From: Sasha Levin Date: Wed, 3 Jul 2019 18:13:19 +0000 (-0400) Subject: fixes for 4.4 X-Git-Tag: v5.1.17~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d13157b55a88eed3505bb42a249dd721d2837cff;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/asoc-cs4265-readable-register-too-low.patch b/queue-4.4/asoc-cs4265-readable-register-too-low.patch new file mode 100644 index 00000000000..30c67f68a9e --- /dev/null +++ b/queue-4.4/asoc-cs4265-readable-register-too-low.patch @@ -0,0 +1,43 @@ +From b97ad42dc36d54829d132bd7650fbec853875c73 Mon Sep 17 00:00:00 2001 +From: Matt Flax +Date: Wed, 8 May 2019 16:33:13 +1000 +Subject: ASoC : cs4265 : readable register too low + +[ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ] + +The cs4265_readable_register function stopped short of the maximum +register. + +An example bug is taken from : +https://github.com/Audio-Injector/Ultra/issues/25 + +Where alsactl store fails with : +Cannot read control '2,0,0,C Data Buffer,0': Input/output error + +This patch fixes the bug by setting the cs4265 to have readable +registers up to the maximum hardware register CS4265_MAX_REGISTER. + +Signed-off-by: Matt Flax +Reviewed-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs4265.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c +index 93b02be3a90e..6edec2387861 100644 +--- a/sound/soc/codecs/cs4265.c ++++ b/sound/soc/codecs/cs4265.c +@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { + static bool cs4265_readable_register(struct device *dev, unsigned int reg) + { + switch (reg) { +- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: ++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: + return true; + default: + return false; +-- +2.20.1 + diff --git a/queue-4.4/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch b/queue-4.4/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch new file mode 100644 index 00000000000..f9a69dde1e7 --- /dev/null +++ b/queue-4.4/asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch @@ -0,0 +1,56 @@ +From 03c2a9fc29c49f975cdbb45e2f5215a0980d6ecf Mon Sep 17 00:00:00 2001 +From: Yu-Hsuan Hsu +Date: Tue, 4 Jun 2019 18:49:09 +0800 +Subject: ASoC: max98090: remove 24-bit format support if RJ is 0 + +[ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ] + +The supported formats are S16_LE and S24_LE now. However, by datasheet +of max98090, S24_LE is only supported when it is in the right justified +mode. We should remove 24-bit format if it is not in that mode to avoid +triggering error. + +Signed-off-by: Yu-Hsuan Hsu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 3e65dc74eb33..e7aef841f87d 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, + return 0; + } + ++static int max98090_dai_startup(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct snd_soc_component *component = dai->component; ++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); ++ unsigned int fmt = max98090->dai_fmt; ++ ++ /* Remove 24-bit format support if it is not in right justified mode. */ ++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { ++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); ++ } ++ return 0; ++} ++ + static int max98090_dai_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) +@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); + #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) + + static const struct snd_soc_dai_ops max98090_dai_ops = { ++ .startup = max98090_dai_startup, + .set_sysclk = max98090_dai_set_sysclk, + .set_fmt = max98090_dai_set_fmt, + .set_tdm_slot = max98090_set_tdm_slot, +-- +2.20.1 + diff --git a/queue-4.4/scsi-hpsa-correct-ioaccel2-chaining.patch b/queue-4.4/scsi-hpsa-correct-ioaccel2-chaining.patch new file mode 100644 index 00000000000..445d48ca1d8 --- /dev/null +++ b/queue-4.4/scsi-hpsa-correct-ioaccel2-chaining.patch @@ -0,0 +1,64 @@ +From dc21b39e405c80469cf5a8374f0075a0650efb56 Mon Sep 17 00:00:00 2001 +From: Don Brace +Date: Mon, 3 Jun 2019 16:43:29 -0500 +Subject: scsi: hpsa: correct ioaccel2 chaining + +[ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ] + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for + the last s/g element. + +- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when + chaining. + +Reviewed-by: Bader Ali - Saleh +Reviewed-by: Scott Teel +Reviewed-by: Matt Perricone +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 7 ++++++- + drivers/scsi/hpsa_cmd.h | 1 + + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 910b795fc5eb..e0952882e132 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -4562,7 +4562,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg->reserved[0] = 0; + curr_sg->reserved[1] = 0; + curr_sg->reserved[2] = 0; +- curr_sg->chain_indicator = 0x80; ++ curr_sg->chain_indicator = IOACCEL2_CHAIN; + + curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; + } +@@ -4579,6 +4579,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, + curr_sg++; + } + ++ /* ++ * Set the last s/g element bit ++ */ ++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; ++ + switch (cmd->sc_data_direction) { + case DMA_TO_DEVICE: + cp->direction &= ~IOACCEL2_DIRECTION_MASK; +diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h +index 26488e2a7f02..7ffde12d57d4 100644 +--- a/drivers/scsi/hpsa_cmd.h ++++ b/drivers/scsi/hpsa_cmd.h +@@ -513,6 +513,7 @@ struct ioaccel2_sg_element { + u8 reserved[3]; + u8 chain_indicator; + #define IOACCEL2_CHAIN 0x80 ++#define IOACCEL2_LAST_SG 0x40 + }; + + /* +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 0bdcfe35ecc..347e1143c82 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -46,3 +46,9 @@ bonding-always-enable-vlan-tx-offload.patch net-check-before-dereferencing-netdev_ops-during-busy-poll.patch bluetooth-fix-faulty-expression-for-minimum-encryption-key-size-check.patch um-compile-with-modern-headers.patch +asoc-cs4265-readable-register-too-low.patch +spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch +asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch +usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch +usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch +scsi-hpsa-correct-ioaccel2-chaining.patch diff --git a/queue-4.4/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch b/queue-4.4/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch new file mode 100644 index 00000000000..4fbbe58b8f8 --- /dev/null +++ b/queue-4.4/spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch @@ -0,0 +1,86 @@ +From 2dbc75b1593c23df32f2a97cefce93a63ab9befd Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 16 May 2019 15:56:56 +0800 +Subject: spi: bitbang: Fix NULL pointer dereference in spi_unregister_master + +[ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ] + +If spi_register_master fails in spi_bitbang_start +because device_add failure, We should return the +error code other than 0, otherwise calling +spi_bitbang_stop may trigger NULL pointer dereference +like this: + +BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0 +Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661 + +CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +Call Trace: + dump_stack+0xa9/0x10e + ? __list_del_entry_valid+0x45/0xd0 + ? __list_del_entry_valid+0x45/0xd0 + __kasan_report+0x171/0x18d + ? __list_del_entry_valid+0x45/0xd0 + kasan_report+0xe/0x20 + __list_del_entry_valid+0x45/0xd0 + spi_unregister_controller+0x99/0x1b0 + spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp] + ? 0xffffffffc1128000 + ? klist_next+0x131/0x1e0 + ? driver_detach+0x40/0x40 [parport] + port_check+0x3b/0x50 [parport] + bus_for_each_dev+0x115/0x180 + ? subsys_dev_iter_exit+0x20/0x20 + __parport_register_driver+0x1f0/0x210 [parport] + ? 0xffffffffc1150000 + do_one_initcall+0xb9/0x3b5 + ? perf_trace_initcall_level+0x270/0x270 + ? kasan_unpoison_shadow+0x30/0x40 + ? kasan_unpoison_shadow+0x30/0x40 + do_init_module+0xe0/0x330 + load_module+0x38eb/0x4270 + ? module_frob_arch_sections+0x20/0x20 + ? kernel_read_file+0x188/0x3f0 + ? find_held_lock+0x6d/0xd0 + ? fput_many+0x1a/0xe0 + ? __do_sys_finit_module+0x162/0x190 + __do_sys_finit_module+0x162/0x190 + ? __ia32_sys_init_module+0x40/0x40 + ? __mutex_unlock_slowpath+0xb4/0x3f0 + ? wait_for_completion+0x240/0x240 + ? vfs_write+0x160/0x2a0 + ? lockdep_hardirqs_off+0xb5/0x100 + ? mark_held_locks+0x1a/0x90 + ? do_syscall_64+0x14/0x2a0 + do_syscall_64+0x72/0x2a0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Reported-by: Hulk Robot +Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master") +Signed-off-by: YueHaibing +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Axel Lin +Reviewed-by: Mukesh Ojha +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index 3aa9e6e3dac8..4ef54436b9d4 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -392,7 +392,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) + if (ret) + spi_master_put(master); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(spi_bitbang_start); + +-- +2.20.1 + diff --git a/queue-4.4/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch b/queue-4.4/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch new file mode 100644 index 00000000000..c7cfc96368c --- /dev/null +++ b/queue-4.4/usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch @@ -0,0 +1,51 @@ +From e5781a657c2ec2a3bb6bec0551d93ee6525b52c5 Mon Sep 17 00:00:00 2001 +From: Young Xiao <92siuyang@gmail.com> +Date: Tue, 28 May 2019 20:17:54 +0800 +Subject: usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] + +[ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ] + +There is no deallocation of fusb300->ep[i] elements, allocated at +fusb300_probe. + +The patch adds deallocation of fusb300->ep array elements. + +Signed-off-by: Young Xiao <92siuyang@gmail.com> +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fusb300_udc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 948845c90e47..351012c498c5 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1345,12 +1345,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { + static int fusb300_remove(struct platform_device *pdev) + { + struct fusb300 *fusb300 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + + return 0; +@@ -1494,6 +1497,8 @@ clean_up: + if (fusb300->ep0_req) + fusb300_free_request(&fusb300->ep[0]->ep, + fusb300->ep0_req); ++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) ++ kfree(fusb300->ep[i]); + kfree(fusb300); + } + if (reg) +-- +2.20.1 + diff --git a/queue-4.4/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch b/queue-4.4/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch new file mode 100644 index 00000000000..56c357ab8f3 --- /dev/null +++ b/queue-4.4/usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch @@ -0,0 +1,39 @@ +From 9f24cca802fea37e6ee9aa9cd04f8ff628bbdeb5 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Wed, 22 May 2019 14:07:36 +0200 +Subject: usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC + +[ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ] + +Gadget drivers may queue request in interrupt context. This would lead to +a descriptor allocation in that context. In that case we would hit +BUG_ON(in_interrupt()) in __get_vm_area_node. + +Also remove the unnecessary cast. + +Acked-by: Sylvain Lemieux +Tested-by: James Grant +Signed-off-by: Alexandre Belloni +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c +index 00b5006baf15..90d24f62bd81 100644 +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -964,8 +964,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) + dma_addr_t dma; + struct lpc32xx_usbd_dd_gad *dd; + +- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( +- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); ++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); + if (dd) + dd->this_dma = dma; + +-- +2.20.1 +