From: Greg Kroah-Hartman Date: Wed, 6 Jan 2021 16:57:47 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.4.250~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cf187458b75de1b2c6351da2582dba628a0b8f09;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch dmaengine-at_hdmac-add-missing-put_device-call-in-at_dma_xlate.patch dmaengine-at_hdmac-substitute-kzalloc-with-kmalloc.patch kdev_t-always-inline-major-minor-helper-functions.patch revert-mtd-spinand-fix-oob-read.patch --- diff --git a/queue-4.19/dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch b/queue-4.19/dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch new file mode 100644 index 00000000000..98765e8117a --- /dev/null +++ b/queue-4.19/dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch @@ -0,0 +1,33 @@ +From e097eb7473d9e70da9e03276f61cd392ccb9d79f Mon Sep 17 00:00:00 2001 +From: Yu Kuai +Date: Mon, 17 Aug 2020 19:57:28 +0800 +Subject: dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate() + +From: Yu Kuai + +commit e097eb7473d9e70da9e03276f61cd392ccb9d79f upstream. + +If memory allocation for 'atslave' succeed, at_dma_xlate() doesn't have a +corresponding kfree() in exception handling. Thus add kfree() for this +function implementation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200817115728.1706719-4-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1718,6 +1718,7 @@ static struct dma_chan *at_dma_xlate(str + chan = dma_request_channel(mask, at_dma_filter, atslave); + if (!chan) { + put_device(&dmac_pdev->dev); ++ kfree(atslave); + return NULL; + } + diff --git a/queue-4.19/dmaengine-at_hdmac-add-missing-put_device-call-in-at_dma_xlate.patch b/queue-4.19/dmaengine-at_hdmac-add-missing-put_device-call-in-at_dma_xlate.patch new file mode 100644 index 00000000000..9aefd599486 --- /dev/null +++ b/queue-4.19/dmaengine-at_hdmac-add-missing-put_device-call-in-at_dma_xlate.patch @@ -0,0 +1,49 @@ +From 3832b78b3ec2cf51e07102f9b4480e343459b20f Mon Sep 17 00:00:00 2001 +From: Yu Kuai +Date: Mon, 17 Aug 2020 19:57:27 +0800 +Subject: dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate() + +From: Yu Kuai + +commit 3832b78b3ec2cf51e07102f9b4480e343459b20f upstream. + +If of_find_device_by_node() succeed, at_dma_xlate() doesn't have a +corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200817115728.1706719-3-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1684,8 +1684,10 @@ static struct dma_chan *at_dma_xlate(str + dma_cap_set(DMA_SLAVE, mask); + + atslave = kmalloc(sizeof(*atslave), GFP_KERNEL); +- if (!atslave) ++ if (!atslave) { ++ put_device(&dmac_pdev->dev); + return NULL; ++ } + + atslave->cfg = ATC_DST_H2SEL_HW | ATC_SRC_H2SEL_HW; + /* +@@ -1714,8 +1716,10 @@ static struct dma_chan *at_dma_xlate(str + atslave->dma_dev = &dmac_pdev->dev; + + chan = dma_request_channel(mask, at_dma_filter, atslave); +- if (!chan) ++ if (!chan) { ++ put_device(&dmac_pdev->dev); + return NULL; ++ } + + atchan = to_at_dma_chan(chan); + atchan->per_if = dma_spec->args[0] & 0xff; diff --git a/queue-4.19/dmaengine-at_hdmac-substitute-kzalloc-with-kmalloc.patch b/queue-4.19/dmaengine-at_hdmac-substitute-kzalloc-with-kmalloc.patch new file mode 100644 index 00000000000..5f4b7380ec5 --- /dev/null +++ b/queue-4.19/dmaengine-at_hdmac-substitute-kzalloc-with-kmalloc.patch @@ -0,0 +1,33 @@ +From a6e7f19c910068cb54983f36acebedb376f3a9ac Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Thu, 23 Jan 2020 14:03:02 +0000 +Subject: dmaengine: at_hdmac: Substitute kzalloc with kmalloc + +From: Tudor Ambarus + +commit a6e7f19c910068cb54983f36acebedb376f3a9ac upstream. + +All members of the structure are initialized below in the function, +there is no need to use kzalloc. + +Signed-off-by: Tudor Ambarus +Acked-by: Ludovic Desroches +Link: https://lore.kernel.org/r/20200123140237.125799-1-tudor.ambarus@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1683,7 +1683,7 @@ static struct dma_chan *at_dma_xlate(str + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); + +- atslave = kzalloc(sizeof(*atslave), GFP_KERNEL); ++ atslave = kmalloc(sizeof(*atslave), GFP_KERNEL); + if (!atslave) + return NULL; + diff --git a/queue-4.19/kdev_t-always-inline-major-minor-helper-functions.patch b/queue-4.19/kdev_t-always-inline-major-minor-helper-functions.patch new file mode 100644 index 00000000000..79ddd024fd6 --- /dev/null +++ b/queue-4.19/kdev_t-always-inline-major-minor-helper-functions.patch @@ -0,0 +1,104 @@ +From