From dac4b91e73e183886b496a6e7b3caaba5127f94c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 5 Jun 2023 16:49:42 +0200 Subject: [PATCH] 5.4-stable patches added patches: hid-google-add-jewel-usb-id.patch hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch iio-light-vcnl4035-fixed-chip-id-check.patch --- queue-5.4/hid-google-add-jewel-usb-id.patch | 40 +++++++++ ...teger-overflow-in-wacom_intuos_inout.patch | 39 +++++++++ ...-the-order-of-two-cleanup-operations.patch | 83 +++++++++++++++++++ ...d5758-driver-when-ad5758-is-selected.patch | 39 +++++++++ ...2c_master_send-return-value-handling.patch | 72 ++++++++++++++++ ...o-light-vcnl4035-fixed-chip-id-check.patch | 57 +++++++++++++ queue-5.4/series | 6 ++ 7 files changed, 336 insertions(+) create mode 100644 queue-5.4/hid-google-add-jewel-usb-id.patch create mode 100644 queue-5.4/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch create mode 100644 queue-5.4/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch create mode 100644 queue-5.4/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch create mode 100644 queue-5.4/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch create mode 100644 queue-5.4/iio-light-vcnl4035-fixed-chip-id-check.patch diff --git a/queue-5.4/hid-google-add-jewel-usb-id.patch b/queue-5.4/hid-google-add-jewel-usb-id.patch new file mode 100644 index 00000000000..a5fc6a2c1be --- /dev/null +++ b/queue-5.4/hid-google-add-jewel-usb-id.patch @@ -0,0 +1,40 @@ +From ed84c4517a5bc536e8572a01dfa11bc22a280d06 Mon Sep 17 00:00:00 2001 +From: Sung-Chi Li +Date: Mon, 24 Apr 2023 10:37:36 +0800 +Subject: HID: google: add jewel USB id + +From: Sung-Chi Li + +commit ed84c4517a5bc536e8572a01dfa11bc22a280d06 upstream. + +Add 1 additional hammer-like device. + +Signed-off-by: Sung-Chi Li +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-google-hammer.c | 2 ++ + drivers/hid/hid-ids.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/hid/hid-google-hammer.c ++++ b/drivers/hid/hid-google-hammer.c +@@ -474,6 +474,8 @@ static const struct hid_device_id hammer + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_JEWEL) }, ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MASTERBALL) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -490,6 +490,7 @@ + #define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044 + #define USB_DEVICE_ID_GOOGLE_DON 0x5050 + #define USB_DEVICE_ID_GOOGLE_EEL 0x5057 ++#define USB_DEVICE_ID_GOOGLE_JEWEL 0x5061 + + #define USB_VENDOR_ID_GOTOP 0x08f2 + #define USB_DEVICE_ID_SUPER_Q2 0x007f diff --git a/queue-5.4/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch b/queue-5.4/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch new file mode 100644 index 00000000000..81272cc0ebe --- /dev/null +++ b/queue-5.4/hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch @@ -0,0 +1,39 @@ +From bd249b91977b768ea02bf84d04625d2690ad2b98 Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Mon, 17 Apr 2023 09:01:48 -0700 +Subject: HID: wacom: avoid integer overflow in wacom_intuos_inout() + +From: Nikita Zhandarovich + +commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream. + +If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic +operations and integer promotions are done, high bits in +wacom->serial[idx] will be filled with 1s as well. +Avoid this, albeit unlikely, issue by specifying left operand's __u64 +type for the right operand. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization") +Signed-off-by: Nikita Zhandarovich +Reviewed-by: Ping Cheng +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/wacom_wac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -831,7 +831,7 @@ static int wacom_intuos_inout(struct wac + /* Enter report */ + if ((data[1] & 0xfc) == 0xc0) { + /* serial number of the tool */ +- wacom->serial[idx] = ((data[3] & 0x0f) << 28) + ++ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) + + (data[4] << 20) + (data[5] << 12) + + (data[6] << 4) + (data[7] >> 4); + diff --git a/queue-5.4/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch b/queue-5.4/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch new file mode 100644 index 00000000000..04e43265c2d --- /dev/null +++ b/queue-5.4/iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch @@ -0,0 +1,83 @@ +From 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 Mon Sep 17 00:00:00 2001 +From: Jiakai Luo +Date: Sat, 22 Apr 2023 06:34:06 -0700 +Subject: iio: adc: mxs-lradc: fix the order of two cleanup operations + +From: Jiakai Luo + +commit 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 upstream. + +Smatch reports: +drivers/iio/adc/mxs-lradc-adc.c:766 mxs_lradc_adc_probe() warn: +missing unwind goto? + +the order of three init operation: +1.mxs_lradc_adc_trigger_init +2.iio_triggered_buffer_setup +3.mxs_lradc_adc_hw_init + +thus, the order of three cleanup operation should be: +1.mxs_lradc_adc_hw_stop +2.iio_triggered_buffer_cleanup +3.mxs_lradc_adc_trigger_remove + +we exchange the order of two cleanup operations, +introducing the following differences: +1.if mxs_lradc_adc_trigger_init fails, returns directly; +2.if trigger_init succeeds but iio_triggered_buffer_setup fails, +goto err_trig and remove the trigger. + +In addition, we also reorder the unwind that goes on in the +remove() callback to match the new ordering. + +Fixes: 6dd112b9f85e ("iio: adc: mxs-lradc: Add support for ADC driver") +Signed-off-by: Jiakai Luo +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230422133407.72908-1-jkluo@hust.edu.cn +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/mxs-lradc-adc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/iio/adc/mxs-lradc-adc.c ++++ b/drivers/iio/adc/mxs-lradc-adc.c +@@ -760,13 +760,13 @@ static int mxs_lradc_adc_probe(struct pl + + ret = mxs_lradc_adc_trigger_init(iio); + if (ret) +- goto err_trig; ++ return ret; + + ret = iio_triggered_buffer_setup(iio, &iio_pollfunc_store_time, + &mxs_lradc_adc_trigger_handler, + &mxs_lradc_adc_buffer_ops); + if (ret) +- return ret; ++ goto err_trig; + + adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc]; + +@@ -804,9 +804,9 @@ static int mxs_lradc_adc_probe(struct pl + + err_dev: + mxs_lradc_adc_hw_stop(adc); +- mxs_lradc_adc_trigger_remove(iio); +-err_trig: + iio_triggered_buffer_cleanup(iio); ++err_trig: ++ mxs_lradc_adc_trigger_remove(iio); + return ret; + } + +@@ -817,8 +817,8 @@ static int mxs_lradc_adc_remove(struct p + + iio_device_unregister(iio); + mxs_lradc_adc_hw_stop(adc); +- mxs_lradc_adc_trigger_remove(iio); + iio_triggered_buffer_cleanup(iio); ++ mxs_lradc_adc_trigger_remove(iio); + + return 0; + } diff --git a/queue-5.4/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch b/queue-5.4/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch new file mode 100644 index 00000000000..e8c560268a1 --- /dev/null +++ b/queue-5.4/iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch @@ -0,0 +1,39 @@ +From a146eccb68be161ae9eab5f3f68bb0ed7c0fbaa8 Mon Sep 17 00:00:00 2001 +From: Lukas Bulwahn +Date: Mon, 8 May 2023 06:02:08 +0200 +Subject: iio: dac: build ad5758 driver when AD5758 is selected + +From: Lukas Bulwahn + +commit a146eccb68be161ae9eab5f3f68bb0ed7c0fbaa8 upstream. + +Commit 28d1a7ac2a0d ("iio: dac: Add AD5758 support") adds the config AD5758 +and the corresponding driver ad5758.c. In the Makefile, the ad5758 driver +is however included when AD5755 is selected, not when AD5758 is selected. + +Probably, this was simply a mistake that happened by copy-and-paste and +forgetting to adjust the actual line. Surprisingly, no one has ever noticed +that this driver is actually only included when AD5755 is selected and that +the config AD5758 has actually no effect on the build. + +Fixes: 28d1a7ac2a0d ("iio: dac: Add AD5758 support") +Signed-off-by: Lukas Bulwahn +Link: https://lore.kernel.org/r/20230508040208.12033-1-lukas.bulwahn@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/Makefile ++++ b/drivers/iio/dac/Makefile +@@ -16,7 +16,7 @@ obj-$(CONFIG_AD5592R_BASE) += ad5592r-ba + obj-$(CONFIG_AD5592R) += ad5592r.o + obj-$(CONFIG_AD5593R) += ad5593r.o + obj-$(CONFIG_AD5755) += ad5755.o +-obj-$(CONFIG_AD5755) += ad5758.o ++obj-$(CONFIG_AD5758) += ad5758.o + obj-$(CONFIG_AD5761) += ad5761.o + obj-$(CONFIG_AD5764) += ad5764.o + obj-$(CONFIG_AD5791) += ad5791.o diff --git a/queue-5.4/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch b/queue-5.4/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch new file mode 100644 index 00000000000..eeba55d071a --- /dev/null +++ b/queue-5.4/iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch @@ -0,0 +1,72 @@ +From 09d3bec7009186bdba77039df01e5834788b3f95 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Thu, 11 May 2023 02:43:30 +0200 +Subject: iio: dac: mcp4725: Fix i2c_master_send() return value handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +commit 09d3bec7009186bdba77039df01e5834788b3f95 upstream. + +The i2c_master_send() returns number of sent bytes on success, +or negative on error. The suspend/resume callbacks expect zero +on success and non-zero on error. Adapt the return value of the +i2c_master_send() to the expectation of the suspend and resume +callbacks, including proper validation of the return value. + +Fixes: cf35ad61aca2 ("iio: add mcp4725 I2C DAC driver") +Signed-off-by: Marek Vasut +Reviewed-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230511004330.206942-1-marex@denx.de +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/mcp4725.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/iio/dac/mcp4725.c ++++ b/drivers/iio/dac/mcp4725.c +@@ -47,12 +47,18 @@ static int __maybe_unused mcp4725_suspen + struct mcp4725_data *data = iio_priv(i2c_get_clientdata( + to_i2c_client(dev))); + u8 outbuf[2]; ++ int ret; + + outbuf[0] = (data->powerdown_mode + 1) << 4; + outbuf[1] = 0; + data->powerdown = true; + +- return i2c_master_send(data->client, outbuf, 2); ++ ret = i2c_master_send(data->client, outbuf, 2); ++ if (ret < 0) ++ return ret; ++ else if (ret != 2) ++ return -EIO; ++ return 0; + } + + static int __maybe_unused mcp4725_resume(struct device *dev) +@@ -60,13 +66,19 @@ static int __maybe_unused mcp4725_resume + struct mcp4725_data *data = iio_priv(i2c_get_clientdata( + to_i2c_client(dev))); + u8 outbuf[2]; ++ int ret; + + /* restore previous DAC value */ + outbuf[0] = (data->dac_value >> 8) & 0xf; + outbuf[1] = data->dac_value & 0xff; + data->powerdown = false; + +- return i2c_master_send(data->client, outbuf, 2); ++ ret = i2c_master_send(data->client, outbuf, 2); ++ if (ret < 0) ++ return ret; ++ else if (ret != 2) ++ return -EIO; ++ return 0; + } + static SIMPLE_DEV_PM_OPS(mcp4725_pm_ops, mcp4725_suspend, mcp4725_resume); + diff --git a/queue-5.4/iio-light-vcnl4035-fixed-chip-id-check.patch b/queue-5.4/iio-light-vcnl4035-fixed-chip-id-check.patch new file mode 100644 index 00000000000..3bb94c17ad5 --- /dev/null +++ b/queue-5.4/iio-light-vcnl4035-fixed-chip-id-check.patch @@ -0,0 +1,57 @@ +From a551c26e8e568fad42120843521529241b9bceec Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 1 May 2023 10:36:04 -0400 +Subject: iio: light: vcnl4035: fixed chip ID check + +From: Frank Li + +commit a551c26e8e568fad42120843521529241b9bceec upstream. + +VCNL4035 register(0xE) ID_L and ID_M define as: + + ID_L: 0x80 + ID_H: 7:6 (0:0) + 5:4 (0:0) slave address = 0x60 (7-bit) + (0:1) slave address = 0x51 (7-bit) + (1:0) slave address = 0x40 (7-bit) + (1:0) slave address = 0x41 (7-bit) + 3:0 Version code default (0:0:0:0) + +So just check ID_L. + +Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20230501143605.1615549-1-Frank.Li@nxp.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/vcnl4035.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -8,6 +8,7 @@ + * TODO: Proximity + */ + #include ++#include + #include + #include + #include +@@ -42,6 +43,7 @@ + #define VCNL4035_ALS_PERS_MASK GENMASK(3, 2) + #define VCNL4035_INT_ALS_IF_H_MASK BIT(12) + #define VCNL4035_INT_ALS_IF_L_MASK BIT(13) ++#define VCNL4035_DEV_ID_MASK GENMASK(7, 0) + + /* Default values */ + #define VCNL4035_MODE_ALS_ENABLE BIT(0) +@@ -415,6 +417,7 @@ static int vcnl4035_init(struct vcnl4035 + return ret; + } + ++ id = FIELD_GET(VCNL4035_DEV_ID_MASK, id); + if (id != VCNL4035_DEV_ID_VAL) { + dev_err(&data->client->dev, "Wrong id, got %x, expected %x\n", + id, VCNL4035_DEV_ID_VAL); diff --git a/queue-5.4/series b/queue-5.4/series index 84d89c655bc..ccf18db734d 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -58,3 +58,9 @@ netfilter-conntrack-define-variables-exp_nat_nla_pol.patch alsa-oss-avoid-missing-prototype-warnings.patch atm-hide-unused-procfs-functions.patch mailbox-mailbox-test-fix-a-locking-issue-in-mbox_tes.patch +iio-adc-mxs-lradc-fix-the-order-of-two-cleanup-operations.patch +hid-google-add-jewel-usb-id.patch +hid-wacom-avoid-integer-overflow-in-wacom_intuos_inout.patch +iio-light-vcnl4035-fixed-chip-id-check.patch +iio-dac-mcp4725-fix-i2c_master_send-return-value-handling.patch +iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch -- 2.47.3