce-main.c */ + int iforce_init_device(struct device *parent, u16 bustype, diff --git a/queue-5.10/misc-fastrpc-fix-memory-corruption-on-open.patch b/queue-5.10/misc-fastrpc-fix-memory-corruption-on-open.patch new file mode 100644 index 00000000000..601b68f5ad2 --- /dev/null +++ b/queue-5.10/misc-fastrpc-fix-memory-corruption-on-open.patch @@ -0,0 +1,50 @@ +From d245f43aab2b61195d8ebb64cef7b5a08c590ab4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 29 Aug 2022 10:05:30 +0200 +Subject: misc: fastrpc: fix memory corruption on open + +From: Johan Hovold + +commit d245f43aab2b61195d8ebb64cef7b5a08c590ab4 upstream. + +The probe session-duplication overflow check incremented the session +count also when there were no more available sessions so that memory +beyond the fixed-size slab-allocated session array could be corrupted in +fastrpc_session_alloc() on open(). + +Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") +Cc: stable@vger.kernel.org # 5.1 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220829080531.29681-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1553,7 +1553,7 @@ static int fastrpc_cb_probe(struct platf + spin_unlock_irqrestore(&cctx->lock, flags); + return -ENOSPC; + } +- sess = &cctx->session[cctx->sesscount]; ++ sess = &cctx->session[cctx->sesscount++]; + sess->used = false; + sess->valid = true; + sess->dev = dev; +@@ -1566,13 +1566,12 @@ static int fastrpc_cb_probe(struct platf + struct fastrpc_session_ctx *dup_sess; + + for (i = 1; i < sessions; i++) { +- if (cctx->sesscount++ >= FASTRPC_MAX_SESSIONS) ++ if (cctx->sesscount >= FASTRPC_MAX_SESSIONS) + break; +- dup_sess = &cctx->session[cctx->sesscount]; ++ dup_sess = &cctx->session[cctx->sesscount++]; + memcpy(dup_sess, sess, sizeof(*dup_sess)); + } + } +- cctx->sesscount++; + spin_unlock_irqrestore(&cctx->lock, flags); + rc = dma_set_mask(dev, DMA_BIT_MASK(32)); + if (rc) { diff --git a/queue-5.10/misc-fastrpc-fix-memory-corruption-on-probe.patch b/queue-5.10/misc-fastrpc-fix-memory-corruption-on-probe.patch new file mode 100644 index 00000000000..ec55e8f6eaf --- /dev/null +++ b/queue-5.10/misc-fastrpc-fix-memory-corruption-on-probe.patch @@ -0,0 +1,37 @@ +From 9baa1415d9abdd1e08362ea2dcfadfacee8690b5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 29 Aug 2022 10:05:29 +0200 +Subject: misc: fastrpc: fix memory corruption on probe + +From: Johan Hovold + +commit 9baa1415d9abdd1e08362ea2dcfadfacee8690b5 upstream. + +Add the missing sanity check on the probed-session count to avoid +corrupting memory beyond the fixed-size slab-allocated session array +when there are more than FASTRPC_MAX_SESSIONS sessions defined in the +devicetree. + +Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") +Cc: stable@vger.kernel.org # 5.1 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220829080531.29681-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1548,6 +1548,11 @@ static int fastrpc_cb_probe(struct platf + of_property_read_u32(dev->of_node, "qcom,nsessions", &sessions); + + spin_lock_irqsave(&cctx->lock, flags); ++ if (cctx->sesscount >= FASTRPC_MAX_SESSIONS) { ++ dev_err(&pdev->dev, "too many sessions\n"); ++ spin_unlock_irqrestore(&cctx->lock, flags); ++ return -ENOSPC; ++ } + sess = &cctx->session[cctx->sesscount]; + sess->used = false; + sess->valid = true; diff --git a/queue-5.10/series b/queue-5.10/series index fa9bd56edc5..0f924cac8a5 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -27,3 +27,10 @@ serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch staging-rtl8712-fix-use-after-free-bugs.patch powerpc-align-syscall-table-for-ppc32.patch vt-clear-selection-before-changing-the-font.patch +tty-serial-lpuart-disable-flow-control-while-waiting-for-the-transmit-engine-to-complete.patch +input-iforce-wake-up-after-clearing-iforce_xmit_running-flag.patch +iio-ad7292-prevent-regulator-double-disable.patch +iio-adc-mcp3911-use-correct-formula-for-ad-conversion.patch +misc-fastrpc-fix-memory-corruption-on-probe.patch +misc-fastrpc-fix-memory-corruption-on-open.patch +usb-serial-ftdi_sio-add-omron-cs1w-cif31-device-id.patch diff --git a/queue-5.10/tty-serial-lpuart-disable-flow-control-while-waiting-for-the-transmit-engine-to-complete.patch b/queue-5.10/tty-serial-lpuart-disable-flow-control-while-waiting-for-the-transmit-engine-to-complete.patch new file mode 100644 index 00000000000..8000f2db17a --- /dev/null +++ b/queue-5.10/tty-serial-lpuart-disable-flow-control-while-waiting-for-the-transmit-engine-to-complete.patch @@ -0,0 +1,34 @@ +From d5a2e0834364377a5d5a2fff1890a0b3f0bafd1f Mon Sep 17 00:00:00 2001 +From: Sherry Sun +Date: Sun, 21 Aug 2022 18:15:27 +0800 +Subject: tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete + +From: Sherry Sun + +commit d5a2e0834364377a5d5a2fff1890a0b3f0bafd1f upstream. + +When the user initializes the uart port, and waits for the transmit +engine to complete in lpuart32_set_termios(), if the UART TX fifo has +dirty data and the UARTMODIR enable the flow control, the TX fifo may +never be empty. So here we should disable the flow control first to make +sure the transmit engin can complete. + +Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") +Cc: stable +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20220821101527.10066-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/fsl_lpuart.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2138,6 +2138,7 @@ lpuart32_set_termios(struct uart_port *p + uart_update_timeout(port, termios->c_cflag, baud); + + /* wait transmit engin complete */ ++ lpuart32_write(&sport->port, 0, UARTMODIR); + lpuart32_wait_bit_set(&sport->port, UARTSTAT, UARTSTAT_TC); + + /* disable transmit and receive */ diff --git a/queue-5.10/usb-serial-ftdi_sio-add-omron-cs1w-cif31-device-id.patch b/queue-5.10/usb-serial-ftdi_sio-add-omron-cs1w-cif31-device-id.patch new file mode 100644 index 00000000000..bce52530d9d --- /dev/null +++ b/queue-5.10/usb-serial-ftdi_sio-add-omron-cs1w-cif31-device-id.patch @@ -0,0 +1,51 @@ +From 001047ea241a9646010b2744451dfbc7289542f3 Mon Sep 17 00:00:00 2001 +From: Niek Nooijens +Date: Mon, 1 Aug 2022 10:39:25 +0200 +Subject: USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id + +From: Niek Nooijens + +commit 001047ea241a9646010b2744451dfbc7289542f3 upstream. + +works perfectly with: +modprobe ftdi_sio +echo "0590 00b2" | tee +/sys/module/ftdi_sio/drivers/usb-serial\:ftdi_sio/new_id > /dev/null + +but doing this every reboot is a pain in the ass. + +Signed-off-by: Niek Nooijens +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1045,6 +1045,8 @@ static const struct usb_device_id id_tab + /* IDS GmbH devices */ + { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, + { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, ++ /* Omron devices */ ++ { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) }, + /* U-Blox devices */ + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -662,6 +662,12 @@ + #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */ + + /* ++ * Omron corporation (https://www.omron.com) ++ */ ++ #define OMRON_VID 0x0590 ++ #define OMRON_CS1W_CIF31_PID 0x00b2 ++ ++/* + * Acton Research Corp. + */ + #define ACTON_VID 0x0647 /* Vendor ID */