December 2024 - Linux-stable-mirror

Re: Patch "HID: bpf: Fix NKRO on Mistel MD770" has been added to the 6.1-stable tree

by Benjamin Tissoires

On Tue, Dec 10, 2024 at 10:32 PM Sasha Levin <sashal(a)kernel.org> wrote: > > This is a note to let you know that I've just added the patch titled > > HID: bpf: Fix NKRO on Mistel MD770 > > to the 6.1-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > hid-bpf-fix-nkro-on-mistel-md770.patch > and it can be found in the queue-6.1 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > Please drop this patch (and in all previous releases). Again, it makes no sense to backport any files in drivers/hid/bpf/progs on kernels before 6.11, and even then, it makes very little value as they are also tracked in a different userspace project (udev-hid-bpf). FWIW, HID-BPF was introduced in v6.3, so it's even more surprising to see such patch added here. Cheers, Benjamin > > > commit 6801fc048d7f85f5a555f46e1961f9c64e33fd8e > Author: Benjamin Tissoires <bentiss(a)kernel.org> > Date: Thu Oct 17 18:34:58 2024 +0200 > > HID: bpf: Fix NKRO on Mistel MD770 > > [ Upstream commit 9bc089307e8dff7797233308372b4a90ce8f79be ] > > Mistel MD770 keyboard (using Holtek Semiconductor, Inc. controller) has > a quirk in report descriptor in one of its interfaces (more detail in > the source file). Fix up the descriptor to allow NKRO to work again. > > Tested by loading the BPF program and confirming that 8 simultaneous > keypresses work. > > Link: https://bugzilla.kernel.org/show_bug.cgi?id=218495 > Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/122 > Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki(a)gmail.com> > Acked-by: Jiri Kosina <jkosina(a)suse.com> > Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-1-6a7acb89a97f@kernel.… > Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/hid/bpf/progs/Mistel__MD770.bpf.c b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c > new file mode 100644 > index 0000000000000..fb8b5a6968b12 > --- /dev/null > +++ b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c > @@ -0,0 +1,154 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* Copyright (c) 2024 Tatsuyuki Ishi > + */ > + > +#include "vmlinux.h" > +#include "hid_bpf.h" > +#include "hid_bpf_helpers.h" > +#include <bpf/bpf_tracing.h> > + > +#define VID_HOLTEK 0x04D9 > +#define PID_MD770 0x0339 > +#define RDESC_SIZE 203 > + > +HID_BPF_CONFIG( > + HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_HOLTEK, PID_MD770) > +); > + > +/* > + * The Mistel MD770 keyboard reports the first 6 simultaneous key presses > + * through the first interface, and anything beyond that through a second > + * interface. Unfortunately, the second interface's report descriptor has an > + * error, causing events to be malformed and ignored. This HID-BPF driver > + * fixes the descriptor to allow NKRO to work again. > + * > + * For reference, this is the original report descriptor: > + * > + * 0x05, 0x01, // Usage Page (Generic Desktop) 0 > + * 0x09, 0x80, // Usage (System Control) 2 > + * 0xa1, 0x01, // Collection (Application) 4 > + * 0x85, 0x01, // Report ID (1) 6 > + * 0x19, 0x81, // Usage Minimum (129) 8 > + * 0x29, 0x83, // Usage Maximum (131) 10 > + * 0x15, 0x00, // Logical Minimum (0) 12 > + * 0x25, 0x01, // Logical Maximum (1) 14 > + * 0x95, 0x03, // Report Count (3) 16 > + * 0x75, 0x01, // Report Size (1) 18 > + * 0x81, 0x02, // Input (Data,Var,Abs) 20 > + * 0x95, 0x01, // Report Count (1) 22 > + * 0x75, 0x05, // Report Size (5) 24 > + * 0x81, 0x01, // Input (Cnst,Arr,Abs) 26 > + * 0xc0, // End Collection 28 > + * 0x05, 0x0c, // Usage Page (Consumer Devices) 29 > + * 0x09, 0x01, // Usage (Consumer Control) 31 > + * 0xa1, 0x01, // Collection (Application) 33 > + * 0x85, 0x02, // Report ID (2) 35 > + * 0x15, 0x00, // Logical Minimum (0) 37 > + * 0x25, 0x01, // Logical Maximum (1) 39 > + * 0x95, 0x12, // Report Count (18) 41 > + * 0x75, 0x01, // Report Size (1) 43 > + * 0x0a, 0x83, 0x01, // Usage (AL Consumer Control Config) 45 > + * 0x0a, 0x8a, 0x01, // Usage (AL Email Reader) 48 > + * 0x0a, 0x92, 0x01, // Usage (AL Calculator) 51 > + * 0x0a, 0x94, 0x01, // Usage (AL Local Machine Browser) 54 > + * 0x09, 0xcd, // Usage (Play/Pause) 57 > + * 0x09, 0xb7, // Usage (Stop) 59 > + * 0x09, 0xb6, // Usage (Scan Previous Track) 61 > + * 0x09, 0xb5, // Usage (Scan Next Track) 63 > + * 0x09, 0xe2, // Usage (Mute) 65 > + * 0x09, 0xea, // Usage (Volume Down) 67 > + * 0x09, 0xe9, // Usage (Volume Up) 69 > + * 0x0a, 0x21, 0x02, // Usage (AC Search) 71 > + * 0x0a, 0x23, 0x02, // Usage (AC Home) 74 > + * 0x0a, 0x24, 0x02, // Usage (AC Back) 77 > + * 0x0a, 0x25, 0x02, // Usage (AC Forward) 80 > + * 0x0a, 0x26, 0x02, // Usage (AC Stop) 83 > + * 0x0a, 0x27, 0x02, // Usage (AC Refresh) 86 > + * 0x0a, 0x2a, 0x02, // Usage (AC Bookmarks) 89 > + * 0x81, 0x02, // Input (Data,Var,Abs) 92 > + * 0x95, 0x01, // Report Count (1) 94 > + * 0x75, 0x0e, // Report Size (14) 96 > + * 0x81, 0x01, // Input (Cnst,Arr,Abs) 98 > + * 0xc0, // End Collection 100 > + * 0x05, 0x01, // Usage Page (Generic Desktop) 101 > + * 0x09, 0x02, // Usage (Mouse) 103 > + * 0xa1, 0x01, // Collection (Application) 105 > + * 0x09, 0x01, // Usage (Pointer) 107 > + * 0xa1, 0x00, // Collection (Physical) 109 > + * 0x85, 0x03, // Report ID (3) 111 > + * 0x05, 0x09, // Usage Page (Button) 113 > + * 0x19, 0x01, // Usage Minimum (1) 115 > + * 0x29, 0x08, // Usage Maximum (8) 117 > + * 0x15, 0x00, // Logical Minimum (0) 119 > + * 0x25, 0x01, // Logical Maximum (1) 121 > + * 0x75, 0x01, // Report Size (1) 123 > + * 0x95, 0x08, // Report Count (8) 125 > + * 0x81, 0x02, // Input (Data,Var,Abs) 127 > + * 0x05, 0x01, // Usage Page (Generic Desktop) 129 > + * 0x09, 0x30, // Usage (X) 131 > + * 0x09, 0x31, // Usage (Y) 133 > + * 0x16, 0x01, 0x80, // Logical Minimum (-32767) 135 > + * 0x26, 0xff, 0x7f, // Logical Maximum (32767) 138 > + * 0x75, 0x10, // Report Size (16) 141 > + * 0x95, 0x02, // Report Count (2) 143 > + * 0x81, 0x06, // Input (Data,Var,Rel) 145 > + * 0x09, 0x38, // Usage (Wheel) 147 > + * 0x15, 0x81, // Logical Minimum (-127) 149 > + * 0x25, 0x7f, // Logical Maximum (127) 151 > + * 0x75, 0x08, // Report Size (8) 153 > + * 0x95, 0x01, // Report Count (1) 155 > + * 0x81, 0x06, // Input (Data,Var,Rel) 157 > + * 0x05, 0x0c, // Usage Page (Consumer Devices) 159 > + * 0x0a, 0x38, 0x02, // Usage (AC Pan) 161 > + * 0x95, 0x01, // Report Count (1) 164 > + * 0x81, 0x06, // Input (Data,Var,Rel) 166 > + * 0xc0, // End Collection 168 > + * 0xc0, // End Collection 169 > + * 0x05, 0x01, // Usage Page (Generic Desktop) 170 > + * 0x09, 0x06, // Usage (Keyboard) 172 > + * 0xa1, 0x01, // Collection (Application) 174 > + * 0x85, 0x04, // Report ID (4) 176 > + * 0x05, 0x07, // Usage Page (Keyboard) 178 > + * 0x95, 0x01, // Report Count (1) 180 > + * 0x75, 0x08, // Report Size (8) 182 > + * 0x81, 0x03, // Input (Cnst,Var,Abs) 184 > + * 0x95, 0xe8, // Report Count (232) 186 > + * 0x75, 0x01, // Report Size (1) 188 > + * 0x15, 0x00, // Logical Minimum (0) 190 > + * 0x25, 0x01, // Logical Maximum (1) 192 > + * 0x05, 0x07, // Usage Page (Keyboard) 194 > + * 0x19, 0x00, // Usage Minimum (0) 196 > + * 0x29, 0xe7, // Usage Maximum (231) 198 > + * 0x81, 0x00, // Input (Data,Arr,Abs) 200 <- change to 0x81, 0x02 (Data,Var,Abs) > + * 0xc0, // End Collection 202 > + */ > + > +SEC(HID_BPF_RDESC_FIXUP) > +int BPF_PROG(hid_rdesc_fixup_mistel_md770, struct hid_bpf_ctx *hctx) > +{ > + __u8 *data = hid_bpf_get_data(hctx, 0, HID_MAX_DESCRIPTOR_SIZE); > + > + if (!data) > + return 0; /* EPERM check */ > + > + if (data[201] == 0x00) > + data[201] = 0x02; > + > + return 0; > +} > + > +HID_BPF_OPS(mistel_md770) = { > + .hid_rdesc_fixup = (void *)hid_rdesc_fixup_mistel_md770, > +}; > + > +SEC("syscall") > +int probe(struct hid_bpf_probe_args *ctx) > +{ > + ctx->retval = ctx->rdesc_size != RDESC_SIZE; > + if (ctx->retval) > + ctx->retval = -EINVAL; > + > + return 0; > +} > + > +char _license[] SEC("license") = "GPL"; >

10 months, 1 week

1
0
0 0

[PATCH 2/2] zram: cond_resched() in writeback loop

by Sergey Senozhatsky

zram writeback is a costly operation, because every target slot (unless ZRAM_HUGE) is decompressed before it gets written to a backing device. The writeback to a backing device uses submit_bio_wait() which may look like a rescheduling point. However, if the backing device has BD_HAS_SUBMIT_BIO bit set __submit_bio() calls directly disk->fops->submit_bio(bio) on the backing device and so when submit_bio_wait() calls blk_wait_io() the I/O is already done. On such systems we effective end up in a loop for_each (target slot) { decompress(slot) __submit_bio() disk->fops->submit_bio(bio) } Which on PREEMPT_NONE systems triggers watchdogs (since there are no explicit rescheduling points). Add cond_resched() to the zram writeback loop. Fixes: a939888ec38b ("zram: support idle/huge page writeback") Cc: stable(a)vger.kernel.org Signed-off-by: Sergey Senozhatsky <senozhatsky(a)chromium.org> --- drivers/block/zram/zram_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 0a924fae02a4..f5fa3db6b4f8 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -884,6 +884,8 @@ static ssize_t writeback_store(struct device *dev, next: zram_slot_unlock(zram, index); release_pp_slot(zram, pps); + + cond_resched(); } if (blk_idx) -- 2.47.1.613.gc27f4b7a9f-goog

10 months, 1 week

1
0
0 0

[PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()

by jianqi.ren.cn＠windriver.com

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ] Reported-by: Robert Morris <rtm(a)csail.mit.edu> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jianqi.ren.cn(a)windriver.com <jianqi.ren.cn(a)windriver.com> --- fs/ntfs3/record.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 7ab452710572..826a756669a3 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) if (t16 > asize) return NULL; - if (t16 + le32_to_cpu(attr->res.data_size) > asize) + if (le32_to_cpu(attr->res.data_size) > asize - t16) return NULL; if (attr->name_len && -- 2.25.1

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] drm/amd/display: fixed integer types and null check locations

by jianqi.ren.cn＠windriver.com

From: Sohaib Nadeem <sohaib.nadeem(a)amd.com> [ Upstream commit 0484e05d048b66d01d1f3c1d2306010bb57d8738 ] [why]: issues fixed: - comparison with wider integer type in loop condition which can cause infinite loops - pointer dereference before null check Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Josip Pavic <josip.pavic(a)amd.com> Acked-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Sohaib Nadeem <sohaib.nadeem(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- .../gpu/drm/amd/display/dc/bios/bios_parser2.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c index 4d2590964a20..75e44d8a7b40 100644 --- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c @@ -1862,19 +1862,21 @@ static enum bp_result get_firmware_info_v3_2( /* Vega12 */ smu_info_v3_2 = GET_IMAGE(struct atom_smu_info_v3_2, DATA_TABLES(smu_info)); - DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", smu_info_v3_2->gpuclk_ss_percentage); if (!smu_info_v3_2) return BP_RESULT_BADBIOSTABLE; + DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", smu_info_v3_2->gpuclk_ss_percentage); + info->default_engine_clk = smu_info_v3_2->bootup_dcefclk_10khz * 10; } else if (revision.minor == 3) { /* Vega20 */ smu_info_v3_3 = GET_IMAGE(struct atom_smu_info_v3_3, DATA_TABLES(smu_info)); - DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", smu_info_v3_3->gpuclk_ss_percentage); if (!smu_info_v3_3) return BP_RESULT_BADBIOSTABLE; + DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", smu_info_v3_3->gpuclk_ss_percentage); + info->default_engine_clk = smu_info_v3_3->bootup_dcefclk_10khz * 10; } @@ -2439,10 +2441,11 @@ static enum bp_result get_integrated_info_v11( info_v11 = GET_IMAGE(struct atom_integrated_system_info_v1_11, DATA_TABLES(integratedsysteminfo)); - DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", info_v11->gpuclk_ss_percentage); if (info_v11 == NULL) return BP_RESULT_BADBIOSTABLE; + DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", info_v11->gpuclk_ss_percentage); + info->gpu_cap_info = le32_to_cpu(info_v11->gpucapinfo); /* @@ -2654,11 +2657,12 @@ static enum bp_result get_integrated_info_v2_1( info_v2_1 = GET_IMAGE(struct atom_integrated_system_info_v2_1, DATA_TABLES(integratedsysteminfo)); - DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", info_v2_1->gpuclk_ss_percentage); if (info_v2_1 == NULL) return BP_RESULT_BADBIOSTABLE; + DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", info_v2_1->gpuclk_ss_percentage); + info->gpu_cap_info = le32_to_cpu(info_v2_1->gpucapinfo); /* @@ -2816,11 +2820,11 @@ static enum bp_result get_integrated_info_v2_2( info_v2_2 = GET_IMAGE(struct atom_integrated_system_info_v2_2, DATA_TABLES(integratedsysteminfo)); - DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", info_v2_2->gpuclk_ss_percentage); - if (info_v2_2 == NULL) return BP_RESULT_BADBIOSTABLE; + DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", info_v2_2->gpuclk_ss_percentage); + info->gpu_cap_info = le32_to_cpu(info_v2_2->gpucapinfo); /* -- 2.25.1

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup

by jianqi.ren.cn＠windriver.com

From: Kory Maincent <kory.maincent(a)bootlin.com> [ Upstream commit bbcc1c83f343e580c3aa1f2a8593343bf7b55bba ] The Linked list element and pointer are not stored in the same memory as the eDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred. Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support") Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Kory Maincent <kory.maincent(a)bootlin.com> Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-6-8e8c1acb7a… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/dma/dw-edma/dw-edma-v0-core.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c index a3816ba63285..4fe83d5a25b6 100644 --- a/drivers/dma/dw-edma/dw-edma-v0-core.c +++ b/drivers/dma/dw-edma/dw-edma-v0-core.c @@ -357,6 +357,20 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk) #endif /* CONFIG_64BIT */ } +static void dw_edma_v0_sync_ll_data(struct dw_edma_chunk *chunk) +{ + /* + * In case of remote eDMA engine setup, the DW PCIe RP/EP internal + * configuration registers and application memory are normally accessed + * over different buses. Ensure LL-data reaches the memory before the + * doorbell register is toggled by issuing the dummy-read from the remote + * LL memory in a hope that the MRd TLP will return only after the + * last MWr TLP is completed + */ + if (!(chunk->chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL)) + readl(chunk->ll_region.vaddr.io); +} + void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first) { struct dw_edma_chan *chan = chunk->chan; @@ -423,6 +437,9 @@ void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first) SET_CH_32(dw, chan->dir, chan->id, llp.msb, upper_32_bits(chunk->ll_region.paddr)); } + + dw_edma_v0_sync_ll_data(chunk); + /* Doorbell */ SET_RW_32(dw, chan->dir, doorbell, FIELD_PREP(EDMA_V0_DOORBELL_CH_MASK, chan->id)); -- 2.39.4

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] media: mtk-vcodec: potential null pointer deference in SCP

by jianqi.ren.cn＠windriver.com

From: Fullway Wang <fullwaywang(a)outlook.com> [ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ] The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113. Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@… Signed-off-by: Fullway Wang <fullwaywang(a)outlook.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c index d8e66b645bd8..27f08b1d34d1 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_fw_scp.c @@ -65,6 +65,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(struct mtk_vcodec_dev *dev) } fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL); + if (!fw) + return ERR_PTR(-ENOMEM); fw->type = SCP; fw->ops = &mtk_vcodec_rproc_msg; fw->scp = scp; -- 2.25.1

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute

by jianqi.ren.cn＠windriver.com

From: Wayne Lin <wayne.lin(a)amd.com> [ Upstream commit fcf6a49d79923a234844b8efe830a61f3f0584e4 ] [Why] When unplug one of monitors connected after mst hub, encounter null pointer dereference. It's due to dc_sink get released immediately in early_unregister() or detect_ctx(). When commit new state which directly referring to info stored in dc_sink will cause null pointer dereference. [how] Remove redundant checking condition. Relevant condition should already be covered by checking if dsc_aux is null or not. Also reset dsc_aux to NULL when the connector is disconnected. Reviewed-by: Jerry Zuo <jerry.zuo(a)amd.com> Acked-by: Zaeem Mohamed <zaeem.mohamed(a)amd.com> Signed-off-by: Wayne Lin <wayne.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c index 1acef5f3838f..a1619f4569cf 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c @@ -183,6 +183,8 @@ amdgpu_dm_mst_connector_early_unregister(struct drm_connector *connector) dc_sink_release(dc_sink); aconnector->dc_sink = NULL; aconnector->edid = NULL; + aconnector->dsc_aux = NULL; + port->passthrough_aux = NULL; } aconnector->mst_status = MST_STATUS_DEFAULT; @@ -487,6 +489,8 @@ dm_dp_mst_detect(struct drm_connector *connector, dc_sink_release(aconnector->dc_sink); aconnector->dc_sink = NULL; aconnector->edid = NULL; + aconnector->dsc_aux = NULL; + port->passthrough_aux = NULL; amdgpu_dm_set_mst_status(&aconnector->mst_status, MST_REMOTE_EDID | MST_ALLOCATE_NEW_PAYLOAD | MST_CLEAR_ALLOCATED_PAYLOAD, -- 2.25.1

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] smb: client: fix potential UAF in cifs_dump_full_key()

by jianqi.ren.cn＠windriver.com

From: Paulo Alcantara <pc(a)manguebit.com> [ Upstream commit 58acd1f497162e7d282077f816faa519487be045 ] Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- fs/smb/client/ioctl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/ioctl.c b/fs/smb/client/ioctl.c index ae9905e2b9d4..173c8c76d31f 100644 --- a/fs/smb/client/ioctl.c +++ b/fs/smb/client/ioctl.c @@ -246,17 +246,23 @@ static int cifs_dump_full_key(struct cifs_tcon *tcon, struct smb3_full_key_debug spin_lock(&cifs_tcp_ses_lock); list_for_each_entry(server_it, &cifs_tcp_ses_list, tcp_ses_list) { list_for_each_entry(ses_it, &server_it->smb_ses_list, smb_ses_list) { - if (ses_it->Suid == out.session_id) { + spin_lock(&ses_it->ses_lock); + if (ses_it->ses_status != SES_EXITING && + ses_it->Suid == out.session_id) { ses = ses_it; /* * since we are using the session outside the crit * section, we need to make sure it won't be released * so increment its refcount */ + + lockdep_assert_held(&cifs_tcp_ses_lock); ses->ses_count++; + spin_unlock(&ses_it->ses_lock); found = true; goto search_end; } + spin_unlock(&ses_it->ses_lock); } } search_end: -- 2.25.1

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup

by jianqi.ren.cn＠windriver.com

From: Kory Maincent <kory.maincent(a)bootlin.com> [ Upstream commit bbcc1c83f343e580c3aa1f2a8593343bf7b55bba ] The Linked list element and pointer are not stored in the same memory as the eDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred. Fixes: 7e4b8a4fbe2c ("dmaengine: Add Synopsys eDMA IP version 0 support") Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Kory Maincent <kory.maincent(a)bootlin.com> Link: https://lore.kernel.org/r/20240129-b4-feature_hdma_mainline-v7-6-8e8c1acb7a… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/dma/dw-edma/dw-edma-v0-core.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c index a3816ba63285..aeaae28fab85 100644 --- a/drivers/dma/dw-edma/dw-edma-v0-core.c +++ b/drivers/dma/dw-edma/dw-edma-v0-core.c @@ -357,6 +357,20 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk) #endif /* CONFIG_64BIT */ } +static void dw_edma_v0_sync_ll_data(struct dw_edma_chunk *chunk) +{ + /* + * In case of remote eDMA engine setup, the DW PCIe RP/EP internal + * configuration registers and application memory are normally accessed + * over different buses. Ensure LL-data reaches the memory before the + * doorbell register is toggled by issuing the dummy-read from the remote + * LL memory in a hope that the MRd TLP will return only after the + * last MWr TLP is completed + */ + if (!(chunk->chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL)) + readl(chunk->ll_region.vaddr); +} + void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first) { struct dw_edma_chan *chan = chunk->chan; @@ -423,6 +437,9 @@ void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first) SET_CH_32(dw, chan->dir, chan->id, llp.msb, upper_32_bits(chunk->ll_region.paddr)); } + + dw_edma_v0_sync_ll_data(chunk); + /* Doorbell */ SET_RW_32(dw, chan->dir, doorbell, FIELD_PREP(EDMA_V0_DOORBELL_CH_MASK, chan->id)); -- 2.39.4

10 months, 1 week

3
2
0 0

[PATCH 6.1.y] ssb: Fix potential NULL pointer dereference in ssb_device_uevent()

by jianqi.ren.cn＠windriver.com

From: Rand Deeb <rand.sec96(a)gmail.com> [ Upstream commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 ] The ssb_device_uevent() function first attempts to convert the 'dev' pointer to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before performing the NULL check, potentially leading to a NULL pointer dereference if 'dev' is NULL. To fix this issue, move the NULL check before dereferencing the 'dev' pointer, ensuring that the pointer is valid before attempting to use it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb <rand.sec96(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240306123028.164155-1-rand.sec96@gmail.com Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> --- drivers/ssb/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c index d52e91258e98..aae50a5dfb57 100644 --- a/drivers/ssb/main.c +++ b/drivers/ssb/main.c @@ -341,11 +341,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv) static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env) { - struct ssb_device *ssb_dev = dev_to_ssb_dev(dev); + struct ssb_device *ssb_dev; if (!dev) return -ENODEV; + ssb_dev = dev_to_ssb_dev(dev); + return add_uevent_var(env, "MODALIAS=ssb:v%04Xid%04Xrev%02X", ssb_dev->id.vendor, ssb_dev->id.coreid, -- 2.25.1

10 months, 1 week

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2024