From: Greg Kroah-Hartman Date: Wed, 9 Dec 2020 11:04:30 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v5.9.14~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=26c562036b93843234a1c8c6a545a6c9bee3f7b0;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: i2c-imx-check-for-i2sr_ial-after-every-byte.patch i2c-imx-fix-reset-of-i2sr_ial-flag.patch speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch --- diff --git a/queue-5.4/i2c-imx-check-for-i2sr_ial-after-every-byte.patch b/queue-5.4/i2c-imx-check-for-i2sr_ial-after-every-byte.patch new file mode 100644 index 00000000000..a017b398e57 --- /dev/null +++ b/queue-5.4/i2c-imx-check-for-i2sr_ial-after-every-byte.patch @@ -0,0 +1,46 @@ +From 1de67a3dee7a279ebe4d892b359fe3696938ec15 Mon Sep 17 00:00:00 2001 +From: Christian Eggers +Date: Fri, 9 Oct 2020 13:03:19 +0200 +Subject: i2c: imx: Check for I2SR_IAL after every byte + +From: Christian Eggers + +commit 1de67a3dee7a279ebe4d892b359fe3696938ec15 upstream. + +Arbitration Lost (IAL) can happen after every single byte transfer. If +arbitration is lost, the I2C hardware will autonomously switch from +master mode to slave. If a transfer is not aborted in this state, +consecutive transfers will not be executed by the hardware and will +timeout. + +Signed-off-by: Christian Eggers +Tested (not extensively) on Vybrid VF500 (Toradex VF50): +Tested-by: Krzysztof Kozlowski +Acked-by: Oleksij Rempel +Cc: stable@vger.kernel.org +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-imx.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -470,6 +470,16 @@ static int i2c_imx_trx_complete(struct i + dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__); + return -ETIMEDOUT; + } ++ ++ /* check for arbitration lost */ ++ if (i2c_imx->i2csr & I2SR_IAL) { ++ dev_dbg(&i2c_imx->adapter.dev, "<%s> Arbitration lost\n", __func__); ++ i2c_imx_clear_irq(i2c_imx, I2SR_IAL); ++ ++ i2c_imx->i2csr = 0; ++ return -EAGAIN; ++ } ++ + dev_dbg(&i2c_imx->adapter.dev, "<%s> TRX complete\n", __func__); + i2c_imx->i2csr = 0; + return 0; diff --git a/queue-5.4/i2c-imx-fix-reset-of-i2sr_ial-flag.patch b/queue-5.4/i2c-imx-fix-reset-of-i2sr_ial-flag.patch new file mode 100644 index 00000000000..1f787aa1f0c --- /dev/null +++ b/queue-5.4/i2c-imx-fix-reset-of-i2sr_ial-flag.patch @@ -0,0 +1,72 @@ +From 384a9565f70a876c2e78e58c5ca0bbf0547e4f6d Mon Sep 17 00:00:00 2001 +From: Christian Eggers +Date: Fri, 9 Oct 2020 13:03:18 +0200 +Subject: i2c: imx: Fix reset of I2SR_IAL flag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Eggers + +commit 384a9565f70a876c2e78e58c5ca0bbf0547e4f6d upstream. + +According to the "VFxxx Controller Reference Manual" (and the comment +block starting at line 97), Vybrid requires writing a one for clearing +an interrupt flag. Syncing the method for clearing I2SR_IIF in +i2c_imx_isr(). + +Signed-off-by: Christian Eggers +Fixes: 4b775022f6fd ("i2c: imx: add struct to hold more configurable quirks") +Reviewed-by: Uwe Kleine-König +Acked-by: Oleksij Rempel +Cc: stable@vger.kernel.org +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-imx.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -414,6 +414,19 @@ static void i2c_imx_dma_free(struct imx_ + dma->chan_using = NULL; + } + ++static void i2c_imx_clear_irq(struct imx_i2c_struct *i2c_imx, unsigned int bits) ++{ ++ unsigned int temp; ++ ++ /* ++ * i2sr_clr_opcode is the value to clear all interrupts. Here we want to ++ * clear only , so we write ~i2sr_clr_opcode with just ++ * toggled. This is required because i.MX needs W0C and Vybrid uses W1C. ++ */ ++ temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits; ++ imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR); ++} ++ + static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy) + { + unsigned long orig_jiffies = jiffies; +@@ -426,8 +439,7 @@ static int i2c_imx_bus_busy(struct imx_i + + /* check for arbitration lost */ + if (temp & I2SR_IAL) { +- temp &= ~I2SR_IAL; +- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR); ++ i2c_imx_clear_irq(i2c_imx, I2SR_IAL); + return -EAGAIN; + } + +@@ -599,9 +611,7 @@ static irqreturn_t i2c_imx_isr(int irq, + if (temp & I2SR_IIF) { + /* save status register */ + i2c_imx->i2csr = temp; +- temp &= ~I2SR_IIF; +- temp |= (i2c_imx->hwdata->i2sr_clr_opcode & I2SR_IIF); +- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR); ++ i2c_imx_clear_irq(i2c_imx, I2SR_IIF); + wake_up(&i2c_imx->queue); + return IRQ_HANDLED; + } diff --git a/queue-5.4/series b/queue-5.4/series index b51f436d06d..958f282b55b 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -33,3 +33,7 @@ x86-uprobes-do-not-use-prefixes.nbytes-when-looping-over-prefixes.bytes.patch coredump-fix-core_pattern-parse-error.patch mm-list_lru-set-shrinker-map-bit-when-child-nr_items-is-not-zero.patch mm-swapfile-do-not-sleep-with-a-spin-lock-held.patch +speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch +i2c-imx-fix-reset-of-i2sr_ial-flag.patch +i2c-imx-check-for-i2sr_ial-after-every-byte.patch +spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch diff --git a/queue-5.4/speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch b/queue-5.4/speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch new file mode 100644 index 00000000000..e6d56b5b9aa --- /dev/null +++ b/queue-5.4/speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch @@ -0,0 +1,93 @@ +From f0992098cadb4c9c6a00703b66cafe604e178fea Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Sun, 29 Nov 2020 20:35:23 +0100 +Subject: speakup: Reject setting the speakup line discipline outside of speakup + +From: Samuel Thibault + +commit f0992098cadb4c9c6a00703b66cafe604e178fea upstream. + +Speakup exposing a line discipline allows userland to try to use it, +while it is deemed to be useless, and thus uselessly exposes potential +bugs. One of them is simply that in such a case if the line sends data, +spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth +is NULL. + +This change restricts the use of the speakup line discipline to +speakup drivers, thus avoiding such kind of issues altogether. + +Cc: stable@vger.kernel.org +Reported-by: Shisong Qin +Signed-off-by: Samuel Thibault +Tested-by: Shisong Qin +Link: https://lore.kernel.org/r/20201129193523.hm3f6n5xrn6fiyyc@function +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/staging/speakup/spk_ttyio.c | 37 ++++++++++++++++++++++-------------- + 1 file changed, 23 insertions(+), 14 deletions(-) + +--- a/drivers/staging/speakup/spk_ttyio.c ++++ b/drivers/staging/speakup/spk_ttyio.c +@@ -47,27 +47,20 @@ static int spk_ttyio_ldisc_open(struct t + { + struct spk_ldisc_data *ldisc_data; + ++ if (tty != speakup_tty) ++ /* Somebody tried to use this line discipline outside speakup */ ++ return -ENODEV; ++ + if (!tty->ops->write) + return -EOPNOTSUPP; + +- mutex_lock(&speakup_tty_mutex); +- if (speakup_tty) { +- mutex_unlock(&speakup_tty_mutex); +- return -EBUSY; +- } +- speakup_tty = tty; +- + ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL); +- if (!ldisc_data) { +- speakup_tty = NULL; +- mutex_unlock(&speakup_tty_mutex); ++ if (!ldisc_data) + return -ENOMEM; +- } + + init_completion(&ldisc_data->completion); + ldisc_data->buf_free = true; +- speakup_tty->disc_data = ldisc_data; +- mutex_unlock(&speakup_tty_mutex); ++ tty->disc_data = ldisc_data; + + return 0; + } +@@ -189,9 +182,25 @@ static int spk_ttyio_initialise_ldisc(st + + tty_unlock(tty); + ++ mutex_lock(&speakup_tty_mutex); ++ speakup_tty = tty; + ret = tty_set_ldisc(tty, N_SPEAKUP); + if (ret) +- pr_err("speakup: Failed to set N_SPEAKUP on tty\n"); ++ speakup_tty = NULL; ++ mutex_unlock(&speakup_tty_mutex); ++ ++ if (!ret) ++ /* Success */ ++ return 0; ++ ++ pr_err("speakup: Failed to set N_SPEAKUP on tty\n"); ++ ++ tty_lock(tty); ++ if (tty->ops->close) ++ tty->ops->close(tty, NULL); ++ tty_unlock(tty); ++ ++ tty_kclose(tty); + + return ret; + } diff --git a/queue-5.4/spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch b/queue-5.4/spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch new file mode 100644 index 00000000000..ccf5947009f --- /dev/null +++ b/queue-5.4/spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Dec 9 12:02:52 PM CET 2020 +From: Lukas Wunner +Date: Sun, 6 Dec 2020 14:10:00 +0100 +Subject: spi: bcm2835: Release the DMA channel if probe fails after dma_init +To: Greg Kroah-Hartman +Cc: Mark Brown , Sudip Mukherjee , stable@vger.kernel.org +Message-ID: <298055a3252640ac67dbf1dbf1452678133fa515.1607260117.git.lukas@wunner.de> + +From: Peter Ujfalusi + +[ Upstream commit 666224b43b4bd4612ce3b758c038f9bc5c5e3fcb ] + +The DMA channel was not released if either devm_request_irq() or +devm_spi_register_controller() failed. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Nicolas Saenz Julienne +Link: https://lore.kernel.org/r/20191212135550.4634-3-peter.ujfalusi@ti.com +Signed-off-by: Mark Brown +[lukas: backport to 5.4-stable] +Signed-off-by: Lukas Wunner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm2835.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -1310,21 +1310,22 @@ static int bcm2835_spi_probe(struct plat + dev_name(&pdev->dev), ctlr); + if (err) { + dev_err(&pdev->dev, "could not request IRQ: %d\n", err); +- goto out_clk_disable; ++ goto out_dma_release; + } + + err = spi_register_controller(ctlr); + if (err) { + dev_err(&pdev->dev, "could not register SPI controller: %d\n", + err); +- goto out_clk_disable; ++ goto out_dma_release; + } + + bcm2835_debugfs_create(bs, dev_name(&pdev->dev)); + + return 0; + +-out_clk_disable: ++out_dma_release: ++ bcm2835_dma_release(ctlr, bs); + clk_disable_unprepare(bs->clk); + return err; + }