From: Greg Kroah-Hartman Date: Mon, 8 Jun 2020 12:32:48 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.7.2~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=701760bfb6e183e2a3bb94609c924f7cec85289d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: iio-adc-stm32-adc-fix-a-wrong-error-message-when-probing-interrupts.patch iio-chemical-pms7003-fix-timestamp-alignment-and-prevent-data-leak.patch iio-chemical-sps30-fix-timestamp-alignment.patch iio-vcnl4000-fix-i2c-swapped-word-reading.patch usb-musb-fix-runtime-pm-imbalance-on-error.patch usb-musb-start-session-in-resume-for-host-port.patch --- diff --git a/queue-5.4/iio-adc-stm32-adc-fix-a-wrong-error-message-when-probing-interrupts.patch b/queue-5.4/iio-adc-stm32-adc-fix-a-wrong-error-message-when-probing-interrupts.patch new file mode 100644 index 00000000000..3536c5cd173 --- /dev/null +++ b/queue-5.4/iio-adc-stm32-adc-fix-a-wrong-error-message-when-probing-interrupts.patch @@ -0,0 +1,124 @@ +From 10134ec3f8cefa6a40fe84987f1795e9e0da9715 Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Tue, 12 May 2020 15:27:05 +0200 +Subject: iio: adc: stm32-adc: fix a wrong error message when probing interrupts + +From: Fabrice Gasnier + +commit 10134ec3f8cefa6a40fe84987f1795e9e0da9715 upstream. + +A wrong error message is printed out currently, like on STM32MP15: +- stm32-adc-core 48003000.adc: IRQ index 2 not found. + +This is seen since commit 7723f4c5ecdb ("driver core: platform: Add an +error message to platform_get_irq*()"). +The STM32 ADC core driver wrongly requests up to 3 interrupt lines. It +should request only the necessary IRQs, based on the compatible: +- stm32f4/h7 ADCs share a common interrupt +- stm32mp1, has one interrupt line per ADC. +So add the number of required interrupts to the compatible data. + +Fixes: d58c67d1d851 ("iio: adc: stm32-adc: add support for STM32MP1") +Signed-off-by: Fabrice Gasnier +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-adc-core.c | 34 ++++++++++++++-------------------- + 1 file changed, 14 insertions(+), 20 deletions(-) + +--- a/drivers/iio/adc/stm32-adc-core.c ++++ b/drivers/iio/adc/stm32-adc-core.c +@@ -65,12 +65,14 @@ struct stm32_adc_priv; + * @clk_sel: clock selection routine + * @max_clk_rate_hz: maximum analog clock rate (Hz, from datasheet) + * @has_syscfg: SYSCFG capability flags ++ * @num_irqs: number of interrupt lines + */ + struct stm32_adc_priv_cfg { + const struct stm32_adc_common_regs *regs; + int (*clk_sel)(struct platform_device *, struct stm32_adc_priv *); + u32 max_clk_rate_hz; + unsigned int has_syscfg; ++ unsigned int num_irqs; + }; + + /** +@@ -372,21 +374,15 @@ static int stm32_adc_irq_probe(struct pl + struct device_node *np = pdev->dev.of_node; + unsigned int i; + +- for (i = 0; i < STM32_ADC_MAX_ADCS; i++) { ++ /* ++ * Interrupt(s) must be provided, depending on the compatible: ++ * - stm32f4/h7 shares a common interrupt line. ++ * - stm32mp1, has one line per ADC ++ */ ++ for (i = 0; i < priv->cfg->num_irqs; i++) { + priv->irq[i] = platform_get_irq(pdev, i); +- if (priv->irq[i] < 0) { +- /* +- * At least one interrupt must be provided, make others +- * optional: +- * - stm32f4/h7 shares a common interrupt. +- * - stm32mp1, has one line per ADC (either for ADC1, +- * ADC2 or both). +- */ +- if (i && priv->irq[i] == -ENXIO) +- continue; +- ++ if (priv->irq[i] < 0) + return priv->irq[i]; +- } + } + + priv->domain = irq_domain_add_simple(np, STM32_ADC_MAX_ADCS, 0, +@@ -397,9 +393,7 @@ static int stm32_adc_irq_probe(struct pl + return -ENOMEM; + } + +- for (i = 0; i < STM32_ADC_MAX_ADCS; i++) { +- if (priv->irq[i] < 0) +- continue; ++ for (i = 0; i < priv->cfg->num_irqs; i++) { + irq_set_chained_handler(priv->irq[i], stm32_adc_irq_handler); + irq_set_handler_data(priv->irq[i], priv); + } +@@ -417,11 +411,8 @@ static void stm32_adc_irq_remove(struct + irq_dispose_mapping(irq_find_mapping(priv->domain, hwirq)); + irq_domain_remove(priv->domain); + +- for (i = 0; i < STM32_ADC_MAX_ADCS; i++) { +- if (priv->irq[i] < 0) +- continue; ++ for (i = 0; i < priv->cfg->num_irqs; i++) + irq_set_chained_handler(priv->irq[i], NULL); +- } + } + + static int stm32_adc_core_switches_supply_en(struct stm32_adc_priv *priv, +@@ -803,6 +794,7 @@ static const struct stm32_adc_priv_cfg s + .regs = &stm32f4_adc_common_regs, + .clk_sel = stm32f4_adc_clk_sel, + .max_clk_rate_hz = 36000000, ++ .num_irqs = 1, + }; + + static const struct stm32_adc_priv_cfg stm32h7_adc_priv_cfg = { +@@ -810,6 +802,7 @@ static const struct stm32_adc_priv_cfg s + .clk_sel = stm32h7_adc_clk_sel, + .max_clk_rate_hz = 36000000, + .has_syscfg = HAS_VBOOSTER, ++ .num_irqs = 1, + }; + + static const struct stm32_adc_priv_cfg stm32mp1_adc_priv_cfg = { +@@ -817,6 +810,7 @@ static const struct stm32_adc_priv_cfg s + .clk_sel = stm32h7_adc_clk_sel, + .max_clk_rate_hz = 40000000, + .has_syscfg = HAS_VBOOSTER | HAS_ANASWVDD, ++ .num_irqs = 2, + }; + + static const struct of_device_id stm32_adc_of_match[] = { diff --git a/queue-5.4/iio-chemical-pms7003-fix-timestamp-alignment-and-prevent-data-leak.patch b/queue-5.4/iio-chemical-pms7003-fix-timestamp-alignment-and-prevent-data-leak.patch new file mode 100644 index 00000000000..6ebee7ce33e --- /dev/null +++ b/queue-5.4/iio-chemical-pms7003-fix-timestamp-alignment-and-prevent-data-leak.patch @@ -0,0 +1,72 @@ +From 13e945631c2ffb946c0af342812a3cd39227de6e Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 17 May 2020 18:30:00 +0100 +Subject: iio:chemical:pms7003: Fix timestamp alignment and prevent data leak. + +From: Jonathan Cameron + +commit 13e945631c2ffb946c0af342812a3cd39227de6e upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses an array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data with alignment +explicitly requested. This data is allocated with kzalloc so no +data can leak appart from previous readings. + +Fixes: a1d642266c14 ("iio: chemical: add support for Plantower PMS7003 sensor") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Cc: +Acked-by: Tomasz Duszynski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/chemical/pms7003.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/iio/chemical/pms7003.c ++++ b/drivers/iio/chemical/pms7003.c +@@ -73,6 +73,11 @@ struct pms7003_state { + struct pms7003_frame frame; + struct completion frame_ready; + struct mutex lock; /* must be held whenever state gets touched */ ++ /* Used to construct scan to push to the IIO buffer */ ++ struct { ++ u16 data[3]; /* PM1, PM2P5, PM10 */ ++ s64 ts; ++ } scan; + }; + + static int pms7003_do_cmd(struct pms7003_state *state, enum pms7003_cmd cmd) +@@ -104,7 +109,6 @@ static irqreturn_t pms7003_trigger_handl + struct iio_dev *indio_dev = pf->indio_dev; + struct pms7003_state *state = iio_priv(indio_dev); + struct pms7003_frame *frame = &state->frame; +- u16 data[3 + 1 + 4]; /* PM1, PM2P5, PM10, padding, timestamp */ + int ret; + + mutex_lock(&state->lock); +@@ -114,12 +118,15 @@ static irqreturn_t pms7003_trigger_handl + goto err; + } + +- data[PM1] = pms7003_get_pm(frame->data + PMS7003_PM1_OFFSET); +- data[PM2P5] = pms7003_get_pm(frame->data + PMS7003_PM2P5_OFFSET); +- data[PM10] = pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET); ++ state->scan.data[PM1] = ++ pms7003_get_pm(frame->data + PMS7003_PM1_OFFSET); ++ state->scan.data[PM2P5] = ++ pms7003_get_pm(frame->data + PMS7003_PM2P5_OFFSET); ++ state->scan.data[PM10] = ++ pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET); + mutex_unlock(&state->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, data, ++ iio_push_to_buffers_with_timestamp(indio_dev, &state->scan, + iio_get_time_ns(indio_dev)); + err: + iio_trigger_notify_done(indio_dev->trig); diff --git a/queue-5.4/iio-chemical-sps30-fix-timestamp-alignment.patch b/queue-5.4/iio-chemical-sps30-fix-timestamp-alignment.patch new file mode 100644 index 00000000000..f04d2086bfd --- /dev/null +++ b/queue-5.4/iio-chemical-sps30-fix-timestamp-alignment.patch @@ -0,0 +1,49 @@ +From a5bf6fdd19c327bcfd9073a8740fa19ca4525fd4 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 17 May 2020 18:29:59 +0100 +Subject: iio:chemical:sps30: Fix timestamp alignment + +From: Jonathan Cameron + +commit a5bf6fdd19c327bcfd9073a8740fa19ca4525fd4 upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses an array of smaller elements on the stack. + +Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Cc: +Acked-by: Tomasz Duszynski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/chemical/sps30.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/iio/chemical/sps30.c ++++ b/drivers/iio/chemical/sps30.c +@@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler + struct iio_dev *indio_dev = pf->indio_dev; + struct sps30_state *state = iio_priv(indio_dev); + int ret; +- s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */ ++ struct { ++ s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ ++ s64 ts; ++ } scan; + + mutex_lock(&state->lock); +- ret = sps30_do_meas(state, data, 4); ++ ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data)); + mutex_unlock(&state->lock); + if (ret) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data, ++ iio_push_to_buffers_with_timestamp(indio_dev, &scan, + iio_get_time_ns(indio_dev)); + err: + iio_trigger_notify_done(indio_dev->trig); diff --git a/queue-5.4/iio-vcnl4000-fix-i2c-swapped-word-reading.patch b/queue-5.4/iio-vcnl4000-fix-i2c-swapped-word-reading.patch new file mode 100644 index 00000000000..4fa37418bb2 --- /dev/null +++ b/queue-5.4/iio-vcnl4000-fix-i2c-swapped-word-reading.patch @@ -0,0 +1,52 @@ +From 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 Mon Sep 17 00:00:00 2001 +From: Mathieu Othacehe +Date: Sun, 3 May 2020 11:29:55 +0200 +Subject: iio: vcnl4000: Fix i2c swapped word reading. + +From: Mathieu Othacehe + +commit 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 upstream. + +The bytes returned by the i2c reading need to be swapped +unconditionally. Otherwise, on be16 platforms, an incorrect value will be +returned. + +Taking the slow path via next merge window as its been around a while +and we have a patch set dependent on this which would be held up. + +Fixes: 62a1efb9f868 ("iio: add vcnl4000 combined ALS and proximity sensor") +Signed-off-by: Mathieu Othacehe +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/vcnl4000.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/iio/light/vcnl4000.c ++++ b/drivers/iio/light/vcnl4000.c +@@ -193,7 +193,6 @@ static int vcnl4000_measure(struct vcnl4 + u8 rdy_mask, u8 data_reg, int *val) + { + int tries = 20; +- __be16 buf; + int ret; + + mutex_lock(&data->vcnl4000_lock); +@@ -220,13 +219,12 @@ static int vcnl4000_measure(struct vcnl4 + goto fail; + } + +- ret = i2c_smbus_read_i2c_block_data(data->client, +- data_reg, sizeof(buf), (u8 *) &buf); ++ ret = i2c_smbus_read_word_swapped(data->client, data_reg); + if (ret < 0) + goto fail; + + mutex_unlock(&data->vcnl4000_lock); +- *val = be16_to_cpu(buf); ++ *val = ret; + + return 0; + diff --git a/queue-5.4/series b/queue-5.4/series index 90ba048a3e6..028a019ddb7 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -13,3 +13,9 @@ usb-serial-qcserial-add-dw5816e-qdl-support.patch usb-serial-usb_wwan-do-not-resubmit-rx-urb-on-fatal-errors.patch usb-serial-option-add-telit-le910c1-eux-compositions.patch usb-serial-ch341-add-basis-for-quirk-detection.patch +iio-chemical-sps30-fix-timestamp-alignment.patch +iio-vcnl4000-fix-i2c-swapped-word-reading.patch +iio-chemical-pms7003-fix-timestamp-alignment-and-prevent-data-leak.patch +iio-adc-stm32-adc-fix-a-wrong-error-message-when-probing-interrupts.patch +usb-musb-start-session-in-resume-for-host-port.patch +usb-musb-fix-runtime-pm-imbalance-on-error.patch diff --git a/queue-5.4/usb-musb-fix-runtime-pm-imbalance-on-error.patch b/queue-5.4/usb-musb-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..c25f641c5cb --- /dev/null +++ b/queue-5.4/usb-musb-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,54 @@ +From e4befc121df03dc8ed2ac1031c98f9538e244bae Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Sun, 24 May 2020 21:50:49 -0500 +Subject: usb: musb: Fix runtime PM imbalance on error + +From: Dinghao Liu + +commit e4befc121df03dc8ed2ac1031c98f9538e244bae upstream. + +When copy_from_user() returns an error code, there +is a runtime PM usage counter imbalance. + +Fix this by moving copy_from_user() to the beginning +of this function. + +Fixes: 7b6c1b4c0e1e ("usb: musb: fix runtime PM in debugfs") + +Signed-off-by: Dinghao Liu +Cc: stable@vger.kernel.org +Signed-off-by: Bin Liu +Link: https://lore.kernel.org/r/20200525025049.3400-7-b-liu@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_debugfs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/usb/musb/musb_debugfs.c ++++ b/drivers/usb/musb/musb_debugfs.c +@@ -168,6 +168,11 @@ static ssize_t musb_test_mode_write(stru + u8 test; + char buf[24]; + ++ memset(buf, 0x00, sizeof(buf)); ++ ++ if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) ++ return -EFAULT; ++ + pm_runtime_get_sync(musb->controller); + test = musb_readb(musb->mregs, MUSB_TESTMODE); + if (test) { +@@ -176,11 +181,6 @@ static ssize_t musb_test_mode_write(stru + goto ret; + } + +- memset(buf, 0x00, sizeof(buf)); +- +- if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) +- return -EFAULT; +- + if (strstarts(buf, "force host full-speed")) + test = MUSB_TEST_FORCE_HOST | MUSB_TEST_FORCE_FS; + diff --git a/queue-5.4/usb-musb-start-session-in-resume-for-host-port.patch b/queue-5.4/usb-musb-start-session-in-resume-for-host-port.patch new file mode 100644 index 00000000000..e315ffcedc2 --- /dev/null +++ b/queue-5.4/usb-musb-start-session-in-resume-for-host-port.patch @@ -0,0 +1,44 @@ +From 7f88a5ac393f39319f69b8b20cc8d5759878d1a1 Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Sun, 24 May 2020 21:50:45 -0500 +Subject: usb: musb: start session in resume for host port + +From: Bin Liu + +commit 7f88a5ac393f39319f69b8b20cc8d5759878d1a1 upstream. + +Commit 17539f2f4f0b ("usb: musb: fix enumeration after resume") replaced +musb_start() in musb_resume() to not override softconnect bit, but it +doesn't restart the session for host port which was done in musb_start(). +The session could be disabled in musb_suspend(), which leads the host +port doesn't stay in host mode. + +So let's start the session specifically for host port in musb_resume(). + +Fixes: 17539f2f4f0b ("usb: musb: fix enumeration after resume") + +Cc: stable@vger.kernel.org +Signed-off-by: Bin Liu +Link: https://lore.kernel.org/r/20200525025049.3400-3-b-liu@ti.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2721,6 +2721,13 @@ static int musb_resume(struct device *de + musb_enable_interrupts(musb); + musb_platform_enable(musb); + ++ /* session might be disabled in suspend */ ++ if (musb->port_mode == MUSB_HOST && ++ !(musb->ops->quirks & MUSB_PRESERVE_SESSION)) { ++ devctl |= MUSB_DEVCTL_SESSION; ++ musb_writeb(musb->mregs, MUSB_DEVCTL, devctl); ++ } ++ + spin_lock_irqsave(&musb->lock, flags); + error = musb_run_resume_work(musb); + if (error)