spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe

Clang warns:

drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]

spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe

Clang warns:

drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]
dev_err(&pdev->dev, "could not get clk: %d\n", err);
^~~
./include/linux/dev_printk.h:112:32: note: expanded from macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^~~~~~~~~~~
drivers/spi/spi-bcm2835aux.c:495:9: note: initialize the variable 'err'
to silence this warning
int err;
^
= 0
1 warning generated.

Restore the assignment so that the error value can be used in the
dev_err statement and there is no uninitialized memory being leaked.

Fixes: e13ee6cc4781 ("spi: bcm2835aux: Fix use-after-free on unbind")
Link: https://github.com/ClangBuiltLinux/linux/issues/1199
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20201113180701.455541-1-natechancellor@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

show more ...

Merge series "Use-after-free be gone" from Lukas Wunner <lukas@wunner.de>:

Here's my proposal to fix the use-after-free bugs reported by
Sascha Hauer and Florian Fainelli:

I scrutinized all SPI dri

Merge series "Use-after-free be gone" from Lukas Wunner <lukas@wunner.de>:

Here's my proposal to fix the use-after-free bugs reported by
Sascha Hauer and Florian Fainelli:

I scrutinized all SPI drivers in the v5.10 tree:

* There are 9 drivers with a use-after-free in the ->remove() hook
caused by accessing driver private data after spi_unregister_controller().

* There are 8 drivers which leak the spi_controller in the ->probe()
error path because of a missing spi_controller_put().

I'm introducing devm_spi_alloc_master/slave() which automatically
calls spi_controller_put() on ->remove(). This fixes both classes
of bugs while at the same time reducing code amount and complexity
in the ->probe() hook.

I propose that spi_controller_unregister() should no longer release
a reference on the spi_controller. Instead, drivers need to either
do it themselves or use one of the devm functions introduced herein.
The vast majority of drivers can be converted to the devm functions.
See the commit message of patch [1/4] for the rationale and details.

Enclosed are patches for 3 Broadcom drivers.
Patches for the other drivers are on this branch:
https://github.com/l1k/linux/commits/spi_fixes

@Florian Fainelli: Could you verify that there are no KASAN splats or
leaks with these patches? Unfortunately I do not have any SPI-capable
hardware at my disposal right now, so can only compile-test. You may
want to augment spi_controller_release() with a printk() to log when
the spi_controller is freed.

@Mark Brown: Patches [2/4] to [4/4] reference the SHA-1 of patch [1/4]
in their stable tags. Because the hash is unknown to me until you apply
the patch, I've used "123456789abc" as a placeholder. You'll have to
replace the hash if/when applying. Alternatively, only apply patch [1/4]
and I'll repost the other patches with the hash fixed up.

Thanks!

Lukas Wunner (4):
spi: Introduce device-managed SPI controller allocation
spi: bcm2835: Fix use-after-free on unbind
spi: bcm2835aux: Fix use-after-free on unbind
spi: bcm-qspi: Fix use-after-free on unbind

drivers/spi/spi-bcm-qspi.c | 34 ++++++++-------------
drivers/spi/spi-bcm2835.c | 24 +++++----------
drivers/spi/spi-bcm2835aux.c | 21 +++++--------
drivers/spi/spi.c | 58 +++++++++++++++++++++++++++++++++++-
include/linux/spi/spi.h | 19 ++++++++++++
5 files changed, 103 insertions(+), 53 deletions(-)

--
2.28.0

show more ...

spi: bcm2835aux: Fix use-after-free on unbind

bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference o

spi: bcm2835aux: Fix use-after-free on unbind

bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 123456789abc: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>

show more ...

Merge branch 'core/urgent' into core/entry

Pick up the entry fix before further modifications.

Merge tag 'irqchip-fixes-5.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent

Pull irqchip fixes from Marc Zyngier:

- A couple of fixes after the IPI as IRQ

Merge tag 'irqchip-fixes-5.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent

Pull irqchip fixes from Marc Zyngier:

- A couple of fixes after the IPI as IRQ patches (Kconfig, bcm2836)
- Two SiFive PLIC fixes (irq_set_affinity, hierarchy handling)
- "unmapped events" handling for the ti-sci-inta controller
- Tidying up for the irq-mst driver (static functions, Kconfig)
- Small cleanup in the Renesas irqpin driver
- STM32 exti can now handle LP timer events

show more ...

Merge branch 'for-5.10/core' into for-linus

- nonblocking read semantics fix for hid-debug

Merge tag 'asoc-v5.10' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v5.10

Not a huge amount going on in the core for ASoC this time but quite a

Merge tag 'asoc-v5.10' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v5.10

Not a huge amount going on in the core for ASoC this time but quite a
lot of driver activity, especially for the Intel platforms:

- Replacement of the DSP driver for some older x86 systems with a new
one which was written with closer reference to the DSP firmware so
should hopefully be more robust and maintainable.
- A big batch of static checker and other fixes for the rest of the x86
DSP drivers.
- Cleanup of the error unwinding code from Morimoto-san, hopefully
making it more robust.
- Helpers for parsing auxiluary devices from the device tree from
Stephan Gerhold.
- New support for AllWinner A64, Cirrus Logic CS4234, Mediatek MT6359
Microchip S/PDIF TX and RX controllers, Realtek RT1015P, and Texas
Instruments J721E, TAS2110, TAS2564 and TAS2764

show more ...

Merge tag 'spi-nor/for-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux into mtd/next

SPI NOR core changes:
- Support for Winbond w25q64jwm flash
- Enable 4K sector support for mx25l

Merge tag 'spi-nor/for-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux into mtd/next

SPI NOR core changes:
- Support for Winbond w25q64jwm flash
- Enable 4K sector support for mx25l12805d

SPI NOR controller drivers changes:
- intel-spi:
- Add Alder Lake-S PCI ID

show more ...

Merge branch 'locking/urgent' into locking/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

Merge tag 'v5.9-rc5' into asoc-5.10

Linux 5.9-rc5

Merge tag 'ti-k3-dt-fixes-for-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/nmenon/linux into arm/fixes

Tag fix up for TI serdes mux definition introduced in 5.9

* tag 'ti-k3-dt-fixes-for-

Merge tag 'ti-k3-dt-fixes-for-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/nmenon/linux into arm/fixes

Tag fix up for TI serdes mux definition introduced in 5.9

* tag 'ti-k3-dt-fixes-for-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/nmenon/linux: (637 commits)
arm64: dts: ti: k3-j721e: Rename mux header and update macro names
Linux 5.9-rc3
genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
fsldma: fix very broken 32-bit ppc ioread64 functionality
kernel.h: Silence sparse warning in lower_32_bits
cifs: fix check of tcon dfs in smb1
KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous exception
KVM: arm64: Survive synchronous exceptions caused by AT instructions
KVM: arm64: Add kvm_extable for vaxorcism code
arm64: vdso32: make vdso32 install conditional
arm64: use a common .arch preamble for inline assembly
mfd: mfd-core: Ensure disabled devices are ignored without error
usb: storage: Add unusual_uas entry for Sony PSZ drives
md/raid5: make sure stripe_size as power of two
powerpc/32s: Disable VMAP stack which CONFIG_ADB_PMU
io_uring: don't bounce block based -EAGAIN retry off task_work
io_uring: fix IOPOLL -EAGAIN retries
arm64/cpuinfo: Remove unnecessary fallthrough annotation
media: dib0700: Fix identation issue in dib8096_set_param_override()
hwmon: (gsc-hwmon) Scale temperature to millidegrees
...

Link: https://lore.kernel.org/r/20200921125402.mtwypblhb45a6ssh@akan
Signed-off-by: Olof Johansson <olof@lixom.net>

show more ...

Merge branch 'x86-seves-for-paolo' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into HEAD

Merge series "Support ROHM BD9576MUF and BD9573MUF PMICs" from Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>:

Initial support for ROHM BD9576MUF and BD9573MUF PMICs.

These PMICs are primarily

Merge series "Support ROHM BD9576MUF and BD9573MUF PMICs" from Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>:

Initial support for ROHM BD9576MUF and BD9573MUF PMICs.

These PMICs are primarily intended to be used to power the R-Car family
processors. BD9576MUF includes some additional safety features the
BD9573MUF does not have. This initial version of drivers does not
utilize these features and for now the SW behaviour is identical.

Please note that this version of drivers is only tested on BD9576MUF
but according to the data-sheets the relevant parts of registers should
be same so drivers should also work on BD9573MUF.

This patch series includes MFD, watchdog and regulator drivers with
basic functionality such as:

- Enabling and pinging the watchdog
- configuring watchog timeout / window from device-tree
- reading regulator states/voltages
- enabling/disabling VOUT1 (VD50) when control mode B is used.

This patch series does not bring interrupt support. BD9576MUF and BD9573MUF
are designed to keep the IRQ line low for whole duration of error
condition. IRQ can't be 'acked'. So proper IRQ support would require
some IRQ limiter implementation (delayed unmask?) in order to not hog
the CPU.

---

Matti Vaittinen (6):
dt_bindings: mfd: Add ROHM BD9576MUF and BD9573MUF PMICs
dt_bindings: regulator: Add ROHM BD9576MUF and BD9573MUF PMICs
mfd: Support ROHM BD9576MUF and BD9573MUF
wdt: Support wdt on ROHM BD9576MUF and BD9573MUF
regulator: Support ROHM BD9576MUF and BD9573MUF
MAINTAINERS: Add ROHM BD9576MUF and BD9573MUF drivers

.../bindings/mfd/rohm,bd9576-pmic.yaml | 129 +++++++
.../regulator/rohm,bd9576-regulator.yaml | 33 ++
MAINTAINERS | 4 +
drivers/mfd/Kconfig | 11 +
drivers/mfd/Makefile | 1 +
drivers/mfd/rohm-bd9576.c | 130 +++++++
drivers/regulator/Kconfig | 10 +
drivers/regulator/Makefile | 1 +
drivers/regulator/bd9576-regulator.c | 337 ++++++++++++++++++
drivers/watchdog/Kconfig | 13 +
drivers/watchdog/Makefile | 1 +
drivers/watchdog/bd9576_wdt.c | 295 +++++++++++++++
include/linux/mfd/rohm-bd957x.h | 61 ++++
include/linux/mfd/rohm-generic.h | 2 +
14 files changed, 1028 insertions(+)
create mode 100644 Documentation/devicetree/bindings/mfd/rohm,bd9576-pmic.yaml
create mode 100644 Documentation/devicetree/bindings/regulator/rohm,bd9576-regulator.yaml
create mode 100644 drivers/mfd/rohm-bd9576.c
create mode 100644 drivers/regulator/bd9576-regulator.c
create mode 100644 drivers/watchdog/bd9576_wdt.c
create mode 100644 include/linux/mfd/rohm-bd957x.h

base-commit: f4d51dffc6c01a9e94650d95ce0104964f8ae822
--
2.21.0

--
Matti Vaittinen, Linux device drivers
ROHM Semiconductors, Finland SWDC
Kiviharjunlenkki 1E
90220 OULU
FINLAND

~~~ "I don't think so," said Rene Descartes. Just then he vanished ~~~
Simon says - in Latin please.
~~~ "non cogito me" dixit Rene Descarte, deinde evanescavit ~~~
Thanks to Simon Glass for the translation =]

show more ...

Merge drm/drm-next into drm-misc-next

Paul Cercueil needs some patches in -rc5 to apply new patches for ingenic
properly.

Signed-off-by: Maxime Ripard <maxime@cerno.tech>

Merge 5.9-rc5 into driver-core-next

We need the driver core changes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge 5.9-rc5 into staging-next

We want the staging/iio changes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge drm/drm-next into drm-intel-next-queued

Sync drm-intel-gt-next here so we can have an unified fixes flow.

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge branch 'kvm-arm64/pt-new' into kvmarm-master/next

Signed-off-by: Marc Zyngier <maz@kernel.org>

Merge tag 'v5.9-rc4' into next

Linux 5.9-rc4

Merge branch 'for-linus' into for-next

Back-merge to apply the tasklet conversion patches that are based
on the already applied tasklet API changes on 5.9-rc4.

Signed-off-by: Takashi Iwai <tiwai@su

Merge branch 'for-linus' into for-next

Back-merge to apply the tasklet conversion patches that are based
on the already applied tasklet API changes on 5.9-rc4.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

show more ...

Merge series "opp: Unconditionally call dev_pm_opp_of_remove_table()" from Viresh Kumar <viresh.kumar@linaro.org>:

Hello,

This cleans up some of the user code around calls to
dev_pm_opp_of_remove_t

Merge series "opp: Unconditionally call dev_pm_opp_of_remove_table()" from Viresh Kumar <viresh.kumar@linaro.org>:

Hello,

This cleans up some of the user code around calls to
dev_pm_opp_of_remove_table().

All the patches can be picked by respective maintainers directly except
for the last patch, which needs the previous two to get merged first.

These are based for 5.9-rc1.

Rajendra, Since most of these changes are related to qcom stuff, it
would be great if you can give them a try. I wasn't able to test them
due to lack of hardware.

Ulf, I had to revise the sdhci patch, sorry about that. Please pick this
one.

Diff between V1 and V2 is mentioned in each of the patches separately.

Viresh Kumar (8):
cpufreq: imx6q: Unconditionally call dev_pm_opp_of_remove_table()
drm/lima: Unconditionally call dev_pm_opp_of_remove_table()
drm/msm: Unconditionally call dev_pm_opp_of_remove_table()
mmc: sdhci-msm: Unconditionally call dev_pm_opp_of_remove_table()
spi: spi-geni-qcom: Unconditionally call dev_pm_opp_of_remove_table()
spi: spi-qcom-qspi: Unconditionally call dev_pm_opp_of_remove_table()
tty: serial: qcom_geni_serial: Unconditionally call
dev_pm_opp_of_remove_table()
qcom-geni-se: remove has_opp_table

drivers/cpufreq/imx6q-cpufreq.c | 10 ++--------
drivers/gpu/drm/lima/lima_devfreq.c | 6 +-----
drivers/gpu/drm/lima/lima_devfreq.h | 1 -
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 14 +++++---------
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 1 -
drivers/gpu/drm/msm/dsi/dsi_host.c | 8 ++------
drivers/mmc/host/sdhci-msm.c | 14 +++++---------
drivers/spi/spi-geni-qcom.c | 13 +++++--------
drivers/spi/spi-qcom-qspi.c | 15 ++++++---------
drivers/tty/serial/qcom_geni_serial.c | 13 +++++--------
include/linux/qcom-geni-se.h | 2 --
11 files changed, 31 insertions(+), 66 deletions(-)

base-commit: f4d51dffc6c01a9e94650d95ce0104964f8ae822
--
2.25.0.rc1.19.g042ed3e048af

show more ...

Merge tag 'v5.9-rc4' into drm-next

Backmerge 5.9-rc4 as there is a nasty qxl conflict
that needs to be resolved.

Signed-off-by: Dave Airlie <airlied@redhat.com>

Merge tag 'v5.9-rc4' into patchwork

Linux 5.9-rc4

* tag 'v5.9-rc4': (1001 commits)
Linux 5.9-rc4
io_uring: fix linked deferred ->files cancellation
io_uring: fix cancel of deferred reqs with

Merge tag 'v5.9-rc4' into patchwork

Linux 5.9-rc4

* tag 'v5.9-rc4': (1001 commits)
Linux 5.9-rc4
io_uring: fix linked deferred ->files cancellation
io_uring: fix cancel of deferred reqs with ->files
include/linux/log2.h: add missing () around n in roundup_pow_of_two()
mm/khugepaged.c: fix khugepaged's request size in collapse_file
mm/hugetlb: fix a race between hugetlb sysctl handlers
mm/hugetlb: try preferred node first when alloc gigantic page from cma
mm/migrate: preserve soft dirty in remove_migration_pte()
mm/migrate: remove unnecessary is_zone_device_page() check
mm/rmap: fixup copying of soft dirty and uffd ptes
mm/migrate: fixup setting UFFD_WP flag
mm: madvise: fix vma user-after-free
checkpatch: fix the usage of capture group ( ... )
fork: adjust sysctl_max_threads definition to match prototype
ipc: adjust proc_ipc_sem_dointvec definition to match prototype
mm: track page table modifications in __apply_to_page_range()
MAINTAINERS: IA64: mark Status as Odd Fixes only
MAINTAINERS: add LLVM maintainers
MAINTAINERS: update Cavium/Marvell entries
mm: slub: fix conversion of freelist_corrupted()
...

show more ...

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

We got slightly different patches removing a double word
in a comment in net/ipv4/raw.c - picked the version from net.

Simple conflict

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

We got slightly different patches removing a double word
in a comment in net/ipv4/raw.c - picked the version from net.

Simple conflict in drivers/net/ethernet/ibm/ibmvnic.c. Use cached
values instead of VNIC login response buffer (following what
commit 507ebe6444a4 ("ibmvnic: Fix use-after-free of VNIC login
response buffer") did).

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

show more ...

Merge branch 'topic/tasklet-convert' into for-linus

Pull tasklet API conversions.

Signed-off-by: Takashi Iwai <tiwai@suse.de>