From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Ken Lin <ken.lin@advantech.com>,
Peter Rosin <peda@axentia.se>,
Jonathan Cameron <jic23@kernel.org>
Subject: [PATCH 4.4 61/91] iio: pressure: mpl3115: do not rely on structure field ordering
Date: Fri, 10 Mar 2017 10:09:00 +0100 [thread overview]
Message-ID: <20170310083903.830228128@linuxfoundation.org> (raw)
In-Reply-To: <20170310083900.730556986@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Rosin <peda@axentia.se>
commit 9cf6cdba586ced75c69b8314b88b2d2f5ce9b3ed upstream.
Fixes a regression triggered by a change in the layout of
struct iio_chan_spec, but the real bug is in the driver which assumed
a specific structure layout in the first place. Hint: the two bits were
not OR:ed together as implied by the indentation prior to this patch,
there was a comma between them, which accidentally moved the ..._SCALE
bit to the next structure field. That field was .info_mask_shared_by_type
before the _available attributes was added by commit 51239600074b
("iio:core: add a callback to allow drivers to provide _available
attributes") and .info_mask_separate_available afterwards, and the
regression happened.
info_mask_shared_by_type is actually a better choice than the originally
intended info_mask_separate for the ..._SCALE bit since a constant is
returned from mpl3115_read_raw for the scale. Using
info_mask_shared_by_type also preserves the behavior from before the
regression and is therefore less likely to cause other interesting side
effects.
The above mentioned regression causes an unintended sysfs attibute to
show up that is not backed by code, in turn causing the following NULL
pointer defererence to happen on access.
Segmentation fault
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = ecc3c000
[00000000] *pgd=87f91831
Internal error: Oops: 80000007 [#1] SMP ARM
Modules linked in:
CPU: 1 PID: 1051 Comm: cat Not tainted 4.10.0-rc5-00009-gffd8858-dirty #3
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
task: ed54ec00 task.stack: ee2bc000
PC is at 0x0
LR is at iio_read_channel_info_avail+0x40/0x280
pc : [<00000000>] lr : [<c06fbc1c>] psr: a0070013
sp : ee2bdda8 ip : 00000000 fp : ee2bddf4
r10: c0a53c74 r9 : ed79f000 r8 : ee8d1018
r7 : 00001000 r6 : 00000fff r5 : ee8b9a00 r4 : ed79f000
r3 : ee2bddc4 r2 : ee2bddbc r1 : c0a86dcc r0 : ee8d1000
Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 3cc3c04a DAC: 00000051
Process cat (pid: 1051, stack limit = 0xee2bc210)
Stack: (0xee2bdda8 to 0xee2be000)
dda0: ee2bddc0 00000002 c016d720 c016d394 ed54ec00 00000000
ddc0: 60070013 ed413780 00000001 edffd480 ee8b9a00 00000fff 00001000 ee8d1018
dde0: ed79f000 c0a53c74 ee2bde0c ee2bddf8 c0513c58 c06fbbe8 edffd480 edffd540
de00: ee2bde3c ee2bde10 c0293474 c0513c40 c02933e4 ee2bde60 00000001 ed413780
de20: 00000001 ed413780 00000000 edffd480 ee2bde4c ee2bde40 c0291d00 c02933f0
de40: ee2bde9c ee2bde50 c024679c c0291ce0 edffd4b0 b6e37000 00020000 ee2bdf78
de60: 00000000 00000000 ed54ec00 ed013200 00000817 c0a111fc edffd540 ed413780
de80: b6e37000 00020000 00020000 ee2bdf78 ee2bded4 ee2bdea0 c0292890 c0246604
dea0: c0117940 c016ba50 00000025 c0a111fc b6e37000 ed413780 ee2bdf78 00020000
dec0: ee2bc000 b6e37000 ee2bdf44 ee2bded8 c021d158 c0292770 c0117764 b6e36004
dee0: c0f0d7c4 ee2bdfb0 b6f89228 00021008 ee2bdfac ee2bdf00 c0101374 c0117770
df00: 00000000 00000000 ee2bc000 00000000 ee2bdf34 ee2bdf20 c016ba04 c0171080
df20: 00000000 00020000 ed413780 b6e37000 00000000 ee2bdf78 ee2bdf74 ee2bdf48
df40: c021e7a0 c021d130 c023e300 c023e280 ee2bdf74 00000000 00000000 ed413780
df60: ed413780 00020000 ee2bdfa4 ee2bdf78 c021e870 c021e71c 00000000 00000000
df80: 00020000 00020000 b6e37000 00000003 c0108084 00000000 00000000 ee2bdfa8
dfa0: c0107ee0 c021e838 00020000 00020000 00000003 b6e37000 00020000 0001a2b4
dfc0: 00020000 00020000 b6e37000 00000003 7fffe000 00000000 00000000 00020000
dfe0: 00000000 be98eb4c 0000c740 b6f1985c 60070010 00000003 00000000 00000000
Backtrace:
[<c06fbbdc>] (iio_read_channel_info_avail) from [<c0513c58>] (dev_attr_show+0x24/0x50)
r10:c0a53c74 r9:ed79f000 r8:ee8d1018 r7:00001000 r6:00000fff r5:ee8b9a00
r4:edffd480
[<c0513c34>] (dev_attr_show) from [<c0293474>] (sysfs_kf_seq_show+0x90/0x110)
r5:edffd540 r4:edffd480
