{"push_id":3094252863,"size":7,"distinct_size":7,"ref":"refs/heads/master","head":"94f371cb73944b410a269d570d6946c042f2ddd0","before":"f92a2ebb3d5588720a33d4f22d55b4ba24f94da6","commits":[{"sha":"ae6b3e54aa52cd29965b8e4e47000ed2c5d78eb8","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field()\n\nGeneric Serial Bus transfers use a data struct like this:\n\nstruct gsb_buffer {\n        u8      status;\n        u8      len;\n        u8      data[0];\n};\n\nacpi_ex_write_data_to_field() copies the data which is to be written from\nthe source-buffer to a temp-buffer. This is done because the OpReg-handler\noverwrites the status field and some transfers do a write + read-back.\n\nCommit f99b89eefeb6 (\"ACPICA: Update for generic_serial_bus and\nattrib_raw_process_bytes protocol\") acpi_ex_write_data_to_field()\nintroduces a number of problems with this:\n\n 1) It drops a \"length += 2\" statement used to calculate the temp-buffer\n size causing the temp-buffer to only be 1/2 bytes large for byte/word\n transfers while it should be 3/4 bytes (taking the status and len field\n into account). This is already fixed in commit e324e10109fc (\"ACPICA:\n Update for field unit access\") which refactors the code.\n\nThe ACPI 6.0 spec (ACPI_6.0.pdf) \"5.5.2.4.5.2 Declaring and Using a\nGenericSerialBusData Buffer\" (page 232) states that the GenericSerialBus\nData Buffer Length field is only valid when doing a Read/Write Block\n(AttribBlock) transfer, but since the troublesome commit we unconditionally\nuse the len field to determine how much data to copy from the source-buffer\ninto the temp-buffer passed to the OpRegion.\n\nThis causes 3 further issues:\n\n 2) This may lead to not copying enough data to the temp-buffer causing the\n OpRegion handler for the serial-bus to write garbage to the hardware.\n\n 3) The temp-buffer passed to the OpRegion is allocated to the size\n returned by acpi_ex_get_serial_access_length(), which may be as little\n as 1, so potentially this may lead to a write overflow of the temp-buffer.\n\n 4) Commit e324e10109fc (\"ACPICA: Update for field unit access\") drops a\n length check on the source-buffer, leading to a potential read overflow\n of the source-buffer.\n\nThis commit fixes all 3 remaining issues by not looking at the len field at\nall (the interpretation of this field is left up to the OpRegion handler),\nand copying the minimum of the source- and temp-buffer sizes from the\nsource-buffer to the temp-buffer.\n\nThis fixes e.g. an Acer S1003 no longer booting since the troublesome\ncommit.\n\nFixes: f99b89eefeb6 (ACPICA: Update for generic_serial_bus and ...)\nFixes: e324e10109fc (ACPICA: Update for field unit access)\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/ae6b3e54aa52cd29965b8e4e47000ed2c5d78eb8"},{"sha":"bf21c6e455539a495ce6d2877da2f9e364a89062","author":{"name":"YueHaibing","email":"87ef4e6170d5e1d30adb7567acad1fcb98f93b6e@huawei.com"},"message":"opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings\n\nRemove .owner field if calls are used which set it automatically\nGenerated by: scripts/coccinelle/api/platform_no_drv_owner.cocci\n\nSigned-off-by: YueHaibing <yuehaibing@huawei.com>\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/bf21c6e455539a495ce6d2877da2f9e364a89062"},{"sha":"3e27c79c4b121a64e85f26ab8957e5d0a09ff28e","author":{"name":"Viresh Kumar","email":"5ff32272b3d9f86512eddc8e0af523fc6f7924e5@linaro.org"},"message":"OPP: Fix parsing of multiple phandles in \"operating-points-v2\" property\n\nWe currently return error if more than one phandle is present in the\n\"operating-points-v2\" property, which is incorrect. We only want to\ncheck the count of phandles here and set index to 0 if only one phandle\nis present.\n\nFix it.\n\nFixes: 5ed4cecd75e9 (\"OPP: Pass OPP table to _of_add_opp_table_v{1|2}()\")\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/3e27c79c4b121a64e85f26ab8957e5d0a09ff28e"},{"sha":"36c3aeb4b48d5b058526d606fde14db4fd7e5e6d","author":{"name":"Rafael J. Wysocki","email":"27ffc44a8ec6a212fba98cfc3246c6ce8ab131e0@intel.com"},"message":"Merge branch 'opp/fixes-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm\n\nPull operating performance points (OPP) framework fixes for 4.20-rc5\nfrom Viresh Kumar.\n\n* 'opp/fixes-for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm:\n  OPP: Fix parsing of multiple phandles in \"operating-points-v2\" property\n  opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/36c3aeb4b48d5b058526d606fde14db4fd7e5e6d"},{"sha":"c4f784268210ae5e6749d4ba30d117bd301a70a6","author":{"name":"Rafael J. Wysocki","email":"27ffc44a8ec6a212fba98cfc3246c6ce8ab131e0@intel.com"},"message":"Merge branch 'acpica-fixes'\n\n* acpica-fixes:\n  ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field()","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/c4f784268210ae5e6749d4ba30d117bd301a70a6"},{"sha":"2f8406891fed8be5aa5f535b7b5c37bba3272b1a","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'pm-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix two issues in the operating performance points (OPP)\n  framework.\n\n  Specifics:\n\n   - Fix the handling of the \"operating-points-v2\" property to avoid\n     failures if multiple phandles are present in it which is legitimate\n     (Viresh Kumar).\n\n   - Drop the unnecessary static initialization of the .owner field in\n     the ti_opp_supply_driver structure (YueHaibing)\"\n\n* tag 'pm-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  OPP: Fix parsing of multiple phandles in \"operating-points-v2\" property\n  opp: ti-opp-supply: Fix platform_no_drv_owner.cocci warnings","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/2f8406891fed8be5aa5f535b7b5c37bba3272b1a"},{"sha":"94f371cb73944b410a269d570d6946c042f2ddd0","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'acpi-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"Fix a recent regression in ACPICA releted to the Generic Serial Bus\n  protocol handling and causing it to read or write too little or too\n  much data in some cases, so incorrect data may be written to hardware\n  as a result (Hans de Goede)\"\n\n* tag 'acpi-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  ACPICA: Fix handling of buffer-size in acpi_ex_write_data_to_field()","distinct":true,"url":"https://api.github.com/repos/uniphier/linux/commits/94f371cb73944b410a269d570d6946c042f2ddd0"}]}
{"actor":{"display_login":"masahir0y"}}