From: Greg Kroah-Hartman Date: Mon, 24 Apr 2023 06:34:36 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.14.314~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b8f8234d300818d43980b46ea3bc212aac7b6ab;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: counter-104-quad-8-fix-race-condition-between-flag-and-cntr-reads.patch --- diff --git a/queue-5.15/counter-104-quad-8-fix-race-condition-between-flag-and-cntr-reads.patch b/queue-5.15/counter-104-quad-8-fix-race-condition-between-flag-and-cntr-reads.patch new file mode 100644 index 00000000000..6854571ea90 --- /dev/null +++ b/queue-5.15/counter-104-quad-8-fix-race-condition-between-flag-and-cntr-reads.patch @@ -0,0 +1,113 @@ +From 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed Mon Sep 17 00:00:00 2001 +From: William Breathitt Gray +Date: Sun, 12 Mar 2023 19:15:49 -0400 +Subject: counter: 104-quad-8: Fix race condition between FLAG and CNTR reads + +From: William Breathitt Gray + +commit 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed upstream. + +The Counter (CNTR) register is 24 bits wide, but we can have an +effective 25-bit count value by setting bit 24 to the XOR of the Borrow +flag and Carry flag. The flags can be read from the FLAG register, but a +race condition exists: the Borrow flag and Carry flag are instantaneous +and could change by the time the count value is read from the CNTR +register. + +Since the race condition could result in an incorrect 25-bit count +value, remove support for 25-bit count values from this driver; +hard-coded maximum count values are replaced by a LS7267_CNTR_MAX define +for consistency and clarity. + +Fixes: 28e5d3bb0325 ("iio: 104-quad-8: Add IIO support for the ACCES 104-QUAD-8") +Cc: # 6.1.x +Cc: # 6.2.x +Link: https://lore.kernel.org/r/20230312231554.134858-1-william.gray@linaro.org/ +Signed-off-by: William Breathitt Gray +Signed-off-by: Greg Kroah-Hartman +--- + drivers/counter/104-quad-8.c | 29 ++++++++--------------------- + 1 file changed, 8 insertions(+), 21 deletions(-) + +--- a/drivers/counter/104-quad-8.c ++++ b/drivers/counter/104-quad-8.c +@@ -61,10 +61,6 @@ struct quad8 { + #define QUAD8_REG_CHAN_OP 0x11 + #define QUAD8_REG_INDEX_INPUT_LEVELS 0x16 + #define QUAD8_DIFF_ENCODER_CABLE_STATUS 0x17 +-/* Borrow Toggle flip-flop */ +-#define QUAD8_FLAG_BT BIT(0) +-/* Carry Toggle flip-flop */ +-#define QUAD8_FLAG_CT BIT(1) + /* Error flag */ + #define QUAD8_FLAG_E BIT(4) + /* Up/Down flag */ +@@ -97,6 +93,9 @@ struct quad8 { + #define QUAD8_CMR_QUADRATURE_X2 0x10 + #define QUAD8_CMR_QUADRATURE_X4 0x18 + ++/* Each Counter is 24 bits wide */ ++#define LS7267_CNTR_MAX GENMASK(23, 0) ++ + static int quad8_signal_read(struct counter_device *counter, + struct counter_signal *signal, + enum counter_signal_level *level) +@@ -121,17 +120,9 @@ static int quad8_count_read(struct count + { + struct quad8 *const priv = counter->priv; + const int base_offset = priv->base + 2 * count->id; +- unsigned int flags; +- unsigned int borrow; +- unsigned int carry; + int i; + +- flags = inb(base_offset + 1); +- borrow = flags & QUAD8_FLAG_BT; +- carry = !!(flags & QUAD8_FLAG_CT); +- +- /* Borrow XOR Carry effectively doubles count range */ +- *val = (unsigned long)(borrow ^ carry) << 24; ++ *val = 0; + + mutex_lock(&priv->lock); + +@@ -154,8 +145,7 @@ static int quad8_count_write(struct coun + const int base_offset = priv->base + 2 * count->id; + int i; + +- /* Only 24-bit values are supported */ +- if (val > 0xFFFFFF) ++ if (val > LS7267_CNTR_MAX) + return -ERANGE; + + mutex_lock(&priv->lock); +@@ -627,8 +617,7 @@ static int quad8_count_preset_write(stru + { + struct quad8 *const priv = counter->priv; + +- /* Only 24-bit values are supported */ +- if (preset > 0xFFFFFF) ++ if (preset > LS7267_CNTR_MAX) + return -ERANGE; + + mutex_lock(&priv->lock); +@@ -654,8 +643,7 @@ static int quad8_count_ceiling_read(stru + *ceiling = priv->preset[count->id]; + break; + default: +- /* By default 0x1FFFFFF (25 bits unsigned) is maximum count */ +- *ceiling = 0x1FFFFFF; ++ *ceiling = LS7267_CNTR_MAX; + break; + } + +@@ -669,8 +657,7 @@ static int quad8_count_ceiling_write(str + { + struct quad8 *const priv = counter->priv; + +- /* Only 24-bit values are supported */ +- if (ceiling > 0xFFFFFF) ++ if (ceiling > LS7267_CNTR_MAX) + return -ERANGE; + + mutex_lock(&priv->lock); diff --git a/queue-5.15/series b/queue-5.15/series index e5902bd7250..1b6414dd6b4 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -63,3 +63,4 @@ sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch pwm-meson-explicitly-set-.polarity-in-.get_state.patch pwm-iqs620a-explicitly-set-.polarity-in-.get_state.patch pwm-hibvt-explicitly-set-.polarity-in-.get_state.patch +counter-104-quad-8-fix-race-condition-between-flag-and-cntr-reads.patch