- Linux-stable-mirror - lists.linaro.org

[PATCH] MIPS: Make the default for PHYSICAL_START always 64-bit

by Maciej W. Rozycki

Make the default for PHYSICAL_START always 64-bit, ensuring that a correct sign-extended value is used if a 32-bit image is loaded by a 64-bit system, and matching how the load address is set in platform Makefile fragments (arch/mips/*/Platform) in the absence of the PHYSICAL_START configuration option. Of course PHYSICAL_START itself is a misnomer as the load address is virtual rather than physical (or otherwise sign-extension would not apply). Signed-off-by: Maciej W. Rozycki <macro(a)mips.com> Fixes: 7aa1c8f47e7e ("MIPS: kdump: Add support") Cc: stable(a)vger.kernel.org # 3.8+ --- Hi James, As discussed in the context of commit 27c524d17430 ("MIPS: Use the entry point from the ELF file header"). This may require verifying by someone who actually uses this feature. I have cc-ed Maxim, the original author, in case he has anything to add. I'm not sure if we want to do anything about the physical vs virtual load address confusion. Please consider. Maciej --- arch/mips/Kconfig | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) linux-mips-physical-start.diff Index: linux-jhogan-test/arch/mips/Kconfig =================================================================== --- linux-jhogan-test.orig/arch/mips/Kconfig 2018-03-21 17:22:12.000000000 +0000 +++ linux-jhogan-test/arch/mips/Kconfig 2018-03-23 09:19:25.049100000 +0000 @@ -2849,8 +2849,7 @@ config CRASH_DUMP config PHYSICAL_START hex "Physical address where the kernel is loaded" - default "0xffffffff84000000" if 64BIT - default "0x84000000" if 32BIT + default "0xffffffff84000000" depends on CRASH_DUMP help This gives the CKSEG0 or KSEG0 address where the kernel is loaded.

7 years, 7 months

2
2
0 0

Re: [PATCH 4.14 000/109] 4.14.28-stable review

by Guenter Roeck

On Mon, Mar 19, 2018 at 02:13:23PM -0400, Kash Pande wrote: > On 2018-03-16 11:22 AM, Greg Kroah-Hartman wrote: > > This is the start of the stable review cycle for the 4.14.28 release. > > There are 109 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. > > > > Responses should be made by Sun Mar 18 15:22:53 UTC 2018. > > Anything received after that time might be too late. > > Any chance to get the k10temp change for Threadripper 1900X offset > reporting included [https://patchwork.kernel.org/patch/10175457/]? > Ryzen and Threadripper are only supported in v4.15+. Guenter

7 years, 7 months

4
7
0 0

Patch "staging: lustre: ptlrpc: kfree used instead of kvfree" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: lustre: ptlrpc: kfree used instead of kvfree to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From c3eec59659cf25916647d2178c541302bb4822ad Mon Sep 17 00:00:00 2001 From: Nadav Amit <namit(a)vmware.com> Date: Tue, 5 Sep 2017 20:25:25 +0000 Subject: staging: lustre: ptlrpc: kfree used instead of kvfree From: Nadav Amit <namit(a)vmware.com> commit c3eec59659cf25916647d2178c541302bb4822ad upstream. rq_reqbuf is allocated using kvmalloc() but released in one occasion using kfree() instead of kvfree(). The issue was found using grep based on a similar bug. Fixes: d7e09d0397e8 ("add Lustre file system client support") Fixes: ee0ec1946ec2 ("lustre: ptlrpc: Replace uses of OBD_{ALLOC,FREE}_LARGE") Cc: Peng Tao <bergwolf(a)gmail.com> Cc: Oleg Drokin <oleg.drokin(a)intel.com> Cc: James Simmons <jsimmons(a)infradead.org> Signed-off-by: Nadav Amit <namit(a)vmware.com> Signed-off-by: Andreas Dilger <andreas.dilger(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/staging/lustre/lustre/ptlrpc/sec.c +++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c @@ -838,7 +838,7 @@ void sptlrpc_request_out_callback(struct if (req->rq_pool || !req->rq_reqbuf) return; - kfree(req->rq_reqbuf); + kvfree(req->rq_reqbuf); req->rq_reqbuf = NULL; req->rq_reqbuf_len = 0; } Patches currently in stable-queue which might be from namit(a)vmware.com are queue-4.9/staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch

7 years, 7 months

1
0
0 0

Patch "iio: ABI: Fix name of timestamp sysfs file" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: ABI: Fix name of timestamp sysfs file to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: iio-abi-fix-name-of-timestamp-sysfs-file.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b9a3589332c2a25fb7edad25a26fcaada3209126 Mon Sep 17 00:00:00 2001 From: Linus Walleij <linus.walleij(a)linaro.org> Date: Tue, 5 Dec 2017 11:57:27 +0100 Subject: iio: ABI: Fix name of timestamp sysfs file From: Linus Walleij <linus.walleij(a)linaro.org> commit b9a3589332c2a25fb7edad25a26fcaada3209126 upstream. The name of the file is "current_timetamp_clock" not "timestamp_clock". Fixes: bc2b7dab629a ("iio:core: timestamping clock selection support") Cc: Gregor Boirie <gregor.boirie(a)parrot.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- Documentation/ABI/testing/sysfs-bus-iio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/Documentation/ABI/testing/sysfs-bus-iio +++ b/Documentation/ABI/testing/sysfs-bus-iio @@ -32,7 +32,7 @@ Description: Description of the physical chip / device for device X. Typically a part number. -What: /sys/bus/iio/devices/iio:deviceX/timestamp_clock +What: /sys/bus/iio/devices/iio:deviceX/current_timestamp_clock KernelVersion: 4.5 Contact: linux-iio(a)vger.kernel.org Description: Patches currently in stable-queue which might be from linus.walleij(a)linaro.org are queue-4.9/iio-abi-fix-name-of-timestamp-sysfs-file.patch

7 years, 7 months

1
0
0 0

Patch "staging: lustre: ptlrpc: kfree used instead of kvfree" has been added to the 4.4-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: lustre: ptlrpc: kfree used instead of kvfree to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From c3eec59659cf25916647d2178c541302bb4822ad Mon Sep 17 00:00:00 2001 From: Nadav Amit <namit(a)vmware.com> Date: Tue, 5 Sep 2017 20:25:25 +0000 Subject: staging: lustre: ptlrpc: kfree used instead of kvfree From: Nadav Amit <namit(a)vmware.com> commit c3eec59659cf25916647d2178c541302bb4822ad upstream. rq_reqbuf is allocated using kvmalloc() but released in one occasion using kfree() instead of kvfree(). The issue was found using grep based on a similar bug. Fixes: d7e09d0397e8 ("add Lustre file system client support") Fixes: ee0ec1946ec2 ("lustre: ptlrpc: Replace uses of OBD_{ALLOC,FREE}_LARGE") Cc: Peng Tao <bergwolf(a)gmail.com> Cc: Oleg Drokin <oleg.drokin(a)intel.com> Cc: James Simmons <jsimmons(a)infradead.org> Signed-off-by: Nadav Amit <namit(a)vmware.com> Signed-off-by: Andreas Dilger <andreas.dilger(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/staging/lustre/lustre/ptlrpc/sec.c +++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c @@ -824,7 +824,7 @@ void sptlrpc_request_out_callback(struct if (req->rq_pool || !req->rq_reqbuf) return; - kfree(req->rq_reqbuf); + kvfree(req->rq_reqbuf); req->rq_reqbuf = NULL; req->rq_reqbuf_len = 0; } Patches currently in stable-queue which might be from namit(a)vmware.com are queue-4.4/staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch

7 years, 7 months

1
0
0 0

Patch "staging: android: ion: Zero CMA allocated memory" has been added to the 4.15-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: android: ion: Zero CMA allocated memory to the 4.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: staging-android-ion-zero-cma-allocated-memory.patch and it can be found in the queue-4.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 6d79bd5bb6c79a9dba4842040c9adf39e7806330 Mon Sep 17 00:00:00 2001 From: Liam Mark <lmark(a)codeaurora.org> Date: Fri, 26 Jan 2018 09:48:18 -0800 Subject: staging: android: ion: Zero CMA allocated memory From: Liam Mark <lmark(a)codeaurora.org> commit 6d79bd5bb6c79a9dba4842040c9adf39e7806330 upstream. Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly") the CMA API is now used directly and therefore the allocated memory is no longer automatically zeroed. Explicitly zero CMA allocated memory to ensure that no data is exposed to userspace. Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") Signed-off-by: Liam Mark <lmark(a)codeaurora.org> Acked-by: Laura Abbott <labbott(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/staging/android/ion/ion_cma_heap.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/drivers/staging/android/ion/ion_cma_heap.c +++ b/drivers/staging/android/ion/ion_cma_heap.c @@ -21,6 +21,7 @@ #include <linux/err.h> #include <linux/cma.h> #include <linux/scatterlist.h> +#include <linux/highmem.h> #include "ion.h" @@ -51,6 +52,22 @@ static int ion_cma_allocate(struct ion_h if (!pages) return -ENOMEM; + if (PageHighMem(pages)) { + unsigned long nr_clear_pages = nr_pages; + struct page *page = pages; + + while (nr_clear_pages > 0) { + void *vaddr = kmap_atomic(page); + + memset(vaddr, 0, PAGE_SIZE); + kunmap_atomic(vaddr); + page++; + nr_clear_pages--; + } + } else { + memset(page_address(pages), 0, size); + } + table = kmalloc(sizeof(*table), GFP_KERNEL); if (!table) goto err; Patches currently in stable-queue which might be from lmark(a)codeaurora.org are queue-4.15/staging-android-ion-zero-cma-allocated-memory.patch

7 years, 7 months

1
0
0 0

Patch "iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot()" has been added to the 4.15-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot() to the 4.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch and it can be found in the queue-4.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 7b9ebe428266fb7e0a6d769bb3ff3fcb6044b15e Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> Date: Mon, 1 Jan 2018 19:54:42 +0100 Subject: iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot() From: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> commit 7b9ebe428266fb7e0a6d769bb3ff3fcb6044b15e upstream. Apply le16_to_cpu() to data read from the sensor in order to take into account architecture endianness Fixes: 290a6ce11d93 (iio: imu: add support to lsm6dsx driver) Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c @@ -448,7 +448,7 @@ static int st_lsm6dsx_read_oneshot(struc st_lsm6dsx_sensor_disable(sensor); - *val = (s16)data; + *val = (s16)le16_to_cpu(data); return IIO_VAL_INT; } Patches currently in stable-queue which might be from lorenzo.bianconi(a)redhat.com are queue-4.15/iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch queue-4.15/iio-imu-st_lsm6dsx-introduce-conf_lock-mutex.patch

7 years, 7 months

1
0
0 0

Patch "iio: imu: st_lsm6dsx: introduce conf_lock mutex" has been added to the 4.15-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: imu: st_lsm6dsx: introduce conf_lock mutex to the 4.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: iio-imu-st_lsm6dsx-introduce-conf_lock-mutex.patch and it can be found in the queue-4.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 335eaedce461c9092e133ce0c6247f5a0b0baf69 Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> Date: Mon, 1 Jan 2018 19:54:43 +0100 Subject: iio: imu: st_lsm6dsx: introduce conf_lock mutex From: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> commit 335eaedce461c9092e133ce0c6247f5a0b0baf69 upstream. Add conf_lock mutex to prevent concurrent FIFO configuration update Fixes: 290a6ce11d93 (iio: imu: add support to lsm6dsx driver) Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 ++ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 21 +++++++++++++-------- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 6 ++++++ 3 files changed, 21 insertions(+), 8 deletions(-) --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h @@ -130,6 +130,7 @@ struct st_lsm6dsx_sensor { * @irq: Device interrupt line (I2C or SPI). * @lock: Mutex to protect read and write operations. * @fifo_lock: Mutex to prevent concurrent access to the hw FIFO. + * @conf_lock: Mutex to prevent concurrent FIFO configuration update. * @fifo_mode: FIFO operating mode supported by the device. * @enable_mask: Enabled sensor bitmask. * @sip: Total number of samples (acc/gyro) in a given pattern. @@ -144,6 +145,7 @@ struct st_lsm6dsx_hw { struct mutex lock; struct mutex fifo_lock; + struct mutex conf_lock; enum st_lsm6dsx_fifo_mode fifo_mode; u8 enable_mask; --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c @@ -325,38 +325,40 @@ static int st_lsm6dsx_update_fifo(struct struct st_lsm6dsx_hw *hw = sensor->hw; int err; + mutex_lock(&hw->conf_lock); + if (hw->fifo_mode != ST_LSM6DSX_FIFO_BYPASS) { err = st_lsm6dsx_flush_fifo(hw); if (err < 0) - return err; + goto out; } if (enable) { err = st_lsm6dsx_sensor_enable(sensor); if (err < 0) - return err; + goto out; } else { err = st_lsm6dsx_sensor_disable(sensor); if (err < 0) - return err; + goto out; } err = st_lsm6dsx_set_fifo_odr(sensor, enable); if (err < 0) - return err; + goto out; err = st_lsm6dsx_update_decimators(hw); if (err < 0) - return err; + goto out; err = st_lsm6dsx_update_watermark(sensor, sensor->watermark); if (err < 0) - return err; + goto out; if (hw->enable_mask) { err = st_lsm6dsx_set_fifo_mode(hw, ST_LSM6DSX_FIFO_CONT); if (err < 0) - return err; + goto out; /* * store enable buffer timestamp as reference to compute @@ -365,7 +367,10 @@ static int st_lsm6dsx_update_fifo(struct sensor->ts = iio_get_time_ns(iio_dev); } - return 0; +out: + mutex_unlock(&hw->conf_lock); + + return err; } static irqreturn_t st_lsm6dsx_handler_irq(int irq, void *private) --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c @@ -528,7 +528,12 @@ static int st_lsm6dsx_set_watermark(stru if (val < 1 || val > hw->settings->max_fifo_size) return -EINVAL; + mutex_lock(&hw->conf_lock); + err = st_lsm6dsx_update_watermark(sensor, val); + + mutex_unlock(&hw->conf_lock); + if (err < 0) return err; @@ -739,6 +744,7 @@ int st_lsm6dsx_probe(struct device *dev, mutex_init(&hw->lock); mutex_init(&hw->fifo_lock); + mutex_init(&hw->conf_lock); hw->dev = dev; hw->irq = irq; Patches currently in stable-queue which might be from lorenzo.bianconi(a)redhat.com are queue-4.15/iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch queue-4.15/iio-imu-st_lsm6dsx-introduce-conf_lock-mutex.patch

7 years, 7 months

1
0
0 0

Patch "iio: ABI: Fix name of timestamp sysfs file" has been added to the 4.15-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: ABI: Fix name of timestamp sysfs file to the 4.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: iio-abi-fix-name-of-timestamp-sysfs-file.patch and it can be found in the queue-4.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b9a3589332c2a25fb7edad25a26fcaada3209126 Mon Sep 17 00:00:00 2001 From: Linus Walleij <linus.walleij(a)linaro.org> Date: Tue, 5 Dec 2017 11:57:27 +0100 Subject: iio: ABI: Fix name of timestamp sysfs file From: Linus Walleij <linus.walleij(a)linaro.org> commit b9a3589332c2a25fb7edad25a26fcaada3209126 upstream. The name of the file is "current_timetamp_clock" not "timestamp_clock". Fixes: bc2b7dab629a ("iio:core: timestamping clock selection support") Cc: Gregor Boirie <gregor.boirie(a)parrot.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio index 9cc0ea1c0273..6a5f34b4d5b9 100644 --- a/Documentation/ABI/testing/sysfs-bus-iio +++ b/Documentation/ABI/testing/sysfs-bus-iio @@ -32,7 +32,7 @@ Description: Description of the physical chip / device for device X. Typically a part number. -What: /sys/bus/iio/devices/iio:deviceX/timestamp_clock +What: /sys/bus/iio/devices/iio:deviceX/current_timestamp_clock KernelVersion: 4.5 Contact: linux-iio(a)vger.kernel.org Description: Patches currently in stable-queue which might be from linus.walleij(a)linaro.org are queue-4.15/pinctrl-samsung-validate-alias-coming-from-dt.patch queue-4.15/iio-abi-fix-name-of-timestamp-sysfs-file.patch

7 years, 7 months

1
0
0 0

Patch "usb: xhci: Fix potential memory leak in xhci_disable_slot()" has been added to the 4.14-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled usb: xhci: Fix potential memory leak in xhci_disable_slot() to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From cd3f1790b006d91786728c20a01da21ee277aff1 Mon Sep 17 00:00:00 2001 From: Lu Baolu <baolu.lu(a)linux.intel.com> Date: Thu, 5 Oct 2017 11:21:41 +0300 Subject: usb: xhci: Fix potential memory leak in xhci_disable_slot() From: Lu Baolu <baolu.lu(a)linux.intel.com> commit cd3f1790b006d91786728c20a01da21ee277aff1 upstream. xhci_disable_slot() allows the invoker to pass a command pointer as paramenter. Otherwise, it will allocate one. This will cause memory leak when a command structure was allocated inside of this function while queuing command trb fails. Another problem comes up when the invoker passed a command pointer, but xhci_disable_slot() frees it when it detects a dead host. This patch fixes these two problems by removing the command parameter from xhci_disable_slot(). Fixes: f9e609b82479 ("usb: xhci: Add helper function xhci_disable_slot().") Cc: Guoqing Zhang <guoqing.zhang(a)intel.com> Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci.c | 30 +++++++++--------------------- drivers/usb/host/xhci.h | 3 +-- 3 files changed, 11 insertions(+), 24 deletions(-) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -637,7 +637,7 @@ static int xhci_enter_test_mode(struct x if (!xhci->devs[i]) continue; - retval = xhci_disable_slot(xhci, NULL, i); + retval = xhci_disable_slot(xhci, i); if (retval) xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", i, retval); --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3523,11 +3523,6 @@ static void xhci_free_dev(struct usb_hcd struct xhci_virt_device *virt_dev; struct xhci_slot_ctx *slot_ctx; int i, ret; - struct xhci_command *command; - - command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); - if (!command) - return; #ifndef CONFIG_USB_DEFAULT_PERSIST /* @@ -3543,10 +3538,8 @@ static void xhci_free_dev(struct usb_hcd /* If the host is halted due to driver unload, we still need to free the * device. */ - if (ret <= 0 && ret != -ENODEV) { - kfree(command); + if (ret <= 0 && ret != -ENODEV) return; - } virt_dev = xhci->devs[udev->slot_id]; slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx); @@ -3558,22 +3551,21 @@ static void xhci_free_dev(struct usb_hcd del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); } - xhci_disable_slot(xhci, command, udev->slot_id); + xhci_disable_slot(xhci, udev->slot_id); /* * Event command completion handler will free any data structures * associated with the slot. XXX Can free sleep? */ } -int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command, - u32 slot_id) +int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) { + struct xhci_command *command; unsigned long flags; u32 state; int ret = 0; - if (!command) - command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); + command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); if (!command) return -ENOMEM; @@ -3591,7 +3583,7 @@ int xhci_disable_slot(struct xhci_hcd *x slot_id); if (ret) { spin_unlock_irqrestore(&xhci->lock, flags); - xhci_dbg(xhci, "FIXME: allocate a command ring segment\n"); + kfree(command); return ret; } xhci_ring_cmd_db(xhci); @@ -3666,6 +3658,8 @@ int xhci_alloc_dev(struct usb_hcd *hcd, return 0; } + xhci_free_command(xhci, command); + if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) { spin_lock_irqsave(&xhci->lock, flags); ret = xhci_reserve_host_control_ep_resources(xhci); @@ -3701,18 +3695,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, pm_runtime_get_noresume(hcd->self.controller); #endif - - xhci_free_command(xhci, command); /* Is this a LS or FS device under a HS hub? */ /* Hub or peripherial? */ return 1; disable_slot: - /* Disable slot, if we can do it without mem alloc */ - kfree(command->completion); - command->completion = NULL; - command->status = 0; - return xhci_disable_slot(xhci, command, udev->slot_id); + return xhci_disable_slot(xhci, udev->slot_id); } /* --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -2014,8 +2014,7 @@ int xhci_run(struct usb_hcd *hcd); int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); void xhci_init_driver(struct hc_driver *drv, const struct xhci_driver_overrides *over); -int xhci_disable_slot(struct xhci_hcd *xhci, - struct xhci_command *command, u32 slot_id); +int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); int xhci_resume(struct xhci_hcd *xhci, bool hibernated); Patches currently in stable-queue which might be from baolu.lu(a)linux.intel.com are queue-4.14/usb-xhci-disable-slot-even-when-virt-dev-is-null.patch queue-4.14/usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch

7 years, 7 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror