The pdev->dev.of_node can be NULL if the "serial" node is absent.
Add a NULL check for np to return an error in such cases.
Found by code review. Compile tested only.
Cc: stable(a)vger.kernel.org
Fixes: 09864c1cdf5c ("tty: serial: Add linflexuart driver for S32V234")
Signed-off-by: Ma Ke <make24(a)iscas.ac.cn>
---
drivers/tty/serial/fsl_linflexuart.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/fsl_linflexuart.c b/drivers/tty/serial/fsl_linflexuart.c
index e972df4b188d..f46f3c21ee1b 100644
--- a/drivers/tty/serial/fsl_linflexuart.c
+++ b/drivers/tty/serial/fsl_linflexuart.c
@@ -811,6 +811,9 @@ static int linflex_probe(struct platform_device *pdev)
struct resource *res;
int ret;
+ if (!np)
+ return -ENODEV;
+
sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL);
if (!sport)
return -ENOMEM;
--
2.25.1
On 13/08/2024 22:03, Vladimir Zapolskiy wrote:
> There is a chance to meet runtime issues during configuration of CAMSS
> power domains, because on the error path dev_pm_domain_detach() is
> unexpectedly called with NULL or error pointer.
>
> One of the simplest ways to reproduce the problem is to probe CAMSS
> driver before registration of CAMSS power domains, for instance if
> a platform CAMCC driver is simply not built.
>
> Warning backtrace example:
>
> Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2
>
> <snip>
>
> pc : dev_pm_domain_detach+0x8/0x48
> lr : camss_probe+0x374/0x9c0
>
> <snip>
>
> Call trace:
> dev_pm_domain_detach+0x8/0x48
> platform_probe+0x70/0xf0
> really_probe+0xc4/0x2a8
> __driver_probe_device+0x80/0x140
> driver_probe_device+0x48/0x170
> __device_attach_driver+0xc0/0x148
> bus_for_each_drv+0x88/0xf0
> __device_attach+0xb0/0x1c0
> device_initial_probe+0x1c/0x30
> bus_probe_device+0xb4/0xc0
> deferred_probe_work_func+0x90/0xd0
> process_one_work+0x164/0x3e0
> worker_thread+0x310/0x420
> kthread+0x120/0x130
> ret_from_fork+0x10/0x20
>
> Fixes: 23aa4f0cd327 ("media: qcom: camss: Move VFE power-domain specifics into vfe.c")
> Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy(a)linaro.org>
> ---
> The first version of the patch and discussion is found over here:
>
> https://lore.kernel.org/all/20240806221204.1560258-1-vladimir.zapolskiy@lin…
>
> Changes from v1 to v2:
> * added an encountered runtime warning to the commit message per ask from Bryan.
>
> I tested this fix in both cases of set and unset "power-domain-names"
> property in camss device tree node, and I didn't find any negative side
> effects of the fix.
>
> drivers/media/platform/qcom/camss/camss.c | 19 ++++++++-----------
> 1 file changed, 8 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
> index 51b1d3550421..aa894be1461d 100644
> --- a/drivers/media/platform/qcom/camss/camss.c
> +++ b/drivers/media/platform/qcom/camss/camss.c
+ stable(a)vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: atomisp: Fix streaming no longer working on BYT / ISP2400 devices
Author: Hans de Goede <hdegoede(a)redhat.com>
Date: Sun Jul 21 17:38:40 2024 +0200
Commit a0821ca14bb8 ("media: atomisp: Remove test pattern generator (TPG)
support") broke BYT support because it removed a seemingly unused field
from struct sh_css_sp_config and a seemingly unused value from enum
ia_css_input_mode.
But these are part of the ABI between the kernel and firmware on ISP2400
and this part of the TPG support removal changes broke ISP2400 support.
ISP2401 support was not affected because on ISP2401 only a part of
struct sh_css_sp_config is used.
Restore the removed field and enum value to fix this.
Fixes: a0821ca14bb8 ("media: atomisp: Remove test pattern generator (TPG) support")
Cc: stable(a)vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede(a)redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
.../staging/media/atomisp/pci/ia_css_stream_public.h | 8 ++++++--
drivers/staging/media/atomisp/pci/sh_css_internal.h | 19 ++++++++++++++++---
2 files changed, 22 insertions(+), 5 deletions(-)
---
diff --git a/drivers/staging/media/atomisp/pci/ia_css_stream_public.h b/drivers/staging/media/atomisp/pci/ia_css_stream_public.h
index 961c61288083..aad860e54d3a 100644
--- a/drivers/staging/media/atomisp/pci/ia_css_stream_public.h
+++ b/drivers/staging/media/atomisp/pci/ia_css_stream_public.h
@@ -27,12 +27,16 @@
#include "ia_css_prbs.h"
#include "ia_css_input_port.h"
-/* Input modes, these enumerate all supported input modes.
- * Note that not all ISP modes support all input modes.
+/*
+ * Input modes, these enumerate all supported input modes.
+ * This enum is part of the atomisp firmware ABI and must
+ * NOT be changed!
+ * Note that not all ISP modes support all input modes.
*/
enum ia_css_input_mode {
IA_CSS_INPUT_MODE_SENSOR, /** data from sensor */
IA_CSS_INPUT_MODE_FIFO, /** data from input-fifo */
+ IA_CSS_INPUT_MODE_TPG, /** data from test-pattern generator */
IA_CSS_INPUT_MODE_PRBS, /** data from pseudo-random bit stream */
IA_CSS_INPUT_MODE_MEMORY, /** data from a frame in memory */
IA_CSS_INPUT_MODE_BUFFERED_SENSOR /** data is sent through mipi buffer */
diff --git a/drivers/staging/media/atomisp/pci/sh_css_internal.h b/drivers/staging/media/atomisp/pci/sh_css_internal.h
index a2d972ea3fa0..959e7f549641 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_internal.h
+++ b/drivers/staging/media/atomisp/pci/sh_css_internal.h
@@ -344,7 +344,14 @@ struct sh_css_sp_input_formatter_set {
#define IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT (3)
-/* SP configuration information */
+/*
+ * SP configuration information
+ *
+ * This struct is part of the atomisp firmware ABI and is directly copied
+ * to ISP DRAM by sh_css_store_sp_group_to_ddr()
+ *
+ * Do NOT change this struct's layout or remove seemingly unused fields!
+ */
struct sh_css_sp_config {
u8 no_isp_sync; /* Signal host immediately after start */
u8 enable_raw_pool_locking; /** Enable Raw Buffer Locking for HALv3 Support */
@@ -354,6 +361,10 @@ struct sh_css_sp_config {
host (true) or when they are passed to the preview/video pipe
(false). */
+ /*
+ * Note the fields below are only used on the ISP2400 not on the ISP2401,
+ * sh_css_store_sp_group_to_ddr() skip copying these when run on the ISP2401.
+ */
struct {
u8 a_changed;
u8 b_changed;
@@ -363,11 +374,13 @@ struct sh_css_sp_config {
} input_formatter;
sync_generator_cfg_t sync_gen;
+ tpg_cfg_t tpg;
prbs_cfg_t prbs;
input_system_cfg_t input_circuit;
u8 input_circuit_cfg_changed;
- u32 mipi_sizes_for_check[N_CSI_PORTS][IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT];
- u8 enable_isys_event_queue;
+ u32 mipi_sizes_for_check[N_CSI_PORTS][IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT];
+ /* These last 2 fields are used on both the ISP2400 and the ISP2401 */
+ u8 enable_isys_event_queue;
u8 disable_cont_vf;
};
When operating in High-Speed, it is observed that DSTS[USBLNKST] doesn't
update link state immediately after receiving the wakeup interrupt. Since
wakeup event handler calls the resume callbacks, there is a chance that
function drivers can perform an ep queue. Which in turn tries to perform
remote wakeup from send_gadget_ep_cmd(), this happens because DSTS[[21:18]
wasn't updated to U0 yet. It is observed that the latency of DSTS can be
in order of milli-seconds. Hence update the dwc->link_state from evtinfo,
and use this variable to prevent calling remote wakup unnecessarily.
Fixes: ecba9bc9946b ("usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Prashanth K <quic_prashk(a)quicinc.com>
---
drivers/usb/dwc3/gadget.c | 25 ++++++++++++++++++-------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 89fc690fdf34..3b55285118b0 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -328,7 +328,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
}
if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
- int link_state;
+ int link_state;
+ bool remote_wakeup = false;
/*
* Initiate remote wakeup if the link state is in U3 when
@@ -339,15 +340,26 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
link_state = dwc3_gadget_get_link_state(dwc);
switch (link_state) {
case DWC3_LINK_STATE_U2:
- if (dwc->gadget->speed >= USB_SPEED_SUPER)
+ if (dwc->gadget->speed < USB_SPEED_SUPER)
+ remote_wakeup = true;
+ break;
+ case DWC3_LINK_STATE_U3:
+ /*
+ * In HS, DSTS can take few milliseconds to update linkstate bits,
+ * so rely on dwc->link_state to identify whether gadget woke up.
+ * Don't issue remote wakuep again if link is already in U0.
+ */
+ if (dwc->link_state == DWC3_LINK_STATE_U0)
break;
- fallthrough;
- case DWC3_LINK_STATE_U3:
+ remote_wakeup = true;
+ break;
+ }
+
+ if (remote_wakeup) {
ret = __dwc3_gadget_wakeup(dwc, false);
dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n",
ret);
- break;
}
}
@@ -4214,6 +4226,7 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
static void dwc3_gadget_wakeup_interrupt(struct dwc3 *dwc, unsigned int evtinfo)
{
dwc->suspended = false;
+ dwc->link_state = evtinfo & DWC3_LINK_STATE_MASK;
/*
* TODO take core out of low power mode when that's
@@ -4225,8 +4238,6 @@ static void dwc3_gadget_wakeup_interrupt(struct dwc3 *dwc, unsigned int evtinfo)
dwc->gadget_driver->resume(dwc->gadget);
spin_lock(&dwc->lock);
}
-
- dwc->link_state = evtinfo & DWC3_LINK_STATE_MASK;
}
static void dwc3_gadget_linksts_change_interrupt(struct dwc3 *dwc,
--
2.25.1
The pmd_trans_huge() code in mfill_atomic() is wrong in three different
ways depending on kernel version:
1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit
the right two race windows) - I've tested this in a kernel build with
some extra mdelay() calls. See the commit message for a description
of the race scenario.
On older kernels (before 6.5), I think the same bug can even
theoretically lead to accessing transhuge page contents as a page table
if you hit the right 5 narrow race windows (I haven't tested this case).
2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for
detecting PMDs that don't point to page tables.
On older kernels (before 6.5), you'd just have to win a single fairly
wide race to hit this.
I've tested this on 6.1 stable by racing migration (with a mdelay()
patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86
VM, that causes a kernel oops in ptlock_ptr().
3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed
to yank page tables out from under us (though I haven't tested that),
so I think the BUG_ON() checks in mfill_atomic() are just wrong.
I decided to write two separate fixes for these (one fix for bugs 1+2,
one fix for bug 3), so that the first fix can be backported to kernels
affected by bugs 1+2.
Signed-off-by: Jann Horn <jannh(a)google.com>
---
Changes in v2:
- in patch 1/2:
- change title
- get rid of redundant early pmd_trans_huge() check
- also check for swap PMDs and devmap PMDs (Qi Zheng)
- Link to v1: https://lore.kernel.org/r/20240812-uffd-thp-flip-fix-v1-0-4fc1db7ccdd0@goog…
---
Jann Horn (2):
userfaultfd: Fix checks for huge PMDs
userfaultfd: Don't BUG_ON() if khugepaged yanks our page table
mm/userfaultfd.c | 29 ++++++++++++++++-------------
1 file changed, 16 insertions(+), 13 deletions(-)
---
base-commit: d4560686726f7a357922f300fc81f5964be8df04
change-id: 20240812-uffd-thp-flip-fix-20f91f1151b9
--
Jann Horn <jannh(a)google.com>
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit f17c06c6608ad4ecd2ccf321753fb511812d821b ]
Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI
functions.
The conditional around these functions depended only on CONFIG_ACPI.
But the functions are implemented in I2C core, so are only present if
CONFIG_I2C is enabled.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/linux/i2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index af2b799d7a665..fee64a24f9877 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -979,7 +979,7 @@ static inline int of_i2c_get_board_info(struct device *dev,
struct acpi_resource;
struct acpi_resource_i2c_serialbus;
-#if IS_ENABLED(CONFIG_ACPI)
+#if IS_ENABLED(CONFIG_ACPI) && IS_ENABLED(CONFIG_I2C)
bool i2c_acpi_get_i2c_resource(struct acpi_resource *ares,
struct acpi_resource_i2c_serialbus **i2c);
u32 i2c_acpi_find_bus_speed(struct device *dev);
--
2.43.0
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit f17c06c6608ad4ecd2ccf321753fb511812d821b ]
Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI
functions.
The conditional around these functions depended only on CONFIG_ACPI.
But the functions are implemented in I2C core, so are only present if
CONFIG_I2C is enabled.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/linux/i2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index a670ae129f4b9..cbd2025a002ea 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -991,7 +991,7 @@ static inline int of_i2c_get_board_info(struct device *dev,
struct acpi_resource;
struct acpi_resource_i2c_serialbus;
-#if IS_ENABLED(CONFIG_ACPI)
+#if IS_ENABLED(CONFIG_ACPI) && IS_ENABLED(CONFIG_I2C)
bool i2c_acpi_get_i2c_resource(struct acpi_resource *ares,
struct acpi_resource_i2c_serialbus **i2c);
u32 i2c_acpi_find_bus_speed(struct device *dev);
--
2.43.0
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit f17c06c6608ad4ecd2ccf321753fb511812d821b ]
Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI
functions.
The conditional around these functions depended only on CONFIG_ACPI.
But the functions are implemented in I2C core, so are only present if
CONFIG_I2C is enabled.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/linux/i2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index f071a121ed914..dbb6aa3daf89b 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -1025,7 +1025,7 @@ static inline int of_i2c_get_board_info(struct device *dev,
struct acpi_resource;
struct acpi_resource_i2c_serialbus;
-#if IS_ENABLED(CONFIG_ACPI)
+#if IS_ENABLED(CONFIG_ACPI) && IS_ENABLED(CONFIG_I2C)
bool i2c_acpi_get_i2c_resource(struct acpi_resource *ares,
struct acpi_resource_i2c_serialbus **i2c);
int i2c_acpi_client_count(struct acpi_device *adev);
--
2.43.0
From: Richard Fitzgerald <rf(a)opensource.cirrus.com>
[ Upstream commit f17c06c6608ad4ecd2ccf321753fb511812d821b ]
Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI
functions.
The conditional around these functions depended only on CONFIG_ACPI.
But the functions are implemented in I2C core, so are only present if
CONFIG_I2C is enabled.
Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com>
Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
include/linux/i2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index cfc59c3371cb2..aeb94241db52e 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -1035,7 +1035,7 @@ static inline int of_i2c_get_board_info(struct device *dev,
struct acpi_resource;
struct acpi_resource_i2c_serialbus;
-#if IS_ENABLED(CONFIG_ACPI)
+#if IS_ENABLED(CONFIG_ACPI) && IS_ENABLED(CONFIG_I2C)
bool i2c_acpi_get_i2c_resource(struct acpi_resource *ares,
struct acpi_resource_i2c_serialbus **i2c);
int i2c_acpi_client_count(struct acpi_device *adev);
--
2.43.0