Commit f469cf96 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'char-misc-6.10-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 

Pull char / misc driver fixes from Greg KH:
 "Here are some small remaining driver fixes for 6.10-final that have
  all been in linux-next for a while and resolve reported issues.
  Included in here are:

   - mei driver fixes (and a spelling fix at the end just to be clean)

   - iio driver fixes for reported problems

   - fastrpc bugfixes

   - nvmem small fixes"

* tag 'char-misc-6.10-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  mei: vsc: Fix spelling error
  mei: vsc: Enhance SPI transfer of IVSC ROM
  mei: vsc: Utilize the appropriate byte order swap function
  mei: vsc: Prevent timeout error with added delay post-firmware download
  mei: vsc: Enhance IVSC chipset stability during warm reboot
  nvmem: core: limit cell sysfs permissions to main attribute ones
  nvmem: core: only change name to fram for current attribute
  nvmem: meson-efuse: Fix return value of nvmem callbacks
  nvmem: rmem: Fix return value of rmem_read()
  misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
  hpet: Support 32-bit userspace
  misc: fastrpc: Restrict untrusted app to attach to privileged PD
  misc: fastrpc: Fix ownership reassignment of remote heap
  misc: fastrpc: Fix memory leak in audio daemon attach operation
  misc: fastrpc: Avoid updating PD type for capability request
  misc: fastrpc: Copy the complete capability structure to user
  misc: fastrpc: Fix DSP capabilities request
  iio: light: apds9306: Fix error handing
  iio: trigger: Fix condition for own trigger
parents 1cb67bcc 389637d4

drivers/char/hpet.c

+29 −5
Original line number Diff line number Diff line
@@ -269,8 +269,13 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos) 
	if (!devp->hd_ireqfreq)

		return -EIO;



	if (in_compat_syscall()) {

		if (count < sizeof(compat_ulong_t))

			return -EINVAL;

	} else {

		if (count < sizeof(unsigned long))

			return -EINVAL;

	}



	add_wait_queue(&devp->hd_waitqueue, &wait);
@@ -294,9 +299,16 @@ hpet_read(struct file *file, char __user *buf, size_t count, loff_t * ppos) 
		schedule();

	}



	if (in_compat_syscall()) {

		retval = put_user(data, (compat_ulong_t __user *)buf);

		if (!retval)

			retval = sizeof(compat_ulong_t);

	} else {

		retval = put_user(data, (unsigned long __user *)buf);

		if (!retval)

			retval = sizeof(unsigned long);

	}



out:

	__set_current_state(TASK_RUNNING);

	remove_wait_queue(&devp->hd_waitqueue, &wait);
@@ -651,12 +663,24 @@ struct compat_hpet_info { 
	unsigned short hi_timer;

};



/* 32-bit types would lead to different command codes which should be

 * translated into 64-bit ones before passed to hpet_ioctl_common

 */

#define COMPAT_HPET_INFO       _IOR('h', 0x03, struct compat_hpet_info)

#define COMPAT_HPET_IRQFREQ    _IOW('h', 0x6, compat_ulong_t)



static long

hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)

{

	struct hpet_info info;

	int err;



	if (cmd == COMPAT_HPET_INFO)

		cmd = HPET_INFO;



	if (cmd == COMPAT_HPET_IRQFREQ)

		cmd = HPET_IRQFREQ;



	mutex_lock(&hpet_mutex);

	err = hpet_ioctl_common(file->private_data, cmd, arg, &info);

	mutex_unlock(&hpet_mutex);

drivers/iio/industrialio-trigger.c

+1 −1
Original line number Diff line number Diff line
@@ -315,7 +315,7 @@ int iio_trigger_attach_poll_func(struct iio_trigger *trig, 
	 * this is the case if the IIO device and the trigger device share the

	 * same parent device.

	 */

	if (iio_validate_own_trigger(pf->indio_dev, trig))

	if (!iio_validate_own_trigger(pf->indio_dev, trig))

		trig->attached_own_device = true;



	return ret;

drivers/iio/light/apds9306.c

+2 −2
Original line number Diff line number Diff line
@@ -583,8 +583,8 @@ static int apds9306_intg_time_set(struct apds9306_data *data, int val2) 
		return ret;



	intg_old = iio_gts_find_int_time_by_sel(&data->gts, intg_time_idx);

	if (ret < 0)

		return ret;

	if (intg_old < 0)

		return intg_old;



	if (intg_old == val2)

		return 0;

drivers/misc/fastrpc.c

+32 −9
Original line number Diff line number Diff line
@@ -1238,6 +1238,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, 
	struct fastrpc_phy_page pages[1];

	char *name;

	int err;

	bool scm_done = false;

	struct {

		int pgid;

		u32 namelen;
@@ -1289,6 +1290,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, 
					fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err);

				goto err_map;

			}

			scm_done = true;

		}

	}
@@ -1320,10 +1322,11 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, 
		goto err_invoke;



	kfree(args);

	kfree(name);



	return 0;

err_invoke:

	if (fl->cctx->vmcount) {

	if (fl->cctx->vmcount && scm_done) {

		u64 src_perms = 0;

		struct qcom_scm_vmperm dst_perms;

		u32 i;
@@ -1693,16 +1696,20 @@ static int fastrpc_get_info_from_dsp(struct fastrpc_user *fl, uint32_t *dsp_attr 
{

	struct fastrpc_invoke_args args[2] = { 0 };



	/* Capability filled in userspace */

	/*

	 * Capability filled in userspace. This carries the information

	 * about the remoteproc support which is fetched from the remoteproc

	 * sysfs node by userspace.

	 */

	dsp_attr_buf[0] = 0;

	dsp_attr_buf_len -= 1;



	args[0].ptr = (u64)(uintptr_t)&dsp_attr_buf_len;

	args[0].length = sizeof(dsp_attr_buf_len);

	args[0].fd = -1;

	args[1].ptr = (u64)(uintptr_t)&dsp_attr_buf[1];

	args[1].length = dsp_attr_buf_len;

	args[1].length = dsp_attr_buf_len * sizeof(u32);

	args[1].fd = -1;

	fl->pd = USER_PD;



	return fastrpc_internal_invoke(fl, true, FASTRPC_DSP_UTILITIES_HANDLE,

				       FASTRPC_SCALARS(0, 1, 1), args);
@@ -1730,7 +1737,7 @@ static int fastrpc_get_info_from_kernel(struct fastrpc_ioctl_capability *cap, 
	if (!dsp_attributes)

		return -ENOMEM;



	err = fastrpc_get_info_from_dsp(fl, dsp_attributes, FASTRPC_MAX_DSP_ATTRIBUTES_LEN);

	err = fastrpc_get_info_from_dsp(fl, dsp_attributes, FASTRPC_MAX_DSP_ATTRIBUTES);

	if (err == DSP_UNSUPPORTED_API) {

		dev_info(&cctx->rpdev->dev,

			 "Warning: DSP capabilities not supported on domain: %d\n", domain);
@@ -1783,7 +1790,7 @@ static int fastrpc_get_dsp_info(struct fastrpc_user *fl, char __user *argp) 
	if (err)

		return err;



	if (copy_to_user(argp, &cap.capability, sizeof(cap.capability)))

	if (copy_to_user(argp, &cap, sizeof(cap)))

		return -EFAULT;



	return 0;
@@ -2080,6 +2087,16 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp) 
	return err;

}



static int is_attach_rejected(struct fastrpc_user *fl)

{

	/* Check if the device node is non-secure */

	if (!fl->is_secure_dev) {

		dev_dbg(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n");

		return -EACCES;

	}

	return 0;

}



static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,

				 unsigned long arg)

{
@@ -2092,12 +2109,18 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd, 
		err = fastrpc_invoke(fl, argp);

		break;

	case FASTRPC_IOCTL_INIT_ATTACH:

		err = is_attach_rejected(fl);

		if (!err)

			err = fastrpc_init_attach(fl, ROOT_PD);

		break;

	case FASTRPC_IOCTL_INIT_ATTACH_SNS:

		err = is_attach_rejected(fl);

		if (!err)

			err = fastrpc_init_attach(fl, SENSORS_PD);

		break;

	case FASTRPC_IOCTL_INIT_CREATE_STATIC:

		err = is_attach_rejected(fl);

		if (!err)

			err = fastrpc_init_create_static_process(fl, argp);

		break;

	case FASTRPC_IOCTL_INIT_CREATE:

drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c

+0 −4
Original line number Diff line number Diff line
@@ -153,7 +153,6 @@ static int pci1xxxx_eeprom_read(void *priv_t, unsigned int off, 


		buf[byte] = readl(rb + MMAP_EEPROM_OFFSET(EEPROM_DATA_REG));

	}

	ret = byte;

error:

	release_sys_lock(priv);

	return ret;
@@ -197,7 +196,6 @@ static int pci1xxxx_eeprom_write(void *priv_t, unsigned int off, 
			goto error;

		}

	}

	ret = byte;

error:

	release_sys_lock(priv);

	return ret;
@@ -258,7 +256,6 @@ static int pci1xxxx_otp_read(void *priv_t, unsigned int off, 


		buf[byte] = readl(rb + MMAP_OTP_OFFSET(OTP_RD_DATA_OFFSET));

	}

	ret = byte;

error:

	release_sys_lock(priv);

	return ret;
@@ -315,7 +312,6 @@ static int pci1xxxx_otp_write(void *priv_t, unsigned int off, 
			goto error;

		}

	}

	ret = byte;

error:

	release_sys_lock(priv);

	return ret;