January 2020 - Linux-stable-mirror

[PATCH] USB: serial: suppress driver bind attributes

by Johan Hovold

USB-serial drivers must not be unbound from their ports before the corresponding USB driver is unbound from the parent interface so suppress the bind and unbind attributes. Unbinding a serial driver while it's port is open is a sure way to trigger a crash as any driver state is released on unbind while port hangup is handled on the parent USB interface level. Drivers for multiport devices where ports share a resource such as an interrupt endpoint also generally cannot handle individual ports going away. Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/usb-serial.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c index 8f066bb55d7d..dc7a65b9ec98 100644 --- a/drivers/usb/serial/usb-serial.c +++ b/drivers/usb/serial/usb-serial.c @@ -1317,6 +1317,9 @@ static int usb_serial_register(struct usb_serial_driver *driver) return -EINVAL; } + /* Prevent individual ports from being unbound. */ + driver->driver.suppress_bind_attrs = true; + usb_serial_operations_init(driver); /* Add this device to our list of devices */ -- 2.24.1

4 years, 11 months

2
4
0 0

[PATCH v2] locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN

by Waiman Long

The commit 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") will allow a recently woken up waiting writer to spin on the owner. Unfortunately, if the owner happens to be RWSEM_OWNER_UNKNOWN, the code will incorrectly spin on it leading to a kernel crash. This is fixed by passing the proper non-spinnable bits to rwsem_spin_on_owner() so that RWSEM_OWNER_UNKNOWN will be treated as a non-spinnable target. Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") Reported-by: Christoph Hellwig <hch(a)lst.de> Tested-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Waiman Long <longman(a)redhat.com> --- kernel/locking/rwsem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c index 44e68761f432..0d9b6be9ecc8 100644 --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -1226,8 +1226,8 @@ rwsem_down_write_slowpath(struct rw_semaphore *sem, int state) * In this case, we attempt to acquire the lock again * without sleeping. */ - if ((wstate == WRITER_HANDOFF) && - (rwsem_spin_on_owner(sem, 0) == OWNER_NULL)) + if (wstate == WRITER_HANDOFF && + rwsem_spin_on_owner(sem, RWSEM_NONSPINNABLE) == OWNER_NULL) goto trylock_again; /* Block until there are no active lockers. */ -- 2.18.1

4 years, 11 months

2
1
0 0

[PATCH 4/5] USB: serial: keyspan: handle unbound ports

by Johan Hovold

Check for NULL port data in the control URB completion handlers to avoid dereferencing a NULL pointer in the unlikely case where a port device isn't bound to a driver (e.g. after an allocation failure on port probe()). Fixes: 0ca1268e109a ("USB Serial Keyspan: add support for USA-49WG & USA-28XG") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/keyspan.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c index e66a59ef43a1..aa3dbce22cfb 100644 --- a/drivers/usb/serial/keyspan.c +++ b/drivers/usb/serial/keyspan.c @@ -1058,6 +1058,8 @@ static void usa49_glocont_callback(struct urb *urb) for (i = 0; i < serial->num_ports; ++i) { port = serial->port[i]; p_priv = usb_get_serial_port_data(port); + if (!p_priv) + continue; if (p_priv->resend_cont) { dev_dbg(&port->dev, "%s - sending setup\n", __func__); @@ -1459,6 +1461,8 @@ static void usa67_glocont_callback(struct urb *urb) for (i = 0; i < serial->num_ports; ++i) { port = serial->port[i]; p_priv = usb_get_serial_port_data(port); + if (!p_priv) + continue; if (p_priv->resend_cont) { dev_dbg(&port->dev, "%s - sending setup\n", __func__); -- 2.24.1

4 years, 11 months

1
0
0 0

[PATCH 3/5] USB: serial: io_edgeport: add missing active-port sanity check

by Johan Hovold

The driver receives the active port number from the device, but never made sure that the port number was valid. This could lead to a NULL-pointer dereference or memory corruption in case a device sends data for an invalid port. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/io_edgeport.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index 0582d78bdb1d..5737add6a2a4 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -1725,7 +1725,8 @@ static void edge_break(struct tty_struct *tty, int break_state) static void process_rcvd_data(struct edgeport_serial *edge_serial, unsigned char *buffer, __u16 bufferLength) { - struct device *dev = &edge_serial->serial->dev->dev; + struct usb_serial *serial = edge_serial->serial; + struct device *dev = &serial->dev->dev; struct usb_serial_port *port; struct edgeport_port *edge_port; __u16 lastBufferLength; @@ -1821,9 +1822,8 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial, /* spit this data back into the tty driver if this port is open */ - if (rxLen) { - port = edge_serial->serial->port[ - edge_serial->rxPort]; + if (rxLen && edge_serial->rxPort < serial->num_ports) { + port = serial->port[edge_serial->rxPort]; edge_port = usb_get_serial_port_data(port); if (edge_port && edge_port->open) { dev_dbg(dev, "%s - Sending %d bytes to TTY for port %d\n", @@ -1833,8 +1833,8 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial, rxLen); edge_port->port->icount.rx += rxLen; } - buffer += rxLen; } + buffer += rxLen; break; case EXPECT_HDR3: /* Expect 3rd byte of status header */ @@ -1869,6 +1869,8 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial, __u8 code = edge_serial->rxStatusCode; /* switch the port pointer to the one being currently talked about */ + if (edge_serial->rxPort >= edge_serial->serial->num_ports) + return; port = edge_serial->serial->port[edge_serial->rxPort]; edge_port = usb_get_serial_port_data(port); if (edge_port == NULL) { -- 2.24.1

4 years, 11 months

1
0
0 0

[PATCH 2/5] USB: serial: io_edgeport: handle unbound ports on URB completion

by Johan Hovold

Check for NULL port data in the shared interrupt and bulk completion callbacks to avoid dereferencing a NULL pointer in case a device sends data for a port device which isn't bound to a driver (e.g. due to a malicious device having unexpected endpoints or after an allocation failure on port probe). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/io_edgeport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index 9690a5f4b9d6..0582d78bdb1d 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -716,7 +716,7 @@ static void edge_interrupt_callback(struct urb *urb) if (txCredits) { port = edge_serial->serial->port[portNumber]; edge_port = usb_get_serial_port_data(port); - if (edge_port->open) { + if (edge_port && edge_port->open) { spin_lock_irqsave(&edge_port->ep_lock, flags); edge_port->txCredits += txCredits; @@ -1825,7 +1825,7 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial, port = edge_serial->serial->port[ edge_serial->rxPort]; edge_port = usb_get_serial_port_data(port); - if (edge_port->open) { + if (edge_port && edge_port->open) { dev_dbg(dev, "%s - Sending %d bytes to TTY for port %d\n", __func__, rxLen, edge_serial->rxPort); -- 2.24.1

4 years, 11 months

1
0
0 0

[PATCH 1/5] USB: ch341: handle unbound port at reset_resume

by Johan Hovold

Check for NULL port data in reset_resume() to avoid dereferencing a NULL pointer in case the port device isn't bound to a driver (e.g. after a failed control request at port probe). Fixes: 1ded7ea47b88 ("USB: ch341 serial: fix port number changed after resume") Cc: stable <stable(a)vger.kernel.org> # 2.6.30 Signed-off-by: Johan Hovold <johan(a)kernel.org> --- drivers/usb/serial/ch341.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c index df582fe855f0..d3f420f3a083 100644 --- a/drivers/usb/serial/ch341.c +++ b/drivers/usb/serial/ch341.c @@ -642,9 +642,13 @@ static int ch341_tiocmget(struct tty_struct *tty) static int ch341_reset_resume(struct usb_serial *serial) { struct usb_serial_port *port = serial->port[0]; - struct ch341_private *priv = usb_get_serial_port_data(port); + struct ch341_private *priv; int ret; + priv = usb_get_serial_port_data(port); + if (!priv) + return 0; + /* reconfigure ch341 serial port after bus-reset */ ch341_configure(serial->dev, priv); -- 2.24.1

4 years, 11 months

1
0
0 0

[PATCH v1 1/2] scsi: ufs: set device as default active power mode during initialization only

by Stanley Chu

Currently ufshcd_probe_hba() always sets device status as "active". This shall be by an assumption that device is already in active state during the boot stage before kernel. However, if link is configured as "off" state and device is requested to enter "sleep" or "powerdown" power mode during suspend flow, device will NOT be waken up to "active" power mode during resume flow because device is already set as "active" power mode in ufhcd_probe_hba(). Fix it by setting device as default active power mode during initialization only, and skipping changing mode during PM flow in ufshcd_probe_hba(). Fixes: 7caf489b99a4 (scsi: ufs: issue link starup 2 times if device isn't active) Cc: Alim Akhtar <alim.akhtar(a)samsung.com> Cc: Avri Altman <avri.altman(a)wdc.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: Bean Huo <beanhuo(a)micron.com> Cc: Can Guo <cang(a)codeaurora.org> Cc: Matthias Brugger <matthias.bgg(a)gmail.com> Cc: Subhash Jadavani <subhashj(a)codeaurora.org> Cc: stable(a)vger.kernel.org Signed-off-by: Stanley Chu <stanley.chu(a)mediatek.com> --- drivers/scsi/ufs/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index ed02a704c1c2..9abb7085a5d0 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -6986,7 +6986,8 @@ static int ufshcd_probe_hba(struct ufs_hba *hba) ufshcd_tune_unipro_params(hba); /* UFS device is also active now */ - ufshcd_set_ufs_dev_active(hba); + if (!hba->pm_op_in_progress) + ufshcd_set_ufs_dev_active(hba); ufshcd_force_reset_auto_bkops(hba); hba->wlun_dev_clr_ua = true; -- 2.18.0

4 years, 11 months

4
12
0 0

stable-rc/linux-4.19.y boot: 62 boots: 1 failed, 60 passed with 1 untried/unknown (v4.19.96-85-ge301315724e2)

by kernelci.org bot

stable-rc/linux-4.19.y boot: 62 boots: 1 failed, 60 passed with 1 untried/unknown (v4.19.96-85-ge301315724e2) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.19.y/kernel/v4.1… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.19.y/kernel/v4.19.96-85… Tree: stable-rc Branch: linux-4.19.y Git Describe: v4.19.96-85-ge301315724e2 Git Commit: e301315724e25ac136c78f10a08928c03bdf7466 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 34 unique boards, 13 SoC families, 13 builds out of 202 Boot Regressions Detected: arm: multi_v7_defconfig: gcc-8: am335x-boneblack: lab-baylibre: new failure (last pass: v4.19.96-50-g3904aafeda38) Boot Failure Detected: arm: multi_v7_defconfig: gcc-8: am335x-boneblack: 1 failed lab --- For more info write to <info(a)kernelci.org>

4 years, 11 months

1
0
0 0

stable-rc/linux-4.9.y boot: 57 boots: 1 failed, 55 passed with 1 untried/unknown (v4.9.210-51-gea9d393b74c1)

by kernelci.org bot

stable-rc/linux-4.9.y boot: 57 boots: 1 failed, 55 passed with 1 untried/unknown (v4.9.210-51-gea9d393b74c1) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.210-51-… Tree: stable-rc Branch: linux-4.9.y Git Describe: v4.9.210-51-gea9d393b74c1 Git Commit: ea9d393b74c1b6575db4c77c74dfbf398e95b646 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 31 unique boards, 12 SoC families, 12 builds out of 190 Boot Regressions Detected: arm: multi_v7_defconfig: gcc-8: omap3-beagle-xm: lab-baylibre: failing since 1 day (last pass: v4.9.208-80-gad5b4ae368f7 - first fail: v4.9.210-32-g2e5db6b9d1e9) versatile_defconfig: gcc-8: versatile-pb: lab-collabora: new failure (last pass: v4.9.210-32-g2e5db6b9d1e9) Boot Failure Detected: arm: multi_v7_defconfig: gcc-8: omap3-beagle-xm: 1 failed lab --- For more info write to <info(a)kernelci.org>

4 years, 11 months

1
0
0 0

stable-rc/linux-4.4.y boot: 81 boots: 0 failed, 76 passed with 5 offline (v4.4.210-40-g10cbf6496fe2)

by kernelci.org bot

stable-rc/linux-4.4.y boot: 81 boots: 0 failed, 76 passed with 5 offline (v4.4.210-40-g10cbf6496fe2) Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.… Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.210-40-… Tree: stable-rc Branch: linux-4.4.y Git Describe: v4.4.210-40-g10cbf6496fe2 Git Commit: 10cbf6496fe262d809f05cd252925a85dd2072fa Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Tested: 43 unique boards, 15 SoC families, 14 builds out of 181 Offline Platforms: arm: sunxi_defconfig: gcc-8 sun5i-r8-chip: 1 offline lab bcm2835_defconfig: gcc-8 bcm2835-rpi-b: 1 offline lab multi_v7_defconfig: gcc-8 socfpga_cyclone5_de0_sockit: 1 offline lab sun5i-r8-chip: 1 offline lab davinci_all_defconfig: gcc-8 dm365evm,legacy: 1 offline lab --- For more info write to <info(a)kernelci.org>

4 years, 11 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2020