* [PATCH AUTOSEL 6.6 02/11] media: vivid: avoid integer overflow
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 03/11] media: ipu-bridge: increase sensor_name size Sasha Levin
` (8 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans Verkuil, Arnd Bergmann, Sasha Levin, linux-media
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 4567ebf8e8f9546b373e78e3b7d584cc30b62028 ]
Fixes these compiler warnings:
drivers/media/test-drivers/vivid/vivid-rds-gen.c: In function 'vivid_rds_gen_fill':
drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:56: warning: '.' directive output may be truncated writing 1 byte into a region of size between 0 and 3 [-Wformat-truncation=]
147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
| ^
drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:52: note: directive argument in the range [0, 9]
147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
| ^~~~~~~~~
drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:9: note: 'snprintf' output between 9 and 12 bytes into a destination of size 9
147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
148 | freq / 16, ((freq & 0xf) * 10) / 16);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/test-drivers/vivid/vivid-rds-gen.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/test-drivers/vivid/vivid-rds-gen.c b/drivers/media/test-drivers/vivid/vivid-rds-gen.c
index b5b104ee64c99..c57771119a34b 100644
--- a/drivers/media/test-drivers/vivid/vivid-rds-gen.c
+++ b/drivers/media/test-drivers/vivid/vivid-rds-gen.c
@@ -145,7 +145,7 @@ void vivid_rds_gen_fill(struct vivid_rds_gen *rds, unsigned freq,
rds->ta = alt;
rds->ms = true;
snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
- freq / 16, ((freq & 0xf) * 10) / 16);
+ (freq / 16) % 1000000, (((freq & 0xf) * 10) / 16) % 10);
if (alt)
strscpy(rds->radiotext,
" The Radio Data System can switch between different Radio Texts ",
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 03/11] media: ipu-bridge: increase sensor_name size
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 02/11] media: vivid: avoid integer overflow Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 04/11] gfs2: ignore negated quota changes Sasha Levin
` (7 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans Verkuil, Arnd Bergmann, Sasha Levin, linux-media
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 83d0d4cc1423194b580356966107379490edd02e ]
Fixes this compiler warning:
In file included from include/linux/property.h:14,
from include/linux/acpi.h:16,
from drivers/media/pci/intel/ipu-bridge.c:4:
In function 'ipu_bridge_init_swnode_names',
inlined from 'ipu_bridge_create_connection_swnodes' at drivers/media/pci/intel/ipu-bridge.c:445:2,
inlined from 'ipu_bridge_connect_sensor' at drivers/media/pci/intel/ipu-bridge.c:656:3:
include/linux/fwnode.h:81:49: warning: '%u' directive output may be truncated writing between 1 and 3 bytes into a region of size 2 [-Wformat-truncation=]
81 | #define SWNODE_GRAPH_PORT_NAME_FMT "port@%u"
| ^~~~~~~~~
drivers/media/pci/intel/ipu-bridge.c:384:18: note: in expansion of macro 'SWNODE_GRAPH_PORT_NAME_FMT'
384 | SWNODE_GRAPH_PORT_NAME_FMT, sensor->link);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fwnode.h: In function 'ipu_bridge_connect_sensor':
include/linux/fwnode.h:81:55: note: format string is defined here
81 | #define SWNODE_GRAPH_PORT_NAME_FMT "port@%u"
| ^~
In function 'ipu_bridge_init_swnode_names',
inlined from 'ipu_bridge_create_connection_swnodes' at drivers/media/pci/intel/ipu-bridge.c:445:2,
inlined from 'ipu_bridge_connect_sensor' at drivers/media/pci/intel/ipu-bridge.c:656:3:
include/linux/fwnode.h:81:49: note: directive argument in the range [0, 255]
81 | #define SWNODE_GRAPH_PORT_NAME_FMT "port@%u"
| ^~~~~~~~~
drivers/media/pci/intel/ipu-bridge.c:384:18: note: in expansion of macro 'SWNODE_GRAPH_PORT_NAME_FMT'
384 | SWNODE_GRAPH_PORT_NAME_FMT, sensor->link);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/media/pci/intel/ipu-bridge.c:382:9: note: 'snprintf' output between 7 and 9 bytes into a destination of size 7
382 | snprintf(sensor->node_names.remote_port,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
383 | sizeof(sensor->node_names.remote_port),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
384 | SWNODE_GRAPH_PORT_NAME_FMT, sensor->link);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/media/ipu-bridge.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/media/ipu-bridge.h b/include/media/ipu-bridge.h
index bdc654a455216..783bda6d5cc3f 100644
--- a/include/media/ipu-bridge.h
+++ b/include/media/ipu-bridge.h
@@ -108,7 +108,7 @@ struct ipu_node_names {
char ivsc_sensor_port[7];
char ivsc_ipu_port[7];
char endpoint[11];
- char remote_port[7];
+ char remote_port[9];
char vcm[16];
};
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 04/11] gfs2: ignore negated quota changes
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 02/11] media: vivid: avoid integer overflow Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 03/11] media: ipu-bridge: increase sensor_name size Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 05/11] gfs2: fix an oops in gfs2_permission Sasha Levin
` (6 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bob Peterson, Andreas Gruenbacher, Sasha Levin, swhiteho,
cluster-devel
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit 4c6a08125f2249531ec01783a5f4317d7342add5 ]
When lots of quota changes are made, there may be cases in which an
inode's quota information is increased and then decreased, such as when
blocks are added to a file, then deleted from it. If the timing is
right, function do_qc can add pending quota changes to a transaction,
then later, another call to do_qc can negate those changes, resulting
in a net gain of 0. The quota_change information is recorded in the qc
buffer (and qd element of the inode as well). The buffer is added to the
transaction by the first call to do_qc, but a subsequent call changes
the value from non-zero back to zero. At that point it's too late to
remove the buffer_head from the transaction. Later, when the quota sync
code is called, the zero-change qd element is discovered and flagged as
an assert warning. If the fs is mounted with errors=panic, the kernel
will panic.
This is usually seen when files are truncated and the quota changes are
negated by punch_hole/truncate which uses gfs2_quota_hold and
gfs2_quota_unhold rather than block allocations that use gfs2_quota_lock
and gfs2_quota_unlock which automatically do quota sync.
This patch solves the problem by adding a check to qd_check_sync such
that net-zero quota changes already added to the transaction are no
longer deemed necessary to be synced, and skipped.
In this case references are taken for the qd and the slot from do_qc
so those need to be put. The normal sequence of events for a normal
non-zero quota change is as follows:
gfs2_quota_change
do_qc
qd_hold
slot_hold
Later, when the changes are to be synced:
gfs2_quota_sync
qd_fish
qd_check_sync
gets qd ref via lockref_get_not_dead
do_sync
do_qc(QC_SYNC)
qd_put
lockref_put_or_lock
qd_unlock
qd_put
lockref_put_or_lock
In the net-zero change case, we add a check to qd_check_sync so it puts
the qd and slot references acquired in gfs2_quota_change and skip the
unneeded sync.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/quota.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 171b2713d2e5e..41d0232532a03 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -457,6 +457,17 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
(sync_gen && (qd->qd_sync_gen >= *sync_gen)))
return 0;
+ /*
+ * If qd_change is 0 it means a pending quota change was negated.
+ * We should not sync it, but we still have a qd reference and slot
+ * reference taken by gfs2_quota_change -> do_qc that need to be put.
+ */
+ if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) {
+ slot_put(qd);
+ qd_put(qd);
+ return 0;
+ }
+
if (!lockref_get_not_dead(&qd->qd_lockref))
return 0;
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 05/11] gfs2: fix an oops in gfs2_permission
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (2 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 04/11] gfs2: ignore negated quota changes Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 06/11] media: cobalt: Use FIELD_GET() to extract Link Width Sasha Levin
` (5 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Al Viro, Andreas Gruenbacher, Sasha Levin, swhiteho, rpeterso,
cluster-devel
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 0abd1557e21c617bd13fc18f7725fc6363c05913 ]
In RCU mode, we might race with gfs2_evict_inode(), which zeroes
->i_gl. Freeing of the object it points to is RCU-delayed, so
if we manage to fetch the pointer before it's been replaced with
NULL, we are fine. Check if we'd fetched NULL and treat that
as "bail out and tell the caller to get out of RCU mode".
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/inode.c | 11 +++++++++--
fs/gfs2/super.c | 2 +-
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 0eac045079047..eb4bbe1728c06 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1868,14 +1868,21 @@ int gfs2_permission(struct mnt_idmap *idmap, struct inode *inode,
{
struct gfs2_inode *ip;
struct gfs2_holder i_gh;
+ struct gfs2_glock *gl;
int error;
gfs2_holder_mark_uninitialized(&i_gh);
ip = GFS2_I(inode);
- if (gfs2_glock_is_locked_by_me(ip->i_gl) == NULL) {
+ gl = rcu_dereference(ip->i_gl);
+ if (unlikely(!gl)) {
+ /* inode is getting torn down, must be RCU mode */
+ WARN_ON_ONCE(!(mask & MAY_NOT_BLOCK));
+ return -ECHILD;
+ }
+ if (gfs2_glock_is_locked_by_me(gl) == NULL) {
if (mask & MAY_NOT_BLOCK)
return -ECHILD;
- error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
+ error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
if (error)
return error;
}
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 02d93da21b2b0..0dd5641990b90 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1550,7 +1550,7 @@ static void gfs2_evict_inode(struct inode *inode)
wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE);
gfs2_glock_add_to_lru(ip->i_gl);
gfs2_glock_put_eventually(ip->i_gl);
- ip->i_gl = NULL;
+ rcu_assign_pointer(ip->i_gl, NULL);
}
}
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 06/11] media: cobalt: Use FIELD_GET() to extract Link Width
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (3 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 05/11] gfs2: fix an oops in gfs2_permission Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 07/11] media: ccs: Fix driver quirk struct documentation Sasha Levin
` (4 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilpo Järvinen, Jonathan Cameron, Hans Verkuil, Sasha Levin,
hans.verkuil, linux-media
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit f301fedbeecfdce91cb898d6fa5e62f269801fee ]
Use FIELD_GET() to extract PCIe Negotiated and Maximum Link Width fields
instead of custom masking and shifting.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cobalt/cobalt-driver.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c
index 74edcc76d12f4..6e1a0614e6d06 100644
--- a/drivers/media/pci/cobalt/cobalt-driver.c
+++ b/drivers/media/pci/cobalt/cobalt-driver.c
@@ -8,6 +8,7 @@
* All rights reserved.
*/
+#include <linux/bitfield.h>
#include <linux/delay.h>
#include <media/i2c/adv7604.h>
#include <media/i2c/adv7842.h>
@@ -210,17 +211,17 @@ void cobalt_pcie_status_show(struct cobalt *cobalt)
pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &stat);
cobalt_info("PCIe link capability 0x%08x: %s per lane and %u lanes\n",
capa, get_link_speed(capa),
- (capa & PCI_EXP_LNKCAP_MLW) >> 4);
+ FIELD_GET(PCI_EXP_LNKCAP_MLW, capa));
cobalt_info("PCIe link control 0x%04x\n", ctrl);
cobalt_info("PCIe link status 0x%04x: %s per lane and %u lanes\n",
stat, get_link_speed(stat),
- (stat & PCI_EXP_LNKSTA_NLW) >> 4);
+ FIELD_GET(PCI_EXP_LNKSTA_NLW, stat));
/* Bus */
pcie_capability_read_dword(pci_bus_dev, PCI_EXP_LNKCAP, &capa);
cobalt_info("PCIe bus link capability 0x%08x: %s per lane and %u lanes\n",
capa, get_link_speed(capa),
- (capa & PCI_EXP_LNKCAP_MLW) >> 4);
+ FIELD_GET(PCI_EXP_LNKCAP_MLW, capa));
/* Slot */
pcie_capability_read_dword(pci_dev, PCI_EXP_SLTCAP, &capa);
@@ -239,7 +240,7 @@ static unsigned pcie_link_get_lanes(struct cobalt *cobalt)
if (!pci_is_pcie(pci_dev))
