From: Greg Kroah-Hartman Date: Mon, 23 Nov 2020 09:33:19 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.246~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3d0d3800a9a75e4d221981fd7a9e6f6c01150cc8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch iio-adc-mediatek-fix-unset-field.patch regulator-avoid-resolve_supply-infinite-recursion.patch regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch regulator-workaround-self-referent-regulators.patch spi-bcm2835aux-fix-use-after-free-on-unbind.patch spi-introduce-device-managed-spi-controller-allocation.patch spi-lpspi-fix-use-after-free-on-unbind.patch spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch --- diff --git a/queue-5.4/ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch b/queue-5.4/ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch new file mode 100644 index 00000000000..883c4a8c9cc --- /dev/null +++ b/queue-5.4/ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch @@ -0,0 +1,40 @@ +From f902b216501094495ff75834035656e8119c537f Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 18 Nov 2020 16:30:32 +0100 +Subject: ext4: fix bogus warning in ext4_update_dx_flag() + +From: Jan Kara + +commit f902b216501094495ff75834035656e8119c537f upstream. + +The idea of the warning in ext4_update_dx_flag() is that we should warn +when we are clearing EXT4_INODE_INDEX on a filesystem with metadata +checksums enabled since after clearing the flag, checksums for internal +htree nodes will become invalid. So there's no need to warn (or actually +do anything) when EXT4_INODE_INDEX is not set. + +Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz +Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs") +Reported-by: Eric Biggers +Reviewed-by: Eric Biggers +Signed-off-by: Jan Kara +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/ext4.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -2496,7 +2496,8 @@ void ext4_insert_dentry(struct inode *in + struct ext4_filename *fname); + static inline void ext4_update_dx_flag(struct inode *inode) + { +- if (!ext4_has_feature_dir_index(inode->i_sb)) { ++ if (!ext4_has_feature_dir_index(inode->i_sb) && ++ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) { + /* ext4_iget() should have caught this... */ + WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb)); + ext4_clear_inode_flag(inode, EXT4_INODE_INDEX); diff --git a/queue-5.4/iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch b/queue-5.4/iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch new file mode 100644 index 00000000000..0c06ade9ff0 --- /dev/null +++ b/queue-5.4/iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch @@ -0,0 +1,113 @@ +From e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 10 Nov 2020 14:38:35 +0100 +Subject: iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode + +From: Hans de Goede + +commit e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 upstream. + +Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s +to allow the OS to determine the angle between the display and the base +of the device, so that the OS can determine if the 2-in-1 is in laptop +or in tablet-mode. + +On Windows both accelerometers are read by a special HingeAngleService +process; and this process calls a DSM (Device Specific Method) on the +ACPI KIOX010A device node for the sensor in the display, to let the +embedded-controller (EC) know about the mode so that it can disable the +kbd and touchpad to avoid spurious input while folded into tablet-mode. + +This notifying of the EC is problematic because sometimes the EC comes up +thinking that device is in tablet-mode and the kbd and touchpad do not +work. This happens for example on Irbis NB111 devices after a suspend / +resume cycle (after a complete battery drain / hard reset without having +booted Windows at least once). Other 2-in-1s which are likely affected +too are e.g. the Teclast F5 and F6 series. + +The kxcjk-1013 driver may seem like a strange place to deal with this, +but since it is *the* driver for the ACPI KIOX010A device, it is also +the driver which has access to the ACPI handle needed by the DSM. + +Add support for calling the DSM and on probe unconditionally tell the +EC that the device is laptop mode, fixing the kbd and touchpad sometimes +not working. + +Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID") +Reported-and-tested-by: russianneuromancer +Signed-off-by: Hans de Goede +Cc: +Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/kxcjk-1013.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -129,6 +129,7 @@ enum kx_chipset { + enum kx_acpi_type { + ACPI_GENERIC, + ACPI_SMO8500, ++ ACPI_KIOX010A, + }; + + struct kxcjk1013_data { +@@ -274,6 +275,32 @@ static const struct { + {19163, 1, 0}, + {38326, 0, 1} }; + ++#ifdef CONFIG_ACPI ++enum kiox010a_fn_index { ++ KIOX010A_SET_LAPTOP_MODE = 1, ++ KIOX010A_SET_TABLET_MODE = 2, ++}; ++ ++static int kiox010a_dsm(struct device *dev, int fn_index) ++{ ++ acpi_handle handle = ACPI_HANDLE(dev); ++ guid_t kiox010a_dsm_guid; ++ union acpi_object *obj; ++ ++ if (!handle) ++ return -ENODEV; ++ ++ guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid); ++ ++ obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL); ++ if (!obj) ++ return -EIO; ++ ++ ACPI_FREE(obj); ++ return 0; ++} ++#endif ++ + static int kxcjk1013_set_mode(struct kxcjk1013_data *data, + enum kxcjk1013_mode mode) + { +@@ -351,6 +378,13 @@ static int kxcjk1013_chip_init(struct kx + { + int ret; + ++#ifdef CONFIG_ACPI ++ if (data->acpi_type == ACPI_KIOX010A) { ++ /* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */ ++ kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE); ++ } ++#endif ++ + ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I); + if (ret < 0) { + dev_err(&data->client->dev, "Error reading who_am_i\n"); +@@ -1248,6 +1282,8 @@ static const char *kxcjk1013_match_acpi_ + + if (strcmp(id->id, "SMO8500") == 0) + *acpi_type = ACPI_SMO8500; ++ else if (strcmp(id->id, "KIOX010A") == 0) ++ *acpi_type = ACPI_KIOX010A; + + *chipset = (enum kx_chipset)id->driver_data; + diff --git a/queue-5.4/iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch b/queue-5.4/iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch new file mode 100644 index 00000000000..6c196bd21e6 --- /dev/null +++ b/queue-5.4/iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch @@ -0,0 +1,87 @@ +From 11e94f28c3de35d5ad1ac6a242a5b30f4378991a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 10 Nov 2020 14:38:34 +0100 +Subject: iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum + +From: Hans de Goede + +commit 11e94f28c3de35d5ad1ac6a242a5b30f4378991a upstream. + +Replace the boolean is_smo8500_device variable with an acpi_type enum. + +For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a +preparation patch for adding special handling for the KIOX010A ACPI HID, +which will add a ACPI_KIOX010A acpi_type to the introduced enum. + +For stable as needed as precursor for next patch. + +Signed-off-by: Hans de Goede +Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID") +Cc: +Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/kxcjk-1013.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -126,6 +126,11 @@ enum kx_chipset { + KX_MAX_CHIPS /* this must be last */ + }; + ++enum kx_acpi_type { ++ ACPI_GENERIC, ++ ACPI_SMO8500, ++}; ++ + struct kxcjk1013_data { + struct i2c_client *client; + struct iio_trigger *dready_trig; +@@ -142,7 +147,7 @@ struct kxcjk1013_data { + bool motion_trigger_on; + int64_t timestamp; + enum kx_chipset chipset; +- bool is_smo8500_device; ++ enum kx_acpi_type acpi_type; + }; + + enum kxcjk1013_axis { +@@ -1233,7 +1238,7 @@ static irqreturn_t kxcjk1013_data_rdy_tr + + static const char *kxcjk1013_match_acpi_device(struct device *dev, + enum kx_chipset *chipset, +- bool *is_smo8500_device) ++ enum kx_acpi_type *acpi_type) + { + const struct acpi_device_id *id; + +@@ -1242,7 +1247,7 @@ static const char *kxcjk1013_match_acpi_ + return NULL; + + if (strcmp(id->id, "SMO8500") == 0) +- *is_smo8500_device = true; ++ *acpi_type = ACPI_SMO8500; + + *chipset = (enum kx_chipset)id->driver_data; + +@@ -1278,7 +1283,7 @@ static int kxcjk1013_probe(struct i2c_cl + } else if (ACPI_HANDLE(&client->dev)) { + name = kxcjk1013_match_acpi_device(&client->dev, + &data->chipset, +- &data->is_smo8500_device); ++ &data->acpi_type); + } else + return -ENODEV; + +@@ -1296,7 +1301,7 @@ static int kxcjk1013_probe(struct i2c_cl + indio_dev->modes = INDIO_DIRECT_MODE; + indio_dev->info = &kxcjk1013_info; + +- if (client->irq > 0 && !data->is_smo8500_device) { ++ if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) { + ret = devm_request_threaded_irq(&client->dev, client->irq, + kxcjk1013_data_rdy_trig_poll, + kxcjk1013_event_handler, diff --git a/queue-5.4/iio-adc-mediatek-fix-unset-field.patch b/queue-5.4/iio-adc-mediatek-fix-unset-field.patch new file mode 100644 index 00000000000..9057121d18e --- /dev/null +++ b/queue-5.4/iio-adc-mediatek-fix-unset-field.patch @@ -0,0 +1,48 @@ +From 15207a92e019803d62687455d8aa2ff9eb3dc82c Mon Sep 17 00:00:00 2001 +From: Fabien Parent +Date: Sun, 18 Oct 2020 21:46:44 +0200 +Subject: iio: adc: mediatek: fix unset field + +From: Fabien Parent + +commit 15207a92e019803d62687455d8aa2ff9eb3dc82c upstream. + +dev_comp field is used in a couple of places but it is never set. This +results in kernel oops when dereferencing a NULL pointer. Set the +`dev_comp` field correctly in the probe function. + +Fixes: 6d97024dce23 ("iio: adc: mediatek: mt6577-auxadc, add mt6765 support") +Signed-off-by: Fabien Parent +Reviewed-by: Matthias Brugger +Cc: +Link: https://lore.kernel.org/r/20201018194644.3366846-1-fparent@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/mt6577_auxadc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/mt6577_auxadc.c ++++ b/drivers/iio/adc/mt6577_auxadc.c +@@ -9,9 +9,9 @@ + #include + #include + #include +-#include +-#include ++#include + #include ++#include + #include + #include + #include +@@ -279,6 +279,8 @@ static int mt6577_auxadc_probe(struct pl + goto err_disable_clk; + } + ++ adc_dev->dev_comp = device_get_match_data(&pdev->dev); ++ + mutex_init(&adc_dev->lock); + + mt6577_auxadc_mod_reg(adc_dev->reg_base + MT6577_AUXADC_MISC, diff --git a/queue-5.4/regulator-avoid-resolve_supply-infinite-recursion.patch b/queue-5.4/regulator-avoid-resolve_supply-infinite-recursion.patch new file mode 100644 index 00000000000..cd9b0b847ae --- /dev/null +++ b/queue-5.4/regulator-avoid-resolve_supply-infinite-recursion.patch @@ -0,0 +1,45 @@ +From 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Fri, 13 Nov 2020 01:20:28 +0100 +Subject: regulator: avoid resolve_supply() infinite recursion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 upstream. + +When a regulator's name equals its supply's name the +regulator_resolve_supply() recurses indefinitely. Add a check +so that debugging the problem is easier. The "fixed" commit +just exposed the problem. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Reported-by: Ahmad Fatoum +Signed-off-by: Michał Mirosław +Tested-by: Ahmad Fatoum # stpmic1 +Link: https://lore.kernel.org/r/c6171057cfc0896f950c4d8cb82df0f9f1b89ad9.1605226675.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1800,6 +1800,12 @@ static int regulator_resolve_supply(stru + } + } + ++ if (r == rdev) { ++ dev_err(dev, "Supply for %s (%s) resolved to itself\n", ++ rdev->desc->name, rdev->supply_name); ++ return -EINVAL; ++ } ++ + /* + * If the supply's parent device is not the same as the + * regulator's parent device, then ensure the parent device diff --git a/queue-5.4/regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch b/queue-5.4/regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch new file mode 100644 index 00000000000..c91b14f2c1e --- /dev/null +++ b/queue-5.4/regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch @@ -0,0 +1,105 @@ +From 57a6ad482af256b2a13de14194fb8f67c1a65f10 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Fri, 13 Nov 2020 01:20:27 +0100 +Subject: regulator: fix memory leak with repeated set_machine_constraints() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 57a6ad482af256b2a13de14194fb8f67c1a65f10 upstream. + +Fixed commit introduced a possible second call to +set_machine_constraints() and that allocates memory for +rdev->constraints. Move the allocation to the caller so +it's easier to manage and done once. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Signed-off-by: Michał Mirosław +Tested-by: Ahmad Fatoum # stpmic1 +Link: https://lore.kernel.org/r/78c3d4016cebc08d441aad18cb924b4e4d9cf9df.1605226675.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1275,7 +1275,6 @@ static int _regulator_do_enable(struct r + /** + * set_machine_constraints - sets regulator constraints + * @rdev: regulator source +- * @constraints: constraints to apply + * + * Allows platform initialisation code to define and constrain + * regulator circuits e.g. valid voltage/current ranges, etc. NOTE: +@@ -1283,21 +1282,11 @@ static int _regulator_do_enable(struct r + * regulator operations to proceed i.e. set_voltage, set_current_limit, + * set_mode. + */ +-static int set_machine_constraints(struct regulator_dev *rdev, +- const struct regulation_constraints *constraints) ++static int set_machine_constraints(struct regulator_dev *rdev) + { + int ret = 0; + const struct regulator_ops *ops = rdev->desc->ops; + +- if (constraints) +- rdev->constraints = kmemdup(constraints, sizeof(*constraints), +- GFP_KERNEL); +- else +- rdev->constraints = kzalloc(sizeof(*constraints), +- GFP_KERNEL); +- if (!rdev->constraints) +- return -ENOMEM; +- + ret = machine_constraints_voltage(rdev, rdev->constraints); + if (ret != 0) + return ret; +@@ -5014,7 +5003,6 @@ struct regulator_dev * + regulator_register(const struct regulator_desc *regulator_desc, + const struct regulator_config *cfg) + { +- const struct regulation_constraints *constraints = NULL; + const struct regulator_init_data *init_data; + struct regulator_config *config = NULL; + static atomic_t regulator_no = ATOMIC_INIT(-1); +@@ -5153,14 +5141,23 @@ regulator_register(const struct regulato + + /* set regulator constraints */ + if (init_data) +- constraints = &init_data->constraints; ++ rdev->constraints = kmemdup(&init_data->constraints, ++ sizeof(*rdev->constraints), ++ GFP_KERNEL); ++ else ++ rdev->constraints = kzalloc(sizeof(*rdev->constraints), ++ GFP_KERNEL); ++ if (!rdev->constraints) { ++ ret = -ENOMEM; ++ goto wash; ++ } + + if (init_data && init_data->supply_regulator) + rdev->supply_name = init_data->supply_regulator; + else if (regulator_desc->supply_name) + rdev->supply_name = regulator_desc->supply_name; + +- ret = set_machine_constraints(rdev, constraints); ++ ret = set_machine_constraints(rdev); + if (ret == -EPROBE_DEFER) { + /* Regulator might be in bypass mode and so needs its supply + * to set the constraints */ +@@ -5169,7 +5166,7 @@ regulator_register(const struct regulato + * that is just being created */ + ret = regulator_resolve_supply(rdev); + if (!ret) +- ret = set_machine_constraints(rdev, constraints); ++ ret = set_machine_constraints(rdev); + else + rdev_dbg(rdev, "unable to resolve supply early: %pe\n", + ERR_PTR(ret)); diff --git a/queue-5.4/regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch b/queue-5.4/regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch new file mode 100644 index 00000000000..318b93e8611 --- /dev/null +++ b/queue-5.4/regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch @@ -0,0 +1,48 @@ +From 365ec8b61689bd64d6a61e129e0319bf71336407 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Tue, 10 Nov 2020 18:41:13 +0100 +Subject: regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} + +From: Sean Nyekjaer + +commit 365ec8b61689bd64d6a61e129e0319bf71336407 upstream. + +Limit the fsl,pfuze-support-disable-sw to the pfuze100 and pfuze200 +variants. +When enabling fsl,pfuze-support-disable-sw and using a pfuze3000 or +pfuze3001, the driver would choose pfuze100_sw_disable_regulator_ops +instead of the newly introduced and correct pfuze3000_sw_regulator_ops. + +Signed-off-by: Sean Nyekjaer +Fixes: 6f1cf5257acc ("regualtor: pfuze100: correct sw1a/sw2 on pfuze3000") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20201110174113.2066534-1-sean@geanix.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/pfuze100-regulator.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -833,11 +833,14 @@ static int pfuze100_regulator_probe(stru + * the switched regulator till yet. + */ + if (pfuze_chip->flags & PFUZE_FLAG_DISABLE_SW) { +- if (pfuze_chip->regulator_descs[i].sw_reg) { +- desc->ops = &pfuze100_sw_disable_regulator_ops; +- desc->enable_val = 0x8; +- desc->disable_val = 0x0; +- desc->enable_time = 500; ++ if (pfuze_chip->chip_id == PFUZE100 || ++ pfuze_chip->chip_id == PFUZE200) { ++ if (pfuze_chip->regulator_descs[i].sw_reg) { ++ desc->ops = &pfuze100_sw_disable_regulator_ops; ++ desc->enable_val = 0x8; ++ desc->disable_val = 0x0; ++ desc->enable_time = 500; ++ } + } + } + diff --git a/queue-5.4/regulator-workaround-self-referent-regulators.patch b/queue-5.4/regulator-workaround-self-referent-regulators.patch new file mode 100644 index 00000000000..02b61c1c20b --- /dev/null +++ b/queue-5.4/regulator-workaround-self-referent-regulators.patch @@ -0,0 +1,44 @@ +From f5c042b23f7429e5c2ac987b01a31c69059a978b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Fri, 13 Nov 2020 01:20:28 +0100 +Subject: regulator: workaround self-referent regulators +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit f5c042b23f7429e5c2ac987b01a31c69059a978b upstream. + +Workaround regulators whose supply name happens to be the same as its +own name. This fixes boards that used to work before the early supply +resolving was removed. The error message is left in place so that +offending drivers can be detected. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Reported-by: Ahmad Fatoum +Signed-off-by: Michał Mirosław +Tested-by: Ahmad Fatoum # stpmic1 +Link: https://lore.kernel.org/r/d703acde2a93100c3c7a81059d716c50ad1b1f52.1605226675.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1803,7 +1803,10 @@ static int regulator_resolve_supply(stru + if (r == rdev) { + dev_err(dev, "Supply for %s (%s) resolved to itself\n", + rdev->desc->name, rdev->supply_name); +- return -EINVAL; ++ if (!have_full_constraints()) ++ return -EINVAL; ++ r = dummy_regulator_rdev; ++ get_device(&r->dev); + } + + /* diff --git a/queue-5.4/series b/queue-5.4/series index 4c163718dec..9b64d898207 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -126,3 +126,15 @@ hid-logitech-dj-fix-an-error-in-mse_bluetooth_descriptor.patch efivarfs-fix-memory-leak-in-efivarfs_create.patch staging-rtl8723bs-add-024c-0627-to-the-list-of-sdio-device-ids.patch iio-light-fix-kconfig-dependency-bug-for-vcnl4035.patch +ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch +iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch +iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch +iio-adc-mediatek-fix-unset-field.patch +spi-lpspi-fix-use-after-free-on-unbind.patch +spi-introduce-device-managed-spi-controller-allocation.patch +spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch +spi-bcm2835aux-fix-use-after-free-on-unbind.patch +regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch +regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch +regulator-avoid-resolve_supply-infinite-recursion.patch +regulator-workaround-self-referent-regulators.patch diff --git a/queue-5.4/spi-bcm2835aux-fix-use-after-free-on-unbind.patch b/queue-5.4/spi-bcm2835aux-fix-use-after-free-on-unbind.patch new file mode 100644 index 00000000000..638f7a1994a --- /dev/null +++ b/queue-5.4/spi-bcm2835aux-fix-use-after-free-on-unbind.patch @@ -0,0 +1,85 @@ +From e13ee6cc4781edaf8c7321bee19217e3702ed481 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 11 Nov 2020 20:07:30 +0100 +Subject: spi: bcm2835aux: Fix use-after-free on unbind + +From: Lukas Wunner + +commit e13ee6cc4781edaf8c7321bee19217e3702ed481 upstream. + +bcm2835aux_spi_remove() accesses the driver's private data after calling +spi_unregister_master() even though that function releases the last +reference on the spi_master and thereby frees the private data. + +Fix by switching over to the new devm_spi_alloc_master() helper which +keeps the private data accessible until the driver has unbound. + +Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order") +Signed-off-by: Lukas Wunner +Cc: # v4.4+: 123456789abc: spi: Introduce device-managed SPI controller allocation +Cc: # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order +Cc: # v4.4+ +Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835aux.c | 21 +++++++-------------- + 1 file changed, 7 insertions(+), 14 deletions(-) + +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -494,7 +494,7 @@ static int bcm2835aux_spi_probe(struct p + unsigned long clk_hz; + int err; + +- master = spi_alloc_master(&pdev->dev, sizeof(*bs)); ++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs)); + if (!master) + return -ENOMEM; + +@@ -524,29 +524,24 @@ static int bcm2835aux_spi_probe(struct p + + /* the main area */ + bs->regs = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(bs->regs)) { +- err = PTR_ERR(bs->regs); +- goto out_master_put; +- } ++ if (IS_ERR(bs->regs)) ++ return PTR_ERR(bs->regs); + + bs->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(bs->clk)) { +- err = PTR_ERR(bs->clk); + dev_err(&pdev->dev, "could not get clk: %d\n", err); +- goto out_master_put; ++ return PTR_ERR(bs->clk); + } + + bs->irq = platform_get_irq(pdev, 0); +- if (bs->irq <= 0) { +- err = bs->irq ? bs->irq : -ENODEV; +- goto out_master_put; +- } ++ if (bs->irq <= 0) ++ return bs->irq ? bs->irq : -ENODEV; + + /* this also enables the HW block */ + err = clk_prepare_enable(bs->clk); + if (err) { + dev_err(&pdev->dev, "could not prepare clock: %d\n", err); +- goto out_master_put; ++ return err; + } + + /* just checking if the clock returns a sane value */ +@@ -581,8 +576,6 @@ static int bcm2835aux_spi_probe(struct p + + out_clk_disable: + clk_disable_unprepare(bs->clk); +-out_master_put: +- spi_master_put(master); + return err; + } + diff --git a/queue-5.4/spi-introduce-device-managed-spi-controller-allocation.patch b/queue-5.4/spi-introduce-device-managed-spi-controller-allocation.patch new file mode 100644 index 00000000000..c2f4f10a957 --- /dev/null +++ b/queue-5.4/spi-introduce-device-managed-spi-controller-allocation.patch @@ -0,0 +1,168 @@ +From 5e844cc37a5cbaa460e68f9a989d321d63088a89 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 11 Nov 2020 20:07:10 +0100 +Subject: spi: Introduce device-managed SPI controller allocation + +From: Lukas Wunner + +commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 upstream. + +SPI driver probing currently comprises two steps, whereas removal +comprises only one step: + + spi_alloc_master() + spi_register_controller() + + spi_unregister_controller() + +That's because spi_unregister_controller() calls device_unregister() +instead of device_del(), thereby releasing the reference on the +spi_controller which was obtained by spi_alloc_master(). + +An SPI driver's private data is contained in the same memory allocation +as the spi_controller struct. Thus, once spi_unregister_controller() +has been called, the private data is inaccessible. But some drivers +need to access it after spi_unregister_controller() to perform further +teardown steps. + +Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which +release a reference on the spi_controller struct only after the driver +has unbound, thereby keeping the memory allocation accessible. Change +spi_unregister_controller() to not release a reference if the +spi_controller was allocated by one of these new devm functions. + +The present commit is small enough to be backportable to stable. +It allows fixing drivers which use the private data in their ->remove() +hook after it's been freed. It also allows fixing drivers which neglect +to release a reference on the spi_controller in the probe error path. + +Long-term, most SPI drivers shall be moved over to the devm functions +introduced herein. The few that can't shall be changed in a treewide +commit to explicitly release the last reference on the controller. +That commit shall amend spi_unregister_controller() to no longer release +a reference, thereby completing the migration. + +As a result, the behaviour will be less surprising and more consistent +with subsystems such as IIO, which also includes the private data in the +allocation of the generic iio_dev struct, but calls device_del() in +iio_device_unregister(). + +Signed-off-by: Lukas Wunner +Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++- + include/linux/spi/spi.h | 19 +++++++++++++++ + 2 files changed, 76 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2257,6 +2257,49 @@ struct spi_controller *__spi_alloc_contr + } + EXPORT_SYMBOL_GPL(__spi_alloc_controller); + ++static void devm_spi_release_controller(struct device *dev, void *ctlr) ++{ ++ spi_controller_put(*(struct spi_controller **)ctlr); ++} ++ ++/** ++ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller() ++ * @dev: physical device of SPI controller ++ * @size: how much zeroed driver-private data to allocate ++ * @slave: whether to allocate an SPI master (false) or SPI slave (true) ++ * Context: can sleep ++ * ++ * Allocate an SPI controller and automatically release a reference on it ++ * when @dev is unbound from its driver. Drivers are thus relieved from ++ * having to call spi_controller_put(). ++ * ++ * The arguments to this function are identical to __spi_alloc_controller(). ++ * ++ * Return: the SPI controller structure on success, else NULL. ++ */ ++struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ++ unsigned int size, ++ bool slave) ++{ ++ struct spi_controller **ptr, *ctlr; ++ ++ ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr), ++ GFP_KERNEL); ++ if (!ptr) ++ return NULL; ++ ++ ctlr = __spi_alloc_controller(dev, size, slave); ++ if (ctlr) { ++ *ptr = ctlr; ++ devres_add(dev, ptr); ++ } else { ++ devres_free(ptr); ++ } ++ ++ return ctlr; ++} ++EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller); ++ + #ifdef CONFIG_OF + static int of_spi_get_gpio_numbers(struct spi_controller *ctlr) + { +@@ -2576,6 +2619,11 @@ int devm_spi_register_controller(struct + } + EXPORT_SYMBOL_GPL(devm_spi_register_controller); + ++static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr) ++{ ++ return *(struct spi_controller **)res == ctlr; ++} ++ + static int __unregister(struct device *dev, void *null) + { + spi_unregister_device(to_spi_device(dev)); +@@ -2617,7 +2665,15 @@ void spi_unregister_controller(struct sp + list_del(&ctlr->list); + mutex_unlock(&board_lock); + +- device_unregister(&ctlr->dev); ++ device_del(&ctlr->dev); ++ ++ /* Release the last reference on the controller if its driver ++ * has not yet been converted to devm_spi_alloc_master/slave(). ++ */ ++ if (!devres_find(ctlr->dev.parent, devm_spi_release_controller, ++ devm_spi_match_controller, ctlr)) ++ put_device(&ctlr->dev); ++ + /* free bus id */ + mutex_lock(&board_lock); + if (found == ctlr) +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -663,6 +663,25 @@ static inline struct spi_controller *spi + return __spi_alloc_controller(host, size, true); + } + ++struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ++ unsigned int size, ++ bool slave); ++ ++static inline struct spi_controller *devm_spi_alloc_master(struct device *dev, ++ unsigned int size) ++{ ++ return __devm_spi_alloc_controller(dev, size, false); ++} ++ ++static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev, ++ unsigned int size) ++{ ++ if (!IS_ENABLED(CONFIG_SPI_SLAVE)) ++ return NULL; ++ ++ return __devm_spi_alloc_controller(dev, size, true); ++} ++ + extern int spi_register_controller(struct spi_controller *ctlr); + extern int devm_spi_register_controller(struct device *dev, + struct spi_controller *ctlr); diff --git a/queue-5.4/spi-lpspi-fix-use-after-free-on-unbind.patch b/queue-5.4/spi-lpspi-fix-use-after-free-on-unbind.patch new file mode 100644 index 00000000000..9433b993a63 --- /dev/null +++ b/queue-5.4/spi-lpspi-fix-use-after-free-on-unbind.patch @@ -0,0 +1,46 @@ +From 4def49da620c84a682d9361d6bef0a97eed46fe0 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 8 Nov 2020 23:41:00 +0100 +Subject: spi: lpspi: Fix use-after-free on unbind + +From: Lukas Wunner + +commit 4def49da620c84a682d9361d6bef0a97eed46fe0 upstream. + +Normally the last reference on an spi_controller is released by +spi_unregister_controller(). In the case of the i.MX lpspi driver, +the spi_controller is registered with devm_spi_register_controller(), +so spi_unregister_controller() is invoked automatically after the driver +has unbound. + +However the driver already releases the last reference in +fsl_lpspi_remove() through a gratuitous call to spi_master_put(), +causing a use-after-free when spi_unregister_controller() is +subsequently invoked by the devres framework. + +Fix by dropping the superfluous spi_master_put(). + +Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi") +Signed-off-by: Lukas Wunner +Cc: # v5.2+ +Cc: Han Xu +Link: https://lore.kernel.org/r/ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-fsl-lpspi.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -973,9 +973,6 @@ static int fsl_lpspi_remove(struct platf + spi_controller_get_devdata(controller); + + pm_runtime_disable(fsl_lpspi->dev); +- +- spi_master_put(controller); +- + return 0; + } + diff --git a/queue-5.4/spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch b/queue-5.4/spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch new file mode 100644 index 00000000000..c881985d693 --- /dev/null +++ b/queue-5.4/spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch @@ -0,0 +1,40 @@ +From 04a9cd51d3f3308a98cbc6adc07acb12fbade011 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 16 Nov 2020 09:23:10 +0100 +Subject: spi: npcm-fiu: Don't leak SPI master in probe error path + +From: Lukas Wunner + +commit 04a9cd51d3f3308a98cbc6adc07acb12fbade011 upstream. + +If the calls to of_match_device(), of_alias_get_id(), +devm_ioremap_resource(), devm_regmap_init_mmio() or devm_clk_get() +fail on probe of the NPCM FIU SPI driver, the spi_controller struct is +erroneously not freed. + +Fix by switching over to the new devm_spi_alloc_master() helper. + +Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver") +Signed-off-by: Lukas Wunner +Cc: # v5.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation +Cc: # v5.4+ +Cc: Tomer Maimon +Link: https://lore.kernel.org/r/a420c23a363a3bc9aa684c6e790c32a8af106d17.1605512876.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-npcm-fiu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-npcm-fiu.c ++++ b/drivers/spi/spi-npcm-fiu.c +@@ -680,7 +680,7 @@ static int npcm_fiu_probe(struct platfor + int ret; + int id; + +- ctrl = spi_alloc_master(dev, sizeof(*fiu)); ++ ctrl = devm_spi_alloc_master(dev, sizeof(*fiu)); + if (!ctrl) + return -ENOMEM; +