aa8c7db494d0a83ecae583aa193f1134ef25d506 Mon Sep 17 00:00:00 2001 +From: Josh Poimboeuf +Date: Tue, 29 Dec 2020 15:14:55 -0800 +Subject: kdev_t: always inline major/minor helper functions + +From: Josh Poimboeuf + +commit aa8c7db494d0a83ecae583aa193f1134ef25d506 upstream. + +Silly GCC doesn't always inline these trivial functions. + +Fixes the following warning: + + arch/x86/kernel/sys_ia32.o: warning: objtool: cp_stat64()+0xd8: call to new_encode_dev() with UACCESS enabled + +Link: https://lkml.kernel.org/r/984353b44a4484d86ba9f73884b7306232e25e30.1608737428.git.jpoimboe@redhat.com +Signed-off-by: Josh Poimboeuf +Reported-by: Randy Dunlap +Acked-by: Randy Dunlap [build-tested] +Cc: Peter Zijlstra +Cc: Greg Kroah-Hartman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/kdev_t.h | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/include/linux/kdev_t.h ++++ b/include/linux/kdev_t.h +@@ -21,61 +21,61 @@ + }) + + /* acceptable for old filesystems */ +-static inline bool old_valid_dev(dev_t dev) ++static __always_inline bool old_valid_dev(dev_t dev) + { + return MAJOR(dev) < 256 && MINOR(dev) < 256; + } + +-static inline u16 old_encode_dev(dev_t dev) ++static __always_inline u16 old_encode_dev(dev_t dev) + { + return (MAJOR(dev) << 8) | MINOR(dev); + } + +-static inline dev_t old_decode_dev(u16 val) ++static __always_inline dev_t old_decode_dev(u16 val) + { + return MKDEV((val >> 8) & 255, val & 255); + } + +-static inline u32 new_encode_dev(dev_t dev) ++static __always_inline u32 new_encode_dev(dev_t dev) + { + unsigned major = MAJOR(dev); + unsigned minor = MINOR(dev); + return (minor & 0xff) | (major << 8) | ((minor & ~0xff) << 12); + } + +-static inline dev_t new_decode_dev(u32 dev) ++static __always_inline dev_t new_decode_dev(u32 dev) + { + unsigned major = (dev & 0xfff00) >> 8; + unsigned minor = (dev & 0xff) | ((dev >> 12) & 0xfff00); + return MKDEV(major, minor); + } + +-static inline u64 huge_encode_dev(dev_t dev) ++static __always_inline u64 huge_encode_dev(dev_t dev) + { + return new_encode_dev(dev); + } + +-static inline dev_t huge_decode_dev(u64 dev) ++static __always_inline dev_t huge_decode_dev(u64 dev) + { + return new_decode_dev(dev); + } + +-static inline int sysv_valid_dev(dev_t dev) ++static __always_inline int sysv_valid_dev(dev_t dev) + { + return MAJOR(dev) < (1<<14) && MINOR(dev) < (1<<18); + } + +-static inline u32 sysv_encode_dev(dev_t dev) ++static __always_inline u32 sysv_encode_dev(dev_t dev) + { + return MINOR(dev) | (MAJOR(dev) << 18); + } + +-static inline unsigned sysv_major(u32 dev) ++static __always_inline unsigned sysv_major(u32 dev) + { + return (dev >> 18) & 0x3fff; + } + +-static inline unsigned sysv_minor(u32 dev) ++static __always_inline unsigned sysv_minor(u32 dev) + { + return dev & 0x3ffff; + } diff --git a/queue-4.19/revert-mtd-spinand-fix-oob-read.patch b/queue-4.19/revert-mtd-spinand-fix-oob-read.patch new file mode 100644 index 00000000000..b40ea5d531f --- /dev/null +++ b/queue-4.19/revert-mtd-spinand-fix-oob-read.patch @@ -0,0 +1,38 @@ +From nbd@nbd.name Wed Jan 6 17:49:44 2021 +From: Felix Fietkau +Date: Tue, 5 Jan 2021 11:18:21 +0100 +Subject: Revert "mtd: spinand: Fix OOB read" +To: stable@vger.kernel.org +Cc: gregkh@linuxfoundation.org, Miquel Raynal +Message-ID: <20210105101821.47138-1-nbd@nbd.name> + +From: Felix Fietkau + +This reverts stable commit baad618d078c857f99cc286ea249e9629159901f. + +This commit is adding lines to spinand_write_to_cache_op, wheras the upstream +commit 868cbe2a6dcee451bd8f87cbbb2a73cf463b57e5 that this was supposed to +backport was touching spinand_read_from_cache_op. +It causes a crash on writing OOB data by attempting to write to read-only +kernel memory. + +Cc: Miquel Raynal +Signed-off-by: Felix Fietkau +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/spi/core.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -378,10 +378,6 @@ static int spinand_write_to_cache_op(str + } + } + +- if (req->ooblen) +- memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs, +- req->ooblen); +- + return 0; + } + diff --git a/queue-4.19/series b/queue-4.19/series index 358c11bd667..7272174bfbc 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1 +1,5 @@ revert-mtd-spinand-fix-oob-read.patch +dmaengine-at_hdmac-substitute-kzalloc-with-kmalloc.patch +dmaengine-at_hdmac-add-missing-put_device-call-in-at_dma_xlate.patch +dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch +kdev_t-always-inline-major-minor-helper-functions.patch