From: Sasha Levin Date: Wed, 12 May 2021 11:50:05 +0000 (-0400) Subject: Fixes for 4.4 X-Git-Tag: v5.4.119~23 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=038e2c97d1622171e87869ba9b3f7758b82e20bf;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch b/queue-4.4/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch new file mode 100644 index 00000000000..7a7b87fa453 --- /dev/null +++ b/queue-4.4/alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch @@ -0,0 +1,40 @@ +From c119082ce58679e966b4243c85b42cc324bde608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 13:19:23 +0200 +Subject: ALSA: core: remove redundant spin_lock pair in snd_card_disconnect + +From: Jia Zhou + +[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ] + +modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between +register and disconnect") resulting in this problem. + +Fixes: 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect") +Signed-off-by: Jia Zhou +Signed-off-by: Yi Wang +Link: https://lore.kernel.org/r/1616989007-34429-1-git-send-email-wang.yi59@zte.com.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/init.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/core/init.c b/sound/core/init.c +index 67765c61e5d5..d0f8405fdfd8 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -403,10 +403,8 @@ int snd_card_disconnect(struct snd_card *card) + return 0; + } + card->shutdown = 1; +- spin_unlock(&card->files_lock); + + /* replace file->f_op with special dummy operations */ +- spin_lock(&card->files_lock); + list_for_each_entry(mfile, &card->files_list, list) { + /* it's critical part, use endless loop */ + /* we have no room to fail */ +-- +2.30.2 + diff --git a/queue-4.4/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch b/queue-4.4/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch new file mode 100644 index 00000000000..7d89bf843a7 --- /dev/null +++ b/queue-4.4/alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch @@ -0,0 +1,136 @@ +From e259d9676b8d3a6eb3db9fa2aa6f34a2d6737937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 13:35:34 +0200 +Subject: ALSA: usb-audio: Add error checks for usb_driver_claim_interface() + calls + +From: Takashi Iwai + +[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ] + +There are a few calls of usb_driver_claim_interface() but all of those +miss the proper error checks, as reported by Coverity. This patch +adds those missing checks. + +Along with it, replace the magic pointer with -1 with a constant +USB_AUDIO_IFACE_UNUSED for better readability. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1475943 ("Error handling issues") +Addresses-Coverity-ID: 1475944 ("Error handling issues") +Addresses-Coverity-ID: 1475945 ("Error handling issues") +Fixes: b1ce7ba619d9 ("ALSA: usb-audio: claim autodetected PCM interfaces all at once") +Fixes: e5779998bf8b ("ALSA: usb-audio: refactor code") +Link: https://lore.kernel.org/r/202104051059.FB7F3016@keescook +Link: https://lore.kernel.org/r/20210406113534.30455-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 14 +++++++------- + sound/usb/quirks.c | 16 ++++++++++++---- + sound/usb/usbaudio.h | 2 ++ + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 61d303f4283d..3ded5fe94cea 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -179,9 +179,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + ctrlif, interface); + return -EINVAL; + } +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); +- +- return 0; ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + if ((altsd->bInterfaceClass != USB_CLASS_AUDIO && +@@ -201,7 +200,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + + if (! snd_usb_parse_audio_interface(chip, interface)) { + usb_set_interface(dev, interface, 0); /* reset the current interface */ +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + return 0; +@@ -610,7 +610,7 @@ static void usb_audio_disconnect(struct usb_interface *intf) + struct snd_card *card; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return; + + card = chip->card; +@@ -710,7 +710,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + struct usb_mixer_interface *mixer; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + if (!chip->num_suspended_intf++) { +@@ -740,7 +740,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + struct list_head *p; + int err = 0; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + atomic_inc(&chip->active); /* avoid autopm */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index cd615514a5ff..7979a9e19c53 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -66,8 +66,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip, + if (!iface) + continue; + if (quirk->ifnum != probed_ifnum && +- !usb_interface_claimed(iface)) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ !usb_interface_claimed(iface)) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +@@ -399,8 +403,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip, + continue; + + err = create_autodetect_quirk(chip, iface, driver); +- if (err >= 0) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ if (err >= 0) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index c5338be3aa37..09ecc7afdc4f 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -62,6 +62,8 @@ struct snd_usb_audio { + struct usb_host_interface *ctrl_intf; /* the audio control interface */ + }; + ++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L) ++ + #define usb_audio_err(chip, fmt, args...) \ + dev_err(&(chip)->dev->dev, fmt, ##args) + #define usb_audio_warn(chip, fmt, args...) \ +-- +2.30.2 + diff --git a/queue-4.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch b/queue-4.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch new file mode 100644 index 00000000000..174216c670e --- /dev/null +++ b/queue-4.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch @@ -0,0 +1,41 @@ +From 4e4a1ddb2d2c5a5785c86c97d404e1be03d420fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:24 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 + +From: Krzysztof Kozlowski + +[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index 0f5dcd418af8..97b152e43f9c 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -134,7 +134,7 @@ + compatible = "maxim,max77686"; + reg = <0x09>; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +-- +2.30.2 + diff --git a/queue-4.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-1060 b/queue-4.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-1060 new file mode 100644 index 00000000000..f2493f367a9 --- /dev/null +++ b/queue-4.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-1060 @@ -0,0 +1,41 @@ +From 345ed456c96c88c287833743537b978f67e5405e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 22:25:25 +0100 +Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Snow + +From: Krzysztof Kozlowski + +[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ] + +The Maxim PMIC datasheets describe the interrupt line as active low +with a requirement of acknowledge from the CPU. Without specifying the +interrupt type in Devicetree, kernel might apply some fixed +configuration, not necessarily working for this hardware. + +Additionally, the interrupt line is shared so using level sensitive +interrupt is here especially important to avoid races. + +Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +index 0a7f408824d8..b45ad99da8c5 100644 +--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi ++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +@@ -281,7 +281,7 @@ + max77686: max77686@09 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +-- +2.30.2 + diff --git a/queue-4.4/ata-libahci_platform-fix-irq-check.patch b/queue-4.4/ata-libahci_platform-fix-irq-check.patch new file mode 100644 index 00000000000..938f0084ced --- /dev/null +++ b/queue-4.4/ata-libahci_platform-fix-irq-check.patch @@ -0,0 +1,44 @@ +From 39346f155404188f97f330822e5f9c46f30dcf54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 23:15:06 +0300 +Subject: ata: libahci_platform: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ] + +Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0 +early (as if the call was successful). Override IRQ0 with -EINVAL instead +as the 'libata' regards 0 as "no IRQ" (thus polling) anyway... + +Fixes: c034640a32f8 ("ata: libahci: properly propagate return value of platform_get_irq()") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/4448c8cc-331f-2915-0e17-38ea34e251c8@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libahci_platform.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 65371e1befe8..8839ad6b73e3 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -516,11 +516,13 @@ int ahci_platform_init_host(struct platform_device *pdev, + int i, irq, n_ports, rc; + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + if (irq != -EPROBE_DEFER) + dev_err(dev, "no irq\n"); + return irq; + } ++ if (!irq) ++ return -EINVAL; + + hpriv->irq = irq; + +-- +2.30.2 + diff --git a/queue-4.4/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch b/queue-4.4/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch new file mode 100644 index 00000000000..8d8b68b9377 --- /dev/null +++ b/queue-4.4/ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch @@ -0,0 +1,61 @@ +From 689b2930a620c7f92e61a97d827f9f5d56c934cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 19:08:19 +0100 +Subject: ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ] + +When the error check in ath9k_hw_read_revisions() was added, it checked for +-EIO which is what ath9k_regread() in the ath9k_htc driver uses. However, +for plain ath9k, the register read function uses ioread32(), which just +returns -1 on error. So if such a read fails, it still gets passed through +and ends up as a weird mac revision in the log output. + +Fix this by changing ath9k_regread() to return -1 on error like ioread32() +does, and fix the error check to look for that instead of -EIO. + +Fixes: 2f90c7e5d094 ("ath9k: Check for errors when reading SREV register") +Signed-off-by: Toke Høiland-Jørgensen +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210326180819.142480-1-toke@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- + drivers/net/wireless/ath/ath9k/hw.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 3932e3d14f3d..379e843fbe0d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset) + if (unlikely(r)) { + ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n", + reg_offset, r); +- return -EIO; ++ return -1; + } + + return be32_to_cpu(val); +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index d50e2e8bd998..25c3e5d3fe62 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -285,7 +285,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) + + srev = REG_READ(ah, AR_SREV); + +- if (srev == -EIO) { ++ if (srev == -1) { + ath_err(ath9k_hw_common(ah), + "Failed to read SREV register"); + return false; +-- +2.30.2 + diff --git a/queue-4.4/crypto-qat-don-t-release-uninitialized-resources.patch b/queue-4.4/crypto-qat-don-t-release-uninitialized-resources.patch new file mode 100644 index 00000000000..20944fa0ebf --- /dev/null +++ b/queue-4.4/crypto-qat-don-t-release-uninitialized-resources.patch @@ -0,0 +1,67 @@ +From e34dcfb446eca41bbb481551fdd56bf2aa519b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 23:39:59 -0400 +Subject: crypto: qat - don't release uninitialized resources + +From: Tong Zhang + +[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ] + +adf_vf_isr_resource_alloc() is not unwinding correctly when error +happens and it want to release uninitialized resources. +To fix this, only release initialized resources. + +[ 1.792845] Trying to free already-free IRQ 11 +[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380 +[ 1.801340] Call Trace: +[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat] +[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat] +[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat] + +Signed-off-by: Tong Zhang +Reviewed-by: Andy Shevchenko +Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver") +Acked-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_dh895xccvf/adf_isr.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c b/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c +index 87c5d8adb125..32f9c2b79681 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c +@@ -243,16 +243,25 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + goto err_out; + + if (adf_setup_pf2vf_bh(accel_dev)) +- goto err_out; ++ goto err_disable_msi; + + if (adf_setup_bh(accel_dev)) +- goto err_out; ++ goto err_cleanup_pf2vf_bh; + + if (adf_request_msi_irq(accel_dev)) +- goto err_out; ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_cleanup_pf2vf_bh: ++ adf_cleanup_pf2vf_bh(accel_dev); ++ ++err_disable_msi: ++ adf_disable_msi(accel_dev); ++ + err_out: +- adf_vf_isr_resource_free(accel_dev); + return -EFAULT; + } +-- +2.30.2 + diff --git a/queue-4.4/crypto-qat-fix-a-double-free-in-adf_create_ring.patch b/queue-4.4/crypto-qat-fix-a-double-free-in-adf_create_ring.patch new file mode 100644 index 00000000000..c6dce96ff67 --- /dev/null +++ b/queue-4.4/crypto-qat-fix-a-double-free-in-adf_create_ring.patch @@ -0,0 +1,40 @@ +From f5af065f59898d18c46b3de1e797cfd539ff75a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 10:13:48 -0700 +Subject: crypto: qat - Fix a double free in adf_create_ring + +From: Lv Yunlong + +[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ] + +In adf_create_ring, if the callee adf_init_ring() failed, the callee will +free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then +adf_create_ring will goto err and the ring->base_addr will be freed again +in adf_cleanup_ring(). + +My patch sets ring->base_addr to NULL after the first freed to avoid the +double free. + +Fixes: a672a9dc872ec ("crypto: qat - Intel(R) QAT transport code") +Signed-off-by: Lv Yunlong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_transport.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c +index 3865ae8d96d9..78f0942a3270 100644 +--- a/drivers/crypto/qat/qat_common/adf_transport.c ++++ b/drivers/crypto/qat/qat_common/adf_transport.c +@@ -198,6 +198,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring) + dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n"); + dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes, + ring->base_addr, ring->dma_addr); ++ ring->base_addr = NULL; + return -EFAULT; + } + +-- +2.30.2 + diff --git a/queue-4.4/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch b/queue-4.4/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch new file mode 100644 index 00000000000..081a269fc4c --- /dev/null +++ b/queue-4.4/crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch @@ -0,0 +1,69 @@ +From added0da79825c5b3b80f8dd86f0719fe75ba598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 08:34:18 +0000 +Subject: crypto: qat - fix error path in adf_isr_resource_alloc() + +From: Giovanni Cabiddu + +[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ] + +The function adf_isr_resource_alloc() is not unwinding correctly in case +of error. +This patch fixes the error paths and propagate the errors to the caller. + +Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator") +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_dh895xcc/adf_isr.c | 29 ++++++++++++++++------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c +index 5570f78795c1..ddbb43da1a13 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c +@@ -315,18 +315,31 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + + ret = adf_isr_alloc_msix_entry_table(accel_dev); + if (ret) +- return ret; +- if (adf_enable_msix(accel_dev)) + goto err_out; + +- if (adf_setup_bh(accel_dev)) +- goto err_out; ++ ret = adf_enable_msix(accel_dev); ++ if (ret) ++ goto err_free_msix_table; + +- if (adf_request_irqs(accel_dev)) +- goto err_out; ++ ret = adf_setup_bh(accel_dev); ++ if (ret) ++ goto err_disable_msix; ++ ++ ret = adf_request_irqs(accel_dev); ++ if (ret) ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_disable_msix: ++ adf_disable_msix(&accel_dev->accel_pci_dev); ++ ++err_free_msix_table: ++ adf_isr_free_msix_entry_table(accel_dev); ++ + err_out: +- adf_isr_resource_free(accel_dev); +- return -EFAULT; ++ return ret; + } +-- +2.30.2 + diff --git a/queue-4.4/fotg210-udc-complete-out-requests-on-short-packets.patch b/queue-4.4/fotg210-udc-complete-out-requests-on-short-packets.patch new file mode 100644 index 00000000000..5c138a84ab6 --- /dev/null +++ b/queue-4.4/fotg210-udc-complete-out-requests-on-short-packets.patch @@ -0,0 +1,47 @@ +From 9f5e2184b3ef827488f8f6dfb5ee370bc5b54b12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:15 +0100 +Subject: fotg210-udc: Complete OUT requests on short packets + +From: Fabian Vogt + +[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ] + +A short packet indicates the end of a transfer and marks the request as +complete. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-8-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index b2910bc65e51..9e102ba9cf66 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -856,12 +856,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep) + { + struct fotg210_request *req = list_entry(ep->queue.next, + struct fotg210_request, queue); ++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1); + + fotg210_start_dma(ep, req); + +- /* finish out transfer */ ++ /* Complete the request when it's full or a short packet arrived. ++ * Like other drivers, short_not_ok isn't handled. ++ */ ++ + if (req->req.length == req->req.actual || +- req->req.actual < ep->ep.maxpacket) ++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1))) + fotg210_done(ep, req, 0); + } + +-- +2.30.2 + diff --git a/queue-4.4/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch b/queue-4.4/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch new file mode 100644 index 00000000000..7c89d3f3048 --- /dev/null +++ b/queue-4.4/fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch @@ -0,0 +1,40 @@ +From c1d640f1c7e23a60fda73d6d7b0f71585cc30719 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:14 +0100 +Subject: fotg210-udc: Don't DMA more than the buffer can take + +From: Fabian Vogt + +[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ] + +Before this, it wrote as much as available into the buffer, even if it +didn't fit. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 491b04dd6db7..b2910bc65e51 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -340,8 +340,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + } else { + buffer = req->req.buf + req->req.actual; + length = ioread32(ep->fotg210->reg + +- FOTG210_FIBCR(ep->epnum - 1)); +- length &= FIBCR_BCFX; ++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX; ++ if (length > req->req.length - req->req.actual) ++ length = req->req.length - req->req.actual; + } + } else { + buffer = req->req.buf + req->req.actual; +-- +2.30.2 + diff --git a/queue-4.4/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch b/queue-4.4/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch new file mode 100644 index 00000000000..1ff2587b6ac --- /dev/null +++ b/queue-4.4/fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch @@ -0,0 +1,40 @@ +From 8d0bc7fe463455650640a3235a174084e23d25b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:09 +0100 +Subject: fotg210-udc: Fix DMA on EP0 for length > max packet size + +From: Fabian Vogt + +[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ] + +For a 75 Byte request, it would send the first 64 separately, then detect +that the remaining 11 Byte fit into a single DMA, but due to this bug set +the length to the original 75 Bytes. This leads to a DMA failure (which is +ignored...) and the request completes without the remaining bytes having +been sent. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-2-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 76e991557116..7831c556a40b 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -348,7 +348,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + if (req->req.length - req->req.actual > ep->ep.maxpacket) + length = ep->ep.maxpacket; + else +- length = req->req.length; ++ length = req->req.length - req->req.actual; + } + + d = dma_map_single(NULL, buffer, length, +-- +2.30.2 + diff --git a/queue-4.4/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch b/queue-4.4/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch new file mode 100644 index 00000000000..ff7035e93af --- /dev/null +++ b/queue-4.4/fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch @@ -0,0 +1,38 @@ +From 2d819a05e108111d5194f175943592f227954f15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:10 +0100 +Subject: fotg210-udc: Fix EP0 IN requests bigger than two packets + +From: Fabian Vogt + +[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ] + +For a 134 Byte packet, it sends the first two 64 Byte packets just fine, +but then notice that less than a packet is remaining and call fotg210_done +without actually sending the rest. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-3-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 7831c556a40b..1eda6fc750c1 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -827,7 +827,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210) + if (req->req.length) + fotg210_start_dma(ep, req); + +- if ((req->req.length - req->req.actual) < ep->ep.maxpacket) ++ if (req->req.actual == req->req.length) + fotg210_done(ep, req, 0); + } else { + fotg210_set_cxdone(fotg210); +-- +2.30.2 + diff --git a/queue-4.4/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch b/queue-4.4/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch new file mode 100644 index 00000000000..b2798401d57 --- /dev/null +++ b/queue-4.4/fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch @@ -0,0 +1,42 @@ +From 0292f820ebb2e7e4146ba3b77849aa794fff906b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:12 +0100 +Subject: fotg210-udc: Mask GRP2 interrupts we don't handle + +From: Fabian Vogt + +[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ] + +Currently it leaves unhandled interrupts unmasked, but those are never +acked. In the case of a "device idle" interrupt, this leads to an +effectively frozen system until plugging it in. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-5-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index d0a9ce7d0635..491b04dd6db7 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -1033,6 +1033,12 @@ static void fotg210_init(struct fotg210_udc *fotg210) + value &= ~DMCR_GLINT_EN; + iowrite32(value, fotg210->reg + FOTG210_DMCR); + ++ /* enable only grp2 irqs we handle */ ++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT ++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT ++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT), ++ fotg210->reg + FOTG210_DMISGR2); ++ + /* disable all fifo interrupt */ + iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1); + +-- +2.30.2 + diff --git a/queue-4.4/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch b/queue-4.4/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch new file mode 100644 index 00000000000..40daab29ef1 --- /dev/null +++ b/queue-4.4/fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch @@ -0,0 +1,40 @@ +From 63c77ee4966f4209d5b4a7740893855a7616fc8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 15:11:11 +0100 +Subject: fotg210-udc: Remove a dubious condition leading to fotg210_done + +From: Fabian Vogt + +[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ] + +When the EP0 IN request was not completed but less than a packet sent, +it would complete the request successfully. That doesn't make sense +and can't really happen as fotg210_start_dma always sends +min(length, maxpkt) bytes. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Link: https://lore.kernel.org/r/20210324141115.9384-4-fabian@ritter-vogt.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 1eda6fc750c1..d0a9ce7d0635 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -385,8 +385,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep, + } + if (ep->dir_in) { /* if IN */ + fotg210_start_dma(ep, req); +- if ((req->req.length == req->req.actual) || +- (req->req.actual < ep->ep.maxpacket)) ++ if (req->req.length == req->req.actual) + fotg210_done(ep, req, 0); + } else { /* OUT */ + u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0); +-- +2.30.2 + diff --git a/queue-4.4/hid-plantronics-workaround-for-double-volume-key-pre.patch b/queue-4.4/hid-plantronics-workaround-for-double-volume-key-pre.patch new file mode 100644 index 00000000000..5d8e2b6a2eb --- /dev/null +++ b/queue-4.4/hid-plantronics-workaround-for-double-volume-key-pre.patch @@ -0,0 +1,181 @@ +From ee6bdc4479066582a849eed2045102ffe0c12371 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Feb 2021 16:47:40 +0200 +Subject: HID: plantronics: Workaround for double volume key presses + +From: Maxim Mikityanskiy + +[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ] + +Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice +for each volume key press. This patch adds a quirk to hid-plantronics +for this product ID, which will ignore the second volume key press if +it happens within 5 ms from the last one that was handled. + +The patch was tested on the mentioned model only, it shouldn't affect +other models, however, this quirk might be needed for them too. +Auto-repeat (when a key is held pressed) is not affected, because the +rate is about 3 times per second, which is far less frequent than once +in 5 ms. + +Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls") +Signed-off-by: Maxim Mikityanskiy +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++-- + include/linux/hid.h | 2 ++ + 3 files changed, 61 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 773452c6edfa..cbf13e993902 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -769,6 +769,7 @@ + #define USB_DEVICE_ID_ORTEK_WKB2000 0x2000 + + #define USB_VENDOR_ID_PLANTRONICS 0x047f ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056 + + #define USB_VENDOR_ID_PANASONIC 0x04da + #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044 +diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c +index 584b10d3fc3d..460711c1124a 100644 +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -16,6 +16,7 @@ + + #include + #include ++#include + + #define PLT_HID_1_0_PAGE 0xffa00000 + #define PLT_HID_2_0_PAGE 0xffa20000 +@@ -39,6 +40,16 @@ + #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ + (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) + ++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) ++ ++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */ ++ ++struct plt_drv_data { ++ unsigned long device_type; ++ unsigned long last_volume_key_ts; ++ u32 quirks; ++}; ++ + static int plantronics_input_mapping(struct hid_device *hdev, + struct hid_input *hi, + struct hid_field *field, +@@ -46,7 +57,8 @@ static int plantronics_input_mapping(struct hid_device *hdev, + unsigned long **bit, int *max) + { + unsigned short mapped_key; +- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ unsigned long plt_type = drv_data->device_type; + + /* special case for PTT products */ + if (field->application == HID_GD_JOYSTICK) +@@ -108,6 +120,30 @@ mapped: + return 1; + } + ++static int plantronics_event(struct hid_device *hdev, struct hid_field *field, ++ struct hid_usage *usage, __s32 value) ++{ ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ ++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) { ++ unsigned long prev_ts, cur_ts; ++ ++ /* Usages are filtered in plantronics_usages. */ ++ ++ if (!value) /* Handle key presses only. */ ++ return 0; ++ ++ prev_ts = drv_data->last_volume_key_ts; ++ cur_ts = jiffies; ++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT) ++ return 1; /* Ignore the repeated key. */ ++ ++ drv_data->last_volume_key_ts = cur_ts; ++ } ++ ++ return 0; ++} ++ + static unsigned long plantronics_device_type(struct hid_device *hdev) + { + unsigned i, col_page; +@@ -136,15 +172,24 @@ exit: + static int plantronics_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { ++ struct plt_drv_data *drv_data; + int ret; + ++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL); ++ if (!drv_data) ++ return -ENOMEM; ++ + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); + goto err; + } + +- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev)); ++ drv_data->device_type = plantronics_device_type(hdev); ++ drv_data->quirks = id->driver_data; ++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT); ++ ++ hid_set_drvdata(hdev, drv_data); + + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT | + HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE); +@@ -156,15 +201,26 @@ err: + } + + static const struct hid_device_id plantronics_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, + { } + }; + MODULE_DEVICE_TABLE(hid, plantronics_devices); + ++static const struct hid_usage_id plantronics_usages[] = { ++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID }, ++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID }, ++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR } ++}; ++ + static struct hid_driver plantronics_driver = { + .name = "plantronics", + .id_table = plantronics_devices, ++ .usage_table = plantronics_usages, + .input_mapping = plantronics_input_mapping, ++ .event = plantronics_event, + .probe = plantronics_probe, + }; + module_hid_driver(plantronics_driver); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index d93ba6014e3c..19c53b64e07a 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -246,6 +246,8 @@ struct hid_item { + #define HID_CP_SELECTION 0x000c0080 + #define HID_CP_MEDIASELECTION 0x000c0087 + #define HID_CP_SELECTDISC 0x000c00ba ++#define HID_CP_VOLUMEUP 0x000c00e9 ++#define HID_CP_VOLUMEDOWN 0x000c00ea + #define HID_CP_PLAYBACKSPEED 0x000c00f1 + #define HID_CP_PROXIMITY 0x000c0109 + #define HID_CP_SPEAKERSYSTEM 0x000c0160 +-- +2.30.2 + diff --git a/queue-4.4/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch b/queue-4.4/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch new file mode 100644 index 00000000000..a4572b4a0d8 --- /dev/null +++ b/queue-4.4/hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch @@ -0,0 +1,46 @@ +From 657aff097b15eef8690a821e6f4a79c21c0d412c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:08:17 +0300 +Subject: HSI: core: fix resource leaks in hsi_add_client_from_dt() + +From: Dan Carpenter + +[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ] + +If some of the allocations fail between the dev_set_name() and the +device_register() then the name will not be freed. Fix this by +moving dev_set_name() directly in front of the call to device_register(). + +Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices") +Signed-off-by: Dan Carpenter +Reviewed-by: Jason Gunthorpe +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/hsi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/hsi/hsi.c b/drivers/hsi/hsi.c +index df380d55c58f..55e36fcd7ff3 100644 +--- a/drivers/hsi/hsi.c ++++ b/drivers/hsi/hsi.c +@@ -223,8 +223,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + if (err) + goto err; + +- dev_set_name(&cl->device, "%s", name); +- + err = hsi_of_property_parse_mode(client, "hsi-mode", &mode); + if (err) { + err = hsi_of_property_parse_mode(client, "hsi-rx-mode", +@@ -307,6 +305,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + cl->device.release = hsi_client_release; + cl->device.of_node = client; + ++ dev_set_name(&cl->device, "%s", name); + if (device_register(&cl->device) < 0) { + pr_err("hsi: failed to register client: %s\n", name); + put_device(&cl->device); +-- +2.30.2 + diff --git a/queue-4.4/i2c-cadence-add-irq-check.patch b/queue-4.4/i2c-cadence-add-irq-check.patch new file mode 100644 index 00000000000..2f0786845de --- /dev/null +++ b/queue-4.4/i2c-cadence-add-irq-check.patch @@ -0,0 +1,42 @@ +From 1defd18e9da0284e1a3ab823bdbc36c1be1773ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:14:35 +0300 +Subject: i2c: cadence: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 84deed6571bd..7d15c9143d16 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -894,7 +894,10 @@ static int cdns_i2c_probe(struct platform_device *pdev) + if (IS_ERR(id->membase)) + return PTR_ERR(id->membase); + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.owner = THIS_MODULE; + id->adap.dev.of_node = pdev->dev.of_node; +-- +2.30.2 + diff --git a/queue-4.4/i2c-jz4780-add-irq-check.patch b/queue-4.4/i2c-jz4780-add-irq-check.patch new file mode 100644 index 00000000000..f0ed193fd14 --- /dev/null +++ b/queue-4.4/i2c-jz4780-add-irq-check.patch @@ -0,0 +1,42 @@ +From aba4dacaf291f055887cd394c81a530d77a2bb79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:18:31 +0300 +Subject: i2c: jz4780: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-jz4780.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c +index ba3b94505c14..d80cee068bea 100644 +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -754,7 +754,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev) + + jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0); + +- i2c->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err; ++ i2c->irq = ret; + ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0, + dev_name(&pdev->dev), i2c); + if (ret) +-- +2.30.2 + diff --git a/queue-4.4/i2c-sh7760-add-irq-check.patch b/queue-4.4/i2c-sh7760-add-irq-check.patch new file mode 100644 index 00000000000..1365dd18bfe --- /dev/null +++ b/queue-4.4/i2c-sh7760-add-irq-check.patch @@ -0,0 +1,42 @@ +From b9bdd9ed535f81bc8094504a42e8a0791df72c5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Apr 2021 23:25:10 +0300 +Subject: i2c: sh7760: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_irq() (which +takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_irq() with invalid +IRQ #s. + +Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh7760.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index 24968384b401..70e4437060d5 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + goto out2; + } + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.nr = pdev->id; + id->adap.algo = &sh7760_i2c_algo; +-- +2.30.2 + diff --git a/queue-4.4/i2c-sh7760-fix-irq-error-path.patch b/queue-4.4/i2c-sh7760-fix-irq-error-path.patch new file mode 100644 index 00000000000..d3b04e94cdb --- /dev/null +++ b/queue-4.4/i2c-sh7760-fix-irq-error-path.patch @@ -0,0 +1,38 @@ +From 5314104405be337d5afb62a133592acd0c19e78e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Apr 2021 22:05:05 +0300 +Subject: i2c: sh7760: fix IRQ error path + +From: Sergey Shtylyov + +[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ] + +While adding the invalid IRQ check after calling platform_get_irq(), +I managed to overlook that the driver has a complex error path in its +probe() method, thus a simple *return* couldn't be used. Use a proper +*goto* instead! + +Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh7760.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index 70e4437060d5..c836c53caa3f 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + + ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto out3; + id->irq = ret; + + id->adap.nr = pdev->id; +-- +2.30.2 + diff --git a/queue-4.4/kfifo-fix-ternary-sign-extension-bugs.patch b/queue-4.4/kfifo-fix-ternary-sign-extension-bugs.patch new file mode 100644 index 00000000000..e9b02c52bd8 --- /dev/null +++ b/queue-4.4/kfifo-fix-ternary-sign-extension-bugs.patch @@ -0,0 +1,120 @@ +From 09195167b9300ae3ba9ebdf0e18701fbe4ecf6e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 22:54:15 -0700 +Subject: kfifo: fix ternary sign extension bugs + +From: Dan Carpenter + +[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ] + +The intent with this code was to return negative error codes but instead +it returns positives. + +The problem is how type promotion works with ternary operations. These +functions return long, "ret" is an int and "copied" is a u32. The +negative error code is first cast to u32 so it becomes a high positive and +then cast to long where it's still a positive. + +We could fix this by declaring "ret" as a ssize_t but let's just get rid +of the ternaries instead. + +Link: https://lkml.kernel.org/r/YIE+/cK1tBzSuQPU@mwanda +Fixes: 5bf2b19320ec ("kfifo: add example files to the kernel sample directory") +Signed-off-by: Dan Carpenter +Cc: Stefani Seibold +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + samples/kfifo/bytestream-example.c | 8 ++++++-- + samples/kfifo/inttype-example.c | 8 ++++++-- + samples/kfifo/record-example.c | 8 ++++++-- + 3 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c +index 2fca916d9edf..a7f5ee8b6edc 100644 +--- a/samples/kfifo/bytestream-example.c ++++ b/samples/kfifo/bytestream-example.c +@@ -124,8 +124,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -140,8 +142,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c +index 8dc3c2e7105a..a326a37e9163 100644 +--- a/samples/kfifo/inttype-example.c ++++ b/samples/kfifo/inttype-example.c +@@ -117,8 +117,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -133,8 +135,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c +index 2d7529eeb294..deb87a2e4e6b 100644 +--- a/samples/kfifo/record-example.c ++++ b/samples/kfifo/record-example.c +@@ -131,8 +131,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -147,8 +149,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +-- +2.30.2 + diff --git a/queue-4.4/mac80211-bail-out-if-cipher-schemes-are-invalid.patch b/queue-4.4/mac80211-bail-out-if-cipher-schemes-are-invalid.patch new file mode 100644 index 00000000000..b1913e82847 --- /dev/null +++ b/queue-4.4/mac80211-bail-out-if-cipher-schemes-are-invalid.patch @@ -0,0 +1,44 @@ +From ab5d24f864244f0a87c2cdfec633d0c6e54b9bb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 14:31:50 +0200 +Subject: mac80211: bail out if cipher schemes are invalid + +From: Johannes Berg + +[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ] + +If any of the cipher schemes specified by the driver are invalid, bail +out and fail the registration rather than just warning. Otherwise, we +might later crash when we try to use the invalid cipher scheme, e.g. +if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd +have an out-of-bounds access in RX validation. + +Fixes: 2475b1cc0d52 ("mac80211: add generic cipher scheme support") +Link: https://lore.kernel.org/r/20210408143149.38a3a13a1b19.I6b7f5790fa0958ed8049cf02ac2a535c61e9bc96@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 2357b17254e7..871931577ef4 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1019,8 +1019,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + if (local->hw.wiphy->max_scan_ie_len) + local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len; + +- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, +- local->hw.n_cipher_schemes)); ++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, ++ local->hw.n_cipher_schemes))) { ++ result = -EINVAL; ++ goto fail_workqueue; ++ } + + result = ieee80211_init_cipher_suites(local); + if (result < 0) +-- +2.30.2 + diff --git a/queue-4.4/media-dvb-usb-remote-fix-dvb_usb_nec_rc_key_to_event.patch b/queue-4.4/media-dvb-usb-remote-fix-dvb_usb_nec_rc_key_to_event.patch new file mode 100644 index 00000000000..1ebb0a7a1bc --- /dev/null +++ b/queue-4.4/media-dvb-usb-remote-fix-dvb_usb_nec_rc_key_to_event.patch @@ -0,0 +1,50 @@ +From 36ee811bf918b15c55a87ea7f85348b9e57c06d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 17:46:00 +0100 +Subject: media: dvb-usb-remote: fix dvb_usb_nec_rc_key_to_event type mismatch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 0fa430e96d3c3561a78701f51fd8593da68b8474 ] + +gcc-11 warns about the prototype not exactly matching the function +definition: + +drivers/media/usb/dvb-usb/dvb-usb-remote.c:363:20: error: argument 2 of type ‘u8[5]’ {aka ‘unsigned char[5]’} with mismatched bound [-Werror=array-parameter=] + 363 | u8 keybuf[5], u32 *event, int *state) + | ~~~^~~~~~~~~ +In file included from drivers/media/usb/dvb-usb/dvb-usb-common.h:13, + from drivers/media/usb/dvb-usb/dvb-usb-remote.c:9: +drivers/media/usb/dvb-usb/dvb-usb.h:490:65: note: previously declared as ‘u8[]’ {aka ‘unsigned char[]’} + 490 | extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *); + | ^~~~ + +Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver") +Signed-off-by: Arnd Bergmann +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dvb-usb.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb.h b/drivers/media/usb/dvb-usb/dvb-usb.h +index ce4c4e3b58bb..dd80b737d4da 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb.h ++++ b/drivers/media/usb/dvb-usb/dvb-usb.h +@@ -466,7 +466,8 @@ extern int dvb_usb_generic_rw(struct dvb_usb_device *, u8 *, u16, u8 *, u16,int) + extern int dvb_usb_generic_write(struct dvb_usb_device *, u8 *, u16); + + /* commonly used remote control parsing */ +-extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *); ++int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *d, u8 keybuf[5], ++ u32 *event, int *state); + + /* commonly used firmware download types and function */ + struct hexline { +-- +2.30.2 + diff --git a/queue-4.4/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch b/queue-4.4/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch new file mode 100644 index 00000000000..8b5d18a55c2 --- /dev/null +++ b/queue-4.4/media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch @@ -0,0 +1,56 @@ +From 34256dfce1e2ff8e22f51ebc3abda2d2de93ecc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 14:16:28 +0200 +Subject: media: m88rs6000t: avoid potential out-of-bounds reads on arrays + +From: Colin Ian King + +[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ] + +There a 3 array for-loops that don't check the upper bounds of the +index into arrays and this may lead to potential out-of-bounds +reads. Fix this by adding array size upper bounds checks to be +full safe. + +Addresses-Coverity: ("Out-of-bounds read") + +Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com +Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000") +Signed-off-by: Colin Ian King +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/m88rs6000t.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c +index 504bfbc4027a..f78caf3c2bbd 100644 +--- a/drivers/media/tuners/m88rs6000t.c ++++ b/drivers/media/tuners/m88rs6000t.c +@@ -535,7 +535,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + PGA2_cri = PGA2_GC >> 2; + PGA2_crf = PGA2_GC & 0x03; + +- for (i = 0; i <= RF_GC; i++) ++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++) + RFG += RFGS[i]; + + if (RF_GC == 0) +@@ -547,12 +547,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + if (RF_GC == 3) + RFG += 100; + +- for (i = 0; i <= IF_GC; i++) ++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++) + IFG += IFGS[i]; + + TIAG = TIA_GC * TIA_GS; + +- for (i = 0; i <= BB_GC; i++) ++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++) + BBG += BBGS[i]; + + PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS; +-- +2.30.2 + diff --git a/queue-4.4/media-omap4iss-return-error-code-when-omap4iss_get-f.patch b/queue-4.4/media-omap4iss-return-error-code-when-omap4iss_get-f.patch new file mode 100644 index 00000000000..386373d0c25 --- /dev/null +++ b/queue-4.4/media-omap4iss-return-error-code-when-omap4iss_get-f.patch @@ -0,0 +1,40 @@ +From eba042e8e18b083473762df9c153841c6759a9ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 03:50:41 +0100 +Subject: media: omap4iss: return error code when omap4iss_get() failed + +From: Yang Yingliang + +[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ] + +If omap4iss_get() failed, it need return error code in iss_probe(). + +Fixes: 59f0ad807681 ("[media] v4l: omap4iss: Add support for OMAP4...") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/omap4iss/iss.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c +index aa76ccda5b42..130d09d28e1d 100644 +--- a/drivers/staging/media/omap4iss/iss.c ++++ b/drivers/staging/media/omap4iss/iss.c +@@ -1406,8 +1406,10 @@ static int iss_probe(struct platform_device *pdev) + if (ret < 0) + goto error; + +- if (!omap4iss_get(iss)) ++ if (!omap4iss_get(iss)) { ++ ret = -EINVAL; + goto error; ++ } + + ret = iss_reset(iss); + if (ret < 0) +-- +2.30.2 + diff --git a/queue-4.4/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch b/queue-4.4/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch new file mode 100644 index 00000000000..cabc3b96828 --- /dev/null +++ b/queue-4.4/media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch @@ -0,0 +1,41 @@ +From 9e5e4db97beb8860d07e3377632be6204ea1897e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 16:43:27 +0100 +Subject: media: vivid: fix assignment of dev->fbuf_out_flags + +From: Colin Ian King + +[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ] + +Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise +mask and the following statement should be bit-wise or'ing in the new flag +bits but instead is making a direct assignment. Fix this by using the |= +operator rather than an assignment. + +Addresses-Coverity: ("Unused value") + +Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vivid/vivid-vid-out.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c +index ffe5531dfc81..7f6fa77e4775 100644 +--- a/drivers/media/platform/vivid/vivid-vid-out.c ++++ b/drivers/media/platform/vivid/vivid-vid-out.c +@@ -1011,7 +1011,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh, + return -EINVAL; + } + dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags); +- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags); ++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags); + return 0; + } + +-- +2.30.2 + diff --git a/queue-4.4/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch b/queue-4.4/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch new file mode 100644 index 00000000000..dfabd031c6c --- /dev/null +++ b/queue-4.4/memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch @@ -0,0 +1,53 @@ +From b3d03c9fc664a4eab2f5b7103c8aa764cbff2665 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 19:38:21 +0000 +Subject: memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] + +From: Colin Ian King + +[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ] + +Currently the array gpmc_cs is indexed by cs before it cs is range checked +and the pointer read from this out-of-index read is dereferenced. Fix this +by performing the range check on cs before the read and the following +pointer dereference. + +Addresses-Coverity: ("Negative array index read") +Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select") +Signed-off-by: Colin Ian King +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/omap-gpmc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index af187c91fc33..f6d06d894538 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -1005,8 +1005,8 @@ EXPORT_SYMBOL(gpmc_cs_request); + + void gpmc_cs_free(int cs) + { +- struct gpmc_cs_data *gpmc = &gpmc_cs[cs]; +- struct resource *res = &gpmc->mem; ++ struct gpmc_cs_data *gpmc; ++ struct resource *res; + + spin_lock(&gpmc_mem_lock); + if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) { +@@ -1015,6 +1015,9 @@ void gpmc_cs_free(int cs) + spin_unlock(&gpmc_mem_lock); + return; + } ++ gpmc = &gpmc_cs[cs]; ++ res = &gpmc->mem; ++ + gpmc_cs_disable_mem(cs); + if (res->flags) + release_resource(res); +-- +2.30.2 + diff --git a/queue-4.4/mt7601u-fix-always-true-expression.patch b/queue-4.4/mt7601u-fix-always-true-expression.patch new file mode 100644 index 00000000000..71446fa967b --- /dev/null +++ b/queue-4.4/mt7601u-fix-always-true-expression.patch @@ -0,0 +1,47 @@ +From 5f242f8797e837ba468b8f23140ae4549f43e8be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 18:32:41 +0000 +Subject: mt7601u: fix always true expression + +From: Colin Ian King + +[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ] + +Currently the expression ~nic_conf1 is always true because nic_conf1 +is a u16 and according to 6.5.3.3 of the C standard the ~ operator +promotes the u16 to an integer before flipping all the bits. Thus +the top 16 bits of the integer result are all set so the expression +is always true. If the intention was to flip all the bits of nic_conf1 +then casting the integer result back to a u16 is a suitabel fix. + +Interestingly static analyzers seem to thing a bitwise ! should be +used instead of ~ for this scenario, so I think the original intent +of the expression may need some extra consideration. + +Addresses-Coverity: ("Logical vs. bitwise operator") +Fixes: c869f77d6abb ("add mt7601u driver") +Signed-off-by: Colin Ian King +Acked-by: Jakub Kicinski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210225183241.1002129-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +index 8d8ee0344f7b..7b917c4613ad 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +@@ -106,7 +106,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom) + { + u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1); + +- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); ++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); + } + + static void +-- +2.30.2 + diff --git a/queue-4.4/mtd-require-write-permissions-for-locking-and-badblo.patch b/queue-4.4/mtd-require-write-permissions-for-locking-and-badblo.patch new file mode 100644 index 00000000000..0e902837b8e --- /dev/null +++ b/queue-4.4/mtd-require-write-permissions-for-locking-and-badblo.patch @@ -0,0 +1,69 @@ +From af3c2a079706ef8caf2b324ecccc1ab09394bd6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:57:35 +0100 +Subject: mtd: require write permissions for locking and badblock ioctls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Walle + +[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ] + +MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require +write permission. Depending on the hardware MEMLOCK might even be +write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK +is always write-once. + +MEMSETBADBLOCK modifies the bad block table. + +Fixes: f7e6b19bc764 ("mtd: properly check all write ioctls for permissions") +Signed-off-by: Michael Walle +Reviewed-by: Greg Kroah-Hartman +Acked-by: Rafał Miłecki +Acked-by: Richard Weinberger +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210303155735.25887-1-michael@walle.cc +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdchar.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index ce87d9506f6a..0a2832782807 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -616,16 +616,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + case MEMGETINFO: + case MEMREADOOB: + case MEMREADOOB64: +- case MEMLOCK: +- case MEMUNLOCK: + case MEMISLOCKED: + case MEMGETOOBSEL: + case MEMGETBADBLOCK: +- case MEMSETBADBLOCK: + case OTPSELECT: + case OTPGETREGIONCOUNT: + case OTPGETREGIONINFO: +- case OTPLOCK: + case ECCGETLAYOUT: + case ECCGETSTATS: + case MTDFILEMODE: +@@ -636,9 +632,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + /* "dangerous" commands */ + case MEMERASE: + case MEMERASE64: ++ case MEMLOCK: ++ case MEMUNLOCK: ++ case MEMSETBADBLOCK: + case MEMWRITEOOB: + case MEMWRITEOOB64: + case MEMWRITE: ++ case OTPLOCK: + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + break; +-- +2.30.2 + diff --git a/queue-4.4/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch b/queue-4.4/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch new file mode 100644 index 00000000000..f1ae0acabe7 --- /dev/null +++ b/queue-4.4/mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch @@ -0,0 +1,43 @@ +From d746ec47e1da27d217f65a13900424c90d59c275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 11:26:27 -0700 +Subject: mwl8k: Fix a double Free in mwl8k_probe_hw + +From: Lv Yunlong + +[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ] + +In mwl8k_probe_hw, hw->priv->txq is freed at the first time by +dma_free_coherent() in the call chain: +if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i). + +Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed +at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent(). + +My patch set txq->txd to NULL after the first free to avoid the +double free. + +Fixes: a66098daacee2 ("mwl8k: Marvell TOPDOG wireless driver") +Signed-off-by: Lv Yunlong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210402182627.4256-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mwl8k.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c +index 088429d0a634..d448480b8406 100644 +--- a/drivers/net/wireless/mwl8k.c ++++ b/drivers/net/wireless/mwl8k.c +@@ -1459,6 +1459,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) + txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL); + if (txq->skb == NULL) { + pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma); ++ txq->txd = NULL; + return -ENOMEM; + } + +-- +2.30.2 + diff --git a/queue-4.4/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch b/queue-4.4/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch new file mode 100644 index 00000000000..8073626638e --- /dev/null +++ b/queue-4.4/net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch @@ -0,0 +1,48 @@ +From 9b345e01340612092ac947e58bf38a73784a5a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 18:16:14 +0100 +Subject: net: davinci_emac: Fix incorrect masking of tx and rx error channel + +From: Colin Ian King + +[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ] + +The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels) +are incorrect and always lead to a zero result. The mask values are +currently the incorrect post-right shifted values, fix this by setting +them to the currect values. + +(I double checked these against the TMS320TCI6482 data sheet, section +5.30, page 127 to ensure I had the correct mask values for the TXERRCH +and RXERRCH fields in the MACSTATUS register). + +Addresses-Coverity: ("Operands don't affect result") +Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/davinci_emac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index e4c4747bdf32..e11f436b0726 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1"; + /* EMAC mac_status register */ + #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000) + #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) +-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000) + #define EMAC_MACSTATUS_TXERRCH_SHIFT (16) + #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000) + #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) +-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700) + #define EMAC_MACSTATUS_RXERRCH_SHIFT (8) + + /* EMAC RX register masks */ +-- +2.30.2 + diff --git a/queue-4.4/net-lapbether-prevent-racing-when-checking-whether-t.patch b/queue-4.4/net-lapbether-prevent-racing-when-checking-whether-t.patch new file mode 100644 index 00000000000..23d8fb8fdb0 --- /dev/null +++ b/queue-4.4/net-lapbether-prevent-racing-when-checking-whether-t.patch @@ -0,0 +1,140 @@ +From 2718771109a783ce1281b0b875f607e34c679f24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 23:23:09 -0800 +Subject: net: lapbether: Prevent racing when checking whether the netif is + running + +From: Xie He + +[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ] + +There are two "netif_running" checks in this driver. One is in +"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make +sure that the LAPB APIs called in these functions are called before +"lapb_unregister" is called by the "ndo_stop" function. + +However, these "netif_running" checks are unreliable, because it's +possible that immediately after "netif_running" returns true, "ndo_stop" +is called (which causes "lapb_unregister" to be called). + +This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can +reliably check and ensure the netif is running while doing their work. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xie He +Acked-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index 666bbacb8cb4..24daa1d0e9c5 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -56,6 +56,8 @@ struct lapbethdev { + struct list_head node; + struct net_device *ethdev; /* link to ethernet device */ + struct net_device *axdev; /* lapbeth device (lapb#) */ ++ bool up; ++ spinlock_t up_lock; /* Protects "up" */ + }; + + static LIST_HEAD(lapbeth_devices); +@@ -103,8 +105,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + rcu_read_lock(); + lapbeth = lapbeth_get_x25_dev(dev); + if (!lapbeth) +- goto drop_unlock; +- if (!netif_running(lapbeth->axdev)) ++ goto drop_unlock_rcu; ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop_unlock; + + len = skb->data[0] + skb->data[1] * 256; +@@ -119,11 +122,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + goto drop_unlock; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + rcu_read_unlock(); + return 0; + drop_unlock: + kfree_skb(skb); + goto out; ++drop_unlock_rcu: ++ rcu_read_unlock(); + drop: + kfree_skb(skb); + return 0; +@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb) + static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + +- /* +- * Just to be *really* sure not to send anything if the interface +- * is down, the ethernet device may have gone. +- */ +- if (!netif_running(dev)) ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop; + + /* There should be a pseudo header of 1 byte added by upper layers. +@@ -188,6 +192,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + goto drop; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + return NETDEV_TX_OK; + drop: + kfree_skb(skb); +@@ -279,6 +284,7 @@ static const struct lapb_register_struct lapbeth_callbacks = { + */ + static int lapbeth_open(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + + if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) { +@@ -286,13 +292,22 @@ static int lapbeth_open(struct net_device *dev) + return -ENODEV; + } + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = true; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + return 0; + } + + static int lapbeth_close(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = false; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + if ((err = lapb_unregister(dev)) != LAPB_OK) + pr_err("lapb_unregister error: %d\n", err); + +@@ -350,6 +365,9 @@ static int lapbeth_new_device(struct net_device *dev) + dev_hold(dev); + lapbeth->ethdev = dev; + ++ lapbeth->up = false; ++ spin_lock_init(&lapbeth->up_lock); ++ + rc = -EIO; + if (register_netdevice(ndev)) + goto fail; +-- +2.30.2 + diff --git a/queue-4.4/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch b/queue-4.4/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch new file mode 100644 index 00000000000..6c4ca2e14ab --- /dev/null +++ b/queue-4.4/net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch @@ -0,0 +1,41 @@ +From b664c98eeb66d2a81b9c48ceec9fd6446f951a33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 09:22:58 -0700 +Subject: net:nfc:digital: Fix a double free in digital_tg_recv_dep_req + +From: Lv Yunlong + +[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ] + +In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp). +If nfc_tm_data_received() failed, the callee will free the resp via +kfree_skb() and return error. But in the exit branch, the resp +will be freed again. + +My patch sets resp to NULL if nfc_tm_data_received() failed, to +avoid the double free. + +Fixes: 1c7a4c24fbfd9 ("NFC Digital: Add target NFC-DEP support") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/digital_dep.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c +index f72be7433df3..46375ff214c0 100644 +--- a/net/nfc/digital_dep.c ++++ b/net/nfc/digital_dep.c +@@ -1187,6 +1187,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, + } + + rc = nfc_tm_data_received(ddev->nfc_dev, resp); ++ if (rc) ++ resp = NULL; + + exit: + kfree_skb(ddev->chaining_skb); +-- +2.30.2 + diff --git a/queue-4.4/net-thunderx-fix-unintentional-sign-extension-issue.patch b/queue-4.4/net-thunderx-fix-unintentional-sign-extension-issue.patch new file mode 100644 index 00000000000..7146ca477bf --- /dev/null +++ b/queue-4.4/net-thunderx-fix-unintentional-sign-extension-issue.patch @@ -0,0 +1,42 @@ +From c748d64697d9aec71bcf71d1013c3fb82385d8c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 14:07:26 +0100 +Subject: net: thunderx: Fix unintentional sign extension issue + +From: Colin Ian King + +[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ] + +The shifting of the u8 integers rq->caching by 26 bits to +the left will be promoted to a 32 bit signed int and then +sign-extended to a u64. In the event that rq->caching is +greater than 0x1f then all then all the upper 32 bits of +the u64 end up as also being set because of the int +sign-extension. Fix this by casting the u8 values to a +u64 before the 26 bit left shift. + +Addresses-Coverity: ("Unintended sign extension") +Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +index 912ee28ab58b..5da49e8b533b 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +@@ -528,7 +528,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, + mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG; + mbx.rq.qs_num = qs->vnic_id; + mbx.rq.rq_num = qidx; +- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) | ++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) | + (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) | + (rq->cont_qs_rbdr_idx << 8) | + (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx); +-- +2.30.2 + diff --git a/queue-4.4/nfc-pn533-prevent-potential-memory-corruption.patch b/queue-4.4/nfc-pn533-prevent-potential-memory-corruption.patch new file mode 100644 index 00000000000..f1f68cff8c5 --- /dev/null +++ b/queue-4.4/nfc-pn533-prevent-potential-memory-corruption.patch @@ -0,0 +1,39 @@ +From 695bf57b0812e8d0be572633211b1d9e96e14b2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 14:44:42 +0300 +Subject: nfc: pn533: prevent potential memory corruption + +From: Dan Carpenter + +[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ] + +If the "type_a->nfcid_len" is too large then it would lead to memory +corruption in pn533_target_found_type_a() when we do: + + memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len); + +Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/pn533.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c +index bb3d5ea9869c..001c12867e43 100644 +--- a/drivers/nfc/pn533.c ++++ b/drivers/nfc/pn533.c +@@ -1250,6 +1250,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a, + if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0) + return false; + ++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE) ++ return false; ++ + return true; + } + +-- +2.30.2 + diff --git a/queue-4.4/pata_arasan_cf-fix-irq-check.patch b/queue-4.4/pata_arasan_cf-fix-irq-check.patch new file mode 100644 index 00000000000..64187ede74c --- /dev/null +++ b/queue-4.4/pata_arasan_cf-fix-irq-check.patch @@ -0,0 +1,56 @@ +From f97b79f5a78f982e7e888674e70c2b1f55188b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 23:50:24 +0300 +Subject: pata_arasan_cf: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ] + +The driver's probe() method is written as if platform_get_irq() returns 0 +on error, while actually it returns a negative error code (with all the +other values considered valid IRQs). Rewrite the driver's IRQ checking code +to pass the positive IRQ #s to ata_host_activate(), propagate upstream +-EPROBE_DEFER, and set up the driver to polling mode on (negative) errors +and IRQ0 (libata treats IRQ #0 as a polling mode anyway)... + +Fixes: a480167b23ef ("pata_arasan_cf: Adding support for arasan compact flash host controller") +Signed-off-by: Sergey Shtylyov +Acked-by: Viresh Kumar +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_arasan_cf.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c +index 80fe0f6fed29..a6b1a7556d37 100644 +--- a/drivers/ata/pata_arasan_cf.c ++++ b/drivers/ata/pata_arasan_cf.c +@@ -819,12 +819,19 @@ static int arasan_cf_probe(struct platform_device *pdev) + else + quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */ + +- /* if irq is 0, support only PIO */ +- acdev->irq = platform_get_irq(pdev, 0); +- if (acdev->irq) ++ /* ++ * If there's an error getting IRQ (or we do get IRQ0), ++ * support only PIO ++ */ ++ ret = platform_get_irq(pdev, 0); ++ if (ret > 0) { ++ acdev->irq = ret; + irq_handler = arasan_cf_interrupt; +- else ++ } else if (ret == -EPROBE_DEFER) { ++ return ret; ++ } else { + quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA; ++ } + + acdev->pbase = res->start; + acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start, +-- +2.30.2 + diff --git a/queue-4.4/pata_ipx4xx_cf-fix-irq-check.patch b/queue-4.4/pata_ipx4xx_cf-fix-irq-check.patch new file mode 100644 index 00000000000..cc5e7425779 --- /dev/null +++ b/queue-4.4/pata_ipx4xx_cf-fix-irq-check.patch @@ -0,0 +1,45 @@ +From 3f520686e0809a47fd626cdc8e645b4973b6f181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 23:51:10 +0300 +Subject: pata_ipx4xx_cf: fix IRQ check + +From: Sergey Shtylyov + +[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ] + +The driver's probe() method is written as if platform_get_irq() returns 0 +on error, while actually it returns a negative error code (with all the +other values considered valid IRQs). Rewrite the driver's IRQ checking +code to pass the positive IRQ #s to ata_host_activate(), propagate errors +upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code +treats 0 as an indication that polling should be used anyway... + +Fixes: 0df0d0a0ea9f ("[libata] ARM: add ixp4xx PATA driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ixp4xx_cf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c +index abda44183512..fb8d1f68f36f 100644 +--- a/drivers/ata/pata_ixp4xx_cf.c ++++ b/drivers/ata/pata_ixp4xx_cf.c +@@ -169,8 +169,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev) + return -ENOMEM; + + irq = platform_get_irq(pdev, 0); +- if (irq) ++ if (irq > 0) + irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING); ++ else if (irq < 0) ++ return irq; ++ else ++ return -EINVAL; + + /* Setup expansion bus chip selects */ + *data->cs0_cfg = data->cs0_bits; +-- +2.30.2 + diff --git a/queue-4.4/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch b/queue-4.4/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch new file mode 100644 index 00000000000..4271686a7c4 --- /dev/null +++ b/queue-4.4/powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch @@ -0,0 +1,47 @@ +From 6da6bc6a9ee22ebd98e76a3276b1f634c9115c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 17:24:03 +0000 +Subject: powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of + 'add') + +From: Christophe Leroy + +[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ] + + AS arch/powerpc/platforms/52xx/lite5200_sleep.o +arch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages: +arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression + +In the following code, 'addi' is wrong, has to be 'add' + + /* local udelay in sram is needed */ + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ + addi r12, r13, r12 /* end */ + +Fixes: ee983079ce04 ("[POWERPC] MPC5200 low power mode") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/cb4cec9131c8577803367f1699209a7e104cec2a.1619025821.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S +index 08ab6fefcf7a..5f44e9223413 100644 +--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S ++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S +@@ -180,7 +180,7 @@ sram_code: + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ +- addi r12, r13, r12 /* end */ ++ add r12, r13, r12 /* end */ + 1: + mftb r13 /* current */ + cmp cr0, r13, r12 +-- +2.30.2 + diff --git a/queue-4.4/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch b/queue-4.4/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch new file mode 100644 index 00000000000..e706dc9e115 --- /dev/null +++ b/queue-4.4/powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch @@ -0,0 +1,44 @@ +From 6a38064fe23a1cf82fcb964d09c6ae472acc99ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 12:26:23 -0700 +Subject: powerpc: iommu: fix build when neither PCI or IBMVIO is set + +From: Randy Dunlap + +[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ] + +When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a +build error. The fault injection code is not useful in that kernel config, +so make the FAIL_IOMMU option depend on PCI || IBMVIO. + +Prevents this build error (warning escalated to error): +../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable] + 178 | static struct notifier_block fail_iommu_bus_notifier = { + +Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection") +Reported-by: kernel test robot +Suggested-by: Michael Ellerman +Signed-off-by: Randy Dunlap +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210404192623.10697-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index 3a510f4a6b68..7e62572215ce 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -350,6 +350,7 @@ config STRICT_DEVMEM + config FAIL_IOMMU + bool "Fault-injection capability for IOMMU" + depends on FAULT_INJECTION ++ depends on PCI || IBMVIO + help + Provide fault-injection capability for IOMMU. Each device can + be selectively enabled via the fail_iommu property. +-- +2.30.2 + diff --git a/queue-4.4/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch b/queue-4.4/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch new file mode 100644 index 00000000000..4099a88d42b --- /dev/null +++ b/queue-4.4/powerpc-prom-mark-identical_pvr_fixup-as-__init.patch @@ -0,0 +1,60 @@ +From 274e0830ff52b44620fc1e8e6bf4ad6764e44f84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 13:08:29 -0700 +Subject: powerpc/prom: Mark identical_pvr_fixup as __init + +From: Nathan Chancellor + +[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ] + +If identical_pvr_fixup() is not inlined, there are two modpost warnings: + +WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference +from the function identical_pvr_fixup() to the function +.init.text:of_get_flat_dt_prop() +The function identical_pvr_fixup() references +the function __init of_get_flat_dt_prop(). +This is often because identical_pvr_fixup lacks a __init +annotation or the annotation of of_get_flat_dt_prop is wrong. + +WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference +from the function identical_pvr_fixup() to the function +.init.text:identify_cpu() +The function identical_pvr_fixup() references +the function __init identify_cpu(). +This is often because identical_pvr_fixup lacks a __init +annotation or the annotation of identify_cpu is wrong. + +identical_pvr_fixup() calls two functions marked as __init and is only +called by a function marked as __init so it should be marked as __init +as well. At the same time, remove the inline keywork as it is not +necessary to inline this function. The compiler is still free to do so +if it feels it is worthwhile since commit 889b3c1245de ("compiler: +remove CONFIG_OPTIMIZE_INLINING entirely"). + +Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround") +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://github.com/ClangBuiltLinux/linux/issues/1316 +Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 04a27307a2c4..77690c7f2671 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -258,7 +258,7 @@ static struct feature_property { + }; + + #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU) +-static inline void identical_pvr_fixup(unsigned long node) ++static __init void identical_pvr_fixup(unsigned long node) + { + unsigned int pvr; + const char *model = of_get_flat_dt_prop(node, "model", NULL); +-- +2.30.2 + diff --git a/queue-4.4/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch b/queue-4.4/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch new file mode 100644 index 00000000000..f039ecdef2b --- /dev/null +++ b/queue-4.4/powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch @@ -0,0 +1,51 @@ +From c027e859eca714a73b27fb26b6ba81888c9051cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Feb 2021 12:24:35 -0600 +Subject: powerpc/pseries: extract host bridge from pci_bus prior to bus + removal + +From: Tyrel Datwyler + +[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ] + +The pci_bus->bridge reference may no longer be valid after +pci_bus_remove() resulting in passing a bad value to device_unregister() +for the associated bridge device. + +Store the host_bridge reference in a separate variable prior to +pci_bus_remove(). + +Fixes: 7340056567e3 ("powerpc/pci: Reorder pci bus/bridge unregistration during PHB removal") +Signed-off-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210211182435.47968-1-tyreld@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c +index 5d4a3df59d0c..baaeb753fa79 100644 +--- a/arch/powerpc/platforms/pseries/pci_dlpar.c ++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c +@@ -98,6 +98,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic); + int remove_phb_dynamic(struct pci_controller *phb) + { + struct pci_bus *b = phb->bus; ++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge); + struct resource *res; + int rc, i; + +@@ -124,7 +125,8 @@ int remove_phb_dynamic(struct pci_controller *phb) + /* Remove the PCI bus and unregister the bridge device from sysfs */ + phb->bus = NULL; + pci_remove_bus(b); +- device_unregister(b->bridge); ++ host_bridge->bus = NULL; ++ device_unregister(&host_bridge->dev); + + /* Now release the IO resource */ + if (res->flags & IORESOURCE_IO) +-- +2.30.2 + diff --git a/queue-4.4/sata_mv-add-irq-checks.patch b/queue-4.4/sata_mv-add-irq-checks.patch new file mode 100644 index 00000000000..87bf5a4f496 --- /dev/null +++ b/queue-4.4/sata_mv-add-irq-checks.patch @@ -0,0 +1,47 @@ +From 7e9e41f6a2f0b951e8d8bf022233aab9c67a9cfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Mar 2021 00:13:49 +0300 +Subject: sata_mv: add IRQ checks + +From: Sergey Shtylyov + +[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ] + +The function mv_platform_probe() neglects to check the results of the +calls to platform_get_irq() and irq_of_parse_and_map() and blithely +passes them to ata_host_activate() -- while the latter only checks +for IRQ0 (treating it as a polling mode indicattion) and passes the +negative values to devm_request_irq() causing it to fail as it takes +unsigned values for the IRQ #... + +Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ +#s to ata_host_activate(), propagate upstream the negative error codes, +and override the IRQ0 with -EINVAL (as we don't want the polling mode). + +Fixes: f351b2d638c3 ("sata_mv: Support SoC controllers") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/51436f00-27a1-e20b-c21b-0e817e0a7c86@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_mv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index 5718dc94c90c..601ea2e9fcf9 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -4101,6 +4101,10 @@ static int mv_platform_probe(struct platform_device *pdev) + n_ports = mv_platform_data->n_ports; + irq = platform_get_irq(pdev, 0); + } ++ if (irq < 0) ++ return irq; ++ if (!irq) ++ return -EINVAL; + + host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports); + hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL); +-- +2.30.2 + diff --git a/queue-4.4/scsi-fcoe-fix-mismatched-fcoe_wwn_from_mac-declarati.patch b/queue-4.4/scsi-fcoe-fix-mismatched-fcoe_wwn_from_mac-declarati.patch new file mode 100644 index 00000000000..f314e28c86a --- /dev/null +++ b/queue-4.4/scsi-fcoe-fix-mismatched-fcoe_wwn_from_mac-declarati.patch @@ -0,0 +1,50 @@ +From 01ba4cc442da508bed89fe14072494fed035a720 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 17:46:59 +0100 +Subject: scsi: fcoe: Fix mismatched fcoe_wwn_from_mac declaration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 5b11c9d80bde81f6896cc85b23aeaa9502a704ed ] + +An old cleanup changed the array size from MAX_ADDR_LEN to unspecified in +the declaration, but now gcc-11 warns about this: + +drivers/scsi/fcoe/fcoe_ctlr.c:1972:37: error: argument 1 of type ‘unsigned char[32]’ with mismatched bound [-Werror=array-parameter=] + 1972 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], + | ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~ +In file included from /git/arm-soc/drivers/scsi/fcoe/fcoe_ctlr.c:33: +include/scsi/libfcoe.h:252:37: note: previously declared as ‘unsigned char[]’ + 252 | u64 fcoe_wwn_from_mac(unsigned char mac[], unsigned int, unsigned int); + | ~~~~~~~~~~~~~~^~~~~ + +Change the type back to what the function definition uses. + +Link: https://lore.kernel.org/r/20210322164702.957810-1-arnd@kernel.org +Fixes: fdd78027fd47 ("[SCSI] fcoe: cleans up libfcoe.h and adds fcoe.h for fcoe module") +Signed-off-by: Arnd Bergmann +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + include/scsi/libfcoe.