linux-stable.git/drivers/leds, branch linux-3.18.y Linux kernel stable tree leds: lp55xx: fix null deref on firmware load failure 2019-04-27T07:30:22+00:00 Michal Kazior michal@plume.com 2019-02-11T09:29:27+00:00 3c81153bc6daa5ffd30cd32ba7a6151e197911fe [ Upstream commit 5ddb0869bfc1bca6cfc592c74c64a026f936638c ] I've stumbled upon a kernel crash and the logs pointed me towards the lp5562 driver: > <4>[306013.841294] lp5562 0-0030: Direct firmware load for lp5562 failed with error -2 > <4>[306013.894990] lp5562 0-0030: Falling back to user helper > ... > <3>[306073.924886] lp5562 0-0030: firmware request failed > <1>[306073.939456] Unable to handle kernel NULL pointer dereference at virtual address 00000000 > <4>[306074.251011] PC is at _raw_spin_lock+0x1c/0x58 > <4>[306074.255539] LR is at release_firmware+0x6c/0x138 > ... After taking a look I noticed firmware_release() could be called with either NULL or a dangling pointer. Fixes: 10c06d178df11 ("leds-lp55xx: support firmware interface") Signed-off-by: Michal Kazior <michal@plume.com> Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 5ddb0869bfc1bca6cfc592c74c64a026f936638c ]

I've stumbled upon a kernel crash and the logs
pointed me towards the lp5562 driver:

> <4>[306013.841294] lp5562 0-0030: Direct firmware load for lp5562 failed with error -2
> <4>[306013.894990] lp5562 0-0030: Falling back to user helper
> ...
> <3>[306073.924886] lp5562 0-0030: firmware request failed
> <1>[306073.939456] Unable to handle kernel NULL pointer dereference at virtual address 00000000
> <4>[306074.251011] PC is at _raw_spin_lock+0x1c/0x58
> <4>[306074.255539] LR is at release_firmware+0x6c/0x138
> ...

After taking a look I noticed firmware_release()
could be called with either NULL or a dangling
pointer.

Fixes: 10c06d178df11 ("leds-lp55xx: support firmware interface")
Signed-off-by: Michal Kazior <michal@plume.com>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
leds: lp5523: fix a missing check of return value of lp55xx_read 2019-03-23T07:18:51+00:00 Kangjie Lu kjlu@umn.edu 2018-12-26T04:18:23+00:00 33951e5f88850c29a831a510437fff9bd1ea7a22 [ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ] When lp55xx_read() fails, "status" is an uninitialized variable and thus may contain random value; using it leads to undefined behaviors. The fix inserts a check for the return value of lp55xx_read: if it fails, returns with its error code. Signed-off-by: Kangjie Lu <kjlu@umn.edu> Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]

When lp55xx_read() fails, "status" is an uninitialized variable and thus
may contain random value; using it leads to undefined behaviors.

The fix inserts a check for the return value of lp55xx_read: if it
fails, returns with its error code.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
leds: pca955x: Correct I2C Functionality 2018-04-13T17:52:14+00:00 Tin Huynh tnhuynh@apm.com 2017-05-22T09:19:20+00:00 be622831649a4223be0d3da88403b6774ab354f0 [ Upstream commit aace34c0bb8ea3c8bdcec865b6a4be4db0a68e33 ] The driver checks an incorrect flag of functionality of adapter. When a driver requires i2c_smbus_read_byte_data and i2c_smbus_write_byte_data, it should check I2C_FUNC_SMBUS_BYTE_DATA instead I2C_FUNC_I2C. This patch fixes the problem. Signed-off-by: Tin Huynh <tnhuynh@apm.com> Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
[ Upstream commit aace34c0bb8ea3c8bdcec865b6a4be4db0a68e33 ]

The driver checks an incorrect flag of functionality of adapter.
When a driver requires i2c_smbus_read_byte_data and
i2c_smbus_write_byte_data, it should check I2C_FUNC_SMBUS_BYTE_DATA
instead I2C_FUNC_I2C.
This patch fixes the problem.

Signed-off-by: Tin Huynh <tnhuynh@apm.com>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Revert "led: core: Fix brightness setting when setting delay_off=0" 2018-04-08T09:49:44+00:00 Ben Hutchings ben.hutchings@codethink.co.uk 2018-03-08T15:59:07+00:00 15075ddaadee365837c7ae5d00299e6890b8289b This reverts commit 20f6d9c2af33da892a0e03ffd6249c7ab81edfb7, which was commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c upstream. The bug that it should fix was only introduced in Linux 4.7, and in 4.4 it causes a regression. Reported-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> Cc: Matthieu CASTET <matthieu.castet@parrot.com> Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Cc: Wang Han <wanghan1995315@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This reverts commit 20f6d9c2af33da892a0e03ffd6249c7ab81edfb7, which
was commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c upstream.
The bug that it should fix was only introduced in Linux 4.7, and
in 4.4 it causes a regression.

Reported-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Cc: Matthieu CASTET <matthieu.castet@parrot.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc: Wang Han <wanghan1995315@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
leds: do not overflow sysfs buffer in led_trigger_show 2018-03-11T15:12:18+00:00 Nathan Sullivan nathan.sullivan@ni.com 2016-08-15T22:20:14+00:00 ee23d044822561ff53aa993b8be4e0e699d8f672 commit 3b9b95363c45365d606ad4bbba16acca75fdf6d3 upstream. Per the documentation, use scnprintf instead of sprintf to ensure there is never more than PAGE_SIZE bytes of trigger names put into the buffer. Signed-off-by: Nathan Sullivan <nathan.sullivan@ni.com> Signed-off-by: Zach Brown <zach.brown@ni.com> Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com> Cc: Willy Tarreau <w@1wt.eu> Cc: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 3b9b95363c45365d606ad4bbba16acca75fdf6d3 upstream.

Per the documentation, use scnprintf instead of sprintf to ensure there
is never more than PAGE_SIZE bytes of trigger names put into the
buffer.

Signed-off-by: Nathan Sullivan <nathan.sullivan@ni.com>
Signed-off-by: Zach Brown <zach.brown@ni.com>
Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
led: core: Fix brightness setting when setting delay_off=0 2018-03-03T09:17:09+00:00 Matthieu CASTET matthieu.castet@parrot.com 2017-12-12T10:10:44+00:00 20f6d9c2af33da892a0e03ffd6249c7ab81edfb7 [ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ] With the current code, the following sequence won't work : echo timer > trigger echo 0 > delay_off * at this point we call ** led_delay_off_store ** led_blink_set 
[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ]

With the current code, the following sequence won't work :
echo timer > trigger

echo 0 >  delay_off
* at this point we call
** led_delay_off_store
** led_blink_set
leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger 2015-07-04T03:02:15+00:00 Grygorii Strashko Grygorii.Strashko@linaro.org 2015-04-24T11:57:10+00:00 7b0ac7786b2ae6407cd292a33b0688e3d71b7067 [ Upstream commit 084609bf727981c7a2e6e69aefe0052c9d793300 ] Setting a dev_pm_ops suspend/resume pair of callbacks but not a set of hibernation callbacks means those pm functions will not be called upon hibernation - that leads to system crash on ARM during freezing if gpio-led is used in combination with CPU led trigger. It may happen after freeze_noirq stage (GPIO is suspended) and before syscore_suspend stage (CPU led trigger is suspended) - usually when disable_nonboot_cpus() is called. Log: PM: noirq freeze of devices complete after 1.425 msecs Disabling non-boot CPUs ... ^ system may crash or stuck here with message (TI AM572x) WARNING: CPU: 0 PID: 3100 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x22c/0x370() 44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in Supervisor mode during Functional access CPU1: shutdown ^ or here Fix this by using SIMPLE_DEV_PM_OPS, which appropriately assigns the suspend and hibernation callbacks and move led_suspend/led_resume under CONFIG_PM_SLEEP to avoid build warnings. Fixes: 73e1ab41a80d (leds: Convert led class driver from legacy pm ops to dev_pm_ops) Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org> Acked-by: Jacek Anaszewski <j.anaszewski@samsung.com> Cc: 3.11+ <stable@vger.kernel.org> # 3.11+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 084609bf727981c7a2e6e69aefe0052c9d793300 ]

Setting a dev_pm_ops suspend/resume pair of callbacks but not a set of
hibernation callbacks means those pm functions will not be
called upon hibernation - that leads to system crash on ARM during
freezing if gpio-led is used in combination with CPU led trigger.
It may happen after freeze_noirq stage (GPIO is suspended)
and before syscore_suspend stage (CPU led trigger is suspended)
- usually when disable_nonboot_cpus() is called.

Log:
  PM: noirq freeze of devices complete after 1.425 msecs
  Disabling non-boot CPUs ...
    ^ system may crash or stuck here with message (TI AM572x)

  WARNING: CPU: 0 PID: 3100 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x22c/0x370()
  44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in Supervisor mode during Functional access

  CPU1: shutdown
    ^ or here

Fix this by using SIMPLE_DEV_PM_OPS, which appropriately
assigns the suspend and hibernation callbacks and move
led_suspend/led_resume under CONFIG_PM_SLEEP to avoid
build warnings.

Fixes: 73e1ab41a80d (leds: Convert led class driver from legacy pm ops to dev_pm_ops)
Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
Acked-by: Jacek Anaszewski <j.anaszewski@samsung.com>
Cc: 3.11+ <stable@vger.kernel.org> # 3.11+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
leds: netxbig: fix oops at probe time 2015-01-27T16:29:40+00:00 Simon Guinot simon.guinot@sequanux.org 2014-12-02T15:32:10+00:00 87a5d5643f1d0348fc5b459a01f9995e609e67b1 commit 0c86ac2c50647451d6a70dc900f8bb0ee3d485d9 upstream. This patch fixes a NULL pointer dereference on led_dat->mode_val. Due to this bug, a kernel oops can be observed at probe time on the LaCie 2Big and 5Big v2 boards: Unable to handle kernel NULL pointer dereference at virtual address 00000008 [...] [<c03f244c>] (netxbig_led_probe) from [<c02c8c6c>] (platform_drv_probe+0x4c/0x9c) [<c02c8c6c>] (platform_drv_probe) from [<c02c72d0>] (driver_probe_device+0x98/0x25c) [<c02c72d0>] (driver_probe_device) from [<c02c7520>] (__driver_attach+0x8c/0x90) [<c02c7520>] (__driver_attach) from [<c02c5c24>] (bus_for_each_dev+0x68/0x94) [<c02c5c24>] (bus_for_each_dev) from [<c02c6408>] (bus_add_driver+0x124/0x1dc) [<c02c6408>] (bus_add_driver) from [<c02c7ac0>] (driver_register+0x78/0xf8) [<c02c7ac0>] (driver_register) from [<c000888c>] (do_one_initcall+0x80/0x1cc) [<c000888c>] (do_one_initcall) from [<c0733618>] (kernel_init_freeable+0xe4/0x1b4) [<c0733618>] (kernel_init_freeable) from [<c058db9c>] (kernel_init+0xc/0xec) [<c058db9c>] (kernel_init) from [<c0009850>] (ret_from_fork+0x14/0x24) [...] This bug was introduced by commit 588a6a99286ae30afb1339d8bc2163517b1b7dd1 ("leds: netxbig: fix attribute-creation race"). Signed-off-by: Simon Guinot <simon.guinot@sequanux.org> Acked-by: Johan Hovold <johan@kernel.org> Signed-off-by: Bryan Wu <cooloney@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 0c86ac2c50647451d6a70dc900f8bb0ee3d485d9 upstream.

This patch fixes a NULL pointer dereference on led_dat->mode_val. Due to
this bug, a kernel oops can be observed at probe time on the LaCie 2Big
and 5Big v2 boards:

Unable to handle kernel NULL pointer dereference at virtual address 00000008
[...]
[<c03f244c>] (netxbig_led_probe) from [<c02c8c6c>] (platform_drv_probe+0x4c/0x9c)
[<c02c8c6c>] (platform_drv_probe) from [<c02c72d0>] (driver_probe_device+0x98/0x25c)
[<c02c72d0>] (driver_probe_device) from [<c02c7520>] (__driver_attach+0x8c/0x90)
[<c02c7520>] (__driver_attach) from [<c02c5c24>] (bus_for_each_dev+0x68/0x94)
[<c02c5c24>] (bus_for_each_dev) from [<c02c6408>] (bus_add_driver+0x124/0x1dc)
[<c02c6408>] (bus_add_driver) from [<c02c7ac0>] (driver_register+0x78/0xf8)
[<c02c7ac0>] (driver_register) from [<c000888c>] (do_one_initcall+0x80/0x1cc)
[<c000888c>] (do_one_initcall) from [<c0733618>] (kernel_init_freeable+0xe4/0x1b4)
[<c0733618>] (kernel_init_freeable) from [<c058db9c>] (kernel_init+0xc/0xec)
[<c058db9c>] (kernel_init) from [<c0009850>] (ret_from_fork+0x14/0x24)
[...]

This bug was introduced by commit 588a6a99286ae30afb1339d8bc2163517b1b7dd1
("leds: netxbig: fix attribute-creation race").

Signed-off-by: Simon Guinot <simon.guinot@sequanux.org>
Acked-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Bryan Wu <cooloney@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds 2014-10-21T15:18:38+00:00 Linus Torvalds torvalds@linux-foundation.org 2014-10-21T15:18:38+00:00 045aaedab67bc3f2f01fe46917e0e17a6b5a7d5d Pull LED update from Bryan Wu: "Basically we have some bug fixing and clean up and one big thing is we start to merge patch to add support LED Flash class" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds: leds: gpio: cleanup the leds-gpio driver led: gpio: Fix possible ZERO_SIZE_PTR pointer dereferencing error. led: gpio: Sort include headers alphabetically leds: Improve and export led_update_brightness leds: trigger: gpio: fix warning in gpio trigger for gpios whose accessor function may sleep leds: lp3944: fix sparse warning leds: avoid using DEVICE_ATTR macro for max_brightness attribute leds: make brightness type consistent across whole subsystem leds: Reorder include directives 
Pull LED update from Bryan Wu:
 "Basically we have some bug fixing and clean up and one big thing is we
  start to merge patch to add support LED Flash class"

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds:
  leds: gpio: cleanup the leds-gpio driver
  led: gpio: Fix possible ZERO_SIZE_PTR pointer dereferencing error.
  led: gpio: Sort include headers alphabetically
  leds: Improve and export led_update_brightness
  leds: trigger: gpio: fix warning in gpio trigger for gpios whose accessor function may sleep
  leds: lp3944: fix sparse warning
  leds: avoid using DEVICE_ATTR macro for max_brightness attribute
  leds: make brightness type consistent across whole subsystem
  leds: Reorder include directives
Merge tag 'hwmon-for-linus-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging 2014-10-10T20:40:14+00:00 Linus Torvalds torvalds@linux-foundation.org 2014-10-10T20:40:14+00:00 40c43269cf8e88a0bdc306c717d1dd5446a6f3b8 Pull hwmon updates from Guenter Roeck: - new driver for menf21bmc. - convert k10temp, smsc47b397, da9052, da9055 to new hwmon API. - register ntc_thermistor driver with thermal subsystem. - add support for F15h M60h to k10temp driver. - add driver for MEN14F021P00 BMC HWMON driver; this required a merge with tag mfd-hwmon-leds-watchdog-v3.18 * tag 'hwmon-for-linus-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ab8500) Call kernel_power_off instead of pm_power_off hwmon: (menf21bmc) Introduce MEN14F021P00 BMC HWMON driver leds: leds-menf21bmc: Introduce MEN 14F021P00 BMC LED driver watchdog: menf21bmc_wdt: Introduce MEN 14F021P00 BMC Watchdog driver mfd: menf21bmc: Introduce MEN 14F021P00 BMC MFD Core driver hwmon: (ntc_thermistor) Add ntc thermistor to thermal subsystem as a sensor. hwmon: (smsc47b397) Convert to devm_hwmon_device_register_with_groups MAINTAINERS: add entry for the PWM fan driver hwmon: (k10temp) Convert to devm_hwmon_device_register_with_groups hwmon: (k10temp) Add support for F15h M60h hwmon: (da9052) Convert to devm_hwmon_device_register_with_groups hwmon: (da9055) Convert to devm_hwmon_device_register_with_groups hwmon: (ads1015) Use of_property_read_u32 at appropriate places 
Pull hwmon updates from Guenter Roeck:
 - new driver for menf21bmc.
 - convert k10temp, smsc47b397, da9052, da9055 to new hwmon API.
 - register ntc_thermistor driver with thermal subsystem.
 - add support for F15h M60h to k10temp driver.
 - add driver for MEN14F021P00 BMC HWMON driver; this required a merge
   with tag mfd-hwmon-leds-watchdog-v3.18

* tag 'hwmon-for-linus-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ab8500) Call kernel_power_off instead of pm_power_off
  hwmon: (menf21bmc) Introduce MEN14F021P00 BMC HWMON driver
  leds: leds-menf21bmc: Introduce MEN 14F021P00 BMC LED driver
  watchdog: menf21bmc_wdt: Introduce MEN 14F021P00 BMC Watchdog driver
  mfd: menf21bmc: Introduce MEN 14F021P00 BMC MFD Core driver
  hwmon: (ntc_thermistor) Add ntc thermistor to thermal subsystem as a sensor.
  hwmon: (smsc47b397) Convert to devm_hwmon_device_register_with_groups
  MAINTAINERS: add entry for the PWM fan driver
  hwmon: (k10temp) Convert to devm_hwmon_device_register_with_groups
  hwmon: (k10temp) Add support for F15h M60h
  hwmon: (da9052) Convert to devm_hwmon_device_register_with_groups
  hwmon: (da9055) Convert to devm_hwmon_device_register_with_groups
  hwmon: (ads1015) Use of_property_read_u32 at appropriate places