From: Sasha Levin Date: Mon, 23 Mar 2020 17:11:50 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v4.19.113~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e5af3f3c8a888e2c38d008e09779e87806cb331f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/iio-adc-at91-sama5d2_adc-fix-channel-configuration-f.patch b/queue-4.14/iio-adc-at91-sama5d2_adc-fix-channel-configuration-f.patch new file mode 100644 index 00000000000..a4b4b06ccc5 --- /dev/null +++ b/queue-4.14/iio-adc-at91-sama5d2_adc-fix-channel-configuration-f.patch @@ -0,0 +1,87 @@ +From 535a836fe325c7d6648f02e9cf45a8887cdaeac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Apr 2018 11:57:47 +0300 +Subject: iio: adc: at91-sama5d2_adc: fix channel configuration for + differential channels + +From: Eugen Hristev + +[ Upstream commit f0c8d1f6dc8eac5a1fbf441c8e080721a7b6c0ff ] + +When iterating through the channels, the index in the array is not the +scan index. Added an xlate function to translate to the proper index. +The result of the bug is that the channel array is indexed with a wrong index, +thus instead of the proper channel, we access invalid memory, which may +lead to invalid results and/or corruption. +This will be used also for devicetree channel xlate. + +Fixes: 5e1a1da0f ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Fixes: 073c66201 ("iio: adc: at91-sama5d2_adc: add support for DMA") +Signed-off-by: Eugen Hristev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/at91-sama5d2_adc.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c +index a70ef7fec95f0..0898f40c2b892 100644 +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -300,6 +300,27 @@ static const struct iio_chan_spec at91_adc_channels[] = { + + AT91_SAMA5D2_DIFF_CHAN_CNT + 1), + }; + ++static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan) ++{ ++ int i; ++ ++ for (i = 0; i < indio_dev->num_channels; i++) { ++ if (indio_dev->channels[i].scan_index == chan) ++ return i; ++ } ++ return -EINVAL; ++} ++ ++static inline struct iio_chan_spec const * ++at91_adc_chan_get(struct iio_dev *indio_dev, int chan) ++{ ++ int index = at91_adc_chan_xlate(indio_dev, chan); ++ ++ if (index < 0) ++ return NULL; ++ return indio_dev->channels + index; ++} ++ + static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + { + struct iio_dev *indio = iio_trigger_get_drvdata(trig); +@@ -317,8 +338,10 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + at91_adc_writel(st, AT91_SAMA5D2_TRGR, status); + + for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { +- struct iio_chan_spec const *chan = indio->channels + bit; ++ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit); + ++ if (!chan) ++ continue; + if (state) { + at91_adc_writel(st, AT91_SAMA5D2_CHER, + BIT(chan->channel)); +@@ -398,8 +421,11 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p) + u8 bit; + + for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { +- struct iio_chan_spec const *chan = indio->channels + bit; ++ struct iio_chan_spec const *chan = ++ at91_adc_chan_get(indio, bit); + ++ if (!chan) ++ continue; + st->buffer[i] = at91_adc_readl(st, chan->address); + i++; + } +-- +2.20.1 + diff --git a/queue-4.14/iio-adc-at91-sama5d2_adc-fix-differential-channels-i.patch b/queue-4.14/iio-adc-at91-sama5d2_adc-fix-differential-channels-i.patch new file mode 100644 index 00000000000..505011d02a2 --- /dev/null +++ b/queue-4.14/iio-adc-at91-sama5d2_adc-fix-differential-channels-i.patch @@ -0,0 +1,55 @@ +From 0122fb1846bd7bb205cf4425664f95ad4a1ca7bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2020 12:57:39 +0000 +Subject: iio: adc: at91-sama5d2_adc: fix differential channels in triggered + mode + +From: Eugen Hristev + +[ Upstream commit a500f3bd787f8224341e44b238f318c407b10897 ] + +The differential channels require writing the channel offset register (COR). +Otherwise they do not work in differential mode. +The configuration of COR is missing in triggered mode. + +Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Signed-off-by: Eugen Hristev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/at91-sama5d2_adc.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c +index 0898f40c2b892..34639ee2d2ce6 100644 +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -339,9 +339,24 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + + for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) { + struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit); ++ u32 cor; + + if (!chan) + continue; ++ if (state) { ++ cor = at91_adc_readl(st, AT91_SAMA5D2_COR); ++ ++ if (chan->differential) ++ cor |= (BIT(chan->channel) | ++ BIT(chan->channel2)) << ++ AT91_SAMA5D2_COR_DIFF_OFFSET; ++ else ++ cor &= ~(BIT(chan->channel) << ++ AT91_SAMA5D2_COR_DIFF_OFFSET); ++ ++ at91_adc_writel(st, AT91_SAMA5D2_COR, cor); ++ } ++ + if (state) { + at91_adc_writel(st, AT91_SAMA5D2_CHER, + BIT(chan->channel)); +-- +2.20.1 + diff --git a/queue-4.14/kbuild-disable-wpointer-to-enum-cast.patch b/queue-4.14/kbuild-disable-wpointer-to-enum-cast.patch new file mode 100644 index 00000000000..ca426882a48 --- /dev/null +++ b/queue-4.14/kbuild-disable-wpointer-to-enum-cast.patch @@ -0,0 +1,48 @@ +From 0627691d8a1c7110a9757a4864c3d4d8abc4f041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Mar 2020 12:41:21 -0700 +Subject: kbuild: Disable -Wpointer-to-enum-cast + +From: Nathan Chancellor + +commit 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f upstream. + +Clang's -Wpointer-to-int-cast deviates from GCC in that it warns when +casting to enums. The kernel does this in certain places, such as device +tree matches to set the version of the device being used, which allows +the kernel to avoid using a gigantic union. + +https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L428 +https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L402 +https://elixir.bootlin.com/linux/v5.5.8/source/include/linux/mod_devicetable.h#L264 + +To avoid a ton of false positive warnings, disable this particular part +of the warning, which has been split off into a separate diagnostic so +that the entire warning does not need to be turned off for clang. It +will be visible under W=1 in case people want to go about fixing these +easily and enabling the warning treewide. + +Cc: stable@vger.kernel.org +Link: https://github.com/ClangBuiltLinux/linux/issues/887 +Link: https://github.com/llvm/llvm-project/commit/2a41b31fcdfcb67ab7038fc2ffb606fd50b83a84 +Signed-off-by: Nathan Chancellor +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/Makefile.extrawarn | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index 8d5357053f865..486e135d3e30a 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -72,5 +72,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format) + KBUILD_CFLAGS += $(call cc-disable-warning, sign-compare) + KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length) + KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized) ++KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) + endif + endif +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 75cd0384470..7378958d1c2 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -37,3 +37,8 @@ mm-slub-be-more-careful-about-the-double-cmpxchg-of-freelist.patch mm-slub-prevent-kmalloc_node-crashes-and-memory-leaks.patch page-flags-fix-a-crash-at-setpageerror-thp_swap.patch x86-mm-split-vmalloc_sync_all.patch +usb-cdc-acm-fix-close_delay-and-closing_wait-units-i.patch +usb-cdc-acm-fix-rounding-error-in-tiocsserial.patch +iio-adc-at91-sama5d2_adc-fix-channel-configuration-f.patch +iio-adc-at91-sama5d2_adc-fix-differential-channels-i.patch +kbuild-disable-wpointer-to-enum-cast.patch diff --git a/queue-4.14/usb-cdc-acm-fix-close_delay-and-closing_wait-units-i.patch b/queue-4.14/usb-cdc-acm-fix-close_delay-and-closing_wait-units-i.patch new file mode 100644 index 00000000000..1c275eb3656 --- /dev/null +++ b/queue-4.14/usb-cdc-acm-fix-close_delay-and-closing_wait-units-i.patch @@ -0,0 +1,55 @@ +From 66de0c615e1b5aa3ccc89699fbce4745313b866a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 14:31:00 +0100 +Subject: USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL + +From: Anthony Mallet + +[ Upstream commit 633e2b2ded739a34bd0fb1d8b5b871f7e489ea29 ] + +close_delay and closing_wait are specified in hundredth of a second but stored +internally in jiffies. Use the jiffies_to_msecs() and msecs_to_jiffies() +functions to convert from each other. + +Signed-off-by: Anthony Mallet +Cc: stable +Link: https://lore.kernel.org/r/20200312133101.7096-1-anthony.mallet@laas.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 0453f0eb11781..74d0a91e84273 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -926,10 +926,10 @@ static int get_serial_info(struct acm *acm, struct serial_struct __user *info) + memset(&tmp, 0, sizeof(tmp)); + tmp.xmit_fifo_size = acm->writesize; + tmp.baud_base = le32_to_cpu(acm->line.dwDTERate); +- tmp.close_delay = acm->port.close_delay / 10; ++ tmp.close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; + tmp.closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? + ASYNC_CLOSING_WAIT_NONE : +- acm->port.closing_wait / 10; ++ jiffies_to_msecs(acm->port.closing_wait) / 10; + + if (copy_to_user(info, &tmp, sizeof(tmp))) + return -EFAULT; +@@ -947,9 +947,10 @@ static int set_serial_info(struct acm *acm, + if (copy_from_user(&new_serial, newinfo, sizeof(new_serial))) + return -EFAULT; + +- close_delay = new_serial.close_delay * 10; ++ close_delay = msecs_to_jiffies(new_serial.close_delay * 10); + closing_wait = new_serial.closing_wait == ASYNC_CLOSING_WAIT_NONE ? +- ASYNC_CLOSING_WAIT_NONE : new_serial.closing_wait * 10; ++ ASYNC_CLOSING_WAIT_NONE : ++ msecs_to_jiffies(new_serial.closing_wait * 10); + + mutex_lock(&acm->port.mutex); + +-- +2.20.1 + diff --git a/queue-4.14/usb-cdc-acm-fix-rounding-error-in-tiocsserial.patch b/queue-4.14/usb-cdc-acm-fix-rounding-error-in-tiocsserial.patch new file mode 100644 index 00000000000..1e6ee5ae1c5 --- /dev/null +++ b/queue-4.14/usb-cdc-acm-fix-rounding-error-in-tiocsserial.patch @@ -0,0 +1,84 @@ +From 6a7e197860c705d9a3011cdeb01ed187b6f64423 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 14:31:01 +0100 +Subject: USB: cdc-acm: fix rounding error in TIOCSSERIAL + +From: Anthony Mallet + +[ Upstream commit b401f8c4f492cbf74f3f59c9141e5be3071071bb ] + +By default, tty_port_init() initializes those parameters to a multiple +of HZ. For instance in line 69 of tty_port.c: + port->close_delay = (50 * HZ) / 100; +https://github.com/torvalds/linux/blob/master/drivers/tty/tty_port.c#L69 + +With e.g. CONFIG_HZ = 250 (as this is the case for Ubuntu 18.04 +linux-image-4.15.0-37-generic), the default setting for close_delay is +thus 125. + +When ioctl(fd, TIOCGSERIAL, &s) is executed, the setting returned in +user space is '12' (125/10). When ioctl(fd, TIOCSSERIAL, &s) is then +executed with the same setting '12', the value is interpreted as '120' +which is different from the current setting and a EPERM error may be +raised by set_serial_info() if !CAP_SYS_ADMIN. +https://github.com/torvalds/linux/blob/master/drivers/usb/class/cdc-acm.c#L919 + +Fixes: ba2d8ce9db0a6 ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)") +Signed-off-by: Anthony Mallet +Cc: stable +Link: https://lore.kernel.org/r/20200312133101.7096-2-anthony.mallet@laas.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 74d0a91e84273..30a124b74d459 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -942,6 +942,7 @@ static int set_serial_info(struct acm *acm, + { + struct serial_struct new_serial; + unsigned int closing_wait, close_delay; ++ unsigned int old_closing_wait, old_close_delay; + int retval = 0; + + if (copy_from_user(&new_serial, newinfo, sizeof(new_serial))) +@@ -952,18 +953,24 @@ static int set_serial_info(struct acm *acm, + ASYNC_CLOSING_WAIT_NONE : + msecs_to_jiffies(new_serial.closing_wait * 10); + ++ /* we must redo the rounding here, so that the values match */ ++ old_close_delay = jiffies_to_msecs(acm->port.close_delay) / 10; ++ old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ? ++ ASYNC_CLOSING_WAIT_NONE : ++ jiffies_to_msecs(acm->port.closing_wait) / 10; ++ + mutex_lock(&acm->port.mutex); + +- if (!capable(CAP_SYS_ADMIN)) { +- if ((close_delay != acm->port.close_delay) || +- (closing_wait != acm->port.closing_wait)) ++ if ((new_serial.close_delay != old_close_delay) || ++ (new_serial.closing_wait != old_closing_wait)) { ++ if (!capable(CAP_SYS_ADMIN)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; +- } else { +- acm->port.close_delay = close_delay; +- acm->port.closing_wait = closing_wait; +- } ++ else { ++ acm->port.close_delay = close_delay; ++ acm->port.closing_wait = closing_wait; ++ } ++ } else ++ retval = -EOPNOTSUPP; + + mutex_unlock(&acm->port.mutex); + return retval; +-- +2.20.1 +