From: Greg Kroah-Hartman Date: Mon, 20 Jan 2025 15:31:38 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.6.73~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cd8fb549a34a203c7fafa0ab850b7d68ad205988;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-radeon-check-bo_va-bo-is-non-null-before-using-it.patch iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch --- diff --git a/queue-5.10/drm-radeon-check-bo_va-bo-is-non-null-before-using-it.patch b/queue-5.10/drm-radeon-check-bo_va-bo-is-non-null-before-using-it.patch new file mode 100644 index 0000000000..d97487f293 --- /dev/null +++ b/queue-5.10/drm-radeon-check-bo_va-bo-is-non-null-before-using-it.patch @@ -0,0 +1,31 @@ +From 6fb15dcbcf4f212930350eaee174bb60ed40a536 Mon Sep 17 00:00:00 2001 +From: Pierre-Eric Pelloux-Prayer +Date: Tue, 25 Jun 2024 14:31:34 +0200 +Subject: drm/radeon: check bo_va->bo is non-NULL before using it + +From: Pierre-Eric Pelloux-Prayer + +commit 6fb15dcbcf4f212930350eaee174bb60ed40a536 upstream. + +The call to radeon_vm_clear_freed might clear bo_va->bo, so +we have to check it before dereferencing it. + +Signed-off-by: Pierre-Eric Pelloux-Prayer +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -582,7 +582,7 @@ static void radeon_gem_va_update_vm(stru + if (r) + goto error_unlock; + +- if (bo_va->it.start) ++ if (bo_va->it.start && bo_va->bo) + r = radeon_vm_bo_update(rdev, bo_va, &bo_va->bo->tbo.mem); + + error_unlock: diff --git a/queue-5.10/iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch b/queue-5.10/iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch new file mode 100644 index 0000000000..d0dbc89070 --- /dev/null +++ b/queue-5.10/iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch @@ -0,0 +1,38 @@ +From 38724591364e1e3b278b4053f102b49ea06ee17c Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Mon, 25 Nov 2024 22:16:12 +0100 +Subject: iio: adc: rockchip_saradc: fix information leak in triggered buffer + +From: Javier Carrasco + +commit 38724591364e1e3b278b4053f102b49ea06ee17c upstream. + +The 'data' local struct is used to push data to user space from a +triggered buffer, but it does not set values for inactive channels, as +it only uses iio_for_each_active_channel() to assign new values. + +Initialize the struct to zero before using it to avoid pushing +uninitialized information to userspace. + +Cc: stable@vger.kernel.org +Fixes: 4e130dc7b413 ("iio: adc: rockchip_saradc: Add support iio buffers") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-4-0cb6e98d895c@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Bin Lan +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/rockchip_saradc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -254,6 +254,8 @@ static irqreturn_t rockchip_saradc_trigg + int ret; + int i, j = 0; + ++ memset(&data, 0, sizeof(data)); ++ + mutex_lock(&i_dev->mlock); + + for_each_set_bit(i, i_dev->active_scan_mask, i_dev->masklength) { diff --git a/queue-5.10/iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch b/queue-5.10/iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch new file mode 100644 index 0000000000..548dd7b4f6 --- /dev/null +++ b/queue-5.10/iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch @@ -0,0 +1,68 @@ +From c0f866de4ce447bca3191b9cefac60c4b36a7922 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Tue, 12 Nov 2024 10:30:10 +0100 +Subject: iio: imu: inv_icm42600: fix spi burst write not supported + +From: Jean-Baptiste Maneyrol + +commit c0f866de4ce447bca3191b9cefac60c4b36a7922 upstream. + +Burst write with SPI is not working for all icm42600 chips. It was +only used for setting user offsets with regmap_bulk_write. + +Add specific SPI regmap config for using only single write with SPI. + +Fixes: 9f9ff91b775b ("iio: imu: inv_icm42600: add SPI driver for inv_icm42600 driver") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://patch.msgid.link/20241112-inv-icm42600-fix-spi-burst-write-not-supported-v2-1-97690dc03607@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 11 +++++++++++ + drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 3 ++- + 3 files changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h +@@ -360,6 +360,7 @@ struct inv_icm42600_state { + typedef int (*inv_icm42600_bus_setup)(struct inv_icm42600_state *); + + extern const struct regmap_config inv_icm42600_regmap_config; ++extern const struct regmap_config inv_icm42600_spi_regmap_config; + extern const struct dev_pm_ops inv_icm42600_pm_ops; + + const struct iio_mount_matrix * +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -43,6 +43,17 @@ const struct regmap_config inv_icm42600_ + }; + EXPORT_SYMBOL_GPL(inv_icm42600_regmap_config); + ++/* define specific regmap for SPI not supporting burst write */ ++const struct regmap_config inv_icm42600_spi_regmap_config = { ++ .reg_bits = 8, ++ .val_bits = 8, ++ .max_register = 0x4FFF, ++ .ranges = inv_icm42600_regmap_ranges, ++ .num_ranges = ARRAY_SIZE(inv_icm42600_regmap_ranges), ++ .use_single_write = true, ++}; ++EXPORT_SYMBOL_NS_GPL(inv_icm42600_spi_regmap_config, IIO_ICM42600); ++ + struct inv_icm42600_hw { + uint8_t whoami; + const char *name; +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c +@@ -59,7 +59,8 @@ static int inv_icm42600_probe(struct spi + return -EINVAL; + chip = (enum inv_icm42600_chip)match; + +- regmap = devm_regmap_init_spi(spi, &inv_icm42600_regmap_config); ++ /* use SPI specific regmap */ ++ regmap = devm_regmap_init_spi(spi, &inv_icm42600_spi_regmap_config); + if (IS_ERR(regmap)) + return PTR_ERR(regmap); + diff --git a/queue-5.10/iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch b/queue-5.10/iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch new file mode 100644 index 0000000000..8cbb19d163 --- /dev/null +++ b/queue-5.10/iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch @@ -0,0 +1,48 @@ +From 65a60a590142c54a3f3be11ff162db2d5b0e1e06 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Wed, 13 Nov 2024 21:25:45 +0100 +Subject: iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on + +From: Jean-Baptiste Maneyrol + +commit 65a60a590142c54a3f3be11ff162db2d5b0e1e06 upstream. + +Currently suspending while sensors are one will result in timestamping +continuing without gap at resume. It can work with monotonic clock but +not with other clocks. Fix that by resetting timestamping. + +Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://patch.msgid.link/20241113-inv_icm42600-fix-timestamps-after-suspend-v1-1-dfc77c394173@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -720,6 +720,8 @@ out_unlock: + static int __maybe_unused inv_icm42600_resume(struct device *dev) + { + struct inv_icm42600_state *st = dev_get_drvdata(dev); ++ struct inv_icm42600_timestamp *gyro_ts = iio_priv(st->indio_gyro); ++ struct inv_icm42600_timestamp *accel_ts = iio_priv(st->indio_accel); + int ret; + + mutex_lock(&st->lock); +@@ -740,9 +742,12 @@ static int __maybe_unused inv_icm42600_r + goto out_unlock; + + /* restore FIFO data streaming */ +- if (st->fifo.on) ++ if (st->fifo.on) { ++ inv_icm42600_timestamp_reset(gyro_ts); ++ inv_icm42600_timestamp_reset(accel_ts); + ret = regmap_write(st->map, INV_ICM42600_REG_FIFO_CONFIG, + INV_ICM42600_FIFO_CONFIG_STREAM); ++ } + + out_unlock: + mutex_unlock(&st->lock); diff --git a/queue-5.10/series b/queue-5.10/series index a644fa343c..220deadfb0 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -107,7 +107,10 @@ vsock-reset-socket-state-when-de-assigning-the-transport.patch fs-proc-fix-softlockup-in-__read_vmcore-part-2.patch gpiolib-cdev-fix-use-after-free-in-lineinfo_changed_notify.patch bluetooth-rfcomm-fix-not-validating-setsockopt-user-input.patch -irqchip-plug-a-of-node-reference-leak-in-platform_irqchip_probe.patch irqchip-gic-v3-handle-cpu_pm_enter_failed-correctly.patch hrtimers-handle-cpu-state-correctly-on-hotplug.patch revert-pci-use-preserve_config-in-place-of-pci_flags.patch +iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch +iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch +iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch +drm-radeon-check-bo_va-bo-is-non-null-before-using-it.patch