Merge tag 'v6.6.6' into dev-6.6

This is the 6.6.6 stable release

Signed-off-by: Joel Stanley <joel@jms.id.au>

clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider

commit 5ad1e217a2b23aa046b241183bd9452d259d70d0 upstream.

`struct clk_hw_onecell_data` is a flexible structure, which means

clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider

commit 5ad1e217a2b23aa046b241183bd9452d259d70d0 upstream.

`struct clk_hw_onecell_data` is a flexible structure, which means that
it contains flexible-array member at the bottom, in this case array
`hws`:

include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };

This could potentially lead to an overwrite of the objects following
`clk_data` in `struct visconti_pll_provider`, in this case
`struct device_node *node;`, at run-time:

drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {
17 void __iomem *reg_base;
18 struct clk_hw_onecell_data clk_data;
19 struct device_node *node;
20 };

Notice that a total of 56 bytes are allocated for flexible-array `hws`
at line 328. See below:

include/dt-bindings/clock/toshiba,tmpv770x.h:
14 #define TMPV770X_NR_PLL 7

drivers/clk/visconti/pll-tmpv770x.c:
69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);

drivers/clk/visconti/pll.c:
321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
322 void __iomem *base,
323 unsigned long nr_plls)
324 {
325 struct visconti_pll_provider *ctx;
...
328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls), GFP_KERNEL);

`struct_size(ctx, clk_data.hws, nr_plls)` above translates to
sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
24 + 8 * 7 == 24 + 56
^^^^
|
allocated bytes for flex array `hws`

$ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o
struct visconti_pll_provider {
void * reg_base; /* 0 8 */
struct clk_hw_onecell_data clk_data; /* 8 8 */
struct device_node * node; /* 16 8 */

/* size: 24, cachelines: 1, members: 3 */
/* last cacheline: 24 bytes */
};

And then, after the allocation, some data is written into all members
of `struct visconti_pll_provider`:

332 for (i = 0; i < nr_plls; ++i)
333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
334
335 ctx->node = np;
336 ctx->reg_base = base;
337 ctx->clk_data.num = nr_plls;

Fix all these by placing the declaration of object `clk_data` at the
end of `struct visconti_pll_provider`. Also, add a comment to make it
clear that this object must always be last in the structure, and
prevent this bug from being introduced again in the future.

-Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
ready to enable it globally.

Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and reset driver")
Cc: stable@vger.kernel.org
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/57a831d94ee2b3889b11525d4ad500356f89576f.1697492890.git.gustavoars@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

Merge branch 'next' into for-linus

Prepare input updates for 6.6 merge window.

Merge tag 'v6.4' into next

Sync up with mainline to bring in updates to shared infrastructure.

Merge branch 'for-6.5/apple' into for-linus

- improved support for Keychron K8 keyboard (Lasse Brun)

Merge drm/drm-next into drm-misc-next-fixes

Backmerging to sync drm-misc-next-fixes with drm-misc-next.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge branch 'drm-next' of git://anongit.freedesktop.org/drm/drm into msm-next-lumag-base

Merge the drm-next tree to pick up the DRM DSC helpers (merged via
drm-intel-next tree). MSM DSC v1.2 patche

Merge branch 'drm-next' of git://anongit.freedesktop.org/drm/drm into msm-next-lumag-base

Merge the drm-next tree to pick up the DRM DSC helpers (merged via
drm-intel-next tree). MSM DSC v1.2 patches depend on these helpers.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

show more ...

Merge tag 'v6.4-rc4' into wpan-next/staging

Linux 6.4-rc4

Merge drm/drm-next into drm-intel-gt-next

For conflict avoidance we need the following commit:

c9a9f18d3ad8 drm/i915/huc: use const struct bus_type pointers

Signed-off-by: Tvrtko Ursulin <tvrtko

Merge drm/drm-next into drm-intel-gt-next

For conflict avoidance we need the following commit:

c9a9f18d3ad8 drm/i915/huc: use const struct bus_type pointers

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>

show more ...

Merge drm/drm-next into drm-intel-next

Backmerge to get some hwmon dependencies.

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge drm/drm-fixes into drm-misc-fixes

Let's bring 6.4-rc1 in drm-misc-fixes to start the new fix cycle.

Signed-off-by: Maxime Ripard <maxime@cerno.tech>

Merge drm/drm-next into drm-misc-next

Start the 6.5 release cycle.

Signed-off-by: Maxime Ripard <maxime@cerno.tech>

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"Nothing looks out of the ordinary in this batch of clk driver updates.

T

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"Nothing looks out of the ordinary in this batch of clk driver updates.

There are a couple patches to the core clk framework, but they're all
basically cleanups or debugging aids. The driver updates and new
additions are dominated in the diffstat by Qualcomm and MediaTek
drivers. Qualcomm gained a handful of new drivers for various SoCs,
and MediaTek gained a bunch of drivers for MT8188. The MediaTek
drivers are being modernized as well, so there are updates all over
that vendor's clk drivers. There's also a couple other new clk drivers
in here, for example the Starfive JH7110 SoC support is added.

Outside of the two major SoC vendors though, we have the usual
collection of non-critical fixes and cleanups to various clk drivers.
It's good to see that we're getting more cleanups and modernization
patches. Maybe one day we'll be able to properly split clk providers
from clk consumers.

Core:
- Print an informational message before disabling unused clks

New Drivers:
- BCM63268 timer clock and reset controller
- Frequency Hopping (FHCTL) on MediaTek MT6795, MT8173, MT8192 and
MT8195 SoCs
- Mediatek MT8188 SoC clk drivers
- Clock driver for Sunplus SP7021 SoC
- Clk driver support for Loongson-2 SoCs
- Clock driver for Skyworks Si521xx I2C PCIe clock generators
- Initial Starfive JH7110 clk/reset support
- Global clock controller drivers for Qualcomm SM7150, IPQ9574,
MSM8917 and IPQ5332 SoCs
- GPU clock controller drivers for SM6115, SM6125, SM6375 and SA8775P
SoCs

Updates:
- Shrink size of clk_fractional_divider a little
- Convert various clk drivers to devm_of_clk_add_hw_provider()
- Convert platform clk drivers to remove_new()
- Converted most Mediatek clock drivers to struct platform_driver
- MediaTek clock drivers can be built as modules
- Reimplement Loongson-1 clk driver with DT support
- Migrate socfpga clk driver to of_clk_add_hw_provider()
- Support for i3c clks on Aspeed ast2600 SoCs
- Add clock generic devm_clk_hw_register_gate_parent_data
- Add audiomix block control for i.MX8MP
- Add support for determine_rate to i.MX composite-8m
- Let the LCDIF Pixel clock of i.MX8MM and i.MX8MN set parent rate
- Provide clock name in error message for clk-gpr-mux on get parent
failure
- Drop duplicate imx_clk_mux_flags macro
- Register the i.MX8MP Media Disp2 Pix clock as bus clock
- Add Media LDB root clock to i.MX8MP
- Make i.MX8MP nand_usdhc_bus clock as non-critical
- Fix the rate table for i.MX fracn-gppll
- Disable HW control for the fracn-gppll in order to be controlled by
register write
- Add support for interger PLL in fracn-gppll
- Add mcore_booted module parameter to i.MX93 provider
- Add NIC, A55 and ARM PLL clocks to i.MX93
- Fix i.MX8ULP XBAR_DIVBUS and AD_SLOW clock parents
- Use "divider closest" clock type for PLL4_PFD dividers on i.MX8ULP
to get more accurate clock rates
- Mark the MU0_Bi and TPM5 clocks on i.MX8ULP as critical
- Update some of the i.MX critical clocks flags to allow glitchless
on-the-fly rate change.
- Add I2C5 clock on Renesas R-Car V3H
- Exynos850: Add CMU_G3D clock controller for the Mali GPU
- Extract Exynos5433 (ARM64) clock controller power management code
to common driver parts
- Exynos850: make PMU_ALIVE_PCLK clock critical
- Add Audio, thermal, camera (CSI-2), Image Signal Processor/Channel
Selector (ISPCS), and video capture (VIN) clocks on Renesas R-Car
V4H
- Add video capture (VIN) clocks on Renesas R-Car V3H
- Add Cortex-A53 System CPU (Z2) clocks on Renesas R-Car V3M and V3H
- Support for Stromer Plus PLL on Qualcomm IPQ5332
- Add a missing reset to Qualcomm QCM2290
- Migrate Qualcomm IPQ4019 to clk_parent_data
- Make USB GDSCs enter retention state when disabled on Qualcomm
SM6375, MSM8996 and MSM8998 SoCs
- Set floor rounding clk_ops for Qualcomm QCM2290 SDCC2 clk
- Add two EMAC GDSCs on Qualcomm SC8280XP
- Use shared rcg clk ops in Qualcomm SM6115 GCC
- Park Qualcomm SM8350 PCIe PIPE clks when disabled
- Add GDSCs to Qualcomm SC7280 LPASS audio clock controller
- Add missing XO clocks to Qualcomm MSM8226 and MSM8974
- Convert some Qualcomm clk DT bindings to YAML
- Reparenting fix for the clock supplying camera modules on Rockchip
rk3399
- Mark more critical (bus-)clocks on Rockchip rk3588"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (290 commits)
clk: qcom: gcc-sc8280xp: Add EMAC GDSCs
clk: starfive: Delete the redundant dev_set_drvdata() in JH7110 clock drivers
clk: rockchip: rk3588: make gate linked clocks critical
clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk
clk: qcom: add the GPUCC driver for sa8775p
dt-bindings: clock: qcom: describe the GPUCC clock for SA8775P
clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling
clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc
clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration
dt-bindings: clock: qcom,sc7280-lpasscc: Add qcom,adsp-pil-mode property
clk: starfive: Avoid casting iomem pointers
clk: microchip: fix potential UAF in auxdev release callback
clk: qcom: rpm: Use managed `of_clk_add_hw_provider()`
clk: mediatek: fhctl: Mark local variables static
clk: sifive: make SiFive clk drivers depend on ARCH_ symbols
clk: uniphier: Use managed `of_clk_add_hw_provider()`
clk: si5351: Use managed `of_clk_add_hw_provider()`
clk: si570: Use managed `of_clk_add_hw_provider()`
clk: si514: Use managed `of_clk_add_hw_provider()`
clk: lmk04832: Use managed `of_clk_add_hw_provider()`
...

show more ...

Merge branches 'clk-cleanup', 'clk-aspeed', 'clk-dt', 'clk-renesas' and 'clk-skyworks' into clk-next

- Support for i3c clks on Aspeed ast2600 SoCs
- Clock driver for Skyworks Si521xx I2C PCIe cloc

Merge branches 'clk-cleanup', 'clk-aspeed', 'clk-dt', 'clk-renesas' and 'clk-skyworks' into clk-next

- Support for i3c clks on Aspeed ast2600 SoCs
- Clock driver for Skyworks Si521xx I2C PCIe clock generators

* clk-cleanup:
clk: microchip: fix potential UAF in auxdev release callback
clk: sifive: make SiFive clk drivers depend on ARCH_ symbols
clk: stm32h7: Remove an unused field in struct stm32_fractional_divider
clk: tegra20: fix gcc-7 constant overflow warning
clock: milbeaut: use devm_platform_get_and_ioremap_resource()
clk: Print an info line before disabling unused clocks
clk: ti: Use of_address_to_resource()
clk: remove unnecessary (void*) conversions
clk: at91: clk-sam9x60-pll: fix return value check
clk: visconti: remove unused visconti_pll_provider::regmap

* clk-aspeed:
dt-bindings: clock: ast2600: Expand comment on reset definitions
clk: ast2600: Add comment about combined clock + reset handling
dt-bindings: clock: ast2600: remove IC36 & I3C7 clock definitions
clk: ast2600: Add full configs for I3C clocks
dt-bindings: clock: ast2600: Add top-level I3C clock
clk: ast2600: allow empty entries in aspeed_g6_gates

* clk-dt:
clk: mediatek: clk-pllfh: fix missing of_node_put() in fhctl_parse_dt()
clk: Use of_property_present() for testing DT property presence

* clk-renesas:
clk: renesas: r8a77980: Add I2C5 clock
clk: rs9: Add support for 9FGV0441
clk: rs9: Support device specific dif bit calculation
dt-bindings: clk: rs9: Add 9FGV0441
clk: rs9: Check for vendor/device ID
clk: renesas: Convert to platform remove callback returning void
clk: renesas: r9a06g032: Improve clock tables
clk: renesas: r9a06g032: Document structs
clk: renesas: r9a06g032: Drop unused fields
clk: renesas: r9a06g032: Improve readability
clk: renesas: r8a77980: Add Z2 clock
clk: renesas: r8a77970: Add Z2 clock
clk: renesas: r8a77995: Fix VIN parent clock
clk: renesas: r8a77980: Add VIN clocks
clk: renesas: r8a779g0: Add VIN clocks
clk: renesas: r8a779g0: Add ISPCS clocks
clk: renesas: r8a779g0: Add CSI-2 clocks
clk: renesas: r8a779g0: Add thermal clock
clk: renesas: r8a779g0: Add Audio clocks
clk: renesas: cpg-mssr: Update MSSR register range for R-Car V4H

* clk-skyworks:
clk: si521xx: Clock driver for Skyworks Si521xx I2C PCIe clock generators
dt-bindings: clk: si521xx: Add Skyworks Si521xx I2C PCIe clock generators

show more ...

clk: visconti: remove unused visconti_pll_provider::regmap

Field regmap of struct visconti_pll_provider is never used. Remove it.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>

clk: visconti: remove unused visconti_pll_provider::regmap

Field regmap of struct visconti_pll_provider is never used. Remove it.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>

Link: https://lore.kernel.org/r/20230302205028.2539197-1-dario.binacchi@amarulasolutions.com
Acked-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>

show more ...

Merge tag 'v5.18'

Linux 5.18

Merge branches 'fixes' and 'misc' into for-linus

Merge branch 'for-5.18/amd-sfh' into for-linus

- dead code elimination (Christophe JAILLET)

Merge tag 'v5.17-rc4' into for-linus

Merge with mainline to get the Intel ASoC generic helpers header and
other changes.

Merge tag 'v5.17-rc4' into next

Sync up with mainline to get the latest changes in HID subsystem.

Merge remote-tracking branch 'drm/drm-next' into drm-misc-next

First backmerge into drm-misc-next. Required for more helpers backmerged,
and to pull in 5.17 (rc2).

Signed-off-by: Maarten Lankhorst

Merge remote-tracking branch 'drm/drm-next' into drm-misc-next

First backmerge into drm-misc-next. Required for more helpers backmerged,
and to pull in 5.17 (rc2).

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

show more ...

Merge tag 'kvmarm-fixes-5.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 5.17, take #2

- A couple of fixes when handling an exception while a SEr

Merge tag 'kvmarm-fixes-5.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 5.17, take #2

- A couple of fixes when handling an exception while a SError has been
delivered

- Workaround for Cortex-A510's single-step[ erratum

show more ...

Merge drm/drm-next into drm-intel-gt-next

Backmerge to bring in 5.17-rc2 to introduce a common baseline
to merge i915_regs changes from drm-intel-next.

Signed-off-by: Joonas Lahtinen <joonas.lahtin

Merge drm/drm-next into drm-intel-gt-next

Backmerge to bring in 5.17-rc2 to introduce a common baseline
to merge i915_regs changes from drm-intel-next.

Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>

show more ...

Merge drm/drm-next into drm-intel-next

Catch-up with 5.17-rc2 and trying to align with drm-intel-gt-next
for a possible topic branch for merging the split of i915_regs...

Signed-off-by: Rodrigo Viv

Merge drm/drm-next into drm-intel-next

Catch-up with 5.17-rc2 and trying to align with drm-intel-gt-next
for a possible topic branch for merging the split of i915_regs...

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

show more ...

Merge drm/drm-fixes into drm-misc-fixes

Backmerging drm/drm-fixes into drm-misc-fixes for v5.17-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>