* [PATCH AUTOSEL 5.15 02/19] media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 03/19] media: af9005: Fix null-ptr-deref in af9005_i2c_xfer Sasha Levin
` (16 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Shurong, Hans Verkuil, Sasha Levin, mchehab, yuzhe,
harperchen1110, linux-media
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit 5ae544d94abc8ff77b1b9bf8774def3fa5689b5b ]
In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach dw2102_i2c_transfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 950e252cb469
("[media] dw2102: limit messages to buffer size")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/dw2102.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 1ed62a80067c6..253d13bdb63e5 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -128,6 +128,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
switch (num) {
case 2:
+ if (msg[0].len < 1) {
+ num = -EOPNOTSUPP;
+ break;
+ }
/* read stv0299 register */
value = msg[0].buf[0];/* register */
for (i = 0; i < msg[1].len; i++) {
@@ -139,6 +143,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
case 1:
switch (msg[0].addr) {
case 0x68:
+ if (msg[0].len < 2) {
+ num = -EOPNOTSUPP;
+ break;
+ }
/* write to stv0299 register */
buf6[0] = 0x2a;
buf6[1] = msg[0].buf[0];
@@ -148,6 +156,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
break;
case 0x60:
if (msg[0].flags == 0) {
+ if (msg[0].len < 4) {
+ num = -EOPNOTSUPP;
+ break;
+ }
/* write to tuner pll */
buf6[0] = 0x2c;
buf6[1] = 5;
@@ -159,6 +171,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
dw210x_op_rw(d->udev, 0xb2, 0, 0,
buf6, 7, DW210X_WRITE_MSG);
} else {
+ if (msg[0].len < 1) {
+ num = -EOPNOTSUPP;
+ break;
+ }
/* read from tuner */
dw210x_op_rw(d->udev, 0xb5, 0, 0,
buf6, 1, DW210X_READ_MSG);
@@ -166,12 +182,20 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
}
break;
case (DW2102_RC_QUERY):
+ if (msg[0].len < 2) {
+ num = -EOPNOTSUPP;
+ break;
+ }
dw210x_op_rw(d->udev, 0xb8, 0, 0,
buf6, 2, DW210X_READ_MSG);
msg[0].buf[0] = buf6[0];
msg[0].buf[1] = buf6[1];
break;
case (DW2102_VOLTAGE_CTRL):
+ if (msg[0].len < 1) {
+ num = -EOPNOTSUPP;
+ break;
+ }
buf6[0] = 0x30;
buf6[1] = msg[0].buf[0];
dw210x_op_rw(d->udev, 0xb2, 0, 0,
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 03/19] media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 02/19] media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 04/19] media: anysee: fix null-ptr-deref in anysee_master_xfer Sasha Levin
` (15 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Shurong, Hans Verkuil, Sasha Levin, mchehab, linux-media
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit f4ee84f27625ce1fdf41e8483fa0561a1b837d10 ]
In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9005_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/af9005.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
index b6a2436d16e97..9af54fcbed1de 100644
--- a/drivers/media/usb/dvb-usb/af9005.c
+++ b/drivers/media/usb/dvb-usb/af9005.c
@@ -422,6 +422,10 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
if (ret == 0)
ret = 2;
} else {
+ if (msg[0].len < 2) {
+ ret = -EOPNOTSUPP;
+ goto unlock;
+ }
/* write one or more registers */
reg = msg[0].buf[0];
addr = msg[0].addr;
@@ -431,6 +435,7 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
ret = 1;
}
+unlock:
mutex_unlock(&d->i2c_mutex);
return ret;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 04/19] media: anysee: fix null-ptr-deref in anysee_master_xfer
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 02/19] media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 03/19] media: af9005: Fix null-ptr-deref in af9005_i2c_xfer Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 05/19] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() Sasha Levin
` (14 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Shurong, Hans Verkuil, Sasha Levin, crope, mchehab,
linux-media
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit c30411266fd67ea3c02a05c157231654d5a3bdc9 ]
In anysee_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach anysee_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: add spaces around +]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/anysee.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/anysee.c b/drivers/media/usb/dvb-usb-v2/anysee.c
index aa45b5d263f6b..a1235d0cce92f 100644
--- a/drivers/media/usb/dvb-usb-v2/anysee.c
+++ b/drivers/media/usb/dvb-usb-v2/anysee.c
@@ -202,7 +202,7 @@ static int anysee_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
while (i < num) {
if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
- if (msg[i].len > 2 || msg[i+1].len > 60) {
+ if (msg[i].len != 2 || msg[i + 1].len > 60) {
ret = -EOPNOTSUPP;
break;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 05/19] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (2 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 04/19] media: anysee: fix null-ptr-deref in anysee_master_xfer Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 06/19] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer Sasha Levin
` (13 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Shurong, Hans Verkuil, Sasha Levin, mchehab, linux-media
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit 1047f9343011f2cedc73c64829686206a7e9fc3f ]
In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach az6007_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/az6007.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
index 7524c90f5da61..6cbfe75791c21 100644
--- a/drivers/media/usb/dvb-usb-v2/az6007.c
+++ b/drivers/media/usb/dvb-usb-v2/az6007.c
@@ -788,6 +788,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
if (az6007_xfer_debug)
printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n",
addr, msgs[i].len);
+ if (msgs[i].len < 1) {
+ ret = -EIO;
+ goto err;
+ }
req = AZ6007_I2C_WR;
index = msgs[i].buf[0];
value = addr | (1 << 8);
@@ -802,6 +806,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
if (az6007_xfer_debug)
printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n",
addr, msgs[i].len);
+ if (msgs[i].len < 1) {
+ ret = -EIO;
+ goto err;
+ }
req = AZ6007_I2C_RD;
index = msgs[i].buf[0];
value = addr;
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 06/19] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (3 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 05/19] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 07/19] iio: core: Use min() instead of min_t() to make code more robust Sasha Levin
` (12 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Shurong, Hans Verkuil, Sasha Levin, crope, mchehab,
linux-media
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit b97719a66970601cd3151a3e2020f4454a1c4ff6 ]
In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/gl861.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/gl861.c b/drivers/media/usb/dvb-usb-v2/gl861.c
index 0c434259c36f1..c71e7b93476de 100644
--- a/drivers/media/usb/dvb-usb-v2/gl861.c
+++ b/drivers/media/usb/dvb-usb-v2/gl861.c
@@ -120,7 +120,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
} else if (num == 2 && !(msg[0].flags & I2C_M_RD) &&
(msg[1].flags & I2C_M_RD)) {
/* I2C write + read */
- if (msg[0].len > 1 || msg[1].len > sizeof(ctx->buf)) {
+ if (msg[0].len != 1 || msg[1].len > sizeof(ctx->buf)) {
ret = -EOPNOTSUPP;
goto err;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 07/19] iio: core: Use min() instead of min_t() to make code more robust
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (4 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 06/19] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 08/19] media: tuners: qt1010: replace BUG_ON with a regular error Sasha Levin
` (11 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Andy Shevchenko, Nuno Sa, Jonathan Cameron, Sasha Levin, jic23,
linux-iio
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit cb1d17535061ca295903f97f5cb0af9db719c02c ]
min() has strict type checking and preferred over min_t() for
unsigned types to avoid overflow. Here it's unclear why min_t()
was chosen since both variables are of the same type. In any
case update to use min().
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20230721170022.3461-5-andriy.shevchenko@linux.intel.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/industrialio-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index a7f5d432c95d9..c374e5fe94f3c 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -418,7 +418,7 @@ static ssize_t iio_debugfs_write_reg(struct file *file,
char buf[80];
int ret;
- count = min_t(size_t, count, (sizeof(buf)-1));
+ count = min(count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT;
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 08/19] media: tuners: qt1010: replace BUG_ON with a regular error
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (5 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 07/19] iio: core: Use min() instead of min_t() to make code more robust Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 09/19] media: pci: cx23885: replace BUG with error return Sasha Levin
` (10 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans Verkuil, Sasha Levin, crope, mchehab, linux-media
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit ee630b29ea44d1851bb6c903f400956604834463 ]
BUG_ON is unnecessary here, and in addition it confuses smatch.
Replacing this with an error return help resolve this smatch
warning:
drivers/media/tuners/qt1010.c:350 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/tuners/qt1010.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
index 3853a3d43d4f2..a7b19863f489e 100644
--- a/drivers/media/tuners/qt1010.c
+++ b/drivers/media/tuners/qt1010.c
@@ -345,11 +345,12 @@ static int qt1010_init(struct dvb_frontend *fe)
else
valptr = &tmpval;
- BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);
-
- err = qt1010_init_meas1(priv, i2c_data[i+1].reg,
- i2c_data[i].reg,
- i2c_data[i].val, valptr);
+ if (i >= ARRAY_SIZE(i2c_data) - 1)
+ err = -EIO;
+ else
+ err = qt1010_init_meas1(priv, i2c_data[i + 1].reg,
+ i2c_data[i].reg,
+ i2c_data[i].val, valptr);
i++;
break;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 09/19] media: pci: cx23885: replace BUG with error return
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (6 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 08/19] media: tuners: qt1010: replace BUG_ON with a regular error Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 10/19] usb: cdns3: Put the cdns set active part outside the spin lock Sasha Levin
` (9 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans Verkuil, Sasha Levin, mchehab, harperchen1110, linux-media
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 2e1796fd4904fdd6062a8e4589778ea899ea0c8d ]
It was completely unnecessary to use BUG in buffer_prepare().
Just replace it with an error return. This also fixes a smatch warning:
drivers/media/pci/cx23885/cx23885-video.c:422 buffer_prepare() error: uninitialized symbol 'ret'.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx23885/cx23885-video.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
index b01499f810697..6851e01da1c5b 100644
--- a/drivers/media/pci/cx23885/cx23885-video.c
+++ b/drivers/media/pci/cx23885/cx23885-video.c
@@ -413,7 +413,7 @@ static int buffer_prepare(struct vb2_buffer *vb)
dev->height >> 1);
break;
default:
- BUG();
+ return -EINVAL; /* should not happen */
}
dprintk(2, "[%p/%d] buffer_init - %dx%d %dbpp 0x%08x - dma=0x%08lx\n",
buf, buf->vb.vb2_buf.index,
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 10/19] usb: cdns3: Put the cdns set active part outside the spin lock
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (7 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 09/19] media: pci: cx23885: replace BUG with error return Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-11 10:00 ` Pavel Machek
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 11/19] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc Sasha Levin
` (8 subsequent siblings)
17 siblings, 1 reply; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xiaolei Wang, Peter Chen, Greg Kroah-Hartman, Sasha Levin, pawell,
linux-usb
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit 2319b9c87fe243327285f2fefd7374ffd75a65fc ]
The device may be scheduled during the resume process,
so this cannot appear in atomic operations. Since
pm_runtime_set_active will resume suppliers, put set
active outside the spin lock, which is only used to
protect the struct cdns data structure, otherwise the
kernel will report the following warning:
BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 PID: 651 Comm: sh Tainted: G WC 6.1.20 #1
Hardware name: Freescale i.MX8QM MEK (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x30
dump_stack_lvl+0x64/0x80
dump_stack+0x1c/0x38
__might_resched+0x1fc/0x240
__might_sleep+0x68/0xc0
__pm_runtime_resume+0x9c/0xe0
rpm_get_suppliers+0x68/0x1b0
__pm_runtime_set_status+0x298/0x560
cdns_resume+0xb0/0x1c0
cdns3_controller_resume.isra.0+0x1e0/0x250
cdns3_plat_resume+0x28/0x40
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20230616021952.1025854-1-xiaolei.wang@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/cdns3/cdns3-plat.c | 3 ++-
drivers/usb/cdns3/cdnsp-pci.c | 3 ++-
drivers/usb/cdns3/core.c | 15 +++++++++++----
drivers/usb/cdns3/core.h | 7 +++++--
4 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/cdns3/cdns3-plat.c b/drivers/usb/cdns3/cdns3-plat.c
index 4d0f027e5bd3a..9cb647203dcf2 100644
--- a/drivers/usb/cdns3/cdns3-plat.c
+++ b/drivers/usb/cdns3/cdns3-plat.c
@@ -256,9 +256,10 @@ static int cdns3_controller_resume(struct device *dev, pm_message_t msg)
cdns3_set_platform_suspend(cdns->dev, false, false);
spin_lock_irqsave(&cdns->lock, flags);
- cdns_resume(cdns, !PMSG_IS_AUTO(msg));
+ cdns_resume(cdns);
cdns->in_lpm = false;
spin_unlock_irqrestore(&cdns->lock, flags);
+ cdns_set_active(cdns, !PMSG_IS_AUTO(msg));
if (cdns->wakeup_pending) {
cdns->wakeup_pending = false;
enable_irq(cdns->wakeup_irq);
diff --git a/drivers/usb/cdns3/cdnsp-pci.c b/drivers/usb/cdns3/cdnsp-pci.c
index 29f433c5a6f3f..a85db23fa19f2 100644
--- a/drivers/usb/cdns3/cdnsp-pci.c
+++ b/drivers/usb/cdns3/cdnsp-pci.c
@@ -210,8 +210,9 @@ static int __maybe_unused cdnsp_pci_resume(struct device *dev)
int ret;
spin_lock_irqsave(&cdns->lock, flags);
- ret = cdns_resume(cdns, 1);
+ ret = cdns_resume(cdns);
spin_unlock_irqrestore(&cdns->lock, flags);
+ cdns_set_active(cdns, 1);
return ret;
}
diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c
index dbcdf3b24b477..7b20d2d5c262e 100644
--- a/drivers/usb/cdns3/core.c
+++ b/drivers/usb/cdns3/core.c
@@ -522,9 +522,8 @@ int cdns_suspend(struct cdns *cdns)
}
EXPORT_SYMBOL_GPL(cdns_suspend);
-int cdns_resume(struct cdns *cdns, u8 set_active)
+int cdns_resume(struct cdns *cdns)
{
- struct device *dev = cdns->dev;
enum usb_role real_role;
bool role_changed = false;
int ret = 0;
@@ -556,15 +555,23 @@ int cdns_resume(struct cdns *cdns, u8 set_active)
if (cdns->roles[cdns->role]->resume)
cdns->roles[cdns->role]->resume(cdns, cdns_power_is_lost(cdns));
+ return 0;
+}
+EXPORT_SYMBOL_GPL(cdns_resume);
+
+void cdns_set_active(struct cdns *cdns, u8 set_active)
+{
+ struct device *dev = cdns->dev;
+
if (set_active) {
pm_runtime_disable(dev);
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
}
- return 0;
+ return;
}
-EXPORT_SYMBOL_GPL(cdns_resume);
+EXPORT_SYMBOL_GPL(cdns_set_active);
#endif /* CONFIG_PM_SLEEP */
MODULE_AUTHOR("Peter Chen <peter.chen@nxp.com>");
diff --git a/drivers/usb/cdns3/core.h b/drivers/usb/cdns3/core.h
index ab0cb68acd239..1b6631cdf5dec 100644
--- a/drivers/usb/cdns3/core.h
+++ b/drivers/usb/cdns3/core.h
@@ -125,10 +125,13 @@ int cdns_init(struct cdns *cdns);
int cdns_remove(struct cdns *cdns);
#ifdef CONFIG_PM_SLEEP
-int cdns_resume(struct cdns *cdns, u8 set_active);
+int cdns_resume(struct cdns *cdns);
int cdns_suspend(struct cdns *cdns);
+void cdns_set_active(struct cdns *cdns, u8 set_active);
#else /* CONFIG_PM_SLEEP */
-static inline int cdns_resume(struct cdns *cdns, u8 set_active)
+static inline int cdns_resume(struct cdns *cdns)
+{ return 0; }
+static inline int cdns_set_active(struct cdns *cdns, u8 set_active)
{ return 0; }
static inline int cdns_suspend(struct cdns *cdns)
{ return 0; }
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH AUTOSEL 5.15 10/19] usb: cdns3: Put the cdns set active part outside the spin lock
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 10/19] usb: cdns3: Put the cdns set active part outside the spin lock Sasha Levin
@ 2023-09-11 10:00 ` Pavel Machek
2023-09-12 2:39 ` wangxiaolei
0 siblings, 1 reply; 22+ messages in thread
From: Pavel Machek @ 2023-09-11 10:00 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, Xiaolei Wang, Peter Chen,
Greg Kroah-Hartman, pawell, linux-usb
[-- Attachment #1: Type: text/plain, Size: 1635 bytes --]
Hi!
> From: Xiaolei Wang <xiaolei.wang@windriver.com>
>
> [ Upstream commit 2319b9c87fe243327285f2fefd7374ffd75a65fc ]
>
> The device may be scheduled during the resume process,
> so this cannot appear in atomic operations. Since
> pm_runtime_set_active will resume suppliers, put set
> active outside the spin lock, which is only used to
> protect the struct cdns data structure, otherwise the
> kernel will report the following warning:
There's something wrong with this patch: cdns_set_active returns
either void or int depending on config. That can't be intentional.
Best regards,
Pavel
> +++ b/drivers/usb/cdns3/core.c
> @@ -556,15 +555,23 @@ int cdns_resume(struct cdns *cdns, u8 set_active)
...
> +
> +void cdns_set_active(struct cdns *cdns, u8 set_active)
> +{
> + struct device *dev = cdns->dev;
> +
> if (set_active) {
> pm_runtime_disable(dev);
> pm_runtime_set_active(dev);
> pm_runtime_enable(dev);
> }
>
> - return 0;
> + return;
> }
> +++ b/drivers/usb/cdns3/core.h
> @@ -125,10 +125,13 @@ int cdns_init(struct cdns *cdns);
> int cdns_remove(struct cdns *cdns);
>
> #ifdef CONFIG_PM_SLEEP
...
> int cdns_suspend(struct cdns *cdns);
> +void cdns_set_active(struct cdns *cdns, u8 set_active);
> #else /* CONFIG_PM_SLEEP */
...
> +static inline int cdns_set_active(struct cdns *cdns, u8 set_active)
> { return 0; }
> static inline int cdns_suspend(struct cdns *cdns)
> { return 0; }
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH AUTOSEL 5.15 10/19] usb: cdns3: Put the cdns set active part outside the spin lock
2023-09-11 10:00 ` Pavel Machek
@ 2023-09-12 2:39 ` wangxiaolei
0 siblings, 0 replies; 22+ messages in thread
From: wangxiaolei @ 2023-09-12 2:39 UTC (permalink / raw)
To: Pavel Machek, Sasha Levin
Cc: linux-kernel, stable, Peter Chen, Greg Kroah-Hartman, pawell,
linux-usb
On 9/11/23 6:00 PM, Pavel Machek wrote:
> Hi!
>
>> From: Xiaolei Wang <xiaolei.wang@windriver.com>
>>
>> [ Upstream commit 2319b9c87fe243327285f2fefd7374ffd75a65fc ]
>>
>> The device may be scheduled during the resume process,
>> so this cannot appear in atomic operations. Since
>> pm_runtime_set_active will resume suppliers, put set
>> active outside the spin lock, which is only used to
>> protect the struct cdns data structure, otherwise the
>> kernel will report the following warning:
> There's something wrong with this patch: cdns_set_active returns
> either void or int depending on config. That can't be intentional.
Thanks for the reminder, I will send a new patch to fix this problem
thanks
xiaolei
>
> Best regards,
> Pavel
>
>> +++ b/drivers/usb/cdns3/core.c
>> @@ -556,15 +555,23 @@ int cdns_resume(struct cdns *cdns, u8 set_active)
> ...
>> +
>> +void cdns_set_active(struct cdns *cdns, u8 set_active)
>> +{
>> + struct device *dev = cdns->dev;
>> +
>> if (set_active) {
>> pm_runtime_disable(dev);
>> pm_runtime_set_active(dev);
>> pm_runtime_enable(dev);
>> }
>>
>> - return 0;
>> + return;
>> }
>> +++ b/drivers/usb/cdns3/core.h
>> @@ -125,10 +125,13 @@ int cdns_init(struct cdns *cdns);
>> int cdns_remove(struct cdns *cdns);
>>
>> #ifdef CONFIG_PM_SLEEP
> ...
>> int cdns_suspend(struct cdns *cdns);
>> +void cdns_set_active(struct cdns *cdns, u8 set_active);
>> #else /* CONFIG_PM_SLEEP */
> ...
>> +static inline int cdns_set_active(struct cdns *cdns, u8 set_active)
>> { return 0; }
>> static inline int cdns_suspend(struct cdns *cdns)
>> { return 0; }
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH AUTOSEL 5.15 11/19] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (8 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 10/19] usb: cdns3: Put the cdns set active part outside the spin lock Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 9:17 ` Sergey Shtylyov
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 12/19] tools: iio: iio_generic_buffer: Fix some integer type and calculation Sasha Levin
` (7 subsequent siblings)
17 siblings, 1 reply; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ma Ke, Li Yang, Greg Kroah-Hartman, Sasha Levin, linux-usb,
linuxppc-dev
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit ce9daa2efc0872a9a68ea51dc8000df05893ef2e ]
We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 15db7a3868fe4..aff4050f96dd6 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1956,6 +1956,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
+ if (pipe >= USB_MAX_ENDPOINTS)
+ goto stall;
struct qe_ep *target_ep = &udc->eps[pipe];
u16 usep;
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH AUTOSEL 5.15 11/19] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 11/19] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc Sasha Levin
@ 2023-09-09 9:17 ` Sergey Shtylyov
0 siblings, 0 replies; 22+ messages in thread
From: Sergey Shtylyov @ 2023-09-09 9:17 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Ma Ke, Li Yang, Greg Kroah-Hartman, linux-usb, linuxppc-dev
On 9/9/23 3:38 AM, Sasha Levin wrote:
> From: Ma Ke <make_ruc2021@163.com>
>
> [ Upstream commit ce9daa2efc0872a9a68ea51dc8000df05893ef2e ]
>
> We should verify the bound of the array to assure that host
> may not manipulate the index to point past endpoint array.
>
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> Acked-by: Li Yang <leoyang.li@nxp.com>
> Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
> index 15db7a3868fe4..aff4050f96dd6 100644
> --- a/drivers/usb/gadget/udc/fsl_qe_udc.c
> +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
> @@ -1956,6 +1956,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
> } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
> /* Get endpoint status */
> int pipe = index & USB_ENDPOINT_NUMBER_MASK;
> + if (pipe >= USB_MAX_ENDPOINTS)
> + goto stall;
Hm, what's the earliest version of gcc needed to compile this
(*if* statement amongst the variable declarations)?
> struct qe_ep *target_ep = &udc->eps[pipe];
> u16 usep;
>
MBR, Sergey
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH AUTOSEL 5.15 12/19] tools: iio: iio_generic_buffer: Fix some integer type and calculation
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (9 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 11/19] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 13/19] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() Sasha Levin
` (6 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chenyuan Mi, Jonathan Cameron, Sasha Levin, jic23, linux-iio
From: Chenyuan Mi <michenyuan@huawei.com>
[ Upstream commit 49d736313d0975ddeb156f4f59801da833f78b30 ]
In function size_from_channelarray(), the return value 'bytes' is defined
as int type. However, the calcution of 'bytes' in this function is designed
to use the unsigned int type. So it is necessary to change 'bytes' type to
unsigned int to avoid integer overflow.
The size_from_channelarray() is called in main() function, its return value
is directly multipled by 'buf_len' and then used as the malloc() parameter.
The 'buf_len' is completely controllable by user, thus a multiplication
overflow may occur here. This could allocate an unexpected small area.
Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Link: https://lore.kernel.org/r/20230725092407.62545-1-michenyuan@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/iio/iio_generic_buffer.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index f8deae4e26a15..44bbf80f0cfdd 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -51,9 +51,9 @@ enum autochan {
* Has the side effect of filling the channels[i].location values used
* in processing the buffer output.
**/
-static int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
+static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
{
- int bytes = 0;
+ unsigned int bytes = 0;
int i = 0;
while (i < num_channels) {
@@ -348,7 +348,7 @@ int main(int argc, char **argv)
ssize_t read_size;
int dev_num = -1, trig_num = -1;
char *buffer_access = NULL;
- int scan_size;
+ unsigned int scan_size;
int noevents = 0;
int notrigger = 0;
char *dummy;
@@ -674,7 +674,16 @@ int main(int argc, char **argv)
}
scan_size = size_from_channelarray(channels, num_channels);
- data = malloc(scan_size * buf_len);
+
+ size_t total_buf_len = scan_size * buf_len;
+
+ if (scan_size > 0 && total_buf_len / scan_size != buf_len) {
+ ret = -EFAULT;
+ perror("Integer overflow happened when calculate scan_size * buf_len");
+ goto error;
+ }
+
+ data = malloc(total_buf_len);
if (!data) {
ret = -ENOMEM;
goto error;
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 13/19] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (10 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 12/19] tools: iio: iio_generic_buffer: Fix some integer type and calculation Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 14/19] serial: cpm_uart: Avoid suspicious locking Sasha Levin
` (5 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Konstantin Shelekhin, Martin K . Petersen, Sasha Levin,
michael.christie, mlombard, linux-scsi, target-devel
From: Konstantin Shelekhin <k.shelekhin@yadro.com>
[ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ]
The function lio_target_nacl_info_show() uses sprintf() in a loop to print
details for every iSCSI connection in a session without checking for the
buffer length. With enough iSCSI connections it's possible to overflow the
buffer provided by configfs and corrupt the memory.
This patch replaces sprintf() with sysfs_emit_at() that checks for buffer
boundries.
Signed-off-by: Konstantin Shelekhin <k.shelekhin@yadro.com>
Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/iscsi/iscsi_target_configfs.c | 54 ++++++++++----------
1 file changed, 27 insertions(+), 27 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index f4a24fa5058e6..df399110fbf11 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -507,102 +507,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page)
spin_lock_bh(&se_nacl->nacl_sess_lock);
se_sess = se_nacl->nacl_sess;
if (!se_sess) {
- rb += sprintf(page+rb, "No active iSCSI Session for Initiator"
+ rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator"
" Endpoint: %s\n", se_nacl->initiatorname);
} else {
sess = se_sess->fabric_sess_ptr;
- rb += sprintf(page+rb, "InitiatorName: %s\n",
+ rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n",
sess->sess_ops->InitiatorName);
- rb += sprintf(page+rb, "InitiatorAlias: %s\n",
+ rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n",
sess->sess_ops->InitiatorAlias);
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ",
sess->sid, sess->isid, sess->tsih);
- rb += sprintf(page+rb, "SessionType: %s\n",
+ rb += sysfs_emit_at(page, rb, "SessionType: %s\n",
(sess->sess_ops->SessionType) ?
"Discovery" : "Normal");
- rb += sprintf(page+rb, "Session State: ");
+ rb += sysfs_emit_at(page, rb, "Session State: ");
switch (sess->session_state) {
case TARG_SESS_STATE_FREE:
- rb += sprintf(page+rb, "TARG_SESS_FREE\n");
+ rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n");
break;
case TARG_SESS_STATE_ACTIVE:
- rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n");
+ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n");
break;
case TARG_SESS_STATE_LOGGED_IN:
- rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n");
+ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n");
break;
case TARG_SESS_STATE_FAILED:
- rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n");
+ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n");
break;
case TARG_SESS_STATE_IN_CONTINUE:
- rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n");
+ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n");
break;
default:
- rb += sprintf(page+rb, "ERROR: Unknown Session"
+ rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session"
" State!\n");
break;
}
- rb += sprintf(page+rb, "---------------------[iSCSI Session"
+ rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session"
" Values]-----------------------\n");
- rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN"
+ rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN"
" : MaxCmdSN : ITT : TTT\n");
max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn);
- rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x"
+ rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x"
" 0x%08x 0x%08x\n",
sess->cmdsn_window,
(max_cmd_sn - sess->exp_cmd_sn) + 1,
sess->exp_cmd_sn, max_cmd_sn,
sess->init_task_tag, sess->targ_xfer_tag);
- rb += sprintf(page+rb, "----------------------[iSCSI"
+ rb += sysfs_emit_at(page, rb, "----------------------[iSCSI"
" Connections]-------------------------\n");
spin_lock(&sess->conn_lock);
list_for_each_entry(conn, &sess->sess_conn_list, conn_list) {
- rb += sprintf(page+rb, "CID: %hu Connection"
+ rb += sysfs_emit_at(page, rb, "CID: %hu Connection"
" State: ", conn->cid);
switch (conn->conn_state) {
case TARG_CONN_STATE_FREE:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_FREE\n");
break;
case TARG_CONN_STATE_XPT_UP:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_XPT_UP\n");
break;
case TARG_CONN_STATE_IN_LOGIN:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_IN_LOGIN\n");
break;
case TARG_CONN_STATE_LOGGED_IN:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_LOGGED_IN\n");
break;
case TARG_CONN_STATE_IN_LOGOUT:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_IN_LOGOUT\n");
break;
case TARG_CONN_STATE_LOGOUT_REQUESTED:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_LOGOUT_REQUESTED\n");
break;
case TARG_CONN_STATE_CLEANUP_WAIT:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"TARG_CONN_STATE_CLEANUP_WAIT\n");
break;
default:
- rb += sprintf(page+rb,
+ rb += sysfs_emit_at(page, rb,
"ERROR: Unknown Connection State!\n");
break;
}
- rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr,
+ rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr,
(conn->network_transport == ISCSI_TCP) ?
"TCP" : "SCTP");
- rb += sprintf(page+rb, " StatSN: 0x%08x\n",
+ rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n",
conn->stat_sn);
}
spin_unlock(&sess->conn_lock);
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 14/19] serial: cpm_uart: Avoid suspicious locking
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (11 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 13/19] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 15/19] workqueue: Call wq_update_unbound_numa() on all CPUs in NUMA node on CPU hotplug Sasha Levin
` (4 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Christophe Leroy, Greg Kroah-Hartman, Sasha Levin, jirislaby,
ilpo.jarvinen, u.kleine-koenig, linux-serial
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 36ef11d311f405e55ad8e848c19b212ff71ef536 ]
CHECK drivers/tty/serial/cpm_uart/cpm_uart_core.c
drivers/tty/serial/cpm_uart/cpm_uart_core.c:1271:39: warning: context imbalance in 'cpm_uart_console_write' - unexpected unlock
Allthough 'nolock' is not expected to change, sparse find the following
form suspicious:
if (unlikely(nolock)) {
local_irq_save(flags);
} else {
spin_lock_irqsave(&pinfo->port.lock, flags);
}
cpm_uart_early_write(pinfo, s, count, true);
if (unlikely(nolock)) {
local_irq_restore(flags);
} else {
spin_unlock_irqrestore(&pinfo->port.lock, flags);
}
Rewrite it a more obvious form:
if (unlikely(oops_in_progress)) {
local_irq_save(flags);
cpm_uart_early_write(pinfo, s, count, true);
local_irq_restore(flags);
} else {
spin_lock_irqsave(&pinfo->port.lock, flags);
cpm_uart_early_write(pinfo, s, count, true);
spin_unlock_irqrestore(&pinfo->port.lock, flags);
}
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Link: https://lore.kernel.org/r/f7da5cdc9287960185829cfef681a7d8614efa1f.1691068700.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/cpm_uart/cpm_uart_core.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index db07d6a5d764d..2335edd516847 100644
--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -1276,19 +1276,14 @@ static void cpm_uart_console_write(struct console *co, const char *s,
{
struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
unsigned long flags;
- int nolock = oops_in_progress;
- if (unlikely(nolock)) {
+ if (unlikely(oops_in_progress)) {
local_irq_save(flags);
- } else {
- spin_lock_irqsave(&pinfo->port.lock, flags);
- }
-
- cpm_uart_early_write(pinfo, s, count, true);
-
- if (unlikely(nolock)) {
+ cpm_uart_early_write(pinfo, s, count, true);
local_irq_restore(flags);
} else {
+ spin_lock_irqsave(&pinfo->port.lock, flags);
+ cpm_uart_early_write(pinfo, s, count, true);
spin_unlock_irqrestore(&pinfo->port.lock, flags);
}
}
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 15/19] workqueue: Call wq_update_unbound_numa() on all CPUs in NUMA node on CPU hotplug
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (12 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 14/19] serial: cpm_uart: Avoid suspicious locking Sasha Levin
@ 2023-09-09 0:38 ` Sasha Levin
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 16/19] usb: ehci: add workaround for chipidea PORTSC.PEC bug Sasha Levin
` (3 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:38 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tejun Heo, Sasha Levin
From: Tejun Heo <tj@kernel.org>
[ Upstream commit 4cbfd3de737b9d00544ff0f673cb75fc37bffb6a ]
When a CPU went online or offline, wq_update_unbound_numa() was called only
on the CPU which was going up or down. This works fine because all CPUs on
the same NUMA node share the same pool_workqueue slot - one CPU updating it
updates it for everyone in the node.
However, future changes will make each CPU use a separate pool_workqueue
even when they're sharing the same worker_pool, which requires updating
pool_workqueue's for all CPUs which may be sharing the same pool_workqueue
on hotplug.
To accommodate the planned changes, this patch updates
workqueue_on/offline_cpu() so that they call wq_update_unbound_numa() for
all CPUs sharing the same NUMA node as the CPU going up or down. In the
current code, the second+ calls would be noops and there shouldn't be any
behavior changes.
* As wq_update_unbound_numa() is now called on multiple CPUs per each
hotplug event, @cpu is renamed to @hotplug_cpu and another @cpu argument
is added. The former indicates the CPU being hot[un]plugged and the latter
the CPU whose pool_workqueue is being updated.
* In wq_update_unbound_numa(), cpu_off is renamed to off_cpu for consistency
with the new @hotplug_cpu.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/workqueue.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 8e108c040cc35..c1f96501e40f6 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4130,7 +4130,8 @@ int apply_workqueue_attrs(struct workqueue_struct *wq,
/**
* wq_update_unbound_numa - update NUMA affinity of a wq for CPU hot[un]plug
* @wq: the target workqueue
- * @cpu: the CPU coming up or going down
+ * @cpu: the CPU to update pool association for
+ * @hotplug_cpu: the CPU coming up or going down
* @online: whether @cpu is coming up or going down
*
* This function is to be called from %CPU_DOWN_PREPARE, %CPU_ONLINE and
@@ -4150,10 +4151,10 @@ int apply_workqueue_attrs(struct workqueue_struct *wq,
* CPU_DOWN_PREPARE.
*/
static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
- bool online)
+ int hotplug_cpu, bool online)
{
int node = cpu_to_node(cpu);
- int cpu_off = online ? -1 : cpu;
+ int off_cpu = online ? -1 : hotplug_cpu;
struct pool_workqueue *old_pwq = NULL, *pwq;
struct workqueue_attrs *target_attrs;
cpumask_t *cpumask;
@@ -4181,7 +4182,7 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
* and create a new one if they don't match. If the target cpumask
* equals the default pwq's, the default pwq should be used.
*/
- if (wq_calc_node_cpumask(wq->dfl_pwq->pool->attrs, node, cpu_off, cpumask)) {
+ if (wq_calc_node_cpumask(wq->dfl_pwq->pool->attrs, node, off_cpu, cpumask)) {
if (cpumask_equal(cpumask, pwq->pool->attrs->cpumask))
return;
} else {
@@ -5168,8 +5169,15 @@ int workqueue_online_cpu(unsigned int cpu)
}
/* update NUMA affinity of unbound workqueues */
- list_for_each_entry(wq, &workqueues, list)
- wq_update_unbound_numa(wq, cpu, true);
+ list_for_each_entry(wq, &workqueues, list) {
+ int tcpu;
+
+ for_each_possible_cpu(tcpu) {
+ if (cpu_to_node(tcpu) == cpu_to_node(cpu)) {
+ wq_update_unbound_numa(wq, tcpu, cpu, true);
+ }
+ }
+ }
mutex_unlock(&wq_pool_mutex);
return 0;
@@ -5187,8 +5195,15 @@ int workqueue_offline_cpu(unsigned int cpu)
/* update NUMA affinity of unbound workqueues */
mutex_lock(&wq_pool_mutex);
- list_for_each_entry(wq, &workqueues, list)
- wq_update_unbound_numa(wq, cpu, false);
+ list_for_each_entry(wq, &workqueues, list) {
+ int tcpu;
+
+ for_each_possible_cpu(tcpu) {
+ if (cpu_to_node(tcpu) == cpu_to_node(cpu)) {
+ wq_update_unbound_numa(wq, tcpu, cpu, false);
+ }
+ }
+ }
mutex_unlock(&wq_pool_mutex);
return 0;
@@ -6132,7 +6147,8 @@ void __init workqueue_init(void)
}
list_for_each_entry(wq, &workqueues, list) {
- wq_update_unbound_numa(wq, smp_processor_id(), true);
+ wq_update_unbound_numa(wq, smp_processor_id(), smp_processor_id(),
+ true);
WARN(init_rescuer(wq),
"workqueue: failed to create early rescuer for %s",
wq->name);
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 16/19] usb: ehci: add workaround for chipidea PORTSC.PEC bug
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (13 preceding siblings ...)
2023-09-09 0:38 ` [PATCH AUTOSEL 5.15 15/19] workqueue: Call wq_update_unbound_numa() on all CPUs in NUMA node on CPU hotplug Sasha Levin
@ 2023-09-09 0:39 ` Sasha Levin
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 17/19] media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning Sasha Levin
` (2 subsequent siblings)
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xu Yang, Peter Chen, Greg Kroah-Hartman, Sasha Levin, stern,
linux-usb
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit dda4b60ed70bd670eefda081f70c0cb20bbeb1fa ]
Some NXP processor using chipidea IP has a bug when frame babble is
detected.
As per 4.15.1.1.1 Serial Bus Babble:
A babble condition also exists if IN transaction is in progress at
High-speed SOF2 point. This is called frame babble. The host controller
must disable the port to which the frame babble is detected.
The USB controller has disabled the port (PE cleared) and has asserted
USBERRINT when frame babble is detected, but PEC is not asserted.
Therefore, the SW isn't aware that port has been disabled. Then the
SW keeps sending packets to this port, but all of the transfers will
fail.
This workaround will firstly assert PCD by SW when USBERRINT is detected
and then judge whether port change has really occurred or not by polling
roothub status. Because the PEC doesn't get asserted in our case, this
patch will also assert it by SW when specific conditions are satisfied.
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20230809024432.535160-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/ehci-hcd.c | 8 ++++++--
drivers/usb/host/ehci-hub.c | 10 +++++++++-
drivers/usb/host/ehci.h | 10 ++++++++++
3 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 1440803216297..02044d45edded 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -755,10 +755,14 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
/* normal [4.15.1.2] or error [4.15.1.1] completion */
if (likely ((status & (STS_INT|STS_ERR)) != 0)) {
- if (likely ((status & STS_ERR) == 0))
+ if (likely ((status & STS_ERR) == 0)) {
INCR(ehci->stats.normal);
- else
+ } else {
+ /* Force to check port status */
+ if (ehci->has_ci_pec_bug)
+ status |= STS_PCD;
INCR(ehci->stats.error);
+ }
bh = 1;
}
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index c4f6a2559a987..0350c03dc97a1 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -674,7 +674,8 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
if ((temp & mask) != 0 || test_bit(i, &ehci->port_c_suspend)
|| (ehci->reset_done[i] && time_after_eq(
- jiffies, ehci->reset_done[i]))) {
+ jiffies, ehci->reset_done[i]))
+ || ehci_has_ci_pec_bug(ehci, temp)) {
if (i < 7)
buf [0] |= 1 << (i + 1);
else
@@ -874,6 +875,13 @@ int ehci_hub_control(
if (temp & PORT_PEC)
status |= USB_PORT_STAT_C_ENABLE << 16;
+ if (ehci_has_ci_pec_bug(ehci, temp)) {
+ status |= USB_PORT_STAT_C_ENABLE << 16;
+ ehci_info(ehci,
+ "PE is cleared by HW port:%d PORTSC:%08x\n",
+ wIndex + 1, temp);
+ }
+
if ((temp & PORT_OCC) && (!ignore_oc && !ehci->spurious_oc)){
status |= USB_PORT_STAT_C_OVERCURRENT << 16;
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index fdd073cc053b8..9888ca5f5f36f 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -207,6 +207,7 @@ struct ehci_hcd { /* one per controller */
unsigned has_fsl_port_bug:1; /* FreeScale */
unsigned has_fsl_hs_errata:1; /* Freescale HS quirk */
unsigned has_fsl_susp_errata:1; /* NXP SUSP quirk */
+ unsigned has_ci_pec_bug:1; /* ChipIdea PEC bug */
unsigned big_endian_mmio:1;
unsigned big_endian_desc:1;
unsigned big_endian_capbase:1;
@@ -706,6 +707,15 @@ ehci_port_speed(struct ehci_hcd *ehci, unsigned int portsc)
*/
#define ehci_has_fsl_susp_errata(e) ((e)->has_fsl_susp_errata)
+/*
+ * Some Freescale/NXP processors using ChipIdea IP have a bug in which
+ * disabling the port (PE is cleared) does not cause PEC to be asserted
+ * when frame babble is detected.
+ */
+#define ehci_has_ci_pec_bug(e, portsc) \
+ ((e)->has_ci_pec_bug && ((e)->command & CMD_PSE) \
+ && !(portsc & PORT_PEC) && !(portsc & PORT_PE))
+
/*
* While most USB host controllers implement their registers in
* little-endian format, a minority (celleb companion chip) implement
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 17/19] media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (14 preceding siblings ...)
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 16/19] usb: ehci: add workaround for chipidea PORTSC.PEC bug Sasha Levin
@ 2023-09-09 0:39 ` Sasha Levin
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 18/19] kobject: Add sanity check for kset->kobj.ktype in kset_register() Sasha Levin
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 19/19] interconnect: Fix locking for runpm vs reclaim Sasha Levin
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:39 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sakari Ailus, Hans Verkuil, Sasha Levin, yong.zhi, bingbu.cao,
djrscally, mchehab, linux-media
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 9d7531be3085a8f013cf173ccc4e72e3cf493538 ]
Initialise timing struct in cio2_hw_init() to zero in order to avoid a
compiler warning. The warning was a false positive.
Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
index 3a8af3936e93a..162ab089124f3 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
@@ -345,7 +345,7 @@ static int cio2_hw_init(struct cio2_device *cio2, struct cio2_queue *q)
void __iomem *const base = cio2->base;
u8 lanes, csi2bus = q->csi2.port;
u8 sensor_vc = SENSOR_VIR_CH_DFLT;
- struct cio2_csi2_timing timing;
+ struct cio2_csi2_timing timing = { 0 };
int i, r;
fmt = cio2_find_format(NULL, &q->subdev_fmt.code);
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 18/19] kobject: Add sanity check for kset->kobj.ktype in kset_register()
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (15 preceding siblings ...)
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 17/19] media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning Sasha Levin
@ 2023-09-09 0:39 ` Sasha Levin
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 19/19] interconnect: Fix locking for runpm vs reclaim Sasha Levin
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:39 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zhen Lei, Greg Kroah-Hartman, Sasha Levin
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 4d0fe8c52bb3029d83e323c961221156ab98680b ]
When I register a kset in the following way:
static struct kset my_kset;
kobject_set_name(&my_kset.kobj, "my_kset");
ret = kset_register(&my_kset);
A null pointer dereference exception is occurred:
[ 4453.568337] Unable to handle kernel NULL pointer dereference at \
virtual address 0000000000000028
... ...
[ 4453.810361] Call trace:
[ 4453.813062] kobject_get_ownership+0xc/0x34
[ 4453.817493] kobject_add_internal+0x98/0x274
[ 4453.822005] kset_register+0x5c/0xb4
[ 4453.825820] my_kobj_init+0x44/0x1000 [my_kset]
... ...
Because I didn't initialize my_kset.kobj.ktype.
According to the description in Documentation/core-api/kobject.rst:
- A ktype is the type of object that embeds a kobject. Every structure
that embeds a kobject needs a corresponding ktype.
So add sanity check to make sure kset->kobj.ktype is not NULL.
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20230805084114.1298-2-thunder.leizhen@huaweicloud.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/kobject.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/kobject.c b/lib/kobject.c
index 184a3dab26991..b6ccb4cced635 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -882,6 +882,11 @@ int kset_register(struct kset *k)
if (!k)
return -EINVAL;
+ if (!k->kobj.ktype) {
+ pr_err("must have a ktype to be initialized properly!\n");
+ return -EINVAL;
+ }
+
kset_init(k);
err = kobject_add_internal(&k->kobj);
if (err)
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread* [PATCH AUTOSEL 5.15 19/19] interconnect: Fix locking for runpm vs reclaim
2023-09-09 0:38 [PATCH AUTOSEL 5.15 01/19] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
` (16 preceding siblings ...)
2023-09-09 0:39 ` [PATCH AUTOSEL 5.15 18/19] kobject: Add sanity check for kset->kobj.ktype in kset_register() Sasha Levin
@ 2023-09-09 0:39 ` Sasha Levin
17 siblings, 0 replies; 22+ messages in thread
From: Sasha Levin @ 2023-09-09 0:39 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Rob Clark, Georgi Djakov, Sasha Levin, linux-pm
From: Rob Clark <robdclark@chromium.org>
[ Upstream commit af42269c3523492d71ebbe11fefae2653e9cdc78 ]
For cases where icc_bw_set() can be called in callbaths that could
deadlock against shrinker/reclaim, such as runpm resume, we need to
decouple the icc locking. Introduce a new icc_bw_lock for cases where
we need to serialize bw aggregation and update to decouple that from
paths that require memory allocation such as node/link creation/
destruction.
Fixes this lockdep splat:
======================================================
WARNING: possible circular locking dependency detected
6.2.0-rc8-debug+ #554 Not tainted
------------------------------------------------------
ring0/132 is trying to acquire lock:
ffffff80871916d0 (&gmu->lock){+.+.}-{3:3}, at: a6xx_pm_resume+0xf0/0x234
but task is already holding lock:
ffffffdb5aee57e8 (dma_fence_map){++++}-{0:0}, at: msm_job_run+0x68/0x150
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (dma_fence_map){++++}-{0:0}:
__dma_fence_might_wait+0x74/0xc0
dma_resv_lockdep+0x1f4/0x2f4
do_one_initcall+0x104/0x2bc
kernel_init_freeable+0x344/0x34c
kernel_init+0x30/0x134
ret_from_fork+0x10/0x20
-> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:
fs_reclaim_acquire+0x80/0xa8
slab_pre_alloc_hook.constprop.0+0x40/0x25c
__kmem_cache_alloc_node+0x60/0x1cc
__kmalloc+0xd8/0x100
topology_parse_cpu_capacity+0x8c/0x178
get_cpu_for_node+0x88/0xc4
parse_cluster+0x1b0/0x28c
parse_cluster+0x8c/0x28c
init_cpu_topology+0x168/0x188
smp_prepare_cpus+0x24/0xf8
kernel_init_freeable+0x18c/0x34c
kernel_init+0x30/0x134
ret_from_fork+0x10/0x20
-> #2 (fs_reclaim){+.+.}-{0:0}:
__fs_reclaim_acquire+0x3c/0x48
fs_reclaim_acquire+0x54/0xa8
slab_pre_alloc_hook.constprop.0+0x40/0x25c
__kmem_cache_alloc_node+0x60/0x1cc
__kmalloc+0xd8/0x100
kzalloc.constprop.0+0x14/0x20
icc_node_create_nolock+0x4c/0xc4
icc_node_create+0x38/0x58
qcom_icc_rpmh_probe+0x1b8/0x248
platform_probe+0x70/0xc4
really_probe+0x158/0x290
__driver_probe_device+0xc8/0xe0
driver_probe_device+0x44/0x100
__driver_attach+0xf8/0x108
bus_for_each_dev+0x78/0xc4
driver_attach+0x2c/0x38
bus_add_driver+0xd0/0x1d8
driver_register+0xbc/0xf8
__platform_driver_register+0x30/0x3c
qnoc_driver_init+0x24/0x30
do_one_initcall+0x104/0x2bc
kernel_init_freeable+0x344/0x34c
kernel_init+0x30/0x134
ret_from_fork+0x10/0x20
-> #1 (icc_lock){+.+.}-{3:3}:
__mutex_lock+0xcc/0x3c8
mutex_lock_nested+0x30/0x44
icc_set_bw+0x88/0x2b4
_set_opp_bw+0x8c/0xd8
_set_opp+0x19c/0x300
dev_pm_opp_set_opp+0x84/0x94
a6xx_gmu_resume+0x18c/0x804
a6xx_pm_resume+0xf8/0x234
adreno_runtime_resume+0x2c/0x38
pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174
rpm_callback+0x78/0x7c
rpm_resume+0x318/0x524
__pm_runtime_resume+0x78/0xbc
adreno_load_gpu+0xc4/0x17c
msm_open+0x50/0x120
drm_file_alloc+0x17c/0x228
drm_open_helper+0x74/0x118
drm_open+0xa0/0x144
drm_stub_open+0xd4/0xe4
chrdev_open+0x1b8/0x1e4
do_dentry_open+0x2f8/0x38c
vfs_open+0x34/0x40
path_openat+0x64c/0x7b4
do_filp_open+0x54/0xc4
do_sys_openat2+0x9c/0x100
do_sys_open+0x50/0x7c
__arm64_sys_openat+0x28/0x34
invoke_syscall+0x8c/0x128
el0_svc_common.constprop.0+0xa0/0x11c
do_el0_svc+0xac/0xbc
el0_svc+0x48/0xa0
el0t_64_sync_handler+0xac/0x13c
el0t_64_sync+0x190/0x194
-> #0 (&gmu->lock){+.+.}-{3:3}:
__lock_acquire+0xe00/0x1060
lock_acquire+0x1e0/0x2f8
__mutex_lock+0xcc/0x3c8
mutex_lock_nested+0x30/0x44
a6xx_pm_resume+0xf0/0x234
adreno_runtime_resume+0x2c/0x38
pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174
rpm_callback+0x78/0x7c
rpm_resume+0x318/0x524
__pm_runtime_resume+0x78/0xbc
pm_runtime_get_sync.isra.0+0x14/0x20
msm_gpu_submit+0x58/0x178
msm_job_run+0x78/0x150
drm_sched_main+0x290/0x370
kthread+0xf0/0x100
ret_from_fork+0x10/0x20
other info that might help us debug this:
Chain exists of:
&gmu->lock --> mmu_notifier_invalidate_range_start --> dma_fence_map
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(dma_fence_map);
lock(mmu_notifier_invalidate_range_start);
lock(dma_fence_map);
lock(&gmu->lock);
*** DEADLOCK ***
2 locks held by ring0/132:
#0: ffffff8087191170 (&gpu->lock){+.+.}-{3:3}, at: msm_job_run+0x64/0x150
#1: ffffffdb5aee57e8 (dma_fence_map){++++}-{0:0}, at: msm_job_run+0x68/0x150
stack backtrace:
CPU: 7 PID: 132 Comm: ring0 Not tainted 6.2.0-rc8-debug+ #554
Hardware name: Google Lazor (rev1 - 2) with LTE (DT)
Call trace:
dump_backtrace.part.0+0xb4/0xf8
show_stack+0x20/0x38
dump_stack_lvl+0x9c/0xd0
dump_stack+0x18/0x34
print_circular_bug+0x1b4/0x1f0
check_noncircular+0x78/0xac
__lock_acquire+0xe00/0x1060
lock_acquire+0x1e0/0x2f8
__mutex_lock+0xcc/0x3c8
mutex_lock_nested+0x30/0x44
a6xx_pm_resume+0xf0/0x234
adreno_runtime_resume+0x2c/0x38
pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174
rpm_callback+0x78/0x7c
rpm_resume+0x318/0x524
__pm_runtime_resume+0x78/0xbc
pm_runtime_get_sync.isra.0+0x14/0x20
msm_gpu_submit+0x58/0x178
msm_job_run+0x78/0x150
drm_sched_main+0x290/0x370
kthread+0xf0/0x100
ret_from_fork+0x10/0x20
Signed-off-by: Rob Clark <robdclark@chromium.org>
Link: https://lore.kernel.org/r/20230807171148.210181-7-robdclark@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/interconnect/core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c
index 14d785e5629e6..df88d9e9fb551 100644
--- a/drivers/interconnect/core.c
+++ b/drivers/interconnect/core.c
@@ -29,6 +29,7 @@ static LIST_HEAD(icc_providers);
static int providers_count;
static bool synced_state;
static DEFINE_MUTEX(icc_lock);
+static DEFINE_MUTEX(icc_bw_lock);
static struct dentry *icc_debugfs_dir;
static void icc_summary_show_one(struct seq_file *s, struct icc_node *n)
@@ -632,7 +633,7 @@ int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw)
if (WARN_ON(IS_ERR(path) || !path->num_nodes))
return -EINVAL;
- mutex_lock(&icc_lock);
+ mutex_lock(&icc_bw_lock);
old_avg = path->reqs[0].avg_bw;
old_peak = path->reqs[0].peak_bw;
@@ -664,7 +665,7 @@ int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw)
apply_constraints(path);
}
- mutex_unlock(&icc_lock);
+ mutex_unlock(&icc_bw_lock);
trace_icc_set_bw_end(path, ret);
@@ -967,6 +968,7 @@ void icc_node_add(struct icc_node *node, struct icc_provider *provider)
return;
mutex_lock(&icc_lock);
+ mutex_lock(&icc_bw_lock);
node->provider = provider;
list_add_tail(&node->node_list, &provider->nodes);
@@ -992,6 +994,7 @@ void icc_node_add(struct icc_node *node, struct icc_provider *provider)
node->avg_bw = 0;
node->peak_bw = 0;
+ mutex_unlock(&icc_bw_lock);
mutex_unlock(&icc_lock);
}
EXPORT_SYMBOL_GPL(icc_node_add);
@@ -1119,6 +1122,7 @@ void icc_sync_state(struct device *dev)
return;
mutex_lock(&icc_lock);
+ mutex_lock(&icc_bw_lock);
synced_state = true;
list_for_each_entry(p, &icc_providers, provider_list) {
dev_dbg(p->dev, "interconnect provider is in synced state\n");
--
2.40.1
^ permalink raw reply related [flat|nested] 22+ messages in thread