- Linux-stable-mirror - lists.linaro.org

[PATCH v4] drm/client: fix null pointer dereference in drm_client_modeset_probe

by Ma Ke

In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: cf13909aee05 ("drm/fb-helper: Move out modeset config code") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v4: - modified patch, set ret and break to handle error rightly. Changes in v3: - modified patch as suggestions, returned error directly when failing to get modeset->mode. Changes in v2: - added the recipient's email address, due to the prolonged absence of a response from the recipients. - added Cc stable. --- drivers/gpu/drm/drm_client_modeset.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c index 31af5cf37a09..cee5eafbfb81 100644 --- a/drivers/gpu/drm/drm_client_modeset.c +++ b/drivers/gpu/drm/drm_client_modeset.c @@ -880,6 +880,11 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, kfree(modeset->mode); modeset->mode = drm_mode_duplicate(dev, mode); + if (!modeset->mode) { + ret = -ENOMEM; + break; + } + drm_connector_get(connector); modeset->connectors[modeset->num_connectors++] = connector; modeset->x = offset->x; -- 2.25.1

1 year, 1 month

1
0
0 0

[PATCH v3] drm/client: fix null pointer dereference in drm_client_modeset_probe

by Ma Ke

In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: cf13909aee05 ("drm/fb-helper: Move out modeset config code") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v3: - modified patch as suggestions, returned error directly when failing to get modeset->mode. Changes in v2: - added the recipient's email address, due to the prolonged absence of a response from the recipients. - added Cc stable. --- drivers/gpu/drm/drm_client_modeset.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c index 31af5cf37a09..750b8dce0f90 100644 --- a/drivers/gpu/drm/drm_client_modeset.c +++ b/drivers/gpu/drm/drm_client_modeset.c @@ -880,6 +880,9 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, kfree(modeset->mode); modeset->mode = drm_mode_duplicate(dev, mode); + if (!modeset->mode) + return 0; + drm_connector_get(connector); modeset->connectors[modeset->num_connectors++] = connector; modeset->x = offset->x; -- 2.25.1

1 year, 1 month

2
4
0 0

Re: [PATCH 6.9 000/250] 6.9.7-rc1 review

by Pavel Machek

On Wed 2024-07-24 18:48:20, DAVIETTE wrote: > Afternoon: > > Has any test on incorporation of muti platform data been seen using the PATCH file ? > > Will the install cause support default models to reset. > > Any other information is welcomed and appreciated, Thanks. > > D.Lauricella Has spam gotten smart with use of AI, or is this real? Can you fix your mailer to to generate in-reply-to headers and try again stating your question? BR, Pavel -- DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

1 year, 1 month

1
0
0 0

[PATCH v2 RESEND] EDAC/ti: Fix possible null pointer dereference in _emif_get_id()

by Ma Ke

In _emif_get_id(), of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Cc: stable(a)vger.kernel.org Fixes: 86a18ee21e5e ("EDAC, ti: Add support for TI keystone and DRA7xx EDAC") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v2: - added Cc stable line. --- drivers/edac/ti_edac.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c index 29723c9592f7..db23887b2d81 100644 --- a/drivers/edac/ti_edac.c +++ b/drivers/edac/ti_edac.c @@ -207,6 +207,9 @@ static int _emif_get_id(struct device_node *node) int my_id = 0; addrp = of_get_address(node, 0, NULL, NULL); + if (!addrp) + return -EINVAL; + my_addr = (u32)of_translate_address(node, addrp); for_each_matching_node(np, ti_edac_of_match) { -- 2.25.1

1 year, 1 month

3
2
0 0

[PATCH] Bluetooth: hci_core: fix suspicious RCU usage in hci_conn_drop()

by Yunseong Kim

Protection from the queuing operation is achieved with an RCU read lock to avoid calling 'queue_delayed_work()' after 'cancel_delayed_work()', but this does not apply to 'hci_conn_drop()'. commit deee93d13d38 ("Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works") The situation described raises concerns about suspicious RCU usage in a corrupted context. CPU 1 CPU 2 hci_dev_do_reset() synchronize_rcu() hci_conn_drop() drain_workqueue() <-- no RCU read protection during queuing. --> queue_delayed_work() It displays a warning message like the following Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 ============================= WARNING: suspicious RCU usage 6.10.0-rc6-01340-gf14c0bb78769 #5 Not tainted ----------------------------- net/mac80211/util.c:4000 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor/798: #0: ffff800089a3de50 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x28/0x40 net/core/rtnetlink.c:79 stack backtrace: CPU: 0 PID: 798 Comm: syz-executor Not tainted 6.10.0-rc6-01340-gf14c0bb78769 #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0x1b8/0x1d0 arch/arm64/kernel/stacktrace.c:317 dump_backtrace arch/arm64/kernel/stacktrace.c:323 [inline] show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xf0/0x170 lib/dump_stack.c:114 dump_stack+0x20/0x30 lib/dump_stack.c:123 lockdep_rcu_suspicious+0x204/0x2f8 kernel/locking/lockdep.c:6712 ieee80211_check_combinations+0x71c/0x828 [mac80211] ieee80211_check_concurrent_iface+0x494/0x700 [mac80211] ieee80211_open+0x140/0x238 [mac80211] __dev_open+0x270/0x498 net/core/dev.c:1474 __dev_change_flags+0x47c/0x610 net/core/dev.c:8837 dev_change_flags+0x98/0x170 net/core/dev.c:8909 devinet_ioctl+0xdf0/0x18d0 net/ipv4/devinet.c:1177 inet_ioctl+0x34c/0x388 net/ipv4/af_inet.c:1003 sock_do_ioctl+0xe4/0x240 net/socket.c:1222 sock_ioctl+0x4cc/0x740 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x184/0x218 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x90/0x2e8 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:131 el0_svc+0x48/0xc0 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x120/0x130 arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x198 arch/arm64/kernel/entry.S:598 This patch attempts to fix that issue with the same convention. Cc: stable(a)vger.kernel.org # v6.1+ Fixes: deee93d13d38 ("Bluetooth: use hdev->workqueue when queuing hdev-> {cmd,ncmd}_timer works") Signed-off-by: Yeoreum Yun <yeoreum.yun(a)arm.com> Tested-by: Yunseong Kim <yskelg(a)gmail.com> Signed-off-by: Yunseong Kim <yskelg(a)gmail.com> --- include/net/bluetooth/hci_core.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 31020891fc68..111509dc1a23 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -1572,8 +1572,13 @@ static inline void hci_conn_drop(struct hci_conn *conn) } cancel_delayed_work(&conn->disc_work); - queue_delayed_work(conn->hdev->workqueue, - &conn->disc_work, timeo); + + rcu_read_lock(); + if (!hci_dev_test_flag(conn->hdev, HCI_CMD_DRAIN_WORKQUEUE)) { + queue_delayed_work(conn->hdev->workqueue, + &conn->disc_work, timeo); + } + rcu_read_unlock(); } } -- 2.45.2

1 year, 1 month

2
1
0 0

[RESEND PATCH] rtc: ds1343: Force SPI chip select to be active high

by Ian Abbott

Commit 3b52093dc917 ("rtc: ds1343: Do not hardcode SPI mode flags") bit-flips (^=) the existing SPI_CS_HIGH setting in the SPI mode during device probe. This will set it to the wrong value if the spi-cs-high property has been set in the devicetree node. Just force it to be set active high and get rid of some commentary that attempted to explain why flipping the bit was the correct choice. Fixes: 3b52093dc917 ("rtc: ds1343: Do not hardcode SPI mode flags") Cc: <stable(a)vger.kernel.org> # 5.6+ Cc: Linus Walleij <linus.walleij(a)linaro.org> Cc: Mark Brown <broonie(a)kernel.org> Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk> --- drivers/rtc/rtc-ds1343.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/rtc/rtc-ds1343.c b/drivers/rtc/rtc-ds1343.c index ed5a6ba89a3e..484b5756b55c 100644 --- a/drivers/rtc/rtc-ds1343.c +++ b/drivers/rtc/rtc-ds1343.c @@ -361,13 +361,10 @@ static int ds1343_probe(struct spi_device *spi) if (!priv) return -ENOMEM; - /* RTC DS1347 works in spi mode 3 and - * its chip select is active high. Active high should be defined as - * "inverse polarity" as GPIO-based chip selects can be logically - * active high but inverted by the GPIO library. + /* + * RTC DS1347 works in spi mode 3 and its chip select is active high. */ - spi->mode |= SPI_MODE_3; - spi->mode ^= SPI_CS_HIGH; + spi->mode |= SPI_MODE_3 | SPI_CS_HIGH; spi->bits_per_word = 8; res = spi_setup(spi); if (res) -- 2.43.0

1 year, 1 month

3
6
0 0

[PATCH v3] block: fix deadlock between sd_remove & sd_release

by Yang Yang

Our test report the following hung task: [ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds. [ 2538.459427] Call trace: [ 2538.459430] __switch_to+0x174/0x338 [ 2538.459436] __schedule+0x628/0x9c4 [ 2538.459442] schedule+0x7c/0xe8 [ 2538.459447] schedule_preempt_disabled+0x24/0x40 [ 2538.459453] __mutex_lock+0x3ec/0xf04 [ 2538.459456] __mutex_lock_slowpath+0x14/0x24 [ 2538.459459] mutex_lock+0x30/0xd8 [ 2538.459462] del_gendisk+0xdc/0x350 [ 2538.459466] sd_remove+0x30/0x60 [ 2538.459470] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459474] device_release_driver+0x18/0x28 [ 2538.459478] bus_remove_device+0x15c/0x174 [ 2538.459483] device_del+0x1d0/0x358 [ 2538.459488] __scsi_remove_device+0xa8/0x198 [ 2538.459493] scsi_forget_host+0x50/0x70 [ 2538.459497] scsi_remove_host+0x80/0x180 [ 2538.459502] usb_stor_disconnect+0x68/0xf4 [ 2538.459506] usb_unbind_interface+0xd4/0x280 [ 2538.459510] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459514] device_release_driver+0x18/0x28 [ 2538.459518] bus_remove_device+0x15c/0x174 [ 2538.459523] device_del+0x1d0/0x358 [ 2538.459528] usb_disable_device+0x84/0x194 [ 2538.459532] usb_disconnect+0xec/0x300 [ 2538.459537] hub_event+0xb80/0x1870 [ 2538.459541] process_scheduled_works+0x248/0x4dc [ 2538.459545] worker_thread+0x244/0x334 [ 2538.459549] kthread+0x114/0x1bc [ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds. [ 2538.461014] Call trace: [ 2538.461016] __switch_to+0x174/0x338 [ 2538.461021] __schedule+0x628/0x9c4 [ 2538.461025] schedule+0x7c/0xe8 [ 2538.461030] blk_queue_enter+0xc4/0x160 [ 2538.461034] blk_mq_alloc_request+0x120/0x1d4 [ 2538.461037] scsi_execute_cmd+0x7c/0x23c [ 2538.461040] ioctl_internal_command+0x5c/0x164 [ 2538.461046] scsi_set_medium_removal+0x5c/0xb0 [ 2538.461051] sd_release+0x50/0x94 [ 2538.461054] blkdev_put+0x190/0x28c [ 2538.461058] blkdev_release+0x28/0x40 [ 2538.461063] __fput+0xf8/0x2a8 [ 2538.461066] __fput_sync+0x28/0x5c [ 2538.461070] __arm64_sys_close+0x84/0xe8 [ 2538.461073] invoke_syscall+0x58/0x114 [ 2538.461078] el0_svc_common+0xac/0xe0 [ 2538.461082] do_el0_svc+0x1c/0x28 [ 2538.461087] el0_svc+0x38/0x68 [ 2538.461090] el0t_64_sync_handler+0x68/0xbc [ 2538.461093] el0t_64_sync+0x1a8/0x1ac T1: T2: sd_remove del_gendisk __blk_mark_disk_dead blk_freeze_queue_start ++q->mq_freeze_depth bdev_release mutex_lock(&disk->open_mutex) sd_release scsi_execute_cmd blk_queue_enter wait_event(!q->mq_freeze_depth) mutex_lock(&disk->open_mutex) SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in this scenario. This is a classic ABBA deadlock. To fix the deadlock, make sure we don't try to acquire disk->open_mutex after freezing the queue. Cc: stable(a)vger.kernel.org Fixes: eec1be4c30df ("block: delete partitions later in del_gendisk") Signed-off-by: Yang Yang <yang.yang(a)vivo.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> --- Changes from v2: - Add Fixes: and Cc: stable by suggestion Changes from v1: - Modify commit message by suggestion --- block/genhd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/genhd.c b/block/genhd.c index 8f1f3c6b4d67..c5fca3e893a0 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -663,12 +663,12 @@ void del_gendisk(struct gendisk *disk) */ if (!test_bit(GD_DEAD, &disk->state)) blk_report_disk_dead(disk, false); - __blk_mark_disk_dead(disk); /* * Drop all partitions now that the disk is marked dead. */ mutex_lock(&disk->open_mutex); + __blk_mark_disk_dead(disk); xa_for_each_start(&disk->part_tbl, idx, part, 1) drop_partition(part); mutex_unlock(&disk->open_mutex); -- 2.34.1

1 year, 1 month

3
2
0 0

[PATCH 6.10 00/11] 6.10.1-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.10.1 release. There are 11 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 25 Jul 2024 12:28:30 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.1-rc2… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.10.1-rc2 Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Allow thermal zones to tell the core to ignore them Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix error pbuf checking Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Limit Speaker Volume to +12dB maximum Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use header defines for Speaker Volume control definition Hao Ge <gehao(a)kylinos.cn> tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() David Howells <dhowells(a)redhat.com> cifs: Fix setting of zero_point after DIO write David Howells <dhowells(a)redhat.com> cifs: Fix server re-repick on subrequest retry Steve French <stfrench(a)microsoft.com> cifs: fix noisy message on copy_file_range David Howells <dhowells(a)redhat.com> cifs: Fix missing fscache invalidation David Howells <dhowells(a)redhat.com> cifs: Fix missing error code set Kees Cook <kees(a)kernel.org> ext4: use memtostr_pad() for s_volume_name ------------- Diffstat: Makefile | 4 +-- drivers/char/tpm/tpm2-sessions.c | 5 +-- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 7 +++- drivers/thermal/thermal_core.c | 51 ++++++++++++++--------------- drivers/thermal/thermal_core.h | 3 ++ drivers/thermal/thermal_helpers.c | 2 ++ fs/ext4/ext4.h | 2 +- fs/ext4/ioctl.c | 2 +- fs/smb/client/cifsfs.c | 2 +- fs/smb/client/file.c | 21 +++++++++--- fs/smb/client/smb2pdu.c | 3 -- include/sound/cs35l56.h | 2 +- io_uring/kbuf.c | 4 ++- sound/soc/codecs/cs35l56.c | 6 +++- 14 files changed, 69 insertions(+), 45 deletions(-)

1 year, 1 month

8
7
0 0

Linux 6.10.1

by Greg Kroah-Hartman

I'm announcing the release of the 6.10.1 kernel. All users of the 6.10 kernel series must upgrade. The updated 6.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 7 +++ drivers/thermal/thermal_core.c | 51 +++++++++++++--------------- drivers/thermal/thermal_core.h | 3 + drivers/thermal/thermal_helpers.c | 2 + fs/ext4/ext4.h | 2 - fs/ext4/ioctl.c | 2 - fs/smb/client/cifsfs.c | 2 - fs/smb/client/file.c | 21 +++++++++-- fs/smb/client/smb2pdu.c | 3 - include/sound/cs35l56.h | 2 - io_uring/kbuf.c | 4 +- sound/soc/codecs/cs35l56.c | 6 ++- 14 files changed, 68 insertions(+), 44 deletions(-) David Howells (4): cifs: Fix missing error code set cifs: Fix missing fscache invalidation cifs: Fix server re-repick on subrequest retry cifs: Fix setting of zero_point after DIO write Greg Kroah-Hartman (1): Linux 6.10.1 Hao Ge (1): tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Kees Cook (1): ext4: use memtostr_pad() for s_volume_name Pavel Begunkov (1): io_uring: fix error pbuf checking Rafael J. Wysocki (1): thermal: core: Allow thermal zones to tell the core to ignore them Richard Fitzgerald (2): ASoC: cs35l56: Use header defines for Speaker Volume control definition ASoC: cs35l56: Limit Speaker Volume to +12dB maximum Steve French (1): cifs: fix noisy message on copy_file_range

1 year, 1 month

1
1
0 0

Linux 6.10.1

by Greg Kroah-Hartman

I'm announcing the release of the 6.10.1 kernel. All users of the 6.10 kernel series must upgrade. The updated 6.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 7 +++ drivers/thermal/thermal_core.c | 51 +++++++++++++--------------- drivers/thermal/thermal_core.h | 3 + drivers/thermal/thermal_helpers.c | 2 + fs/ext4/ext4.h | 2 - fs/ext4/ioctl.c | 2 - fs/smb/client/cifsfs.c | 2 - fs/smb/client/file.c | 21 +++++++++-- fs/smb/client/smb2pdu.c | 3 - include/sound/cs35l56.h | 2 - io_uring/kbuf.c | 4 +- sound/soc/codecs/cs35l56.c | 6 ++- 14 files changed, 68 insertions(+), 44 deletions(-) David Howells (4): cifs: Fix missing error code set cifs: Fix missing fscache invalidation cifs: Fix server re-repick on subrequest retry cifs: Fix setting of zero_point after DIO write Greg Kroah-Hartman (1): Linux 6.10.1 Hao Ge (1): tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Kees Cook (1): ext4: use memtostr_pad() for s_volume_name Pavel Begunkov (1): io_uring: fix error pbuf checking Rafael J. Wysocki (1): thermal: core: Allow thermal zones to tell the core to ignore them Richard Fitzgerald (2): ASoC: cs35l56: Use header defines for Speaker Volume control definition ASoC: cs35l56: Limit Speaker Volume to +12dB maximum Steve French (1): cifs: fix noisy message on copy_file_range

1 year, 1 month

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror