November 2022 - Linux-stable-mirror

[PATCH] can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive

by Biju Das

commit 702de2c21eed04c67cefaaedc248ef16e5f6b293 upstream. We are seeing an IRQ storm on the global receive IRQ line under heavy CAN bus load conditions with both CAN channels enabled. Conditions: The global receive IRQ line is shared between can0 and can1, either of the channels can trigger interrupt while the other channel's IRQ line is disabled (RFIE). When global a receive IRQ interrupt occurs, we mask the interrupt in the IRQ handler. Clearing and unmasking of the interrupt is happening in rx_poll(). There is a race condition where rx_poll() unmasks the interrupt, but the next IRQ handler does not mask the IRQ due to NAPIF_STATE_MISSED flag (e.g.: can0 RX FIFO interrupt is disabled and can1 is triggering RX interrupt, the delay in rx_poll() processing results in setting NAPIF_STATE_MISSED flag) leading to an IRQ storm. This patch fixes the issue by checking IRQ active and enabled before handling the IRQ on a particular channel. Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver") Suggested-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com> Link: https://lore.kernel.org/all/20221025155657.1426948-2-biju.das.jz@bp.renesas… Cc: stable(a)vger.kernel.org#5.15.y [mkl: adjust commit message] Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> [biju: removed gpriv from RCANFD_RFCC_RFIE macro] Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com> --- Resending to 5.15 with confilcts[1] fixed [1] https://lore.kernel.org/stable/1667194204110137@kroah.com/T/#u --- drivers/net/can/rcar/rcar_canfd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c index 2f44c567ebd7..9991bb475ae1 100644 --- a/drivers/net/can/rcar/rcar_canfd.c +++ b/drivers/net/can/rcar/rcar_canfd.c @@ -1106,11 +1106,13 @@ static void rcar_canfd_handle_global_receive(struct rcar_canfd_global *gpriv, u3 { struct rcar_canfd_channel *priv = gpriv->ch[ch]; u32 ridx = ch + RCANFD_RFFIFO_IDX; - u32 sts; + u32 sts, cc; /* Handle Rx interrupts */ sts = rcar_canfd_read(priv->base, RCANFD_RFSTS(ridx)); - if (likely(sts & RCANFD_RFSTS_RFIF)) { + cc = rcar_canfd_read(priv->base, RCANFD_RFCC(ridx)); + if (likely(sts & RCANFD_RFSTS_RFIF && + cc & RCANFD_RFCC_RFIE)) { if (napi_schedule_prep(&priv->napi)) { /* Disable Rx FIFO interrupts */ rcar_canfd_clear_bit(priv->base, -- 2.25.1

2 years, 1 month

4
4
0 0

[PATCH 4.14 00/34] 4.14.297-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.297 release. There are 34 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Nov 2022 07:01:32 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.297-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.297-rc1 Daniel Sneddon <daniel.sneddon(a)linux.intel.com> x86/speculation: Add RSB VM Exit protections Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts Nathan Chancellor <nathan(a)kernel.org> x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/speculation: Disable RRSBA behavior Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Add Cannon lake to RETBleed affected CPU list Andrew Cooper <andrew.cooper3(a)citrix.com> x86/cpu/amd: Enumerate BTC_NO Peter Zijlstra <peterz(a)infradead.org> x86/common: Stamp out the stepping madness Josh Poimboeuf <jpoimboe(a)kernel.org> x86/speculation: Fill RSB on vmexit for IBRS Josh Poimboeuf <jpoimboe(a)kernel.org> KVM: VMX: Fix IBRS handling after vmexit Josh Poimboeuf <jpoimboe(a)kernel.org> KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS Josh Poimboeuf <jpoimboe(a)kernel.org> x86/speculation: Remove x86_spec_ctrl_mask Josh Poimboeuf <jpoimboe(a)kernel.org> x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit Josh Poimboeuf <jpoimboe(a)kernel.org> x86/speculation: Fix SPEC_CTRL write on SMT state change Josh Poimboeuf <jpoimboe(a)kernel.org> x86/speculation: Fix firmware entry SPEC_CTRL handling Josh Poimboeuf <jpoimboe(a)kernel.org> x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/speculation: Add LFENCE to RSB fill sequence Peter Zijlstra <peterz(a)infradead.org> x86/speculation: Change FILL_RETURN_BUFFER to work with objtool Peter Zijlstra <peterz(a)infradead.org> entel_idle: Disable IBRS during long idle Peter Zijlstra <peterz(a)infradead.org> x86/bugs: Report Intel retbleed vulnerability Peter Zijlstra <peterz(a)infradead.org> x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS Peter Zijlstra <peterz(a)infradead.org> x86/bugs: Optimize SPEC_CTRL MSR writes Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> x86/entry: Add kernel IBRS implementation Peter Zijlstra <peterz(a)infradead.org> x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value Alexandre Chartre <alexandre.chartre(a)oracle.com> x86/bugs: Add AMD retbleed= boot parameter Alexandre Chartre <alexandre.chartre(a)oracle.com> x86/bugs: Report AMD retbleed vulnerability Peter Zijlstra <peterz(a)infradead.org> x86/cpufeatures: Move RETPOLINE flags to word 11 Peter Zijlstra <peterz(a)infradead.org> x86/entry: Remove skip_r11rcx Mark Gross <mgross(a)linux.intel.com> x86/cpu: Add a steppings field to struct x86_cpu_id Thomas Gleixner <tglx(a)linutronix.de> x86/cpu: Add consistent CPU match macros Thomas Gleixner <tglx(a)linutronix.de> x86/devicetable: Move x86 specific macro out of generic code Ingo Molnar <mingo(a)kernel.org> x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header Kan Liang <kan.liang(a)linux.intel.com> x86/cpufeature: Add facility to check for min microcode revisions Suraj Jitindar Singh <surajjs(a)amazon.com> Revert "x86/cpu: Add a steppings field to struct x86_cpu_id" ------------- Diffstat: Documentation/admin-guide/hw-vuln/spectre.rst | 8 + Documentation/admin-guide/kernel-parameters.txt | 13 + Makefile | 4 +- arch/x86/entry/calling.h | 68 +++- arch/x86/entry/entry_32.S | 2 - arch/x86/entry/entry_64.S | 38 ++- arch/x86/entry/entry_64_compat.S | 12 +- arch/x86/include/asm/cpu_device_id.h | 168 +++++++++- arch/x86/include/asm/cpufeatures.h | 16 +- arch/x86/include/asm/intel-family.h | 6 + arch/x86/include/asm/msr-index.h | 14 + arch/x86/include/asm/nospec-branch.h | 48 +-- arch/x86/kernel/cpu/amd.c | 21 +- arch/x86/kernel/cpu/bugs.c | 415 ++++++++++++++++++++---- arch/x86/kernel/cpu/common.c | 68 ++-- arch/x86/kernel/cpu/match.c | 44 ++- arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/process.c | 2 +- arch/x86/kvm/svm.c | 1 + arch/x86/kvm/vmx.c | 51 ++- drivers/base/cpu.c | 8 + drivers/cpufreq/acpi-cpufreq.c | 1 + drivers/cpufreq/amd_freq_sensitivity.c | 1 + drivers/idle/intel_idle.c | 45 ++- include/linux/cpu.h | 2 + include/linux/mod_devicetable.h | 4 +- tools/arch/x86/include/asm/cpufeatures.h | 1 + 27 files changed, 899 insertions(+), 163 deletions(-)

2 years, 1 month

3
36
0 0

[PATCH openEuler-22.03-LTS] nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()

by Long Li

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.0-rc3 commit 21a87d88c2253350e115029f14fe2a10a7e6c856 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5X1Z4 CVE: CVE-2022-3621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the i_mode field in inode of metadata files is corrupted on disk, it can cause the initialization of bmap structure, which should have been called from nilfs_read_inode_common(), not to be called. This causes a lockdep warning followed by a NULL pointer dereference at nilfs_bmap_lookup_at_level(). This patch fixes these issues by adding a missing sanitiy check for the i_mode field of metadata file's inode. Link: https://lkml.kernel.org/r/20221002030804.29978-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+2b32eb36c1a825b7a74c(a)syzkaller.appspotmail.com Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nilfs2/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index ca380c6d7825..bfe3c7ccdf50 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -462,6 +462,8 @@ int nilfs_read_inode_common(struct inode *inode, inode->i_atime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec); inode->i_ctime.tv_nsec = le32_to_cpu(raw_inode->i_ctime_nsec); inode->i_mtime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec); + if (nilfs_is_metadata_file_inode(inode) && !S_ISREG(inode->i_mode)) + return -EIO; /* this inode is for metadata and corrupted */ if (inode->i_nlink == 0) return -ESTALE; /* this inode is deleted */ -- 2.31.1

2 years, 1 month

2
2
0 0

[PATCH openEuler-22.03-LTS] nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()

by Long Li

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.0-rc3 commit 21a87d88c2253350e115029f14fe2a10a7e6c856 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5X1Z4 CVE: CVE-2022-3621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the i_mode field in inode of metadata files is corrupted on disk, it can cause the initialization of bmap structure, which should have been called from nilfs_read_inode_common(), not to be called. This causes a lockdep warning followed by a NULL pointer dereference at nilfs_bmap_lookup_at_level(). This patch fixes these issues by adding a missing sanitiy check for the i_mode field of metadata file's inode. Link: https://lkml.kernel.org/r/20221002030804.29978-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+2b32eb36c1a825b7a74c(a)syzkaller.appspotmail.com Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nilfs2/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index ca380c6d7825..bfe3c7ccdf50 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -462,6 +462,8 @@ int nilfs_read_inode_common(struct inode *inode, inode->i_atime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec); inode->i_ctime.tv_nsec = le32_to_cpu(raw_inode->i_ctime_nsec); inode->i_mtime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec); + if (nilfs_is_metadata_file_inode(inode) && !S_ISREG(inode->i_mode)) + return -EIO; /* this inode is for metadata and corrupted */ if (inode->i_nlink == 0) return -ESTALE; /* this inode is deleted */ -- 2.31.1

2 years, 1 month

1
0
0 0

[PATCH 6.0 00/20] 6.0.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.0.4 release. There are 20 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.0.4-rc1 Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/core: Remove remove_conflicting_pci_framebuffers() Mel Gorman <mgorman(a)techsingularity.net> mm/huge_memory: do not clobber swp_entry_t during THP split Rafael Mendonca <rafaelmendsr(a)gmail.com> io-wq: Fix memory leak in worker creation Martin Liska <mliska(a)suse.cz> gcov: support GCC 12.1 and newer compilers Ard Biesheuvel <ardb(a)kernel.org> efi: ssdt: Don't free memory if ACPI table was loaded successfully Ard Biesheuvel <ardb(a)kernel.org> efi: efivars: Fix variable writes without query_variable_store() Nikos Tsironis <ntsironis(a)arrikto.com> dm clone: Fix typo in block_device format specifier Tim Huang <tim.huang(a)amd.com> drm/amd/pm: update SMU IP v13.0.4 driver interface version Evan Quan <evan.quan(a)amd.com> drm/amd/pm: fulfill SMU13.0.0 cstate control interface Evan Quan <evan.quan(a)amd.com> drm/amd/pm: disable cstate feature for gpu reset scenario Tim Huang <tim.huang(a)amd.com> drm/amd/pm: add SMU IP v13.0.4 IF version define to V7 Evan Quan <evan.quan(a)amd.com> drm/amd/pm: fulfill SMU13.0.7 cstate control interface Pavel Begunkov <asml.silence(a)gmail.com> net: flag sockets supporting msghdr originated zerocopy Roderick Colenbrander <roderick(a)gaikai.com> HID: playstation: add initial DualSense Edge controller support Roderick Colenbrander <roderick(a)gaikai.com> HID: playstation: stop DualSense output work on remove. Pavel Begunkov <asml.silence(a)gmail.com> io_uring/net: fail zc send when unsupported by socket Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: intel_powerclamp: Use first online CPU as control_cpu Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> pinctrl: amd: change dev_warn to dev_dbg for additional feature support Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/bios: Use hardcoded fp_timing size for generating LFP data pointers Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/bios: Validate fp_timing terminator presence ------------- Diffstat: Makefile | 4 +- drivers/firmware/efi/efi.c | 2 + drivers/firmware/efi/vars.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++ .../pm/swsmu/inc/pmfw_if/smu13_driver_if_v13_0_4.h | 17 +++- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 8 ++ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 9 ++ .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 11 +++ .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 12 +++ drivers/gpu/drm/i915/display/intel_bios.c | 106 ++++++++++----------- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-playstation.c | 46 +++++++-- drivers/md/dm-clone-target.c | 2 +- drivers/pinctrl/pinctrl-amd.c | 4 +- drivers/thermal/intel/intel_powerclamp.c | 6 +- drivers/video/aperture.c | 30 +++--- drivers/video/fbdev/core/fbmem.c | 48 ---------- fs/efivarfs/vars.c | 16 ---- include/linux/efi.h | 3 - include/linux/fb.h | 2 - include/linux/net.h | 1 + io_uring/io-wq.c | 2 +- io_uring/net.c | 2 + kernel/gcov/gcc_4_7.c | 18 +++- mm/huge_memory.c | 11 ++- net/ipv4/tcp.c | 1 + net/ipv4/udp.c | 1 + 28 files changed, 218 insertions(+), 165 deletions(-)

2 years, 1 month

17
41
0 0

[PATCH AUTOSEL 4.9 1/3] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

by Sasha Levin

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/staging/media/s5p-cec/s5p_cec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/media/s5p-cec/s5p_cec.c b/drivers/staging/media/s5p-cec/s5p_cec.c index bebd44d9bd51..f6d1d98431a7 100644 --- a/drivers/staging/media/s5p-cec/s5p_cec.c +++ b/drivers/staging/media/s5p-cec/s5p_cec.c @@ -112,6 +112,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); -- 2.35.1

2 years, 1 month

1
2
0 0

[PATCH AUTOSEL 4.14 1/4] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

by Sasha Levin

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/media/platform/s5p-cec/s5p_cec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c index 3032247c63a5..554c8f2b60b8 100644 --- a/drivers/media/platform/s5p-cec/s5p_cec.c +++ b/drivers/media/platform/s5p-cec/s5p_cec.c @@ -116,6 +116,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); -- 2.35.1

2 years, 1 month

1
3
0 0

[PATCH AUTOSEL 4.19 1/6] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

by Sasha Levin

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/media/platform/s5p-cec/s5p_cec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c index 3032247c63a5..554c8f2b60b8 100644 --- a/drivers/media/platform/s5p-cec/s5p_cec.c +++ b/drivers/media/platform/s5p-cec/s5p_cec.c @@ -116,6 +116,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); -- 2.35.1

2 years, 1 month

1
5
0 0

[PATCH AUTOSEL 5.4 1/8] media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

by Sasha Levin

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> [ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/media/platform/s5p-cec/s5p_cec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c index 828792b854f5..0c668d4a3daa 100644 --- a/drivers/media/platform/s5p-cec/s5p_cec.c +++ b/drivers/media/platform/s5p-cec/s5p_cec.c @@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); cec->rx = STATE_BUSY; cec->msg.len = status >> 24; + if (cec->msg.len > CEC_MAX_MSG_SIZE) + cec->msg.len = CEC_MAX_MSG_SIZE; cec->msg.rx_status = CEC_RX_STATUS_OK; s5p_cec_get_rx_buf(cec, cec->msg.len, cec->msg.msg); -- 2.35.1

2 years, 1 month

1
7
0 0

[PATCH AUTOSEL 5.10 01/14] media: rkisp1: Initialize color space on resizer sink and source pads

by Sasha Levin

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> [ Upstream commit 83b9296e399367862845d3b19984444fc756bd61 ] Initialize the four color space fields on the sink and source video pads of the resizer in the .init_cfg() operation. The resizer can't perform any color space conversion, so set the sink and source color spaces to the same defaults, which match the ISP source video pad default. Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed-by: Paul Elder <paul.elder(a)ideasonboard.com> Reviewed-by: Dafna Hirschfeld <dafna(a)fastmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/staging/media/rkisp1/rkisp1-resizer.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/staging/media/rkisp1/rkisp1-resizer.c b/drivers/staging/media/rkisp1/rkisp1-resizer.c index 4dcc342ac2b2..76f17dd7670f 100644 --- a/drivers/staging/media/rkisp1/rkisp1-resizer.c +++ b/drivers/staging/media/rkisp1/rkisp1-resizer.c @@ -500,6 +500,10 @@ static int rkisp1_rsz_init_config(struct v4l2_subdev *sd, sink_fmt->height = RKISP1_DEFAULT_HEIGHT; sink_fmt->field = V4L2_FIELD_NONE; sink_fmt->code = RKISP1_DEF_FMT; + sink_fmt->colorspace = V4L2_COLORSPACE_SRGB; + sink_fmt->xfer_func = V4L2_XFER_FUNC_SRGB; + sink_fmt->ycbcr_enc = V4L2_YCBCR_ENC_601; + sink_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE; sink_crop = v4l2_subdev_get_try_crop(sd, cfg, RKISP1_RSZ_PAD_SINK); sink_crop->width = RKISP1_DEFAULT_WIDTH; -- 2.35.1

2 years, 1 month

1
13
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2022