linux.git/arch/sh, branch v6.5.4

sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

2023-09-19T10:30:21+00:00

[ Upstream commit 246f80a0b17f8f582b2c0996db02998239057c65 ]

The original code puts flush_work() before timer_shutdown_sync()
in switch_drv_remove(). Although we use flush_work() to stop
the worker, it could be rescheduled in switch_timer(). As a result,
a use-after-free bug can occur. The details are shown below:

      (cpu 0)                    |      (cpu 1)
switch_drv_remove()              |
 flush_work()                    |
  ...                            |  switch_timer // timer
                                 |   schedule_work(&psw->work)
 timer_shutdown_sync()           |
 ...                             |  switch_work_handler // worker
 kfree(psw) // free              |
                                 |   psw->state = 0 // use

This patch puts timer_shutdown_sync() before flush_work() to
mitigate the bugs. As a result, the worker and timer will be
stopped safely before the deallocate operations.

Fixes: 9f5e8eee5cfe ("sh: generic push-switch framework.")
Signed-off-by: Duoming Zhou 
Reviewed-by: Geert Uytterhoeven 
Reviewed-by: John Paul Adrian Glaubitz 
Link: https://lore.kernel.org/r/20230802033737.9738-1-duoming@zju.edu.cn
Signed-off-by: John Paul Adrian Glaubitz 
Signed-off-by: Sasha Levin

sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()

2023-09-19T10:30:21+00:00

[ Upstream commit fb60211f377b69acffead3147578f86d0092a7a5 ]

In all these cases, the last argument to dma_declare_coherent_memory() is
the buffer end address, but the expected value should be the size of the
reserved region.

Fixes: 39fb993038e1 ("media: arch: sh: ap325rxa: Use new renesas-ceu camera driver")
Fixes: c2f9b05fd5c1 ("media: arch: sh: ecovec: Use new renesas-ceu camera driver")
Fixes: f3590dc32974 ("media: arch: sh: kfr2r09: Use new renesas-ceu camera driver")
Fixes: 186c446f4b84 ("media: arch: sh: migor: Use new renesas-ceu camera driver")
Fixes: 1a3c230b4151 ("media: arch: sh: ms7724se: Use new renesas-ceu camera driver")
Signed-off-by: Petr Tesarik 
Reviewed-by: Geert Uytterhoeven 
Reviewed-by: Jacopo Mondi 
Reviewed-by: John Paul Adrian Glaubitz 
Reviewed-by: Laurent Pinchart 
Link: https://lore.kernel.org/r/20230724120742.2187-1-petrtesarik@huaweicloud.com
Signed-off-by: John Paul Adrian Glaubitz 
Signed-off-by: Sasha Levin

arch//configs/defconfig: Replace AUTOFS4_FS by AUTOFS_FS

2023-07-29T21:08:22+00:00

Commit a2225d931f75 ("autofs: remove left-over autofs4 stubs")
promised the removal of the fs/autofs/Kconfig fragment for AUTOFS4_FS
within a couple of releases, but five years later this still has not
happened yet, and AUTOFS4_FS is still enabled in 63 defconfigs.

Get rid of it mechanically:

   git grep -l CONFIG_AUTOFS4_FS -- '*defconfig' |
       xargs sed -i 's/AUTOFS4_FS/AUTOFS_FS/'

Also just remove the AUTOFS4_FS config option stub.  Anybody who hasn't
regenerated their config file in the last five years will need to just
get the new name right when they do.

Signed-off-by: Sven Joachim 
Acked-by: Ian Kent 
Signed-off-by: Linus Torvalds

Merge tag 'sh-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux

2023-07-13T20:34:00+00:00

Pull sh fixes from John Paul Adrian Glaubitz:
 "The sh updates introduced multiple regressions.

  In particular, the change a8ac2961148e ("sh: Avoid using IRQ0 on SH3
  and SH4") causes several boards to hang during boot due to incorrect
  IRQ numbers.

  Geert Uytterhoeven has contributed patches that handle the virq offset
  in the IRQ code for the dreamcast, highlander and r2d boards while
  Artur Rojek has contributed a patch which handles the virq offset for
  the hd64461 companion chip"

* tag 'sh-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux:
  sh: hd64461: Handle virq offset for offchip IRQ base and HD64461 IRQ
  sh: mach-dreamcast: Handle virq offset in cascaded IRQ demux
  sh: mach-highlander: Handle virq offset in cascaded IRL demux
  sh: mach-r2d: Handle virq offset in cascaded IRL demux

sh: hd64461: Handle virq offset for offchip IRQ base and HD64461 IRQ

2023-07-13T06:37:53+00:00

A recent change to start counting SuperH IRQ #s from 16 breaks support
for the Hitachi HD64461 companion chip.

Move the offchip IRQ base and HD64461 IRQ # by 16 in order to
accommodate for the new virq numbering rules.

Fixes: a8ac2961148e ("sh: Avoid using IRQ0 on SH3 and SH4")
Signed-off-by: Artur Rojek 
Reviewed-by: Geert Uytterhoeven 
Reviewed-by: John Paul Adrian Glaubitz 
Link: https://lore.kernel.org/r/20230710233132.69734-1-contact@artur-rojek.eu
Signed-off-by: John Paul Adrian Glaubitz

sh: mach-dreamcast: Handle virq offset in cascaded IRQ demux

2023-07-13T06:37:43+00:00

Take into account the virq offset when translating cascaded interrupts.

Fixes: a8ac2961148e8c72 ("sh: Avoid using IRQ0 on SH3 and SH4")
Signed-off-by: Geert Uytterhoeven 
Reviewed-by: John Paul Adrian Glaubitz 
Link: https://lore.kernel.org/r/7d0cb246c9f1cd24bb1f637ec5cb67e799a4c3b8.1688908227.git.geert+renesas@glider.be
Signed-off-by: John Paul Adrian Glaubitz

sh: mach-highlander: Handle virq offset in cascaded IRL demux

2023-07-13T06:37:38+00:00

Take into account the virq offset when translating cascaded IRL
interrupts.

Fixes: a8ac2961148e8c72 ("sh: Avoid using IRQ0 on SH3 and SH4")
Signed-off-by: Geert Uytterhoeven 
Reviewed-by: John Paul Adrian Glaubitz 
Link: https://lore.kernel.org/r/4fcb0d08a2b372431c41e04312742dc9e41e1be4.1688908186.git.geert+renesas@glider.be
Signed-off-by: John Paul Adrian Glaubitz

sh: mach-r2d: Handle virq offset in cascaded IRL demux

2023-07-13T06:37:26+00:00

When booting rts7751r2dplus_defconfig on QEMU, the system hangs due to
an interrupt storm on IRQ 20.  IRQ 20 aka event 0x280 is a cascaded IRL
interrupt, which maps to IRQ_VOYAGER, the interrupt used by the Silicon
Motion SM501 multimedia companion chip.  As rts7751r2d_irq_demux() does
not take into account the new virq offset, the interrupt is no longer
translated, leading to an unhandled interrupt.

Fix this by taking into account the virq offset when translating
cascaded IRL interrupts.

Fixes: a8ac2961148e8c72 ("sh: Avoid using IRQ0 on SH3 and SH4")
Reported-by: Guenter Roeck 
Closes: https://lore.kernel.org/r/fbfea3ad-d327-4ad5-ac9c-648c7ca3fe1f@roeck-us.net
Signed-off-by: Geert Uytterhoeven 
Reviewed-by: John Paul Adrian Glaubitz 
Tested-by: John Paul Adrian Glaubitz 
Tested-by: Guenter Roeck 
Link: https://lore.kernel.org/r/2c99d5df41c40691f6c407b7b6a040d406bc81ac.1688901306.git.geert+renesas@glider.be
Signed-off-by: John Paul Adrian Glaubitz

Merge tag 'sh-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux

2023-07-06T04:45:32+00:00

Pull sh updates from Adrian Glaubitz:
 "Fix a compiler warning in the J2 probing code and a fix by Sergey
  Shtylyov to avoid using IRQ0 on SH3 and SH4 targets. Masahiro Yamada
  made some clean-up in the build system to address reports by the 0day
  bot.

  The most notable changes come from Artur Rojek who addressed a number
  of issues in the DMA code, in particular a fix for the DMA channel
  offset calculation that was introduced in in 7f47c7189b3e ("sh: dma:
  More legacy cpu dma chainsawing.") in 2012!

  Together with another change to correct the number of DMA channels for
  each SuperH SoC according to specification, Artur's series unbreaks
  the kernel on the SH7709 SoC allowing Linux to boot on the HP Jornada
  680 handheld again.

  Summary:

   - Provide unxlate_dev_mem_ptr() in asm/io.h

   - dma: Correct the number of DMA channels for SH7709

   - dma: Drop incorrect SH_DMAC_BASE1 definition for SH4

   - dma: Fix DMA channel offset calculation

   - Remove compiler flag duplication

   - Refactor header include path addition

   - Move build rule for cchips/hd6446x/ to arch/sh/Kbuild

   - Fix -Wmissing-include-dirs warnings for various platforms

   - Avoid using IRQ0 on SH3 and SH4

   - j2: Use ioremap() to translate device tree address into kernel
     memory"

* tag 'sh-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux:
  sh: Provide unxlate_dev_mem_ptr() in asm/io.h
  sh: dma: Correct the number of DMA channels for SH7709
  sh: dma: Drop incorrect SH_DMAC_BASE1 definition for SH4
  sh: dma: Fix DMA channel offset calculation
  sh: Remove compiler flag duplication
  sh: Refactor header include path addition
  sh: Move build rule for cchips/hd6446x/ to arch/sh/Kbuild
  sh: Fix -Wmissing-include-dirs warnings for various platforms
  sh: Avoid using IRQ0 on SH3 and SH4
  sh: j2: Use ioremap() to translate device tree address into kernel memory

sh: Provide unxlate_dev_mem_ptr() in asm/io.h

2023-07-05T17:04:51+00:00

The unxlate_dev_mem_ptr() function has no prototype on the sh architecture
which does not include asm-generic/io.h. This results in the following
build failure:

drivers/char/mem.c: In function 'read_mem':
drivers/char/mem.c:164:25: error: implicit declaration of function 'unxlate_dev_mem_ptr'

This compile error is now seen because commit 99b619b37ae1 ("mips: provide
unxlate_dev_mem_ptr() in asm/io.h") removed the weak function which was
previously in place to handle this problem.

Add a trivial macro to the sh header to provide the now missing dummy
function.

Fixes: 99b619b37ae1 ("mips: provide unxlate_dev_mem_ptr() in asm/io.h")
Cc: Arnd Bergmann 
Signed-off-by: Guenter Roeck 
Acked-by: Arnd Bergmann 
Reviewed-by: John Paul Adrian Glaubitz 
Link: https://lore.kernel.org/r/20230704190144.2888679-1-linux@roeck-us.net
Signed-off-by: John Paul Adrian Glaubitz