This is a note to let you know that I've just added the patch titled ARM: ux500: do not directly dereference __iomem to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: arm-ux500-do-not-directly-dereference-__iomem.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 65b0e307a1a9193571db12910f382f84195a3d29 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" <Jason@xxxxxxxxx> Date: Tue, 8 Nov 2022 13:37:55 +0100 Subject: ARM: ux500: do not directly dereference __iomem From: Jason A. Donenfeld <Jason@xxxxxxxxx> commit 65b0e307a1a9193571db12910f382f84195a3d29 upstream. Sparse reports that calling add_device_randomness() on `uid` is a violation of address spaces. And indeed the next usage uses readl() properly, but that was left out when passing it toadd_device_ randomness(). So instead copy the whole thing to the stack first. Fixes: 4040d10a3d44 ("ARM: ux500: add DB serial number to entropy pool") Cc: Linus Walleij <linus.walleij@xxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Link: https://lore.kernel.org/all/202210230819.loF90KDh-lkp@xxxxxxxxx/ Reported-by: kernel test robot <lkp@xxxxxxxxx> Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx> Link: https://lore.kernel.org/r/20221108123755.207438-1-Jason@xxxxxxxxx Signed-off-by: Linus Walleij <linus.walleij@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/soc/ux500/ux500-soc-id.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) --- a/drivers/soc/ux500/ux500-soc-id.c +++ b/drivers/soc/ux500/ux500-soc-id.c @@ -167,20 +167,18 @@ ATTRIBUTE_GROUPS(ux500_soc); static const char *db8500_read_soc_id(struct device_node *backupram) { void __iomem *base; - void __iomem *uid; const char *retstr; + u32 uid[5]; base = of_iomap(backupram, 0); if (!base) return NULL; - uid = base + 0x1fc0; + memcpy_fromio(uid, base + 0x1fc0, sizeof(uid)); /* Throw these device-specific numbers into the entropy pool */ - add_device_randomness(uid, 0x14); + add_device_randomness(uid, sizeof(uid)); retstr = kasprintf(GFP_KERNEL, "%08x%08x%08x%08x%08x", - readl((u32 *)uid+0), - readl((u32 *)uid+1), readl((u32 *)uid+2), - readl((u32 *)uid+3), readl((u32 *)uid+4)); + uid[0], uid[1], uid[2], uid[3], uid[4]); iounmap(base); return retstr; } Patches currently in stable-queue which might be from Jason@xxxxxxxxx are queue-6.1/random-add-helpers-for-random-numbers-with-given-floor-or-range.patch queue-6.1/arm-ux500-do-not-directly-dereference-__iomem.patch queue-6.1/media-stv0288-use-explicitly-signed-char.patch queue-6.1/random-use-rejection-sampling-for-uniform-bounded-random-integers.patch