From: Greg Kroah-Hartman Date: Mon, 17 May 2021 08:27:19 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.4.120~57 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=615793c5bc2f23bcbccb07a31006b5493821bf8b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: iio-gyro-mpu3050-fix-reported-temperature-value.patch iio-tsl2583-fix-division-by-a-zero-lux_val.patch kvm-x86-cancel-pvclock_gtod_work-on-module-removal.patch --- diff --git a/queue-4.14/iio-gyro-mpu3050-fix-reported-temperature-value.patch b/queue-4.14/iio-gyro-mpu3050-fix-reported-temperature-value.patch new file mode 100644 index 00000000000..ba1abf13488 --- /dev/null +++ b/queue-4.14/iio-gyro-mpu3050-fix-reported-temperature-value.patch @@ -0,0 +1,59 @@ +From f73c730774d88a14d7b60feee6d0e13570f99499 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Fri, 23 Apr 2021 05:09:59 +0300 +Subject: iio: gyro: mpu3050: Fix reported temperature value + +From: Dmitry Osipenko + +commit f73c730774d88a14d7b60feee6d0e13570f99499 upstream. + +The raw temperature value is a 16-bit signed integer. The sign casting +is missing in the code, which results in a wrong temperature reported +by userspace tools, fix it. + +Cc: stable@vger.kernel.org +Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope") +Datasheet: https://www.cdiweb.com/datasheets/invensense/mpu-3000a.pdf +Tested-by: Maxim Schwalm # Asus TF700T +Tested-by: Svyatoslav Ryhel # Asus TF201 +Reported-by: Svyatoslav Ryhel +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Osipenko +Acked-by: Jean-Baptiste Maneyrol +Link: https://lore.kernel.org/r/20210423020959.5023-1-digetx@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/mpu3050-core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/iio/gyro/mpu3050-core.c ++++ b/drivers/iio/gyro/mpu3050-core.c +@@ -270,7 +270,16 @@ static int mpu3050_read_raw(struct iio_d + case IIO_CHAN_INFO_OFFSET: + switch (chan->type) { + case IIO_TEMP: +- /* The temperature scaling is (x+23000)/280 Celsius */ ++ /* ++ * The temperature scaling is (x+23000)/280 Celsius ++ * for the "best fit straight line" temperature range ++ * of -30C..85C. The 23000 includes room temperature ++ * offset of +35C, 280 is the precision scale and x is ++ * the 16-bit signed integer reported by hardware. ++ * ++ * Temperature value itself represents temperature of ++ * the sensor die. ++ */ + *val = 23000; + return IIO_VAL_INT; + default: +@@ -327,7 +336,7 @@ static int mpu3050_read_raw(struct iio_d + goto out_read_raw_unlock; + } + +- *val = be16_to_cpu(raw_val); ++ *val = (s16)be16_to_cpu(raw_val); + ret = IIO_VAL_INT; + + goto out_read_raw_unlock; diff --git a/queue-4.14/iio-tsl2583-fix-division-by-a-zero-lux_val.patch b/queue-4.14/iio-tsl2583-fix-division-by-a-zero-lux_val.patch new file mode 100644 index 00000000000..1903e9cd2cd --- /dev/null +++ b/queue-4.14/iio-tsl2583-fix-division-by-a-zero-lux_val.patch @@ -0,0 +1,45 @@ +From af0e1871d79cfbb91f732d2c6fa7558e45c31038 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 7 May 2021 19:30:41 +0100 +Subject: iio: tsl2583: Fix division by a zero lux_val + +From: Colin Ian King + +commit af0e1871d79cfbb91f732d2c6fa7558e45c31038 upstream. + +The lux_val returned from tsl2583_get_lux can potentially be zero, +so check for this to avoid a division by zero and an overflowed +gain_trim_val. + +Fixes clang scan-build warning: + +drivers/iio/light/tsl2583.c:345:40: warning: Either the +condition 'lux_val<0' is redundant or there is division +by zero at line 345. [zerodivcond] + +Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver") +Signed-off-by: Colin Ian King +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/tsl2583.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/iio/light/tsl2583.c ++++ b/drivers/iio/light/tsl2583.c +@@ -350,6 +350,14 @@ static int tsl2583_als_calibrate(struct + return lux_val; + } + ++ /* Avoid division by zero of lux_value later on */ ++ if (lux_val == 0) { ++ dev_err(&chip->client->dev, ++ "%s: lux_val of 0 will produce out of range trim_value\n", ++ __func__); ++ return -ENODATA; ++ } ++ + gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target) + * chip->als_settings.als_gain_trim) / lux_val); + if ((gain_trim_val < 250) || (gain_trim_val > 4000)) { diff --git a/queue-4.14/kvm-x86-cancel-pvclock_gtod_work-on-module-removal.patch b/queue-4.14/kvm-x86-cancel-pvclock_gtod_work-on-module-removal.patch new file mode 100644 index 00000000000..ec488ca6c22 --- /dev/null +++ b/queue-4.14/kvm-x86-cancel-pvclock_gtod_work-on-module-removal.patch @@ -0,0 +1,44 @@ +From 594b27e677b35f9734b1969d175ebc6146741109 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 5 May 2021 23:48:17 +0200 +Subject: KVM: x86: Cancel pvclock_gtod_work on module removal + +From: Thomas Gleixner + +commit 594b27e677b35f9734b1969d175ebc6146741109 upstream. + +Nothing prevents the following: + + pvclock_gtod_notify() + queue_work(system_long_wq, &pvclock_gtod_work); + ... + remove_module(kvm); + ... + work_queue_run() + pvclock_gtod_work() <- UAF + +Ditto for any other operation on that workqueue list head which touches +pvclock_gtod_work after module removal. + +Cancel the work in kvm_arch_exit() to prevent that. + +Fixes: 16e8d74d2da9 ("KVM: x86: notifier for clocksource changes") +Signed-off-by: Thomas Gleixner +Message-Id: <87czu4onry.ffs@nanos.tec.linutronix.de> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/x86.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6420,6 +6420,7 @@ void kvm_arch_exit(void) + cpuhp_remove_state_nocalls(CPUHP_AP_X86_KVM_CLK_ONLINE); + #ifdef CONFIG_X86_64 + pvclock_gtod_unregister_notifier(&pvclock_gtod_notifier); ++ cancel_work_sync(&pvclock_gtod_work); + #endif + kvm_x86_ops = NULL; + kvm_mmu_module_exit(); diff --git a/queue-4.14/series b/queue-4.14/series index 6e2fcae736f..4fdbbd5c089 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -287,3 +287,6 @@ usb-dwc3-omap-improve-extcon-initialization.patch usb-xhci-increase-timeout-for-hc-halt.patch usb-dwc2-fix-gadget-dma-unmap-direction.patch usb-core-hub-fix-race-condition-about-trsmrcy-of-resume.patch +iio-gyro-mpu3050-fix-reported-temperature-value.patch +iio-tsl2583-fix-division-by-a-zero-lux_val.patch +kvm-x86-cancel-pvclock_gtod_work-on-module-removal.patch