From 425dc1b74888c4e093ddd4dccbcd8bfc3e35f4f2 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 7 Aug 2023 08:15:34 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...upm-fix-an-off-by-one-test-in-fun_ex.patch | 43 +++++++ ..._elm-fix-incorrect-type-in-assignmen.patch | 120 ++++++++++++++++++ ...-mm-altmap-fix-altmap-boundary-check.patch | 41 ++++++ queue-5.10/series | 3 + 4 files changed, 207 insertions(+) create mode 100644 queue-5.10/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch create mode 100644 queue-5.10/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch create mode 100644 queue-5.10/powerpc-mm-altmap-fix-altmap-boundary-check.patch diff --git a/queue-5.10/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch b/queue-5.10/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch new file mode 100644 index 00000000000..65096c86266 --- /dev/null +++ b/queue-5.10/mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch @@ -0,0 +1,43 @@ +From a0ba8e6366ed216e1a04d6ff23e8e760c940fcc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 23:55:01 +0200 +Subject: mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() + +From: Christophe JAILLET + +[ Upstream commit c6abce60338aa2080973cd95be0aedad528bb41f ] + +'op-cs' is copied in 'fun->mchip_number' which is used to access the +'mchip_offsets' and the 'rnb_gpio' arrays. +These arrays have NAND_MAX_CHIPS elements, so the index must be below this +limit. + +Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This +would lead to out-of-bound accesses. + +Fixes: 54309d657767 ("mtd: rawnand: fsl_upm: Implement exec_op()") +Signed-off-by: Christophe JAILLET +Reviewed-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/cd01cba1c7eda58bdabaae174c78c067325803d2.1689803636.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsl_upm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c +index d5813b9abc8e7..9f934466dd975 100644 +--- a/drivers/mtd/nand/raw/fsl_upm.c ++++ b/drivers/mtd/nand/raw/fsl_upm.c +@@ -136,7 +136,7 @@ static int fun_exec_op(struct nand_chip *chip, const struct nand_operation *op, + unsigned int i; + int ret; + +- if (op->cs > NAND_MAX_CHIPS) ++ if (op->cs >= NAND_MAX_CHIPS) + return -EINVAL; + + if (check_only) +-- +2.40.1 + diff --git a/queue-5.10/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch b/queue-5.10/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch new file mode 100644 index 00000000000..bd290af18e6 --- /dev/null +++ b/queue-5.10/mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch @@ -0,0 +1,120 @@ +From 02e53898f6345b210c1029c72f5e433a4b0d8f9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jun 2023 00:10:21 +0530 +Subject: mtd: rawnand: omap_elm: Fix incorrect type in assignment + +From: Roger Quadros + +[ Upstream commit d8403b9eeee66d5dd81ecb9445800b108c267ce3 ] + +Once the ECC word endianness is converted to BE32, we force cast it +to u32 so we can use elm_write_reg() which in turn uses writel(). + +Fixes below sparse warnings: + + drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: expected unsigned int [usertype] val + drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: got restricted __be32 [usertype] +>> drivers/mtd/nand/raw/omap_elm.c:200:40: sparse: sparse: restricted __be32 degrades to integer + drivers/mtd/nand/raw/omap_elm.c:206:39: sparse: sparse: restricted __be32 degrades to integer + drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: expected unsigned int [assigned] [usertype] val + drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: got restricted __be32 [usertype] + drivers/mtd/nand/raw/omap_elm.c:228:39: sparse: sparse: restricted __be32 degrades to integer + +Fixes: bf22433575ef ("mtd: devices: elm: Add support for ELM error correction") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306212211.WDXokuWh-lkp@intel.com/ +Signed-off-by: Roger Quadros +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230624184021.7740-1-rogerq@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/omap_elm.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/mtd/nand/raw/omap_elm.c b/drivers/mtd/nand/raw/omap_elm.c +index 4b799521a427a..dad17fa0b514e 100644 +--- a/drivers/mtd/nand/raw/omap_elm.c ++++ b/drivers/mtd/nand/raw/omap_elm.c +@@ -174,17 +174,17 @@ static void elm_load_syndrome(struct elm_info *info, + switch (info->bch_type) { + case BCH8_ECC: + /* syndrome fragment 0 = ecc[9-12B] */ +- val = cpu_to_be32(*(u32 *) &ecc[9]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[9]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 1 = ecc[5-8B] */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[5]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[5]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 2 = ecc[1-4B] */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[1]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[1]); + elm_write_reg(info, offset, val); + + /* syndrome fragment 3 = ecc[0B] */ +@@ -194,35 +194,35 @@ static void elm_load_syndrome(struct elm_info *info, + break; + case BCH4_ECC: + /* syndrome fragment 0 = ecc[20-52b] bits */ +- val = (cpu_to_be32(*(u32 *) &ecc[3]) >> 4) | ++ val = ((__force u32)cpu_to_be32(*(u32 *)&ecc[3]) >> 4) | + ((ecc[2] & 0xf) << 28); + elm_write_reg(info, offset, val); + + /* syndrome fragment 1 = ecc[0-20b] bits */ + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 12; ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 12; + elm_write_reg(info, offset, val); + break; + case BCH16_ECC: +- val = cpu_to_be32(*(u32 *) &ecc[22]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[22]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[18]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[18]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[14]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[14]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[10]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[10]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[6]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[6]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[2]); ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[2]); + elm_write_reg(info, offset, val); + offset += 4; +- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 16; ++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 16; + elm_write_reg(info, offset, val); + break; + default: +-- +2.40.1 + diff --git a/queue-5.10/powerpc-mm-altmap-fix-altmap-boundary-check.patch b/queue-5.10/powerpc-mm-altmap-fix-altmap-boundary-check.patch new file mode 100644 index 00000000000..a4bef8728ce --- /dev/null +++ b/queue-5.10/powerpc-mm-altmap-fix-altmap-boundary-check.patch @@ -0,0 +1,41 @@ +From ef82e0a3843321102fb301ef14da41a4ae6b55ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 23:43:20 +0530 +Subject: powerpc/mm/altmap: Fix altmap boundary check + +From: Aneesh Kumar K.V + +[ Upstream commit 6722b25712054c0f903b839b8f5088438dd04df3 ] + +altmap->free includes the entire free space from which altmap blocks +can be allocated. So when checking whether the kernel is doing altmap +block free, compute the boundary correctly, otherwise memory hotunplug +can fail. + +Fixes: 9ef34630a461 ("powerpc/mm: Fallback to RAM if the altmap is unusable") +Signed-off-by: "Aneesh Kumar K.V" +Reviewed-by: David Hildenbrand +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230724181320.471386-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/init_64.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c +index b76cd49d521b9..db040f34c0046 100644 +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -313,8 +313,7 @@ void __ref vmemmap_free(unsigned long start, unsigned long end, + start = ALIGN_DOWN(start, page_size); + if (altmap) { + alt_start = altmap->base_pfn; +- alt_end = altmap->base_pfn + altmap->reserve + +- altmap->free + altmap->alloc + altmap->align; ++ alt_end = altmap->base_pfn + altmap->reserve + altmap->free; + } + + pr_debug("vmemmap_free %lx...%lx\n", start, end); +-- +2.40.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 3a62ed7d391..cb5b627da88 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -180,3 +180,6 @@ bluetooth-l2cap-fix-use-after-free-in-l2cap_sock_ready_cb.patch net-usbnet-fix-warning-in-usbnet_start_xmit-usb_submit_urb.patch fs-protect-reconfiguration-of-sb-read-write-from-racing-writes.patch ext2-drop-fragment-support.patch +mtd-rawnand-omap_elm-fix-incorrect-type-in-assignmen.patch +mtd-rawnand-fsl_upm-fix-an-off-by-one-test-in-fun_ex.patch +powerpc-mm-altmap-fix-altmap-boundary-check.patch -- 2.47.3