From: Greg Kroah-Hartman Date: Mon, 5 Jun 2023 14:49:31 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.14.317~90 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a99a7f352292d546e4c9b9bf82e981534653a61e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: hid-google-add-jewel-usb-id.patch hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch --- diff --git a/queue-4.19/hid-google-add-jewel-usb-id.patch b/queue-4.19/hid-google-add-jewel-usb-id.patch new file mode 100644 index 00000000000..7bc4cd0d80e --- /dev/null +++ b/queue-4.19/hid-google-add-jewel-usb-id.patch @@ -0,0 +1,40 @@ +From ed84c4517a5bc536e8572a01dfa11bc22a280d06 Mon Sep 17 00:00:00 2001 +From: Sung-Chi Li +Date: Mon, 24 Apr 2023 10:37:36 +0800 +Subject: HID: google: add jewel USB id + +From: Sung-Chi Li + +commit ed84c4517a5bc536e8572a01dfa11bc22a280d06 upstream. + +Add 1 additional hammer-like device. + +Signed-off-by: Sung-Chi Li +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-google-hammer.c | 2 ++ + drivers/hid/hid-ids.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/hid/hid-google-hammer.c ++++ b/drivers/hid/hid-google-hammer.c +@@ -125,6 +125,8 @@ static const struct hid_device_id hammer + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_JEWEL) }, ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MASTERBALL) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -480,6 +480,7 @@ + #define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044 + #define USB_DEVICE_ID_GOOGLE_DON 0x5050 + #define USB_DEVICE_ID_GOOGLE_EEL 0x5057 ++#define USB_DEVICE_ID_GOOGLE_JEWEL 0x5061 + + #define USB_VENDOR_ID_GOTOP 0x08f2 + #define USB_DEVICE_ID_SUPER_Q2 0x007f diff --git a/queue-4.19/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch b/queue-4.19/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch new file mode 100644 index 00000000000..5c68cd40251 --- /dev/null +++ b/queue-4.19/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch @@ -0,0 +1,39 @@ +From bd249b91977b768ea02bf84d04625d2690ad2b98 Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Mon, 17 Apr 2023 09:01:48 -0700 +Subject: HID: wacom: avoid integer overflow in wacom_intuos_inout() + +From: Nikita Zhandarovich + +commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream. + +If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic +operations and integer promotions are done, high bits in +wacom->serial[idx] will be filled with 1s as well. +Avoid this, albeit unlikely, issue by specifying left operand's __u64 +type for the right operand. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization") +Signed-off-by: Nikita Zhandarovich +Reviewed-by: Ping Cheng +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/wacom_wac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -781,7 +781,7 @@ static int wacom_intuos_inout(struct wac + /* Enter report */ + if ((data[1] & 0xfc) == 0xc0) { + /* serial number of the tool */ +- wacom->serial[idx] = ((data[3] & 0x0f) << 28) + ++ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) + + (data[4] << 20) + (data[5] << 12) + + (data[6] << 4) + (data[7] >> 4); + diff --git a/queue-4.19/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch b/queue-4.19/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch new file mode 100644 index 00000000000..72f067daf7c --- /dev/null +++ b/queue-4.19/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch @@ -0,0 +1,83 @@ +From 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 Mon Sep 17 00:00:00 2001 +From: Jiakai Luo +Date: Sat, 22 Apr 2023 06:34:06 -0700 +Subject: iio: adc: mxs-lradc: fix the order of two cleanup operations + +From: Jiakai Luo + +commit 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 upstream. + +Smatch reports: +drivers/iio/adc/mxs-lradc-adc.c:766 mxs_lradc_adc_probe() warn: +missing unwind goto? + +the order of three init operation: +1.mxs_lradc_adc_trigger_init +2.iio_triggered_buffer_setup +3.mxs_lradc_adc_hw_init + +thus, the order of three cleanup operation should be: +1.mxs_lradc_adc_hw_stop +2.iio_triggered_buffer_cleanup +3.mxs_lradc_adc_trigger_remove + +we exchange the order of two cleanup operations, +introducing the following differences: +1.if mxs_lradc_adc_trigger_init fails, returns directly; +2.if trigger_init succeeds but iio_triggered_buffer_setup fails, +goto err_trig and remove the trigger. + +In addition, we also reorder the unwind that goes on in the +remove() callback to match the new ordering. + +Fixes: 6dd112b9f85e ("iio: adc: mxs-lradc: Add support for ADC driver") +Signed-off-by: Jiakai Luo +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230422133407.72908-1-jkluo@hust.edu.cn +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/mxs-lradc-adc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/iio/adc/mxs-lradc-adc.c ++++ b/drivers/iio/adc/mxs-lradc-adc.c +@@ -767,13 +767,13 @@ static int mxs_lradc_adc_probe(struct pl + + ret = mxs_lradc_adc_trigger_init(iio); + if (ret) +- goto err_trig; ++ return ret; + + ret = iio_triggered_buffer_setup(iio, &iio_pollfunc_store_time, + &mxs_lradc_adc_trigger_handler, + &mxs_lradc_adc_buffer_ops); + if (ret) +- return ret; ++ goto