March 2021 - Linux-stable-mirror

[PATCH v5 01/13] phy: cadence: Sierra: Fix PHY power_on sequence

by Kishon Vijay Abraham I

Commit 44d30d622821d ("phy: cadence: Add driver for Sierra PHY") de-asserts PHY_RESET even before the configurations are loaded in phy_init(). However PHY_RESET should be de-asserted only after all the configurations has been initialized, instead of de-asserting in probe. Fix it here. Fixes: 44d30d622821d ("phy: cadence: Add driver for Sierra PHY") Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com> Cc: <stable(a)vger.kernel.org> # v5.4+ Reviewed-by: Philipp Zabel <p.zabel(a)pengutronix.de> --- drivers/phy/cadence/phy-cadence-sierra.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/phy/cadence/phy-cadence-sierra.c b/drivers/phy/cadence/phy-cadence-sierra.c index 26a0badabe38..19f32ae877b9 100644 --- a/drivers/phy/cadence/phy-cadence-sierra.c +++ b/drivers/phy/cadence/phy-cadence-sierra.c @@ -319,6 +319,12 @@ static int cdns_sierra_phy_on(struct phy *gphy) u32 val; int ret; + ret = reset_control_deassert(sp->phy_rst); + if (ret) { + dev_err(dev, "Failed to take the PHY out of reset\n"); + return ret; + } + /* Take the PHY lane group out of reset */ ret = reset_control_deassert(ins->lnk_rst); if (ret) { @@ -616,7 +622,6 @@ static int cdns_sierra_phy_probe(struct platform_device *pdev) pm_runtime_enable(dev); phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); - reset_control_deassert(sp->phy_rst); return PTR_ERR_OR_ZERO(phy_provider); put_child: -- 2.17.1

3 years, 10 months

1
0
0 0

stable-rc/queue/4.19 baseline: 149 runs, 6 regressions (v4.19.178-71-g265578f5dd1f)

by kernelci.org bot

stable-rc/queue/4.19 baseline: 149 runs, 6 regressions (v4.19.178-71-g265578f5dd1f) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ panda | arm | lab-collabora | gcc-8 | omap2plus_defconfig | 1 qemu_arm-versatilepb | arm | lab-baylibre | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-broonie | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-cip | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-collabora | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-linaro-lkft | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.19/kernel/v4.19.17… Test: baseline Tree: stable-rc Branch: queue/4.19 Describe: v4.19.178-71-g265578f5dd1f URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 265578f5dd1fe465bb09b958af3f964ddd3209c3 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ panda | arm | lab-collabora | gcc-8 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/604578412ed1258319addcb1 Results: 4 PASS, 1 FAIL, 0 SKIP Full config: omap2plus_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.dmesg.emerg: https://kernelci.org/test/case/id/604578412ed1258319addcb6 new failure (last pass: v4.19.178-68-gb96cdc01d592) 2 lines 2021-03-08 01:05:00.252000+00:00 kern :emerg : lock: emif_lock+0x0/0xffffed34 [emif], .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-baylibre | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457666cc1cb86b2faddce2 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457666cc1cb86b2faddce3 failing since 114 days (last pass: v4.19.157-26-gd59f3161b3a0, first fail: v4.19.157-27-g5543cc2c41d55) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-broonie | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457a030e550239edaddcb5 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457a030e550239edaddcb6 failing since 114 days (last pass: v4.19.157-26-gd59f3161b3a0, first fail: v4.19.157-27-g5543cc2c41d55) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-cip | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/604586c3ee22a2c507addd2d Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604586c3ee22a2c507addd2e failing since 114 days (last pass: v4.19.157-26-gd59f3161b3a0, first fail: v4.19.157-27-g5543cc2c41d55) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-collabora | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/604575e849d982e046addcc7 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604575e849d982e046addcc8 failing since 114 days (last pass: v4.19.157-26-gd59f3161b3a0, first fail: v4.19.157-27-g5543cc2c41d55) platform | arch | lab | compiler | defconfig | regressions ---------------------+------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-linaro-lkft | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457bdfe5f622855daddd13 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.178-71-g265578f5dd… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457bdfe5f622855daddd14 failing since 114 days (last pass: v4.19.157-26-gd59f3161b3a0, first fail: v4.19.157-27-g5543cc2c41d55)

3 years, 10 months

1
0
0 0

stable-rc/queue/5.10 baseline: 171 runs, 2 regressions (v5.10.20-139-g399d512602cb1)

by kernelci.org bot

stable-rc/queue/5.10 baseline: 171 runs, 2 regressions (v5.10.20-139-g399d512602cb1) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -------------------------+------+--------------+----------+--------------------+------------ imx6q-var-dt6customboard | arm | lab-baylibre | gcc-8 | multi_v7_defconfig | 2 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.10/kernel/v5.10.20… Test: baseline Tree: stable-rc Branch: queue/5.10 Describe: v5.10.20-139-g399d512602cb1 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 399d512602cb11f2c5636b0c9218cad1f9d20009 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -------------------------+------+--------------+----------+--------------------+------------ imx6q-var-dt6customboard | arm | lab-baylibre | gcc-8 | multi_v7_defconfig | 2 Details: https://kernelci.org/test/plan/id/604578f579fb643de5addcbf Results: 3 PASS, 2 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.20-139-g399d512602… HTML log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.20-139-g399d512602… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.dmesg.alert: https://kernelci.org/test/case/id/604578f579fb643de5addcc3 new failure (last pass: v5.10.20-131-gc7f3b8dd767e) 4 lines 2021-03-08 01:07:51.180000+00:00 kern :alert : Unable to handle kernel NULL pointer dereference at virtual address 00000313 2021-03-08 01:07:51.180000+00:00 kern :alert : pgd = (ptrval)<8>[ 39.689952] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=alert RESULT=fail UNITS=lines MEASUREMENT=4> 2021-03-08 01:07:51.181000+00:00 2021-03-08 01:07:51.181000+00:00 kern :alert : [00000313] *pgd=00000000 * baseline.dmesg.emerg: https://kernelci.org/test/case/id/604578f579fb643de5addcc4 new failure (last pass: v5.10.20-131-gc7f3b8dd767e) 47 lines 2021-03-08 01:07:51.232000+00:00 kern :emerg : Process kworker/3:1 (pid: 53, stack limit = 0x(ptrval)) 2021-03-08 01:07:51.233000+00:00 kern :emerg : Stack: (0xc2443d58 to 0xc2444000) 2021-03-08 01:07:51.233000+00:00 kern :emerg : 3d40: c36835b0 c36835b4 2021-03-08 01:07:51.233000+00:00 kern :emerg : 3d60: c3683400 c3683414 c1449398 c09bf1a4 c2442000 ef86c320 c09c0564 c3683400 2021-03-08 01:07:51.234000+00:00 kern :emerg : 3d80: 000002f3 0000000c c19c7724 c2001d80 c3a1ac00 ef86c340 c09cc8fc c1449398 2021-03-08 01:07:51.275000+00:00 kern :emerg : 3da0: c19c7708 3d5adbdf c19c7724 c3a19540 c323be00 c3683400 c3683414 c1449398 2021-03-08 01:07:51.276000+00:00 kern :emerg : 3dc0: c19c7708 0000000c c19c7724 c09cc8cc c14470c0 00000000 c368340c c3683400 2021-03-08 01:07:51.276000+00:00 kern :emerg : 3de0: fffffdfb c22d8c10 c3b15840 c09a27f4 c3683400 bf026000 fffffdfb bf022138 2021-03-08 01:07:51.276000+00:00 kern :emerg : 3e00: c3a16bc0 c3b85908 00000120 c3b099c0 c3b15840 c09fc328 c3a16bc0 c3a16bc0 2021-03-08 01:07:51.277000+00:00 kern :emerg : 3e20: 00000040 c3a16bc0 c3b15840 00000000 c19c771c bf067084 bf068014 00000018 ... (33 line(s) more)

3 years, 10 months

1
0
0 0

stable-rc/queue/4.4 baseline: 105 runs, 12 regressions (v4.4.259-35-gaa7c5505201ed)

by kernelci.org bot

stable-rc/queue/4.4 baseline: 105 runs, 12 regressions (v4.4.259-35-gaa7c5505201ed) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ panda | arm | lab-collabora | gcc-8 | omap2plus_defconfig | 1 qemu_arm-virt-gicv2 | arm | lab-baylibre | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv2 | arm | lab-broonie | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv2 | arm | lab-cip | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv2 | arm | lab-collabora | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv2 | arm | lab-linaro-lkft | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv3 | arm | lab-baylibre | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv3 | arm | lab-broonie | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv3 | arm | lab-cip | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv3 | arm | lab-collabora | gcc-8 | multi_v7_defconfig | 1 qemu_arm-virt-gicv3 | arm | lab-linaro-lkft | gcc-8 | multi_v7_defconfig | 1 qemu_x86_64-uefi | x86_64 | lab-baylibre | gcc-8 | x86_64_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.4/kernel/v4.4.259-… Test: baseline Tree: stable-rc Branch: queue/4.4 Describe: v4.4.259-35-gaa7c5505201ed URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: aa7c5505201ed174eb1424b161b3eb32a4fc6452 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ panda | arm | lab-collabora | gcc-8 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/604570035b0e9ddafcaddcba Results: 3 PASS, 1 FAIL, 1 SKIP Full config: omap2plus_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.dmesg.emerg: https://kernelci.org/test/case/id/604570035b0e9ddafcaddcbf failing since 1 day (last pass: v4.4.259-30-g62260e4c9abb1, first fail: v4.4.259-30-gb1fda807d9697) 2 lines 2021-03-08 00:29:51.785000+00:00 kern :emerg : lock: emif_lock+0x0/0xfffff26c [emif], .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv2 | arm | lab-baylibre | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/6045727d8909721b42addcba Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/6045727d8909721b42addcbb failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv2 | arm | lab-broonie | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/604574764872fe9541addd16 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604574764872fe9541addd17 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv2 | arm | lab-cip | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457c6e282c6590fcaddcb1 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457c6e282c6590fcaddcb2 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv2 | arm | lab-collabora | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/604571c6ee201925d0addcc4 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604571c6ee201925d0addcc5 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv2 | arm | lab-linaro-lkft | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457ac38063f8b842addcc3 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457ac38063f8b842addcc4 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv3 | arm | lab-baylibre | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457292b786a1fd35addcb4 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457292b786a1fd35addcb5 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv3 | arm | lab-broonie | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/604574b215449660c0addcba Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604574b215449660c0addcbb failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv3 | arm | lab-cip | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457e17acc2cbe3cfaddcb2 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457e17acc2cbe3cfaddcb3 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv3 | arm | lab-collabora | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/604571f95549e5b11eaddcdd Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604571f95549e5b11eaddcde failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-virt-gicv3 | arm | lab-linaro-lkft | gcc-8 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/60457ac48bb412c21caddcb2 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60457ac48bb412c21caddcb3 failing since 114 days (last pass: v4.4.243-18-gfc7e8c68369a, first fail: v4.4.243-19-g71b6c961c7fe) platform | arch | lab | compiler | defconfig | regressions --------------------+--------+-----------------+----------+---------------------+------------ qemu_x86_64-uefi | x86_64 | lab-baylibre | gcc-8 | x86_64_defconfig | 1 Details: https://kernelci.org/test/plan/id/6045713d3b9e1f0389addcb1 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig Compiler: gcc-8 (gcc (Debian 8.3.0-6) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… HTML log: https://storage.kernelci.org//stable-rc/queue-4.4/v4.4.259-35-gaa7c5505201e… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/6045713d3b9e1f0389addcb2 new failure (last pass: v4.4.259-33-g7d5afb658c057)

3 years, 10 months

1
0
0 0

stable-rc/queue/4.14 baseline: 133 runs, 9 regressions (v4.14.223-46-g755149b36d91)

by kernelci.org bot

stable-rc/queue/4.14 baseline: 133 runs, 9 regressions (v4.14.223-46-g755149b36d91) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ meson-gxm-q200 | arm64 | lab-baylibre | gcc-8 | defconfig | 1 panda | arm | lab-collabora | gcc-8 | omap2plus_defconfig | 1 qemu_arm-versatilepb | arm | lab-baylibre | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-broonie | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-cip | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-collabora | gcc-8 | versatile_defconfig | 1 qemu_arm-versatilepb | arm | lab-linaro-lkft | gcc-8 | versatile_defconfig | 1 qemu_x86_64 | x86_64 | lab-baylibre | gcc-8 | x86_64_defconfig | 1 qemu_x86_64-uefi | x86_64 | lab-baylibre | gcc-8 | x86_64_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.14/kernel/v4.14.22… Test: baseline Tree: stable-rc Branch: queue/4.14 Describe: v4.14.223-46-g755149b36d91 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 755149b36d913cb156762ac55e0853f48b8c39f7 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ meson-gxm-q200 | arm64 | lab-baylibre | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/plan/id/604578f2b7abe1bb3aaddcc5 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-8 (aarch64-linux-gnu-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/604578f2b7abe1bb3aaddcc6 failing since 6 days (last pass: v4.14.222-11-g13b8482a0f700, first fail: v4.14.222-120-gdc8887cba23e) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ panda | arm | lab-collabora | gcc-8 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/60456f6bb757c24aceaddcc5 Results: 3 PASS, 1 FAIL, 1 SKIP Full config: omap2plus_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.dmesg.emerg: https://kernelci.org/test/case/id/60456f6bb757c24aceaddcca new failure (last pass: v4.14.223-44-g7f3fe97bedd97) 2 lines 2021-03-08 00:27:19.008000+00:00 kern :emerg : BUG: spinlock bad magic on CPU#0, udevd/105 2021-03-08 00:27:19.017000+00:00 kern :emerg : lock: emif_lock+0x0/0xffffed34 [emif], .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-baylibre | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/60456de02b5190f484addcb4 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60456de02b5190f484addcb5 failing since 114 days (last pass: v4.14.206-21-g787a7a3ca16c, first fail: v4.14.206-22-ga949bf40fb01) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-broonie | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/60456df86f6a8d6992addce0 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60456df86f6a8d6992addce1 failing since 114 days (last pass: v4.14.206-21-g787a7a3ca16c, first fail: v4.14.206-22-ga949bf40fb01) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-cip | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/6045702b950c2cc5c6addcbd Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/6045702b950c2cc5c6addcbe failing since 114 days (last pass: v4.14.206-21-g787a7a3ca16c, first fail: v4.14.206-22-ga949bf40fb01) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-collabora | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/60456d7a497a509ba7addcb1 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60456d7a497a509ba7addcb2 failing since 114 days (last pass: v4.14.206-21-g787a7a3ca16c, first fail: v4.14.206-22-ga949bf40fb01) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_arm-versatilepb | arm | lab-linaro-lkft | gcc-8 | versatile_defconfig | 1 Details: https://kernelci.org/test/plan/id/6045786ca17709582caddcd0 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: versatile_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/6045786ca17709582caddcd1 failing since 114 days (last pass: v4.14.206-21-g787a7a3ca16c, first fail: v4.14.206-22-ga949bf40fb01) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_x86_64 | x86_64 | lab-baylibre | gcc-8 | x86_64_defconfig | 1 Details: https://kernelci.org/test/plan/id/60456c94457e093510addcb1 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig Compiler: gcc-8 (gcc (Debian 8.3.0-6) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60456c94457e093510addcb2 new failure (last pass: v4.14.223-44-g7f3fe97bedd97) platform | arch | lab | compiler | defconfig | regressions ---------------------+--------+-----------------+----------+---------------------+------------ qemu_x86_64-uefi | x86_64 | lab-baylibre | gcc-8 | x86_64_defconfig | 1 Details: https://kernelci.org/test/plan/id/60456cc8c4fb4f2f0daddcc6 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig Compiler: gcc-8 (gcc (Debian 8.3.0-6) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.223-46-g755149b36d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60456cc8c4fb4f2f0daddcc7 new failure (last pass: v4.14.223-44-g7f3fe97bedd97)

3 years, 10 months

1
0
0 0

[PATCH 6/6] usbip: fix vudc usbip_sockfd_store races leading to gpf

by Shuah Khan

usbip_sockfd_store() is invoked when user requests attach (import) detach (unimport) usb gadget device from usbip host. vhci_hcd sends import request and usbip_sockfd_store() exports the device if it is free for export. Export and unexport are governed by local state and shared state - Shared state (usbip device status, sockfd) - sockfd and Device status are used to determine if stub should be brought up or shut down. Device status is shared between host and client. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - While the device is exported, device status is marked used and socket, sockfd, and thread pointers are valid. Export sequence (stub-up) includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the client to provide access to the exported device. rx and tx threads depends on local and shared state to be correct and in sync. Unexport (stub-down) sequence shuts the socket down and stops the rx and tx threads. Stub-down sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current stub-up sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to SDEV_ST_USED. This opens up a race condition between the threads and usbip_sockfd_store() stub up and down handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold usbip_device lock to update local and shared states after creating rx and tx threads. - Update usbip_device status to SDEV_ST_USED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is a hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the stub-up sequence. Reported-by: syzbot <syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+bf1a360e305ee719e364(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+95ce4b142579611ef0a9(a)syzkaller.appspotmail.com> Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: stable(a)vger.kernel.org Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/vudc_sysfs.c | 42 +++++++++++++++++++++++++++------- 1 file changed, 34 insertions(+), 8 deletions(-) diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c index 83a0c59a3de8..a3ec39fc6177 100644 --- a/drivers/usb/usbip/vudc_sysfs.c +++ b/drivers/usb/usbip/vudc_sysfs.c @@ -90,8 +90,9 @@ static ssize_t dev_desc_read(struct file *file, struct kobject *kobj, } static BIN_ATTR_RO(dev_desc, sizeof(struct usb_device_descriptor)); -static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *attr, - const char *in, size_t count) +static ssize_t usbip_sockfd_store(struct device *dev, + struct device_attribute *attr, + const char *in, size_t count) { struct vudc *udc = (struct vudc *) dev_get_drvdata(dev); int rv; @@ -100,6 +101,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a struct socket *socket; unsigned long flags; int ret; + struct task_struct *tcp_rx = NULL; + struct task_struct *tcp_tx = NULL; rv = kstrtoint(in, 0, &sockfd); if (rv != 0) @@ -145,24 +148,47 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a goto sock_err; } - udc->ud.tcp_socket = socket; - + /* unlock and create threads and get tasks */ spin_unlock_irq(&udc->ud.lock); spin_unlock_irqrestore(&udc->lock, flags); - udc->ud.tcp_rx = kthread_get_run(&v_rx_loop, - &udc->ud, "vudc_rx"); - udc->ud.tcp_tx = kthread_get_run(&v_tx_loop, - &udc->ud, "vudc_tx"); + tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx"); + if (IS_ERR(tcp_rx)) { + sockfd_put(socket); + return -EINVAL; + } + tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx"); + if (IS_ERR(tcp_tx)) { + kthread_stop(tcp_rx); + sockfd_put(socket); + return -EINVAL; + } + + /* get task structs now */ + get_task_struct(tcp_rx); + get_task_struct(tcp_tx); + /* lock and update udc->ud state */ spin_lock_irqsave(&udc->lock, flags); spin_lock_irq(&udc->ud.lock); + + udc->ud.tcp_socket = socket; + udc->ud.tcp_rx = tcp_rx; + udc->ud.tcp_rx = tcp_tx; udc->ud.status = SDEV_ST_USED; + spin_unlock_irq(&udc->ud.lock); ktime_get_ts64(&udc->start_time); v_start_timer(udc); udc->connected = 1; + + spin_unlock_irqrestore(&udc->lock, flags); + + wake_up_process(udc->ud.tcp_rx); + wake_up_process(udc->ud.tcp_tx); + return count; + } else { if (!udc->connected) { dev_err(dev, "Device not connected"); -- 2.27.0

3 years, 10 months

1
0
0 0

[PATCH 5/6] usbip: fix vhci_hcd attach_store() races leading to gpf

by Shuah Khan

attach_store() is invoked when user requests import (attach) a device from usbip host. Attach and detach are governed by local state and shared state - Shared state (usbip device status) - Device status is used to manage the attach and detach operations on import-able devices. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - Device has to be in the right state to be attached and detached. Attach sequence includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the host to get access to the imported device. rx and tx threads depends on local and shared state to be correct and in sync. Detach sequence shuts the socket down and stops the rx and tx threads. Detach sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current attach sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to VDEV_ST_NOTASSIGNED. This opens up a race condition between the threads, port connect, and detach handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold vhci and usbip_device locks to update local and shared states after creating rx and tx threads. - Update usbip_device status to VDEV_ST_NOTASSIGNED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the attach sequence. - Update usbip_device tcp_rx and tcp_tx pointers holding vhci and usbip_device locks. Tested with syzbot reproducer: - https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000 Reported-by: syzbot <syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+bf1a360e305ee719e364(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+95ce4b142579611ef0a9(a)syzkaller.appspotmail.com> Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: stable(a)vger.kernel.org Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/vhci_sysfs.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c index 1e1ae9bd06ab..c4b4256e5dad 100644 --- a/drivers/usb/usbip/vhci_sysfs.c +++ b/drivers/usb/usbip/vhci_sysfs.c @@ -312,6 +312,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, struct vhci *vhci; int err; unsigned long flags; + struct task_struct *tcp_rx = NULL; + struct task_struct *tcp_tx = NULL; /* * @rhport: port number of vhci_hcd @@ -360,9 +362,24 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, return -EINVAL; } - /* now need lock until setting vdev status as used */ + /* create threads before locking */ + tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx"); + if (IS_ERR(tcp_rx)) { + sockfd_put(socket); + return -EINVAL; + } + tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx"); + if (IS_ERR(tcp_tx)) { + kthread_stop(tcp_rx); + sockfd_put(socket); + return -EINVAL; + } + + /* get task structs now */ + get_task_struct(tcp_rx); + get_task_struct(tcp_tx); - /* begin a lock */ + /* now begin lock until setting vdev status set */ spin_lock_irqsave(&vhci->lock, flags); spin_lock(&vdev->ud.lock); @@ -372,6 +389,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, spin_unlock_irqrestore(&vhci->lock, flags); sockfd_put(socket); + kthread_stop_put(tcp_rx); + kthread_stop_put(tcp_tx); dev_err(dev, "port %d already used\n", rhport); /* @@ -390,6 +409,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, vdev->speed = speed; vdev->ud.sockfd = sockfd; vdev->ud.tcp_socket = socket; + vdev->ud.tcp_rx = tcp_rx; + vdev->ud.tcp_tx = tcp_tx; vdev->ud.status = VDEV_ST_NOTASSIGNED; usbip_kcov_handle_init(&vdev->ud); @@ -397,8 +418,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, spin_unlock_irqrestore(&vhci->lock, flags); /* end the lock */ - vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx"); - vdev->ud.tcp_tx = kthread_get_run(vhci_tx_loop, &vdev->ud, "vhci_tx"); + wake_up_process(vdev->ud.tcp_rx); + wake_up_process(vdev->ud.tcp_tx); rh_port_connect(vdev, speed); -- 2.27.0

3 years, 10 months

1
0
0 0

[PATCH 4/6] usbip: fix stub_dev usbip_sockfd_store() races leading to gpf

by Shuah Khan

usbip_sockfd_store() is invoked when user requests attach (import) detach (unimport) usb device from usbip host. vhci_hcd sends import request and usbip_sockfd_store() exports the device if it is free for export. Export and unexport are governed by local state and shared state - Shared state (usbip device status, sockfd) - sockfd and Device status are used to determine if stub should be brought up or shut down. - Local state (tcp_socket, rx and tx thread task_struct ptrs) A valid tcp_socket controls rx and tx thread operations while the device is in exported state. - While the device is exported, device status is marked used and socket, sockfd, and thread pointers are valid. Export sequence (stub-up) includes validating the socket and creating receive (rx) and transmit (tx) threads to talk to the client to provide access to the exported device. rx and tx threads depends on local and shared state to be correct and in sync. Unexport (stub-down) sequence shuts the socket down and stops the rx and tx threads. Stub-down sequence relies on local and shared states to be in sync. There are races in updating the local and shared status in the current stub-up sequence resulting in crashes. These stem from starting rx and tx threads before local and global state is updated correctly to be in sync. 1. Doesn't handle kthread_create() error and saves invalid ptr in local state that drives rx and tx threads. 2. Updates tcp_socket and sockfd, starts stub_rx and stub_tx threads before updating usbip_device status to SDEV_ST_USED. This opens up a race condition between the threads and usbip_sockfd_store() stub up and down handling. Fix the above problems: - Stop using kthread_get_run() macro to create/start threads. - Create threads and get task struct reference. - Add kthread_create() failure handling and bail out. - Hold usbip_device lock to update local and shared states after creating rx and tx threads. - Update usbip_device status to SDEV_ST_USED. - Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx - Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx, and status) is complete. Credit goes to syzbot and Tetsuo Handa for finding and root-causing the kthread_get_run() improper error handling problem and others. This is a hard problem to find and debug since the races aren't seen in a normal case. Fuzzing forces the race window to be small enough for the kthread_get_run() error path bug and starting threads before updating the local and shared state bug in the stub-up sequence. Tested with syzbot reproducer: - https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000 Reported-by: syzbot <syzbot+a93fba6d384346a761e3(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+bf1a360e305ee719e364(a)syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+95ce4b142579611ef0a9(a)syzkaller.appspotmail.com> Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread") Cc: stable(a)vger.kernel.org Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/stub_dev.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c index 90c105469a07..8f1de1fbbeed 100644 --- a/drivers/usb/usbip/stub_dev.c +++ b/drivers/usb/usbip/stub_dev.c @@ -46,6 +46,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a int sockfd = 0; struct socket *socket; int rv; + struct task_struct *tcp_rx = NULL; + struct task_struct *tcp_tx = NULL; if (!sdev) { dev_err(dev, "sdev is null\n"); @@ -80,20 +82,36 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a goto sock_err; } - sdev->ud.tcp_socket = socket; - sdev->ud.sockfd = sockfd; - + /* unlock and create threads and get tasks */ spin_unlock_irq(&sdev->ud.lock); + tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx"); + if (IS_ERR(tcp_rx)) { + sockfd_put(socket); + return -EINVAL; + } + tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx"); + if (IS_ERR(tcp_tx)) { + kthread_stop(tcp_rx); + sockfd_put(socket); + return -EINVAL; + } - sdev->ud.tcp_rx = kthread_get_run(stub_rx_loop, &sdev->ud, - "stub_rx"); - sdev->ud.tcp_tx = kthread_get_run(stub_tx_loop, &sdev->ud, - "stub_tx"); + /* get task structs now */ + get_task_struct(tcp_rx); + get_task_struct(tcp_tx); + /* lock and update sdev->ud state */ spin_lock_irq(&sdev->ud.lock); + sdev->ud.tcp_socket = socket; + sdev->ud.sockfd = sockfd; + sdev->ud.tcp_rx = tcp_rx; + sdev->ud.tcp_tx = tcp_tx; sdev->ud.status = SDEV_ST_USED; spin_unlock_irq(&sdev->ud.lock); + wake_up_process(sdev->ud.tcp_rx); + wake_up_process(sdev->ud.tcp_tx); + } else { dev_info(dev, "stub down\n"); -- 2.27.0

3 years, 10 months

1
0
0 0

[PATCH 3/6] usbip: fix vudc to check for stream socket

by Shuah Khan

Fix usbip_sockfd_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc: stable(a)vger.kernel.org Suggested-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/vudc_sysfs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c index 100f680c572a..83a0c59a3de8 100644 --- a/drivers/usb/usbip/vudc_sysfs.c +++ b/drivers/usb/usbip/vudc_sysfs.c @@ -138,6 +138,13 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a goto unlock_ud; } + if (socket->type != SOCK_STREAM) { + dev_err(dev, "Expecting SOCK_STREAM - found %d", + socket->type); + ret = -EINVAL; + goto sock_err; + } + udc->ud.tcp_socket = socket; spin_unlock_irq(&udc->ud.lock); @@ -177,6 +184,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a return count; +sock_err: + sockfd_put(socket); unlock_ud: spin_unlock_irq(&udc->ud.lock); unlock: -- 2.27.0

3 years, 10 months

1
0
0 0

[PATCH 2/6] usbip: fix vhci_hcd to check for stream socket

by Shuah Khan

Fix attach_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc: stable(a)vger.kernel.org Suggested-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- drivers/usb/usbip/vhci_sysfs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c index 96e5371dc335..1e1ae9bd06ab 100644 --- a/drivers/usb/usbip/vhci_sysfs.c +++ b/drivers/usb/usbip/vhci_sysfs.c @@ -349,8 +349,16 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr, /* Extract socket from fd. */ socket = sockfd_lookup(sockfd, &err); - if (!socket) + if (!socket) { + dev_err(dev, "failed to lookup sock"); return -EINVAL; + } + if (socket->type != SOCK_STREAM) { + dev_err(dev, "Expecting SOCK_STREAM - found %d", + socket->type); + sockfd_put(socket); + return -EINVAL; + } /* now need lock until setting vdev status as used */ -- 2.27.0

3 years, 10 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2021