On Fri, Jan 07, 2022 at 05:28:59PM +0800, David Laight wrote:
> That !!alt_base doesn't look right.
> Without looking at the rest of the code maybe:
> if (!base && !alt_base)
> may be correct.
Thanks, that's my fault.
I will correct it.
> It also rather makes me wonder about the actual failure return value.
> If devm_ioport_map() returns a 'port number' for inb()/outb() then
> zero is technically a valid value!
That's not right.
The devm_ioport_map() returns NULL if fails and returns non-NULL
pointer if success.
And also we can find in `drivers/ata/pata_platform.c` that it also
use the same way to check the return value from devm_ioport_map().
I will submit a new version to correct my code.
Sincerely thanks,
Jiang
Szanowny Beneficjentu,
We współpracy z międzynarodowym funduszem walutowym, funduszem Union
Togolaise de Banque & Kuwait na rzecz rozwoju gospodarczego krajów
arabskich oraz organizacją Narodów Zjednoczonych (ONZ) Katar Charity,
niniejszym oficjalnie powiadamiamy Państwa o wypłacie spadku.
Otrzymujesz nagrodę i prawo do otrzymania kwoty (350 000 USD) z
funduszu Kuwejtu na rzecz rozwoju gospodarczego krajów arabskich i
organizacji charytatywnej Qatar Charity we współpracy z Union
Togolaise de Banque.
Po dokładnych badaniach i śledztwach dotyczących osób, które mają
otrzymać spadek z programu Kuwejcki Fundusz na rzecz Arabskiego
Rozwoju Gospodarczego, odkryliśmy, że jesteś w to zaangażowany, a Twój
adres e-mail został wybrany spośród tych, którzy nie otrzymali jeszcze
płatności spadkowej.
Dlatego właśnie teraz korzystamy z tej okazji, aby oficjalnie
poinformować Cię, że Twoja płatność/środek o wartości (350 000 USD)
został zatwierdzony, podpisany i zwolniony do natychmiastowego
przelewu.
Ten fundusz/płatność jest dla Ciebie dziedzictwem za bycie wśród beneficjentów.
Jest sponsorowany i inicjowany przez Qatar Charity, MFW i Kuwait Fund
for Arab Economic Development oraz Bank Światowy i Union Togolaise de
Banque. Stan Kuwejtu utrzymuje również swoje wsparcie i wkład do
zasobów innych międzynarodowych instytucji rozwojowych, takich jak
Arab Fundusz na rzecz rozwoju gospodarczego i społecznego, afrykański
bank rozwoju, międzynarodowy fundusz Qatar Charity oraz międzynarodowe
stowarzyszenie na rzecz rozwoju za pośrednictwem funduszu kuwejckiego.
Kiedy odkryjemy i zauważymy, że nie otrzymałeś jeszcze swojego
funduszu spadkowego, zalecamy skontaktowanie się z nami w sprawie
płatności w celu natychmiastowego żądania płatności.
skontaktuj się ze mną na ten e-mail (kodjikokou09(a)gmail.com)
Z poważaniem,
Z poważaniem,
kodji kokou
Union Togolaise de Banque
This is the start of the stable review cycle for the 5.15.9 release.
There are 42 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 17 Dec 2021 17:20:14 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.9-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.15.9-rc1
Adrian Hunter <adrian.hunter(a)intel.com>
perf inject: Fix itrace space allowed for new attributes
Miklos Szeredi <mszeredi(a)redhat.com>
fuse: make sure reclaim doesn't write the inode
Nikita Yushchenko <nikita.yoush(a)cogentembedded.com>
staging: most: dim2: use device release method
Chen Jun <chenjun102(a)huawei.com>
tracing: Fix a kmemleak false positive in tracing_map
Philip Yang <Philip.Yang(a)amd.com>
drm/amdkfd: process_info lock not needed for svm
Perry Yuan <Perry.Yuan(a)amd.com>
drm/amd/display: add connector type check for CRC source set
Philip Yang <Philip.Yang(a)amd.com>
drm/amdkfd: fix double free mem structure
Mustapha Ghaddar <mghaddar(a)amd.com>
drm/amd/display: Fix for the no Audio bug with Tiled Displays
Flora Cui <flora.cui(a)amd.com>
drm/amdgpu: check atomic flag to differeniate with legacy path
Flora Cui <flora.cui(a)amd.com>
drm/amdgpu: cancel the correct hrtimer on exit
Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com>
net: netlink: af_netlink: Prevent empty skb by adding a check on len.
Ondrej Jirman <megous(a)megous.com>
i2c: rk3x: Handle a spurious start completion interrupt flag
Helge Deller <deller(a)gmx.de>
parisc/agp: Annotate parisc agp init functions with __init
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>
loop: Use pr_warn_once() for loop_control_remove() warning
Erik Ekman <erik(a)kryo.se>
net/mlx4_en: Update reported link modes for 1/10G
Alexander Stein <alexander.stein(a)ew.tq-group.com>
Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
Ilie Halip <ilie.halip(a)gmail.com>
s390/test_unwind: use raw opcode instead of invalid instruction
Marc Zyngier <maz(a)kernel.org>
KVM: arm64: Save PSTATE early on exit
Douglas Anderson <dianders(a)chromium.org>
drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
Philip Chen <philipchen(a)chromium.org>
drm/msm/dsi: set default num_data_lanes
Akhil P Oommen <akhilpo(a)codeaurora.org>
drm/msm/a6xx: Fix uinitialized use of gpu_scid
Akhil P Oommen <akhilpo(a)codeaurora.org>
drm/msm: Fix null ptr access msm_ioctl_gem_submit()
Vincent Whitchurch <vincent.whitchurch(a)axis.com>
i2c: virtio: fix completion handling
Ronak Doshi <doshir(a)vmware.com>
vmxnet3: fix minimum vectors alloc issue
Yahui Cao <yahui.cao(a)intel.com>
ice: fix FDIR init missing when reset VF
Tatyana Nikolova <tatyana.e.nikolova(a)intel.com>
RDMA/irdma: Don't arm the CQ more than two times if no CE for this CQ
Shiraz Saleem <shiraz.saleem(a)intel.com>
RDMA/irdma: Report correct WC errors
Christophe JAILLET <christophe.jaillet(a)wanadoo.fr>
RDMA/irdma: Fix a potential memory allocation issue in 'irdma_prm_add_pble_mem()'
Shiraz Saleem <shiraz.saleem(a)intel.com>
RDMA/irdma: Fix a user-after-free in add_pble_prm
David Howells <dhowells(a)redhat.com>
netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock
Song Liu <songliubraving(a)fb.com>
perf bpf_skel: Do not use typedef to avoid error on old clang
Martin Botka <martin.botka(a)somainline.org>
clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1
Rob Herring <robh(a)kernel.org>
dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema
Eric Dumazet <edumazet(a)google.com>
inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently
Herve Codina <herve.codina(a)bootlin.com>
mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface
Herve Codina <herve.codina(a)bootlin.com>
mtd: rawnand: Fix nand_erase_op delay
Alaa Hleihel <alaa(a)nvidia.com>
RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
Pavel Skripkin <paskripkin(a)gmail.com>
RDMA: Fix use-after-free in rxe_queue_cleanup
Wilken Gottwalt <wilken.gottwalt(a)posteo.net>
hwmon: (corsair-psu) fix plain integer used as NULL pointer
Tadeusz Struk <tadeusz.struk(a)linaro.org>
nfc: fix segfault in nfc_genl_dump_devices_done
-------------
Diffstat:
.../bindings/media/nxp,imx7-mipi-csi2.yaml | 14 +-----
Makefile | 4 +-
arch/arm64/kvm/hyp/include/hyp/switch.h | 6 +++
arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 7 ++-
arch/s390/lib/test_unwind.c | 5 +-
drivers/block/loop.c | 2 +-
drivers/char/agp/parisc-agp.c | 6 +--
drivers/clk/qcom/gcc-sm6125.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 8 ++--
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 4 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 ----
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 8 ++++
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 ++
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 18 +++----
drivers/gpu/drm/msm/dp/dp_aux.c | 17 +++++++
drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +
drivers/gpu/drm/msm/msm_gem_submit.c | 1 +
drivers/hwmon/corsair-psu.c | 2 +-
drivers/i2c/busses/i2c-rk3x.c | 4 +-
drivers/i2c/busses/i2c-virtio.c | 32 +++++--------
drivers/infiniband/hw/irdma/hw.c | 7 ++-
drivers/infiniband/hw/irdma/main.h | 1 +
drivers/infiniband/hw/irdma/pble.c | 8 ++--
drivers/infiniband/hw/irdma/pble.h | 1 -
drivers/infiniband/hw/irdma/utils.c | 24 +++++++---
drivers/infiniband/hw/irdma/verbs.c | 23 +++++++--
drivers/infiniband/hw/irdma/verbs.h | 2 +
drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 +--
drivers/infiniband/hw/mlx5/mr.c | 26 +++++-----
drivers/infiniband/sw/rxe/rxe_qp.c | 1 +
drivers/mtd/nand/raw/nand_base.c | 6 +--
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 6 +--
drivers/net/vmxnet3/vmxnet3_drv.c | 13 ++---
drivers/staging/most/dim2/dim2.c | 55 ++++++++++++----------
drivers/tty/serial/fsl_lpuart.c | 1 +
fs/fuse/dir.c | 8 ++++
fs/fuse/file.c | 15 ++++++
fs/fuse/fuse_i.h | 1 +
fs/fuse/inode.c | 3 ++
fs/netfs/read_helper.c | 15 ++----
kernel/trace/tracing_map.c | 3 ++
net/ipv4/inet_connection_sock.c | 2 +-
net/netlink/af_netlink.c | 5 ++
net/nfc/netlink.c | 6 ++-
sound/pci/hda/hda_intel.c | 12 ++++-
sound/pci/hda/patch_hdmi.c | 3 +-
tools/perf/builtin-inject.c | 2 +-
tools/perf/util/bpf_skel/bperf.h | 14 ------
tools/perf/util/bpf_skel/bperf_follower.bpf.c | 16 +++++--
tools/perf/util/bpf_skel/bperf_leader.bpf.c | 16 +++++--
52 files changed, 284 insertions(+), 180 deletions(-)
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f28439db470cca8b6b082239314e9fd10bd39034 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao(a)linux.vnet.ibm.com>
Date: Thu, 23 Dec 2021 16:04:39 +0530
Subject: [PATCH] tracing: Tag trace_percpu_buffer as a percpu pointer
Tag trace_percpu_buffer as a percpu pointer to resolve warnings
reported by sparse:
/linux/kernel/trace/trace.c:3218:46: warning: incorrect type in initializer (different address spaces)
/linux/kernel/trace/trace.c:3218:46: expected void const [noderef] __percpu *__vpp_verify
/linux/kernel/trace/trace.c:3218:46: got struct trace_buffer_struct *
/linux/kernel/trace/trace.c:3234:9: warning: incorrect type in initializer (different address spaces)
/linux/kernel/trace/trace.c:3234:9: expected void const [noderef] __percpu *__vpp_verify
/linux/kernel/trace/trace.c:3234:9: got int *
Link: https://lkml.kernel.org/r/ebabd3f23101d89cb75671b68b6f819f5edc830b.16402553…
Cc: stable(a)vger.kernel.org
Reported-by: kernel test robot <lkp(a)intel.com>
Fixes: 07d777fe8c398 ("tracing: Add percpu buffers for trace_printk()")
Signed-off-by: Naveen N. Rao <naveen.n.rao(a)linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org>
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e1f55851e53f..78ea542ce3bc 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3207,7 +3207,7 @@ struct trace_buffer_struct {
char buffer[4][TRACE_BUF_SIZE];
};
-static struct trace_buffer_struct *trace_percpu_buffer;
+static struct trace_buffer_struct __percpu *trace_percpu_buffer;
/*
* This allows for lockless recording. If we're nested too deeply, then
@@ -3236,7 +3236,7 @@ static void put_trace_buf(void)
static int alloc_percpu_trace_buffer(void)
{
- struct trace_buffer_struct *buffers;
+ struct trace_buffer_struct __percpu *buffers;
if (trace_percpu_buffer)
return 0;
After commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"),
drm_gem_mmap_obj() takes a reference of the passed drm_gem_object at the
beginning of the function to safely dereference the mmap offset pointer,
and releases it at the end, if an error occurred. However, the cma and
shmem helpers are also releasing that reference in case of an error,
which causes the imbalance of the reference counter and the panic
reported by syzbot.
Don't release the reference in drm_gem_mmap_obj() if the mmap method was
called and it returned an error, and uniformly apply the same behavior of
the cma and shmem helpers to the ttm helper (release the reference in the
helper, not in the caller, when an error occurs).
Cc: stable(a)vger.kernel.org
Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com>
Reported-by: syzbot+c8ae65286134dd1b800d(a)syzkaller.appspotmail.com
Fixes: 9786b65bc61ac ("drm/ttm: fix mmap refcounting")
---
drivers/gpu/drm/drm_gem.c | 3 ++-
drivers/gpu/drm/drm_gem_ttm_helper.c | 4 +---
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 4dcdec6487bb..7264a1a7a8d2 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1049,8 +1049,9 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size,
if (obj->funcs->mmap) {
ret = obj->funcs->mmap(obj, vma);
+ /* All helpers call drm_gem_object_put() */
if (ret)
- goto err_drm_gem_object_put;
+ return ret;
WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));
} else {
if (!vma->vm_ops) {
diff --git a/drivers/gpu/drm/drm_gem_ttm_helper.c b/drivers/gpu/drm/drm_gem_ttm_helper.c
index ecf3d2a54a98..c44bfdbb722d 100644
--- a/drivers/gpu/drm/drm_gem_ttm_helper.c
+++ b/drivers/gpu/drm/drm_gem_ttm_helper.c
@@ -101,8 +101,6 @@ int drm_gem_ttm_mmap(struct drm_gem_object *gem,
int ret;
ret = ttm_bo_mmap_obj(vma, bo);
- if (ret < 0)
- return ret;
/*
* ttm has its own object refcounting, so drop gem reference
@@ -110,7 +108,7 @@ int drm_gem_ttm_mmap(struct drm_gem_object *gem,
*/
drm_gem_object_put(gem);
- return 0;
+ return ret;
}
EXPORT_SYMBOL(drm_gem_ttm_mmap);
--
2.32.0
In linux-stable-5.15.13, this file has been removed and combined
to `drivers/ata/pata_platform.c` without this bug.
But in the older LTS kernels, like 5.10.90, this bug still exists.
As the possible failure of the devres_alloc(), the devm_ioremap() and
devm_ioport_map() may return NULL pointer.
And then, the 'base' and 'alt_base' are used in plat_ide_setup_ports().
Therefore, it should be better to add the check in order to avoid the
dereference of the NULL pointer.
Actually, it introduced the bug from commit 8cb1f567f4c0
("ide: Platform IDE driver") and we can know from the commit message
that it tended to be similar to the `drivers/ata/pata_platform.c`.
But actually, even the first time pata_platform was built,
commit a20c9e820864 ("[PATCH] ata: Generic platform_device libata driver"),
there was no the bug, as there was a check after the ioremap().
So possibly the bug was caused by ide itself.
Fixes: 8cb1f567f4c0 ("ide: Platform IDE driver")
Cc: stable(a)vger.kernel.org#5.10.90
Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
---
Changelog
v1 -> v2
* Change 1. Correct the fixes tag and commit message.
---
drivers/ide/ide_platform.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/ide/ide_platform.c b/drivers/ide/ide_platform.c
index 91639fd6c276..5500c5afb3ca 100644
--- a/drivers/ide/ide_platform.c
+++ b/drivers/ide/ide_platform.c
@@ -85,6 +85,10 @@ static int plat_ide_probe(struct platform_device *pdev)
alt_base = devm_ioport_map(&pdev->dev,
res_alt->start, resource_size(res_alt));
}
+ if (!base || !!alt_base) {
+ ret = -ENOMEM;
+ goto out;
+ }
memset(&hw, 0, sizeof(hw));
plat_ide_setup_ports(&hw, base, alt_base, pdata, res_irq->start);
--
2.25.1