Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0eb6774 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.19.166 into android-4.19-stable 



Changes in 4.19.166
	Revert "mtd: spinand: Fix OOB read"
	dmaengine: at_hdmac: Substitute kzalloc with kmalloc
	dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()
	dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate()
	kdev_t: always inline major/minor helper functions
	iio:imu:bmi160: Fix alignment and data leak issues
	iio:magnetometer:mag3110: Fix alignment and data leak issues.
	mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
	Linux 4.19.166

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib7d0ce70832eb58e4aed2b7b6f29082184f64299
parents c0fc50e6 610bdbf6

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 4

PATCHLEVEL = 19

SUBLEVEL = 165

SUBLEVEL = 166

EXTRAVERSION =

NAME = "People's Front"

drivers/dma/at_hdmac.c

+8 −3
Original line number Diff line number Diff line
@@ -1683,9 +1683,11 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, 
	dma_cap_zero(mask);

	dma_cap_set(DMA_SLAVE, mask);



	atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);

	if (!atslave)

	atslave = kmalloc(sizeof(*atslave), GFP_KERNEL);

	if (!atslave) {

		put_device(&dmac_pdev->dev);

		return NULL;

	}



	atslave->cfg = ATC_DST_H2SEL_HW | ATC_SRC_H2SEL_HW;

	/*
@@ -1714,8 +1716,11 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, 
	atslave->dma_dev = &dmac_pdev->dev;



	chan = dma_request_channel(mask, at_dma_filter, atslave);

	if (!chan)

	if (!chan) {

		put_device(&dmac_pdev->dev);

		kfree(atslave);

		return NULL;

	}



	atchan = to_at_dma_chan(chan);

	atchan->per_if = dma_spec->args[0] & 0xff;

drivers/iio/imu/bmi160/bmi160_core.c

+9 −4
Original line number Diff line number Diff line
@@ -110,6 +110,13 @@ enum bmi160_sensor_type { 


struct bmi160_data {

	struct regmap *regmap;

	/*

	 * Ensure natural alignment for timestamp if present.

	 * Max length needed: 2 * 3 channels + 4 bytes padding + 8 byte ts.

	 * If fewer channels are enabled, less space may be needed, as

	 * long as the timestamp is still aligned to 8 bytes.

	 */

	__le16 buf[12] __aligned(8);

};



const struct regmap_config bmi160_regmap_config = {
@@ -385,8 +392,6 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p) 
	struct iio_poll_func *pf = p;

	struct iio_dev *indio_dev = pf->indio_dev;

	struct bmi160_data *data = iio_priv(indio_dev);

	__le16 buf[12];

	/* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */

	int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;

	__le16 sample;
@@ -396,10 +401,10 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p) 
				       &sample, sizeof(sample));

		if (ret < 0)

			goto done;

		buf[j++] = sample;

		data->buf[j++] = sample;

	}



	iio_push_to_buffers_with_timestamp(indio_dev, buf,

	iio_push_to_buffers_with_timestamp(indio_dev, data->buf,

					   iio_get_time_ns(indio_dev));

done:

	iio_trigger_notify_done(indio_dev->trig);

drivers/iio/magnetometer/mag3110.c

+9 −4
Original line number Diff line number Diff line
@@ -56,6 +56,12 @@ struct mag3110_data { 
	struct mutex lock;

	u8 ctrl_reg1;

	int sleep_val;

	/* Ensure natural alignment of timestamp */

	struct {

		__be16 channels[3];

		u8 temperature;

		s64 ts __aligned(8);

	} scan;

};



static int mag3110_request(struct mag3110_data *data)
@@ -387,10 +393,9 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p) 
	struct iio_poll_func *pf = p;

	struct iio_dev *indio_dev = pf->indio_dev;

	struct mag3110_data *data = iio_priv(indio_dev);

	u8 buffer[16]; /* 3 16-bit channels + 1 byte temp + padding + ts */

	int ret;



	ret = mag3110_read(data, (__be16 *) buffer);

	ret = mag3110_read(data, data->scan.channels);

	if (ret < 0)

		goto done;
@@ -399,10 +404,10 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p) 
			MAG3110_DIE_TEMP);

		if (ret < 0)

			goto done;

		buffer[6] = ret;

		data->scan.temperature = ret;

	}



	iio_push_to_buffers_with_timestamp(indio_dev, buffer,

	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,

		iio_get_time_ns(indio_dev));



done:

drivers/mtd/nand/spi/core.c

+0 −4
Original line number Diff line number Diff line
@@ -378,10 +378,6 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand, 
		}

	}



	if (req->ooblen)

		memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs,

		       req->ooblen);



	return 0;

}