return 0;
pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &link);
- return (link & PCI_EXP_LNKSTA_NLW) >> 4;
+ return FIELD_GET(PCI_EXP_LNKSTA_NLW, link);
}
static unsigned pcie_bus_link_get_lanes(struct cobalt *cobalt)
@@ -250,7 +251,7 @@ static unsigned pcie_bus_link_get_lanes(struct cobalt *cobalt)
if (!pci_is_pcie(pci_dev))
return 0;
pcie_capability_read_dword(pci_dev, PCI_EXP_LNKCAP, &link);
- return (link & PCI_EXP_LNKCAP_MLW) >> 4;
+ return FIELD_GET(PCI_EXP_LNKCAP_MLW, link);
}
static void msi_config_show(struct cobalt *cobalt, struct pci_dev *pci_dev)
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 07/11] media: ccs: Fix driver quirk struct documentation
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (4 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 06/11] media: cobalt: Use FIELD_GET() to extract Link Width Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 08/11] media: imon: fix access to invalid resource for the second interface Sasha Levin
` (3 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sakari Ailus, Laurent Pinchart, Hans Verkuil, Sasha Levin,
linux-media
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 441b5c63d71ec9ec5453328f7e83384ecc1dddd9 ]
Fix documentation for struct ccs_quirk, a device specific struct for
managing deviations from the standard. The flags field was drifted away
from where it should have been.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ccs/ccs-quirk.h | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/media/i2c/ccs/ccs-quirk.h b/drivers/media/i2c/ccs/ccs-quirk.h
index 5838fcda92fd4..0b1a64958d714 100644
--- a/drivers/media/i2c/ccs/ccs-quirk.h
+++ b/drivers/media/i2c/ccs/ccs-quirk.h
@@ -32,12 +32,10 @@ struct ccs_sensor;
* @reg: Pointer to the register to access
* @value: Register value, set by the caller on write, or
* by the quirk on read
- *
- * @flags: Quirk flags
- *
* @return: 0 on success, -ENOIOCTLCMD if no register
* access may be done by the caller (default read
* value is zero), else negative error code on error
+ * @flags: Quirk flags
*/
struct ccs_quirk {
int (*limits)(struct ccs_sensor *sensor);
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 08/11] media: imon: fix access to invalid resource for the second interface
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (5 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 07/11] media: ccs: Fix driver quirk struct documentation Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers Sasha Levin
` (2 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, syzbot+59875ffef5cb9c9b29e9, Ricardo B . Marliere,
Sean Young, Hans Verkuil, Sasha Levin, gautammenghani201,
linux-media
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit a1766a4fd83befa0b34d932d532e7ebb7fab1fa7 ]
imon driver probes two USB interfaces, and at the probe of the second
interface, the driver assumes blindly that the first interface got
bound with the same imon driver. It's usually true, but it's still
possible that the first interface is bound with another driver via a
malformed descriptor. Then it may lead to a memory corruption, as
spotted by syzkaller; imon driver accesses the data from drvdata as
struct imon_context object although it's a completely different one
that was assigned by another driver.
This patch adds a sanity check -- whether the first interface is
really bound with the imon driver or not -- for avoiding the problem
above at the probe time.
Reported-by: syzbot+59875ffef5cb9c9b29e9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000a838aa0603cc74d6@google.com/
Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
Link: https://lore.kernel.org/r/20230922005152.163640-1-ricardo@marliere.net
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/imon.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 74546f7e34691..5719dda6e0f0e 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -2427,6 +2427,12 @@ static int imon_probe(struct usb_interface *interface,
goto fail;
}
+ if (first_if->dev.driver != interface->dev.driver) {
+ dev_err(&interface->dev, "inconsistent driver matching\n");
+ ret = -EINVAL;
+ goto fail;
+ }
+
if (ifnum == 0) {
ictx = imon_init_intf0(interface, id);
if (!ictx) {
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (6 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 08/11] media: imon: fix access to invalid resource for the second interface Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 18:00 ` Alex Deucher
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 10/11] drm/amd/display: Avoid NULL dereference of timing generator Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 11/11] gfs2: Fix slab-use-after-free in gfs2_qd_dealloc Sasha Levin
9 siblings, 1 reply; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alex Deucher, Mario Limonciello, Christian König,
Sasha Levin, airlied, amd-gfx, dri-devel
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]
For pptable structs that use flexible array sizes, use flexible arrays.
Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
.../amd/pm/powerplay/hwmgr/vega10_pptable.h | 24 +++++++++----------
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 7a31cfa5e7fb4..df7cab1a571b3 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
typedef struct _ATOM_Tonga_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
- ATOM_Tonga_VCE_State_Record entries[1];
+ ATOM_Tonga_VCE_State_Record entries[];
} ATOM_Tonga_VCE_State_Table;
typedef struct _ATOM_Tonga_PowerTune_Table {
@@ -481,7 +481,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
typedef struct _ATOM_Tonga_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
- ATOM_Tonga_Hard_Limit_Record entries[1];
+ ATOM_Tonga_Hard_Limit_Record entries[];
} ATOM_Tonga_Hard_Limit_Table;
typedef struct _ATOM_Tonga_GPIO_Table {
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
index 8b0590b834cca..de2926df5ed74 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
typedef struct _ATOM_Vega10_State_Array {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
- ATOM_Vega10_State states[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_State states[]; /* Dynamically allocate entries. */
} ATOM_Vega10_State_Array;
typedef struct _ATOM_Vega10_CLK_Dependency_Record {
@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
- ATOM_Vega10_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_MCLK_Dependency_Table;
typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_SOCCLK_Dependency_Table;
typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_DCEFCLK_Dependency_Table;
typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_PIXCLK_Dependency_Table;
typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries.*/
- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_DISPCLK_Dependency_Table;
typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries. */
- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_PHYCLK_Dependency_Table;
typedef struct _ATOM_Vega10_MM_Dependency_Record {
@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
typedef struct _ATOM_Vega10_MM_Dependency_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries */
- ATOM_Vega10_MM_Dependency_Record entries[1]; /* Dynamically allocate entries */
+ ATOM_Vega10_MM_Dependency_Record entries[]; /* Dynamically allocate entries */
} ATOM_Vega10_MM_Dependency_Table;
typedef struct _ATOM_Vega10_PCIE_Record {
@@ -225,7 +225,7 @@ typedef struct _ATOM_Vega10_PCIE_Record {
typedef struct _ATOM_Vega10_PCIE_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries */
- ATOM_Vega10_PCIE_Record entries[1]; /* Dynamically allocate entries. */
+ ATOM_Vega10_PCIE_Record entries[]; /* Dynamically allocate entries. */
} ATOM_Vega10_PCIE_Table;
typedef struct _ATOM_Vega10_Voltage_Lookup_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Vega10_Voltage_Lookup_Record {
typedef struct _ATOM_Vega10_Voltage_Lookup_Table {
UCHAR ucRevId;
UCHAR ucNumEntries; /* Number of entries */
- ATOM_Vega10_Voltage_Lookup_Record entries[1]; /* Dynamically allocate entries */
+ ATOM_Vega10_Voltage_Lookup_Record entries[]; /* Dynamically allocate entries */
} ATOM_Vega10_Voltage_Lookup_Table;
typedef struct _ATOM_Vega10_Fan_Table {
@@ -327,7 +327,7 @@ typedef struct _ATOM_Vega10_VCE_State_Record {
typedef struct _ATOM_Vega10_VCE_State_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
- ATOM_Vega10_VCE_State_Record entries[1];
+ ATOM_Vega10_VCE_State_Record entries[];
} ATOM_Vega10_VCE_State_Table;
typedef struct _ATOM_Vega10_PowerTune_Table {
@@ -427,7 +427,7 @@ typedef struct _ATOM_Vega10_Hard_Limit_Record {
typedef struct _ATOM_Vega10_Hard_Limit_Table {
UCHAR ucRevId;
UCHAR ucNumEntries;
- ATOM_Vega10_Hard_Limit_Record entries[1];
+ ATOM_Vega10_Hard_Limit_Record entries[];
} ATOM_Vega10_Hard_Limit_Table;
typedef struct _Vega10_PPTable_Generic_SubTable_Header {
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers Sasha Levin
@ 2023-11-12 18:00 ` Alex Deucher
2023-11-12 18:51 ` Sasha Levin
0 siblings, 1 reply; 14+ messages in thread
From: Alex Deucher @ 2023-11-12 18:00 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, airlied, dri-devel, amd-gfx,
Mario Limonciello, Alex Deucher, Christian König
On Sun, Nov 12, 2023 at 8:27 AM Sasha Levin <sashal@kernel.org> wrote:
>
> From: Alex Deucher <alexander.deucher@amd.com>
>
> [ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]
>
> For pptable structs that use flexible array sizes, use flexible arrays.
>
> Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
> Acked-by: Christian König <christian.koenig@amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
I don't think any of these UBSAN flexible array changes are stable material.
Alex
> ---
> .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
> .../amd/pm/powerplay/hwmgr/vega10_pptable.h | 24 +++++++++----------
> 2 files changed, 14 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
> index 7a31cfa5e7fb4..df7cab1a571b3 100644
> --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
> +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
> @@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record {
> typedef struct _ATOM_Tonga_VCE_State_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries;
> - ATOM_Tonga_VCE_State_Record entries[1];
> + ATOM_Tonga_VCE_State_Record entries[];
> } ATOM_Tonga_VCE_State_Table;
>
> typedef struct _ATOM_Tonga_PowerTune_Table {
> @@ -481,7 +481,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record {
> typedef struct _ATOM_Tonga_Hard_Limit_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries;
> - ATOM_Tonga_Hard_Limit_Record entries[1];
> + ATOM_Tonga_Hard_Limit_Record entries[];
> } ATOM_Tonga_Hard_Limit_Table;
>
> typedef struct _ATOM_Tonga_GPIO_Table {
> diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
> index 8b0590b834cca..de2926df5ed74 100644
> --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
> +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h
> @@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State {
> typedef struct _ATOM_Vega10_State_Array {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries. */
> - ATOM_Vega10_State states[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_State states[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_State_Array;
>
> typedef struct _ATOM_Vega10_CLK_Dependency_Record {
> @@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table {
> typedef struct _ATOM_Vega10_MCLK_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries. */
> - ATOM_Vega10_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_MCLK_Dependency_Table;
>
> typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries. */
> - ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_SOCCLK_Dependency_Table;
>
> typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries. */
> - ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_DCEFCLK_Dependency_Table;
>
> typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries. */
> - ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_PIXCLK_Dependency_Table;
>
> typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries.*/
> - ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_DISPCLK_Dependency_Table;
>
> typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries. */
> - ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_PHYCLK_Dependency_Table;
>
> typedef struct _ATOM_Vega10_MM_Dependency_Record {
> @@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record {
> typedef struct _ATOM_Vega10_MM_Dependency_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries */
> - ATOM_Vega10_MM_Dependency_Record entries[1]; /* Dynamically allocate entries */
> + ATOM_Vega10_MM_Dependency_Record entries[]; /* Dynamically allocate entries */
> } ATOM_Vega10_MM_Dependency_Table;
>
> typedef struct _ATOM_Vega10_PCIE_Record {
> @@ -225,7 +225,7 @@ typedef struct _ATOM_Vega10_PCIE_Record {
> typedef struct _ATOM_Vega10_PCIE_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries */
> - ATOM_Vega10_PCIE_Record entries[1]; /* Dynamically allocate entries. */
> + ATOM_Vega10_PCIE_Record entries[]; /* Dynamically allocate entries. */
> } ATOM_Vega10_PCIE_Table;
>
> typedef struct _ATOM_Vega10_Voltage_Lookup_Record {
> @@ -235,7 +235,7 @@ typedef struct _ATOM_Vega10_Voltage_Lookup_Record {
> typedef struct _ATOM_Vega10_Voltage_Lookup_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries; /* Number of entries */
> - ATOM_Vega10_Voltage_Lookup_Record entries[1]; /* Dynamically allocate entries */
> + ATOM_Vega10_Voltage_Lookup_Record entries[]; /* Dynamically allocate entries */
> } ATOM_Vega10_Voltage_Lookup_Table;
>
> typedef struct _ATOM_Vega10_Fan_Table {
> @@ -327,7 +327,7 @@ typedef struct _ATOM_Vega10_VCE_State_Record {
> typedef struct _ATOM_Vega10_VCE_State_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries;
> - ATOM_Vega10_VCE_State_Record entries[1];
> + ATOM_Vega10_VCE_State_Record entries[];
> } ATOM_Vega10_VCE_State_Table;
>
> typedef struct _ATOM_Vega10_PowerTune_Table {
> @@ -427,7 +427,7 @@ typedef struct _ATOM_Vega10_Hard_Limit_Record {
> typedef struct _ATOM_Vega10_Hard_Limit_Table {
> UCHAR ucRevId;
> UCHAR ucNumEntries;
> - ATOM_Vega10_Hard_Limit_Record entries[1];
> + ATOM_Vega10_Hard_Limit_Record entries[];
> } ATOM_Vega10_Hard_Limit_Table;
>
> typedef struct _Vega10_PPTable_Generic_SubTable_Header {
> --
> 2.42.0
>
^ permalink raw reply [flat|nested] 14+ messages in thread* Re: [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers
2023-11-12 18:00 ` Alex Deucher
@ 2023-11-12 18:51 ` Sasha Levin
2023-11-14 9:31 ` Pavel Machek
0 siblings, 1 reply; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 18:51 UTC (permalink / raw)
To: Alex Deucher
Cc: linux-kernel, stable, airlied, dri-devel, amd-gfx,
Mario Limonciello, Alex Deucher, Christian König
On Sun, Nov 12, 2023 at 01:00:37PM -0500, Alex Deucher wrote:
>On Sun, Nov 12, 2023 at 8:27 AM Sasha Levin <sashal@kernel.org> wrote:
>>
>> From: Alex Deucher <alexander.deucher@amd.com>
>>
>> [ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]
>>
>> For pptable structs that use flexible array sizes, use flexible arrays.
>>
>> Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
>> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
>> Acked-by: Christian König <christian.koenig@amd.com>
>> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>
>I don't think any of these UBSAN flexible array changes are stable material.
I'll drop it, but in general we've been taking kasan/ubsan/kcsan/...
annotation fixes since it enables (easier) testing on the LTS trees, and
for example finding issues specific to those LTS trees.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers
2023-11-12 18:51 ` Sasha Levin
@ 2023-11-14 9:31 ` Pavel Machek
0 siblings, 0 replies; 14+ messages in thread
From: Pavel Machek @ 2023-11-14 9:31 UTC (permalink / raw)
To: Sasha Levin
Cc: Alex Deucher, linux-kernel, stable, airlied, dri-devel, amd-gfx,
Mario Limonciello, Alex Deucher, Christian König
[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]
Hi!
> > > From: Alex Deucher <alexander.deucher@amd.com>
> > >
> > > [ Upstream commit 49afe91370b86566857a3c2c39612cf098110885 ]
> > >
> > > For pptable structs that use flexible array sizes, use flexible arrays.
> > >
> > > Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926
> > > Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
> > > Acked-by: Christian König <christian.koenig@amd.com>
> > > Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> >
> > I don't think any of these UBSAN flexible array changes are stable material.
>
> I'll drop it, but in general we've been taking kasan/ubsan/kcsan/...
> annotation fixes since it enables (easier) testing on the LTS trees, and
> for example finding issues specific to those LTS trees.
I believe they should not be in stable, either.
In any case, Documentation/process/stable-kernel-rules.rst should be
updated, because it contradicts current practice.
Best regards,
Pavel
--
People of Russia, stop Putin before his war on Ukraine escalates.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH AUTOSEL 6.6 10/11] drm/amd/display: Avoid NULL dereference of timing generator
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (7 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 09/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay headers Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 11/11] gfs2: Fix slab-use-after-free in gfs2_qd_dealloc Sasha Levin
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wayne Lin, Jun Lei, Hersen Wu, Daniel Wheeler, Alex Deucher,
Sasha Levin, christian.koenig, airlied, amd-gfx, dri-devel
From: Wayne Lin <wayne.lin@amd.com>
[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]
[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.
Reviewed-by: Jun Lei <jun.lei@amd.com>
Acked-by: Hersen Wu <hersenxs.wu@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 01fe2d2fd2417..ebe571fcefe32 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -582,7 +582,7 @@ uint32_t dc_stream_get_vblank_counter(const struct dc_stream_state *stream)
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
- if (res_ctx->pipe_ctx[i].stream != stream)
+ if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
return tg->funcs->get_frame_count(tg);
@@ -641,7 +641,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state *stream,
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
- if (res_ctx->pipe_ctx[i].stream != stream)
+ if (res_ctx->pipe_ctx[i].stream != stream || !tg)
continue;
tg->funcs->get_scanoutpos(tg,
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [PATCH AUTOSEL 6.6 11/11] gfs2: Fix slab-use-after-free in gfs2_qd_dealloc
2023-11-12 13:27 [PATCH AUTOSEL 6.6 01/11] media: gspca: cpia1: shift-out-of-bounds in set_flicker Sasha Levin
` (8 preceding siblings ...)
2023-11-12 13:27 ` [PATCH AUTOSEL 6.6 10/11] drm/amd/display: Avoid NULL dereference of timing generator Sasha Levin
@ 2023-11-12 13:27 ` Sasha Levin
9 siblings, 0 replies; 14+ messages in thread
From: Sasha Levin @ 2023-11-12 13:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Juntong Deng, syzbot+29c47e9e51895928698c, Andreas Gruenbacher,
Sasha Levin, swhiteho, rpeterso, cluster-devel
From: Juntong Deng <juntong.deng@outlook.com>
[ Upstream commit bdcb8aa434c6d36b5c215d02a9ef07551be25a37 ]
In gfs2_put_super(), whether withdrawn or not, the quota should
be cleaned up by gfs2_quota_cleanup().
Otherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu
callback) has run for all gfs2_quota_data objects, resulting in
use-after-free.
Also, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called
by gfs2_make_fs_ro(), so in gfs2_put_super(), after calling
gfs2_make_fs_ro(), there is no need to call them again.
Reported-by: syzbot+29c47e9e51895928698c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=29c47e9e51895928698c
Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/super.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 0dd5641990b90..5f4ebe279aaae 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -602,13 +602,15 @@ static void gfs2_put_super(struct super_block *sb)
}
spin_unlock(&sdp->sd_jindex_spin);
- if (!sb_rdonly(sb)) {
+ if (!sb_rdonly(sb))
gfs2_make_fs_ro(sdp);
- }
- if (gfs2_withdrawn(sdp)) {
- gfs2_destroy_threads(sdp);
+ else {
+ if (gfs2_withdrawn(sdp))
+ gfs2_destroy_threads(sdp);
+
gfs2_quota_cleanup(sdp);
}
+
WARN_ON(gfs2_withdrawing(sdp));
/* At this point, we're through modifying the disk */
--
2.42.0
^ permalink raw reply related [flat|nested] 14+ messages in thread