[<c02933e4>] (sysfs_kf_seq_show) from [<c0291d00>] (kernfs_seq_show+0x2c/0x30)
r10:edffd480 r9:00000000 r8:ed413780 r7:00000001 r6:ed413780 r5:00000001
r4:ee2bde60 r3:c02933e4
[<c0291cd4>] (kernfs_seq_show) from [<c024679c>] (seq_read+0x1a4/0x4e0)
[<c02465f8>] (seq_read) from [<c0292890>] (kernfs_fop_read+0x12c/0x1cc)
r10:ee2bdf78 r9:00020000 r8:00020000 r7:b6e37000 r6:ed413780 r5:edffd540
r4:c0a111fc
[<c0292764>] (kernfs_fop_read) from [<c021d158>] (__vfs_read+0x34/0x118)
r10:b6e37000 r9:ee2bc000 r8:00020000 r7:ee2bdf78 r6:ed413780 r5:b6e37000
r4:c0a111fc
[<c021d124>] (__vfs_read) from [<c021e7a0>] (vfs_read+0x90/0x11c)
r8:ee2bdf78 r7:00000000 r6:b6e37000 r5:ed413780 r4:00020000
[<c021e710>] (vfs_read) from [<c021e870>] (SyS_read+0x44/0x90)
r8:00020000 r7:ed413780 r6:ed413780 r5:00000000 r4:00000000
[<c021e82c>] (SyS_read) from [<c0107ee0>] (ret_fast_syscall+0x0/0x1c)
r10:00000000 r8:c0108084 r7:00000003 r6:b6e37000 r5:00020000 r4:00020000
Code: bad PC value
---[ end trace 9c4938ccd0389004 ]---
Fixes: cc26ad455f57 ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Fixes: 51239600074b ("iio:core: add a callback to allow drivers to provide _available attributes")
Reported-by: Ken Lin <ken.lin@advantech.com>
Tested-by: Ken Lin <ken.lin@advantech.com>
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/mpl3115.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -182,7 +182,7 @@ static const struct iio_chan_spec mpl311
{
.type = IIO_PRESSURE,
.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
- BIT(IIO_CHAN_INFO_SCALE),
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
.scan_index = 0,
.scan_type = {
.sign = 'u',
@@ -195,7 +195,7 @@ static const struct iio_chan_spec mpl311
{
.type = IIO_TEMP,
.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
- BIT(IIO_CHAN_INFO_SCALE),
+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
.scan_index = 1,
.scan_type = {
.sign = 's',
next prev parent reply other threads:[~2017-03-10 9:15 UTC|newest]
Thread overview: 101+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-10 9:07 [PATCH 4.4 00/91] 4.4.53-stable review Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 01/91] MIPS: Fix special case in 64 bit IP checksumming Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 03/91] MIPS: OCTEON: Fix copy_from_user fault handling for large buffers Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 04/91] MIPS: Lantiq: Keep ethernet enabled during boot Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 05/91] MIPS: Clear ISA bit correctly in get_frame_info() Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 06/91] MIPS: Prevent unaligned accesses during stack unwinding Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 07/91] MIPS: Fix get_frame_info() handling of microMIPS function size Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 08/91] MIPS: Fix is_jump_ins() handling of 16b microMIPS instructions Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 09/91] MIPS: Calculate microMIPS ra properly when unwinding the stack Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 10/91] MIPS: Handle microMIPS jumps in the same way as MIPS32/MIPS64 jumps Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 11/91] [media] am437x-vpfe: always assign bpp variable Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 12/91] [media] uvcvideo: Fix a wrong macro Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 13/91] [media] media: fix dm1105.c build error Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 14/91] ARM: at91: define LPDDR types Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 15/91] ARM: dts: at91: Enable DMA on sama5d4_xplained console Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 16/91] ARM: dts: at91: Enable DMA on sama5d2_xplained console Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 17/91] ALSA: hda/realtek - Cannot adjust speakers volume on a Dell AIO Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 18/91] ALSA: hda - fix Lewisburg audio issue Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 19/91] ALSA: timer: Reject user params with too small ticks Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 20/91] ALSA: ctxfi: Fallback DMA mask to 32bit Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 21/91] ALSA: seq: Fix link corruption by event error handling Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 22/91] ALSA: hda - Add subwoofer support for Dell Inspiron 17 7000 Gaming Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 23/91] ALSA: hda - Fix micmute hotkey problem for a lenovo AIO machine Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 24/91] staging: rtl: fix possible NULL pointer dereference Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 25/91] regulator: Fix regulator_summary for deviceless consumers Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 26/91] iommu/vt-d: Fix some macros that are incorrectly specified in intel-iommu Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 27/91] iommu/vt-d: Tylersburg isoch identity map check is done too late Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 28/91] mm/page_alloc: fix nodes for reclaim in fast path Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 29/91] mm: vmpressure: fix sending wrong events on underflow Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 30/91] mm: do not access page->mapping directly on page_endio Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 31/91] ipc/shm: Fix shmat mmap nil-page protection Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 32/91] dm cache: fix corruption seen when using cache > 2TB Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 33/91] dm stats: fix a leaked s->histogram_boundaries array Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 34/91] scsi: storvsc: use tagged SRB requests if supported by the device Greg Kroah-Hartman
2017-03-10 14:56 ` Ben Hutchings
2017-03-10 15:21 ` Greg Kroah-Hartman
2017-03-10 15:29 ` KY Srinivasan
2017-03-10 9:08 ` [PATCH 4.4 35/91] scsi: storvsc: properly handle SRB_ERROR when sense message is present Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 36/91] scsi: storvsc: properly set residual data length on errors Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 37/91] scsi: aacraid: Reorder Adapter status check Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 38/91] scsi: use scsi_device_from_queue() for scsi_dh Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 39/91] sd: get disk reference in sd_check_events() Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 40/91] Fix: Disable sys_membarrier when nohz_full is enabled Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 41/91] jbd2: dont leak modified metadata buffers on an aborted journal Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 42/91] block/loop: fix race between I/O and set_status Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 43/91] loop: fix LO_FLAGS_PARTSCAN hang Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 44/91] ext4: Include forgotten start block on fallocate insert range Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 45/91] ext4: do not polute the extents cache while shifting extents Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 46/91] ext4: trim allocation requests to group size Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 47/91] ext4: fix data corruption in data=journal mode Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 48/91] ext4: fix inline data error paths Greg Kroah-Hartman
2017-03-10 16:48 ` Ben Hutchings
2017-03-12 5:22 ` Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 49/91] ext4: preserve the needs_recovery flag when the journal is aborted Greg Kroah-Hartman
2017-03-10 16:58 ` Ben Hutchings
2017-03-10 20:14 ` Theodore Ts'o
2017-03-11 5:27 ` Ben Hutchings
2017-03-10 9:08 ` [PATCH 4.4 50/91] ext4: return EROFS if device is r/o and journal replay is needed Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 52/91] target: Obtain se_node_acl->acl_kref during get_initiator_node_acl Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 53/91] target: Fix multi-session dynamic se_node_acl double free OOPs Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 54/91] ath5k: drop bogus warning on drv_set_key with unsupported cipher Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 55/91] ath9k: fix race condition in enabling/disabling IRQs Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 56/91] ath9k: use correct OTP register offsets for the AR9340 and AR9550 Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 57/91] crypto: testmgr - Pad aes_ccm_enc_tv_template vector Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 58/91] fuse: add missing FR_FORCE Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 59/91] arm/arm64: KVM: Enforce unconditional flush to PoC when mapping to stage-2 Greg Kroah-Hartman
2017-03-10 9:08 ` [PATCH 4.4 60/91] iio: pressure: mpl115: do not rely on structure field ordering Greg Kroah-Hartman
2017-03-10 9:09 ` Greg Kroah-Hartman [this message]
2017-03-10 9:09 ` [PATCH 4.4 62/91] can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 63/91] w1: dont leak refcount on slave attach failure in w1_attach_slave_device() Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 64/91] w1: ds2490: USB transfer buffers need to be DMAable Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 65/91] usb: musb: da8xx: Remove CPPI 3.0 quirk and methods Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 66/91] usb: host: xhci: plat: check hcc_params after add hcd Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 67/91] usb: gadget: udc: fsl: Add missing complete function Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 68/91] hv: allocate synic pages for all present CPUs Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 69/91] hv: init percpu_list in hv_synic_alloc() Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 70/91] Drivers: hv: util: kvp: Fix a rescind processing issue Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 71/91] Drivers: hv: util: Fcopy: " Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 72/91] Drivers: hv: util: Backup: " Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 73/91] RDMA/core: Fix incorrect structure packing for booleans Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 74/91] rdma_cm: fail iwarp accepts w/o connection params Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 75/91] gfs2: Add missing rcu locking for glock lookup Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 76/91] rtlwifi: Fix alignment issues Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 77/91] rtlwifi: rtl8192c-common: Fix "BUG: KASAN: Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 78/91] nfsd: minor nfsd_setattr cleanup Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 79/91] nfsd: special case truncates some more Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 80/91] NFSv4: Fix memory and state leak in _nfs4_open_and_get_state Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 81/91] NFSv4: fix getacl head length estimation Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 82/91] NFSv4: fix getacl ERANGE for some ACL buffer sizes Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 83/91] rtc: sun6i: Add some locking Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 84/91] rtc: sun6i: Switch to the external oscillator Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 85/91] md linear: fix a race between linear_add() and linear_congested() Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 87/91] dmaengine: ipu: Make sure the interrupt routine checks all interrupts Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 88/91] powerpc/xmon: Fix data-breakpoint Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 89/91] MIPS: IP22: Reformat inline assembler code to modern standards Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 90/91] MIPS: IP22: Fix build error due to binutils 2.25 uselessnes Greg Kroah-Hartman
2017-03-10 9:09 ` [PATCH 4.4 91/91] scsi: lpfc: Correct WQ creation for pagesize Greg Kroah-Hartman
2017-03-10 18:35 ` [PATCH 4.4 00/91] 4.4.53-stable review Guenter Roeck
2017-03-10 19:15 ` Shuah Khan
[not found] ` <58c2d01c.cdd8190a.421eb.b1d4@mx.google.com>
[not found] ` <m2pohoes9u.fsf@baylibre.com>
2017-03-13 8:56 ` Thomas Petazzoni
2017-03-14 17:08 ` Kevin Hilman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170310083903.830228128@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jic23@kernel.org \
--cc=ken.lin@advantech.com \
--cc=linux-kernel@vger.kernel.org \
--cc=peda@axentia.se \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).