linux-toradex.git, branch v4.9.35

Linux 4.9.35

2017-06-29T11:00:49+00:00

brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2()

2017-06-29T11:00:32+00:00

commit 35abcd4f9f303ac4f10f99b3f7e993e5f2e6fa37 upstream.

This fixes the following warning:

  drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c: In function
  'brcmf_usb_probe_phase2':
  drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c:1198:2:
  warning: 'devinfo' may be used uninitialized in this function
  [-Wmaybe-uninitialized]
    mutex_unlock(&devinfo->dev_init_lock);

Fixes: 6d0507a777fb ("brcmfmac: add parameter to pass error code in firmware callback")
Cc: Stephen Rothwell 
Reported-by: Kalle Valo 
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman

jump label: fix passing kbuild_cflags when checking for asm goto support

2017-06-29T11:00:31+00:00

commit 7292ae3d5a18fb922be496e6bb687647193569b4 upstream.

The latest change of asm goto support check added passing of KBUILD_CFLAGS
to compiler.  When these flags reference gcc plugins that are not built yet,
the check fails.

When one runs "make bzImage" followed by "make modules", the kernel is always
built with HAVE_JUMP_LABEL disabled, while the modules are built depending on
CONFIG_JUMP_LABEL.  If HAVE_JUMP_LABEL macro happens to be different, modules
are built with undefined references, e.g.:

ERROR: "static_key_slow_inc" [net/netfilter/xt_TEE.ko] undefined!
ERROR: "static_key_slow_dec" [net/netfilter/xt_TEE.ko] undefined!
ERROR: "static_key_slow_dec" [net/netfilter/nft_meta.ko] undefined!
ERROR: "static_key_slow_inc" [net/netfilter/nft_meta.ko] undefined!
ERROR: "nf_hooks_needed" [net/netfilter/ipvs/ip_vs.ko] undefined!
ERROR: "nf_hooks_needed" [net/ipv6/ipv6.ko] undefined!
ERROR: "static_key_count" [net/ipv6/ipv6.ko] undefined!
ERROR: "static_key_slow_inc" [net/ipv6/ipv6.ko] undefined!

This change moves the check before all these references are added
to KBUILD_CFLAGS.  This is correct because subsequent KBUILD_CFLAGS
modifications are not relevant to this check.

Reported-by: Anton V. Boyarshinov 
Fixes: 35f860f9ba6a ("jump label: pass kbuild_cflags when checking for asm goto support")
Signed-off-by: Gleb Fotengauer-Malinovskiy 
Signed-off-by: Dmitry V. Levin 
Acked-by: Steven Rostedt (VMware) 
Acked-by: David Lin 
Signed-off-by: Masahiro Yamada 
Signed-off-by: Greg Kroah-Hartman

net: phy: fix marvell phy status reading

2017-06-29T11:00:31+00:00

commit 898805e0cdf7fd860ec21bf661d3a0285a3defbd upstream.

The Marvell driver incorrectly provides phydev->lp_advertising as the
logical and of the link partner's advert and our advert.  This is
incorrect - this field is supposed to store the link parter's unmodified
advertisment.

This allows ethtool to report the correct link partner auto-negotiation
status.

Fixes: be937f1f89ca ("Marvell PHY m88e1111 driver fix")
Signed-off-by: Russell King 
Reviewed-by: Andrew Lunn 
Reviewed-by: Florian Fainelli 
Signed-off-by: David S. Miller 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

spi: double time out tolerance

2017-06-29T11:00:31+00:00

commit 833bfade96561216aa2129516a5926a0326860a2 upstream.

The generic SPI code calculates how long the issued transfer would take
and adds 100ms in addition to the timeout as tolerance. On my 500 MHz
Lantiq Mips SoC I am getting timeouts from the SPI like this when the
system boots up:

m25p80 spi32766.4: SPI transfer timed out
blk_update_request: I/O error, dev mtdblock3, sector 2
SQUASHFS error: squashfs_read_data failed to read block 0x6e

After increasing the tolerance for the timeout to 200ms I haven't seen
these SPI transfer time outs any more.
The Lantiq SPI driver in use here has an extra work queue in between,
which gets triggered when the controller send the last word and the
hardware FIFOs used for reading and writing are only 8 words long.

Signed-off-by: Hauke Mehrtens 
Signed-off-by: Mark Brown 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

dmaengine: bcm2835: Fix cyclic DMA period splitting

2017-06-29T11:00:31+00:00

commit 2201ac6129fa162ac24da089a034bb0971648ebb upstream.

The code responsible for splitting periods into chunks that
can be handled by the DMA controller missed to update total_len,
the number of bytes processed in the current period, when there
are more chunks to follow.

Therefore total_len was stuck at 0 and the code didn't work at all.
This resulted in a wrong control block layout and audio issues because
the cyclic DMA callback wasn't executing on period boundaries.

Fix this by adding the missing total_len update.

Signed-off-by: Matthias Reichl 
Signed-off-by: Martin Sperl 
Tested-by: Clive Messer 
Reviewed-by: Eric Anholt 
Signed-off-by: Vinod Koul 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

net: phy: Initialize mdio clock at probe function

2017-06-29T11:00:31+00:00

commit bb1a619735b4660f21bce3e728b937640024b4ad upstream.