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h +index e59180264591..004bf0ca8884 100644 +--- a/include/scsi/libfcoe.h ++++ b/include/scsi/libfcoe.h +@@ -256,7 +256,7 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *, + struct fc_frame *); + + /* libfcoe funcs */ +-u64 fcoe_wwn_from_mac(unsigned char mac[], unsigned int, unsigned int); ++u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int); + int fcoe_libfc_config(struct fc_lport *, struct fcoe_ctlr *, + const struct libfc_function_template *, int init_fcp); + u32 fcoe_fc_crc(struct fc_frame *fp); +-- +2.30.2 + diff --git a/queue-4.4/scsi-jazz_esp-add-irq-check.patch b/queue-4.4/scsi-jazz_esp-add-irq-check.patch new file mode 100644 index 00000000000..441aa7622b1 --- /dev/null +++ b/queue-4.4/scsi-jazz_esp-add-irq-check.patch @@ -0,0 +1,41 @@ +From 859c89c6852e66138b71b159ddef1c5757b97e79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:43:23 +0300 +Subject: scsi: jazz_esp: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real +error code. Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/594aa9ae-2215-49f6-f73c-33bd38989912@omprussia.ru +Fixes: 352e921f0dd4 ("[SCSI] jazz_esp: converted to use esp_core") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/jazz_esp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c +index 9aaa74e349cc..65f0dbfc3a45 100644 +--- a/drivers/scsi/jazz_esp.c ++++ b/drivers/scsi/jazz_esp.c +@@ -170,7 +170,9 @@ static int esp_jazz_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp); + if (err < 0) + goto fail_unmap_command_block; +-- +2.30.2 + diff --git a/queue-4.4/scsi-sni_53c710-add-irq-check.patch b/queue-4.4/scsi-sni_53c710-add-irq-check.patch new file mode 100644 index 00000000000..e9d6d54aae0 --- /dev/null +++ b/queue-4.4/scsi-sni_53c710-add-irq-check.patch @@ -0,0 +1,49 @@ +From e60068a1cf2bd2ccf41d22096a5db6675a9517ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:45:12 +0300 +Subject: scsi: sni_53c710: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV +further below). Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/8f4b8fa5-8251-b977-70a1-9099bcb4bb17@omprussia.ru +Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sni_53c710.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c +index b0f5220ae23a..fad68cb028d6 100644 +--- a/drivers/scsi/sni_53c710.c ++++ b/drivers/scsi/sni_53c710.c +@@ -71,6 +71,7 @@ static int snirm710_probe(struct platform_device *dev) + struct NCR_700_Host_Parameters *hostdata; + struct Scsi_Host *host; + struct resource *res; ++ int rc; + + res = platform_get_resource(dev, IORESOURCE_MEM, 0); + if (!res) +@@ -96,7 +97,9 @@ static int snirm710_probe(struct platform_device *dev) + goto out_kfree; + host->this_id = 7; + host->base = base; +- host->irq = platform_get_irq(dev, 0); ++ host->irq = rc = platform_get_irq(dev, 0); ++ if (rc < 0) ++ goto out_put_host; + if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) { + printk(KERN_ERR "snirm710: request_irq failed!\n"); + goto out_put_host; +-- +2.30.2 + diff --git a/queue-4.4/scsi-sun3x_esp-add-irq-check.patch b/queue-4.4/scsi-sun3x_esp-add-irq-check.patch new file mode 100644 index 00000000000..822272ca489 --- /dev/null +++ b/queue-4.4/scsi-sun3x_esp-add-irq-check.patch @@ -0,0 +1,41 @@ +From 8d6a5e53cb290e7b0e2d59f820d28985c5a2a76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 20:44:08 +0300 +Subject: scsi: sun3x_esp: Add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to request_irq() (which takes +*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real +error code. Stop calling request_irq() with the invalid IRQ #s. + +Link: https://lore.kernel.org/r/363eb4c8-a3bf-4dc9-2a9e-90f349030a15@omprussia.ru +Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sun3x_esp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c +index d50c5ed8f428..167ae2d29e47 100644 +--- a/drivers/scsi/sun3x_esp.c ++++ b/drivers/scsi/sun3x_esp.c +@@ -233,7 +233,9 @@ static int esp_sun3x_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs_dma; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, + "SUN3X ESP", esp); + if (err < 0) +-- +2.30.2 + diff --git a/queue-4.4/series b/queue-4.4/series index 1e479d708f6..9ef8414d86a 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -74,3 +74,60 @@ alsa-hda-realtek-re-order-alc269-sony-quirk-table-entries.patch alsa-hda-realtek-remove-redundant-entry-for-alc861-haier-uniwill-devices.patch kvm-s390-split-kvm_s390_real_to_abs.patch usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch +memory-gpmc-fix-out-of-bounds-read-and-dereference-o.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch +arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-1060 +usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch +usb-gadget-pch_udc-check-if-driver-is-present-before.patch +usb-gadget-pch_udc-check-for-dma-mapping-error.patch +crypto-qat-don-t-release-uninitialized-resources.patch +fotg210-udc-fix-dma-on-ep0-for-length-max-packet-siz.patch +fotg210-udc-fix-ep0-in-requests-bigger-than-two-pack.patch +fotg210-udc-remove-a-dubious-condition-leading-to-fo.patch +fotg210-udc-mask-grp2-interrupts-we-don-t-handle.patch +fotg210-udc-don-t-dma-more-than-the-buffer-can-take.patch +fotg210-udc-complete-out-requests-on-short-packets.patch +mtd-require-write-permissions-for-locking-and-badblo.patch +crypto-qat-fix-error-path-in-adf_isr_resource_alloc.patch +staging-rtl8192u-fix-potential-infinite-loop.patch +crypto-qat-fix-a-double-free-in-adf_create_ring.patch +usb-gadget-r8a66597-add-missing-null-check-on-return.patch +usb-cdc-acm-fix-unprivileged-tioccserial.patch +tty-fix-return-value-for-unsupported-ioctls.patch +ttyprintk-add-tty-hangup-callback.patch +media-vivid-fix-assignment-of-dev-fbuf_out_flags.patch +media-omap4iss-return-error-code-when-omap4iss_get-f.patch +media-m88rs6000t-avoid-potential-out-of-bounds-reads.patch +pata_arasan_cf-fix-irq-check.patch +pata_ipx4xx_cf-fix-irq-check.patch +sata_mv-add-irq-checks.patch +ata-libahci_platform-fix-irq-check.patch +scsi-fcoe-fix-mismatched-fcoe_wwn_from_mac-declarati.patch +media-dvb-usb-remote-fix-dvb_usb_nec_rc_key_to_event.patch +scsi-jazz_esp-add-irq-check.patch +scsi-sun3x_esp-add-irq-check.patch +scsi-sni_53c710-add-irq-check.patch +hsi-core-fix-resource-leaks-in-hsi_add_client_from_d.patch +x86-events-amd-iommu-fix-sysfs-type-mismatch.patch +hid-plantronics-workaround-for-double-volume-key-pre.patch +net-lapbether-prevent-racing-when-checking-whether-t.patch +powerpc-prom-mark-identical_pvr_fixup-as-__init.patch +alsa-core-remove-redundant-spin_lock-pair-in-snd_car.patch +nfc-pn533-prevent-potential-memory-corruption.patch +alsa-usb-audio-add-error-checks-for-usb_driver_claim.patch +powerpc-iommu-fix-build-when-neither-pci-or-ibmvio-i.patch +mac80211-bail-out-if-cipher-schemes-are-invalid.patch +mt7601u-fix-always-true-expression.patch +net-thunderx-fix-unintentional-sign-extension-issue.patch +i2c-cadence-add-irq-check.patch +i2c-jz4780-add-irq-check.patch +i2c-sh7760-add-irq-check.patch +powerpc-pseries-extract-host-bridge-from-pci_bus-pri.patch +i2c-sh7760-fix-irq-error-path.patch +mwl8k-fix-a-double-free-in-mwl8k_probe_hw.patch +vsock-vmci-log-once-the-failed-queue-pair-allocation.patch +net-davinci_emac-fix-incorrect-masking-of-tx-and-rx-.patch +ath9k-fix-error-check-in-ath9k_hw_read_revisions-for.patch +powerpc-52xx-fix-an-invalid-asm-expression-addi-used.patch +net-nfc-digital-fix-a-double-free-in-digital_tg_recv.patch +kfifo-fix-ternary-sign-extension-bugs.patch diff --git a/queue-4.4/staging-rtl8192u-fix-potential-infinite-loop.patch b/queue-4.4/staging-rtl8192u-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..70c6ad37e48 --- /dev/null +++ b/queue-4.4/staging-rtl8192u-fix-potential-infinite-loop.patch @@ -0,0 +1,41 @@ +From cd8864d2de2d0dd4ebdba507db6bd807472c7868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 16:03:08 +0100 +Subject: staging: rtl8192u: Fix potential infinite loop + +From: Colin Ian King + +[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ] + +The for-loop iterates with a u8 loop counter i and compares this +with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum +that is a u16 type. There is a potential infinite loop if SlotNum +is larger than the u8 loop counter. Fix this by making the loop +counter the same type as SlotNum. + +Addresses-Coverity: ("Infinite loop") +Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210407150308.496623-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/r8192U_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 1e0d2a33787e..72dabbf19bc7 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -3418,7 +3418,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum, + u32 *TotalRxDataNum) + { + u16 SlotIndex; +- u8 i; ++ u16 i; + + *TotalRxBcnNum = 0; + *TotalRxDataNum = 0; +-- +2.30.2 + diff --git a/queue-4.4/tty-fix-return-value-for-unsupported-ioctls.patch b/queue-4.4/tty-fix-return-value-for-unsupported-ioctls.patch new file mode 100644 index 00000000000..8c7d79f2a29 --- /dev/null +++ b/queue-4.4/tty-fix-return-value-for-unsupported-ioctls.patch @@ -0,0 +1,85 @@ +From a70cc60b89bc1c7265082f04bc27b0712664990e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 11:52:02 +0200 +Subject: tty: fix return value for unsupported ioctls + +From: Johan Hovold + +[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ] + +Drivers should return -ENOTTY ("Inappropriate I/O control operation") +when an ioctl isn't supported, while -EINVAL is used for invalid +arguments. + +Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned +-EINVAL when a tty driver did not implement the corresponding +operations. + +Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a +corresponding Fixes tag below. + +Fixes: d281da7ff6f7 ("tty: Make tiocgicount a handler") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210407095208.31838-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_io.c | 8 ++++---- + include/linux/tty_driver.h | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index dff507cd0250..bdb25b23e8d3 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2762,14 +2762,14 @@ out: + * @p: pointer to result + * + * Obtain the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ + + static int tty_tiocmget(struct tty_struct *tty, int __user *p) + { +- int retval = -EINVAL; ++ int retval = -ENOTTY; + + if (tty->ops->tiocmget) { + retval = tty->ops->tiocmget(tty); +@@ -2787,7 +2787,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p) + * @p: pointer to desired bits + * + * Set the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ +@@ -2799,7 +2799,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd, + unsigned int set, clear, val; + + if (tty->ops->tiocmset == NULL) +- return -EINVAL; ++ return -ENOTTY; + + retval = get_user(val, p); + if (retval) +diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h +index 161052477f77..6d8db1555260 100644 +--- a/include/linux/tty_driver.h ++++ b/include/linux/tty_driver.h +@@ -235,7 +235,7 @@ + * + * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel + * structure to complete. This method is optional and will only be called +- * if provided (otherwise EINVAL will be returned). ++ * if provided (otherwise ENOTTY will be returned). + */ + + #include +-- +2.30.2 + diff --git a/queue-4.4/ttyprintk-add-tty-hangup-callback.patch b/queue-4.4/ttyprintk-add-tty-hangup-callback.patch new file mode 100644 index 00000000000..da65866fcf2 --- /dev/null +++ b/queue-4.4/ttyprintk-add-tty-hangup-callback.patch @@ -0,0 +1,87 @@ +From 376395531b77cc4de68da5ce54091dde9cd4b1a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 09:22:22 +0900 +Subject: ttyprintk: Add TTY hangup callback. + +From: Tetsuo Handa + +[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ] + +syzbot is reporting hung task due to flood of + + tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__, + port->count); + +message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from +decrementing port->count due to tty_hung_up_p() == true. + +---------- +#include +#include +#include +#include +#include + +int main(int argc, char *argv[]) +{ + int i; + int fd[10]; + + for (i = 0; i < 10; i++) + fd[i] = open("/dev/ttyprintk", O_WRONLY); + ioctl(fd[0], TIOCVHANGUP); + for (i = 0; i < 10; i++) + close(fd[i]); + close(open("/dev/ttyprintk", O_WRONLY)); + return 0; +} +---------- + +When TTY hangup happens, port->count needs to be reset via +"struct tty_operations"->hangup callback. + +[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a + +Reported-by: syzbot +Reported-by: syzbot +Tested-by: syzbot +Signed-off-by: Tetsuo Handa +Fixes: 24b4b67d17c308aa ("add ttyprintk driver") +Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/ttyprintk.