linux-stable.git/arch/arm, branch v3.16.80

ARM: mm: fix alignment handler faults under memory pressure

2019-12-19T15:58:18+00:00

commit 67e15fa5b487adb9b78a92789eeff2d6ec8f5cee upstream.

When the system has high memory pressure, the page containing the
instruction may be paged out.  Using probe_kernel_address() means that
if the page is swapped out, the resulting page fault will not be
handled because page faults are disabled by this function.

Use get_user() to read the instruction instead.

Reported-by: Jing Xiangfeng 
Fixes: b255188f90e2 ("ARM: fix scheduling while atomic warning in alignment handling code")
Signed-off-by: Russell King 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

USB: rio500: Remove Rio 500 kernel driver

2019-12-19T15:57:59+00:00

commit 015664d15270a112c2371d812f03f7c579b35a73 upstream.

The Rio500 kernel driver has not been used by Rio500 owners since 2001
not long after the rio500 project added support for a user-space USB stack
through the very first versions of usbdevfs and then libusb.

Support for the kernel driver was removed from the upstream utilities
in 2008:
https://gitlab.freedesktop.org/hadess/rio500/commit/943f624ab721eb8281c287650fcc9e2026f6f5db

Cc: Cesar Miquel 
Signed-off-by: Bastien Nocera 
Link: https://lore.kernel.org/r/6251c17584d220472ce882a3d9c199c401a51a71.camel@hadess.net
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16:
 - Also delete CONFIG_USB_RIO500 from arch/powerpc/configs/c2k_defconfig
 - Drop change to arch/arm/configs/pxa_defconfig
 - Adjust filename, content]
Signed-off-by: Ben Hutchings

ARM: zynq: Use memcpy_toio instead of memcpy on smp bring-up

2019-12-10T18:01:12+00:00

commit b7005d4ef4f3aa2dc24019ffba03a322557ac43d upstream.

This fixes a kernel panic on memcpy when
FORTIFY_SOURCE is enabled.

The initial smp implementation on commit aa7eb2bb4e4a
("arm: zynq: Add smp support")
used memcpy, which worked fine until commit ee333554fed5
("ARM: 8749/1: Kconfig: Add ARCH_HAS_FORTIFY_SOURCE")
enabled overflow checks at runtime, producing a read
overflow panic.

The computed size of memcpy args are:
- p_size (dst): 4294967295 = (size_t) -1
- q_size (src): 1
- size (len): 8

Additionally, the memory is marked as __iomem, so one of
the memcpy_* functions should be used for read/write.

Fixes: aa7eb2bb4e4a ("arm: zynq: Add smp support")
Signed-off-by: Luis Araneda 
Signed-off-by: Michal Simek 
Signed-off-by: Ben Hutchings

ARM: riscpc: fix DMA

2019-10-31T22:14:50+00:00

commit ffd9a1ba9fdb7f2bd1d1ad9b9243d34e96756ba2 upstream.

DMA got broken a while back in two different ways:
1) a change in the behaviour of disable_irq() to wait for the interrupt
   to finish executing causes us to deadlock at the end of DMA.
2) a change to avoid modifying the scatterlist left the first transfer
   uninitialised.

DMA is only used with expansion cards, so has gone unnoticed.

Fixes: fa4e99899932 ("[ARM] dma: RiscPC: don't modify DMA SG entries")
Signed-off-by: Russell King 
Signed-off-by: Ben Hutchings

crypto: arm/aes-neonbs - don't access already-freed walk.iv

2019-09-23T20:11:44+00:00

commit 767f015ea0b7ab9d60432ff6cd06b664fd71f50f upstream.

If the user-provided IV needs to be aligned to the algorithm's
alignmask, then skcipher_walk_virt() copies the IV into a new aligned
buffer walk.iv.  But skcipher_walk_virt() can fail afterwards, and then
if the caller unconditionally accesses walk.iv, it's a use-after-free.

arm32 xts-aes-neonbs doesn't set an alignmask, so currently it isn't
affected by this despite unconditionally accessing walk.iv.  However
this is more subtle than desired, and it was actually broken prior to
the alignmask being removed by commit cc477bf64573 ("crypto: arm/aes -
replace bit-sliced OpenSSL NEON code").  Thus, update xts-aes-neonbs to
start checking the return value of skcipher_walk_virt().

Fixes: e4e7f10bfc40 ("ARM: add support for bit sliced AES using NEON instructions")
Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"

2019-09-23T20:11:41+00:00

commit 9ee8578d953023cc57e7e736ae48502c707c0210 upstream.

Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
kfree, iounmap, clk_put etc are not needed anymore in remove path.

Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
Signed-off-by: YueHaibing 
[ commit message spelling fix ]
Signed-off-by: Robert Jarzmik 
Signed-off-by: Ben Hutchings

ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()

2019-09-23T20:11:35+00:00

commit 7f0d078667a494466991aa7133f49594f32ff6a2 upstream.

Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
the call to _enable() conditional based on no oh->rst_lines_cnt. This
caused the return value to be potentially uninitialized. Curiously we see
no compiler warnings for this, probably as this gets inlined.

We call _setup_reset() from _setup() and only _setup_postsetup() if the
return value is zero. Currently the return value can be uninitialized for
cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.

Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
Cc: Paul Walmsley 
Cc: Tero Kristo 
Signed-off-by: Tony Lindgren 
Signed-off-by: Ben Hutchings

ARM: dts: exynos: Fix interrupt for shared EINTs on Exynos5260

2019-09-23T20:11:33+00:00

commit b7ed69d67ff0788d8463e599dd5dd1b45c701a7e upstream.

Fix the interrupt information for the GPIO lines with a shared EINT
interrupt.

Fixes: 16d7ff2642e7 ("ARM: dts: add dts files for exynos5260 SoC")
Signed-off-by: Stuart Menefy 
Signed-off-by: Krzysztof Kozlowski 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

ARM: dts: pfla02: increase phy reset duration

2019-08-13T11:38:49+00:00

commit 032f85c9360fb1a08385c584c2c4ed114b33c260 upstream.

Increase the reset duration to ensure correct phy functionality. The
reset duration is taken from barebox commit 52fdd510de ("ARM: dts:
pfla02: use long enough reset for ethernet phy"):

  Use a longer reset time for ethernet phy Micrel KSZ9031RNX. Otherwise a
  small percentage of modules have 'transmission timeouts' errors like

  barebox@Phytec phyFLEX-i.MX6 Quad Carrier-Board:/ ifup eth0
  warning: No MAC address set. Using random address 7e:94:4d:02:f8:f3
  eth0: 1000Mbps full duplex link detected
  eth0: transmission timeout
  T eth0: transmission timeout
  T eth0: transmission timeout
  T eth0: transmission timeout
  T eth0: transmission timeout

Cc: Stefan Christ 
Cc: Christian Hemp 
Signed-off-by: Marco Felsch 
Fixes: 3180f956668e ("ARM: dts: Phytec imx6q pfla02 and pbab01 support")
Signed-off-by: Shawn Guo 
Signed-off-by: Ben Hutchings

ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time

2019-08-13T11:38:45+00:00

commit 91740fc8242b4f260cfa4d4536d8551804777fae upstream.

In the current cpuidle implementation for i.MX6q, the CPU that sets
'WAIT_UNCLOCKED' and the CPU that returns to 'WAIT_CLOCKED' are always
the same. While the CPU that sets 'WAIT_UNCLOCKED' is in IDLE state of
"WAIT", if the other CPU wakes up and enters IDLE state of "WFI"
istead of "WAIT", this CPU can not wake up at expired time.
 Because, in the case of "WFI", the CPU must be waked up by the local
timer interrupt. But, while 'WAIT_UNCLOCKED' is set, the local timer
is stopped, when all CPUs execute "wfi" instruction. As a result, the
local timer interrupt is not fired.
 In this situation, this CPU will wake up by IRQ different from local
timer. (e.g. broacast timer)

So, this fix changes CPU to return to 'WAIT_CLOCKED'.

Signed-off-by: Kohji Okuno 
Fixes: e5f9dec8ff5f ("ARM: imx6q: support WAIT mode using cpuidle")
Signed-off-by: Shawn Guo 
[bwh: Backported to 3.16: use imx6q_set_lpm() instead of imx6_set_lpm()]
Signed-off-by: Ben Hutchings