kernel/linux.git/drivers/slimbus/messaging.c, branch linux-4.16.y

slimbus: Fix out-of-bounds access in slim_slicesize()

2018-05-01T19:47:26+00:00

commit e33bbe69149b802c0c77bfb822685772f85388ca upstream. With gcc-4.1.2: slimbus/messaging.c: In function ‘slim_slicesize’: slimbus/messaging.c:186: warning: statement with no effect Indeed, clamp() is a macro not operating in-place, but returning the clamped value. Hence the value is not clamped at all, which may lead to an out-of-bounds access. Fix this by assigning the clamped value. Fixes: afbdcc7c384b0d44 ("slimbus: Add messaging APIs to slimbus framework") Signed-off-by: Geert Uytterhoeven Cc: stable Signed-off-by: Greg Kroah-Hartman

slimbus: Fix missing unlock on error in slim_msg_response()

2018-01-09T16:00:13+00:00

Add the missing unlock before return from function slim_msg_response() in the error handling case. Signed-off-by: Wei Yongjun Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: Use GFP_ATOMIC under spin lock

2018-01-09T16:00:13+00:00

A spin lock is taken here so we should use GFP_ATOMIC. Signed-off-by: Wei Yongjun Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: avoid null pointer dereference on msg

2018-01-09T16:00:13+00:00

The pointer msg is checked to see if it is null at the start of the function and jumps to the error exit label reterr that then dereferences msg when it prints a dev_err error message. Avoid this potential null pointer dereference by only printing the error message if msg is not null. Detected by CoverityScan, CID#1463141 ("Dereference after null check") Signed-off-by: Colin Ian King Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: Add support for 'clock-pause' feature

2017-12-19T10:01:03+00:00

Per SLIMbus specification, a reconfiguration sequence known as 'clock pause' needs to be broadcast over the bus while entering low- power mode. Clock-pause is initiated by the controller driver. To exit clock-pause, controller typically wakes up the framer device. Since wakeup precedure is controller-specific, framework calls it via controller's function pointer to invoke it. Signed-off-by: Sagar Dharia Signed-off-by: Srinivas Kandagatla Reviwed-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

slimbus: Add messaging APIs to slimbus framework

2017-12-19T10:01:02+00:00

SLIMbus devices use value-element, and information elements to control device parameters (e.g. value element is used to represent gain for codec, information element is used to represent interrupt status for codec when codec interrupt fires). Messaging APIs are used to set/get these value and information elements. SLIMbus specification uses 8-bit "transaction IDs" for messages where a read-value is anticipated. Framework uses a table of pointers to store those TIDs and responds back to the caller in O(1). Caller can do synchronous and asynchronous reads/writes. Signed-off-by: Srinivas Kandagatla Reviwed-by: Mark Brown Signed-off-by: Greg Kroah-Hartman