From: Sasha Levin Date: Mon, 23 Nov 2020 03:05:57 +0000 (-0500) Subject: Fixes for 4.9 X-Git-Tag: v4.4.246~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=53723d8caa242e0d0255478a0be372f4b72467e5;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch b/queue-4.9/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch new file mode 100644 index 00000000000..7d37bb41d5d --- /dev/null +++ b/queue-4.9/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch @@ -0,0 +1,43 @@ +From f8227998b73461ee75f3dea3c6c3c98d3a3ba688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:13:20 -0300 +Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX + +From: Fabio Estevam + +[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ] + +The SPI chip selects are represented as: + +cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>; + +, which means that they are used in GPIO function instead of native +SPI mode. + +Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of +the native CSPI_SSI function. + +Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx50-evk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts +index 27d763c7a307d..4dbd180e72ba6 100644 +--- a/arch/arm/boot/dts/imx50-evk.dts ++++ b/arch/arm/boot/dts/imx50-evk.dts +@@ -66,7 +66,7 @@ + MX50_PAD_CSPI_MISO__CSPI_MISO 0x00 + MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00 + MX50_PAD_CSPI_SS0__GPIO4_11 0xc4 +- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4 ++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84 + >; + }; + +-- +2.27.0 + diff --git a/queue-4.9/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch b/queue-4.9/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch new file mode 100644 index 00000000000..8d71c9db997 --- /dev/null +++ b/queue-4.9/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch @@ -0,0 +1,39 @@ +From 46ef297a17334835d9056c803cdf8280be77243b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Oct 2020 23:11:20 +0300 +Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy + +From: Sergey Matyukevich + +[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ] + +Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the +KSZ9031 PHY") fixed micrel phy driver adding proper support for phy +modes. Adapt imx6q-udoo board phy settings : explicitly set required +delay configuration using "rgmii-id". + +Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo") +Signed-off-by: Sergey Matyukevich +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +index c96c91d836785..fc4ae2e423bd7 100644 +--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +@@ -94,7 +94,7 @@ + &fec { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.9/can-dev-can_restart-post-buffer-from-the-right-conte.patch b/queue-4.9/can-dev-can_restart-post-buffer-from-the-right-conte.patch new file mode 100644 index 00000000000..6fca4ea6ec2 --- /dev/null +++ b/queue-4.9/can-dev-can_restart-post-buffer-from-the-right-conte.patch @@ -0,0 +1,41 @@ +From 142ba6ec5dbad5e2b85115255c79883a6e403c77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 21:51:47 +0000 +Subject: can: dev: can_restart(): post buffer from the right context + +From: Alejandro Concepcion Rodriguez + +[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ] + +netif_rx() is meant to be called from interrupt contexts. can_restart() may be +called by can_restart_work(), which is called from a worqueue, so it may run in +process context. Use netif_rx_ni() instead. + +Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") +Co-developed-by: Loris Fauster +Signed-off-by: Loris Fauster +Signed-off-by: Alejandro Concepcion Rodriguez +Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu +[mkl: use netif_rx_ni() instead of netif_rx_any_context()] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 617eb75c7c0ce..c7508d9a4c6fb 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -555,7 +555,7 @@ static void can_restart(struct net_device *dev) + } + cf->can_id |= CAN_ERR_RESTARTED; + +- netif_rx(skb); ++ netif_rx_ni(skb); + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +-- +2.27.0 + diff --git a/queue-4.9/can-m_can-m_can_handle_state_change-fix-state-change.patch b/queue-4.9/can-m_can-m_can_handle_state_change-fix-state-change.patch new file mode 100644 index 00000000000..3509122db14 --- /dev/null +++ b/queue-4.9/can-m_can-m_can_handle_state_change-fix-state-change.patch @@ -0,0 +1,51 @@ +From 9ef105a16a0b89f2daba1fc04c3081c755af5ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2020 10:23:30 +0800 +Subject: can: m_can: m_can_handle_state_change(): fix state change + +From: Wu Bo + +[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ] + +m_can_handle_state_change() is called with the new_state as an argument. + +In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the +following code indicate that a CAN_STATE_ERROR_WARNING is handled. + +This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING. + +Signed-off-by: Wu Bo +Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com +Cc: Dan Murphy +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 195f15edb32e3..0bd7e71647964 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -572,7 +572,7 @@ static int m_can_handle_state_change(struct net_device *dev, + unsigned int ecr; + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + priv->can.can_stats.error_warning++; + priv->can.state = CAN_STATE_ERROR_WARNING; +@@ -601,7 +601,7 @@ static int m_can_handle_state_change(struct net_device *dev, + __m_can_get_berr_counter(dev, &bec); + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cf->can_id |= CAN_ERR_CRTL; + cf->data[1] = (bec.txerr > bec.rxerr) ? +-- +2.27.0 + diff --git a/queue-4.9/can-peak_usb-fix-potential-integer-overflow-on-shift.patch b/queue-4.9/can-peak_usb-fix-potential-integer-overflow-on-shift.patch new file mode 100644 index 00000000000..7713e9eff00 --- /dev/null +++ b/queue-4.9/can-peak_usb-fix-potential-integer-overflow-on-shift.patch @@ -0,0 +1,48 @@ +From e47b4b0d40c1f365dda1513e829a5dc57e81298a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 11:24:27 +0000 +Subject: can: peak_usb: fix potential integer overflow on shift of a int + +From: Colin Ian King + +[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ] + +The left shift of int 32 bit integer constant 1 is evaluated using 32 bit +arithmetic and then assigned to a signed 64 bit variable. In the case where +time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow. +Avoid this by shifting using the BIT_ULL macro instead. + +Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +index 74b37309efab7..2e316228aa1e8 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -178,7 +178,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts, + if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { + /* case when event time (tsw) wraps */ + if (ts < time_ref->ts_dev_1) +- delta_ts = 1 << time_ref->adapter->ts_used_bits; ++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits); + + /* Otherwise, sync time counter (ts_dev_2) has wrapped: + * handle case when event time (tsn) hasn't. +@@ -190,7 +190,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts, + * tsn ts + */ + } else if (time_ref->ts_dev_1 < ts) { +- delta_ts = -(1 << time_ref->adapter->ts_used_bits); ++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits); + } + + /* add delay between last sync and event timestamps */ +-- +2.27.0 + diff --git a/queue-4.9/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch b/queue-4.9/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch new file mode 100644 index 00000000000..f0e301f9c19 --- /dev/null +++ b/queue-4.9/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch @@ -0,0 +1,38 @@ +From 6a980906cd052ae79726d0502b278d2c4ea86235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 17:10:09 -0700 +Subject: Input: adxl34x - clean up a data type in adxl34x_probe() + +From: Dan Carpenter + +[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ] + +The "revid" is used to store negative error codes so it should be an int +type. + +Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") +Signed-off-by: Dan Carpenter +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/adxl34x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c +index 2b2d02f408bbb..2e189646d8fe2 100644 +--- a/drivers/input/misc/adxl34x.c ++++ b/drivers/input/misc/adxl34x.c +@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, + struct input_dev *input_dev; + const struct adxl34x_platform_data *pdata; + int err, range, i; +- unsigned char revid; ++ int revid; + + if (!irq) { + dev_err(dev, "no IRQ?\n"); +-- +2.27.0 + diff --git a/queue-4.9/libfs-fix-error-cast-of-negative-value-in-simple_att.patch b/queue-4.9/libfs-fix-error-cast-of-negative-value-in-simple_att.patch new file mode 100644 index 00000000000..e694c4102bb --- /dev/null +++ b/queue-4.9/libfs-fix-error-cast-of-negative-value-in-simple_att.patch @@ -0,0 +1,57 @@ +From 89176cef91c72562507b8b73b05afc36b687eccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 22:17:19 -0800 +Subject: libfs: fix error cast of negative value in simple_attr_write() + +From: Yicong Yang + +[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ] + +The attr->set() receive a value of u64, but simple_strtoll() is used for +doing the conversion. It will lead to the error cast if user inputs a +negative value. + +Use kstrtoull() instead of simple_strtoll() to convert a string got from +the user to an unsigned value. The former will return '-EINVAL' if it +gets a negetive value, but the latter can't handle the situation +correctly. Make 'val' unsigned long long as what kstrtoull() takes, +this will eliminate the compile warning on no 64-bit architectures. + +Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines") +Signed-off-by: Yicong Yang +Signed-off-by: Andrew Morton +Cc: Al Viro +Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/libfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/libfs.c b/fs/libfs.c +index 278457f221482..835d25e335095 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -865,7 +865,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + size_t len, loff_t *ppos) + { + struct simple_attr *attr; +- u64 val; ++ unsigned long long val; + size_t size; + ssize_t ret; + +@@ -883,7 +883,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + goto out; + + attr->set_buf[size] = '\0'; +- val = simple_strtoll(attr->set_buf, NULL, 0); ++ ret = kstrtoull(attr->set_buf, 0, &val); ++ if (ret) ++ goto out; + ret = attr->set(attr->data, val); + if (ret == 0) + ret = len; /* on success, claim we got the whole input */ +-- +2.27.0 + diff --git a/queue-4.9/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch b/queue-4.9/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch new file mode 100644 index 00000000000..83aab73920a --- /dev/null +++ b/queue-4.9/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch @@ -0,0 +1,51 @@ +From 9989adb16289041e0157aecb38bda3114fdd76d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:18:56 +0800 +Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu + +From: Zhang Qilong + +[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ] + +If the clk_register fails, we should free h before +function returns to prevent memleak. + +Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/alchemy/common/clock.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c +index 7ba7ea0a22f80..e6d0044393b08 100644 +--- a/arch/mips/alchemy/common/clock.c ++++ b/arch/mips/alchemy/common/clock.c +@@ -151,6 +151,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, + { + struct clk_init_data id; + struct clk_hw *h; ++ struct clk *clk; + + h = kzalloc(sizeof(*h), GFP_KERNEL); + if (!h) +@@ -163,7 +164,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, + id.ops = &alchemy_clkops_cpu; + h->init = &id; + +- return clk_register(NULL, h); ++ clk = clk_register(NULL, h); ++ if (IS_ERR(clk)) { ++ pr_err("failed to register clock\n"); ++ kfree(h); ++ } ++ ++ return clk; + } + + /* AUXPLLs ************************************************************/ +-- +2.27.0 + diff --git a/queue-4.9/mips-export-has_transparent_hugepage-for-modules.patch b/queue-4.9/mips-export-has_transparent_hugepage-for-modules.patch new file mode 100644 index 00000000000..d447dcd4e96 --- /dev/null +++ b/queue-4.9/mips-export-has_transparent_hugepage-for-modules.patch @@ -0,0 +1,47 @@ +From 6aadd17b7949da76b8958b482ea90a4ddbc01d07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 12:44:40 -0700 +Subject: MIPS: export has_transparent_hugepage() for modules + +From: Randy Dunlap + +[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ] + +MIPS should export its local version of "has_transparent_hugepage" +so that loadable modules (dax) can use it. + +Fixes this build error: +ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined! + +Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Dan Williams +Cc: Vishal Verma +Cc: Dave Jiang +Cc: linux-nvdimm@lists.01.org +Cc: Hugh Dickins +Cc: Andrew Morton +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/tlb-r4k.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c +index 0596505770dba..11985399c4695 100644 +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -424,6 +424,7 @@ int has_transparent_hugepage(void) + } + return mask == PM_HUGE_MASK; + } ++EXPORT_SYMBOL(has_transparent_hugepage); + + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + +-- +2.27.0 + diff --git a/queue-4.9/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch b/queue-4.9/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch new file mode 100644 index 00000000000..1761a4b281f --- /dev/null +++ b/queue-4.9/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch @@ -0,0 +1,54 @@ +From 5c968b82229b44710a313176763a3b2b5413adff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 17:42:29 +0800 +Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero + +From: Leo Yan + +[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ] + +When execute command "perf lock report", it hits failure and outputs log +as follows: + + perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed. + Aborted + +This is an imbalance issue. The locking sequence structure +"lock_seq_stat" contains the reader counter and it is used to check if +the locking sequence is balance or not between acquiring and releasing. + +If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero, +the "read_count" will be reset to zero when allocate a new structure at +the next time; thus it causes the wrong counting for reader and finally +results in imbalance issue. + +To fix this issue, if detects "read_count" is not zero (means still have +read user in the locking sequence), goto the "end" tag to skip freeing +structure "lock_seq_stat". + +Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence") +Signed-off-by: Leo Yan +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-lock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c +index ce3bfb48b26f0..956b0aa916cfe 100644 +--- a/tools/perf/builtin-lock.c ++++ b/tools/perf/builtin-lock.c +@@ -616,7 +616,7 @@ static int report_lock_release_event(struct perf_evsel *evsel, + case SEQ_STATE_READ_ACQUIRED: + seq->read_count--; + BUG_ON(seq->read_count < 0); +- if (!seq->read_count) { ++ if (seq->read_count) { + ls->nr_release++; + goto end; + } +-- +2.27.0 + diff --git a/queue-4.9/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch b/queue-4.9/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch new file mode 100644 index 00000000000..18d26f05fd9 --- /dev/null +++ b/queue-4.9/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch @@ -0,0 +1,71 @@ +From 3b6e7f36276fb8867f901592f13d1aae12d5a532 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 08:50:09 -0600 +Subject: regulator: ti-abb: Fix array out of bound read access on the first + transition + +From: Nishanth Menon + +[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ] + +At the start of driver initialization, we do not know what bias +setting the bootloader has configured the system for and we only know +for certain the very first time we do a transition. + +However, since the initial value of the comparison index is -EINVAL, +this negative value results in an array out of bound access on the +very first transition. + +Since we don't know what the setting is, we just set the bias +configuration as there is nothing to compare against. This prevents +the array out of bound access. + +NOTE: Even though we could use a more relaxed check of "< 0" the only +valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+. + +Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver") +Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/ +Reported-by: Naresh Kamboju +Reviewed-by: Arnd Bergmann +Signed-off-by: Nishanth Menon +Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/ti-abb-regulator.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c +index 6d17357b3a248..5f5f63eb8c762 100644 +--- a/drivers/regulator/ti-abb-regulator.c ++++ b/drivers/regulator/ti-abb-regulator.c +@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) + return ret; + } + +- /* If data is exactly the same, then just update index, no change */ + info = &abb->info[sel]; ++ /* ++ * When Linux kernel is starting up, we are'nt sure of the ++ * Bias configuration that bootloader has configured. ++ * So, we get to know the actual setting the first time ++ * we are asked to transition. ++ */ ++ if (abb->current_info_idx == -EINVAL) ++ goto just_set_abb; ++ ++ /* If data is exactly the same, then just update index, no change */ + oinfo = &abb->info[abb->current_info_idx]; + if (!memcmp(info, oinfo, sizeof(*info))) { + dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__, +@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) + goto out; + } + ++just_set_abb: + ret = ti_abb_set_opp(rdev, abb, info); + + out: +-- +2.27.0 + diff --git a/queue-4.9/series b/queue-4.9/series index a03676eb14f..2b3f464ec75 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -19,3 +19,15 @@ mlxsw-core-use-variable-timeout-for-emad-retries.patch pinctrl-rockchip-enable-gpio-pclk-for-rockchip_gpio_.patch arm64-psci-avoid-printing-in-cpu_psci_cpu_die.patch vfs-remove-lockdep-bogosity-in-__sb_start_write.patch +input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch +mips-export-has_transparent_hugepage-for-modules.patch +arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch +arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch +perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch +can-dev-can_restart-post-buffer-from-the-right-conte.patch +can-peak_usb-fix-potential-integer-overflow-on-shift.patch +can-m_can-m_can_handle_state_change-fix-state-change.patch +mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch +regulator-ti-abb-fix-array-out-of-bound-read-access-.patch +xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch +libfs-fix-error-cast-of-negative-value-in-simple_att.patch diff --git a/queue-4.9/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch b/queue-4.9/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch new file mode 100644 index 00000000000..866e948acd3 --- /dev/null +++ b/queue-4.9/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch @@ -0,0 +1,83 @@ +From 0f8c94863f052fc29e437bc51c9f31788c4c81b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 15:17:50 -0800 +Subject: xfs: revert "xfs: fix rmap key and record comparison functions" + +From: Darrick J. Wong + +[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ] + +This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f. + +Your maintainer committed a major braino in the rmap code by adding the +attr fork, bmbt, and unwritten extent usage bits into rmap record key +comparisons. While XFS uses the usage bits *in the rmap records* for +cross-referencing metadata in xfs_scrub and xfs_repair, it only needs +the owner and offset information to distinguish between reverse mappings +of the same physical extent into the data fork of a file at multiple +offsets. The other bits are not important for key comparisons for index +lookups, and never have been. + +Eric Sandeen reports that this causes regressions in generic/299, so +undo this patch before it does more damage. + +Reported-by: Eric Sandeen +Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions") +Signed-off-by: Darrick J. Wong +Reviewed-by: Eric Sandeen +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c +index c5a24b80c7f72..33a28efc3085b 100644 +--- a/fs/xfs/libxfs/xfs_rmap_btree.c ++++ b/fs/xfs/libxfs/xfs_rmap_btree.c +@@ -262,8 +262,8 @@ xfs_rmapbt_key_diff( + else if (y > x) + return -1; + +- x = be64_to_cpu(kp->rm_offset); +- y = xfs_rmap_irec_offset_pack(rec); ++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset)); ++ y = rec->rm_offset; + if (x > y) + return 1; + else if (y > x) +@@ -294,8 +294,8 @@ xfs_rmapbt_diff_two_keys( + else if (y > x) + return -1; + +- x = be64_to_cpu(kp1->rm_offset); +- y = be64_to_cpu(kp2->rm_offset); ++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset)); ++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset)); + if (x > y) + return 1; + else if (y > x) +@@ -401,8 +401,8 @@ xfs_rmapbt_keys_inorder( + return 1; + else if (a > b) + return 0; +- a = be64_to_cpu(k1->rmap.rm_offset); +- b = be64_to_cpu(k2->rmap.rm_offset); ++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset)); ++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset)); + if (a <= b) + return 1; + return 0; +@@ -431,8 +431,8 @@ xfs_rmapbt_recs_inorder( + return 1; + else if (a > b) + return 0; +- a = be64_to_cpu(r1->rmap.rm_offset); +- b = be64_to_cpu(r2->rmap.rm_offset); ++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset)); ++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset)); + if (a <= b) + return 1; + return 0; +-- +2.27.0 +