From: Greg Kroah-Hartman Date: Thu, 30 Apr 2020 13:10:49 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.4.37~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e4672a8970fa495e6735ed0f5ed70fa672f6d720;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: iio-ad7797-use-correct-attribute_group.patch nfsd-memory-corruption-in-nfsd4_lock.patch usb-dwc3-gadget-do-link-recovery-for-ss-and-ssp.patch usb-gadget-udc-bdc-remove-unnecessary-null-checks-in-bdc_req_complete.patch --- diff --git a/queue-4.14/iio-ad7797-use-correct-attribute_group.patch b/queue-4.14/iio-ad7797-use-correct-attribute_group.patch new file mode 100644 index 00000000000..b39e698b320 --- /dev/null +++ b/queue-4.14/iio-ad7797-use-correct-attribute_group.patch @@ -0,0 +1,36 @@ +From 28535877ac5b2b84f0d394fd67a5ec71c0c48b10 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Tue, 10 Mar 2020 22:16:54 +0800 +Subject: iio:ad7797: Use correct attribute_group + +From: YueHaibing + +commit 28535877ac5b2b84f0d394fd67a5ec71c0c48b10 upstream. + +It should use ad7797_attribute_group in ad7797_info, +according to commit ("iio:ad7793: Add support for the ad7796 and ad7797"). + +Scale is fixed for the ad7796 and not programmable, hence +should not have the scale_available attribute. + +Fixes: fd1a8b912841 ("iio:ad7793: Add support for the ad7796 and ad7797") +Signed-off-by: YueHaibing +Reviewed-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad7793.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -543,7 +543,7 @@ static const struct iio_info ad7797_info + .read_raw = &ad7793_read_raw, + .write_raw = &ad7793_write_raw, + .write_raw_get_fmt = &ad7793_write_raw_get_fmt, +- .attrs = &ad7793_attribute_group, ++ .attrs = &ad7797_attribute_group, + .validate_trigger = ad_sd_validate_trigger, + .driver_module = THIS_MODULE, + }; diff --git a/queue-4.14/nfsd-memory-corruption-in-nfsd4_lock.patch b/queue-4.14/nfsd-memory-corruption-in-nfsd4_lock.patch new file mode 100644 index 00000000000..e9460cb6c37 --- /dev/null +++ b/queue-4.14/nfsd-memory-corruption-in-nfsd4_lock.patch @@ -0,0 +1,37 @@ +From e1e8399eee72e9d5246d4d1bcacd793debe34dd3 Mon Sep 17 00:00:00 2001 +From: Vasily Averin +Date: Fri, 27 Mar 2020 07:50:40 +0300 +Subject: nfsd: memory corruption in nfsd4_lock() + +From: Vasily Averin + +commit e1e8399eee72e9d5246d4d1bcacd793debe34dd3 upstream. + +New struct nfsd4_blocked_lock allocated in find_or_allocate_block() +does not initialized nbl_list and nbl_lru. +If conflock allocation fails rollback can call list_del_init() +access uninitialized fields and corrupt memory. + +v2: just initialize nbl_list and nbl_lru right after nbl allocation. + +Fixes: 76d348fadff5 ("nfsd: have nfsd4_lock use blocking locks for v4.1+ lock") +Signed-off-by: Vasily Averin +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4state.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -246,6 +246,8 @@ find_or_allocate_block(struct nfs4_locko + if (!nbl) { + nbl= kmalloc(sizeof(*nbl), GFP_KERNEL); + if (nbl) { ++ INIT_LIST_HEAD(&nbl->nbl_list); ++ INIT_LIST_HEAD(&nbl->nbl_lru); + fh_copy_shallow(&nbl->nbl_fh, fh); + locks_init_lock(&nbl->nbl_lock); + nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client, diff --git a/queue-4.14/series b/queue-4.14/series index f9a618d78f5..6a634f92dc2 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -86,3 +86,7 @@ remoteproc-fix-wrong-rvring-index-computation.patch mtd-cfi-fix-deadloop-in-cfi_cmdset_0002.c-do_write_buffer.patch include-uapi-linux-swab.h-fix-userspace-breakage-use-__bits_per_long-for-swap.patch binder-take-read-mode-of-mmap_sem-in-binder_alloc_free_page.patch +usb-dwc3-gadget-do-link-recovery-for-ss-and-ssp.patch +usb-gadget-udc-bdc-remove-unnecessary-null-checks-in-bdc_req_complete.patch +iio-ad7797-use-correct-attribute_group.patch +nfsd-memory-corruption-in-nfsd4_lock.patch diff --git a/queue-4.14/usb-dwc3-gadget-do-link-recovery-for-ss-and-ssp.patch b/queue-4.14/usb-dwc3-gadget-do-link-recovery-for-ss-and-ssp.patch new file mode 100644 index 00000000000..787dc1fc0da --- /dev/null +++ b/queue-4.14/usb-dwc3-gadget-do-link-recovery-for-ss-and-ssp.patch @@ -0,0 +1,54 @@ +From d0550cd20e52558ecf6847a0f96ebd5d944c17e4 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Fri, 31 Jan 2020 16:25:50 -0800 +Subject: usb: dwc3: gadget: Do link recovery for SS and SSP + +From: Thinh Nguyen + +commit d0550cd20e52558ecf6847a0f96ebd5d944c17e4 upstream. + +The controller always supports link recovery for device in SS and SSP. +Remove the speed limit check. Also, when the device is in RESUME or +RESET state, it means the controller received the resume/reset request. +The driver must send the link recovery to acknowledge the request. They +are valid states for the driver to send link recovery. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Fixes: ee5cd41c9117 ("usb: dwc3: Update speed checks for SuperSpeedPlus") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1641,7 +1641,6 @@ static int __dwc3_gadget_wakeup(struct d + u32 reg; + + u8 link_state; +- u8 speed; + + /* + * According to the Databook Remote wakeup request should +@@ -1651,16 +1650,13 @@ static int __dwc3_gadget_wakeup(struct d + */ + reg = dwc3_readl(dwc->regs, DWC3_DSTS); + +- speed = reg & DWC3_DSTS_CONNECTSPD; +- if ((speed == DWC3_DSTS_SUPERSPEED) || +- (speed == DWC3_DSTS_SUPERSPEED_PLUS)) +- return 0; +- + link_state = DWC3_DSTS_USBLNKST(reg); + + switch (link_state) { ++ case DWC3_LINK_STATE_RESET: + case DWC3_LINK_STATE_RX_DET: /* in HS, means Early Suspend */ + case DWC3_LINK_STATE_U3: /* in HS, means SUSPEND */ ++ case DWC3_LINK_STATE_RESUME: + break; + default: + return -EINVAL; diff --git a/queue-4.14/usb-gadget-udc-bdc-remove-unnecessary-null-checks-in-bdc_req_complete.patch b/queue-4.14/usb-gadget-udc-bdc-remove-unnecessary-null-checks-in-bdc_req_complete.patch new file mode 100644 index 00000000000..f678638967d --- /dev/null +++ b/queue-4.14/usb-gadget-udc-bdc-remove-unnecessary-null-checks-in-bdc_req_complete.patch @@ -0,0 +1,47 @@ +From 09b04abb70f096333bef6bc95fa600b662e7ee13 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Sat, 28 Mar 2020 18:12:46 -0700 +Subject: usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete + +From: Nathan Chancellor + +commit 09b04abb70f096333bef6bc95fa600b662e7ee13 upstream. + +When building with Clang + -Wtautological-pointer-compare: + +drivers/usb/gadget/udc/bdc/bdc_ep.c:543:28: warning: comparison of +address of 'req->queue' equal to a null pointer is always false +[-Wtautological-pointer-compare] + if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) + ~~~~~^~~~~ ~~~~ +drivers/usb/gadget/udc/bdc/bdc_ep.c:543:51: warning: comparison of +address of 'req->usb_req' equal to a null pointer is always false +[-Wtautological-pointer-compare] + if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) + ~~~~~^~~~~~~ ~~~~ +2 warnings generated. + +As it notes, these statements will always evaluate to false so remove +them. + +Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") +Link: https://github.com/ClangBuiltLinux/linux/issues/749 +Signed-off-by: Nathan Chancellor +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c +@@ -546,7 +546,7 @@ static void bdc_req_complete(struct bdc_ + { + struct bdc *bdc = ep->bdc; + +- if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) ++ if (req == NULL) + return; + + dev_dbg(bdc->dev, "%s ep:%s status:%d\n", __func__, ep->name, status);