October 2019 - Linux-stable-mirror

[PATCH 1/3] xhci: Fix use-after-free regression in xhci clear hub TT implementation

by Mathias Nyman

commit ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") schedules work to clear TT buffer, but causes a use-after-free regression at the same time Make sure hub_tt_work finishes before endpoint is disabled, otherwise the work will dereference already freed endpoint and device related pointers. This was triggered when usb core failed to read the configuration descriptor of a FS/LS device during enumeration. xhci driver queued clear_tt_work while usb core freed and reallocated a new device for the next enumeration attempt. EHCI driver implents ehci_endpoint_disable() that makes sure clear_tt_work has finished before it returns, but xhci lacks this support. usb core will call hcd->driver->endpoint_disable() callback before disabling endpoints, so we want this in xhci as well. The added xhci_endpoint_disable() is based on ehci_endpoint_disable() Fixes: ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") Cc: <stable(a)vger.kernel.org> # v5.3 Reported-by: Johan Hovold <johan(a)kernel.org> Suggested-by: Johan Hovold <johan(a)kernel.org> Reviewed-by: Johan Hovold <johan(a)kernel.org> Tested-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> --- drivers/usb/host/xhci.c | 54 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 45 insertions(+), 9 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 517ec3206f6e..6c17e3fe181a 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3071,6 +3071,48 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index, } } +static void xhci_endpoint_disable(struct usb_hcd *hcd, + struct usb_host_endpoint *host_ep) +{ + struct xhci_hcd *xhci; + struct xhci_virt_device *vdev; + struct xhci_virt_ep *ep; + struct usb_device *udev; + unsigned long flags; + unsigned int ep_index; + + xhci = hcd_to_xhci(hcd); +rescan: + spin_lock_irqsave(&xhci->lock, flags); + + udev = (struct usb_device *)host_ep->hcpriv; + if (!udev || !udev->slot_id) + goto done; + + vdev = xhci->devs[udev->slot_id]; + if (!vdev) + goto done; + + ep_index = xhci_get_endpoint_index(&host_ep->desc); + ep = &vdev->eps[ep_index]; + if (!ep) + goto done; + + /* wait for hub_tt_work to finish clearing hub TT */ + if (ep->ep_state & EP_CLEARING_TT) { + spin_unlock_irqrestore(&xhci->lock, flags); + schedule_timeout_uninterruptible(1); + goto rescan; + } + + if (ep->ep_state) + xhci_dbg(xhci, "endpoint disable with ep_state 0x%x\n", + ep->ep_state); +done: + host_ep->hcpriv = NULL; + spin_unlock_irqrestore(&xhci->lock, flags); +} + /* * Called after usb core issues a clear halt control message. * The host side of the halt should already be cleared by a reset endpoint @@ -5238,20 +5280,13 @@ static void xhci_clear_tt_buffer_complete(struct usb_hcd *hcd, unsigned int ep_index; unsigned long flags; - /* - * udev might be NULL if tt buffer is cleared during a failed device - * enumeration due to a halted control endpoint. Usb core might - * have allocated a new udev for the next enumeration attempt. - */ - xhci = hcd_to_xhci(hcd); + + spin_lock_irqsave(&xhci->lock, flags); udev = (struct usb_device *)ep->hcpriv; - if (!udev) - return; slot_id = udev->slot_id; ep_index = xhci_get_endpoint_index(&ep->desc); - spin_lock_irqsave(&xhci->lock, flags); xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_CLEARING_TT; xhci_ring_doorbell_for_active_rings(xhci, slot_id, ep_index); spin_unlock_irqrestore(&xhci->lock, flags); @@ -5288,6 +5323,7 @@ static const struct hc_driver xhci_hc_driver = { .free_streams = xhci_free_streams, .add_endpoint = xhci_add_endpoint, .drop_endpoint = xhci_drop_endpoint, + .endpoint_disable = xhci_endpoint_disable, .endpoint_reset = xhci_endpoint_reset, .check_bandwidth = xhci_check_bandwidth, .reset_bandwidth = xhci_reset_bandwidth, -- 2.7.4

