--- /dev/null
+From daniel@iogearbox.net Thu Aug 30 05:13:02 2018
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Sat, 18 Aug 2018 00:21:34 +0200
+Subject: bpf, arm32: fix stack var offset in jit
+To: gregkh@linuxfoundation.org
+Cc: stable@vger.kernel.org, pbrobinson@gmail.com, mh+netdev@zugschlus.de, stefan.wahren@i2se.com, rmk+kernel@armlinux.org.uk, ast@kernel.org, daniel@iogearbox.net
+Message-ID: <2006e3ef8d4e30f2c901a39423655df9acaf1ce2.1534544005.git.daniel@iogearbox.net>
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+Commit 38ca93060163 ("bpf, arm32: save 4 bytes of unneeded stack
+space") messed up STACK_VAR() by 4 bytes presuming it was related
+to skb scratch buffer space, but it clearly isn't as this refers
+to the top word in stack, therefore restore it. This fixes a NULL
+pointer dereference seen during bootup when JIT is enabled and BPF
+program run in sk_filter_trim_cap() triggered by systemd-udevd.
+
+JIT rework in 1c35ba122d4a ("ARM: net: bpf: use negative numbers
+for stacked registers") and 96cced4e774a ("ARM: net: bpf: access
+eBPF scratch space using ARM FP register") removed the affected
+parts, so only needed in 4.18 stable.
+
+Fixes: 38ca93060163 ("bpf, arm32: save 4 bytes of unneeded stack space")
+Reported-by: Peter Robinson <pbrobinson@gmail.com>
+Reported-by: Marc Haber <mh+netdev@zugschlus.de>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Tested-by: Peter Robinson <pbrobinson@gmail.com>
+Cc: Russell King <rmk+kernel@armlinux.org.uk>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+---
+ arch/arm/net/bpf_jit_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -238,7 +238,7 @@ static void jit_fill_hole(void *area, un
+ #define STACK_SIZE ALIGN(_STACK_SIZE, STACK_ALIGNMENT)
+
+ /* Get the offset of eBPF REGISTERs stored on scratch space. */
+-#define STACK_VAR(off) (STACK_SIZE - off)
++#define STACK_VAR(off) (STACK_SIZE - off - 4)
+
+ #if __LINUX_ARM_ARCH__ < 7
+
--- /dev/null
+From a9191579ba1086d91842199263e6fe6bb5eec1ba Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Tue, 19 Jun 2018 16:10:00 +0100
+Subject: regulator: arizona-ldo1: Use correct device to get enable GPIO
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+commit a9191579ba1086d91842199263e6fe6bb5eec1ba upstream.
+
+Currently the enable GPIO is being looked up on the regulator
+device itself but that does not have its own DT node, this causes
+the lookup to fail and the regulator not to get its GPIO. The DT
+node is shared across the whole MFD and as such the lookup needs
+to happen on that parent device. Moving the lookup to the parent
+device also means devres can no longer be used as the life time
+would attach to the wrong device.
+
+Additionally, the enable GPIO is active high so we should be passing
+GPIOD_OUT_LOW to ensure the regulator starts in its off state allowing
+the driver to enable it when it is ready.
+
+Fixes: e1739e86f0cb ("regulator: arizona-ldo1: Look up a descriptor and pass to the core")
+Reported-by: Matthias Reichl <hias@horus.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+From: Matthias Reichl <hias@horus.com>
+
+---
+ drivers/regulator/arizona-ldo1.c | 27 ++++++++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/regulator/arizona-ldo1.c
++++ b/drivers/regulator/arizona-ldo1.c
+@@ -36,6 +36,8 @@ struct arizona_ldo1 {
+
+ struct regulator_consumer_supply supply;
+ struct regulator_init_data init_data;
++
++ struct gpio_desc *ena_gpiod;
+ };
+
+ static int arizona_ldo1_hc_list_voltage(struct regulator_dev *rdev,
+@@ -253,12 +255,17 @@ static int arizona_ldo1_common_init(stru
+ }
+ }
+
+- /* We assume that high output = regulator off */
+- config.ena_gpiod = devm_gpiod_get_optional(&pdev->dev, "wlf,ldoena",
+- GPIOD_OUT_HIGH);
++ /* We assume that high output = regulator off
++ * Don't use devm, since we need to get against the parent device
++ * so clean up would happen at the wrong time
++ */
++ config.ena_gpiod = gpiod_get_optional(parent_dev, "wlf,ldoena",
++ GPIOD_OUT_LOW);
+ if (IS_ERR(config.ena_gpiod))
+ return PTR_ERR(config.ena_gpiod);
+
++ ldo1->ena_gpiod = config.ena_gpiod;
++
+ if (pdata->init_data)
+ config.init_data = pdata->init_data;
+ else
+@@ -276,6 +283,9 @@ static int arizona_ldo1_common_init(stru
+ of_node_put(config.of_node);
+
+ if (IS_ERR(ldo1->regulator)) {
++ if (config.ena_gpiod)
++ gpiod_put(config.ena_gpiod);
++
+ ret = PTR_ERR(ldo1->regulator);
+ dev_err(&pdev->dev, "Failed to register LDO1 supply: %d\n",
+ ret);
+@@ -334,8 +344,19 @@ static int arizona_ldo1_probe(struct pla
+ return ret;
+ }
+
++static int arizona_ldo1_remove(struct platform_device *pdev)
++{
++ struct arizona_ldo1 *ldo1 = platform_get_drvdata(pdev);
++
++ if (ldo1->ena_gpiod)
++ gpiod_put(ldo1->ena_gpiod);
++
++ return 0;
++}
++
+ static struct platform_driver arizona_ldo1_driver = {
+ .probe = arizona_ldo1_probe,
++ .remove = arizona_ldo1_remove,
+ .driver = {
+ .name = "arizona-ldo1",
+ },
projects / thirdparty / kernel / stable-queue.git / commitdiff
