From 517c54d455b8501cee2176421dd77ebfb530e153 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 15 Jun 2020 21:55:38 -0400 Subject: [PATCH] Fixes for 4.19 Signed-off-by: Sasha Levin --- ...x-dest-length-calculation-in-__virti.patch | 56 +++++++++++++ ...x-src-dst-scatterlist-calculation-in.patch | 81 +++++++++++++++++++ ...x-use-after-free-in-virtio_crypto_sk.patch | 76 +++++++++++++++++ queue-4.19/series | 9 +++ ...2835-fix-controller-unregister-order.patch | 66 +++++++++++++++ .../spi-fix-controller-unregister-order.patch | 55 +++++++++++++ ...ssign-dummy-value-in-spi_unregister_.patch | 51 ++++++++++++ ...ce-runtime-pm-enable-disable-on-erro.patch | 51 ++++++++++++ ...a2xx-fix-controller-unregister-order.patch | 76 +++++++++++++++++ ...untime-pm-ref-imbalance-on-probe-err.patch | 45 +++++++++++ 10 files changed, 566 insertions(+) create mode 100644 queue-4.19/crypto-virtio-fix-dest-length-calculation-in-__virti.patch create mode 100644 queue-4.19/crypto-virtio-fix-src-dst-scatterlist-calculation-in.patch create mode 100644 queue-4.19/crypto-virtio-fix-use-after-free-in-virtio_crypto_sk.patch create mode 100644 queue-4.19/spi-bcm2835-fix-controller-unregister-order.patch create mode 100644 queue-4.19/spi-fix-controller-unregister-order.patch create mode 100644 queue-4.19/spi-no-need-to-assign-dummy-value-in-spi_unregister_.patch create mode 100644 queue-4.19/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch create mode 100644 queue-4.19/spi-pxa2xx-fix-controller-unregister-order.patch create mode 100644 queue-4.19/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-err.patch diff --git a/queue-4.19/crypto-virtio-fix-dest-length-calculation-in-__virti.patch b/queue-4.19/crypto-virtio-fix-dest-length-calculation-in-__virti.patch new file mode 100644 index 00000000000..f09098c2999 --- /dev/null +++ b/queue-4.19/crypto-virtio-fix-dest-length-calculation-in-__virti.patch @@ -0,0 +1,56 @@ +From 87a7877aa70a0c3ff2f9bbc497c8207fd92dda6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jun 2020 15:05:01 +0800 +Subject: crypto: virtio: Fix dest length calculation in + __virtio_crypto_skcipher_do_req() + +From: Longpeng(Mike) + +[ Upstream commit d90ca42012db2863a9a30b564a2ace6016594bda ] + +The src/dst length is not aligned with AES_BLOCK_SIZE(which is 16) in some +testcases in tcrypto.ko. + +For example, the src/dst length of one of cts(cbc(aes))'s testcase is 17, the +crypto_virtio driver will set @src_data_len=16 but @dst_data_len=17 in this +case and get a wrong at then end. + + SRC: pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp (17 bytes) + EXP: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc pp (17 bytes) + DST: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00 (pollute the last bytes) + (pp: plaintext cc:ciphertext) + +Fix this issue by limit the length of dest buffer. + +Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") +Cc: Gonglei +Cc: Herbert Xu +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: "David S. Miller" +Cc: virtualization@lists.linux-foundation.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Longpeng(Mike) +Link: https://lore.kernel.org/r/20200602070501.2023-4-longpeng2@huawei.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/crypto/virtio/virtio_crypto_algs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index e9a8485c4929..ab4700e4b409 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -424,6 +424,7 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, + goto free; + } + ++ dst_len = min_t(unsigned int, req->nbytes, dst_len); + pr_debug("virtio_crypto: src_len: %u, dst_len: %llu\n", + req->nbytes, dst_len); + +-- +2.25.1 + diff --git a/queue-4.19/crypto-virtio-fix-src-dst-scatterlist-calculation-in.patch b/queue-4.19/crypto-virtio-fix-src-dst-scatterlist-calculation-in.patch new file mode 100644 index 00000000000..2772079c109 --- /dev/null +++ b/queue-4.19/crypto-virtio-fix-src-dst-scatterlist-calculation-in.patch @@ -0,0 +1,81 @@ +From 7a51aa624c89a5656978dee6d0bdca6bf838ca64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jun 2020 15:04:59 +0800 +Subject: crypto: virtio: Fix src/dst scatterlist calculation in + __virtio_crypto_skcipher_do_req() + +From: Longpeng(Mike) + +[ Upstream commit b02989f37fc5e865ceeee9070907e4493b3a21e2 ] + +The system will crash when the users insmod crypto/tcrypt.ko with mode=38 +( testing "cts(cbc(aes))" ). + +Usually the next entry of one sg will be @sg@ + 1, but if this sg element +is part of a chained scatterlist, it could jump to the start of a new +scatterlist array. Fix it by sg_next() on calculation of src/dst +scatterlist. + +Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") +Reported-by: LABBE Corentin +Cc: Herbert Xu +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: "David S. Miller" +Cc: virtualization@lists.linux-foundation.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200123101000.GB24255@Red +Signed-off-by: Gonglei +Signed-off-by: Longpeng(Mike) +Link: https://lore.kernel.org/r/20200602070501.2023-2-longpeng2@huawei.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/crypto/virtio/virtio_crypto_algs.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 9348060cc32f..e9a8485c4929 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -367,13 +367,18 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, + int err; + unsigned long flags; + struct scatterlist outhdr, iv_sg, status_sg, **sgs; +- int i; + u64 dst_len; + unsigned int num_out = 0, num_in = 0; + int sg_total; + uint8_t *iv; ++ struct scatterlist *sg; + + src_nents = sg_nents_for_len(req->src, req->nbytes); ++ if (src_nents < 0) { ++ pr_err("Invalid number of src SG.\n"); ++ return src_nents; ++ } ++ + dst_nents = sg_nents(req->dst); + + pr_debug("virtio_crypto: Number of sgs (src_nents: %d, dst_nents: %d)\n", +@@ -459,12 +464,12 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, + vc_sym_req->iv = iv; + + /* Source data */ +- for (i = 0; i < src_nents; i++) +- sgs[num_out++] = &req->src[i]; ++ for (sg = req->src; src_nents; sg = sg_next(sg), src_nents--) ++ sgs[num_out++] = sg; + + /* Destination data */ +- for (i = 0; i < dst_nents; i++) +- sgs[num_out + num_in++] = &req->dst[i]; ++ for (sg = req->dst; sg; sg = sg_next(sg)) ++ sgs[num_out + num_in++] = sg; + + /* Status */ + sg_init_one(&status_sg, &vc_req->status, sizeof(vc_req->status)); +-- +2.25.1 + diff --git a/queue-4.19/crypto-virtio-fix-use-after-free-in-virtio_crypto_sk.patch b/queue-4.19/crypto-virtio-fix-use-after-free-in-virtio_crypto_sk.patch new file mode 100644 index 00000000000..72ff9456fe0 --- /dev/null +++ b/queue-4.19/crypto-virtio-fix-use-after-free-in-virtio_crypto_sk.patch @@ -0,0 +1,76 @@ +From 769a89cee19ae2c04afdf5875a4cdb8d0ff2b1c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jun 2020 15:05:00 +0800 +Subject: crypto: virtio: Fix use-after-free in + virtio_crypto_skcipher_finalize_req() + +From: Longpeng(Mike) + +[ Upstream commit 8c855f0720ff006d75d0a2512c7f6c4f60ff60ee ] + +The system'll crash when the users insmod crypto/tcrypto.ko with mode=155 +( testing "authenc(hmac(sha1),cbc(aes))" ). It's caused by reuse the memory +of request structure. + +In crypto_authenc_init_tfm(), the reqsize is set to: + [PART 1] sizeof(authenc_request_ctx) + + [PART 2] ictx->reqoff + + [PART 3] MAX(ahash part, skcipher part) +and the 'PART 3' is used by both ahash and skcipher in turn. + +When the virtio_crypto driver finish skcipher req, it'll call ->complete +callback(in crypto_finalize_skcipher_request) and then free its +resources whose pointers are recorded in 'skcipher parts'. + +However, the ->complete is 'crypto_authenc_encrypt_done' in this case, +it will use the 'ahash part' of the request and change its content, +so virtio_crypto driver will get the wrong pointer after ->complete +finish and mistakenly free some other's memory. So the system will crash +when these memory will be used again. + +The resources which need to be cleaned up are not used any more. But the +pointers of these resources may be changed in the function +"crypto_finalize_skcipher_request". Thus release specific resources before +calling this function. + +Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver") +Reported-by: LABBE Corentin +Cc: Gonglei +Cc: Herbert Xu +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: "David S. Miller" +Cc: virtualization@lists.linux-foundation.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200123101000.GB24255@Red +Acked-by: Gonglei +Signed-off-by: Longpeng(Mike) +Link: https://lore.kernel.org/r/20200602070501.2023-3-longpeng2@huawei.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/crypto/virtio/virtio_crypto_algs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 38432721069f..9348060cc32f 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -594,10 +594,11 @@ static void virtio_crypto_ablkcipher_finalize_req( + scatterwalk_map_and_copy(req->info, req->dst, + req->nbytes - AES_BLOCK_SIZE, + AES_BLOCK_SIZE, 0); +- crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine, +- req, err); + kzfree(vc_sym_req->iv); + virtcrypto_clear_request(&vc_sym_req->base); ++ ++ crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine, ++ req, err); + } + + static struct virtio_crypto_algo virtio_crypto_algs[] = { { +-- +2.25.