From patchwork Tue Jan 14 10:01:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233966 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C523DC33CB1 for ; Tue, 14 Jan 2020 10:07:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 998812468B for ; Tue, 14 Jan 2020 10:07:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996423; bh=rTuW6XD6+BeoH+HPUkAft1lIeA8jtdHv//koodJO8h8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=p163y4vX1+QqBRaPTF9vXe6YiyHIzRAA0YcSzowsfSx8MBMoH8yOraHsBd79YUsTK nysC+3aPjC4ZAtScgTYebm7Y07SXy2FqsPu+mfYaqX4uN+/J5OftQ5jb9//V3kGzKC HmD44J7Rsir6IgWSO4GpfOfeLzHj+l60ovyHIcgo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728978AbgANKHC (ORCPT ); Tue, 14 Jan 2020 05:07:02 -0500 Received: from mail.kernel.org ([198.145.29.99]:36606 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730558AbgANKHB (ORCPT ); Tue, 14 Jan 2020 05:07:01 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 47F0720678; Tue, 14 Jan 2020 10:06:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996419; bh=rTuW6XD6+BeoH+HPUkAft1lIeA8jtdHv//koodJO8h8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VPCHslTPgcdM9wOviLGUQyag+fK1ZUAKtpTbtixBUC255WIaNR1vFFaZQQD8lTz6b LhcvPbUyakl75XhPZ1dMfk2G6cskdxN0fcB+bLNLcHApcCuArFKernow4eas9tUzTy vwAJmMK9VUkwVID5G+5QyvZbfc9M50+QHDiMKkWQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Grzeschik , Peter Chen , Guenter Roeck , Peter Chen Subject: [PATCH 4.19 03/46] usb: chipidea: host: Disable port power only if previously enabled Date: Tue, 14 Jan 2020 11:01:20 +0100 Message-Id: <20200114094341.112906176@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Guenter Roeck commit c1ffba305dbcf3fb9ca969c20a97acbddc38f8e9 upstream. On shutdown, ehci_power_off() is called unconditionally to power off each port, even if it was never called to power on the port. For chipidea, this results in a call to ehci_ci_portpower() with a request to power off ports even if the port was never powered on. This results in the following warning from the regulator code. WARNING: CPU: 0 PID: 182 at drivers/regulator/core.c:2596 _regulator_disable+0x1a8/0x210 unbalanced disables for usb_otg2_vbus Modules linked in: CPU: 0 PID: 182 Comm: init Not tainted 5.4.6 #1 Hardware name: Freescale i.MX7 Dual (Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xe0/0x10c) [] (dump_stack) from [] (__warn+0xf4/0x10c) [] (__warn) from [] (warn_slowpath_fmt+0x78/0xbc) [] (warn_slowpath_fmt) from [] (_regulator_disable+0x1a8/0x210) [] (_regulator_disable) from [] (regulator_disable+0x38/0xe8) [] (regulator_disable) from [] (ehci_ci_portpower+0x38/0xdc) [] (ehci_ci_portpower) from [] (ehci_port_power+0x50/0xa4) [] (ehci_port_power) from [] (ehci_silence_controller+0x5c/0xc4) [] (ehci_silence_controller) from [] (ehci_stop+0x3c/0xcc) [] (ehci_stop) from [] (usb_remove_hcd+0xe0/0x19c) [] (usb_remove_hcd) from [] (host_stop+0x38/0xa8) [] (host_stop) from [] (ci_hdrc_remove+0x44/0xe4) ... Keeping track of the power enable state avoids the warning and traceback. Fixes: c8679a2fb8dec ("usb: chipidea: host: add portpower override") Cc: Michael Grzeschik Cc: Peter Chen Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck Acked-by: Peter Chen Link: https://lore.kernel.org/r/20191226155754.25451-1-linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman --- drivers/usb/chipidea/host.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/usb/chipidea/host.c +++ b/drivers/usb/chipidea/host.c @@ -25,6 +25,7 @@ static int (*orig_bus_suspend)(struct us struct ehci_ci_priv { struct regulator *reg_vbus; + bool enabled; }; static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) @@ -36,7 +37,7 @@ static int ehci_ci_portpower(struct usb_ int ret = 0; int port = HCS_N_PORTS(ehci->hcs_params); - if (priv->reg_vbus) { + if (priv->reg_vbus && enable != priv->enabled) { if (port > 1) { dev_warn(dev, "Not support multi-port regulator control\n"); @@ -52,6 +53,7 @@ static int ehci_ci_portpower(struct usb_ enable ? "enable" : "disable", ret); return ret; } + priv->enabled = enable; } if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { From patchwork Tue Jan 14 10:01:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233965 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E73CC33CB3 for ; Tue, 14 Jan 2020 10:07:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 19D8E2467E for ; Tue, 14 Jan 2020 10:07:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996431; bh=+gYPelXvqrrju/nEGUV6QFgs/hZenqpPWhlUyiFzqwc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=s0WoRvlGWkakij/gl85JBy3MDr0H+bDoJQPmic+tZ5jJBMgXOlTfE/areqKV26PFb 57cAMeHtRSZKb2ar6B9unzPgCbjjtQMWMVJEwtXnPtQuk+IXJ6dImEhk1KgzwGH31p wHAGS/5pEwdKnocPs0+92SRxNQ3ayaB6F9mo1D3M= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729949AbgANKHK (ORCPT ); Tue, 14 Jan 2020 05:07:10 -0500 Received: from mail.kernel.org ([198.145.29.99]:36840 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729745AbgANKHG (ORCPT ); Tue, 14 Jan 2020 05:07:06 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 259F624681; Tue, 14 Jan 2020 10:07:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996425; bh=+gYPelXvqrrju/nEGUV6QFgs/hZenqpPWhlUyiFzqwc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TSXNR6WIpbog3P5TGPPW1+ctoYfKl+cCOnXN8DnTEJh4vthItFPpCw2wUFHi5YfpB 7OyRHpqqimFUnb2ZDmPCs96Crlbt3D2GBFOUplZ+CM39NZBREtYXVUe7+pZh1ONlpq Q71oDC84SvBCBCvD+SIPw3Pcx9Kq4D4P9uDqsgJY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kailang Yang , Takashi Iwai Subject: [PATCH 4.19 05/46] ALSA: hda/realtek - Add new codec supported for ALCS1200A Date: Tue, 14 Jan 2020 11:01:22 +0100 Message-Id: <20200114094341.488946953@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kailang Yang commit 6d9ffcff646bbd0ede6c2a59f4cd28414ecec6e0 upstream. Add ALCS1200A supported. It was similar as ALC900. Signed-off-by: Kailang Yang Cc: Link: https://lore.kernel.org/r/a9bd3cdaa02d4fa197623448d5c51e50@realtek.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -442,6 +442,7 @@ static void alc_fill_eapd_coef(struct hd break; case 0x10ec0899: case 0x10ec0900: + case 0x10ec0b00: case 0x10ec1168: case 0x10ec1220: alc_update_coef_idx(codec, 0x7, 1<<1, 0); @@ -2521,6 +2522,7 @@ static int patch_alc882(struct hda_codec case 0x10ec0882: case 0x10ec0885: case 0x10ec0900: + case 0x10ec0b00: case 0x10ec1220: break; default: @@ -8989,6 +8991,7 @@ static const struct hda_device_id snd_hd HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662), HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882), HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), {} /* terminator */ From patchwork Tue Jan 14 10:01:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233962 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FD6CC33CB1 for ; Tue, 14 Jan 2020 10:07:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EB87524682 for ; Tue, 14 Jan 2020 10:07:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996472; bh=hp3tyotnzJKkUh2bGZfuSWRRRn68vaaDLm7ShU8eO6Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=FVWawz2Dr+cLTcyflqPmnAOPI0R2AZMA1ury+TYp0j8+zXqK8vFktuGM7AbForqi2 50rGQiVKtZcAR5SRnVgFbfooZFPHk47dj0BVx5qLx+Wie2BC9+Ws9/No/U8zcZCOBX aEvpM7THnk/Jbsi7LfKSDoJ/mCd0di7hXMM7WDwc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730753AbgANKHr (ORCPT ); Tue, 14 Jan 2020 05:07:47 -0500 Received: from mail.kernel.org ([198.145.29.99]:38366 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730747AbgANKHq (ORCPT ); Tue, 14 Jan 2020 05:07:46 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D3B3C207FF; Tue, 14 Jan 2020 10:07:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996466; bh=hp3tyotnzJKkUh2bGZfuSWRRRn68vaaDLm7ShU8eO6Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=raeyyHtgsYMxrp/Th60QUBaB5HuPaAMRfT/FvSu66s+nnHYq0wj/jXkfVwkNsYAxC uuJZZe9CFMSHwdEsQlHzQ3V5WRzYfpynKAVGtztFFhvh9sKTg4ugMdXQSmA5n8Yoed rlJ3YSIlJ38MVak47FwuQgsEHFu6DHHSBYt431Ok= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kaitao Cheng , "Steven Rostedt (VMware)" Subject: [PATCH 4.19 08/46] kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail Date: Tue, 14 Jan 2020 11:01:25 +0100 Message-Id: <20200114094342.139174139@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kaitao Cheng commit 50f9ad607ea891a9308e67b81f774c71736d1098 upstream. In the function, if register_trace_sched_migrate_task() returns error, sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is why fail_deprobe_sched_switch was added. Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com Cc: stable@vger.kernel.org Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") Signed-off-by: Kaitao Cheng Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- kernel/trace/trace_sched_wakeup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -640,7 +640,7 @@ static void start_wakeup_tracer(struct t if (ret) { pr_info("wakeup trace: Couldn't activate tracepoint" " probe to kernel_sched_migrate_task\n"); - return; + goto fail_deprobe_sched_switch; } wakeup_reset(tr); @@ -658,6 +658,8 @@ static void start_wakeup_tracer(struct t printk(KERN_ERR "failed to start wakeup tracer\n"); return; +fail_deprobe_sched_switch: + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); fail_deprobe_wake_new: unregister_trace_sched_wakeup_new(probe_wakeup, NULL); fail_deprobe: From patchwork Tue Jan 14 10:01:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233903 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3664C33CB1 for ; Tue, 14 Jan 2020 10:18:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7DB0C20678 for ; Tue, 14 Jan 2020 10:18:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997097; bh=kzrT3qT3qSemd6xAxlmFMym2JQwhldvlctsOG+uH+kQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tlFT+8LHyRvakMrWmpJupWKRflETh1/Vwym0ldHl1pqPGkJK4rJqR6LbDm50qwvIX r9gj/87x9Usq34m4IPr5RlIRCG5ElZYVFl8TVL4YwNWpQrzvYLgbH6FGXt1PD6TpML rIF4lshD3YZGOnR0iAG6PIG/9D4sNNFKOhcbuQo4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730407AbgANKIH (ORCPT ); Tue, 14 Jan 2020 05:08:07 -0500 Received: from mail.kernel.org ([198.145.29.99]:39156 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730867AbgANKIG (ORCPT ); Tue, 14 Jan 2020 05:08:06 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C628524685; Tue, 14 Jan 2020 10:08:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996486; bh=kzrT3qT3qSemd6xAxlmFMym2JQwhldvlctsOG+uH+kQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VwWOr04mdm9WXWjrPPTqNetlXfKotysNQ8zllbFiYfzZAEMc+b/LvNFfxYG1E+BDI UblVJMIuKHiSrKSMJkbvPyvgRaJnKCBSPPoeT8podkA4VDIzr8NLnkYhvh1VcD0u2X b7W5r0RfIKyQOPQf1eer5fbsMkLVkX79FYzB1DD8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kbuild test robot , "Steven Rostedt (VMware)" Subject: [PATCH 4.19 09/46] tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined Date: Tue, 14 Jan 2020 11:01:26 +0100 Message-Id: <20200114094342.369694851@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Steven Rostedt (VMware) commit b8299d362d0837ae39e87e9019ebe6b736e0f035 upstream. On some archs with some configurations, MCOUNT_INSN_SIZE is not defined, and this makes the stack tracer fail to compile. Just define it to zero in this case. Link: https://lore.kernel.org/r/202001020219.zvE3vsty%lkp@intel.com Cc: stable@vger.kernel.org Fixes: 4df297129f622 ("tracing: Remove most or all of stack tracer stack size from stack_max_size") Reported-by: kbuild test robot Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- kernel/trace/trace_stack.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/kernel/trace/trace_stack.c +++ b/kernel/trace/trace_stack.c @@ -196,6 +196,11 @@ check_stack(unsigned long ip, unsigned l local_irq_restore(flags); } +/* Some archs may not define MCOUNT_INSN_SIZE */ +#ifndef MCOUNT_INSN_SIZE +# define MCOUNT_INSN_SIZE 0 +#endif + static void stack_trace_call(unsigned long ip, unsigned long parent_ip, struct ftrace_ops *op, struct pt_regs *pt_regs) From patchwork Tue Jan 14 10:01:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233959 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E095C33CB2 for ; Tue, 14 Jan 2020 10:08:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E916620678 for ; Tue, 14 Jan 2020 10:08:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996494; bh=WqD2Us02xrSuoy6mpu73fSbZ4IxiJuvY/HXOclXffyo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RmayoVcya13a3T88XhfeTGrymTxoY1K5DOUD6CzVwg3ZQGyr4EDbz88g2CiQ1J3Rn uFcJiIPZ9smATxPgAiu4rbiODEgko36RSkl6K8MQmGAZN/hqtth/nKvXRZ0CzNdDL3 hfwDw4ues4a+vW4/R4U6RLGtTLSlL1eAuy+yxN8A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730902AbgANKIM (ORCPT ); Tue, 14 Jan 2020 05:08:12 -0500 Received: from mail.kernel.org ([198.145.29.99]:39368 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730492AbgANKIM (ORCPT ); Tue, 14 Jan 2020 05:08:12 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 33AC320678; Tue, 14 Jan 2020 10:08:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996491; bh=WqD2Us02xrSuoy6mpu73fSbZ4IxiJuvY/HXOclXffyo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qkRy2be/LYObykvamG9IrjLGj2+elyHwUU8WS8K++UMZiw8s8/RP9aORlwwTSuWQT eBwOZ6lgoMzmYZ+EOsjvun43YrgD9uteihiwF6Y8+WMXoBjvuNMIaU4HUQ/pgTBIah iPNeFqCOxjRWZE5g+U4hCCk1tlIVXETL6K9glREw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Jiri Kosina , syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com Subject: [PATCH 4.19 11/46] HID: Fix slab-out-of-bounds read in hid_field_extract Date: Tue, 14 Jan 2020 11:01:28 +0100 Message-Id: <20200114094342.825971082@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alan Stern commit 8ec321e96e056de84022c032ffea253431a83c3c upstream. The syzbot fuzzer found a slab-out-of-bounds bug in the HID report handler. The bug was caused by a report descriptor which included a field with size 12 bits and count 4899, for a total size of 7349 bytes. The usbhid driver uses at most a single-page 4-KB buffer for reports. In the test there wasn't any problem about overflowing the buffer, since only one byte was received from the device. Rather, the bug occurred when the HID core tried to extract the data from the report fields, which caused it to try reading data beyond the end of the allocated buffer. This patch fixes the problem by rejecting any report whose total length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow for a possible report index). In theory a device could have a report longer than that, but if there was such a thing we wouldn't handle it correctly anyway. Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com Signed-off-by: Alan Stern CC: Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-core.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -288,6 +288,12 @@ static int hid_add_field(struct hid_pars offset = report->size; report->size += parser->global.report_size * parser->global.report_count; + /* Total size check: Allow for possible report index byte */ + if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { + hid_err(parser->device, "report is too long\n"); + return -1; + } + if (!parser->local.usage_index) /* Ignore padding fields */ return 0; From patchwork Tue Jan 14 10:01:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233904 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C39FDC33CB1 for ; Tue, 14 Jan 2020 10:18:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 95CDC20678 for ; Tue, 14 Jan 2020 10:18:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997091; bh=sWMEmwOaSigD93iCcuIdDMxsBcm/kGtre5bgA27A5ww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=j2EDPfSqNIr2pusMPeMi2QBHJRjR5lttAuBsL5WDVaMS7NLGSdEsCvuxPQJkBAoyF xrxrYzYETCbQIKMJspe+gLznYhsR1bq/+ST6n84MvNo8QvXK4d6Y5gro2glVuT6YGm rkraH3Mo/Ri/ghQ3wONLXZ/0SsBPgl/JeZY/PObw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730260AbgANKIS (ORCPT ); Tue, 14 Jan 2020 05:08:18 -0500 Received: from mail.kernel.org ([198.145.29.99]:39534 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730457AbgANKIS (ORCPT ); Tue, 14 Jan 2020 05:08:18 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D5E8C20678; Tue, 14 Jan 2020 10:08:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996497; bh=sWMEmwOaSigD93iCcuIdDMxsBcm/kGtre5bgA27A5ww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0Nu0VmQoYosq+0aT0ZzcNu0JE+sy5IacAutPibx16Cmckc7cTqzxJsZmkOQPlIxih lwcrP9fOZReOWlvnNxjpb2DnN5piyJOhBLFmJjkSuzQ5/upRq3gSqnXV9/z8nHm4SN pgSQpD1j0f5XOn+BkGpzzM3O5J23bZk95npOkxM4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com, Dmitry Torokhov , Benjamin Tissoires , Jiri Kosina Subject: [PATCH 4.19 13/46] HID: hid-input: clear unmapped usages Date: Tue, 14 Jan 2020 11:01:30 +0100 Message-Id: <20200114094343.218751152@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dmitry Torokhov commit 4f3882177240a1f55e45a3d241d3121341bead78 upstream. We should not be leaving half-mapped usages with potentially invalid keycodes, as that may confuse hidinput_find_key() when the key is located by index, which may end up feeding way too large keycode into the VT keyboard handler and cause OOB write there: BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 ... kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 input_pass_values drivers/input/input.c:949 [inline] input_set_keycode+0x290/0x320 drivers/input/input.c:954 evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 evdev_do_ioctl drivers/input/evdev.c:1150 [inline] Cc: stable@vger.kernel.org Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com Signed-off-by: Dmitry Torokhov Tested-by: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-input.