5 years, 2 months

1
0
0 0

[PATCH AUTOSEL 4.4 01/16] PCI/ASPM: Do not initialize link state when aspm_disabled is set

by Sasha Levin

From: Patrick Talbert <ptalbert(a)redhat.com> [ Upstream commit 17c91487364fb33797ed84022564ee7544ac4945 ] Now that ASPM is configured for *all* PCIe devices at boot, a problem is seen with systems that set the FADT NO_ASPM bit. This bit indicates that the OS should not alter the ASPM state, but when pcie_aspm_init_link_state() runs it only checks for !aspm_support_enabled. This misses the ACPI_FADT_NO_ASPM case because that is setting aspm_disabled. The result is systems may hang at boot after 1302fcf; avoidable if they boot with pcie_aspm=off (sets !aspm_support_enabled). Fix this by having aspm_init_link_state() check for either !aspm_support_enabled or acpm_disabled. Link: https://bugzilla.kernel.org/show_bug.cgi?id=201001 Fixes: 1302fcf0d03e ("PCI: Configure *all* devices, not just hot-added ones") Signed-off-by: Patrick Talbert <ptalbert(a)redhat.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pci/pcie/aspm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index c6a012b5ba390..6cc073f1d2d15 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -560,7 +560,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev) struct pcie_link_state *link; int blacklist = !!pcie_aspm_sanity_check(pdev); - if (!aspm_support_enabled) + if (!aspm_support_enabled || aspm_disabled) return; if (pdev->link_state) -- 2.20.1

5 years, 2 months

1
15
0 0

[PATCH AUTOSEL 4.14 01/25] PCI/ASPM: Do not initialize link state when aspm_disabled is set

by Sasha Levin

From: Patrick Talbert <ptalbert(a)redhat.com> [ Upstream commit 17c91487364fb33797ed84022564ee7544ac4945 ] Now that ASPM is configured for *all* PCIe devices at boot, a problem is seen with systems that set the FADT NO_ASPM bit. This bit indicates that the OS should not alter the ASPM state, but when pcie_aspm_init_link_state() runs it only checks for !aspm_support_enabled. This misses the ACPI_FADT_NO_ASPM case because that is setting aspm_disabled. The result is systems may hang at boot after 1302fcf; avoidable if they boot with pcie_aspm=off (sets !aspm_support_enabled). Fix this by having aspm_init_link_state() check for either !aspm_support_enabled or acpm_disabled. Link: https://bugzilla.kernel.org/show_bug.cgi?id=201001 Fixes: 1302fcf0d03e ("PCI: Configure *all* devices, not just hot-added ones") Signed-off-by: Patrick Talbert <ptalbert(a)redhat.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pci/pcie/aspm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index 6b4e82a4b64e0..370c3459e8845 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -858,7 +858,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev) struct pcie_link_state *link; int blacklist = !!pcie_aspm_sanity_check(pdev); - if (!aspm_support_enabled) + if (!aspm_support_enabled || aspm_disabled) return; if (pdev->link_state) -- 2.20.1

5 years, 2 months

1
24
0 0

❌ FAIL: Stable queue: queue-5.3

by CKI Project

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 365dab61f74e - Linux 5.3.7 The results of these automated tests are provided below. Overall result: FAILED (see details below) Merge: OK Compile: OK Tests: FAILED All kernel binaries, config files, and logs are available for download here: https://artifacts.cki-project.org/pipelines/246469 One or more kernel tests failed: aarch64: ❌ xfstests: xfs We hope that these logs can help you find the problem quickly. For the full detail on our testing procedures, please scroll to the bottom of this message. Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out the following commit: Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 365dab61f74e - Linux 5.3.7 We grabbed the b536e633e23b commit of the stable queue repository. We then merged the patchset with `git am`: drm-free-the-writeback_job-when-it-with-an-empty-fb.patch drm-clear-the-fence-pointer-when-writeback-job-signa.patch clk-ti-dra7-fix-mcasp8-clock-bits.patch arm-dts-fix-wrong-clocks-for-dra7-mcasp.patch nvme-pci-fix-a-race-in-controller-removal.patch scsi-ufs-skip-shutdown-if-hba-is-not-powered.patch scsi-megaraid-disable-device-when-probe-failed-after.patch scsi-qla2xxx-silence-fwdump-template-message.patch scsi-qla2xxx-fix-unbound-sleep-in-fcport-delete-path.patch scsi-qla2xxx-fix-stale-mem-access-on-driver-unload.patch scsi-qla2xxx-fix-n2n-link-reset.patch scsi-qla2xxx-fix-n2n-link-up-fail.patch arm-dts-fix-gpio0-flags-for-am335x-icev2.patch arm-omap2-fix-missing-reset-done-flag-for-am3-and-am.patch arm-omap2-add-missing-lcdc-midlemode-for-am335x.patch arm-omap2-fix-warnings-with-broken-omap2_set_init_vo.patch nvme-tcp-fix-wrong-stop-condition-in-io_work.patch nvme-pci-save-pci-state-before-putting-drive-into-de.patch nvme-fix-an-error-code-in-nvme_init_subsystem.patch nvme-rdma-fix-max_hw_sectors-calculation.patch added-quirks-for-adata-xpg-sx8200-pro-512gb.patch nvme-add-quirk-for-kingston-nvme-ssd-running-fw-e8fk.patch nvme-allow-64-bit-results-in-passthru-commands.patch drm-komeda-prevent-memory-leak-in-komeda_wb_connecto.patch nvme-rdma-fix-possible-use-after-free-in-connect-tim.patch blk-mq-honor-io-scheduler-for-multiqueue-devices.patch ieee802154-ca8210-prevent-memory-leak.patch arm-dts-am4372-set-memory-bandwidth-limit-for-dispc.patch net-dsa-qca8k-use-up-to-7-ports-for-all-operations.patch mips-dts-ar9331-fix-interrupt-controller-size.patch xen-efi-set-nonblocking-callbacks.patch loop-change-queue-block-size-to-match-when-using-dio.patch nl80211-fix-null-pointer-dereference.patch mac80211-fix-txq-null-pointer-dereference.patch netfilter-nft_connlimit-disable-bh-on-garbage-collec.patch net-mscc-ocelot-add-missing-of_node_put-after-callin.patch net-dsa-rtl8366rb-add-missing-of_node_put-after-call.patch net-stmmac-xgmac-not-all-unicast-addresses-may-be-av.patch net-stmmac-dwmac4-always-update-the-mac-hash-filter.patch net-stmmac-correctly-take-timestamp-for-ptpv2.patch net-stmmac-do-not-stop-phy-if-wol-is-enabled.patch net-ag71xx-fix-mdio-subnode-support.patch risc-v-clear-load-reservations-while-restoring-hart-.patch riscv-fix-memblock-reservation-for-device-tree-blob.patch drm-amdgpu-fix-multiple-memory-leaks-in-acp_hw_init.patch drm-amd-display-memory-leak.patch mips-loongson-fix-the-link-time-qualifier-of-serial_.patch net-hisilicon-fix-usage-of-uninitialized-variable-in.patch net-stmmac-avoid-deadlock-on-suspend-resume.patch selftests-kvm-fix-libkvm-build-error.patch lib-textsearch-fix-escapes-in-example-code.patch s390-mm-fix-wunused-but-set-variable-warnings.patch r8152-set-macpassthru-in-reset_resume-callback.patch net-phy-allow-for-reset-line-to-be-tied-to-a-sleepy-.patch net-phy-fix-write-to-mii-ctrl1000-register.patch namespace-fix-namespace.pl-script-to-support-relativ.patch convert-filldir-64-from-__put_user-to-unsafe_put_use.patch elf-don-t-use-map_fixed_noreplace-for-elf-executable.patch make-filldir-64-verify-the-directory-entry-filename-.patch uaccess-implement-a-proper-unsafe_copy_to_user-and-s.patch filldir-64-remove-warn_on_once-for-bad-directory-ent.patch net_sched-fix-backward-compatibility-for-tca_kind.patch net_sched-fix-backward-compatibility-for-tca_act_kin.patch libata-ahci-fix-pcs-quirk-application.patch md-raid0-fix-warning-message-for-parameter-default_l.patch revert-drm-radeon-fix-eeh-during-kexec.patch ocfs2-fix-panic-due-to-ocfs2_wq-is-null.patch nvme-pci-set-the-prp2-correctly-when-using-more-than-4k-page.patch ipv4-fix-race-condition-between-route-lookup-and-invalidation.patch ipv4-return-enetunreach-if-we-can-t-create-route-but-saddr-is-valid.patch net-avoid-potential-infinite-loop-in-tc_ctl_action.patch net-bcmgenet-fix-rgmii_mode_en-value-for-genet-v1-2-3.patch net-bcmgenet-set-phydev-dev_flags-only-for-internal-phys.patch net-i82596-fix-dma_alloc_attr-for-sni_82596.patch net-ibmvnic-fix-eoi-when-running-in-xive-mode.patch net-ipv6-fix-listify-ip6_rcv_finish-in-case-of-forwarding.patch net-stmmac-disable-enable-ptp_ref_clk-in-suspend-resume-flow.patch rxrpc-fix-possible-null-pointer-access-in-icmp-handling.patch sched-etf-fix-ordering-of-packets-with-same-txtime.patch sctp-change-sctp_prot-.no_autobind-with-true.patch net-aquantia-temperature-retrieval-fix.patch net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch net-aquantia-do-not-pass-lro-session-with-invalid-tcp-checksum.patch net-aquantia-correctly-handle-macvlan-and-multicast-coexistence.patch net-phy-micrel-discern-ksz8051-and-ksz8795-phys.patch net-phy-micrel-update-ksz87xx-phy-name.patch net-avoid-errors-when-trying-to-pop-mlps-header-on-non-mpls-packets.patch net-sched-fix-corrupted-l2-header-with-mpls-push-and-pop-actions.patch netdevsim-fix-error-handling-in-nsim_fib_init-and-nsim_fib_exit.patch net-ethernet-broadcom-have-drivers-select-dimlib-as-needed.patch net-phy-fix-link-partner-information-disappear-issue.patch Compile testing --------------- We compiled the kernel for 3 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test ❌ xfstests: xfs ⚡⚡⚡ selinux-policy: serge-testsuite ⚡⚡⚡ lvm thinp sanity ⚡⚡⚡ storage: software RAID testing 🚧 ⚡⚡⚡ Storage blktests Host 2: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ LTP lite ✅ Loopdev Sanity ✅ jvm test suite ✅ AMTU (Abstract Machine Test Utility) ✅ LTP: openposix test suite ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route: pmtu ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Networking route_func: local ✅ Networking route_func: forward 🚧 ✅ storage: dm/common ppc64le: Host 1: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ LTP lite ✅ Loopdev Sanity ✅ jvm test suite ✅ AMTU (Abstract Machine Test Utility) ✅ LTP: openposix test suite ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route: pmtu ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ Usex - version 1.9-29 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Networking route_func: local ✅ Networking route_func: forward 🚧 ✅ storage: dm/common Host 2: ✅ Boot test ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ Storage blktests x86_64: Host 1: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ LTP lite ✅ Loopdev Sanity ✅ jvm test suite ✅ AMTU (Abstract Machine Test Utility) ✅ LTP: openposix test suite ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking route: pmtu ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ pciutils: sanity smoke test ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ stress: stress-ng 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Networking route_func: local ✅ Networking route_func: forward 🚧 ✅ storage: dm/common Host 2: ✅ Boot test ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ Storage blktests Test sources: https://github.com/CKI-project/tests-beaker 💚 Pull requests are welcome for new tests or improvements to existing tests! Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed. Testing timeout --------------- We aim to provide a report within reasonable timeframe. Tests that haven't finished running are marked with ⏱. Reports for non-upstream kernels have a Beaker recipe linked to next to each host.

5 years, 2 months

1
0
0 0

[PATCH v3 1/3] ACPI / LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links

by Hans de Goede

So far on Bay Trail (BYT) we only have been adding a device_link adding the iGPU (LNXVIDEO) device as consumer for the I2C controller for the PMIC for I2C5, but the PMIC only uses I2C5 on BYT CR (cost reduced) on regular BYT platforms I2C7 is used and we were not adding the device_link sometimes causing resume ordering issues. This commit adds LNXVIDEO -> BYT I2C7 to the lpss_device_links table, fixing this. Cc: stable(a)vger.kernel.org Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- Changes in v2: -Add Fixes: tag Changes in v3: -Point Fixes tag to a more apropriate commit --- drivers/acpi/acpi_lpss.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c index 60bbc5090abe..e7a4504f0fbf 100644 --- a/drivers/acpi/acpi_lpss.c +++ b/drivers/acpi/acpi_lpss.c @@ -473,9 +473,14 @@ struct lpss_device_links { * the supplier is not enumerated until after the consumer is probed. */ static const struct lpss_device_links lpss_device_links[] = { + /* CHT External sdcard slot controller depends on PMIC I2C ctrl */ {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME}, + /* CHT iGPU depends on PMIC I2C controller */ {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */ {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */ + {"80860F41", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, }; static bool hid_uid_match(struct acpi_device *adev, -- 2.23.0

5 years, 2 months

3
6
0 0

[PATCH 1/3] ACPI / LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links

by Hans de Goede

So far on Bay Trail (BYT) we only have been adding a device_link adding the iGPU (LNXVIDEO) device as consumer for the I2C controller for the PMIC for I2C5, but the PMIC only uses I2C5 on BYT CR (cost reduced) on regular BYT platforms I2C7 is used and we were not adding the device_link sometimes causing resume ordering issues. This commit adds LNXVIDEO -> BYT I2C7 to the lpss_device_links table, fixing this. Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/acpi/acpi_lpss.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c index 60bbc5090abe..e7a4504f0fbf 100644 --- a/drivers/acpi/acpi_lpss.c +++ b/drivers/acpi/acpi_lpss.c @@ -473,9 +473,14 @@ struct lpss_device_links { * the supplier is not enumerated until after the consumer is probed. */ static const struct lpss_device_links lpss_device_links[] = { + /* CHT External sdcard slot controller depends on PMIC I2C ctrl */ {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME}, + /* CHT iGPU depends on PMIC I2C controller */ {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */ {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, + /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */ + {"80860F41", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME}, }; static bool hid_uid_match(struct acpi_device *adev, -- 2.23.0

5 years, 2 months

3
6
0 0

[PATCH] spi: Fix NULL pointer when setting SPI_CS_HIGH for GPIO CS

by Gregory CLEMENT

Even if the flag use_gpio_descriptors is set, it is possible that cs_gpiods was not allocated, which leads to a kernel crash: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = (ptrval) [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Tainted: G W 5.4.0-rc3 #1 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) PC is at of_register_spi_device+0x20c/0x38c LR is at __of_find_property+0x3c/0x60 pc : [<c09b45dc>] lr : [<c0c47a98>] psr: 20000013 sp : ea0b5d88 ip : aae04461 fp : ea1a8810 r10: 00000055 r9 : 00000000 r8 : ea6dc800 r7 : 00000001 r6 : c1704048 r5 : eafc8c7c r4 : ea7fd800 r3 : 00000000 r2 : 00000000 r1 : ffffffff r0 : 00000001 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 80204059 DAC: 00000051 Process swapper (pid: 1, stack limit = 0x(ptrval)) Stack: (0xea0b5d88 to 0xea0b6000) 5d80: 00000000 aae04461 00000000 aae04461 ea6dc800 00000000 5da0: eafc8c7c c131fbdc ea6dc9c0 c09b4e24 ea7f4500 00000040 c09b3e24 ea7f3dc0 5dc0: ea6dc800 ea1a8800 ea1a8810 00000000 00000000 00000055 0000014b c09b5020 5de0: ea6dc800 ea6dcb80 ea1a8800 ea1a8810 00000000 c09cb884 ea1a69c0 ea6dcb80 5e00: ea1a8810 00000000 c1862448 00000000 00000000 c1862448 00000000 c08dba2c 5e20: c18e66dc ea1a8810 c18e66e0 00000000 00000000 c08d9b28 ea1a8810 c1862448 5e40: c1862448 c08da0c8 00000000 c15c5850 c18a4200 c08d9e18 00000000 c15c5850 5e60: c18a4200 ea1a8810 00000000 c1862448 c08da0c8 00000000 c15c5850 c18a4200 5e80: 0000014b c08da0c0 00000000 c1862448 ea1a8810 c08da120 ea1aa0b0 c1704048 5ea0: c1862448 c08d7ed4 c15c5850 ea0894cc ea1aa0b0 aae04461 c18522c8 c1862448 5ec0: ea7f3800 c18522c8 00000000 c08d8f14 c1321b68 c15977a0 c1862448 c1862448 5ee0: c1704048 c15977b0 c15c5830 c08daa8c c18992a0 c1704048 c15977b0 c0302ce4 5f00: ebfffcd1 c03566f0 c14031b4 c1346700 00000000 00000006 00000006 c1242794 5f20: 00000000 c1704048 c1252144 c1242808 c1655778 ebfffcc0 ebfffcc3 aae04461 5f40: 00000000 00000006 c18992a0 aae04461 c16564e8 c18992a0 c18a4200 c15c5830 5f60: c15004a8 c1501028 00000006 00000006 00000000 c15004a8 00000000 00000007 5f80: c0e01028 00000000 c0e01028 00000000 00000000 00000000 00000000 00000000 5fa0: 00000000 c0e01030 00000000 c03010e8 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [<c09b45dc>] (of_register_spi_device) from [<c09b4e24>] (spi_register_controller+0x558/0x720) [<c09b4e24>] (spi_register_controller) from [<c09b5020>] (devm_spi_register_controller+0x34/0x6c) [<c09b5020>] (devm_spi_register_controller) from [<c09cb884>] (tegra_spi_probe+0x344/0x438) [<c09cb884>] (tegra_spi_probe) from [<c08dba2c>] (platform_drv_probe+0x48/0x98) [<c08dba2c>] (platform_drv_probe) from [<c08d9b28>] (really_probe+0x1e0/0x348) [<c08d9b28>] (really_probe) from [<c08d9e18>] (driver_probe_device+0x60/0x168) [<c08d9e18>] (driver_probe_device) from [<c08da0c0>] (device_driver_attach+0x58/0x60) [<c08da0c0>] (device_driver_attach) from [<c08da120>] (__driver_attach+0x58/0xcc) [<c08da120>] (__driver_attach) from [<c08d7ed4>] (bus_for_each_dev+0x74/0xb4) [<c08d7ed4>] (bus_for_each_dev) from [<c08d8f14>] (bus_add_driver+0x1b8/0x1d8) [<c08d8f14>] (bus_add_driver) from [<c08daa8c>] (driver_register+0x74/0x108) [<c08daa8c>] (driver_register) from [<c0302ce4>] (do_one_initcall+0x50/0x1a8) [<c0302ce4>] (do_one_initcall) from [<c1501028>] (kernel_init_freeable+0x15c/0x1fc) [<c1501028>] (kernel_init_freeable) from [<c0e01030>] (kernel_init+0x8/0x10c) [<c0e01030>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c) Exception stack(0xea0b5fb0 to 0xea0b5ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 Code: e3520000 0a000006 e59822a8 e6ef3073 (e7923103) Reported-by: "kernelci.org bot" <bot(a)kernelci.org> Fixes: 3e5ec1db8bfe ("spi: Fix SPI_CS_HIGH setting when using native and GPIO CS") Cc: <stable(a)vger.kernel.org> Signed-off-by: Gregory CLEMENT <gregory.clement(a)bootlin.com> --- Hello, Following the report from https://kernelci.org/boot/id/5daa485f59b5142f647525a0/, I managed to reproduce the bug on my platform, and fixed it. The commit ID provided for the fixes tag is the one of the branch for-linus on git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git Gregory drivers/spi/spi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 1b68acc28c8f..dd7cdd996086 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -1949,7 +1949,8 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi, * handled in the gpiolib, so all gpio chip selects are "active high" * in the logical sense, the gpiolib will invert the line if need be. */ - if ((ctlr->use_gpio_descriptors) && ctlr->cs_gpiods[spi->chip_select]) + if ((ctlr->use_gpio_descriptors) && ctlr->cs_gpiods && + ctlr->cs_gpiods[spi->chip_select]) spi->mode |= SPI_CS_HIGH; /* Device speed */ -- 2.23.0

5 years, 2 months

2
2
0 0

[PATCHES] Networking

by David Miller

Please queue up the following networking bug fixes for 4.19.x and 5.3.x -stable, respectively. Thank you!

5 years, 2 months

2
1
0 0

[PATCH] target/cxgbit: Fix cxgbit_fw4_ack()

by Bart Van Assche

Use the pointer 'p' after having tested that pointer instead of before. Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Cc: Varun Prakash <varun(a)chelsio.com> Cc: Nicholas Bellinger <nab(a)linux-iscsi.org> Cc: <stable(a)vger.kernel.org> Fixes: 5cadafb236df ("target/cxgbit: Fix endianness annotations") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> --- drivers/target/iscsi/cxgbit/cxgbit_cm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c index c70caf4ea490..a2b5c796bbc4 100644 --- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c +++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c @@ -1831,7 +1831,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb) while (credits) { struct sk_buff *p = cxgbit_sock_peek_wr(csk); - const u32 csum = (__force u32)p->csum; + u32 csum; if (unlikely(!p)) { pr_err("csk 0x%p,%u, cr %u,%u+%u, empty.\n", @@ -1840,6 +1840,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb) break; } + csum = (__force u32)p->csum; if (unlikely(credits < csum)) { pr_warn("csk 0x%p,%u, cr %u,%u+%u, < %u.\n", csk, csk->tid, -- 2.23.0

5 years, 2 months

2
1
0 0

[PATCH 4.4 4.9 4.14] loop: Add LOOP_SET_DIRECT_IO to compat ioctl

by Alessio Balsini

[ Upstream commit fdbe4eeeb1aac219b14f10c0ed31ae5d1123e9b8 ] Enabling Direct I/O with loop devices helps reducing memory usage by avoiding double caching. 32 bit applications running on 64 bits systems are currently not able to request direct I/O because is missing from the lo_compat_ioctl. This patch fixes the compatibility issue mentioned above by exporting LOOP_SET_DIRECT_IO as additional lo_compat_ioctl() entry. The input argument for this ioctl is a single long converted to a 1-bit boolean, so compatibility is preserved. Cc: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Alessio Balsini <balsini(a)android.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/block/loop.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index da3902ac16c86..8aadd4d0c3a88 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1557,6 +1557,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, arg = (unsigned long) compat_ptr(arg); case LOOP_SET_FD: case LOOP_CHANGE_FD: + case LOOP_SET_DIRECT_IO: err = lo_ioctl(bdev, mode, cmd, arg); break; default: -- 2.23.0.866.gb869b98d4c-goog

5 years, 2 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2019