From: Greg Kroah-Hartman Date: Fri, 29 Aug 2014 19:06:10 +0000 (-0700) Subject: 3.16-stable patches X-Git-Tag: v3.10.54~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f19693052e6afc3fbdedff6023c1fc2326efea81;p=thirdparty%2Fkernel%2Fstable-queue.git 3.16-stable patches added patches: hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch hwmon-ads1015-fix-out-of-bounds-array-access.patch hwmon-amc6821-fix-possible-race-condition-bug.patch hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch hwmon-lm85-fix-various-errors-on-attribute-writes.patch hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch tpm-add-missing-tpm_do_selftest-to-st33-i2c-driver.patch --- diff --git a/queue-3.16/hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch b/queue-3.16/hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch new file mode 100644 index 00000000000..64e074a2c22 --- /dev/null +++ b/queue-3.16/hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch @@ -0,0 +1,31 @@ +From 56de1377ad92f72ee4e5cb0faf7a9b6048fdf0bf Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Wed, 30 Jul 2014 11:13:52 +0800 +Subject: hwmon: (ads1015) Fix off-by-one for valid channel index checking + +From: Axel Lin + +commit 56de1377ad92f72ee4e5cb0faf7a9b6048fdf0bf upstream. + +Current code uses channel as array index, so the valid channel value is +0 .. ADS1015_CHANNELS - 1. + +Signed-off-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ads1015.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/ads1015.c ++++ b/drivers/hwmon/ads1015.c +@@ -198,7 +198,7 @@ static int ads1015_get_channels_config_o + } + + channel = be32_to_cpup(property); +- if (channel > ADS1015_CHANNELS) { ++ if (channel >= ADS1015_CHANNELS) { + dev_err(&client->dev, + "invalid channel index %d on %s\n", + channel, node->full_name); diff --git a/queue-3.16/hwmon-ads1015-fix-out-of-bounds-array-access.patch b/queue-3.16/hwmon-ads1015-fix-out-of-bounds-array-access.patch new file mode 100644 index 00000000000..23e4af726ac --- /dev/null +++ b/queue-3.16/hwmon-ads1015-fix-out-of-bounds-array-access.patch @@ -0,0 +1,40 @@ +From e981429557cbe10c780fab1c1a237cb832757652 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Tue, 5 Aug 2014 09:59:49 +0800 +Subject: hwmon: (ads1015) Fix out-of-bounds array access + +From: Axel Lin + +commit e981429557cbe10c780fab1c1a237cb832757652 upstream. + +Current code uses data_rate as array index in ads1015_read_adc() and uses pga +as array index in ads1015_reg_to_mv, so we must make sure both data_rate and +pga settings are in valid value range. +Return -EINVAL if the setting is out-of-range. + +Signed-off-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ads1015.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwmon/ads1015.c ++++ b/drivers/hwmon/ads1015.c +@@ -212,6 +212,7 @@ static int ads1015_get_channels_config_o + dev_err(&client->dev, + "invalid gain on %s\n", + node->full_name); ++ return -EINVAL; + } + } + +@@ -222,6 +223,7 @@ static int ads1015_get_channels_config_o + dev_err(&client->dev, + "invalid data_rate on %s\n", + node->full_name); ++ return -EINVAL; + } + } + diff --git a/queue-3.16/hwmon-amc6821-fix-possible-race-condition-bug.patch b/queue-3.16/hwmon-amc6821-fix-possible-race-condition-bug.patch new file mode 100644 index 00000000000..3865d9cdf78 --- /dev/null +++ b/queue-3.16/hwmon-amc6821-fix-possible-race-condition-bug.patch @@ -0,0 +1,84 @@ +From cf44819c98db11163f58f08b822d626c7a8f5188 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Thu, 31 Jul 2014 09:43:19 +0800 +Subject: hwmon: (amc6821) Fix possible race condition bug + +From: Axel Lin + +commit cf44819c98db11163f58f08b822d626c7a8f5188 upstream. + +Ensure mutex lock protects the read-modify-write period to prevent possible +race condition bug. +In additional, update data->valid should also be protected by the mutex lock. + +Signed-off-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/amc6821.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/amc6821.c ++++ b/drivers/hwmon/amc6821.c +@@ -360,11 +360,13 @@ static ssize_t set_pwm1_enable( + if (config) + return config; + ++ mutex_lock(&data->update_lock); + config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF1); + if (config < 0) { + dev_err(&client->dev, + "Error reading configuration register, aborting.\n"); +- return config; ++ count = config; ++ goto unlock; + } + + switch (val) { +@@ -381,14 +383,15 @@ static ssize_t set_pwm1_enable( + config |= AMC6821_CONF1_FDRC1; + break; + default: +- return -EINVAL; ++ count = -EINVAL; ++ goto unlock; + } +- mutex_lock(&data->update_lock); + if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF1, config)) { + dev_err(&client->dev, + "Configuration register write error, aborting.\n"); + count = -EIO; + } ++unlock: + mutex_unlock(&data->update_lock); + return count; + } +@@ -493,8 +496,9 @@ static ssize_t set_temp_auto_point_temp( + return -EINVAL; + } + +- data->valid = 0; + mutex_lock(&data->update_lock); ++ data->valid = 0; ++ + switch (ix) { + case 0: + ptemp[0] = clamp_val(val / 1000, 0, +@@ -658,13 +662,14 @@ static ssize_t set_fan1_div( + if (config) + return config; + ++ mutex_lock(&data->update_lock); + config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF4); + if (config < 0) { + dev_err(&client->dev, + "Error reading configuration register, aborting.\n"); +- return config; ++ count = config; ++ goto EXIT; + } +- mutex_lock(&data->update_lock); + switch (val) { + case 2: + config &= ~AMC6821_CONF4_PSPR; diff --git a/queue-3.16/hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch b/queue-3.16/hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch new file mode 100644 index 00000000000..76432027425 --- /dev/null +++ b/queue-3.16/hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch @@ -0,0 +1,163 @@ +From d58e47d787c09fe5c61af3c6ce7d784762f29c3d Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Wed, 6 Aug 2014 08:02:44 +0800 +Subject: hwmon: (dme1737) Prevent overflow problem when writing large limits + +From: Axel Lin + +commit d58e47d787c09fe5c61af3c6ce7d784762f29c3d upstream. + +On platforms with sizeof(int) < sizeof(long), writing a temperature +limit larger than MAXINT will result in unpredictable limit values +written to the chip. Avoid auto-conversion from long to int to fix +the problem. + +Voltage limits, fan minimum speed, pwm frequency, pwm ramp rate, and +other attributes have the same problem, fix them as well. + +Zone temperature limits are signed, but were cached as u8, causing +unepected values to be reported for negative temperatures. Cache as +s8 to fix the problem. + +vrm is an u8, so the written value needs to be limited to [0, 255]. + +Signed-off-by: Axel Lin +[Guenter Roeck: Fix zone temperature cache] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/dme1737.c | 33 ++++++++++++++++++--------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +--- a/drivers/hwmon/dme1737.c ++++ b/drivers/hwmon/dme1737.c +@@ -247,8 +247,8 @@ struct dme1737_data { + u8 pwm_acz[3]; + u8 pwm_freq[6]; + u8 pwm_rr[2]; +- u8 zone_low[3]; +- u8 zone_abs[3]; ++ s8 zone_low[3]; ++ s8 zone_abs[3]; + u8 zone_hyst[2]; + u32 alarms; + }; +@@ -277,7 +277,7 @@ static inline int IN_FROM_REG(int reg, i + return (reg * nominal + (3 << (res - 3))) / (3 << (res - 2)); + } + +-static inline int IN_TO_REG(int val, int nominal) ++static inline int IN_TO_REG(long val, int nominal) + { + return clamp_val((val * 192 + nominal / 2) / nominal, 0, 255); + } +@@ -293,7 +293,7 @@ static inline int TEMP_FROM_REG(int reg, + return (reg * 1000) >> (res - 8); + } + +-static inline int TEMP_TO_REG(int val) ++static inline int TEMP_TO_REG(long val) + { + return clamp_val((val < 0 ? val - 500 : val + 500) / 1000, -128, 127); + } +@@ -308,7 +308,7 @@ static inline int TEMP_RANGE_FROM_REG(in + return TEMP_RANGE[(reg >> 4) & 0x0f]; + } + +-static int TEMP_RANGE_TO_REG(int val, int reg) ++static int TEMP_RANGE_TO_REG(long val, int reg) + { + int i; + +@@ -331,7 +331,7 @@ static inline int TEMP_HYST_FROM_REG(int + return (((ix == 1) ? reg : reg >> 4) & 0x0f) * 1000; + } + +-static inline int TEMP_HYST_TO_REG(int val, int ix, int reg) ++static inline int TEMP_HYST_TO_REG(long val, int ix, int reg) + { + int hyst = clamp_val((val + 500) / 1000, 0, 15); + +@@ -347,7 +347,7 @@ static inline int FAN_FROM_REG(int reg, + return (reg == 0 || reg == 0xffff) ? 0 : 90000 * 60 / reg; + } + +-static inline int FAN_TO_REG(int val, int tpc) ++static inline int FAN_TO_REG(long val, int tpc) + { + if (tpc) { + return clamp_val(val / tpc, 0, 0xffff); +@@ -379,7 +379,7 @@ static inline int FAN_TYPE_FROM_REG(int + return (edge > 0) ? 1 << (edge - 1) : 0; + } + +-static inline int FAN_TYPE_TO_REG(int val, int reg) ++static inline int FAN_TYPE_TO_REG(long val, int reg) + { + int edge = (val == 4) ? 3 : val; + +@@ -402,7 +402,7 @@ static int FAN_MAX_FROM_REG(int reg) + return 1000 + i * 500; + } + +-static int FAN_MAX_TO_REG(int val) ++static int FAN_MAX_TO_REG(long val) + { + int i; + +@@ -460,7 +460,7 @@ static inline int PWM_ACZ_FROM_REG(int r + return acz[(reg >> 5) & 0x07]; + } + +-static inline int PWM_ACZ_TO_REG(int val, int reg) ++static inline int PWM_ACZ_TO_REG(long val, int reg) + { + int acz = (val == 4) ? 2 : val - 1; + +@@ -476,7 +476,7 @@ static inline int PWM_FREQ_FROM_REG(int + return PWM_FREQ[reg & 0x0f]; + } + +-static int PWM_FREQ_TO_REG(int val, int reg) ++static int PWM_FREQ_TO_REG(long val, int reg) + { + int i; + +@@ -510,7 +510,7 @@ static inline int PWM_RR_FROM_REG(int re + return (rr & 0x08) ? PWM_RR[rr & 0x07] : 0; + } + +-static int PWM_RR_TO_REG(int val, int ix, int reg) ++static int PWM_RR_TO_REG(long val, int ix, int reg) + { + int i; + +@@ -528,7 +528,7 @@ static inline int PWM_RR_EN_FROM_REG(int + return PWM_RR_FROM_REG(reg, ix) ? 1 : 0; + } + +-static inline int PWM_RR_EN_TO_REG(int val, int ix, int reg) ++static inline int PWM_RR_EN_TO_REG(long val, int ix, int reg) + { + int en = (ix == 1) ? 0x80 : 0x08; + +@@ -1481,13 +1481,16 @@ static ssize_t set_vrm(struct device *de + const char *buf, size_t count) + { + struct dme1737_data *data = dev_get_drvdata(dev); +- long val; ++ unsigned long val; + int err; + +- err = kstrtol(buf, 10, &val); ++ err = kstrtoul(buf, 10, &val); + if (err) + return err; + ++ if (val > 255) ++ return -EINVAL; ++ + data->vrm = val; + return count; + } diff --git a/queue-3.16/hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch b/queue-3.16/hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch new file mode 100644 index 00000000000..8793bb279d7 --- /dev/null +++ b/queue-3.16/hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch @@ -0,0 +1,32 @@ +From 2565fb05d1e9fc0831f7b1c083bcfcb1cba1f020 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Sat, 2 Aug 2014 13:36:38 +0800 +Subject: hwmon: (gpio-fan) Prevent overflow problem when writing large limits + +From: Axel Lin + +commit 2565fb05d1e9fc0831f7b1c083bcfcb1cba1f020 upstream. + +On platforms with sizeof(int) < sizeof(unsigned long), writing a rpm value +larger than MAXINT will result in unpredictable limit values written to the +chip. Avoid auto-conversion from unsigned long to int to fix the problem. + +Signed-off-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/gpio-fan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/gpio-fan.c ++++ b/drivers/hwmon/gpio-fan.c +@@ -173,7 +173,7 @@ static int get_fan_speed_index(struct gp + return -ENODEV; + } + +-static int rpm_to_speed_index(struct gpio_fan_data *fan_data, int rpm) ++static int rpm_to_speed_index(struct gpio_fan_data *fan_data, unsigned long rpm) + { + struct gpio_fan_speed *speed = fan_data->speed; + int i; diff --git a/queue-3.16/hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch b/queue-3.16/hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch new file mode 100644 index 00000000000..1df52f3977e --- /dev/null +++ b/queue-3.16/hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch @@ -0,0 +1,34 @@ +From 1074d683a51f1aded3562add9ef313e75d557327 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 29 Jul 2014 20:48:59 -0700 +Subject: hwmon: (lm78) Fix overflow problems seen when writing large temperature limits + +From: Guenter Roeck + +commit 1074d683a51f1aded3562add9ef313e75d557327 upstream. + +On platforms with sizeof(int) < sizeof(long), writing a temperature +limit larger than MAXINT will result in unpredictable limit values +written to the chip. Avoid auto-conversion from long to int to fix +the problem. + +Cc: Axel Lin +Reviewed-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm78.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/lm78.c ++++ b/drivers/hwmon/lm78.c +@@ -108,7 +108,7 @@ static inline int FAN_FROM_REG(u8 val, i + * TEMP: mC (-128C to +127C) + * REG: 1C/bit, two's complement + */ +-static inline s8 TEMP_TO_REG(int val) ++static inline s8 TEMP_TO_REG(long val) + { + int nval = clamp_val(val, -128000, 127000) ; + return nval < 0 ? (nval - 500) / 1000 : (nval + 500) / 1000; diff --git a/queue-3.16/hwmon-lm85-fix-various-errors-on-attribute-writes.patch b/queue-3.16/hwmon-lm85-fix-various-errors-on-attribute-writes.patch new file mode 100644 index 00000000000..66c5706fa12 --- /dev/null +++ b/queue-3.16/hwmon-lm85-fix-various-errors-on-attribute-writes.patch @@ -0,0 +1,72 @@ +From 3248c3b771ddd9d31695da17ba350eb6e1b80a53 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 29 Jul 2014 22:23:12 -0700 +Subject: hwmon: (lm85) Fix various errors on attribute writes + +From: Guenter Roeck + +commit 3248c3b771ddd9d31695da17ba350eb6e1b80a53 upstream. + +Temperature limit register writes did not account for negative numbers. +As a result, writing -127000 resulted in -126000 written into the +temperature limit register. This problem affected temp[1-3]_min, +temp[1-3]_max, temp[1-3]_auto_temp_crit, and temp[1-3]_auto_temp_min. + +When writing pwm[1-3]_freq, a long variable was auto-converted into an int +without range check. Wiring values larger than MAXINT resulted in unexpected +register values. + +When writing temp[1-3]_auto_temp_max, an unsigned long variable was +auto-converted into an int without range check. Writing values larger than +MAXINT resulted in unexpected register values. + +vrm is an u8, so the written value needs to be limited to [0, 255]. + +Cc: Axel Lin +Reviewed-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm85.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/lm85.c ++++ b/drivers/hwmon/lm85.c +@@ -155,7 +155,7 @@ static inline u16 FAN_TO_REG(unsigned lo + + /* Temperature is reported in .001 degC increments */ + #define TEMP_TO_REG(val) \ +- clamp_val(SCALE(val, 1000, 1), -127, 127) ++ DIV_ROUND_CLOSEST(clamp_val((val), -127000, 127000), 1000) + #define TEMPEXT_FROM_REG(val, ext) \ + SCALE(((val) << 4) + (ext), 16, 1000) + #define TEMP_FROM_REG(val) ((val) * 1000) +@@ -189,7 +189,7 @@ static const int lm85_range_map[] = { + 13300, 16000, 20000, 26600, 32000, 40000, 53300, 80000 + }; + +-static int RANGE_TO_REG(int range) ++static int RANGE_TO_REG(long range) + { + int i; + +@@ -211,7 +211,7 @@ static const int adm1027_freq_map[8] = { + 11, 15, 22, 29, 35, 44, 59, 88 + }; + +-static int FREQ_TO_REG(const int *map, int freq) ++static int FREQ_TO_REG(const int *map, unsigned long freq) + { + int i; + +@@ -460,6 +460,9 @@ static ssize_t store_vrm_reg(struct devi + if (err) + return err; + ++ if (val > 255) ++ return -EINVAL; ++ + data->vrm = val; + return count; + } diff --git a/queue-3.16/hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch b/queue-3.16/hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch new file mode 100644 index 00000000000..f1821ae63c9 --- /dev/null +++ b/queue-3.16/hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch @@ -0,0 +1,63 @@ +From 5b963089161b8fb244889c972edf553b9d737545 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Tue, 5 Aug 2014 10:08:31 +0800 +Subject: hwmon: (lm92) Prevent overflow problem when writing large limits + +From: Axel Lin + +commit 5b963089161b8fb244889c972edf553b9d737545 upstream. + +On platforms with sizeof(int) < sizeof(long), writing a temperature +limit larger than MAXINT will result in unpredictable limit values +written to the chip. Avoid auto-conversion from long to int to fix +the problem. + +The hysteresis temperature range depends on the value of +data->temp[attr->index], since val is subtracted from it. +Use a wider clamp, [-120000, 220000] should do to cover the +possible range. Also add missing TEMP_TO_REG() on writes into +cached hysteresis value. + +Also uses clamp_val to simplify the code a bit. + +Signed-off-by: Axel Lin +[Guenter Roeck: Fixed double TEMP_TO_REG on hysteresis updates] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm92.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/drivers/hwmon/lm92.c ++++ b/drivers/hwmon/lm92.c +@@ -74,12 +74,9 @@ static inline int TEMP_FROM_REG(s16 reg) + return reg / 8 * 625 / 10; + } + +-static inline s16 TEMP_TO_REG(int val) ++static inline s16 TEMP_TO_REG(long val) + { +- if (val <= -60000) +- return -60000 * 10 / 625 * 8; +- if (val >= 160000) +- return 160000 * 10 / 625 * 8; ++ val = clamp_val(val, -60000, 160000); + return val * 10 / 625 * 8; + } + +@@ -206,10 +203,12 @@ static ssize_t set_temp_hyst(struct devi + if (err) + return err; + ++ val = clamp_val(val, -120000, 220000); + mutex_lock(&data->update_lock); +- data->temp[t_hyst] = TEMP_FROM_REG(data->temp[attr->index]) - val; ++ data->temp[t_hyst] = ++ TEMP_TO_REG(TEMP_FROM_REG(data->temp[attr->index]) - val); + i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST, +- TEMP_TO_REG(data->temp[t_hyst])); ++ data->temp[t_hyst]); + mutex_unlock(&data->update_lock); + return count; + } diff --git a/queue-3.16/hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch b/queue-3.16/hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch new file mode 100644 index 00000000000..ae04c89355a --- /dev/null +++ b/queue-3.16/hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch @@ -0,0 +1,33 @@ +From cc336546ddca8c22de83720632431c16a5f9fe9a Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Thu, 31 Jul 2014 22:27:04 +0800 +Subject: hwmon: (sis5595) Prevent overflow problem when writing large limits + +From: Axel Lin + +commit cc336546ddca8c22de83720632431c16a5f9fe9a upstream. + +On platforms with sizeof(int) < sizeof(long), writing a temperature +limit larger than MAXINT will result in unpredictable limit values +written to the chip. Avoid auto-conversion from long to int to fix +the problem. + +Signed-off-by: Axel Lin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/sis5595.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/sis5595.c ++++ b/drivers/hwmon/sis5595.c +@@ -159,7 +159,7 @@ static inline int TEMP_FROM_REG(s8 val) + { + return val * 830 + 52120; + } +-static inline s8 TEMP_TO_REG(int val) ++static inline s8 TEMP_TO_REG(long val) + { + int nval = clamp_val(val, -54120, 157530) ; + return nval < 0 ? (nval - 5212 - 415) / 830 : (nval - 5212 + 415) / 830; diff --git a/queue-3.16/series b/queue-3.16/series index 588be545504..7187912ff8d 100644 --- a/queue-3.16/series +++ b/queue-3.16/series @@ -36,3 +36,13 @@ arm-omap3-fix-choice-of-omap3_restore_es-function-in-omap34xx-rev3.1.2-case.patc drm-omapdrm-fix-compiler-errors.patch mmc-mmci-remove-redundant-check-of-status-for-data-irq.patch mmc-mmci-move-all-cmd-irq-handling-to-mmci_cmd_irq.patch +hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch +hwmon-amc6821-fix-possible-race-condition-bug.patch +hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch +hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch +hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch +hwmon-lm85-fix-various-errors-on-attribute-writes.patch +hwmon-ads1015-fix-out-of-bounds-array-access.patch +hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch +hwmon-lm92-prevent-overflow-problem-when-writing-large-limits.patch +tpm-add-missing-tpm_do_selftest-to-st33-i2c-driver.patch diff --git a/queue-3.16/tpm-add-missing-tpm_do_selftest-to-st33-i2c-driver.patch b/queue-3.16/tpm-add-missing-tpm_do_selftest-to-st33-i2c-driver.patch new file mode 100644 index 00000000000..ae4febf027b --- /dev/null +++ b/queue-3.16/tpm-add-missing-tpm_do_selftest-to-st33-i2c-driver.patch @@ -0,0 +1,36 @@ +From f07a5e9a331045e976a3d317ba43d14859d9407c Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Sat, 9 Nov 2013 11:17:00 -0700 +Subject: tpm: Add missing tpm_do_selftest to ST33 I2C driver + +From: Jason Gunthorpe + +commit f07a5e9a331045e976a3d317ba43d14859d9407c upstream. + +Most device drivers do call 'tpm_do_selftest' which executes a +TPM_ContinueSelfTest. tpm_i2c_stm_st33 is just pointlessly different, +I think it is bug. + +These days we have the general assumption that the TPM is usable by +the kernel immediately after the driver is finished, so we can no +longer defer the mandatory self test to userspace. + +Reported-by: Richard Marciel +Signed-off-by: Jason Gunthorpe +Signed-off-by: Peter Huewe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm_i2c_stm_st33.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/char/tpm/tpm_i2c_stm_st33.c ++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c +@@ -714,6 +714,7 @@ tpm_st33_i2c_probe(struct i2c_client *cl + } + + tpm_get_timeouts(chip); ++ tpm_do_selftest(chip); + + dev_info(chip->dev, "TPM I2C Initialized\n"); + return 0;