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -1125,9 +1125,15 @@ static void hidinput_configure_usage(str } mapped: - if (device->driver->input_mapped && device->driver->input_mapped(device, - hidinput, field, usage, &bit, &max) < 0) - goto ignore; + if (device->driver->input_mapped && + device->driver->input_mapped(device, hidinput, field, usage, + &bit, &max) < 0) { + /* + * The driver indicated that no further generic handling + * of the usage is desired. + */ + return; + } set_bit(usage->type, input->evbit); @@ -1208,9 +1214,11 @@ mapped: set_bit(MSC_SCAN, input->mscbit); } -ignore: return; +ignore: + usage->type = 0; + usage->code = 0; } void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) From patchwork Tue Jan 14 10:01:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233905 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDE3AC33CB3 for ; Tue, 14 Jan 2020 10:16:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B54FA24681 for ; Tue, 14 Jan 2020 10:16:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997015; bh=JqCYsh26Mk9/vcxTTruMptcg0CwCViC/wGsnxWhfASE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2BCYdJZa6QQyfrrdL82R//QSR70edYdnXZkVMYpaNshC5IQ5eCW+fbGO60cDb5apo BBTkeluTso98cxcPFQTgRv/Nf0gVjeiZRgr7VqMPr7R66o2/peozIH/w9VwIhk0wfN yKbGnGK5RxjfpIKqRn62y7fAA1GTxuRsPfCZSiZE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730389AbgANKIY (ORCPT ); Tue, 14 Jan 2020 05:08:24 -0500 Received: from mail.kernel.org ([198.145.29.99]:39722 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730960AbgANKIY (ORCPT ); Tue, 14 Jan 2020 05:08:24 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2CF0020678; Tue, 14 Jan 2020 10:08:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996502; bh=JqCYsh26Mk9/vcxTTruMptcg0CwCViC/wGsnxWhfASE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DyDRKRQXz15Z5OQaIePueWFkJBqGzTQ4bE1RuHYaoBYoW1VM/h4BOVRt5j30zdqNU LYVXgC0jAz2wDu1xfD6fvJJBu5V4jwg8rb59dIsItjB1dQ7l4WAgKqSCQ9AuDDrDrz 8l0MYhf1z2AHI6XMbR+0XPlAcm6tyfp3lVGG5dSY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Dmitry Torokhov Subject: [PATCH 4.19 15/46] Input: input_event - fix struct padding on sparc64 Date: Tue, 14 Jan 2020 11:01:32 +0100 Message-Id: <20200114094343.665406071@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann commit f729a1b0f8df7091cea3729fc0e414f5326e1163 upstream. Going through all uses of timeval, I noticed that we screwed up input_event in the previous attempts to fix it: The time fields now match between kernel and user space, but all following fields are in the wrong place. Add the required padding that is implied by the glibc timeval definition to fix the layout, and use a struct initializer to avoid leaking kernel stack data. Fixes: 141e5dcaa735 ("Input: input_event - fix the CONFIG_SPARC64 mixup") Fixes: 2e746942ebac ("Input: input_event - provide override for sparc64") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20191213204936.3643476-2-arnd@arndb.de Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman --- drivers/input/evdev.c | 14 +++++++------- drivers/input/misc/uinput.c | 14 +++++++++----- include/uapi/linux/input.h | 1 + 3 files changed, 17 insertions(+), 12 deletions(-) --- a/drivers/input/evdev.c +++ b/drivers/input/evdev.c @@ -241,13 +241,13 @@ static void __pass_event(struct evdev_cl */ client->tail = (client->head - 2) & (client->bufsize - 1); - client->buffer[client->tail].input_event_sec = - event->input_event_sec; - client->buffer[client->tail].input_event_usec = - event->input_event_usec; - client->buffer[client->tail].type = EV_SYN; - client->buffer[client->tail].code = SYN_DROPPED; - client->buffer[client->tail].value = 0; + client->buffer[client->tail] = (struct input_event) { + .input_event_sec = event->input_event_sec, + .input_event_usec = event->input_event_usec, + .type = EV_SYN, + .code = SYN_DROPPED, + .value = 0, + }; client->packet_head = client->tail; } --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -87,12 +87,16 @@ static int uinput_dev_event(struct input struct uinput_device *udev = input_get_drvdata(dev); struct timespec64 ts; - udev->buff[udev->head].type = type; - udev->buff[udev->head].code = code; - udev->buff[udev->head].value = value; ktime_get_ts64(&ts); - udev->buff[udev->head].input_event_sec = ts.tv_sec; - udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC; + + udev->buff[udev->head] = (struct input_event) { + .input_event_sec = ts.tv_sec, + .input_event_usec = ts.tv_nsec / NSEC_PER_USEC, + .type = type, + .code = code, + .value = value, + }; + udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; wake_up_interruptible(&udev->waitq); --- a/include/uapi/linux/input.h +++ b/include/uapi/linux/input.h @@ -34,6 +34,7 @@ struct input_event { __kernel_ulong_t __sec; #if defined(__sparc__) && defined(__arch64__) unsigned int __usec; + unsigned int __pad; #else __kernel_ulong_t __usec; #endif From patchwork Tue Jan 14 10:01:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233964 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B1ECC33CB1 for ; Tue, 14 Jan 2020 10:07:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0389E2468D for ; Tue, 14 Jan 2020 10:07:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996438; bh=rE7QBSma/p8DVJlJA35iUxJ1Y9UvZCnyIuSvTLJfYBU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=WtjHQcyPY8qKECPDGgTNYXBlLUzmUAuSaljCn5+EF05xECKhcOnF16C8eaIBlhjVU fIxsBhdvPWBBOv93p10x3niYsf98fLL0nTzZ87OvhvcYptjJUhNffG53HaaE4BNQ6+ DV6b31c+9GV6ifoKYDeF+6qoCSEVoEr/H8hamLZ4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730655AbgANKHQ (ORCPT ); Tue, 14 Jan 2020 05:07:16 -0500 Received: from mail.kernel.org ([198.145.29.99]:37274 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730651AbgANKHQ (ORCPT ); Tue, 14 Jan 2020 05:07:16 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 30EF024687; Tue, 14 Jan 2020 10:07:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996434; bh=rE7QBSma/p8DVJlJA35iUxJ1Y9UvZCnyIuSvTLJfYBU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wlgWeyITZoQm4ki8DMmIeBGg51e3xZeswLUvjKwrXIa9gsJsVPpsy9iO4z4RIAN1+ teN0JOijkahAOx9M0xMQr6bdWooIhnMKYtoIdcm4HP29ziXgSM+sprJg4NHIRKZZW9 vJ0ZYpuxaiNHQ63QR3GKUJEpuct2CP0V2fiw4/qI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen-Yu Tsai , Maxime Ripard Subject: [PATCH 4.19 16/46] drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model Date: Tue, 14 Jan 2020 11:01:33 +0100 Message-Id: <20200114094343.835349007@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Chen-Yu Tsai commit 4396393fb96449c56423fb4b351f76e45a6bcaf6 upstream. In commit 0b8e7bbde5e7 ("drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.") it was assumed that all TCON variants support a minimum divider of 1 if only DCLK was used. However, the oldest generation of hardware only supports minimum divider of 4 if only DCLK is used. If a divider of 1 was used on this old hardware, some scrolling artifact would appear. A divider of 2 seemed OK, but a divider of 3 had artifacts as well. Set the minimum divider when outputing to parallel RGB based on the hardware model, with a minimum of 4 for the oldest (A10/A10s/A13/A20) hardware, and a minimum of 1 for the rest. A value is not set for the TCON variants lacking channel 0. This fixes the scrolling artifacts seen on my A13 tablet. Fixes: 0b8e7bbde5e7 ("drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.") Cc: # 5.4.x Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20200107070113.28951-1-wens@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/sun4i/sun4i_tcon.c | 15 ++++++++++++--- drivers/gpu/drm/sun4i/sun4i_tcon.h | 1 + 2 files changed, 13 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/sun4i/sun4i_tcon.c +++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c @@ -423,7 +423,7 @@ static void sun4i_tcon0_mode_set_rgb(str WARN_ON(!tcon->quirks->has_channel_0); - tcon->dclk_min_div = 1; + tcon->dclk_min_div = tcon->quirks->dclk_min_div; tcon->dclk_max_div = 127; sun4i_tcon0_mode_set_common(tcon, mode); @@ -1249,12 +1249,14 @@ static int sun6i_tcon_set_mux(struct sun static const struct sun4i_tcon_quirks sun4i_a10_quirks = { .has_channel_0 = true, .has_channel_1 = true, + .dclk_min_div = 4, .set_mux = sun4i_a10_tcon_set_mux, }; static const struct sun4i_tcon_quirks sun5i_a13_quirks = { .has_channel_0 = true, .has_channel_1 = true, + .dclk_min_div = 4, .set_mux = sun5i_a13_tcon_set_mux, }; @@ -1263,6 +1265,7 @@ static const struct sun4i_tcon_quirks su .has_channel_1 = true, .has_lvds_alt = true, .needs_de_be_mux = true, + .dclk_min_div = 1, .set_mux = sun6i_tcon_set_mux, }; @@ -1270,11 +1273,13 @@ static const struct sun4i_tcon_quirks su .has_channel_0 = true, .has_channel_1 = true, .needs_de_be_mux = true, + .dclk_min_div = 1, }; static const struct sun4i_tcon_quirks sun7i_a20_quirks = { .has_channel_0 = true, .has_channel_1 = true, + .dclk_min_div = 4, /* Same display pipeline structure as A10 */ .set_mux = sun4i_a10_tcon_set_mux, }; @@ -1282,11 +1287,13 @@ static const struct sun4i_tcon_quirks su static const struct sun4i_tcon_quirks sun8i_a33_quirks = { .has_channel_0 = true, .has_lvds_alt = true, + .dclk_min_div = 1, }; static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = { .supports_lvds = true, .has_channel_0 = true, + .dclk_min_div = 1, }; static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = { @@ -1295,11 +1302,13 @@ static const struct sun4i_tcon_quirks su static const struct sun4i_tcon_quirks sun8i_v3s_quirks = { .has_channel_0 = true, + .dclk_min_div = 1, }; static const struct sun4i_tcon_quirks sun9i_a80_tcon_lcd_quirks = { - .has_channel_0 = true, - .needs_edp_reset = true, + .has_channel_0 = true, + .needs_edp_reset = true, + .dclk_min_div = 1, }; static const struct sun4i_tcon_quirks sun9i_a80_tcon_tv_quirks = { --- a/drivers/gpu/drm/sun4i/sun4i_tcon.h +++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h @@ -224,6 +224,7 @@ struct sun4i_tcon_quirks { bool needs_de_be_mux; /* sun6i needs mux to select backend */ bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */ bool supports_lvds; /* Does the TCON support an LVDS output? */ + u8 dclk_min_div; /* minimum divider for TCON0 DCLK */ /* callback to handle tcon muxing options */ int (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *); From patchwork Tue Jan 14 10:01:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233899 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFBD6C33CB1 for ; Tue, 14 Jan 2020 10:18:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A752E207FF for ; Tue, 14 Jan 2020 10:18:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997120; bh=AsJbEe2drDEZF42+Vj5f9Qd4fzm6cumGTNfq1AhDNew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=xcG9fHvrtRtW68NK8uoQgBCNkfr/XUQl0WfzVBvSqVcP/YOsiBBU/v1jr/loAlAm2 Xf+OCR70ub7vHBJOLUyWbWrjTK6CGqhdtOOE9MiKRzgAusmIgoyZrrS46snMuRjH/R y5Mj4XNUuMZfYNBdU/M/Auqmx9v4gpZVkcf2sglw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729903AbgANKHc (ORCPT ); Tue, 14 Jan 2020 05:07:32 -0500 Received: from mail.kernel.org ([198.145.29.99]:37396 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730667AbgANKHR (ORCPT ); Tue, 14 Jan 2020 05:07:17 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E0DDA24688; Tue, 14 Jan 2020 10:07:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996437; bh=AsJbEe2drDEZF42+Vj5f9Qd4fzm6cumGTNfq1AhDNew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XGLowJhCFfElZyAxojSWkdE6Pgd2wyeICk8MJJ7tAJVL+G2lMV2R2mzKMPsFPWQ3N SLW5UKb78+ydoPbfOsX1fnwlpfTtdh8s7yhKnOsLVm4vrFxQ6ordUeZl1WT3mnj9ZC BzasPVgyirTIlkxpjEmCsibg7xC2Re53YKCSgK14= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Daniel Vetter Subject: [PATCH 4.19 17/46] drm/fb-helper: Round up bits_per_pixel if possible Date: Tue, 14 Jan 2020 11:01:34 +0100 Message-Id: <20200114094344.042402634@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Geert Uytterhoeven commit f30e27779d3031a092c2a177b7fb76adccc45241 upstream. When userspace requests a video mode parameter value that is not supported, frame buffer device drivers should round it up to a supported value, if possible, instead of just rejecting it. This allows applications to quickly scan for supported video modes. Currently this rule is not followed for the number of bits per pixel, causing e.g. "fbset -depth N" to fail, if N is smaller than the current number of bits per pixel. Fix this by returning an error only if bits per pixel is too large, and setting it to the current value otherwise. See also Documentation/fb/framebuffer.rst, Section 2 (Programmer's View of /dev/fb*"). Fixes: 865afb11949e5bf4 ("drm/fb-helper: reject any changes to the fbdev") Cc: stable@vger.kernel.org Signed-off-by: Geert Uytterhoeven Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20191230132734.4538-1-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/drm_fb_helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -1702,7 +1702,7 @@ int drm_fb_helper_check_var(struct fb_va * Changes struct fb_var_screeninfo are currently not pushed back * to KMS, hence fail if different settings are requested. */ - if (var->bits_per_pixel != fb->format->cpp[0] * 8 || + if (var->bits_per_pixel > fb->format->cpp[0] * 8 || var->xres > fb->width || var->yres > fb->height || var->xres_virtual > fb->width || var->yres_virtual > fb->height) { DRM_DEBUG("fb requested width/height/bpp can't fit in current fb " @@ -1728,6 +1728,11 @@ int drm_fb_helper_check_var(struct fb_va } /* + * Likewise, bits_per_pixel should be rounded up to a supported value. + */ + var->bits_per_pixel = fb->format->cpp[0] * 8; + + /* * drm fbdev emulation doesn't support changing the pixel format at all, * so reject all pixel format changing requests. */ From patchwork Tue Jan 14 10:01:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233963 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AFEE3C33CB2 for ; Tue, 14 Jan 2020 10:07:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 880AB2467A for ; Tue, 14 Jan 2020 10:07:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996452; bh=k18qRjP/nywpIHZ3grDId+QnddItalWgK5eGRgAKNkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JPwbzgqeiBsKCgcR+M4dT6h/k+LQVHHAl6n3UpD6kP7YjB0DjN/R7jT+za+HVPAGC nZ48ch5I3vWSfpGuzgZCa5tYnnlqxRdQykm+IW9CtK4O+tGbkpAfV6amWFFUmbyE0O OcL7/0NTHilADlD6Wa49g6UxvbkcoCWfx5NCsj3Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726169AbgANKHb (ORCPT ); Tue, 14 Jan 2020 05:07:31 -0500 Received: from mail.kernel.org ([198.145.29.99]:37854 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729499AbgANKHb (ORCPT ); Tue, 14 Jan 2020 05:07:31 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A17BC20678; Tue, 14 Jan 2020 10:07:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996450; bh=k18qRjP/nywpIHZ3grDId+QnddItalWgK5eGRgAKNkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l0ixdT7HT4ko6ZUnq1qxLhLWR3IddHdJ7h2EvRe38FRNmyE5L8gCFv+6nLYN6zgwH dAW7ig350Yu8zjX1IWoDh0wxiFInm3fFTLj+d+/rxkNQLApIcaFXlE6Slmu6Ijn7B4 YsLJy9M68MxFRy/RReorky/OCXKSjyHTxaNcGOoQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Faber , Marc Kleine-Budde Subject: [PATCH 4.19 21/46] can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode Date: Tue, 14 Jan 2020 11:01:38 +0100 Message-Id: <20200114094344.766503208@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Florian Faber commit 2d77bd61a2927be8f4e00d9478fe6996c47e8d45 upstream. Under load, the RX side of the mscan driver can get stuck while TX still works. Restarting the interface locks up the system. This behaviour could be reproduced reliably on a MPC5121e based system. The patch fixes the return value of the NAPI polling function (should be the number of processed packets, not constant 1) and the condition under which IRQs are enabled again after polling is finished. With this patch, no more lockups were observed over a test period of ten days. Fixes: afa17a500a36 ("net/can: add driver for mscan family & mpc52xx_mscan") Signed-off-by: Florian Faber Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- drivers/net/can/mscan/mscan.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) --- a/drivers/net/can/mscan/mscan.c +++ b/drivers/net/can/mscan/mscan.c @@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_str struct net_device *dev = napi->dev; struct mscan_regs __iomem *regs = priv->reg_base; struct net_device_stats *stats = &dev->stats; - int npackets = 0; - int ret = 1; + int work_done = 0; struct sk_buff *skb; struct can_frame *frame; u8 canrflg; - while (npackets < quota) { + while (work_done < quota) { canrflg = in_8(®s->canrflg); if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) break; @@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_str stats->rx_packets++; stats->rx_bytes += frame->can_dlc; - npackets++; + work_done++; netif_receive_skb(skb); } - if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { - napi_complete(&priv->napi); - clear_bit(F_RX_PROGRESS, &priv->flags); - if (priv->can.state < CAN_STATE_BUS_OFF) - out_8(®s->canrier, priv->shadow_canrier); - ret = 0; + if (work_done < quota) { + if (likely(napi_complete_done(&priv->napi, work_done))) { + clear_bit(F_RX_PROGRESS, &priv->flags); + if (priv->can.state < CAN_STATE_BUS_OFF) + out_8(®s->canrier, priv->shadow_canrier); + } } - return ret; + return work_done; } static irqreturn_t mscan_isr(int irq, void *dev_id) From patchwork Tue Jan 14 10:01:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233900 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1382DC33CB1 for ; Tue, 14 Jan 2020 10:18:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DFCFC207FF for ; Tue, 14 Jan 2020 10:18:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997118; bh=EzNgiiWZ33n+Hg8gPGnUEB6TwMW3CwgI6GJIxqhBaLE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=nhqwdsxwF2qjJWWGZOa9j1H6q2XZFxFc4/XjHZpJFRsjaipsFYpaqJPooedOnDUmH SuPYygV8HNcOFaRqOuMbow7/ticujRFBSlNkl1bkkWUHnfoKOdXqOMCvbLfscCrue3 +mrklbJ4tKJB3X0JmEF/UQvo2dTuyaqSHyxDcBl8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729067AbgANKSe (ORCPT ); Tue, 14 Jan 2020 05:18:34 -0500 Received: from mail.kernel.org ([198.145.29.99]:37956 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730287AbgANKHe (ORCPT ); Tue, 14 Jan 2020 05:07:34 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8146E24679; Tue, 14 Jan 2020 10:07:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996453; bh=EzNgiiWZ33n+Hg8gPGnUEB6TwMW3CwgI6GJIxqhBaLE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C6gUs0X2OwfSWddcaHwhHnEE9DBqDW90UBnVucWzFnbwZPcLzM47CsS+ykCxspi0E lvlb2v8IjZT2GzbQMewPdC9oNemB4cmE37y0Ug9BDKEIv6zMv3WAsH+AaE/s47x0Ql WO1FJJRyxaahZ/F5eeBtf7Ce0sg7t4+31ndANH7U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+b02ff0707a97e4e79ebb@syzkaller.appspotmail.com, Oliver Hartkopp , Marc Kleine-Budde Subject: [PATCH 4.19 22/46] can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs Date: Tue, 14 Jan 2020 11:01:39 +0100 Message-Id: <20200114094344.962581194@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Oliver Hartkopp commit e7153bf70c3496bac00e7e4f395bb8d8394ac0ea upstream. KMSAN sysbot detected a read access to an untinitialized value in the headroom of an outgoing CAN related sk_buff. When using CAN sockets this area is filled appropriately - but when using a packet socket this initialization is missing. The problematic read access occurs in the CAN receive path which can only be triggered when the sk_buff is sent through a (virtual) CAN interface. So we check in the sending path whether we need to perform the missing initializations. Fixes: d3b58c47d330d ("can: replace timestamp as unique skb attribute") Reported-by: syzbot+b02ff0707a97e4e79ebb@syzkaller.appspotmail.com Signed-off-by: Oliver Hartkopp Tested-by: Oliver Hartkopp Cc: linux-stable # >= v4.1 Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- include/linux/can/dev.h | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) --- a/include/linux/can/dev.h +++ b/include/linux/can/dev.h @@ -18,6 +18,7 @@ #include #include #include +#include #include /* @@ -91,6 +92,36 @@ struct can_priv { #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) +/* Check for outgoing skbs that have not been created by the CAN subsystem */ +static inline bool can_skb_headroom_valid(struct net_device *dev, + struct sk_buff *skb) +{ + /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ + if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) + return false; + + /* af_packet does not apply CAN skb specific settings */ + if (skb->ip_summed == CHECKSUM_NONE) { + /* init headroom */ + can_skb_prv(skb)->ifindex = dev->ifindex; + can_skb_prv(skb)->skbcnt = 0; + + skb->ip_summed = CHECKSUM_UNNECESSARY; + + /* preform proper loopback on capable devices */ + if (dev->flags & IFF_ECHO) + skb->pkt_type = PACKET_LOOPBACK; + else + skb->pkt_type = PACKET_HOST; + + skb_reset_mac_header(skb); + skb_reset_network_header(skb); + skb_reset_transport_header(skb); + } + + return true; +} + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ static inline bool can_dropped_invalid_skb(struct net_device *dev, struct sk_buff *skb) @@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_s } else goto inval_skb; + if (!can_skb_headroom_valid(dev, skb)) + goto inval_skb; + return false; inval_skb: From patchwork Tue Jan 14 10:01:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233901 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71357C33CB1 for ; Tue, 14 Jan 2020 10:18:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 45CE3207FF for ; Tue, 14 Jan 2020 10:18:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997111; bh=d74K2DIfr18c3bWonOpJS6cUqnB8pqMipT6c6hyzOBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=e6RyIqQt4mqovxIf2ozjjYsBLgU8tiPLsJ48UBCWDwG0hJG3WJwP+FjZs6vXLrFrt DqQ9xcHbkX6OLUwKbGAYAPkOx/wix0rtKaBxk65DTkgrFgShfOQW0SQGvuCEANxdZ1 o0UZCd5PKwGz2AF3hfRgomTsr3kQhhAez6VblZrE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730718AbgANKHj (ORCPT ); Tue, 14 Jan 2020 05:07:39 -0500 Received: from mail.kernel.org ([198.145.29.99]:38146 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729721AbgANKHj (ORCPT ); Tue, 14 Jan 2020 05:07:39 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0163F20678; Tue, 14 Jan 2020 10:07:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996458; bh=d74K2DIfr18c3bWonOpJS6cUqnB8pqMipT6c6hyzOBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R271DfdyMcv/MA6/7MU1RG24cxHJAfssGfl40PpmIRfagvDtntqmzikg0e2pY9nqQ 76YOeQR79aJdV05Z/uRopXd/RGQoDWCNGo0nF4sEC+CjWbMkUL0241C+evoxeHWhc1 31SaXU8rXxFSZ+quTslYR9friZlwz0eqwhklbvaE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , Mika Westerberg , Hans de Goede , Linus Walleij Subject: [PATCH 4.19 24/46] gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism Date: Tue, 14 Jan 2020 11:01:41 +0100 Message-Id: <20200114094345.347891623@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hans de Goede commit aa23ca3d98f756d5b1e503fb140665fb24a41a38 upstream. On some laptops enabling wakeup on the GPIO interrupts used for ACPI _AEI event handling causes spurious wakeups. This commit adds a new honor_wakeup option, defaulting to true (our current behavior), which can be used to disable wakeup on troublesome hardware to avoid these spurious wakeups. This is a workaround for an architectural problem with s2idle under Linux where we do not have any mechanism to immediately go back to sleep after wakeup events, other then for embedded-controller events using the standard ACPI EC interface, for details see: https://lore.kernel.org/linux-acpi/61450f9b-cbc6-0c09-8b3a-aff6bf9a0b3c@redhat.com/ One series of laptops which is not able to suspend without this workaround is the HP x2 10 Cherry Trail models, this commit adds a DMI based quirk which makes sets honor_wakeup to false on these models. Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20200105160357.97154-3-hdegoede@redhat.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman --- drivers/gpio/gpiolib-acpi.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -25,12 +25,18 @@ #include "gpiolib.h" #define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l +#define QUIRK_NO_WAKEUP 0x02l static int run_edge_events_on_boot = -1; module_param(run_edge_events_on_boot, int, 0444); MODULE_PARM_DESC(run_edge_events_on_boot, "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); +static int honor_wakeup = -1; +module_param(honor_wakeup, int, 0444); +MODULE_PARM_DESC(honor_wakeup, + "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); + /** * struct acpi_gpio_event - ACPI GPIO event handler data * @@ -280,7 +286,7 @@ static acpi_status acpi_gpiochip_alloc_e event->handle = evt_handle; event->handler = handler; event->irq = irq; - event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; + event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; event->pin = pin; event->desc = desc; @@ -1291,6 +1297,23 @@ static const struct dmi_system_id gpioli }, .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, }, + { + /* + * Various HP X2 10 Cherry Trail models use an external + * embedded-controller connected via I2C + an ACPI GPIO + * event handler. The embedded controller generates various + * spurious wakeup events when suspended. So disable wakeup + * for its handler (it uses the only ACPI GPIO event handler). + * This breaks wakeup when opening the lid, the user needs + * to press the power-button to wakeup the system. The + * alternative is suspend simply not working, which is worse. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "HP"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), + }, + .driver_data = (void *)QUIRK_NO_WAKEUP, + }, {} /* Terminating entry */ }; @@ -1310,6 +1333,13 @@ static int acpi_gpio_setup_params(void) run_edge_events_on_boot = 1; } + if (honor_wakeup < 0) { + if (quirks & QUIRK_NO_WAKEUP) + honor_wakeup = 0; + else + honor_wakeup = 1; + } + return 0; } From patchwork Tue Jan 14 10:01:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233961 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71BE5C33CB2 for ; Tue, 14 Jan 2020 10:08:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4739024693 for ; Tue, 14 Jan 2020 10:08:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996480; bh=2LyRKRdbA5SZ6xlA3llIC3ouPv99BFtpcpHQ2YBOzIE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Ovg9S3l6W3Jr5sBuqr9KKE0j4ZMyCmLnDAKpkcfC+IZqmaV4CcQInnM16V2UHrMbD A7TW0qNvmHcuqZ8WG+URh493EEwvBUalxaboXex/I5G2dYTK4M0Vbqc4a/Lq2wXsHo Aect5M4gPh1SRyGFHt4vW+U5DVyAQoLQAOjd+Pmk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729795AbgANKHw (ORCPT ); Tue, 14 Jan 2020 05:07:52 -0500 Received: from mail.kernel.org ([198.145.29.99]:38514 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730747AbgANKHu (ORCPT ); Tue, 14 Jan 2020 05:07:50 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7AC072467D; Tue, 14 Jan 2020 10:07:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996469; bh=2LyRKRdbA5SZ6xlA3llIC3ouPv99BFtpcpHQ2YBOzIE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HCUXynyIhAvpJCaN9nN0X0uakuVbXezqxshKlM+ixvm7HMRXfitlYpmuISuh3D7dp Kw3f08FIFBdpaqiM+b5yxgiwtgpfVXrYnsWKULQUO80vt6VtYW2R0gUrhyCbCspJiB TYVgkJA7iYjwOAxs5sU8+yKksUJT/GVGLLtKlXLA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , Johan Hovold Subject: [PATCH 4.19 26/46] USB: serial: option: add ZLP support for 0x1bc7/0x9010 Date: Tue, 14 Jan 2020 11:01:43 +0100 Message-Id: <20200114094345.726789934@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniele Palmas commit 2438c3a19dec5e98905fd3ffcc2f24716aceda6b upstream. Telit FN980 flashing device 0x1bc7/0x9010 requires zero packet to be sent if out data size is is equal to the endpoint max size. Signed-off-by: Daniele Palmas [ johan: switch operands in conditional ] Cc: stable Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/option.c | 8 ++++++++ drivers/usb/serial/usb-wwan.h | 1 + drivers/usb/serial/usb_wwan.c | 4 ++++ 3 files changed, 13 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -567,6 +567,9 @@ static void option_instat_callback(struc /* Interface must have two endpoints */ #define NUMEP2 BIT(16) +/* Device needs ZLP */ +#define ZLP BIT(17) + static const struct usb_device_id option_ids[] = { { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, @@ -1198,6 +1201,8 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ + .driver_info = NCTRL(0) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), .driver_info = RSVD(1) }, @@ -2098,6 +2103,9 @@ static int option_attach(struct usb_seri if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) data->use_send_setup = 1; + if (device_flags & ZLP) + data->use_zlp = 1; + spin_lock_init(&data->susp_lock); usb_set_serial_data(serial, data); --- a/drivers/usb/serial/usb-wwan.h +++ b/drivers/usb/serial/usb-wwan.h @@ -36,6 +36,7 @@ struct usb_wwan_intf_private { spinlock_t susp_lock; unsigned int suspended:1; unsigned int use_send_setup:1; + unsigned int use_zlp:1; int in_flight; unsigned int open_ports; void *private; --- a/drivers/usb/serial/usb_wwan.c +++ b/drivers/usb/serial/usb_wwan.c @@ -490,6 +490,7 @@ static struct urb *usb_wwan_setup_urb(st void (*callback) (struct urb *)) { struct usb_serial *serial = port->serial; + struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); struct urb *urb; urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ @@ -500,6 +501,9 @@ static struct urb *usb_wwan_setup_urb(st usb_sndbulkpipe(serial->dev, endpoint) | dir, buf, len, callback, ctx); + if (intfdata->use_zlp && dir == USB_DIR_OUT) + urb->transfer_flags |= URB_ZERO_PACKET; + return urb; } From patchwork Tue Jan 14 10:01:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233960 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67227C33CB1 for ; Tue, 14 Jan 2020 10:08:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3EF0524692 for ; Tue, 14 Jan 2020 10:08:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996485; bh=8AIZEBeI+orkEPwjWlJSquPttIx5N798ymgLlc/bwHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=gW5dOBj8+RWblk4+WegEqIkzfAuGuNuLCvYxcjvFa1MqWiZ3ar7ID98/IMGHvUTIM OxweANKNLqo62tQBCCIddHibReT/Hwufym6vR0/UXTL2wd7Za2x2/MJXzUindxwbxa FF2JCQ+KL8AzJIFb4mka8hv5H40oXWydgZpNpAWs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730820AbgANKIB (ORCPT ); Tue, 14 Jan 2020 05:08:01 -0500 Received: from mail.kernel.org ([198.145.29.99]:38596 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729067AbgANKHw (ORCPT ); Tue, 14 Jan 2020 05:07:52 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3873924677; Tue, 14 Jan 2020 10:07:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996471; bh=8AIZEBeI+orkEPwjWlJSquPttIx5N798ymgLlc/bwHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bIr9V7QOxTw6Nlh4NqzojvTkLo9eZRfC4Jr41qkn0Q+zVI8XixHllg82Z6WMJGa29 Dy38grSz84k84Qg33vr8iQUV0XFBumjwUhhHoKA+8OiipoB3MVSmEgC0orlRMmiISa wzoOSr7O2iYORfT93f7+8InijtQBenzLHE38eJo8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Merlijn Wajer , Pavel Machek , Sebastian Reichel , Tony Lindgren , Bin Liu Subject: [PATCH 4.19 27/46] usb: musb: fix idling for suspend after disconnect interrupt Date: Tue, 14 Jan 2020 11:01:44 +0100 Message-Id: <20200114094345.907114623@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tony Lindgren commit 5fbf7a2534703fd71159d3d71504b0ad01b43394 upstream. When disconnected as USB B-device, suspend interrupt should come before diconnect interrupt, because the DP/DM pins are shorter than the VBUS/GND pins on the USB connectors. But we sometimes get a suspend interrupt after disconnect interrupt. In that case we have devctl set to 99 with VBUS still valid and musb_pm_runtime_check_session() wrongly thinks we have an active session. We have no other interrupts after disconnect coming in this case at least with the omap2430 glue. Let's fix the issue by checking the interrupt status again with delayed work for the devctl 99 case. In the suspend after disconnect case the devctl session bit has cleared by then and musb can idle. For a typical USB B-device connect case we just continue with normal interrupts. Fixes: 467d5c980709 ("usb: musb: Implement session bit based runtime PM for musb-core") Cc: Merlijn Wajer Cc: Pavel Machek Cc: Sebastian Reichel Cc: stable@vger.kernel.org Signed-off-by: Tony Lindgren Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20200107152625.857-2-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/usb/musb/musb_core.c +++ b/drivers/usb/musb/musb_core.c @@ -1842,6 +1842,9 @@ static const struct attribute_group musb #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \ (2 << MUSB_DEVCTL_VBUS_SHIFT) | \ MUSB_DEVCTL_SESSION) +#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \ + (3 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \ MUSB_DEVCTL_SESSION) @@ -1864,6 +1867,11 @@ static void musb_pm_runtime_check_sessio s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV | MUSB_DEVCTL_HR; switch (devctl & ~s) { + case MUSB_QUIRK_B_DISCONNECT_99: + musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); + schedule_delayed_work(&musb->irq_work, + msecs_to_jiffies(1000)); + break; case MUSB_QUIRK_B_INVALID_VBUS_91: if (musb->quirk_retries && !musb->flush_irq_work) { musb_dbg(musb, From patchwork Tue Jan 14 10:01:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233902 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CCF0C33CB1 for ; Tue, 14 Jan 2020 10:18:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5F2D8207FF for ; Tue, 14 Jan 2020 10:18:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997104; bh=DLUMAB8sKpPd5p+SiSltdWxQrt78MGu3CgUvppVNDlI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=R6uuuJUoB/ob7VGHEQ6I56yeK2tmqK+cfMwlhaJyyxxO8aGdpxyYPbiCArQjBh9tc hzra+gCY0zfWGP7A1hQK9aC3qfYgF3GPnKi3liV/aYqZrvYIcMAbahTWqDGhOKu7QX H6FNEyht6qhZXZKqHvNJ4+EZkDQY68E3fJTLl27s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729274AbgANKSS (ORCPT ); Tue, 14 Jan 2020 05:18:18 -0500 Received: from mail.kernel.org ([198.145.29.99]:39022 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729067AbgANKID (ORCPT ); Tue, 14 Jan 2020 05:08:03 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B78AA2467D; Tue, 14 Jan 2020 10:08:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996483; bh=DLUMAB8sKpPd5p+SiSltdWxQrt78MGu3CgUvppVNDlI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iko3LHqqWZT6vNgUS0SCNfO2xNf3UK2Zx18o6NgVR1prtRAjKOK+YQgD1FwkiijXI JVX/lb96wRolIEBy8BOp95dcfzXHDa7P5MFC3o7JA/Hw3JYVX2WiZb9dIO4yiTwqWr f2CCoXmB2XHR+LcOT0m3/l7Pouwrp8c7ETzZRVWM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Straube Subject: [PATCH 4.19 31/46] staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 Date: Tue, 14 Jan 2020 11:01:48 +0100 Message-Id: <20200114094346.678044719@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Michael Straube commit 58dcc5bf4030cab548d5c98cd4cd3632a5444d5a upstream. This device was added to the stand-alone driver on github. Add it to the staging driver as well. Link: https://github.com/lwfinger/rtl8188eu/commit/b9b537aa25a8 Signed-off-by: Michael Straube Cc: stable Link: https://lore.kernel.org/r/20191228143725.24455-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c +++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c @@ -37,6 +37,7 @@ static const struct usb_device_id rtw_us {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ + {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ {} /* Terminating entry */ From patchwork Tue Jan 14 10:01:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233906 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F2C7C33CB1 for ; Tue, 14 Jan 2020 10:16:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0434E207FF for ; Tue, 14 Jan 2020 10:16:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997014; bh=cJ6wEibUShMousPc+02xkZVy1kRYitQYZDUUI9Aah7o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mMwCwIJayfz+fvxZ0s8OqyrYsnIAzM2IWHG5wx/u0gJD/eWbdywDdWSIolKhyB2P6 GrHcAtg8y0vIoAPg8deAT+5dl8npOEYSXRkA2yY4qsYQhtK4Gcpr1hsCQNevFOwhIG jPwdaoH6CdJA/nEpridYOQEBiaFXoXZpI0H7kB4k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730297AbgANKI3 (ORCPT ); Tue, 14 Jan 2020 05:08:29 -0500 Received: from mail.kernel.org ([198.145.29.99]:39946 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729094AbgANKI3 (ORCPT ); Tue, 14 Jan 2020 05:08:29 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 00E9F207FF; Tue, 14 Jan 2020 10:08:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996508; bh=cJ6wEibUShMousPc+02xkZVy1kRYitQYZDUUI9Aah7o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HHFbVyUcpAy/QCVZG9n6y6FjiVqJ3MKEtWH8RlGvgYpOy1Ht0iv2AuuHZPytWtoqa CYcy7pGX4WKvC/7LzmKiNzG8lkt223JzrGuGwCEQb47OR1/A20TevU3nBbAavWZMwM 18+nmPvjJT6EPjm5JygSRpObpxkTcH32J1GO1ShI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby , Sudip Mukherjee Subject: [PATCH 4.19 33/46] tty: link tty and port before configuring it as console Date: Tue, 14 Jan 2020 11:01:50 +0100 Message-Id: <20200114094346.995735914@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sudip Mukherjee commit fb2b90014d782d80d7ebf663e50f96d8c507a73c upstream. There seems to be a race condition in tty drivers and I could see on many boot cycles a NULL pointer dereference as tty_init_dev() tries to do 'tty->port->itty = tty' even though tty->port is NULL. 'tty->port' will be set by the driver and if the driver has not yet done it before we open the tty device we can get to this situation. By adding some extra debug prints, I noticed that: 6.650130: uart_add_one_port 6.663849: register_console 6.664846: tty_open 6.674391: tty_init_dev 6.675456: tty_port_link_device uart_add_one_port() registers the console, as soon as it registers, the userspace tries to use it and that leads to tty_open() but uart_add_one_port() has not yet done tty_port_link_device() and so tty->port is not yet configured when control reaches tty_init_dev(). Further look into the code and tty_port_link_device() is done by uart_add_one_port(). After registering the console uart_add_one_port() will call tty_port_register_device_attr_serdev() and tty_port_link_device() is called from this. Call add tty_port_link_device() before uart_configure_port() is done and add a check in tty_port_link_device() so that it only links the port if it has not been done yet. Suggested-by: Jiri Slaby Signed-off-by: Sudip Mukherjee Cc: stable Link: https://lore.kernel.org/r/20191212131602.29504-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/serial_core.c | 1 + drivers/tty/tty_port.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -2786,6 +2786,7 @@ int uart_add_one_port(struct uart_driver if (uport->cons && uport->dev) of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + tty_port_link_device(port, drv->tty_driver, uport->line); uart_configure_port(drv, state, uport); port->console = uart_console(uport); --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -89,7 +89,8 @@ void tty_port_link_device(struct tty_por { if (WARN_ON(index >= driver->num)) return; - driver->ports[index] = port; + if (!driver->ports[index]) + driver->ports[index] = port; } EXPORT_SYMBOL_GPL(tty_port_link_device); From patchwork Tue Jan 14 10:01:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233909 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9786AC33CB2 for ; Tue, 14 Jan 2020 10:16:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6E28A207FF for ; Tue, 14 Jan 2020 10:16:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997007; bh=WyIhIt16m1+94Tbnkg+8anM20YQiwXa69PsEMkW6yR0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=bm7hwrLfnEkBe+E6RBGsIHm9KQgGJbtOjoaV89BKe2+glMqvd9lYFCmK8vZ/UuL3H cDIYx1ljIry0baps57GaC/ORe/BtE3htSCNq40Sk3ctbJWgHZfRbqHYFr8q7PSvO3T UXmj30CflvFP5PH0Zu1sje2/iF+LafH6vPcnhcoA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731083AbgANKIt (ORCPT ); Tue, 14 Jan 2020 05:08:49 -0500 Received: from mail.kernel.org ([198.145.29.99]:40676 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731061AbgANKIs (ORCPT ); Tue, 14 Jan 2020 05:08:48 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9AADF20678; Tue, 14 Jan 2020 10:08:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996528; bh=WyIhIt16m1+94Tbnkg+8anM20YQiwXa69PsEMkW6yR0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yI+TkWf4l2Bt2IJBWH71bmklj5wprp+3+qFYaCSof00958+oNO+SFLkxPQjj/KGbC vj+tnBU8LCbv8Fbtr0fIxl9Fuv251wZ2ata+AHeCgQfHYPgHAD6iKv6BKBXePlwJlR N3dkWSnk8IF34kf9cnZXUg3mUkpRt1grm72/trI4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, huangwen , Ganapathi Bhat , Kalle Valo , Ben Hutchings Subject: [PATCH 4.19 35/46] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() Date: Tue, 14 Jan 