From: Greg Kroah-Hartman Date: Sun, 6 Nov 2016 11:56:42 +0000 (+0100) Subject: 4.8-stable patches X-Git-Tag: v4.4.31~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e2ced3786423bc143463ff633377a01253dc2fb1;p=thirdparty%2Fkernel%2Fstable-queue.git 4.8-stable patches added patches: drm-dp-mst-clear-port-pdt-when-tearing-down-the-i2c-adapter.patch i2c-core-fix-null-pointer-dereference-under-race-condition.patch i2c-imx-defer-probe-if-bus-recovery-gpios-are-not-ready.patch i2c-rk3x-give-the-tuning-value-0-during-rk3x_i2c_v0_calc_timings.patch i2c-xgene-avoid-dma_buffer-overrun.patch --- diff --git a/queue-4.8/drm-dp-mst-clear-port-pdt-when-tearing-down-the-i2c-adapter.patch b/queue-4.8/drm-dp-mst-clear-port-pdt-when-tearing-down-the-i2c-adapter.patch new file mode 100644 index 00000000000..35080020e9e --- /dev/null +++ b/queue-4.8/drm-dp-mst-clear-port-pdt-when-tearing-down-the-i2c-adapter.patch @@ -0,0 +1,65 @@ +From 36e3fa6a38e135e9478a2f75dec9bf6ff1e6480e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 26 Oct 2016 16:30:33 +0300 +Subject: drm/dp/mst: Clear port->pdt when tearing down the i2c adapter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 36e3fa6a38e135e9478a2f75dec9bf6ff1e6480e upstream. + +The i2c adapter is only relevant for some peer device types, so +let's clear the pdt if it's still the same as the old_pdt when we +tear down the i2c adapter. + +I don't really like this design pattern of updating port->whatever +before doing the accompanying changes and passing around old_whatever +to figure stuff out. Would make much more sense to me to the pass the +new value around and only update the port->whatever when things are +consistent. But let's try to work with what we have right now. + +Quoting a follow-up from Ville: + +"And naturally I forgot to amend the commit message w.r.t. this guy +[the change in drm_dp_destroy_port]. We don't really need to do this +here, but I figured I'd try to be a bit more consistent by having it, +just to avoid accidental mistakes if/when someone changes this stuff +again later." + +v2: Clear port->pdt in the caller, if needed (Daniel) + +Cc: Daniel Vetter +Cc: Carlos Santa +Cc: Kirill A. Shutemov +Tested-by: Carlos Santa (v1) +Tested-by: Kirill A. Shutemov (v1) +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97666 +Signed-off-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/1477488633-16544-1-git-send-email-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -914,6 +914,7 @@ static void drm_dp_destroy_port(struct k + /* no need to clean up vcpi + * as if we have no connector we never setup a vcpi */ + drm_dp_port_teardown_pdt(port, port->pdt); ++ port->pdt = DP_PEER_DEVICE_NONE; + } + kfree(port); + } +@@ -2919,6 +2920,7 @@ static void drm_dp_destroy_connector_wor + mgr->cbs->destroy_connector(mgr, port->connector); + + drm_dp_port_teardown_pdt(port, port->pdt); ++ port->pdt = DP_PEER_DEVICE_NONE; + + if (!port->input && port->vcpi.vcpi > 0) { + drm_dp_mst_reset_vcpi_slots(mgr, port); diff --git a/queue-4.8/i2c-core-fix-null-pointer-dereference-under-race-condition.patch b/queue-4.8/i2c-core-fix-null-pointer-dereference-under-race-condition.patch new file mode 100644 index 00000000000..8ac1494a680 --- /dev/null +++ b/queue-4.8/i2c-core-fix-null-pointer-dereference-under-race-condition.patch @@ -0,0 +1,92 @@ +From 147b36d5b70c083cc76770c47d60b347e8eaf231 Mon Sep 17 00:00:00 2001 +From: Vladimir Zapolskiy +Date: Mon, 31 Oct 2016 21:46:24 +0200 +Subject: i2c: core: fix NULL pointer dereference under race condition + +From: Vladimir Zapolskiy + +commit 147b36d5b70c083cc76770c47d60b347e8eaf231 upstream. + +Race condition between registering an I2C device driver and +deregistering an I2C adapter device which is assumed to manage that +I2C device may lead to a NULL pointer dereference due to the +uninitialized list head of driver clients. + +The root cause of the issue is that the I2C bus may know about the +registered device driver and thus it is matched by bus_for_each_drv(), +but the list of clients is not initialized and commonly it is NULL, +because I2C device drivers define struct i2c_driver as static and +clients field is expected to be initialized by I2C core: + + i2c_register_driver() i2c_del_adapter() + driver_register() ... + bus_add_driver() ... + ... bus_for_each_drv(..., __process_removed_adapter) + ... i2c_do_del_adapter() + ... list_for_each_entry_safe(..., &driver->clients, ...) + INIT_LIST_HEAD(&driver->clients); + +To solve the problem it is sufficient to do clients list head +initialization before calling driver_register(). + +The problem was found while using an I2C device driver with a sluggish +registration routine on a bus provided by a physically detachable I2C +master controller, but practically the oops may be reproduced under +the race between arbitraty I2C device driver registration and managing +I2C bus device removal e.g. by unbinding the latter over sysfs: + +% echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind + Unable to handle kernel NULL pointer dereference at virtual address 00000000 + Internal error: Oops: 17 [#1] SMP ARM + CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61 + Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) + task: e5ada400 task.stack: e4936000 + PC is at i2c_do_del_adapter+0x20/0xcc + LR is at __process_removed_adapter+0x14/0x1c + Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none + Control: 10c5387d Table: 35bd004a DAC: 00000051 + Process sh (pid: 533, stack limit = 0xe4936210) + Stack: (0xe4937d28 to 0xe4938000) + Backtrace: + [] (i2c_do_del_adapter) from [] (__process_removed_adapter+0x14/0x1c) + [] (__process_removed_adapter) from [] (bus_for_each_drv+0x6c/0xa0) + [] (bus_for_each_drv) from [] (i2c_del_adapter+0xbc/0x284) + [] (i2c_del_adapter) from [] (i2c_imx_remove+0x44/0x164 [i2c_imx]) + [] (i2c_imx_remove [i2c_imx]) from [] (platform_drv_remove+0x2c/0x44) + [] (platform_drv_remove) from [] (__device_release_driver+0x90/0x12c) + [] (__device_release_driver) from [] (device_release_driver+0x28/0x34) + [] (device_release_driver) from [] (unbind_store+0x80/0x104) + [] (unbind_store) from [] (drv_attr_store+0x28/0x34) + [] (drv_attr_store) from [] (sysfs_kf_write+0x50/0x54) + [] (sysfs_kf_write) from [] (kernfs_fop_write+0x100/0x214) + [] (kernfs_fop_write) from [] (__vfs_write+0x34/0x120) + [] (__vfs_write) from [] (vfs_write+0xa8/0x170) + [] (vfs_write) from [] (SyS_write+0x4c/0xa8) + [] (SyS_write) from [] (ret_fast_syscall+0x0/0x1c) + +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -2073,6 +2073,7 @@ int i2c_register_driver(struct module *o + /* add the driver to the list of i2c drivers in the driver core */ + driver->driver.owner = owner; + driver->driver.bus = &i2c_bus_type; ++ INIT_LIST_HEAD(&driver->clients); + + /* When registration returns, the driver core + * will have called probe() for all matching-but-unbound devices. +@@ -2083,7 +2084,6 @@ int i2c_register_driver(struct module *o + + pr_debug("driver [%s] registered\n", driver->driver.name); + +- INIT_LIST_HEAD(&driver->clients); + /* Walk the adapters that are already present */ + i2c_for_each_dev(driver, __process_new_driver); + diff --git a/queue-4.8/i2c-imx-defer-probe-if-bus-recovery-gpios-are-not-ready.patch b/queue-4.8/i2c-imx-defer-probe-if-bus-recovery-gpios-are-not-ready.patch new file mode 100644 index 00000000000..189e269dec4 --- /dev/null +++ b/queue-4.8/i2c-imx-defer-probe-if-bus-recovery-gpios-are-not-ready.patch @@ -0,0 +1,48 @@ +From 533169d164c6b4c8571d0d48779f6ff6be593d72 Mon Sep 17 00:00:00 2001 +From: Stefan Agner +Date: Mon, 26 Sep 2016 17:18:58 -0700 +Subject: i2c: imx: defer probe if bus recovery GPIOs are not ready +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Agner + +commit 533169d164c6b4c8571d0d48779f6ff6be593d72 upstream. + +Some SoC might load the GPIO driver after the I2C driver and +using the I2C bus recovery mechanism via GPIOs. In this case +it is crucial to defer probing if the GPIO request functions +do so, otherwise the I2C driver gets loaded without recovery +mechanisms enabled. + +Signed-off-by: Stefan Agner +Acked-by: Uwe Kleine-König +Acked-by: Li Yang +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-imx.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -996,10 +996,13 @@ static void i2c_imx_init_recovery_info(s + rinfo->sda_gpio = of_get_named_gpio(pdev->dev.of_node, "sda-gpios", 0); + rinfo->scl_gpio = of_get_named_gpio(pdev->dev.of_node, "scl-gpios", 0); + +- if (!gpio_is_valid(rinfo->sda_gpio) || +- !gpio_is_valid(rinfo->scl_gpio) || +- IS_ERR(i2c_imx->pinctrl_pins_default) || +- IS_ERR(i2c_imx->pinctrl_pins_gpio)) { ++ if (rinfo->sda_gpio == -EPROBE_DEFER || ++ rinfo->scl_gpio == -EPROBE_DEFER) { ++ return -EPROBE_DEFER; ++ } else if (!gpio_is_valid(rinfo->sda_gpio) || ++ !gpio_is_valid(rinfo->scl_gpio) || ++ IS_ERR(i2c_imx->pinctrl_pins_default) || ++ IS_ERR(i2c_imx->pinctrl_pins_gpio)) { + dev_dbg(&pdev->dev, "recovery information incomplete\n"); + return; + } diff --git a/queue-4.8/i2c-rk3x-give-the-tuning-value-0-during-rk3x_i2c_v0_calc_timings.patch b/queue-4.8/i2c-rk3x-give-the-tuning-value-0-during-rk3x_i2c_v0_calc_timings.patch new file mode 100644 index 00000000000..07bc983917d --- /dev/null +++ b/queue-4.8/i2c-rk3x-give-the-tuning-value-0-during-rk3x_i2c_v0_calc_timings.patch @@ -0,0 +1,36 @@ +From 399c168ab5ab5e12ed55b6c91d61c24eb84c9164 Mon Sep 17 00:00:00 2001 +From: David Wu +Date: Sat, 22 Oct 2016 16:43:42 +0800 +Subject: i2c: rk3x: Give the tuning value 0 during rk3x_i2c_v0_calc_timings + +From: David Wu + +commit 399c168ab5ab5e12ed55b6c91d61c24eb84c9164 upstream. + +We found a bug that i2c transfer sometimes failed on 3066a board with +stabel-4.8, the con register would be updated by uninitialized tuning +value, it made the i2c transfer failed. + +So give the tuning value to be zero during rk3x_i2c_v0_calc_timings. + +Signed-off-by: David Wu +Tested-by: Andy Yan +Reviewed-by: Douglas Anderson +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-rk3x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -694,6 +694,8 @@ static int rk3x_i2c_v0_calc_timings(unsi + t_calc->div_low--; + t_calc->div_high--; + ++ /* Give the tuning value 0, that would not update con register */ ++ t_calc->tuning = 0; + /* Maximum divider supported by hw is 0xffff */ + if (t_calc->div_low > 0xffff) { + t_calc->div_low = 0xffff; diff --git a/queue-4.8/i2c-xgene-avoid-dma_buffer-overrun.patch b/queue-4.8/i2c-xgene-avoid-dma_buffer-overrun.patch new file mode 100644 index 00000000000..a22248db687 --- /dev/null +++ b/queue-4.8/i2c-xgene-avoid-dma_buffer-overrun.patch @@ -0,0 +1,32 @@ +From 603616017c35f4d0fbdbcace72adf9bf949c4a65 Mon Sep 17 00:00:00 2001 +From: Hoan Tran +Date: Mon, 10 Oct 2016 10:13:10 -0700 +Subject: i2c: xgene: Avoid dma_buffer overrun + +From: Hoan Tran + +commit 603616017c35f4d0fbdbcace72adf9bf949c4a65 upstream. + +SMBus block command uses the first byte of buffer for the data length. +The dma_buffer should be increased by 1 to avoid the overrun issue. + +Reported-by: Phil Endecott +Signed-off-by: Hoan Tran +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-xgene-slimpro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-xgene-slimpro.c ++++ b/drivers/i2c/busses/i2c-xgene-slimpro.c +@@ -105,7 +105,7 @@ struct slimpro_i2c_dev { + struct mbox_chan *mbox_chan; + struct mbox_client mbox_client; + struct completion rd_complete; +- u8 dma_buffer[I2C_SMBUS_BLOCK_MAX]; ++ u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */ + u32 *resp_msg; + }; +