June 2019 - Linux-stable-mirror

[PATCH 5.1] include/linux/bitops.h: sanitize rotate primitives

by Matthias Kaehlcke

From: Rasmus Villemoes <linux(a)rasmusvillemoes.dk> commit ef4d6f6b275c498f8e5626c99dbeefdc5027f843 upstream The ror32 implementation (word >> shift) | (word << (32 - shift) has undefined behaviour if shift is outside the [1, 31] range. Similarly for the 64 bit variants. Most callers pass a compile-time constant (naturally in that range), but there's an UBSAN report that these may actually be called with a shift count of 0. Instead of special-casing that, we can make them DTRT for all values of shift while also avoiding UB. For some reason, this was already partly done for rol32 (which was well-defined for [0, 31]). gcc 8 recognizes these patterns as rotates, so for example __u32 rol32(__u32 word, unsigned int shift) { return (word << (shift & 31)) | (word >> ((-shift) & 31)); } compiles to 0000000000000020 <rol32>: 20: 89 f8 mov %edi,%eax 22: 89 f1 mov %esi,%ecx 24: d3 c0 rol %cl,%eax 26: c3 retq Older compilers unfortunately do not do as well, but this only affects the small minority of users that don't pass constants. Due to integer promotions, ro[lr]8 were already well-defined for shifts in [0, 8], and ro[lr]16 were mostly well-defined for shifts in [0, 16] (only mostly - u16 gets promoted to _signed_ int, so if bit 15 is set, word << 16 is undefined). For consistency, update those as well. Link: http://lkml.kernel.org/r/20190410211906.2190-1-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes <linux(a)rasmusvillemoes.dk> Reported-by: Ido Schimmel <idosch(a)mellanox.com> Tested-by: Ido Schimmel <idosch(a)mellanox.com> Reviewed-by: Will Deacon <will.deacon(a)arm.com> Cc: Vadim Pasternak <vadimp(a)mellanox.com> Cc: Andrey Ryabinin <aryabinin(a)virtuozzo.com> Cc: Jacek Anaszewski <jacek.anaszewski(a)gmail.com> Cc: Pavel Machek <pavel(a)ucw.cz> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Matthias Kaehlcke <mka(a)chromium.org> --- Hi Greg and Sasha, Please pick this patch for 5.1. It fixes (at least) crashes due to undefined instructions in BPF code on arm32 when building with clang: [ 4.271668] Internal error: Oops - undefined instruction: 0 [#1] PREEMPT SMP ARM [ 4.271675] Modules linked in: [ 4.284143] joydev [ 4.284155] CPU: 2 PID: 279 Comm: udevd Not tainted 4.19.44 #95 [ 4.284157] Hardware name: Rockchip (Device Tree) [ 4.284167] PC is at 0xbf017de8 [ 4.284176] LR is at sk_filter_trim_cap+0xfc/0x244 [ 4.284181] pc : [<bf017de8>] lr : [<c0890c34>] psr: 60070013 [ 4.323863] sp : ed36fcd8 ip : 00000000 fp : ed36fd28 [ 4.329698] r10: c100b608 r9 : 00000000 r8 : ed2d6600 [ 4.335531] r7 : 00000000 r6 : 00000071 r5 : 00000000 r4 : ed59c180 [ 4.342812] r3 : 00000000 r2 : ed59c180 r1 : 00000000 r0 : 2a1884a1 [ 4.350105] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 4.358075] Control: 30c5387d Table: 2d22b880 DAC: 44541fd3 [ 4.364495] Process udevd (pid: 279, stack limit = 0xb5b8ffdf) [ 4.371009] Stack: (0xed36fcd8 to 0xed370000) [ 4.375864] fcc0: bf017a9c 60070013 [ 4.385001] fce0: 00000000 00000000 ed36fcd8 00000000 00000089 00000000 ed2d6600 00000000 [ 4.394137] fd00: 00000000 00000000 ed59c180 f0c12000 00000000 ed289000 ed59c1a0 00000001 [ 4.403274] fd20: 00000071 00000000 ed59c180 f0c12000 00000000 ed289000 ed59c1a0 00000001 ... [ 4.613384] [<c0890c34>] (sk_filter_trim_cap) from [<00000001>] (0x1) [ 4.620580] Code: aa000002 e0200000 e3a01000 ea000045 (f7e6c179) Thanks Matthias --- include/linux/bitops.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/include/linux/bitops.h b/include/linux/bitops.h index 7ddb1349394d..7ac2e46112b7 100644 --- a/include/linux/bitops.h +++ b/include/linux/bitops.h @@ -60,7 +60,7 @@ static __always_inline unsigned long hweight_long(unsigned long w) */ static inline __u64 rol64(__u64 word, unsigned int shift) { - return (word << shift) | (word >> (64 - shift)); + return (word << (shift & 63)) | (word >> ((-shift) & 63)); } /** @@ -70,7 +70,7 @@ static inline __u64 rol64(__u64 word, unsigned int shift) */ static inline __u64 ror64(__u64 word, unsigned int shift) { - return (word >> shift) | (word << (64 - shift)); + return (word >> (shift & 63)) | (word << ((-shift) & 63)); } /** @@ -80,7 +80,7 @@ static inline __u64 ror64(__u64 word, unsigned int shift) */ static inline __u32 rol32(__u32 word, unsigned int shift) { - return (word << shift) | (word >> ((-shift) & 31)); + return (word << (shift & 31)) | (word >> ((-shift) & 31)); } /** @@ -90,7 +90,7 @@ static inline __u32 rol32(__u32 word, unsigned int shift) */ static inline __u32 ror32(__u32 word, unsigned int shift) { - return (word >> shift) | (word << (32 - shift)); + return (word >> (shift & 31)) | (word << ((-shift) & 31)); } /** @@ -100,7 +100,7 @@ static inline __u32 ror32(__u32 word, unsigned int shift) */ static inline __u16 rol16(__u16 word, unsigned int shift) { - return (word << shift) | (word >> (16 - shift)); + return (word << (shift & 15)) | (word >> ((-shift) & 15)); } /** @@ -110,7 +110,7 @@ static inline __u16 rol16(__u16 word, unsigned int shift) */ static inline __u16 ror16(__u16 word, unsigned int shift) { - return (word >> shift) | (word << (16 - shift)); + return (word >> (shift & 15)) | (word << ((-shift) & 15)); } /** @@ -120,7 +120,7 @@ static inline __u16 ror16(__u16 word, unsigned int shift) */ static inline __u8 rol8(__u8 word, unsigned int shift) { - return (word << shift) | (word >> (8 - shift)); + return (word << (shift & 7)) | (word >> ((-shift) & 7)); } /** @@ -130,7 +130,7 @@ static inline __u8 rol8(__u8 word, unsigned int shift) */ static inline __u8 ror8(__u8 word, unsigned int shift) { - return (word >> shift) | (word << (8 - shift)); + return (word >> (shift & 7)) | (word << ((-shift) & 7)); } /** -- 2.22.0.rc1.311.g5d7573a151-goog

5 years, 6 months

2
1
0 0

v5.0.21 build: 5 failures 8 warnings (v5.0.21)

by Build bot for Mark Brown

Tree/Branch: v5.0.21 Git describe: v5.0.21 Commit: fd1594eb70 Linux 5.0.21 Build Time: 261 min 35 sec Passed: 6 / 11 ( 54.55 %) Failed: 5 / 11 ( 45.45 %) Errors: 0 Warnings: 8 Section Mismatches: 0 Failed defconfigs: arm-multi_v5_defconfig arm-multi_v7_defconfig arm-allmodconfig arm-multi_v4t_defconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm64-allmodconfig 3 warnings 0 mismatches : arm-multi_v5_defconfig 4 warnings 0 mismatches : arm-multi_v7_defconfig 7 warnings 0 mismatches : arm-allmodconfig 3 warnings 0 mismatches : arm-multi_v4t_defconfig 3 warnings 0 mismatches : x86_64-allmodconfig 1 warnings 0 mismatches : arm64-defconfig ------------------------------------------------------------------------------- Warnings Summary: 8 8 ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] 5 ../include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] 4 ../drivers/regulator/core.c:4798:38: warning: array subscript is above array bounds [-Warray-bounds] 1 ../samples/seccomp/user-trap.c:83:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] 1 ../samples/seccomp/user-trap.c:50:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] 1 ../drivers/staging/erofs/unzip_vle.c:268:29: warning: array subscript is above array bounds [-Warray-bounds] 1 ../drivers/scsi/myrs.c:821:24: warning: 'sshdr.sense_key' may be used uninitialized in this function [-Wmaybe-uninitialized] 1 ../drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:221:1: warning: the frame size of 1096 bytes is larger than 1024 bytes [-Wframe-larger-than=] =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm64-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- arm-multi_v5_defconfig : FAIL, 0 errors, 3 warnings, 0 section mismatches Warnings: ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:4798:38: warning: array subscript is above array bounds [-Warray-bounds] ------------------------------------------------------------------------------- arm-multi_v7_defconfig : FAIL, 0 errors, 4 warnings, 0 section mismatches Warnings: ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:4798:38: warning: array subscript is above array bounds [-Warray-bounds] ../include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 7 warnings, 0 section mismatches Warnings: ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:4798:38: warning: array subscript is above array bounds [-Warray-bounds] ../include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] ../drivers/staging/erofs/unzip_vle.c:268:29: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:221:1: warning: the frame size of 1096 bytes is larger than 1024 bytes [-Wframe-larger-than=] ../drivers/scsi/myrs.c:821:24: warning: 'sshdr.sense_key' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- arm-multi_v4t_defconfig : FAIL, 0 errors, 3 warnings, 0 section mismatches Warnings: ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:244:45: warning: array subscript is above array bounds [-Warray-bounds] ../drivers/regulator/core.c:4798:38: warning: array subscript is above array bounds [-Warray-bounds] ------------------------------------------------------------------------------- x86_64-allmodconfig : PASS, 0 errors, 3 warnings, 0 section mismatches Warnings: ../samples/seccomp/user-trap.c:50:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] ../samples/seccomp/user-trap.c:83:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] ../include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- arm64-defconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../include/linux/spinlock.h:279:3: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: x86_64-allnoconfig arm64-allnoconfig arm-allnoconfig x86_64-defconfig

5 years, 6 months

1
0
0 0

[GIT PULL] pstore fixes for v5.2-rc4

by Kees Cook

Hi Linus, Please pull these pstore fixes for v5.2-rc4. They've been in linux-next for a bit now and catch some pstore corner cases found recently. Thanks! -Kees The following changes since commit a188339ca5a396acc588e5851ed7e19f66b0ebd9: Linux 5.2-rc1 (2019-05-19 15:47:09 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/pstore-v5.2-rc4 for you to fetch changes up to 8880fa32c557600f5f624084152668ed3c2ea51e: pstore/ram: Run without kernel crash dump region (2019-05-31 01:19:06 -0700) ---------------------------------------------------------------- pstore fixes for v5.2-rc4 - Avoid NULL deref when unloading/reloading ramoops module (Pi-Hsun Shih) - Run ramoops without crash dump region ---------------------------------------------------------------- Kees Cook (1): pstore/ram: Run without kernel crash dump region Pi-Hsun Shih (1): pstore: Set tfm to NULL on free_buf_for_compression fs/pstore/platform.c | 7 +++++-- fs/pstore/ram.c | 36 +++++++++++++++++++++++------------- 2 files changed, 28 insertions(+), 15 deletions(-) -- Kees Cook

5 years, 6 months

2
1
0 0

Re: [PATCH] x86/build: Move _etext to actual end of .text

by Kees Cook

On Wed, Jun 05, 2019 at 11:08:13AM -0500, Alec Ari wrote: > I'm having this problem too, build is failing: > > Invalid absolute R_X86_64_32S relocation: _etext > > I stayed on the 4.14 branch to help prevent these kind of breakages, > so much for that idea. Gentoo GCC 8.3.0. It seems to be a problem with the Gold linker. Using ld.bfd appears to work. I haven't narrowed down the problem, unfortunately. Greg, given that this change was only for special situations (Clang CFI), can you revert this for the stable trees? -- Kees Cook

5 years, 6 months

2
1
0 0

Re: [stable] binder: fix race between munmap() and direct reclaim

by Todd Kjos

Greg, I'm really confused. [1] was my submittal to stable for "binder: fix race between munmap() and direct reclaim" which I think looks correct. For "binder: fix handling of misaligned binder object", I only submitted to LKML [2]. But then I see [3] for 4.14 (that looks incorrect as Ben pointed out). So the result is that fix is present in the LTS trees where it is needed, but it has the wrong commit message and headline. I agree with Ben that the cleanest approach is to revert and apply the correct version (to 4.14, 4.19, 5.0). I think the correct version is the one I sent [1], but please let me know if you see something I screwed up or if you need me to do something. [1] https://www.spinics.net/lists/stable/msg299033.html [2] https://lkml.org/lkml/2019/2/14/1235 [3] https://lkml.org/lkml/2019/4/30/650 -Todd On Tue, May 28, 2019 at 9:34 AM Todd Kjos <tkjos(a)google.com> wrote: > > Probably my screw-up. I was working on both of those bug fixes at about the same time. I'll investigate what happened. > > On Mon, May 27, 2019 at 11:51 PM Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> wrote: >> >> On Mon, May 27, 2019 at 10:09:32PM +0100, Ben Hutchings wrote: >> > There are commits in the 4.14, 4.19 and 5.0 stable branches that claim >> > to be backports of: >> > >> > commit 26528be6720bb40bc8844e97ee73a37e530e9c5e >> > Author: Todd Kjos <tkjos(a)android.com> >> > Date: Thu Feb 14 15:22:57 2019 -0800 >> > >> > binder: fix handling of misaligned binder object >> > >> > However the source changes actually match: >> > >> > commit 5cec2d2e5839f9c0fec319c523a911e0a7fd299f >> > Author: Todd Kjos <tkjos(a)android.com> >> > Date: Fri Mar 1 15:06:06 2019 -0800 >> > >> > binder: fix race between munmap() and direct reclaim >> > >> > So far as I can see, the former fixes a bug only introduced in 5.1 and >> > the latter fixes an older bug, so the changes are correct and only the >> > metadata is not. >> > >> > Similar mix-ups have happened before and I'm a little disturbed that >> > this keeps happening. In any case, you may want to revert and re-apply >> > with correct metadata. >> >> Note, these backports came directly from Todd, so he can provide more >> information about them. Todd, did something get messed up on your end >> and do we need to include another patch to fix this up? >> >> thanks, >> >> greg k-h

5 years, 6 months

2
3
0 0

[PATCH 5.0 1/2] Revert "binder: fix handling of misaligned binder object"

by Todd Kjos

This reverts commit bbb19ca082ce27ce60ca65be016a951806ea947c. The commit message is for a different patch. Reverting and then adding the same patch back with the correct commit message. Cc: stable <stable(a)vger.kernel.org> # 5.0 Signed-off-by: Todd Kjos <tkjos(a)google.com> --- drivers/android/binder_alloc.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index a6e556bf62dff..022cd80e80cc3 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -959,13 +959,14 @@ enum lru_status binder_alloc_free_page(struct list_head *item, index = page - alloc->pages; page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE; - - mm = alloc->vma_vm_mm; - if (!mmget_not_zero(mm)) - goto err_mmget; - if (!down_write_trylock(&mm->mmap_sem)) - goto err_down_write_mmap_sem_failed; vma = binder_alloc_get_vma(alloc); + if (vma) { + if (!mmget_not_zero(alloc->vma_vm_mm)) + goto err_mmget; + mm = alloc->vma_vm_mm; + if (!down_write_trylock(&mm->mmap_sem)) + goto err_down_write_mmap_sem_failed; + } list_lru_isolate(lru, item); spin_unlock(lock); @@ -978,9 +979,10 @@ enum lru_status binder_alloc_free_page(struct list_head *item, PAGE_SIZE); trace_binder_unmap_user_end(alloc, index); + + up_write(&mm->mmap_sem); + mmput(mm); } - up_write(&mm->mmap_sem); - mmput(mm); trace_binder_unmap_kernel_start(alloc, index); -- 2.22.0.rc1.311.g5d7573a151-goog

5 years, 6 months

1
1
0 0

[PATCH 4.19 1/2] Revert "binder: fix handling of misaligned binder object"

by Todd Kjos

This reverts commit 6bf7d3c5c0c5dad650bfc4345ed553c18b69d59e. The commit message is for a different patch. Reverting and then adding the same patch back with the correct commit message. Cc: stable <stable(a)vger.kernel.org> # 4.19 Signed-off-by: Todd Kjos <tkjos(a)google.com> --- drivers/android/binder_alloc.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index a654ccfd1a222..030c98f35cca7 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -958,13 +958,14 @@ enum lru_status binder_alloc_free_page(struct list_head *item, index = page - alloc->pages; page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE; - - mm = alloc->vma_vm_mm; - if (!mmget_not_zero(mm)) - goto err_mmget; - if (!down_write_trylock(&mm->mmap_sem)) - goto err_down_write_mmap_sem_failed; vma = binder_alloc_get_vma(alloc); + if (vma) { + if (!mmget_not_zero(alloc->vma_vm_mm)) + goto err_mmget; + mm = alloc->vma_vm_mm; + if (!down_write_trylock(&mm->mmap_sem)) + goto err_down_write_mmap_sem_failed; + } list_lru_isolate(lru, item); spin_unlock(lock); @@ -977,9 +978,10 @@ enum lru_status binder_alloc_free_page(struct list_head *item, PAGE_SIZE); trace_binder_unmap_user_end(alloc, index); + + up_write(&mm->mmap_sem); + mmput(mm); } - up_write(&mm->mmap_sem); - mmput(mm); trace_binder_unmap_kernel_start(alloc, index); -- 2.22.0.rc1.311.g5d7573a151-goog

5 years, 6 months

1
1
0 0

[PATCH 4.14 1/2] Revert "binder: fix handling of misaligned binder object"

by Todd Kjos

This reverts commit 33c6b9ca70a8b066a613e2a3d0331ae8f82aa31a. The commit message is for a different patch. Reverting and then adding the same patch back with the correct commit message. Cc: stable <stable(a)vger.kernel.org> # 4.14 Signed-off-by: Todd Kjos <tkjos(a)google.com> --- drivers/android/binder_alloc.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index e0b0399ff7ec8..b9281f2725a6a 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -945,13 +945,14 @@ enum lru_status binder_alloc_free_page(struct list_head *item, index = page - alloc->pages; page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE; - - mm = alloc->vma_vm_mm; - if (!mmget_not_zero(mm)) - goto err_mmget; - if (!down_write_trylock(&mm->mmap_sem)) - goto err_down_write_mmap_sem_failed; vma = binder_alloc_get_vma(alloc); + if (vma) { + if (!mmget_not_zero(alloc->vma_vm_mm)) + goto err_mmget; + mm = alloc->vma_vm_mm; + if (!down_write_trylock(&mm->mmap_sem)) + goto err_down_write_mmap_sem_failed; + } list_lru_isolate(lru, item); spin_unlock(lock); @@ -964,9 +965,10 @@ enum lru_status binder_alloc_free_page(struct list_head *item, PAGE_SIZE); trace_binder_unmap_user_end(alloc, index); + + up_write(&mm->mmap_sem); + mmput(mm); } - up_write(&mm->mmap_sem); - mmput(mm); trace_binder_unmap_kernel_start(alloc, index); -- 2.22.0.rc1.311.g5d7573a151-goog

5 years, 6 months

1
1
0 0

[PATCH 2/2] drm/i915/dsi: Use a fuzzy check for burst mode clock check

by Hans de Goede

Prior to this commit we fail to init the DSI panel on the GPD MicroPC: https://www.indiegogo.com/projects/gpd-micropc-6-inch-handheld-industry-lap… The problem is intel_dsi_vbt_init() failing with the following error: *ERROR* Burst mode freq is less than computed The pclk in the VBT panel modeline is 70000, together with 24 bpp and 4 lines this results in a bitrate value of 70000 * 24 / 4 = 420000. But the target_burst_mode_freq in the VBT is 418000. This commit works around this problem by adding an intel_fuzzy_clock_check when target_burst_mode_freq < bitrate and setting target_burst_mode_freq to bitrate when that checks succeeds, fixing the panel not working. Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/gpu/drm/i915/intel_dsi_vbt.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/i915/intel_dsi_vbt.c b/drivers/gpu/drm/i915/intel_dsi_vbt.c index 022bf59418df..a2a9b9d0eeaa 100644 --- a/drivers/gpu/drm/i915/intel_dsi_vbt.c +++ b/drivers/gpu/drm/i915/intel_dsi_vbt.c @@ -895,6 +895,17 @@ bool intel_dsi_vbt_init(struct intel_dsi *intel_dsi, u16 panel_id) if (mipi_config->target_burst_mode_freq) { u32 bitrate = intel_dsi_bitrate(intel_dsi); + /* + * Sometimes the VBT contains a slightly lower clock, + * then the bitrate we have calculated, in this case + * just replace it with the calculated bitrate. + */ + if (mipi_config->target_burst_mode_freq < bitrate && + intel_fuzzy_clock_check( + mipi_config->target_burst_mode_freq, + bitrate)) + mipi_config->target_burst_mode_freq = bitrate; + if (mipi_config->target_burst_mode_freq < bitrate) { DRM_ERROR("Burst mode freq is less than computed\n"); return false; -- 2.21.0

5 years, 6 months

2
2
0 0

[PATCH 1/4] Revert "HID: Increase maximum report size allowed by hid_field_extract()"

by Benjamin Tissoires

This reverts commit 94a9992f7dbdfb28976b565af220e0c4a117144a. The commit allows for more than 32 bits in hid_field_extract(), but the return value is a 32 bits int. So basically what this commit is doing is just silencing those legitimate errors. Revert to a previous situation in the hope that a proper fix will be impletemented. Fixes: 94a9992f7dbd ("HID: Increase maximum report size allowed by hid_field_extract()") Cc: stable(a)vger.kernel.org # v5.1 Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> --- drivers/hid/hid-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 08d310723e96..205d6b82a706 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1311,10 +1311,10 @@ static u32 __extract(u8 *report, unsigned offset, int n) u32 hid_field_extract(const struct hid_device *hid, u8 *report, unsigned offset, unsigned n) { - if (n > 256) { - hid_warn(hid, "hid_field_extract() called with n (%d) > 256! (%s)\n", + if (n > 32) { + hid_warn(hid, "hid_field_extract() called with n (%d) > 32! (%s)\n", n, current->comm); - n = 256; + n = 32; } return __extract(report, offset, n); -- 2.19.2

5 years, 6 months

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror June 2019