From: Sasha Levin Date: Mon, 20 Jul 2020 03:53:06 +0000 (-0400) Subject: Fixes for 4.9 X-Git-Tag: v4.4.231~48 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d22e89695dfd7882e0c1d6665c20b39ce2ed1af2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch b/queue-4.9/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch new file mode 100644 index 00000000000..d7c788056ca --- /dev/null +++ b/queue-4.9/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch @@ -0,0 +1,51 @@ +From 675b09fa8d88392cbd9f6ae519e482a95c0d43d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 10:06:02 +0200 +Subject: ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit d7adfe5ffed9faa05f8926223086b101e14f700d ] + +Fix dtschema validator warnings like: + l2-cache@fffff000: $nodename:0: + 'l2-cache@fffff000' does not match '^(cache-controller|cpu)(@[0-9a-f,]+)*$' + +Fixes: 475dc86d08de ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga.dtsi | 2 +- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index f0702d8063d9b..9a2db3df5edef 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -676,7 +676,7 @@ ocram-ecc@ffd08144 { + }; + }; + +- L2: l2-cache@fffef000 { ++ L2: cache-controller@fffef000 { + compatible = "arm,pl310-cache"; + reg = <0xfffef000 0x1000>; + interrupts = <0 38 0x04>; +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index f520cbff5e1c9..4d496479e1353 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -567,7 +567,7 @@ sdr: sdr@ffc25000 { + reg = <0xffcfb100 0x80>; + }; + +- L2: l2-cache@fffff000 { ++ L2: cache-controller@fffff000 { + compatible = "arm,pl310-cache"; + reg = <0xfffff000 0x1000>; + interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>; +-- +2.25.1 + diff --git a/queue-4.9/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch b/queue-4.9/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch new file mode 100644 index 00000000000..a2f9f5c7741 --- /dev/null +++ b/queue-4.9/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch @@ -0,0 +1,73 @@ +From 2cc8a8afdedebdfe9cbeae82ab54f88f0b86116d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 May 2020 18:29:57 +0100 +Subject: iio:health:afe4404 Fix timestamp alignment and prevent data leak. + +From: Jonathan Cameron + +[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ] + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses a 40 byte array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data with alignment +explicitly requested. This data is allocated with kzalloc so no +data can leak appart from previous readings. + +Fixes: 87aec56e27ef ("iio: health: Add driver for the TI AFE4404 heart monitor") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Acked-by: Andrew F. Davis +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/health/afe4404.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c +index 964f5231a831c..5e256b11ac877 100644 +--- a/drivers/iio/health/afe4404.c ++++ b/drivers/iio/health/afe4404.c +@@ -91,6 +91,7 @@ static const struct reg_field afe4404_reg_fields[] = { + * @regulator: Pointer to the regulator for the IC + * @trig: IIO trigger for this device + * @irq: ADC_RDY line interrupt number ++ * @buffer: Used to construct a scan to push to the iio buffer. + */ + struct afe4404_data { + struct device *dev; +@@ -99,6 +100,7 @@ struct afe4404_data { + struct regulator *regulator; + struct iio_trigger *trig; + int irq; ++ s32 buffer[10] __aligned(8); + }; + + enum afe4404_chan_id { +@@ -337,17 +339,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private) + struct iio_dev *indio_dev = pf->indio_dev; + struct afe4404_data *afe = iio_priv(indio_dev); + int ret, bit, i = 0; +- s32 buffer[10]; + + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->masklength) { + ret = regmap_read(afe->regmap, afe4404_channel_values[bit], +- &buffer[i++]); ++ &afe->buffer[i++]); + if (ret) + goto err; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp); ++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer, ++ pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); + +-- +2.25.1 + diff --git a/queue-4.9/revert-thermal-mediatek-fix-register-index-error.patch b/queue-4.9/revert-thermal-mediatek-fix-register-index-error.patch new file mode 100644 index 00000000000..a38973f7a23 --- /dev/null +++ b/queue-4.9/revert-thermal-mediatek-fix-register-index-error.patch @@ -0,0 +1,130 @@ +From 81175ac13db38b82b668f6e7754620caceb98293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 12:34:12 +0200 +Subject: Revert "thermal: mediatek: fix register index error" + +From: Enric Balletbo i Serra + +[ Upstream commit a8f62f183021be389561570ab5f8c701a5e70298 ] + +This reverts commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 + +The above patch is supposed to fix a register index error on mt2701. It +is not clear if the problem solved is a hang or just an invalid value +returned, my guess is the second. The patch introduces, though, a new +hang on MT8173 device making them unusable. So, seems reasonable, revert +the patch because introduces a worst issue. + +The reason I send a revert instead of trying to fix the issue for MT8173 +is because the information needed to fix the issue is in the datasheet +and is not public. So I am not really able to fix it. + +Fixes the following bug when CONFIG_MTK_THERMAL is set on MT8173 +devices. + +[ 2.222488] Unable to handle kernel paging request at virtual address ffff8000125f5001 +[ 2.230421] Mem abort info: +[ 2.233207] ESR = 0x96000021 +[ 2.236261] EC = 0x25: DABT (current EL), IL = 32 bits +[ 2.241571] SET = 0, FnV = 0 +[ 2.244623] EA = 0, S1PTW = 0 +[ 2.247762] Data abort info: +[ 2.250640] ISV = 0, ISS = 0x00000021 +[ 2.254473] CM = 0, WnR = 0 +[ 2.257544] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041850000 +[ 2.264251] [ffff8000125f5001] pgd=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=006800001100b707 +[ 2.274867] Internal error: Oops: 96000021 [#1] PREEMPT SMP +[ 2.280432] Modules linked in: +[ 2.283483] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc6+ #162 +[ 2.289914] Hardware name: Google Elm (DT) +[ 2.294003] pstate: 20000005 (nzCv daif -PAN -UAO) +[ 2.298792] pc : mtk_read_temp+0xb8/0x1c8 +[ 2.302793] lr : mtk_read_temp+0x7c/0x1c8 +[ 2.306794] sp : ffff80001003b930 +[ 2.310100] x29: ffff80001003b930 x28: 0000000000000000 +[ 2.315404] x27: 0000000000000002 x26: ffff0000f9550b10 +[ 2.320709] x25: ffff0000f9550a80 x24: 0000000000000090 +[ 2.326014] x23: ffff80001003ba24 x22: 00000000610344c0 +[ 2.331318] x21: 0000000000002710 x20: 00000000000001f4 +[ 2.336622] x19: 0000000000030d40 x18: ffff800011742ec0 +[ 2.341926] x17: 0000000000000001 x16: 0000000000000001 +[ 2.347230] x15: ffffffffffffffff x14: ffffff0000000000 +[ 2.352535] x13: ffffffffffffffff x12: 0000000000000028 +[ 2.357839] x11: 0000000000000003 x10: ffff800011295ec8 +[ 2.363143] x9 : 000000000000291b x8 : 0000000000000002 +[ 2.368447] x7 : 00000000000000a8 x6 : 0000000000000004 +[ 2.373751] x5 : 0000000000000000 x4 : ffff800011295cb0 +[ 2.379055] x3 : 0000000000000002 x2 : ffff8000125f5001 +[ 2.384359] x1 : 0000000000000001 x0 : ffff0000f9550a80 +[ 2.389665] Call trace: +[ 2.392105] mtk_read_temp+0xb8/0x1c8 +[ 2.395760] of_thermal_get_temp+0x2c/0x40 +[ 2.399849] thermal_zone_get_temp+0x78/0x160 +[ 2.404198] thermal_zone_device_update.part.0+0x3c/0x1f8 +[ 2.409589] thermal_zone_device_update+0x34/0x48 +[ 2.414286] of_thermal_set_mode+0x58/0x88 +[ 2.418375] thermal_zone_of_sensor_register+0x1a8/0x1d8 +[ 2.423679] devm_thermal_zone_of_sensor_register+0x64/0xb0 +[ 2.429242] mtk_thermal_probe+0x690/0x7d0 +[ 2.433333] platform_drv_probe+0x5c/0xb0 +[ 2.437335] really_probe+0xe4/0x448 +[ 2.440901] driver_probe_device+0xe8/0x140 +[ 2.445077] device_driver_attach+0x7c/0x88 +[ 2.449252] __driver_attach+0xac/0x178 +[ 2.453082] bus_for_each_dev+0x78/0xc8 +[ 2.456909] driver_attach+0x2c/0x38 +[ 2.460476] bus_add_driver+0x14c/0x230 +[ 2.464304] driver_register+0x6c/0x128 +[ 2.468131] __platform_driver_register+0x50/0x60 +[ 2.472831] mtk_thermal_driver_init+0x24/0x30 +[ 2.477268] do_one_initcall+0x50/0x298 +[ 2.481098] kernel_init_freeable+0x1ec/0x264 +[ 2.485450] kernel_init+0x1c/0x110 +[ 2.488931] ret_from_fork+0x10/0x1c +[ 2.492502] Code: f9401081 f9400402 b8a67821 8b010042 (b9400042) +[ 2.498599] ---[ end trace e43e3105ed27dc99 ]--- +[ 2.503367] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b +[ 2.511020] SMP: stopping secondary CPUs +[ 2.514941] Kernel Offset: disabled +[ 2.518421] CPU features: 0x090002,25006005 +[ 2.522595] Memory Limit: none +[ 2.525644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]-- + +Cc: Michael Kao +Fixes: eb9aecd90d1a ("thermal: mediatek: fix register index error") +Signed-off-by: Enric Balletbo i Serra +Reviewed-by: Matthias Brugger +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200707103412.1010823-1-enric.balletbo@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/mtk_thermal.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c +index ea9558679634b..34169c32d4956 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mtk_thermal.c +@@ -348,8 +348,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank) + u32 raw; + + for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) { +- raw = readl(mt->thermal_base + +- conf->msr[conf->bank_data[bank->id].sensors[i]]); ++ raw = readl(mt->thermal_base + conf->msr[i]); + + temp = raw_to_mcelsius(mt, + conf->bank_data[bank->id].sensors[i], +@@ -486,8 +485,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num, + + for (i = 0; i < conf->bank_data[num].num_sensors; i++) + writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]], +- mt->thermal_base + +- conf->adcpnp[conf->bank_data[num].sensors[i]]); ++ mt->thermal_base + conf->adcpnp[i]); + + writel((1 << conf->bank_data[num].num_sensors) - 1, + mt->thermal_base + TEMP_MONCTL0); +-- +2.25.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 036ef8b3912..1baa62504da 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -50,3 +50,9 @@ revert-usb-ehci-platform-set-pm-runtime-as-active-on.patch revert-usb-xhci-plat-set-pm-runtime-as-active-on-res.patch revert-usb-ohci-platform-fix-a-warning-when-hibernat.patch efi-arm-defer-probe-of-pcie-backed-efifb-on-dt-syste.patch +iio-health-afe4404-fix-timestamp-alignment-and-preve.patch +spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch +usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch +staging-comedi-verify-array-index-is-correct-before-.patch +revert-thermal-mediatek-fix-register-index-error.patch +arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch diff --git a/queue-4.9/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch b/queue-4.9/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch new file mode 100644 index 00000000000..3bd320b755d --- /dev/null +++ b/queue-4.9/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch @@ -0,0 +1,70 @@ +From 60a253423a0d818db6e8a260f878081d27499153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 16:34:34 +0200 +Subject: spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate + +From: Marc Kleine-Budde + +[ Upstream commit ed7815db70d17b1741883f2da8e1d80bc2efe517 ] + +A SPI transfer defines the _maximum_ speed of the SPI transfer. However the +driver doesn't take into account that the clock divider is always rounded down +(due to integer arithmetics). This results in a too high clock rate for the SPI +transfer. + +E.g.: with a mclk_rate of 24 MHz and a SPI transfer speed of 10 MHz, the +original code calculates a reg of "0", which results in a effective divider of +"2" and a 12 MHz clock for the SPI transfer. + +This patch fixes the issue by using DIV_ROUND_UP() instead of a plain +integer division. + +While there simplify the divider calculation for the CDR1 case, use +order_base_2() instead of two ilog2() calculations. + +Fixes: 3558fe900e8a ("spi: sunxi: Add Allwinner A31 SPI controller driver") +Signed-off-by: Marc Kleine-Budde +Acked-by: Maxime Ripard +Link: https://lore.kernel.org/r/20200706143443.9855-2-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sun6i.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index 7e7da97982aaf..17068e62e792d 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -163,7 +163,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + struct spi_transfer *tfr) + { + struct sun6i_spi *sspi = spi_master_get_devdata(master); +- unsigned int mclk_rate, div, timeout; ++ unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout; + unsigned int start, end, tx_time; + unsigned int tx_len = 0; + int ret = 0; +@@ -241,14 +241,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + * First try CDR2, and if we can't reach the expected + * frequency, fall back to CDR1. + */ +- div = mclk_rate / (2 * tfr->speed_hz); +- if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) { +- if (div > 0) +- div--; +- +- reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS; ++ div_cdr1 = DIV_ROUND_UP(mclk_rate, tfr->speed_hz); ++ div_cdr2 = DIV_ROUND_UP(div_cdr1, 2); ++ if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) { ++ reg = SUN6I_CLK_CTL_CDR2(div_cdr2 - 1) | SUN6I_CLK_CTL_DRS; + } else { +- div = ilog2(mclk_rate) - ilog2(tfr->speed_hz); ++ div = min(SUN6I_CLK_CTL_CDR1_MASK, order_base_2(div_cdr1)); + reg = SUN6I_CLK_CTL_CDR1(div); + } + +-- +2.25.1 + diff --git a/queue-4.9/staging-comedi-verify-array-index-is-correct-before-.patch b/queue-4.9/staging-comedi-verify-array-index-is-correct-before-.patch new file mode 100644 index 00000000000..4539f6e13d1 --- /dev/null +++ b/queue-4.9/staging-comedi-verify-array-index-is-correct-before-.patch @@ -0,0 +1,54 @@ +From 3d433c7004ced0bf71e8e8957a52b7dcb88871e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 13:29:36 +0300 +Subject: staging: comedi: verify array index is correct before using it + +From: Dan Carpenter + +[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ] + +This code reads from the array before verifying that "trig" is a valid +index. If the index is wildly out of bounds then reading from an +invalid address could lead to an Oops. + +Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions") +Signed-off-by: Dan Carpenter +Reviewed-by: Ian Abbott +Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c +index 63991c49ff230..79a8799b12628 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1500.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c +@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + unsigned int lo_mask = data[5] << shift; + unsigned int chan_mask = hi_mask | lo_mask; + unsigned int old_mask = (1 << shift) - 1; +- unsigned int pm = devpriv->pm[trig] & old_mask; +- unsigned int pt = devpriv->pt[trig] & old_mask; +- unsigned int pp = devpriv->pp[trig] & old_mask; ++ unsigned int pm; ++ unsigned int pt; ++ unsigned int pp; + + if (trig > 1) { + dev_dbg(dev->class_dev, +@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + return -EINVAL; + } + ++ pm = devpriv->pm[trig] & old_mask; ++ pt = devpriv->pt[trig] & old_mask; ++ pp = devpriv->pp[trig] & old_mask; ++ + switch (data[2]) { + case COMEDI_DIGITAL_TRIG_DISABLE: + /* clear trigger configuration */ +-- +2.25.1 + diff --git a/queue-4.9/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch b/queue-4.9/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch new file mode 100644 index 00000000000..66f62f3f0d2 --- /dev/null +++ b/queue-4.9/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch @@ -0,0 +1,39 @@ +From 83c3915647ee59426e4d098975df5566e951effb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 20:35:54 +0200 +Subject: usb: gadget: udc: atmel: fix uninitialized read in debug printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ] + +Fixed commit moved the assignment of 'req', but did not update a +reference in the DBG() call. Use the argument as it was renamed. + +Fixes: 5fb694f96e7c ("usb: gadget: udc: atmel: fix possible oops when unloading module") +Signed-off-by: Michał Mirosław +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c +index 57dd3bad95397..ccf1e9fe5ebde 100644 +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -843,7 +843,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) + u32 status; + + DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n", +- ep->ep.name, req); ++ ep->ep.name, _req); + + spin_lock_irqsave(&udc->lock, flags); + +-- +2.25.1 +