linux.git/drivers, branch v4.14.320

i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle

2023-06-28T08:14:21+00:00

[ Upstream commit e69b9bc170c6d93ee375a5cbfd15f74c0fb59bdd ]

Claim clkhi and clklo as integer type to avoid possible calculation
errors caused by data overflow.

Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver")
Signed-off-by: Clark Wang 
Signed-off-by: Carlos Song 
Reviewed-by: Andi Shyti 
Signed-off-by: Wolfram Sang 
Signed-off-by: Sasha Levin

drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl

2023-06-28T08:14:21+00:00

[ Upstream commit 982b173a6c6d9472730c3116051977e05d17c8c5 ]

Userspace can race to free the gobj(robj converted from), robj should not
be accessed again after drm_gem_object_put, otherwith it will result in
use-after-free.

Reviewed-by: Christian König 
Signed-off-by: Min Li 
Signed-off-by: Alex Deucher 
Signed-off-by: Sasha Levin

drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl

2023-06-28T08:14:21+00:00

[ Upstream commit 48bfd02569f5db49cc033f259e66d57aa6efc9a3 ]

If it is async, runqueue_node is freed in g2d_runqueue_worker on another
worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and
then executes the following if statement, there will be use-after-free.

Signed-off-by: Min Li 
Reviewed-by: Andi Shyti 
Signed-off-by: Inki Dae 
Signed-off-by: Sasha Levin

drm/exynos: vidi: fix a wrong error return

2023-06-28T08:14:21+00:00

[ Upstream commit 4a059559809fd1ddbf16f847c4d2237309c08edf ]

Fix a wrong error return by dropping an error return.

When vidi driver is remvoed, if ctx->raw_edid isn't same as fake_edid_info
then only what we have to is to free ctx->raw_edid so that driver removing
can work correctly - it's not an error case.

Signed-off-by: Inki Dae 
Reviewed-by: Andi Shyti 
Signed-off-by: Sasha Levin

s390/cio: unregister device when the only path is gone

2023-06-28T08:14:21+00:00

[ Upstream commit 89c0c62e947a01e7a36b54582fd9c9e346170255 ]

Currently, if the device is offline and all the channel paths are
either configured or varied offline, the associated subchannel gets
unregistered. Don't unregister the subchannel, instead unregister
offline device.

Signed-off-by: Vineeth Vijayan 
Reviewed-by: Peter Oberparleiter 
Signed-off-by: Alexander Gordeev 
Signed-off-by: Sasha Levin

usb: gadget: udc: fix NULL dereference in remove()

2023-06-28T08:14:21+00:00

[ Upstream commit 016da9c65fec9f0e78c4909ed9a0f2d567af6775 ]

The "udc" pointer was never set in the probe() function so it will
lead to a NULL dereference in udc_pci_remove() when we do:

	usb_del_gadget_udc(&udc->gadget);

Signed-off-by: Dan Carpenter 
Link: https://lore.kernel.org/r/ZG+A/dNpFWAlCChk@kili
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

fbdev: imsttfb: Release framebuffer and dealloc cmap on error path

2023-06-28T08:14:21+00:00

[ Upstream commit 5cf9a090a39c97f4506b7b53739d469b1c05a7e9 ]

Add missing cleanups in error path.

Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

nfcsim.c: Fix error checking for debugfs_create_dir

2023-06-28T08:14:20+00:00

[ Upstream commit 9b9e46aa07273ceb96866b2e812b46f1ee0b8d2f ]

This patch fixes the error checking in nfcsim.c.
The DebugFS kernel API is developed in
a way that the caller can safely ignore the errors that
occur during the creation of DebugFS nodes.

Signed-off-by: Osama Muhammad 
Reviewed-by: Simon Horman 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

HID: wacom: Add error check to wacom_parse_and_register()

2023-06-28T08:14:20+00:00

[ Upstream commit 16a9c24f24fbe4564284eb575b18cc20586b9270 ]

   Added a variable check and
   transition in case of an error

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Arefev 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin

scsi: target: iscsi: Prevent login threads from racing between each other

2023-06-28T08:14:20+00:00

[ Upstream commit 2a737d3b8c792400118d6cf94958f559de9c5e59 ]

The tpg->np_login_sem is a semaphore that is used to serialize the login
process when multiple login threads run concurrently against the same
target portal group.

The iscsi_target_locate_portal() function finds the tpg, calls
iscsit_access_np() against the np_login_sem semaphore and saves the tpg
pointer in conn->tpg;

If iscsi_target_locate_portal() fails, the caller will check for the
conn->tpg pointer and, if it's not NULL, then it will assume that
iscsi_target_locate_portal() called iscsit_access_np() on the semaphore.

Make sure that conn->tpg gets initialized only if iscsit_access_np() was
successful, otherwise iscsit_deaccess_np() may end up being called against
a semaphore we never took, allowing more than one thread to access the same
tpg.

Signed-off-by: Maurizio Lombardi 
Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@redhat.com
Reviewed-by: Mike Christie 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin