From: Greg Kroah-Hartman Date: Mon, 18 Oct 2021 10:55:04 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.14.252~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cdfaafcce16cf7b9df84c30dae33457f26ae8ecf;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch --- diff --git a/queue-4.4/iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch b/queue-4.4/iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch new file mode 100644 index 00000000000..a8b465fe212 --- /dev/null +++ b/queue-4.4/iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch @@ -0,0 +1,42 @@ +From bbcf40816b547b3c37af49168950491d20d81ce1 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 21 Aug 2021 12:37:24 +0200 +Subject: iio: adc128s052: Fix the error handling path of 'adc128_probe()' + +From: Christophe JAILLET + +commit bbcf40816b547b3c37af49168950491d20d81ce1 upstream. + +A successful 'regulator_enable()' call should be balanced by a +corresponding 'regulator_disable()' call in the error handling path of the +probe, as already done in the remove function. + +Update the error handling path accordingly. + +Fixes: 913b86468674 ("iio: adc: Add TI ADC128S052") +Signed-off-by: Christophe JAILLET +Reviewed-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/85189f1cfcf6f5f7b42d8730966f2a074b07b5f5.1629542160.git.christophe.jaillet@wanadoo.fr +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-adc128s052.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/iio/adc/ti-adc128s052.c ++++ b/drivers/iio/adc/ti-adc128s052.c +@@ -159,7 +159,13 @@ static int adc128_probe(struct spi_devic + mutex_init(&adc->lock); + + ret = iio_device_register(indio_dev); ++ if (ret) ++ goto err_disable_regulator; + ++ return 0; ++ ++err_disable_regulator: ++ regulator_disable(adc->reg); + return ret; + } + diff --git a/queue-4.4/iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch b/queue-4.4/iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch new file mode 100644 index 00000000000..33298ff30b3 --- /dev/null +++ b/queue-4.4/iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch @@ -0,0 +1,57 @@ +From 8167c9a375ccceed19048ad9d68cb2d02ed276e0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 9 Sep 2021 12:13:36 +0300 +Subject: iio: ssp_sensors: add more range checking in ssp_parse_dataframe() + +From: Dan Carpenter + +commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream. + +The "idx" is validated at the start of the loop but it gets incremented +during the iteration so it needs to be checked again. + +Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210909091336.GA26312@kili +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/ssp_sensors/ssp_spi.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/iio/common/ssp_sensors/ssp_spi.c ++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c +@@ -286,6 +286,8 @@ static int ssp_parse_dataframe(struct ss + for (idx = 0; idx < len;) { + switch (dataframe[idx++]) { + case SSP_MSG2AP_INST_BYPASS_DATA: ++ if (idx >= len) ++ return -EPROTO; + sd = dataframe[idx++]; + if (sd < 0 || sd >= SSP_SENSOR_MAX) { + dev_err(SSP_DEV, +@@ -295,10 +297,13 @@ static int ssp_parse_dataframe(struct ss + + if (indio_devs[sd]) { + spd = iio_priv(indio_devs[sd]); +- if (spd->process_data) ++ if (spd->process_data) { ++ if (idx >= len) ++ return -EPROTO; + spd->process_data(indio_devs[sd], + &dataframe[idx], + data->timestamp); ++ } + } else { + dev_err(SSP_DEV, "no client for frame\n"); + } +@@ -306,6 +311,8 @@ static int ssp_parse_dataframe(struct ss + idx += ssp_offset_map[sd]; + break; + case SSP_MSG2AP_INST_DEBUG_DATA: ++ if (idx >= len) ++ return -EPROTO; + sd = ssp_print_mcu_debug(dataframe, &idx, len); + if (sd) { + dev_err(SSP_DEV, diff --git a/queue-4.4/iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch b/queue-4.4/iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch new file mode 100644 index 00000000000..f3cadf900cd --- /dev/null +++ b/queue-4.4/iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch @@ -0,0 +1,35 @@ +From 4170d3dd1467e9d78cb9af374b19357dc324b328 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 14 Sep 2021 13:53:33 +0300 +Subject: iio: ssp_sensors: fix error code in ssp_print_mcu_debug() + +From: Dan Carpenter + +commit 4170d3dd1467e9d78cb9af374b19357dc324b328 upstream. + +The ssp_print_mcu_debug() function should return negative error codes on +error. Returning "length" is meaningless. This change does not affect +runtime because the callers only care about zero/non-zero. + +Reported-by: Jonathan Cameron +Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210914105333.GA11657@kili +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/ssp_sensors/ssp_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/common/ssp_sensors/ssp_spi.c ++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c +@@ -147,7 +147,7 @@ static int ssp_print_mcu_debug(char *dat + if (length > received_len - *data_index || length <= 0) { + ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n", + length, received_len); +- return length ? length : -EPROTO; ++ return -EPROTO; + } + + ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]); diff --git a/queue-4.4/series b/queue-4.4/series index 8349f78f312..0c50e775e30 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -7,3 +7,6 @@ input-xpad-add-support-for-another-usb-id-of-nacon-gc-100.patch usb-serial-qcserial-add-em9191-qdl-support.patch usb-serial-option-add-telit-le910cx-composition-0x1204.patch nvmem-fix-shift-out-of-bound-ubsan-with-byte-size-cells.patch +iio-adc128s052-fix-the-error-handling-path-of-adc128_probe.patch +iio-ssp_sensors-add-more-range-checking-in-ssp_parse_dataframe.patch +iio-ssp_sensors-fix-error-code-in-ssp_print_mcu_debug.patch