linux-stable.git/drivers/of, branch v3.18.136

of/pci: Remove duplicate kfree in of_pci_get_host_bridge_resources()

2018-11-10T15:39:18+00:00

[ Upstream commit feb28979c137ba3f649ad36fc27c85c64c111f78 ]

Commit d2be00c0fb5a ("of/pci: Free resources on failure in
of_pci_get_host_bridge_resources()") fixed the error path so it frees
everything on the "resources" list.  That list includes the bus_range, so
we should not free it again.

Remove the superfluous free of bus_range.

[bhelgaas: changelog]
Fixes: d2be00c0fb5a ("of/pci: Free resources on failure in of_pci_get_host_bridge_resources()")
Reported-by: Jiang Liu 
Signed-off-by: Lorenzo Pieralisi 
Signed-off-by: Bjorn Helgaas 
CC: Rafael J. Wysocki 
Signed-off-by: Sasha Levin

of: fix of_device_get_modalias returned length when truncating buffers

2018-03-22T08:37:13+00:00

[ Upstream commit bcf54d5385abaea9c8026aae6f4eeb348671a52d ]

If the length of the modalias is greater than the buffer size, then the
modalias is truncated. However the untruncated length is returned which
will cause an error. Fix this to return the truncated length. If an error
in the case was desired, then then we should just return -ENOMEM.

The reality is no device will ever have 4KB of compatible strings to hit
this case.

Signed-off-by: Rob Herring 
Cc: Frank Rowand 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

of: device: Export of_device_{get_modalias, uvent_modalias} to modules

2017-07-27T22:03:29+00:00

commit 7a3b7cd332db08546f3cdd984f11773e0d1999e7 upstream.

The ULPI bus can be built as a module, and it will soon be
calling these functions when it supports probing devices from DT.
Export them so they can be used by the ULPI module.

Acked-by: Rob Herring 
Cc: 
Signed-off-by: Stephen Boyd 
Signed-off-by: Peter Chen 
Signed-off-by: Greg Kroah-Hartman

of: Add check to of_scan_flat_dt() before accessing initial_boot_params

2017-06-29T07:12:24+00:00

commit 3ec754410cb3e931a6c4920b1a150f21a94a2bf4 upstream.

An empty __dtb_start to __dtb_end section might result in
initial_boot_params being null for arch/mips/ralink. This showed that the
boot process hangs indefinitely in of_scan_flat_dt().

Signed-off-by: Tobias Wolf 
Cc: Sergei Shtylyov 
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14605/
Signed-off-by: Ralf Baechle 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

of: fdt: add missing allocation-failure check

2017-05-25T12:17:58+00:00

commit 49e67dd17649b60b4d54966e18ec9c80198227f0 upstream.

The memory allocator passed to __unflatten_device_tree() (e.g. a wrapped
kzalloc) can fail so add the missing sanity check to avoid dereferencing
a NULL pointer.

Fixes: fe14042358fa ("of/flattree: Refactor unflatten_device_tree and add fdt_unflatten_tree")
Signed-off-by: Johan Hovold 
Signed-off-by: Rob Herring 
Signed-off-by: Greg Kroah-Hartman

of: fix sparse warning in of_pci_range_parser_one

2017-05-25T12:17:57+00:00

commit eb3100365791b06242b8bb5c3c2854ba41dabfbc upstream.

sparse gives the following warning for 'pci_space':

../drivers/of/address.c:266:26: warning: incorrect type in assignment (different base types)
../drivers/of/address.c:266:26:    expected unsigned int [unsigned] [usertype] pci_space
../drivers/of/address.c:266:26:    got restricted __be32 const [usertype] 

It appears that pci_space is only ever accessed on powerpc, so the endian
swap is often not needed.

Signed-off-by: Rob Herring 
Signed-off-by: Greg Kroah-Hartman

of: fix memory leak related to safe_name()

2016-08-22T16:23:00+00:00

[ Upstream commit d9fc880723321dbf16b2981e3f3e916b73942210 ]

Fix a memory leak resulting from memory allocation in safe_name().
This patch fixes all call sites of safe_name().

Mathieu Malaterre reported the memory leak on boot:

On my PowerMac device-tree would generate a duplicate name:

[    0.023043] device-tree: Duplicate name in PowerPC,G4@0, renamed to "l2-cache#1"

in this case a newly allocated name is generated by `safe_name`. However
in this case it is never deallocated.

The bug was found using kmemleak reported as:

unreferenced object 0xdf532e60 (size 32):
  comm "swapper", pid 1, jiffies 4294892300 (age 1993.532s)
  hex dump (first 32 bytes):
    6c 32 2d 63 61 63 68 65 23 31 00 dd e4 dd 1e c2  l2-cache#1......
    ec d4 ba ce 04 ec cc de 8e 85 e9 ca c4 ec cc 9e  ................
  backtrace:
    [] kvasprintf+0x64/0xc8
    [] kasprintf+0x4c/0x5c
    [] safe_name.isra.1+0x80/0xc4
    [] __of_attach_node_sysfs+0x6c/0x11c
    [] of_core_init+0x8c/0xf8
    [] kernel_init_freeable+0xd4/0x208
    [] kernel_init+0x24/0x11c
    [] ret_from_kernel_thread+0x5c/0x64

Link: https://bugzilla.kernel.org/show_bug.cgi?id=120331

Signed-off-by: Frank Rowand 
Reported-by: mathieu.malaterre@gmail.com
Tested-by: Mathieu Malaterre 
Cc: stable@vger.kernel.org
Signed-off-by: Rob Herring 
Signed-off-by: Sasha Levin

of: irq: fix of_irq_get[_byname]() kernel-doc

2016-06-20T03:47:44+00:00

[ Upstream commit 3993546646baf1dab5f5c4f7d9bb58f2046fd1c1 ]

The kernel-doc for the of_irq_get[_byname]()  is clearly inadequate in
describing the return values -- of_irq_get_byname() is documented better
than of_irq_get() but it  still doesn't mention that 0 is returned iff
irq_create_of_mapping() fails (it doesn't return an error code in this
case). Document all possible return value variants, making the writing
of the word "IRQ" consistent, while at it...

Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Fixes: ad69674e73a1 ("of/irq: do irq resolution in platform_get_irq_byname()")
Signed-off-by: Sergei Shtylyov 
CC: stable@vger.kernel.org
Signed-off-by: Rob Herring 
Signed-off-by: Sasha Levin

of: alloc anywhere from memblock if range not specified

2016-04-18T12:49:23+00:00

[ Upstream commit e53b50c0cbe392c946807abf7d07615a3c588642 ]

early_init_dt_alloc_reserved_memory_arch passes end as 0 to
__memblock_alloc_base, when limits are not specified. But
__memblock_alloc_base takes end value of 0 as MEMBLOCK_ALLOC_ACCESSIBLE
and limits the end to memblock.current_limit. This results in regions
never being placed in HIGHMEM area, for e.g. CMA.
Let __memblock_alloc_base allocate from anywhere in memory if limits are
not specified.

Acked-by: Marek Szyprowski 
Signed-off-by: Vinayak Menon 
Cc: stable@vger.kernel.org
Signed-off-by: Rob Herring 
Signed-off-by: Sasha Levin

of/address: Don't loop forever in of_find_matching_node_by_address().

2015-10-28T02:14:51+00:00

[ Upstream commit 3a496b00b6f90c41bd21a410871dfc97d4f3c7ab ]

If the internal call to of_address_to_resource() fails, we end up
looping forever in of_find_matching_node_by_address().  This can be
caused by a defective device tree, or calling with an incorrect
matches argument.

Fix by calling of_find_matching_node() unconditionally at the end of
the loop.

Signed-off-by: David Daney 
Cc: stable@vger.kernel.org
Signed-off-by: Rob Herring 
Signed-off-by: Sasha Levin