kernel/linux.git/drivers/slimbus, branch v4.17.1

slimbus: Fix out-of-bounds access in slim_slicesize()

2018-04-23T11:40:15+00:00

With gcc-4.1.2: slimbus/messaging.c: In function ‘slim_slicesize’: slimbus/messaging.c:186: warning: statement with no effect Indeed, clamp() is a macro not operating in-place, but returning the clamped value. Hence the value is not clamped at all, which may lead to an out-of-bounds access. Fix this by assigning the clamped value. Fixes: afbdcc7c384b0d44 ("slimbus: Add messaging APIs to slimbus framework") Signed-off-by: Geert Uytterhoeven Cc: stable Signed-off-by: Greg Kroah-Hartman

slimbus: core: use put_device() instead of kfree()

2018-03-15T16:55:52+00:00

Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. Signed-off-by: Arvind Yadav Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: qcom: add HAS_IOMEM dependency

2018-01-09T16:01:15+00:00

Below build failure was reported on UML, ERROR: "devm_ioremap_resource" [drivers/slimbus/slim-qcom-ctrl.ko] undefined! ERROR: "__ioread32_copy" [drivers/slimbus/slim-qcom-ctrl.ko] undefined! ERROR: "__iowrite32_copy" [drivers/slimbus/slim-qcom-ctrl.ko] undefined! ERROR: "devm_ioremap" [drivers/slimbus/slim-qcom-ctrl.ko] undefined! This patch fixes it by making qcom slimbus depend on HAS_IOMEM, as these are only defined when HAS_IOMEM is selected. Reported-by: Thomas Meyer Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: qcom: Fix return value check in qcom_slim_probe()

2018-01-09T16:00:13+00:00

In case of error, the function devm_ioremap_resource() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by: Wei Yongjun Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: Fix missing unlock on error in slim_msg_response()

2018-01-09T16:00:13+00:00

Add the missing unlock before return from function slim_msg_response() in the error handling case. Signed-off-by: Wei Yongjun Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: Use GFP_ATOMIC under spin lock

2018-01-09T16:00:13+00:00

A spin lock is taken here so we should use GFP_ATOMIC. Signed-off-by: Wei Yongjun Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: make functions slim_ack_txn and slim_alloc_txbuf static

2018-01-09T16:00:13+00:00

The functions slim_ack_txn and slim_alloc_txbuf are local to the source and do not need to be in global scope, so make them static. Cleans up sparse warnings: symbol 'slim_ack_txn' was not declared. Should it be static? symbol 'slim_alloc_txbuf' was not declared. Should it be static? Signed-off-by: Colin Ian King Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: fix retries comparison to correctly identify failed allocation

2018-01-09T16:00:13+00:00

Currently the check for too many retries fails because retries is actually -1 when the retry loop terminates if no pbuf can be allocated because of the post decrement on retries. Fix this by not comparing retries with zero but instead check if it is negative. Detected by CoverityScan, CID#1463143 ("Logically dead code") and CID#1463144 ("Dereference after null check") Signed-off-by: Colin Ian King Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: avoid null pointer dereference on msg

2018-01-09T16:00:13+00:00

The pointer msg is checked to see if it is null at the start of the function and jumps to the error exit label reterr that then dereferences msg when it prints a dev_err error message. Avoid this potential null pointer dereference by only printing the error message if msg is not null. Detected by CoverityScan, CID#1463141 ("Dereference after null check") Signed-off-by: Colin Ian King Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman

slimbus: qcom-ctrl: use normal allocation

2018-01-02T16:05:17+00:00

The previous patch addressed a warning but not the cause: drivers/slimbus/qcom-ctrl.c: In function 'qcom_slim_probe': drivers/slimbus/qcom-ctrl.c:584:9: error: passing argument 3 of 'dmam_alloc_coherent' from incompatible pointer type [-Werror=incompatible-pointer-types] There are two things wrong here: - The naming is very confusing, we now have a member named 'phys' that doesn't refer to a phys_addr_t but a dma_addr_t. If we needed a dma address, it should be named 'dma' to avoid confusion, and to make it less likely that someone passes it into a function that expects a physical address. - The dma address is not used at all at this point. It may have been designed to support DMA in the future, but today it doesn't, so the only effect right now is to make transfers artificially slower by using uncached memory instead of cached memory for a temporary buffer. This removes the unused structure member and instead changes the code to call devm_kcalloc(), which matches the usage of the 'base' pointer as an array of temporary buffers. Fixes: db809859c8ce ("slimbus: qcom: fix incompatible pointer warning") Signed-off-by: Arnd Bergmann Cc: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman