Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc driver fixes from Greg KH:
"Here are some small char/misc driver fixes for issues that have been
reported.
Nothing major, highlights include:
- gnss sync write fixes
- uio oops fix
- nvmem fixes
- other minor fixes and some documentation/maintainers updates
Full details are in the shortlog.
All of these have been in linux-next for a while with no reported
issues"
* tag 'char-misc-4.20-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
Documentation/security-bugs: Postpone fix publication in exceptional cases
MAINTAINERS: Add Sasha as a stable branch maintainer
gnss: sirf: fix synchronous write timeout
gnss: serial: fix synchronous write timeout
uio: Fix an Oops on load
test_firmware: fix error return getting clobbered
nvmem: core: fix regression in of_nvmem_cell_get()
misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
drivers/misc/sgi-gru: fix Spectre v1 vulnerability
Drivers: hv: kvp: Fix the recent regression caused by incorrect clean-up
slimbus: ngd: remove unnecessary check
+54
-31
+10
-9
Documentation/admin-guide/security-bugs.rst
+10
-9
Documentation/admin-guide/security-bugs.rst
···
32
32
The security list is not a disclosure channel. For that, see Coordination
33
33
below.
34
34
35
-
Once a robust fix has been developed, our preference is to release the
36
-
fix in a timely fashion, treating it no differently than any of the other
37
-
thousands of changes and fixes the Linux kernel project releases every
38
-
month.
35
+
Once a robust fix has been developed, the release process starts. Fixes
36
+
for publicly known bugs are released immediately.
39
37
40
-
However, at the request of the reporter, we will postpone releasing the
41
-
fix for up to 5 business days after the date of the report or after the
42
-
embargo has lifted; whichever comes first. The only exception to that
43
-
rule is if the bug is publicly known, in which case the preference is to
44
-
release the fix as soon as it's available.
38
+
Although our preference is to release fixes for publicly undisclosed bugs
39
+
as soon as they become available, this may be postponed at the request of
40
+
the reporter or an affected party for up to 7 calendar days from the start
41
+
of the release process, with an exceptional extension to 14 calendar days
42
+
if it is agreed that the criticality of the bug requires more time. The
43
+
only valid reason for deferring the publication of a fix is to accommodate
44
+
the logistics of QA and large scale rollouts which require release
45
+
coordination.
45
46
46
47
Whilst embargoed information may be shared with trusted individuals in
47
48
order to develop a fix, such information will not be published alongside
+1
MAINTAINERS
+1
MAINTAINERS
+2
-1
drivers/gnss/serial.c
+2
-1
drivers/gnss/serial.c
···
13
13
#include <linux/of.h>
14
14
#include <linux/pm.h>
15
15
#include <linux/pm_runtime.h>
16
+
#include <linux/sched.h>
16
17
#include <linux/serdev.h>
17
18
#include <linux/slab.h>
18
19
···
64
63
int ret;
65
64
66
65
/* write is only buffered synchronously */
67
-
ret = serdev_device_write(serdev, buf, count, 0);
66
+
ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
68
67
if (ret < 0)
69
68
return ret;
70
69
+2
-1
drivers/gnss/sirf.c
+2
-1
drivers/gnss/sirf.c
···
16
16
#include <linux/pm.h>
17
17
#include <linux/pm_runtime.h>
18
18
#include <linux/regulator/consumer.h>
19
+
#include <linux/sched.h>
19
20
#include <linux/serdev.h>
20
21
#include <linux/slab.h>
21
22
#include <linux/wait.h>
···
84
83
int ret;
85
84
86
85
/* write is only buffered synchronously */
87
-
ret = serdev_device_write(serdev, buf, count, 0);
86
+
ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
88
87
if (ret < 0)
89
88
return ret;
90
89
+22
-4
drivers/hv/hv_kvp.c
+22
-4
drivers/hv/hv_kvp.c
···
353
353
354
354
out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
355
355
356
+
/* fallthrough */
357
+
358
+
case KVP_OP_GET_IP_INFO:
356
359
utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
357
360
MAX_ADAPTER_ID_SIZE,
358
361
UTF16_LITTLE_ENDIAN,
···
408
405
process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
409
406
break;
410
407
case KVP_OP_GET_IP_INFO:
411
-
/* We only need to pass on message->kvp_hdr.operation. */
408
+
/*
409
+
* We only need to pass on the info of operation, adapter_id
410
+
* and addr_family to the userland kvp daemon.
411
+
*/
412
+
process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
412
413
break;
413
414
case KVP_OP_SET:
414
415
switch (in_msg->body.kvp_set.data.value_type) {
···
453
446
454
447
}
455
448
456
-
break;
457
-
458
-
case KVP_OP_GET:
449
+
/*
450
+
* The key is always a string - utf16 encoding.
451
+
*/
459
452
message->body.kvp_set.data.key_size =
460
453
utf16s_to_utf8s(
461
454
(wchar_t *)in_msg->body.kvp_set.data.key,
462
455
in_msg->body.kvp_set.data.key_size,
463
456
UTF16_LITTLE_ENDIAN,
464
457
message->body.kvp_set.data.key,
458
+
HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
459
+
460
+
break;
461
+
462
+
case KVP_OP_GET:
463
+
message->body.kvp_get.data.key_size =
464
+
utf16s_to_utf8s(
465
+
(wchar_t *)in_msg->body.kvp_get.data.key,
466
+
in_msg->body.kvp_get.data.key_size,
467
+
UTF16_LITTLE_ENDIAN,
468
+
message->body.kvp_get.data.key,
465
469
HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
466
470
break;
467
471
+1
-1
drivers/misc/atmel-ssc.c
+1
-1
drivers/misc/atmel-ssc.c
···
132
132
MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
133
133
#endif
134
134
135
-
static inline const struct atmel_ssc_platform_data * __init
135
+
static inline const struct atmel_ssc_platform_data *
136
136
atmel_ssc_get_driver_data(struct platform_device *pdev)
137
137
{
138
138
if (pdev->dev.of_node) {
+4
drivers/misc/sgi-gru/grukdump.c
+4
drivers/misc/sgi-gru/grukdump.c
···
27
27
#include <linux/delay.h>
28
28
#include <linux/bitops.h>
29
29
#include <asm/uv/uv_hub.h>
30
+
31
+
#include <linux/nospec.h>
32
+
30
33
#include "gru.h"
31
34
#include "grutables.h"
32
35
#include "gruhandles.h"
···
199
196
/* Currently, only dump by gid is implemented */
200
197
if (req.gid >= gru_max_gids)
201
198
return -EINVAL;
199
+
req.gid = array_index_nospec(req.gid, gru_max_gids);
202
200
203
201
gru = GID_TO_GRU(req.gid);
204
202
ubuf = req.buf;
+6
-4
drivers/nvmem/core.c
+6
-4
drivers/nvmem/core.c
···
44
44
int bytes;
45
45
int bit_offset;
46
46
int nbits;
47
+
struct device_node *np;
47
48
struct nvmem_device *nvmem;
48
49
struct list_head node;
49
50
};
···
299
298
mutex_lock(&nvmem_mutex);
300
299
list_del(&cell->node);
301
300
mutex_unlock(&nvmem_mutex);
301
+
of_node_put(cell->np);
302
302
kfree(cell->name);
303
303
kfree(cell);
304
304
}
···
532
530
return -ENOMEM;
533
531
534
532
cell->nvmem = nvmem;
533
+
cell->np = of_node_get(child);
535
534
cell->offset = be32_to_cpup(addr++);
536
535
cell->bytes = be32_to_cpup(addr);
537
536
cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
···
963
960
964
961
#if IS_ENABLED(CONFIG_OF)
965
962
static struct nvmem_cell *
966
-
nvmem_find_cell_by_index(struct nvmem_device *nvmem, int index)
963
+
nvmem_find_cell_by_node(struct nvmem_device *nvmem, struct device_node *np)
967
964
{
968
965
struct nvmem_cell *cell = NULL;
969
-
int i = 0;
970
966
971
967
mutex_lock(&nvmem_mutex);
972
968
list_for_each_entry(cell, &nvmem->cells, node) {
973
-
if (index == i++)
969
+
if (np == cell->np)
974
970
break;
975
971
}
976
972
mutex_unlock(&nvmem_mutex);
···
1013
1011
if (IS_ERR(nvmem))
1014
1012
return ERR_CAST(nvmem);
1015
1013
1016
-
cell = nvmem_find_cell_by_index(nvmem, index);
1014
+
cell = nvmem_find_cell_by_node(nvmem, cell_np);
1017
1015
if (!cell) {
1018
1016
__nvmem_device_put(nvmem);
1019
1017
return ERR_PTR(-ENOENT);
-3
drivers/slimbus/qcom-ngd-ctrl.c
-3
drivers/slimbus/qcom-ngd-ctrl.c
···
777
777
u8 la = txn->la;
778
778
bool usr_msg = false;
779
779
780
-
if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)
781
-
return -EPROTONOSUPPORT;
782
-
783
780
if (txn->mt == SLIM_MSG_MT_CORE &&
784
781
(txn->mc >= SLIM_MSG_MC_BEGIN_RECONFIGURATION &&
785
782
txn->mc <= SLIM_MSG_MC_RECONFIGURE_NOW))
-6
drivers/slimbus/slimbus.h
-6
drivers/slimbus/slimbus.h
···
61
61
#define SLIM_MSG_MC_NEXT_REMOVE_CHANNEL 0x58
62
62
#define SLIM_MSG_MC_RECONFIGURE_NOW 0x5F
63
63
64
-
/*
65
-
* Clock pause flag to indicate that the reconfig message
66
-
* corresponds to clock pause sequence
67
-
*/
68
-
#define SLIM_MSG_CLK_PAUSE_SEQ_FLG (1U << 8)
69
-
70
64
/* Clock pause values per SLIMbus spec */
71
65
#define SLIM_CLK_FAST 0
72
66
#define SLIM_CLK_CONST_PHASE 1
+5
-2
drivers/uio/uio.c
+5
-2
drivers/uio/uio.c
···
961
961
if (ret)
962
962
goto err_uio_dev_add_attributes;
963
963
964
+
info->uio_dev = idev;
965
+
964
966
if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
965
967
/*
966
968
* Note that we deliberately don't use devm_request_irq
···
974
972
*/
975
973
ret = request_irq(info->irq, uio_interrupt,
976
974
info->irq_flags, info->name, idev);
977
-
if (ret)
975
+
if (ret) {
976
+
info->uio_dev = NULL;
978
977
goto err_request_irq;
978
+
}
979
979
}
980
980
981
-
info->uio_dev = idev;
982
981
return 0;
983
982
984
983
err_request_irq: