* [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone
@ 2023-06-16 10:28 Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 2/8] ASoC: simple-card: Add missing of_node_put() in case of error Sasha Levin
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vineeth Vijayan, Peter Oberparleiter, Alexander Gordeev,
Sasha Levin, hca, gor, linux-s390
From: Vineeth Vijayan <vneethv@linux.ibm.com>
[ Upstream commit 89c0c62e947a01e7a36b54582fd9c9e346170255 ]
Currently, if the device is offline and all the channel paths are
either configured or varied offline, the associated subchannel gets
unregistered. Don't unregister the subchannel, instead unregister
offline device.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/cio/device.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 23e9227e60fd7..d7ca75efb49fb 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1385,6 +1385,7 @@ void ccw_device_set_notoper(struct ccw_device *cdev)
enum io_sch_action {
IO_SCH_UNREG,
IO_SCH_ORPH_UNREG,
+ IO_SCH_UNREG_CDEV,
IO_SCH_ATTACH,
IO_SCH_UNREG_ATTACH,
IO_SCH_ORPH_ATTACH,
@@ -1417,7 +1418,7 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
}
if ((sch->schib.pmcw.pam & sch->opm) == 0) {
if (ccw_device_notify(cdev, CIO_NO_PATH) != NOTIFY_OK)
- return IO_SCH_UNREG;
+ return IO_SCH_UNREG_CDEV;
return IO_SCH_DISC;
}
if (device_is_disconnected(cdev))
@@ -1479,6 +1480,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
case IO_SCH_ORPH_ATTACH:
ccw_device_set_disconnected(cdev);
break;
+ case IO_SCH_UNREG_CDEV:
case IO_SCH_UNREG_ATTACH:
case IO_SCH_UNREG:
if (!cdev)
@@ -1512,6 +1514,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
if (rc)
goto out;
break;
+ case IO_SCH_UNREG_CDEV:
case IO_SCH_UNREG_ATTACH:
spin_lock_irqsave(sch->lock, flags);
if (cdev->private->flags.resuming) {
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 2/8] ASoC: simple-card: Add missing of_node_put() in case of error
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 3/8] ASoC: nau8824: Add quirk to active-high jack-detect Sasha Levin
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Herve Codina, Kuninori Morimoto, Mark Brown, Sasha Levin,
lgirdwood, perex, tiwai, astrid.rost, aidanmacdonald.0x0,
alsa-devel
From: Herve Codina <herve.codina@bootlin.com>
[ Upstream commit 8938f75a5e35c597a647c28984a0304da7a33d63 ]
In the error path, a of_node_put() for platform is missing.
Just add it.
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/20230523151223.109551-9-herve.codina@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/generic/simple-card.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 4484c40c7a39c..653181d7eaa34 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -404,6 +404,7 @@ static int simple_for_each_link(struct asoc_simple_priv *priv,
if (ret < 0) {
of_node_put(codec);
+ of_node_put(plat);
of_node_put(np);
goto error;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 3/8] ASoC: nau8824: Add quirk to active-high jack-detect
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 2/8] ASoC: simple-card: Add missing of_node_put() in case of error Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 4/8] ARM: dts: Fix erroneous ADS touchscreen polarities Sasha Levin
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Edson Juliano Drosdeck, Mark Brown, Sasha Levin, lgirdwood, perex,
tiwai, savagecin, SJLIN0, ckeepax, alsa-devel
From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
[ Upstream commit e384dba03e3294ce7ea69e4da558e9bf8f0e8946 ]
Add entries for Positivo laptops: CW14Q01P, K1424G, N14ZP74G to the
DMI table, so that active-high jack-detect will work properly on
these laptops.
Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Link: https://lore.kernel.org/r/20230529181911.632851-1-edson.drosdeck@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/nau8824.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
index a95fe3fff1db8..9b22219a76937 100644
--- a/sound/soc/codecs/nau8824.c
+++ b/sound/soc/codecs/nau8824.c
@@ -1896,6 +1896,30 @@ static const struct dmi_system_id nau8824_quirk_table[] = {
},
.driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
},
+ {
+ /* Positivo CW14Q01P */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P"),
+ },
+ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
+ },
+ {
+ /* Positivo K1424G */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "K1424G"),
+ },
+ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
+ },
+ {
+ /* Positivo N14ZP74G */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_BOARD_NAME, "N14ZP74G"),
+ },
+ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
+ },
{}
};
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 4/8] ARM: dts: Fix erroneous ADS touchscreen polarities
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 2/8] ASoC: simple-card: Add missing of_node_put() in case of error Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 3/8] ASoC: nau8824: Add quirk to active-high jack-detect Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 5/8] drm/exynos: vidi: fix a wrong error return Sasha Levin
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Linus Walleij, Arnd Bergmann, Sasha Levin, bcousson, tony,
robh+dt, krzysztof.kozlowski+dt, conor+dt, nicolas.ferre,
alexandre.belloni, claudiu.beznea, shawnguo, linux-omap,
devicetree, linux-arm-kernel
From: Linus Walleij <linus.walleij@linaro.org>
[ Upstream commit 4a672d500bfd6bb87092c33d5a2572c3d0a1cf83 ]
Several device tree files get the polarity of the pendown-gpios
wrong: this signal is active low. Fix up all incorrect flags, so
that operating systems can rely on the flag being correctly set.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230510105156.1134320-1-linus.walleij@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/am57xx-cl-som-am57x.dts | 2 +-
arch/arm/boot/dts/at91sam9261ek.dts | 2 +-
arch/arm/boot/dts/imx7d-pico-hobbit.dts | 2 +-
arch/arm/boot/dts/imx7d-sdb.dts | 2 +-
arch/arm/boot/dts/omap3-cm-t3x.dtsi | 2 +-
arch/arm/boot/dts/omap3-devkit8000-lcd-common.dtsi | 2 +-
arch/arm/boot/dts/omap3-lilly-a83x.dtsi | 2 +-
arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi | 2 +-
arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi | 2 +-
arch/arm/boot/dts/omap3-pandora-common.dtsi | 2 +-
arch/arm/boot/dts/omap5-cm-t54.dts | 2 +-
11 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/arch/arm/boot/dts/am57xx-cl-som-am57x.dts b/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
index e86d4795e0244..e542a9f59e936 100644
--- a/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
+++ b/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
@@ -527,7 +527,7 @@ touchscreen@1 {
interrupt-parent = <&gpio1>;
interrupts = <31 0>;
- pendown-gpio = <&gpio1 31 0>;
+ pendown-gpio = <&gpio1 31 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <0x0>;
diff --git a/arch/arm/boot/dts/at91sam9261ek.dts b/arch/arm/boot/dts/at91sam9261ek.dts
index c4ef74fea97c2..ee90ea09e781f 100644
--- a/arch/arm/boot/dts/at91sam9261ek.dts
+++ b/arch/arm/boot/dts/at91sam9261ek.dts
@@ -156,7 +156,7 @@ tsc2046@2 {
compatible = "ti,ads7843";
interrupts-extended = <&pioC 2 IRQ_TYPE_EDGE_BOTH>;
spi-max-frequency = <3000000>;
- pendown-gpio = <&pioC 2 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&pioC 2 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <150>;
ti,x-max = /bits/ 16 <3830>;
diff --git a/arch/arm/boot/dts/imx7d-pico-hobbit.dts b/arch/arm/boot/dts/imx7d-pico-hobbit.dts
index d917dc4f2f227..6ad39dca70096 100644
--- a/arch/arm/boot/dts/imx7d-pico-hobbit.dts
+++ b/arch/arm/boot/dts/imx7d-pico-hobbit.dts
@@ -64,7 +64,7 @@ ads7846@0 {
interrupt-parent = <&gpio2>;
interrupts = <7 0>;
spi-max-frequency = <1000000>;
- pendown-gpio = <&gpio2 7 0>;
+ pendown-gpio = <&gpio2 7 GPIO_ACTIVE_LOW>;
vcc-supply = <®_3p3v>;
ti,x-min = /bits/ 16 <0>;
ti,x-max = /bits/ 16 <4095>;
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 363d1f57a608b..88e62801b82e1 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -176,7 +176,7 @@ tsc2046@0 {
pinctrl-0 = <&pinctrl_tsc2046_pendown>;
interrupt-parent = <&gpio2>;
interrupts = <29 0>;
- pendown-gpio = <&gpio2 29 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio2 29 GPIO_ACTIVE_LOW>;
touchscreen-max-pressure = <255>;
wakeup-source;
};
diff --git a/arch/arm/boot/dts/omap3-cm-t3x.dtsi b/arch/arm/boot/dts/omap3-cm-t3x.dtsi
index cdb632df152a1..11ae189441954 100644
--- a/arch/arm/boot/dts/omap3-cm-t3x.dtsi
+++ b/arch/arm/boot/dts/omap3-cm-t3x.dtsi
@@ -227,7 +227,7 @@ ads7846@0 {
interrupt-parent = <&gpio2>;
interrupts = <25 0>; /* gpio_57 */
- pendown-gpio = <&gpio2 25 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio2 25 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <0x0>;
ti,x-max = /bits/ 16 <0x0fff>;
diff --git a/arch/arm/boot/dts/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/omap3-devkit8000-lcd-common.dtsi
index 3decc2d78a6ca..a7f99ae0c1fe9 100644
--- a/arch/arm/boot/dts/omap3-devkit8000-lcd-common.dtsi
+++ b/arch/arm/boot/dts/omap3-devkit8000-lcd-common.dtsi
@@ -54,7 +54,7 @@ ads7846@0 {
interrupt-parent = <&gpio1>;
interrupts = <27 0>; /* gpio_27 */
- pendown-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio1 27 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <0x0>;
ti,x-max = /bits/ 16 <0x0fff>;
diff --git a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
index c22833d4e5685..fba69b3f79c2b 100644
--- a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
+++ b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
@@ -311,7 +311,7 @@ tsc2046@0 {
interrupt-parent = <&gpio1>;
interrupts = <8 0>; /* boot6 / gpio_8 */
spi-max-frequency = <1000000>;
- pendown-gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio1 8 GPIO_ACTIVE_LOW>;
vcc-supply = <®_vcc3>;
pinctrl-names = "default";
pinctrl-0 = <&tsc2048_pins>;
diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
index 185ce53de0ece..0523a369a4d75 100644
--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
@@ -149,7 +149,7 @@ ads7846@0 {
interrupt-parent = <&gpio4>;
interrupts = <18 0>; /* gpio_114 */
- pendown-gpio = <&gpio4 18 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio4 18 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <0x0>;
ti,x-max = /bits/ 16 <0x0fff>;
diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
index 7fe0f9148232b..d340eb722f129 100644
--- a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
@@ -160,7 +160,7 @@ ads7846@0 {
interrupt-parent = <&gpio4>;
interrupts = <18 0>; /* gpio_114 */
- pendown-gpio = <&gpio4 18 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio4 18 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <0x0>;
ti,x-max = /bits/ 16 <0x0fff>;
diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi
index 150d5be42d278..4ea5656825de7 100644
--- a/arch/arm/boot/dts/omap3-pandora-common.dtsi
+++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi
@@ -651,7 +651,7 @@ tsc2046@0 {
pinctrl-0 = <&penirq_pins>;
interrupt-parent = <&gpio3>;
interrupts = <30 IRQ_TYPE_NONE>; /* GPIO_94 */
- pendown-gpio = <&gpio3 30 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio3 30 GPIO_ACTIVE_LOW>;
vcc-supply = <&vaux4>;
ti,x-min = /bits/ 16 <0>;
diff --git a/arch/arm/boot/dts/omap5-cm-t54.dts b/arch/arm/boot/dts/omap5-cm-t54.dts
index e78d3718f145d..d38781025eef8 100644
--- a/arch/arm/boot/dts/omap5-cm-t54.dts
+++ b/arch/arm/boot/dts/omap5-cm-t54.dts
@@ -354,7 +354,7 @@ ads7846@0 {
interrupt-parent = <&gpio1>;
interrupts = <15 0>; /* gpio1_wk15 */
- pendown-gpio = <&gpio1 15 GPIO_ACTIVE_HIGH>;
+ pendown-gpio = <&gpio1 15 GPIO_ACTIVE_LOW>;
ti,x-min = /bits/ 16 <0x0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 5/8] drm/exynos: vidi: fix a wrong error return
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
` (2 preceding siblings ...)
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 4/8] ARM: dts: Fix erroneous ADS touchscreen polarities Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 6/8] drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl Sasha Levin
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Inki Dae, Andi Shyti, Sasha Levin, sw0312.kim, kyungmin.park,
airlied, daniel, krzysztof.kozlowski, dri-devel, linux-arm-kernel,
linux-samsung-soc
From: Inki Dae <inki.dae@samsung.com>
[ Upstream commit 4a059559809fd1ddbf16f847c4d2237309c08edf ]
Fix a wrong error return by dropping an error return.
When vidi driver is remvoed, if ctx->raw_edid isn't same as fake_edid_info
then only what we have to is to free ctx->raw_edid so that driver removing
can work correctly - it's not an error case.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_drm_vidi.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 65b891cb9c50b..d882a22dfd6e6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -483,8 +483,6 @@ static int vidi_remove(struct platform_device *pdev)
if (ctx->raw_edid != (struct edid *)fake_edid_info) {
kfree(ctx->raw_edid);
ctx->raw_edid = NULL;
-
- return -EINVAL;
}
component_del(&pdev->dev, &vidi_component_ops);
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 6/8] drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
` (3 preceding siblings ...)
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 5/8] drm/exynos: vidi: fix a wrong error return Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 7/8] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 8/8] ext4: only check dquot_initialize_needed() when debugging Sasha Levin
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Min Li, Andi Shyti, Inki Dae, Sasha Levin, sw0312.kim,
kyungmin.park, airlied, daniel, krzysztof.kozlowski, dri-devel,
linux-arm-kernel, linux-samsung-soc
From: Min Li <lm0963hack@gmail.com>
[ Upstream commit 48bfd02569f5db49cc033f259e66d57aa6efc9a3 ]
If it is async, runqueue_node is freed in g2d_runqueue_worker on another
worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and
then executes the following if statement, there will be use-after-free.
Signed-off-by: Min Li <lm0963hack@gmail.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_drm_g2d.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index fcee33a43aca3..2df04de7f4354 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1332,7 +1332,7 @@ int exynos_g2d_exec_ioctl(struct drm_device *drm_dev, void *data,
/* Let the runqueue know that there is work to do. */
queue_work(g2d->g2d_workq, &g2d->runqueue_work);
- if (runqueue_node->async)
+ if (req->async)
goto out;
wait_for_completion(&runqueue_node->complete);
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 7/8] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
` (4 preceding siblings ...)
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 6/8] drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 8/8] ext4: only check dquot_initialize_needed() when debugging Sasha Levin
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Min Li, Christian König, Alex Deucher, Sasha Levin,
Xinhui.Pan, airlied, daniel, amd-gfx, dri-devel
From: Min Li <lm0963hack@gmail.com>
[ Upstream commit 982b173a6c6d9472730c3116051977e05d17c8c5 ]
Userspace can race to free the gobj(robj converted from), robj should not
be accessed again after drm_gem_object_put, otherwith it will result in
use-after-free.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_gem.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index b2b076606f54b..e164b3c7a234f 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -384,7 +384,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
struct radeon_device *rdev = dev->dev_private;
struct drm_radeon_gem_set_domain *args = data;
struct drm_gem_object *gobj;
- struct radeon_bo *robj;
int r;
/* for now if someone requests domain CPU -
@@ -397,13 +396,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
up_read(&rdev->exclusive_lock);
return -ENOENT;
}
- robj = gem_to_radeon_bo(gobj);
r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain);
drm_gem_object_put_unlocked(gobj);
up_read(&rdev->exclusive_lock);
- r = radeon_gem_handle_lockup(robj->rdev, r);
+ r = radeon_gem_handle_lockup(rdev, r);
return r;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 5.4 8/8] ext4: only check dquot_initialize_needed() when debugging
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
` (5 preceding siblings ...)
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 7/8] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl Sasha Levin
@ 2023-06-16 10:28 ` Sasha Levin
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2023-06-16 10:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Theodore Ts'o, Sasha Levin, adilger.kernel, linux-ext4
From: Theodore Ts'o <tytso@mit.edu>
[ Upstream commit dea9d8f7643fab07bf89a1155f1f94f37d096a5e ]
ext4_xattr_block_set() relies on its caller to call dquot_initialize()
on the inode. To assure that this has happened there are WARN_ON
checks. Unfortunately, this is subject to false positives if there is
an antagonist thread which is flipping the file system at high rates
between r/o and rw. So only do the check if EXT4_XATTR_DEBUG is
enabled.
Link: https://lore.kernel.org/r/20230608044056.GA1418535@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/xattr.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 3440cddb5ffb8..79d13811c5be2 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -2016,8 +2016,9 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
else {
u32 ref;
+#ifdef EXT4_XATTR_DEBUG
WARN_ON_ONCE(dquot_initialize_needed(inode));
-
+#endif
/* The old block is released after updating
the inode. */
error = dquot_alloc_block(inode,
@@ -2079,8 +2080,9 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
/* We need to allocate a new block */
ext4_fsblk_t goal, block;
+#ifdef EXT4_XATTR_DEBUG
WARN_ON_ONCE(dquot_initialize_needed(inode));
-
+#endif
goal = ext4_group_first_block_no(sb,
EXT4_I(inode)->i_block_group);
block = ext4_new_meta_blocks(handle, inode, goal, 0,
--
2.39.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2023-06-16 10:42 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-16 10:28 [PATCH AUTOSEL 5.4 1/8] s390/cio: unregister device when the only path is gone Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 2/8] ASoC: simple-card: Add missing of_node_put() in case of error Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 3/8] ASoC: nau8824: Add quirk to active-high jack-detect Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 4/8] ARM: dts: Fix erroneous ADS touchscreen polarities Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 5/8] drm/exynos: vidi: fix a wrong error return Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 6/8] drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 7/8] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl Sasha Levin
2023-06-16 10:28 ` [PATCH AUTOSEL 5.4 8/8] ext4: only check dquot_initialize_needed() when debugging Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).