From: Greg Kroah-Hartman Date: Fri, 25 Feb 2022 12:34:52 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.9.304~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7b5cdfb0407d1626e2dcce86d114156c09ea1a51;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: serial-8250-fix-error-handling-in-of_platform_serial_probe.patch serial-8250-of-fix-mapped-region-size-when-using-reg-offset-property.patch --- diff --git a/queue-4.9/serial-8250-fix-error-handling-in-of_platform_serial_probe.patch b/queue-4.9/serial-8250-fix-error-handling-in-of_platform_serial_probe.patch new file mode 100644 index 00000000000..5659326f290 --- /dev/null +++ b/queue-4.9/serial-8250-fix-error-handling-in-of_platform_serial_probe.patch @@ -0,0 +1,85 @@ +From foo@baz Fri Feb 25 01:31:22 PM CET 2022 +From: Alexey Khoroshilov +Date: Wed, 19 Jul 2017 11:32:37 +0300 +Subject: serial: 8250: fix error handling in of_platform_serial_probe() + +From: Alexey Khoroshilov + +commit fa9ba3acb557e444fe4a736ab654f0d0a0fbccde upstream. + +clk_disable_unprepare(info->clk) is missed in of_platform_serial_probe(), +while irq_dispose_mapping(port->irq) is missed in of_platform_serial_setup(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Greg Kroah-Hartman +[sudip: adjust context] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_of.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -86,7 +86,7 @@ static int of_platform_serial_setup(stru + ret = of_address_to_resource(np, 0, &resource); + if (ret) { + dev_warn(&ofdev->dev, "invalid address\n"); +- goto out; ++ goto err_unprepare; + } + + spin_lock_init(&port->lock); +@@ -132,7 +132,7 @@ static int of_platform_serial_setup(stru + dev_warn(&ofdev->dev, "unsupported reg-io-width (%d)\n", + prop); + ret = -EINVAL; +- goto out; ++ goto err_dispose; + } + } + +@@ -162,7 +162,9 @@ static int of_platform_serial_setup(stru + port->handle_irq = fsl8250_handle_irq; + + return 0; +-out: ++err_dispose: ++ irq_dispose_mapping(port->irq); ++err_unprepare: + if (info->clk) + clk_disable_unprepare(info->clk); + return ret; +@@ -194,7 +196,7 @@ static int of_platform_serial_probe(stru + port_type = (unsigned long)match->data; + ret = of_platform_serial_setup(ofdev, port_type, &port, info); + if (ret) +- goto out; ++ goto err_free; + + switch (port_type) { + case PORT_8250 ... PORT_MAX_8250: +@@ -228,15 +230,18 @@ static int of_platform_serial_probe(stru + break; + } + if (ret < 0) +- goto out; ++ goto err_dispose; + + info->type = port_type; + info->line = ret; + platform_set_drvdata(ofdev, info); + return 0; +-out: +- kfree(info); ++err_dispose: + irq_dispose_mapping(port.irq); ++ if (info->clk) ++ clk_disable_unprepare(info->clk); ++err_free: ++ kfree(info); + return ret; + } + diff --git a/queue-4.9/serial-8250-of-fix-mapped-region-size-when-using-reg-offset-property.patch b/queue-4.9/serial-8250-of-fix-mapped-region-size-when-using-reg-offset-property.patch new file mode 100644 index 00000000000..92bff0aac47 --- /dev/null +++ b/queue-4.9/serial-8250-of-fix-mapped-region-size-when-using-reg-offset-property.patch @@ -0,0 +1,55 @@ +From foo@baz Fri Feb 25 01:31:29 PM CET 2022 +From: Robert Hancock +Date: Wed, 12 Jan 2022 13:42:14 -0600 +Subject: serial: 8250: of: Fix mapped region size when using reg-offset property + +From: Robert Hancock + +commit d06b1cf28297e27127d3da54753a3a01a2fa2f28 upstream. + +8250_of supports a reg-offset property which is intended to handle +cases where the device registers start at an offset inside the region +of memory allocated to the device. The Xilinx 16550 UART, for which this +support was initially added, requires this. However, the code did not +adjust the overall size of the mapped region accordingly, causing the +driver to request an area of memory past the end of the device's +allocation. For example, if the UART was allocated an address of +0xb0130000, size of 0x10000 and reg-offset of 0x1000 in the device +tree, the region of memory reserved was b0131000-b0140fff, which caused +the driver for the region starting at b0140000 to fail to probe. + +Fix this by subtracting reg-offset from the mapped region size. + +Fixes: b912b5e2cfb3 ([POWERPC] Xilinx: of_serial support for Xilinx uart 16550.) +Cc: stable +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20220112194214.881844-1-robert.hancock@calian.com +Signed-off-by: Greg Kroah-Hartman +[sudip: adjust context] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_of.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -94,8 +94,17 @@ static int of_platform_serial_setup(stru + port->mapsize = resource_size(&resource); + + /* Check for shifted address mapping */ +- if (of_property_read_u32(np, "reg-offset", &prop) == 0) ++ if (of_property_read_u32(np, "reg-offset", &prop) == 0) { ++ if (prop >= port->mapsize) { ++ dev_warn(&ofdev->dev, "reg-offset %u exceeds region size %pa\n", ++ prop, &port->mapsize); ++ ret = -EINVAL; ++ goto err_unprepare; ++ } ++ + port->mapbase += prop; ++ port->mapsize -= prop; ++ } + + /* Compatibility with the deprecated pxa driver and 8250_pxa drivers. */ + if (of_device_is_compatible(np, "mrvl,mmp-uart")) diff --git a/queue-4.9/series b/queue-4.9/series index a9191e0bcc9..ad40a8fd084 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -4,3 +4,5 @@ parisc-unaligned-fix-fldd-and-fstd-unaligned-handlers-on-32-bit-kernel.patch parisc-unaligned-fix-ldw-and-stw-unalignment-handlers.patch sr9700-sanity-check-for-packet-length.patch usb-zaurus-support-another-broken-zaurus.patch +serial-8250-fix-error-handling-in-of_platform_serial_probe.patch +serial-8250-of-fix-mapped-region-size-when-using-reg-offset-property.patch