USB PHYs need the MDIO clock divisor enabled earlier to work.
Initialize mdio clock divisor in probe function. The ext bus
bit available in the same register will be used by mdio mux
to enable external mdio.

Signed-off-by: Yendapally Reddy Dhananjaya Reddy 
Fixes: ddc24ae1 ("net: phy: Broadcom iProc MDIO bus driver")
Reviewed-by: Florian Fainelli 
Signed-off-by: Jon Mason 
Signed-off-by: David S. Miller 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

rt2x00: avoid introducing a USB dependency in the rt2x00lib module

2017-06-29T11:00:31+00:00

commit 6232c17438ed01f43665197db5a98a4a4f77ef47 upstream.

As reported by Felix:

Though protected by an ifdef, introducing an usb symbol dependency in
the rt2x00lib module is a major inconvenience for distributions that
package kernel modules split into individual packages.

Get rid of this unnecessary dependency by calling the usb related
function from a more suitable place.

Cc: Vishal Thanki 
Reported-by: Felix Fietkau 
Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB")
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: Kalle Valo 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_fs: avoid out of bounds access on comp_desc

2017-06-29T11:00:31+00:00

commit b7f73850bb4fac1e2209a4dd5e636d39be92f42c upstream.

Companion descriptor is only used for SuperSpeed endpoints,
if the endpoints are HighSpeed or FullSpeed, the Companion
descriptor will not allocated, so we can only access it if
gadget is SuperSpeed.

I can reproduce this issue on Rockchip platform rk3368 SoC
which supports USB 2.0, and use functionfs for ADB. Kernel
build with CONFIG_KASAN=y and CONFIG_SLUB_DEBUG=y report
the following BUG:

==================================================================
BUG: KASAN: slab-out-of-bounds in ffs_func_set_alt+0x224/0x3a0 at addr ffffffc0601f6509
Read of size 1 by task swapper/0/0
============================================================================
BUG kmalloc-256 (Not tainted): kasan: bad access detected
----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in ffs_func_bind+0x52c/0x99c age=1275 cpu=0 pid=1
alloc_debug_processing+0x128/0x17c
___slab_alloc.constprop.58+0x50c/0x610
__slab_alloc.isra.55.constprop.57+0x24/0x34
__kmalloc+0xe0/0x250
ffs_func_bind+0x52c/0x99c
usb_add_function+0xd8/0x1d4
configfs_composite_bind+0x48c/0x570
udc_bind_to_driver+0x6c/0x170
usb_udc_attach_driver+0xa4/0xd0
gadget_dev_desc_UDC_store+0xcc/0x118
configfs_write_file+0x1a0/0x1f8
__vfs_write+0x64/0x174
vfs_write+0xe4/0x200
SyS_write+0x68/0xc8
el0_svc_naked+0x24/0x28
INFO: Freed in inode_doinit_with_dentry+0x3f0/0x7c4 age=1275 cpu=7 pid=247
...
Call trace:
[] dump_backtrace+0x0/0x230
[] show_stack+0x14/0x1c
[] dump_stack+0xa0/0xc8
[] print_trailer+0x188/0x198
[] object_err+0x3c/0x4c
[] kasan_report+0x324/0x4dc
[] __asan_load1+0x24/0x50
[] ffs_func_set_alt+0x224/0x3a0
[] composite_setup+0xdcc/0x1ac8
[] android_setup+0x124/0x1a0
[] _setup+0x54/0x74
[] handle_ep0+0x3288/0x4390
[] dwc_otg_pcd_handle_out_ep_intr+0x14dc/0x2ae4
[] dwc_otg_pcd_handle_intr+0x1ec/0x298
[] dwc_otg_pcd_irq+0x10/0x20
[] handle_irq_event_percpu+0x124/0x3ac
[] handle_irq_event+0x60/0xa0
[] handle_fasteoi_irq+0x10c/0x1d4
[] generic_handle_irq+0x30/0x40
[] __handle_domain_irq+0xac/0xdc
[] gic_handle_irq+0x64/0xa4
...
Memory state around the buggy address:
  ffffffc0601f6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffffffc0601f6480: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc
 >ffffffc0601f6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                       ^
  ffffffc0601f6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffffffc0601f6600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================

Signed-off-by: William Wu 
Signed-off-by: Felipe Balbi 
Cc: Jerry Zhang 
Signed-off-by: Greg Kroah-Hartman

mtd: spi-nor: fix spansion quad enable

2017-06-29T11:00:31+00:00

commit 807c16253319ee6ccf8873ae64f070f7eb532cd5 upstream.

With the S25FL127S nor flash part, each writing to the configuration
register takes hundreds of ms. During that  time, no more accesses to
the flash should be done (even reads).

This commit adds a wait loop after the register writing until the flash
finishes its work.

This issue could make rootfs mounting fail when the latter was done too
much closely to this quad enable bit setting step. And in this case, a
driver as UBIFS may try to recover the filesystem and may broke it
completely.

Signed-off-by: Joël Esponde 
Signed-off-by: Cyrille Pitchen 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman