linux/drivers/i2c, branch v5.14

i2c: dev: zero out array used for i2c reads from userspace

2021-08-10T20:54:10Z

If an i2c driver happens to not provide the full amount of data that a user asks for, it is possible that some uninitialized data could be sent to userspace. While all in-kernel drivers look to be safe, just be sure by initializing the buffer to zero before it is passed to the i2c driver so that any future drivers will not have this issue. Also properly copy the amount of data recvieved to the userspace buffer, as pointed out by Dan Carpenter. Reported-by: Eric Dumazet Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Wolfram Sang

i2c: iproc: fix race between client unreg and tasklet

2021-08-10T20:40:55Z

Similar NULL deref was originally fixed by graceful teardown sequence - https://lore.kernel.org/linux-i2c/1597106560-79693-1-git-send-email-dphadke@linux.microsoft.com After this, a tasklet was added to take care of FIFO full condition for large i2c transaction. https://lore.kernel.org/linux-arm-kernel/20201102035433.6774-1-rayagonda.kokatanur@broadcom.com/ This introduced regression, a new race condition between tasklet enabling interrupts and client unreg teardown sequence. Kill tasklet before unreg_slave() masks bits in IE_OFFSET. Updated teardown sequence - (1) disable_irq() (2) Kill tasklet (3) Mask event enable bits in control reg (4) Erase slave address (avoid further writes to rx fifo) (5) Flush tx and rx FIFOs (6) Clear pending event (interrupt) bits in status reg (7) Set client pointer to NULL (8) enable_irq() -- Unable to handle kernel read from unreadable memory at virtual address 0000000000000320 Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000009212a000 [0000000000000320] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] SMP CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O Hardware name: Overlake (DT) pstate: 40400085 (nZcv daIf +PAN -UAO -TCO BTYPE=--) pc : bcm_iproc_i2c_slave_isr+0x2b8/0x8e4 lr : bcm_iproc_i2c_slave_isr+0x1c8/0x8e4 sp : ffff800010003e70 x29: ffff800010003e80 x28: ffffda017acdc000 x27: ffffda017b0ae000 x26: ffff800010004000 x25: ffff800010000000 x24: ffffda017af4a168 x23: 0000000000000073 x22: 0000000000000000 x21: 0000000001400000 x20: 0000000001000000 x19: ffff06f09583f880 x18: 00000000fa83b2da x17: 000000000000b67e x16: 0000000002edb2f3 x15: 00000000000002c7 x14: 00000000000002c7 x13: 0000000000000006 x12: 0000000000000033 x11: 0000000000000000 x10: 0000000001000000 x9 : 0000000003289312 x8 : 0000000003289311 x7 : 02d0cd03a303adbc x6 : 02d18e7f0a4dfc6c x5 : 02edb2f33f76ea68 x4 : 00000000fa83b2da x3 : ffffda017af43cd0 x2 : ffff800010003e74 x1 : 0000000001400000 x0 : 0000000000000000 Call trace: bcm_iproc_i2c_slave_isr+0x2b8/0x8e4 bcm_iproc_i2c_isr+0x178/0x290 __handle_irq_event_percpu+0xd0/0x200 handle_irq_event+0x60/0x1a0 handle_fasteoi_irq+0x130/0x220 __handle_domain_irq+0x8c/0xcc gic_handle_irq+0xc0/0x120 el1_irq+0xcc/0x180 finish_task_switch+0x100/0x1d8 __schedule+0x61c/0x7a0 schedule_idle+0x28/0x44 do_idle+0x254/0x28c cpu_startup_entry+0x28/0x2c rest_init+0xc4/0xd0 arch_call_rest_init+0x14/0x1c start_kernel+0x33c/0x3b8 Code: f9423260 910013e2 11000509 b9047a69 (f9419009) ---[ end trace 4781455b2a7bec15 ]--- Fixes: 4d658451c9d6 ("i2c: iproc: handle rx fifo full interrupt") Signed-off-by: Dhananjay Phadke Acked-by: Ray Jui Acked-by: Rayagonda Kokatanur Signed-off-by: Wolfram Sang

i2c: mpc: Poll for MCF

2021-07-20T20:32:01Z

During some transfers the bus can still be busy when an interrupt is received. Commit 763778cd7926 ("i2c: mpc: Restore reread of I2C status register") attempted to address this by re-reading MPC_I2C_SR once but that just made it less likely to happen without actually preventing it. Instead of a single re-read, poll with a timeout so that the bus is given enough time to settle but a genuine stuck SCL is still noticed. Fixes: 1538d82f4647 ("i2c: mpc: Interrupt driven transfer") Signed-off-by: Chris Packham Signed-off-by: Wolfram Sang

Merge branch 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2021-07-04T18:47:18Z

Pull i2c updates from Wolfram Sang: - core supports now bus regulators controlling power for SCL/SDA - quite some DT binding conversions to YAML - added a seperate DT binding for the optional SMBus Alert feature - documentation with examples how to deal with I2C sysfs files - some bigger rework for the i801 driver - and a few usual driver updates * 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (42 commits) i2c: ali1535: mention that the device should not be disabled i2c: mpc: Restore reread of I2C status register i2c: core-smbus: Expose PEC calculate function for generic use Documentation: i2c: Add doc for I2C sysfs i2c: core: Disable client irq on reboot/shutdown dt-bindings: i2c: update bindings for MT8195 SoC i2c: imx: Fix some checkpatch warnings i2c: davinci: Simplify with dev_err_probe() i2c: cadence: Simplify with dev_err_probe() i2c: xiic: Simplify with dev_err_probe() i2c: cadence: Clear HOLD bit before xfer_size register rolls over dt-bindings: i2c: ce4100: Replace "ti,pcf8575" by "nxp,pcf8575" i2c: i801: Improve i801_setup_hstcfg i2c: i801: Use driver name constant instead of function dev_driver_string i2c: i801: Simplify initialization of i2c_board_info in i801_probe_optional_slaves i2c: i801: Improve status polling i2c: cht-wc: Replace of_node by NULL i2c: riic: Add RZ/G2L support dt-bindings: i2c: renesas,riic: Document RZ/G2L I2C controller dt-bindings: i2c: renesas,iic: Convert to json-schema ...

i2c: ali1535: mention that the device should not be disabled

2021-07-02T07:14:46Z

The comment from the i801 driver is valid here, too, so copy it. Reported-by: Jean Delvare Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang

i2c: mpc: Restore reread of I2C status register

2021-07-02T07:12:51Z

Prior to commit 1538d82f4647 ("i2c: mpc: Interrupt driven transfer") the old interrupt handler would reread MPC_I2C_SR after checking the CSR_MIF bit. When the driver was re-written this was removed as it seemed unnecessary. However as it turns out this is necessary for i2c devices which do clock stretching otherwise we end up thinking the bus is still busy when processing the interrupt. Fixes: 1538d82f4647 ("i2c: mpc: Interrupt driven transfer") Signed-off-by: Chris Packham Signed-off-by: Wolfram Sang

Merge tag 'acpi-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2021-06-29T20:39:41Z

Pull ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to the 20210604 upstream revision, add preliminary support for the Platform Runtime Mechanism (PRM), address issues related to the handling of device dependencies in the ACPI device eunmeration code, improve the tracking of ACPI power resource states, improve the ACPI support for suspend-to-idle on AMD systems, continue the unification of message printing in the ACPI code, address assorted issues and clean up the code in a number of places. Specifics: - Update ACPICA code in the kernel to upstrea revision 20210604 including the following changes: - Add defines for the CXL Host Bridge Structureand and add the CFMWS structure definition to CEDT (Alison Schofield). - iASL: Finish support for the IVRS ACPI table (Bob Moore). - iASL: Add support for the SVKL table (Bob Moore). - iASL: Add full support for RGRT ACPI table (Bob Moore). - iASL: Add support for the BDAT ACPI table (Bob Moore). - iASL: add disassembler support for PRMT (Erik Kaneda). - Fix memory leak caused by _CID repair function (Erik Kaneda). - Add support for PlatformRtMechanism OpRegion (Erik Kaneda). - Add PRMT module header to facilitate parsing (Erik Kaneda). - Add _PLD panel positions (Fabian Wüthrich). - MADT: add Multiprocessor Wakeup Mailbox Structure and the SVKL table headers (Kuppuswamy Sathyanarayanan). - Use ACPI_FALLTHROUGH (Wei Ming Chen). - Add preliminary support for the Platform Runtime Mechanism (PRM) to allow the AML interpreter to call PRM functions (Erik Kaneda). - Address some issues related to the handling of device dependencies reported by _DEP in the ACPI device enumeration code and clean up some related pieces of it (Rafael Wysocki). - Improve the tracking of states of ACPI power resources (Rafael Wysocki). - Improve ACPI support for suspend-to-idle on AMD systems (Alex Deucher, Mario Limonciello, Pratik Vishwakarma). - Continue the unification and cleanup of message printing in the ACPI code (Hanjun Guo, Heiner Kallweit). - Fix possible buffer overrun issue with the description_show() sysfs attribute method (Krzysztof Wilczyński). - Improve the acpi_mask_gpe kernel command line parameter handling and clean up the core ACPI code related to sysfs (Andy Shevchenko, Baokun Li, Clayton Casciato). - Postpone bringing devices in the general ACPI PM domain to D0 during resume from system-wide suspend until they are really needed (Dmitry Torokhov). - Make the ACPI processor driver fix up C-state latency if not ordered (Mario Limonciello). - Add support for identifying devices depening on the given one that are not its direct descendants with the help of _DEP (Daniel Scally). - Extend the checks related to ACPI IRQ overrides on x86 in order to avoid false-positives (Hui Wang). - Add battery DPTF participant for Intel SoCs (Sumeet Pawnikar). - Rearrange the ACPI fan driver and device power management code to use a common list of device IDs (Rafael Wysocki). - Fix clang CFI violation in the ACPI BGRT table parsing code and clean it up (Nathan Chancellor). - Add GPE-related quirks for some laptops to the EC driver (Chris Chiu, Zhang Rui). - Make the ACPI PPTT table parsing code populate the cache-id value if present in the firmware (James Morse). - Remove redundant clearing of context->ret.pointer from acpi_run_osc() (Hans de Goede). - Add missing acpi_put_table() in acpi_init_fpdt() (Jing Xiangfeng). - Make ACPI APEI handle ARM Processor Error CPER records like Memory Error ones to avoid user space task lockups (Xiaofei Tan). - Stop warning about disabled ACPI in APEI (Jon Hunter). - Fix fall-through warning for Clang in the SBSHC driver (Gustavo A. R. Silva). - Add custom DSDT file as Makefile prerequisite (Richard Fitzgerald). - Initialize local variable to avoid garbage being returned (Colin Ian King). - Simplify assorted pieces of code, address assorted coding style and documentation issues and comment typos (Baokun Li, Christophe JAILLET, Clayton Casciato, Liu Shixin, Shaokun Zhang, Wei Yongjun, Yang Li, Zhen Lei)" * tag 'acpi-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (97 commits) ACPI: PM: postpone bringing devices to D0 unless we need them ACPI: tables: Add custom DSDT file as makefile prerequisite ACPI: bgrt: Use sysfs_emit ACPI: bgrt: Fix CFI violation ACPI: EC: trust DSDT GPE for certain HP laptop ACPI: scan: Simplify acpi_table_events_fn() ACPI: PM: Adjust behavior for field problems on AMD systems ACPI: PM: s2idle: Add support for new Microsoft UUID ACPI: PM: s2idle: Add support for multiple func mask ACPI: PM: s2idle: Refactor common code ACPI: PM: s2idle: Use correct revision id ACPI: sysfs: Remove tailing return statement in void function ACPI: sysfs: Use __ATTR_RO() and __ATTR_RW() macros ACPI: sysfs: Sort headers alphabetically ACPI: sysfs: Refactor param_get_trace_state() to drop dead code ACPI: sysfs: Unify pattern of memory allocations ACPI: sysfs: Allow bitmap list to be supplied to acpi_mask_gpe ACPI: sysfs: Make sparse happy about address space in use ACPI: scan: Fix race related to dropping dependencies ACPI: scan: Reorganize acpi_device_add() ...

Merge branches 'acpi-bus', 'acpi-scan' and 'acpi-tables'

2021-06-29T13:46:52Z

* acpi-bus: ACPI: Remove redundant clearing of context->ret.pointer from acpi_run_osc() * acpi-scan: ACPI: scan: Simplify acpi_table_events_fn() ACPI: scan: Fix race related to dropping dependencies ACPI: scan: Reorganize acpi_device_add() ACPI: scan: Fix device object rescan in acpi_scan_clear_dep() ACPI: scan: Make acpi_walk_dep_device_list() ACPI: scan: Rearrange acpi_dev_get_first_consumer_dev_cb() ACPI: scan: Define acpi_bus_put_acpi_device() as static inline ACPI: scan: initialize local variable to avoid garbage being returned ACPI: scan: Add function to fetch dependent of ACPI device ACPI: scan: Extend acpi_walk_dep_device_list() ACPI: scan: Rearrange dep_unmet initialization * acpi-tables: ACPI: tables: Add custom DSDT file as makefile prerequisite ACPI: bgrt: Use sysfs_emit ACPI: bgrt: Fix CFI violation ACPI: tables: FPDT: Add missing acpi_put_table() in acpi_init_fpdt() ACPI: tables: PPTT: Populate cache-id if provided by firmware

i2c: core-smbus: Expose PEC calculate function for generic use

2021-06-25T15:09:34Z

Expose the PEC calculation i2c_smbus_pec() for generic use. Signed-off-by: Quan Nguyen Acked-by: Matt Johnston Signed-off-by: Wolfram Sang

i2c: robotfuzz-osif: fix control-request directions

2021-06-24T20:08:00Z

The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation. Control transfers without a data stage are treated as OUT requests by the USB stack and should be using usb_sndctrlpipe(). Failing to do so will now trigger a warning. Fix the OSIFI2C_SET_BIT_RATE and OSIFI2C_STOP requests which erroneously used the osif_usb_read() helper and set the IN direction bit. Reported-by: syzbot+9d7dadd15b8819d73f41@syzkaller.appspotmail.com Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.") Cc: stable@vger.kernel.org # 3.14 Signed-off-by: Johan Hovold Signed-off-by: Wolfram Sang