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 2c246b03514..6157444a3a0 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -55,3 +55,12 @@ x86-speculation-change-misspelled-stipb-to-stibp.patch x86-speculation-add-support-for-stibp-always-on-pref.patch x86-speculation-avoid-force-disabling-ibpb-based-on-.patch x86-speculation-pr_spec_force_disable-enforcement-fo.patch +spi-no-need-to-assign-dummy-value-in-spi_unregister_.patch +spi-fix-controller-unregister-order.patch +spi-pxa2xx-fix-controller-unregister-order.patch +spi-bcm2835-fix-controller-unregister-order.patch +spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch +spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-err.patch +crypto-virtio-fix-use-after-free-in-virtio_crypto_sk.patch +crypto-virtio-fix-src-dst-scatterlist-calculation-in.patch +crypto-virtio-fix-dest-length-calculation-in-__virti.patch diff --git a/queue-4.19/spi-bcm2835-fix-controller-unregister-order.patch b/queue-4.19/spi-bcm2835-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..51cd9837142 --- /dev/null +++ b/queue-4.19/spi-bcm2835-fix-controller-unregister-order.patch @@ -0,0 +1,66 @@ +From 4c0e74856fb2e21dbb76cde3a9669c9b60539ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 May 2020 17:58:02 +0200 +Subject: spi: bcm2835: Fix controller unregister order + +From: Lukas Wunner + +[ Upstream commit 9dd277ff92d06f6aa95b39936ad83981d781f49b ] + +The BCM2835 SPI driver uses devm_spi_register_controller() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +bcm2835_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: bcm2835_spi_remove() tears down the DMA +channels and turns off the SPI controller, including its interrupts +and clock. The SPI controller is thus no longer usable. + +When the SPI controller is subsequently unregistered, it unbinds all +its slave devices. If their drivers need to access the SPI bus, +e.g. to quiesce their interrupts, unbinding will fail. + +As a rule, devm_spi_register_controller() must not be used if the +->remove() hook performs teardown steps which shall be performed +after unbinding of slaves. + +Fix by using the non-devm variant spi_register_controller(). Note that +the struct spi_controller as well as the driver-private data are not +freed until after bcm2835_spi_remove() has finished, so accessing them +is safe. + +Fixes: 247263dba208 ("spi: bcm2835: use devm_spi_register_master()") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v3.13+ +Link: https://lore.kernel.org/r/2397dd70cdbe95e0bc4da2b9fca0f31cb94e5aed.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm2835.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c +index eab27d41ba83..df6abc75bc16 100644 +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -793,7 +793,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) + goto out_clk_disable; + } + +- err = devm_spi_register_master(&pdev->dev, master); ++ err = spi_register_master(master); + if (err) { + dev_err(&pdev->dev, "could not register SPI master: %d\n", err); + goto out_clk_disable; +@@ -813,6 +813,8 @@ static int bcm2835_spi_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct bcm2835_spi *bs = spi_master_get_devdata(master); + ++ spi_unregister_master(master); ++ + /* Clear FIFOs, and disable the HW block */ + bcm2835_wr(bs, BCM2835_SPI_CS, + BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX); +-- +2.25.1 + diff --git a/queue-4.19/spi-fix-controller-unregister-order.patch b/queue-4.19/spi-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..1d022a113c3 --- /dev/null +++ b/queue-4.19/spi-fix-controller-unregister-order.patch @@ -0,0 +1,55 @@ +From a69132b15a4c774f1b1c5503f47b0e4df07c60e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 May 2020 17:58:01 +0200 +Subject: spi: Fix controller unregister order + +From: Lukas Wunner + +[ Upstream commit 84855678add8aba927faf76bc2f130a40f94b6f7 ] + +When an SPI controller unregisters, it unbinds all its slave devices. +For this, their drivers may need to access the SPI bus, e.g. to quiesce +interrupts. + +However since commit ffbbdd21329f ("spi: create a message queueing +infrastructure"), spi_destroy_queue() is executed before unbinding the +slaves. It sets ctlr->running = false, thereby preventing SPI bus +access and causing unbinding of slave devices to fail. + +Fix by unbinding slaves before calling spi_destroy_queue(). + +Fixes: ffbbdd21329f ("spi: create a message queueing infrastructure") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v3.4+ +Cc: Linus Walleij +Link: https://lore.kernel.org/r/8aaf9d44c153fe233b17bc2dec4eb679898d7e7b.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 0022a49797f9..f589d8100e95 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2306,6 +2306,8 @@ void spi_unregister_controller(struct spi_controller *ctlr) + struct spi_controller *found; + int id = ctlr->bus_num; + ++ device_for_each_child(&ctlr->dev, NULL, __unregister); ++ + /* First make sure that this controller was ever added */ + mutex_lock(&board_lock); + found = idr_find(&spi_master_idr, id); +@@ -2318,7 +2320,6 @@ void spi_unregister_controller(struct spi_controller *ctlr) + list_del(&ctlr->list); + mutex_unlock(&board_lock); + +- device_for_each_child(&ctlr->dev, NULL, __unregister); + device_unregister(&ctlr->dev); + /* free bus id */ + mutex_lock(&board_lock); +-- +2.25.1 + diff --git a/queue-4.19/spi-no-need-to-assign-dummy-value-in-spi_unregister_.patch b/queue-4.19/spi-no-need-to-assign-dummy-value-in-spi_unregister_.patch new file mode 100644 index 00000000000..d8db538cb44 --- /dev/null +++ b/queue-4.19/spi-no-need-to-assign-dummy-value-in-spi_unregister_.patch @@ -0,0 +1,51 @@ +From f283b3244d00dd2ba7d000234e0d498c981a5f18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jun 2019 20:41:35 +0300 +Subject: spi: No need to assign dummy value in spi_unregister_controller() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit ebc37af5e0a134355ea2b62ed4141458bdbd5389 ] + +The device_for_each_child() doesn't require the returned value to be checked. +Thus, drop the dummy variable completely and have no warning anymore: + +drivers/spi/spi.c: In function ‘spi_unregister_controller’: +drivers/spi/spi.c:2480:6: warning: variable ‘dummy’ set but not used [-Wunused-but-set-variable] + int dummy; + ^~~~~ + +Signed-off-by: Andy Shevchenko +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 88a8a8edd44b..0022a49797f9 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2305,7 +2305,6 @@ void spi_unregister_controller(struct spi_controller *ctlr) + { + struct spi_controller *found; + int id = ctlr->bus_num; +- int dummy; + + /* First make sure that this controller was ever added */ + mutex_lock(&board_lock); +@@ -2319,7 +2318,7 @@ void spi_unregister_controller(struct spi_controller *ctlr) + list_del(&ctlr->list); + mutex_unlock(&board_lock); + +- dummy = device_for_each_child(&ctlr->dev, NULL, __unregister); ++ device_for_each_child(&ctlr->dev, NULL, __unregister); + device_unregister(&ctlr->dev); + /* free bus id */ + mutex_lock(&board_lock); +-- +2.25.1 + diff --git a/queue-4.19/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch b/queue-4.19/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch new file mode 100644 index 00000000000..e9472abd817 --- /dev/null +++ b/queue-4.19/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch @@ -0,0 +1,51 @@ +From dc4edf8a06bbe59696347cfab8115bd29353084d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2019 14:27:13 +0200 +Subject: spi: pxa2xx: Balance runtime PM enable/disable on error + +From: Lubomir Rintel + +[ Upstream commit 1274204542f683e1d8491ebe9cc86284d5a8ebcc ] + +Don't undo the PM initialization if we error out before we managed to +initialize it. The call to pm_runtime_disable() without being preceded +by pm_runtime_enable() would disturb the balance of the Force. + +In practice, this happens if we fail to allocate any of the GPIOS ("cs", +"ready") due to -EPROBE_DEFER because we're getting probled before the +GPIO driver. + +Signed-off-by: Lubomir Rintel +Link: https://lore.kernel.org/r/20190719122713.3444318-1-lkundrak@v3.sk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index d6c30bd1583f..6551188fea23 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1742,14 +1742,16 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) + status = spi_register_controller(master); + if (status != 0) { + dev_err(&pdev->dev, "problem registering spi master\n"); +- goto out_error_clock_enabled; ++ goto out_error_pm_runtime_enabled; + } + + return status; + +-out_error_clock_enabled: ++out_error_pm_runtime_enabled: + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++out_error_clock_enabled: + clk_disable_unprepare(ssp->clk); + + out_error_dma_irq_alloc: +-- +2.25.1 + diff --git a/queue-4.19/spi-pxa2xx-fix-controller-unregister-order.patch b/queue-4.19/spi-pxa2xx-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..68ba1a00ef5 --- /dev/null +++ b/queue-4.19/spi-pxa2xx-fix-controller-unregister-order.patch @@ -0,0 +1,76 @@ +From 51273f0a049a3ab57757ca0061c245aff437a3b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 May 2020 14:25:02 +0200 +Subject: spi: pxa2xx: Fix controller unregister order + +From: Lukas Wunner + +[ Upstream commit 32e5b57232c0411e7dea96625c415510430ac079 ] + +The PXA2xx SPI driver uses devm_spi_register_controller() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +pxa2xx_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: pxa2xx_spi_remove() disables the chip, +rendering the SPI bus inaccessible even though the SPI controller is +still registered. When the SPI controller is subsequently unregistered, +it unbinds all its slave devices. Because their drivers cannot access +the SPI bus, e.g. to quiesce interrupts, the slave devices may be left +in an improper state. + +As a rule, devm_spi_register_controller() must not be used if the +->remove() hook performs teardown steps which shall be performed after +unregistering the controller and specifically after unbinding of slaves. + +Fix by reverting to the non-devm variant of spi_register_controller(). + +An alternative approach would be to use device-managed functions for all +steps in pxa2xx_spi_remove(), e.g. by calling devm_add_action_or_reset() +on probe. However that approach would add more LoC to the driver and +it wouldn't lend itself as well to backporting to stable. + +The improper use of devm_spi_register_controller() was introduced in 2013 +by commit a807fcd090d6 ("spi: pxa2xx: use devm_spi_register_master()"), +but all earlier versions of the driver going back to 2006 were likewise +broken because they invoked spi_unregister_master() at the end of +pxa2xx_spi_remove(), rather than at the beginning. + +Fixes: e0c9905e87ac ("[PATCH] SPI: add PXA2xx SSP SPI Driver") +Signed-off-by: Lukas Wunner +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v2.6.17+ +Cc: Tsuchiya Yuto +Link: https://bugzilla.kernel.org/show_bug.cgi?id=206403#c1 +Link: https://lore.kernel.org/r/834c446b1cf3284d2660f1bee1ebe3e737cd02a9.1590408496.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index e4482823d8d7..d6c30bd1583f 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1739,7 +1739,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) + + /* Register with the SPI framework */ + platform_set_drvdata(pdev, drv_data); +- status = devm_spi_register_controller(&pdev->dev, master); ++ status = spi_register_controller(master); + if (status != 0) { + dev_err(&pdev->dev, "problem registering spi master\n"); + goto out_error_clock_enabled; +@@ -1773,6 +1773,8 @@ static int pxa2xx_spi_remove(struct platform_device *pdev) + + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(drv_data->master); ++ + /* Disable the SSP at the peripheral and SOC level */ + pxa2xx_spi_write(drv_data, SSCR0, 0); + clk_disable_unprepare(ssp->clk); +-- +2.25.1 + diff --git a/queue-4.19/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-err.patch b/queue-4.19/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-err.patch new file mode 100644 index 00000000000..d04a60dda3a --- /dev/null +++ b/queue-4.19/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-err.patch @@ -0,0 +1,45 @@ +From e82cecde019c98b6e6f0b5147423b773ec24497a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 May 2020 14:25:03 +0200 +Subject: spi: pxa2xx: Fix runtime PM ref imbalance on probe error + +From: Lukas Wunner + +[ Upstream commit 65e318e17358a3fd4fcb5a69d89b14016dee2f06 ] + +The PXA2xx SPI driver releases a runtime PM ref in the probe error path +even though it hasn't acquired a ref earlier. + +Apparently commit e2b714afee32 ("spi: pxa2xx: Disable runtime PM if +controller registration fails") sought to copy-paste the invocation of +pm_runtime_disable() from pxa2xx_spi_remove(), but erroneously copied +the call to pm_runtime_put_noidle() as well. Drop it. + +Fixes: e2b714afee32 ("spi: pxa2xx: Disable runtime PM if controller registration fails") +Signed-off-by: Lukas Wunner +Reviewed-by: Jarkko Nikula +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v4.17+ +Cc: Jarkko Nikula +Link: https://lore.kernel.org/r/58b2ac6942ca1f91aaeeafe512144bc5343e1d84.1590408496.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 6551188fea23..2525fd9c8aa4 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1748,7 +1748,6 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) + return status; + + out_error_pm_runtime_enabled: +- pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + + out_error_clock_enabled: +-- +2.25.1 + -- 2.47.3