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c +index e265bace57d7..50031a215a66 100644 +--- a/drivers/char/ttyprintk.c ++++ b/drivers/char/ttyprintk.c +@@ -166,12 +166,23 @@ static int tpk_ioctl(struct tty_struct *tty, + return 0; + } + ++/* ++ * TTY operations hangup function. ++ */ ++static void tpk_hangup(struct tty_struct *tty) ++{ ++ struct ttyprintk_port *tpkp = tty->driver_data; ++ ++ tty_port_hangup(&tpkp->port); ++} ++ + static const struct tty_operations ttyprintk_ops = { + .open = tpk_open, + .close = tpk_close, + .write = tpk_write, + .write_room = tpk_write_room, + .ioctl = tpk_ioctl, ++ .hangup = tpk_hangup, + }; + + static struct tty_port_operations null_ops = { }; +-- +2.30.2 + diff --git a/queue-4.4/usb-cdc-acm-fix-unprivileged-tioccserial.patch b/queue-4.4/usb-cdc-acm-fix-unprivileged-tioccserial.patch new file mode 100644 index 00000000000..393b711b0bc --- /dev/null +++ b/queue-4.4/usb-cdc-acm-fix-unprivileged-tioccserial.patch @@ -0,0 +1,48 @@ +From e6598326c230e61d73193ab499a417dc88adae00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 15:16:01 +0200 +Subject: USB: cdc-acm: fix unprivileged TIOCCSERIAL + +From: Johan Hovold + +[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ] + +TIOCSSERIAL is a horrid, underspecified, legacy interface which for most +serial devices is only useful for setting the close_delay and +closing_wait parameters. + +A non-privileged user has only ever been able to set the since long +deprecated ASYNC_SPD flags and trying to change any other *supported* +feature should result in -EPERM being returned. Setting the current +values for any supported features should return success. + +Fix the cdc-acm implementation which instead indicated that the +TIOCSSERIAL ioctl was not even implemented when a non-privileged user +set the current values. + +Fixes: ba2d8ce9db0a ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)") +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210408131602.27956-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 8c476a785360..0478d55bd283 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -883,8 +883,6 @@ static int set_serial_info(struct acm *acm, + if ((new_serial.close_delay != old_close_delay) || + (new_serial.closing_wait != old_closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; +-- +2.30.2 + diff --git a/queue-4.4/usb-gadget-pch_udc-check-for-dma-mapping-error.patch b/queue-4.4/usb-gadget-pch_udc-check-for-dma-mapping-error.patch new file mode 100644 index 00000000000..841a6dcb14e --- /dev/null +++ b/queue-4.4/usb-gadget-pch_udc-check-for-dma-mapping-error.patch @@ -0,0 +1,39 @@ +From b3c5922c4c336ba99cbdda5fedddee6a85265230 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:22 +0200 +Subject: usb: gadget: pch_udc: Check for DMA mapping error + +From: Andy Shevchenko + +[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ] + +DMA mapping might fail, we have to check it with dma_mapping_error(). +Otherwise DMA-API is not happy: + + DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single] + +Fixes: abab0c67c061 ("usb: pch_udc: Fixed issue which does not work with g_serial") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 152c2ee0ca50..5301de1c5d31 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -3003,7 +3003,7 @@ static int init_dma_pools(struct pch_udc_dev *dev) + dev->dma_addr = dma_map_single(&dev->pdev->dev, dev->ep0out_buf, + UDC_EP0OUT_BUFF_SIZE * 4, + DMA_FROM_DEVICE); +- return 0; ++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr); + } + + static int pch_udc_start(struct usb_gadget *g, +-- +2.30.2 + diff --git a/queue-4.4/usb-gadget-pch_udc-check-if-driver-is-present-before.patch b/queue-4.4/usb-gadget-pch_udc-check-if-driver-is-present-before.patch new file mode 100644 index 00000000000..902e8848235 --- /dev/null +++ b/queue-4.4/usb-gadget-pch_udc-check-if-driver-is-present-before.patch @@ -0,0 +1,99 @@ +From 9c41214438acc11e2da0e7014c14005df352855e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:21 +0200 +Subject: usb: gadget: pch_udc: Check if driver is present before calling + ->setup() + +From: Andy Shevchenko + +[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ] + +Since we have a separate routine for VBUS sense, the interrupt may occur +before gadget driver is present. Hence, ->setup() call may oops the kernel: + +[ 55.245843] BUG: kernel NULL pointer dereference, address: 00000010 +... +[ 55.245843] EIP: pch_udc_isr.cold+0x162/0x33f +... +[ 55.245843] +[ 55.245843] ? pch_udc_svc_data_out+0x160/0x160 + +Check if driver is present before calling ->setup(). + +Fixes: f646cf94520e ("USB device driver of Topcliff PCH") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 6e84b27c14dd..152c2ee0ca50 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -2341,6 +2341,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num) + pch_udc_set_dma(dev, DMA_DIR_RX); + } + ++static int pch_udc_gadget_setup(struct pch_udc_dev *dev) ++ __must_hold(&dev->lock) ++{ ++ int rc; ++ ++ /* In some cases we can get an interrupt before driver gets setup */ ++ if (!dev->driver) ++ return -ESHUTDOWN; ++ ++ spin_unlock(&dev->lock); ++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data); ++ spin_lock(&dev->lock); ++ return rc; ++} ++ + /** + * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts + * @dev: Reference to the device structure +@@ -2412,15 +2427,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev) + dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep; + else /* OUT */ + dev->gadget.ep0 = &ep->ep; +- spin_lock(&dev->lock); + /* If Mass storage Reset */ + if ((dev->setup_data.bRequestType == 0x21) && + (dev->setup_data.bRequest == 0xFF)) + dev->prot_stall = 0; + /* call gadget with setup data received */ +- setup_supported = dev->driver->setup(&dev->gadget, +- &dev->setup_data); +- spin_unlock(&dev->lock); ++ setup_supported = pch_udc_gadget_setup(dev); + + if (dev->setup_data.bRequestType & USB_DIR_IN) { + ep->td_data->status = (ep->td_data->status & +@@ -2673,9 +2685,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev) + dev->ep[i].halted = 0; + } + dev->stall = 0; +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +@@ -2710,9 +2720,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev) + dev->stall = 0; + + /* call gadget zero with setup data received */ +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +-- +2.30.2 + diff --git a/queue-4.4/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch b/queue-4.4/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch new file mode 100644 index 00000000000..c63fe2e5aa9 --- /dev/null +++ b/queue-4.4/usb-gadget-pch_udc-replace-cpu_to_le32-by-lower_32_b.patch @@ -0,0 +1,42 @@ +From 5742606d72809d9d3a3fcda50550a0ec94b581ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 17:36:20 +0200 +Subject: usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() + +From: Andy Shevchenko + +[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ] + +Either way ~0 will be in the correct byte order, hence +replace cpu_to_le32() by lower_32_bits(). Moreover, +it makes sparse happy, otherwise it complains: + +.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types) +.../pch_udc.c:1813:27: expected unsigned int [usertype] dataptr +.../pch_udc.c:1813:27: got restricted __le32 [usertype] + +Fixes: f646cf94520e ("USB device driver of Topcliff PCH") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/pch_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index f4b81e8f2272..6e84b27c14dd 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -1797,7 +1797,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep, + } + /* prevent from using desc. - set HOST BUSY */ + dma_desc->status |= PCH_UDC_BS_HST_BSY; +- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID); ++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID); + req->td_data = dma_desc; + req->td_data_last = dma_desc; + req->chain_len = 1; +-- +2.30.2 + diff --git a/queue-4.4/usb-gadget-r8a66597-add-missing-null-check-on-return.patch b/queue-4.4/usb-gadget-r8a66597-add-missing-null-check-on-return.patch new file mode 100644 index 00000000000..fbe406d7399 --- /dev/null +++ b/queue-4.4/usb-gadget-r8a66597-add-missing-null-check-on-return.patch @@ -0,0 +1,39 @@ +From 333eab3543ad784cdd50af623e1ec22870e502b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 19:45:10 +0100 +Subject: usb: gadget: r8a66597: Add missing null check on return from + platform_get_resource + +From: Colin Ian King + +[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ] + +The call to platform_get_resource can potentially return a NULL pointer +on failure, so add this check and return -EINVAL if it fails. + +Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.") +Signed-off-by: Colin Ian King +Addresses-Coverity: ("Dereference null return") +Link: https://lore.kernel.org/r/20210406184510.433497-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index e34094647603..4eb8e181763d 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1867,6 +1867,8 @@ static int r8a66597_probe(struct platform_device *pdev) + return PTR_ERR(reg); + + ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0); ++ if (!ires) ++ return -EINVAL; + irq = ires->start; + irq_trigger = ires->flags & IRQF_TRIGGER_MASK; + +-- +2.30.2 + diff --git a/queue-4.4/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch b/queue-4.4/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch new file mode 100644 index 00000000000..c651a84fd45 --- /dev/null +++ b/queue-4.4/vsock-vmci-log-once-the-failed-queue-pair-allocation.patch @@ -0,0 +1,50 @@ +From 22924d5e9fbe40f3fa9dade3e53bb671a5126979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 12:44:16 +0200 +Subject: vsock/vmci: log once the failed queue pair allocation + +From: Stefano Garzarella + +[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ] + +VMCI feature is not supported in conjunction with the vSphere Fault +Tolerance (FT) feature. + +VMware Tools can repeatedly try to create a vsock connection. If FT is +enabled the kernel logs is flooded with the following messages: + + qp_alloc_hypercall result = -20 + Could not attach to queue pair with -20 + +"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 +("VMCI: Stop log spew when qp allocation isn't possible"), but "Could +not attach to queue pair with -20" is still there flooding the log. + +Since the error message can be useful in some cases, print it only once. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Signed-off-by: Stefano Garzarella +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 217810674c35..1f3f34b56840 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -593,8 +593,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, + peer, flags, VMCI_NO_PRIVILEGE_FLAGS); + out: + if (err < 0) { +- pr_err("Could not attach to queue pair with %d\n", +- err); ++ pr_err_once("Could not attach to queue pair with %d\n", err); + err = vmci_transport_error_to_vsock_error(err); + } + +-- +2.30.2 + diff --git a/queue-4.4/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch b/queue-4.4/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch new file mode 100644 index 00000000000..86083b53be2 --- /dev/null +++ b/queue-4.4/x86-events-amd-iommu-fix-sysfs-type-mismatch.patch @@ -0,0 +1,55 @@ +From 0c1b665ea87c4b3ccdb15f149b08680363bc5373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 17:11:11 -0700 +Subject: x86/events/amd/iommu: Fix sysfs type mismatch + +From: Nathan Chancellor + +[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ] + +dev_attr_show() calls _iommu_event_show() via an indirect call but +_iommu_event_show()'s type does not currently match the type of the +show() member in 'struct device_attribute', resulting in a Control Flow +Integrity violation. + +$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit +csource=0x0a + +$ dmesg | grep "CFI failure" +[ 3526.735140] CFI failure (target: _iommu_event_show...): + +Change _iommu_event_show() and 'struct amd_iommu_event_desc' to +'struct device_attribute' so that there is no more CFI violation. + +Fixes: 7be6296fdd75 ("perf/x86/amd: AMD IOMMU Performance Counter PERF uncore PMU implementation") +Signed-off-by: Nathan Chancellor +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210415001112.3024673-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/perf_event_amd_iommu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/cpu/perf_event_amd_iommu.c b/arch/x86/kernel/cpu/perf_event_amd_iommu.c +index 97242a9242bd..ec0bfbab7265 100644 +--- a/arch/x86/kernel/cpu/perf_event_amd_iommu.c ++++ b/arch/x86/kernel/cpu/perf_event_amd_iommu.c +@@ -80,12 +80,12 @@ static struct attribute_group amd_iommu_format_group = { + * sysfs events attributes + *---------------------------------------------*/ + struct amd_iommu_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *event; + }; + +-static ssize_t _iommu_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++static ssize_t _iommu_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct amd_iommu_event_desc *event = + container_of(attr, struct amd_iommu_event_desc, attr); +-- +2.30.2 +