From: Greg Kroah-Hartman Date: Sat, 2 Apr 2022 12:41:24 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.17.2~184 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d6a624d8d56f005902cf5f7bf4c1438edbfde9ee;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch drivers-hamradio-6pack-fix-uaf-bug-caused-by-mod_timer.patch thermal-int340x-increase-bitmap-size.patch video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch --- diff --git a/queue-4.14/arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch b/queue-4.14/arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch new file mode 100644 index 00000000000..2e425639af6 --- /dev/null +++ b/queue-4.14/arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch @@ -0,0 +1,36 @@ +From 0fb578a529ac7aca326a9fa475b4a6f58a756fda Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Tue, 11 Jan 2022 15:23:01 +0200 +Subject: ARM: dts: at91: sama5d2: Fix PMERRLOC resource size + +From: Tudor Ambarus + +commit 0fb578a529ac7aca326a9fa475b4a6f58a756fda upstream. + +PMERRLOC resource size was set to 0x100, which resulted in HSMC_ERRLOCx +register being truncated to offset x = 21, causing error correction to +fail if more than 22 bit errors and if 24 or 32 bit error correction +was supported. + +Fixes: d9c41bf30cf8 ("ARM: dts: at91: Declare EBI/NAND controllers") +Signed-off-by: Tudor Ambarus +Cc: # 4.13.x +Acked-by: Alexander Dahl +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220111132301.906712-1-tudor.ambarus@microchip.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/sama5d2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -1121,7 +1121,7 @@ + pmecc: ecc-engine@f8014070 { + compatible = "atmel,sama5d2-pmecc"; + reg = <0xf8014070 0x490>, +- <0xf8014500 0x100>; ++ <0xf8014500 0x200>; + }; + }; + diff --git a/queue-4.14/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch b/queue-4.14/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch new file mode 100644 index 00000000000..6aec581d18e --- /dev/null +++ b/queue-4.14/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch @@ -0,0 +1,34 @@ +From 60a9914cb2061ba612a3f14f6ad329912b486360 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 8 Feb 2022 18:18:14 +0100 +Subject: ARM: dts: exynos: add missing HDMI supplies on SMDK5250 + +From: Krzysztof Kozlowski + +commit 60a9914cb2061ba612a3f14f6ad329912b486360 upstream. + +Add required VDD supplies to HDMI block on SMDK5250. Without them, the +HDMI driver won't probe. Because of lack of schematics, use same +supplies as on Arndale 5250 board (voltage matches). + +Cc: # v3.15+ +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220208171823.226211-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -117,6 +117,9 @@ + + &hdmi { + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; ++ vdd-supply = <&ldo8_reg>; ++ vdd_osc-supply = <&ldo10_reg>; ++ vdd_pll-supply = <&ldo8_reg>; + }; + + &i2c_0 { diff --git a/queue-4.14/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch b/queue-4.14/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch new file mode 100644 index 00000000000..e4fa5ca8f11 --- /dev/null +++ b/queue-4.14/arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch @@ -0,0 +1,34 @@ +From 453a24ded415f7fce0499c6b0a2c7b28f84911f2 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 8 Feb 2022 18:18:15 +0100 +Subject: ARM: dts: exynos: add missing HDMI supplies on SMDK5420 + +From: Krzysztof Kozlowski + +commit 453a24ded415f7fce0499c6b0a2c7b28f84911f2 upstream. + +Add required VDD supplies to HDMI block on SMDK5420. Without them, the +HDMI driver won't probe. Because of lack of schematics, use same +supplies as on Arndale Octa and Odroid XU3 boards (voltage matches). + +Cc: # v3.15+ +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220208171823.226211-3-krzysztof.kozlowski@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/arm/boot/dts/exynos5420-smdk5420.dts ++++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts +@@ -133,6 +133,9 @@ + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_hpd_irq>; ++ vdd-supply = <&ldo6_reg>; ++ vdd_osc-supply = <&ldo7_reg>; ++ vdd_pll-supply = <&ldo6_reg>; + }; + + &hsi2c_4 { diff --git a/queue-4.14/arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch b/queue-4.14/arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch new file mode 100644 index 00000000000..36b3f3722c9 --- /dev/null +++ b/queue-4.14/arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch @@ -0,0 +1,34 @@ +From 372d7027fed43c8570018e124cf78b89523a1f8e Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 30 Dec 2021 20:53:23 +0100 +Subject: ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 + +From: Krzysztof Kozlowski + +commit 372d7027fed43c8570018e124cf78b89523a1f8e upstream. + +The gpa1-4 pin was put twice in UART3 pin configuration of Exynos5250, +instead of proper pin gpa1-5. + +Fixes: f8bfe2b050f3 ("ARM: dts: add pin state information in client nodes for Exynos5 platforms") +Cc: +Signed-off-by: Krzysztof Kozlowski +Tested-by: Marek Szyprowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20211230195325.328220-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +@@ -257,7 +257,7 @@ + }; + + uart3_data: uart3-data { +- samsung,pins = "gpa1-4", "gpa1-4"; ++ samsung,pins = "gpa1-4", "gpa1-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + samsung,pin-drv = ; diff --git a/queue-4.14/carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch b/queue-4.14/carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch new file mode 100644 index 00000000000..6cbbb74330c --- /dev/null +++ b/queue-4.14/carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch @@ -0,0 +1,39 @@ +From 02a95374b5eebdbd3b6413fd7ddec151d2ea75a1 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 25 Jan 2022 00:44:06 +0000 +Subject: carl9170: fix missing bit-wise or operator for tx_params + +From: Colin Ian King + +commit 02a95374b5eebdbd3b6413fd7ddec151d2ea75a1 upstream. + +Currently tx_params is being re-assigned with a new value and the +previous setting IEEE80211_HT_MCS_TX_RX_DIFF is being overwritten. +The assignment operator is incorrect, the original intent was to +bit-wise or the value in. Fix this by replacing the = operator +with |= instead. + +Kudos to Christian Lamparter for suggesting the correct fix. + +Fixes: fe8ee9ad80b2 ("carl9170: mac80211 glue and command interface") +Signed-off-by: Colin Ian King +Cc: +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220125004406.344422-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/carl9170/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/carl9170/main.c ++++ b/drivers/net/wireless/ath/carl9170/main.c +@@ -1922,7 +1922,7 @@ static int carl9170_parse_eeprom(struct + WARN_ON(!(tx_streams >= 1 && tx_streams <= + IEEE80211_HT_MCS_TX_MAX_STREAMS)); + +- tx_params = (tx_streams - 1) << ++ tx_params |= (tx_streams - 1) << + IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; + + carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params; diff --git a/queue-4.14/drivers-hamradio-6pack-fix-uaf-bug-caused-by-mod_timer.patch b/queue-4.14/drivers-hamradio-6pack-fix-uaf-bug-caused-by-mod_timer.patch new file mode 100644 index 00000000000..9a9b5045e50 --- /dev/null +++ b/queue-4.14/drivers-hamradio-6pack-fix-uaf-bug-caused-by-mod_timer.patch @@ -0,0 +1,87 @@ +From efe4186e6a1b54bf38b9e05450d43b0da1fd7739 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Thu, 17 Feb 2022 09:43:03 +0800 +Subject: drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() + +From: Duoming Zhou + +commit efe4186e6a1b54bf38b9e05450d43b0da1fd7739 upstream. + +When a 6pack device is detaching, the sixpack_close() will act to cleanup +necessary resources. Although del_timer_sync() in sixpack_close() +won't return if there is an active timer, one could use mod_timer() in +sp_xmit_on_air() to wake up timer again by calling userspace syscall such +as ax25_sendmsg(), ax25_connect() and ax25_ioctl(). + +This unexpected waked handler, sp_xmit_on_air(), realizes nothing about +the undergoing cleanup and may still call pty_write() to use driver layer +resources that have already been released. + +One of the possible race conditions is shown below: + + (USE) | (FREE) +ax25_sendmsg() | + ax25_queue_xmit() | + ... | + sp_xmit() | + sp_encaps() | sixpack_close() + sp_xmit_on_air() | del_timer_sync(&sp->tx_t) + mod_timer(&sp->tx_t,...) | ... + | unregister_netdev() + | ... + (wait a while) | tty_release() + | tty_release_struct() + | release_tty() + sp_xmit_on_air() | tty_kref_put(tty_struct) //FREE + pty_write(tty_struct) //USE | ... + +The corresponding fail log is shown below: +=============================================================== +BUG: KASAN: use-after-free in __run_timers.part.0+0x170/0x470 +Write of size 8 at addr ffff88800a652ab8 by task swapper/2/0 +... +Call Trace: + ... + queue_work_on+0x3f/0x50 + pty_write+0xcd/0xe0pty_write+0xcd/0xe0 + sp_xmit_on_air+0xb2/0x1f0 + call_timer_fn+0x28/0x150 + __run_timers.part.0+0x3c2/0x470 + run_timer_softirq+0x3b/0x80 + __do_softirq+0xf1/0x380 + ... + +This patch reorders the del_timer_sync() after the unregister_netdev() +to avoid UAF bugs. Because the unregister_netdev() is well synchronized, +it flushs out any pending queues, waits the refcount of net_device +decreases to zero and removes net_device from kernel. There is not any +running routines after executing unregister_netdev(). Therefore, we could +not arouse timer from userspace again. + +Signed-off-by: Duoming Zhou +Reviewed-by: Lin Ma +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hamradio/6pack.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -685,14 +685,14 @@ static void sixpack_close(struct tty_str + */ + netif_stop_queue(sp->dev); + ++ unregister_netdev(sp->dev); ++ + del_timer_sync(&sp->tx_t); + del_timer_sync(&sp->resync_t); + + /* Free all 6pack frame buffers. */ + kfree(sp->rbuff); + kfree(sp->xbuff); +- +- unregister_netdev(sp->dev); + } + + /* Perform I/O control on an active 6pack channel. */ diff --git a/queue-4.14/series b/queue-4.14/series index 89b179310c5..ad9563e4ace 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -36,3 +36,12 @@ revert-input-clear-btn_right-middle-on-buttonpads.patch alsa-cs4236-fix-an-incorrect-null-check-on-list-iterator.patch drbd-fix-potential-silent-data-corruption.patch acpi-properties-consistently-return-enoent-if-there-are-no-more-references.patch +drivers-hamradio-6pack-fix-uaf-bug-caused-by-mod_timer.patch +video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch +video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch +arm-dts-at91-sama5d2-fix-pmerrloc-resource-size.patch +arm-dts-exynos-fix-uart3-pins-configuration-in-exynos5250.patch +arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5250.patch +arm-dts-exynos-add-missing-hdmi-supplies-on-smdk5420.patch +carl9170-fix-missing-bit-wise-or-operator-for-tx_params.patch +thermal-int340x-increase-bitmap-size.patch diff --git a/queue-4.14/thermal-int340x-increase-bitmap-size.patch b/queue-4.14/thermal-int340x-increase-bitmap-size.patch new file mode 100644 index 00000000000..551024a6f9c --- /dev/null +++ b/queue-4.14/thermal-int340x-increase-bitmap-size.patch @@ -0,0 +1,35 @@ +From 668f69a5f863b877bc3ae129efe9a80b6f055141 Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Mon, 14 Mar 2022 15:08:55 -0700 +Subject: thermal: int340x: Increase bitmap size + +From: Srinivas Pandruvada + +commit 668f69a5f863b877bc3ae129efe9a80b6f055141 upstream. + +The number of policies are 10, so can't be supported by the bitmap size +of u8. + +Even though there are no platfoms with these many policies, but +for correctness increase to u32. + +Signed-off-by: Srinivas Pandruvada +Fixes: 16fc8eca1975 ("thermal/int340x_thermal: Add additional UUIDs") +Cc: 5.1+ # 5.1+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/int340x_thermal/int3400_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thermal/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c +@@ -53,7 +53,7 @@ struct int3400_thermal_priv { + struct art *arts; + int trt_count; + struct trt *trts; +- u8 uuid_bitmap; ++ u32 uuid_bitmap; + int rel_misc_dev_res; + int current_uuid_index; + }; diff --git a/queue-4.14/video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch b/queue-4.14/video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch new file mode 100644 index 00000000000..4cc700734a2 --- /dev/null +++ b/queue-4.14/video-fbdev-atari-atari-2-bpp-ste-palette-bugfix.patch @@ -0,0 +1,62 @@ +From c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 Mon Sep 17 00:00:00 2001 +From: Michael Schmitz +Date: Wed, 16 Feb 2022 20:26:25 +1300 +Subject: video: fbdev: atari: Atari 2 bpp (STe) palette bugfix + +From: Michael Schmitz + +commit c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 upstream. + +The code to set the shifter STe palette registers has a long +standing operator precedence bug, manifesting as colors set +on a 2 bits per pixel frame buffer coming up with a distinctive +blue tint. + +Add parentheses around the calculation of the per-color palette +data before shifting those into their respective bit field position. + +This bug goes back a long way (2.4 days at the very least) so there +won't be a Fixes: tag. + +Tested on ARAnyM as well on Falcon030 hardware. + +Cc: stable@vger.kernel.org +Reported-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/CAMuHMdU3ievhXxKR_xi_v3aumnYW7UNUO6qMdhgfyWTyVSsCkQ@mail.gmail.com +Tested-by: Michael Schmitz +Tested-by: Geert Uytterhoeven +Signed-off-by: Michael Schmitz +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/atafb.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/video/fbdev/atafb.c ++++ b/drivers/video/fbdev/atafb.c +@@ -1713,9 +1713,9 @@ static int falcon_setcolreg(unsigned int + ((blue & 0xfc00) >> 8)); + if (regno < 16) { + shifter_tt.color_reg[regno] = +- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | +- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | +- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | ++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | ++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11)); +@@ -2001,9 +2001,9 @@ static int stste_setcolreg(unsigned int + green >>= 12; + if (ATARIHW_PRESENT(EXTD_SHIFTER)) + shifter_tt.color_reg[regno] = +- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | +- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | +- ((blue & 0xe) >> 1) | ((blue & 1) << 3); ++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | ++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | ++ ((blue & 0xe) >> 1) | ((blue & 1) << 3); + else + shifter_tt.color_reg[regno] = + ((red & 0xe) << 7) | diff --git a/queue-4.14/video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch b/queue-4.14/video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch new file mode 100644 index 00000000000..18f7e526ad6 --- /dev/null +++ b/queue-4.14/video-fbdev-sm712fb-fix-crash-in-smtcfb_read.patch @@ -0,0 +1,76 @@ +From bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 27 Feb 2022 08:43:56 +0100 +Subject: video: fbdev: sm712fb: Fix crash in smtcfb_read() + +From: Helge Deller + +commit bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 upstream. + +Zheyu Ma reported this crash in the sm712fb driver when reading +three bytes from the framebuffer: + + BUG: unable to handle page fault for address: ffffc90001ffffff + RIP: 0010:smtcfb_read+0x230/0x3e0 + Call Trace: + vfs_read+0x198/0xa00 + ? do_sys_openat2+0x27d/0x350 + ? __fget_light+0x54/0x340 + ksys_read+0xce/0x190 + do_syscall_64+0x43/0x90 + +Fix it by removing the open-coded endianess fixup-code and +by moving the pointer post decrement out the fb_readl() function. + +Reported-by: Zheyu Ma +Signed-off-by: Helge Deller +Tested-by: Zheyu Ma +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/sm712fb.c | 25 +++++++------------------ + 1 file changed, 7 insertions(+), 18 deletions(-) + +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_inf + if (count + p > total_size) + count = total_size - p; + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_inf + while (count) { + c = (count > PAGE_SIZE) ? PAGE_SIZE : count; + dst = buffer; +- for (i = c >> 2; i--;) { +- *dst = fb_readl(src++); +- *dst = big_swap(*dst); ++ for (i = (c + 3) >> 2; i--;) { ++ u32 val; ++ ++ val = fb_readl(src); ++ *dst = big_swap(val); ++ src++; + dst++; + } +- if (c & 3) { +- u8 *dst8 = (u8 *)dst; +- u8 __iomem *src8 = (u8 __iomem *)src; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- *dst8++ = fb_readb(++src8); +- } else { +- *dst8++ = fb_readb(--src8); +- src8 += 2; +- } +- } +- src = (u32 __iomem *)src8; +- } + + if (copy_to_user(buf, buffer, c)) { + err = -EFAULT;