err_trig; + + adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc]; + +@@ -811,9 +811,9 @@ static int mxs_lradc_adc_probe(struct pl + + err_dev: + mxs_lradc_adc_hw_stop(adc); +- mxs_lradc_adc_trigger_remove(iio); +-err_trig: + iio_triggered_buffer_cleanup(iio); ++err_trig: ++ mxs_lradc_adc_trigger_remove(iio); + return ret; + } + +@@ -824,8 +824,8 @@ static int mxs_lradc_adc_remove(struct p + + iio_device_unregister(iio); + mxs_lradc_adc_hw_stop(adc); +- mxs_lradc_adc_trigger_remove(iio); + iio_triggered_buffer_cleanup(iio); ++ mxs_lradc_adc_trigger_remove(iio); + + return 0; + } diff --git a/queue-4.19/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch b/queue-4.19/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch new file mode 100644 index 00000000000..e8c560268a1 --- /dev/null +++ b/queue-4.19/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch @@ -0,0 +1,39 @@ +From a146eccb68be161ae9eab5f3f68bb0ed7c0fbaa8 Mon Sep 17 00:00:00 2001 +From: Lukas Bulwahn +Date: Mon, 8 May 2023 06:02:08 +0200 +Subject: iio: dac: build ad5758 driver when AD5758 is selected + +From: Lukas Bulwahn + +commit a146eccb68be161ae9eab5f3f68bb0ed7c0fbaa8 upstream. + +Commit 28d1a7ac2a0d ("iio: dac: Add AD5758 support") adds the config AD5758 +and the corresponding driver ad5758.c. In the Makefile, the ad5758 driver +is however included when AD5755 is selected, not when AD5758 is selected. + +Probably, this was simply a mistake that happened by copy-and-paste and +forgetting to adjust the actual line. Surprisingly, no one has ever noticed +that this driver is actually only included when AD5755 is selected and that +the config AD5758 has actually no effect on the build. + +Fixes: 28d1a7ac2a0d ("iio: dac: Add AD5758 support") +Signed-off-by: Lukas Bulwahn +Link: https://lore.kernel.org/r/20230508040208.12033-1-lukas.bulwahn@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/Makefile ++++ b/drivers/iio/dac/Makefile +@@ -16,7 +16,7 @@ obj-$(CONFIG_AD5592R_BASE) += ad5592r-ba + obj-$(CONFIG_AD5592R) += ad5592r.o + obj-$(CONFIG_AD5593R) += ad5593r.o + obj-$(CONFIG_AD5755) += ad5755.o +-obj-$(CONFIG_AD5755) += ad5758.o ++obj-$(CONFIG_AD5758) += ad5758.o + obj-$(CONFIG_AD5761) += ad5761.o + obj-$(CONFIG_AD5764) += ad5764.o + obj-$(CONFIG_AD5791) += ad5791.o diff --git a/queue-4.19/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch b/queue-4.19/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch new file mode 100644 index 00000000000..967cc07d7fc --- /dev/null +++ b/queue-4.19/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch @@ -0,0 +1,72 @@ +From 09d3bec7009186bdba77039df01e5834788b3f95 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Thu, 11 May 2023 02:43:30 +0200 +Subject: iio: dac: mcp4725: Fix i2c_master_send() return value handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +commit 09d3bec7009186bdba77039df01e5834788b3f95 upstream. + +The i2c_master_send() returns number of sent bytes on success, +or negative on error. The suspend/resume callbacks expect zero +on success and non-zero on error. Adapt the return value of the +i2c_master_send() to the expectation of the suspend and resume +callbacks, including proper validation of the return value. + +Fixes: cf35ad61aca2 ("iio: add mcp4725 I2C DAC driver") +Signed-off-by: Marek Vasut +Reviewed-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230511004330.206942-1-marex@denx.de +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/mcp4725.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/iio/dac/mcp4725.c ++++ b/drivers/iio/dac/mcp4725.c +@@ -50,12 +50,18 @@ static int mcp4725_suspend(struct device + struct mcp4725_data *data = iio_priv(i2c_get_clientdata( + to_i2c_client(dev))); + u8 outbuf[2]; ++ int ret; + + outbuf[0] = (data->powerdown_mode + 1) << 4; + outbuf[1] = 0; + data->powerdown = true; + +- return i2c_master_send(data->client, outbuf, 2); ++ ret = i2c_master_send(data->client, outbuf, 2); ++ if (ret < 0) ++ return ret; ++ else if (ret != 2) ++ return -EIO; ++ return 0; + } + + static int mcp4725_resume(struct device *dev) +@@ -63,13 +69,19 @@ static int mcp4725_resume(struct device + struct mcp4725_data *data = iio_priv(i2c_get_clientdata( + to_i2c_client(dev))); + u8 outbuf[2]; ++ int ret; + + /* restore previous DAC value */ + outbuf[0] = (data->dac_value >> 8) & 0xf; + outbuf[1] = data->dac_value & 0xff; + data->powerdown = false; + +- return i2c_master_send(data->client, outbuf, 2); ++ ret = i2c_master_send(data->client, outbuf, 2); ++ if (ret < 0) ++ return ret; ++ else if (ret != 2) ++ return -EIO; ++ return 0; + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-4.19/series b/queue-4.19/series index 0888ad16592..db5067aac10 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -58,3 +58,8 @@ netfilter-conntrack-define-variables-exp_nat_nla_pol.patch alsa-oss-avoid-missing-prototype-warnings.patch atm-hide-unused-procfs-functions.patch mailbox-mailbox-test-fix-a-locking-issue-in-mbox_tes.patch +iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch +hid-google-add-jewel-usb-id.patch +hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch +iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch +iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch