From: Greg Kroah-Hartman Date: Mon, 20 Dec 2021 11:42:06 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.4.296~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d2852735084e052c3a0884591d54f04f13b45ed9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch media-mxl111sf-change-mutex_init-location.patch --- diff --git a/queue-4.19/arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch b/queue-4.19/arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch new file mode 100644 index 00000000000..3fe1ae0d22b --- /dev/null +++ b/queue-4.19/arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch @@ -0,0 +1,37 @@ +From 737e65c7956795b3553781fb7bc82fce1c39503f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 24 Nov 2021 15:45:41 -0300 +Subject: ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name + +From: Fabio Estevam + +commit 737e65c7956795b3553781fb7bc82fce1c39503f upstream. + +According to the i.MX6ULL Reference Manual, pad CSI_DATA07 may +have the ESAI_TX0 functionality, not ESAI_T0. + +Also, NXP's i.MX Config Tools 10.0 generates dtsi with the +MX6ULL_PAD_CSI_DATA07__ESAI_TX0 naming, so fix it accordingly. + +There are no devicetree users in mainline that use the old name, +so just remove the old entry. + +Fixes: c201369d4aa5 ("ARM: dts: imx6ull: add imx6ull support") +Reported-by: George Makarov +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx6ull-pinfunc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6ull-pinfunc.h ++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h +@@ -68,6 +68,6 @@ + #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA06__ESAI_TX5_RX0 0x01FC 0x0488 0x0000 0x9 0x0 +-#define MX6ULL_PAD_CSI_DATA07__ESAI_T0 0x0200 0x048C 0x0000 0x9 0x0 ++#define MX6ULL_PAD_CSI_DATA07__ESAI_TX0 0x0200 0x048C 0x0000 0x9 0x0 + + #endif /* __DTS_IMX6ULL_PINFUNC_H */ diff --git a/queue-4.19/media-mxl111sf-change-mutex_init-location.patch b/queue-4.19/media-mxl111sf-change-mutex_init-location.patch new file mode 100644 index 00000000000..b8c413f8326 --- /dev/null +++ b/queue-4.19/media-mxl111sf-change-mutex_init-location.patch @@ -0,0 +1,112 @@ +From 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Thu, 19 Aug 2021 12:42:21 +0200 +Subject: media: mxl111sf: change mutex_init() location + +From: Pavel Skripkin + +commit 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f upstream. + +Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized +mutex. The problem was in wrong mutex_init() location. + +Previous mutex_init(&state->msg_lock) call was in ->init() function, but +dvb_usbv2_init() has this order of calls: + + dvb_usbv2_init() + dvb_usbv2_adapter_init() + dvb_usbv2_adapter_frontend_init() + props->frontend_attach() + + props->init() + +Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() +internally we need to initialize state->msg_lock before +frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* +devices, which will simply initiaize mutex. + +Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com + +Fixes: 8572211842af ("[media] mxl111sf: convert to new DVB USB") +Signed-off-by: Pavel Skripkin +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/dvb-usb-v2/mxl111sf.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c ++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c +@@ -932,8 +932,6 @@ static int mxl111sf_init(struct dvb_usb_ + .len = sizeof(eeprom), .buf = eeprom }, + }; + +- mutex_init(&state->msg_lock); +- + ret = get_chip_info(state); + if (mxl_fail(ret)) + pr_err("failed to get chip info during probe"); +@@ -1075,6 +1073,14 @@ static int mxl111sf_get_stream_config_dv + return 0; + } + ++static int mxl111sf_probe(struct dvb_usb_device *dev) ++{ ++ struct mxl111sf_state *state = d_to_priv(dev); ++ ++ mutex_init(&state->msg_lock); ++ return 0; ++} ++ + static struct dvb_usb_device_properties mxl111sf_props_dvbt = { + .driver_name = KBUILD_MODNAME, + .owner = THIS_MODULE, +@@ -1084,6 +1090,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_dvbt, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1125,6 +1132,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_atsc, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1166,6 +1174,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mh, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1234,6 +1243,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_atsc_mh, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1312,6 +1322,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mercury, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1382,6 +1393,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mercury_mh, + .tuner_attach = mxl111sf_attach_tuner, diff --git a/queue-4.19/series b/queue-4.19/series index 4c1d20bdcdc..64fc5f0d2b6 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -44,3 +44,5 @@ mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch arm-8800-1-use-choice-for-kernel-unwinders.patch input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch firmware-arm_scpi-fix-string-overflow-in-scpi-genpd-driver.patch +arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch +media-mxl111sf-change-mutex_init-location.patch