2020 11:01:52 +0100 Message-Id: <20200114094347.269035680@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ganapathi Bhat commit 3d94a4a8373bf5f45cf5f939e88b8354dbf2311b upstream. mwifiex_process_country_ie() function parse elements of bss descriptor in beacon packet. When processing WLAN_EID_COUNTRY element, there is no upper limit check for country_ie_len before calling memcpy. The destination buffer domain_info->triplet is an array of length MWIFIEX_MAX_TRIPLET_802_11D(83). The remote attacker can build a fake AP with the same ssid as real AP, and send malicous beacon packet with long WLAN_EID_COUNTRY elemen (country_ie_len > 83). Attacker can force STA connect to fake AP on a different channel. When the victim STA connects to fake AP, will trigger the heap buffer overflow. Fix this by checking for length and if found invalid, don not connect to the AP. This fix addresses CVE-2019-14895. Reported-by: huangwen Signed-off-by: Ganapathi Bhat Signed-off-by: Kalle Valo Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c @@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(st "11D: skip setting domain info in FW\n"); return 0; } + + if (country_ie_len > + (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { + mwifiex_dbg(priv->adapter, ERROR, + "11D: country_ie_len overflow!, deauth AP\n"); + return -EINVAL; + } + memcpy(priv->adapter->country_code, &country_ie[2], 2); domain_info->country_code[0] = country_ie[2]; @@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_pri priv->scan_block = false; if (bss) { - if (adapter->region_code == 0x00) - mwifiex_process_country_ie(priv, bss); + if (adapter->region_code == 0x00 && + mwifiex_process_country_ie(priv, bss)) + return -EINVAL; /* Allocate and fill new bss descriptor */ bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), From patchwork Tue Jan 14 10:01:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233910 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC0BFC33CB1 for ; Tue, 14 Jan 2020 10:16:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C10C7207FF for ; Tue, 14 Jan 2020 10:16:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997004; bh=k7kjU9j0TYsN5f6EiBfMNCH3voyuC2Mmp1NyQsEfLoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ytVml/2JeOoCOlvG0U9Td4MXVKPtjHsPvy66pxZn8PRimVn/tiR6DpRa2rBKZb/W9 RBZ+edeiwwWKOFElDUHzMtD+cqotLPhzfi5Nawby+CH305F0RDuiCtwMWh5sgB45MW 7kfrlszwJVNXn+EUdRgxVg61p08SrrevM3dYQWQc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731123AbgANKIy (ORCPT ); Tue, 14 Jan 2020 05:08:54 -0500 Received: from mail.kernel.org ([198.145.29.99]:40886 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731117AbgANKIx (ORCPT ); Tue, 14 Jan 2020 05:08:53 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0202924677; Tue, 14 Jan 2020 10:08:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996533; bh=k7kjU9j0TYsN5f6EiBfMNCH3voyuC2Mmp1NyQsEfLoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MlkzcAXTKyZoC+PMUnvNF6SKM/3C58C393e4mkTYJL6UaL+jW1G3v+mxUWHjnRsRl F1RRI32K7bVrSWAg8rnFdps9WAPXr233m198QbtoBH1PmwAoS2yKOhWfZzs3D7yBJf KZ3DCL04yoKa4K2d/glGVbBcAVBI1cKWQlJeeGeA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Navid Emamdoost , "Martin K. Petersen" , Ben Hutchings Subject: [PATCH 4.19 37/46] scsi: bfa: release allocated memory in case of error Date: Tue, 14 Jan 2020 11:01:54 +0100 Message-Id: <20200114094347.569969550@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Navid Emamdoost commit 0e62395da2bd5166d7c9e14cbc7503b256a34cb0 upstream. In bfad_im_get_stats if bfa_port_get_stats fails, allocated memory needs to be released. Link: https://lore.kernel.org/r/20190910234417.22151-1-navid.emamdoost@gmail.com Signed-off-by: Navid Emamdoost Signed-off-by: Martin K. Petersen Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- drivers/scsi/bfa/bfad_attr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/scsi/bfa/bfad_attr.c +++ b/drivers/scsi/bfa/bfad_attr.c @@ -283,8 +283,10 @@ bfad_im_get_stats(struct Scsi_Host *shos rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), fcstats, bfad_hcb_comp, &fcomp); spin_unlock_irqrestore(&bfad->bfad_lock, flags); - if (rc != BFA_STATUS_OK) + if (rc != BFA_STATUS_OK) { + kfree(fcstats); return NULL; + } wait_for_completion(&fcomp.comp); From patchwork Tue Jan 14 10:01:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233911 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A6F0C33CB2 for ; Tue, 14 Jan 2020 10:16:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 69F0324676 for ; Tue, 14 Jan 2020 10:16:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997002; bh=BFxh46HFy9ySY4mUcKY0PvlwJXW3zNmemXO2wpQrlu4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=l7rPuTJfEP5dSYA7SpeWgZmZoyiMy8m/fZY3J2HkVJs6yqDGesyW6FIR4daWHqkuz Txq1YlSqR0YsHIbR3hpWT+i4BhhVHp7PR0F8HT5KYXyDtLtNc6a+eHawrvaR3LKhvc dPE4htNDq6FA7FVYhd3HAQYLCruSG3cNXr6ggufg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725842AbgANKQh (ORCPT ); Tue, 14 Jan 2020 05:16:37 -0500 Received: from mail.kernel.org ([198.145.29.99]:41222 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729472AbgANKJC (ORCPT ); Tue, 14 Jan 2020 05:09:02 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7E5AE20678; Tue, 14 Jan 2020 10:09:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996542; bh=BFxh46HFy9ySY4mUcKY0PvlwJXW3zNmemXO2wpQrlu4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0/Pn6Ba2keUVUEZohGeLMXc8UG4xNv5Mmki8J0VYOVQ/i1F5RpFns7BPzqEwhe/eD kGzokRK67XI93JxnFJAN1zlWwTlk5tZsAs55DZOcvi9PU7dWBhhJjC/F7ojaRdFL1Q 3k5UO72wMagS/81SuambEq0iuhPZ/BWMLCPdUsM8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Torokhov , Benjamin Tissoires Subject: [PATCH 4.19 40/46] HID: hiddev: fix mess in hiddev_open() Date: Tue, 14 Jan 2020 11:01:57 +0100 Message-Id: <20200114094348.101474810@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dmitry Torokhov commit 18a1b06e5b91d47dc86c0a66a762646ea7c5d141 upstream. The open method of hiddev handler fails to bring the device out of autosuspend state as was promised in 0361a28d3f9a, as it actually has 2 blocks that try to start the transport (call hid_hw_open()) with both being guarded by the "open" counter, so the 2nd block is never executed as the first block increments the counter so it is never at 0 when we check it for the second block. Additionally hiddev_open() was leaving counter incremented on errors, causing the device to never be reopened properly if there was ever an error. Let's fix all of this by factoring out code that creates client structure and powers up the device into a separate function that is being called from usbhid_open() with the "existancelock" being held. Fixes: 0361a28d3f9a ("HID: autosuspend support for USB HID") Signed-off-by: Dmitry Torokhov Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman --- drivers/hid/usbhid/hiddev.c | 97 +++++++++++++++++++------------------------- 1 file changed, 42 insertions(+), 55 deletions(-) --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c @@ -254,12 +254,51 @@ static int hiddev_release(struct inode * return 0; } +static int __hiddev_open(struct hiddev *hiddev, struct file *file) +{ + struct hiddev_list *list; + int error; + + lockdep_assert_held(&hiddev->existancelock); + + list = vzalloc(sizeof(*list)); + if (!list) + return -ENOMEM; + + mutex_init(&list->thread_lock); + list->hiddev = hiddev; + + if (!hiddev->open++) { + error = hid_hw_power(hiddev->hid, PM_HINT_FULLON); + if (error < 0) + goto err_drop_count; + + error = hid_hw_open(hiddev->hid); + if (error < 0) + goto err_normal_power; + } + + spin_lock_irq(&hiddev->list_lock); + list_add_tail(&list->node, &hiddev->list); + spin_unlock_irq(&hiddev->list_lock); + + file->private_data = list; + + return 0; + +err_normal_power: + hid_hw_power(hiddev->hid, PM_HINT_NORMAL); +err_drop_count: + hiddev->open--; + vfree(list); + return error; +} + /* * open file op */ static int hiddev_open(struct inode *inode, struct file *file) { - struct hiddev_list *list; struct usb_interface *intf; struct hid_device *hid; struct hiddev *hiddev; @@ -268,66 +307,14 @@ static int hiddev_open(struct inode *ino intf = usbhid_find_interface(iminor(inode)); if (!intf) return -ENODEV; + hid = usb_get_intfdata(intf); hiddev = hid->hiddev; - if (!(list = vzalloc(sizeof(struct hiddev_list)))) - return -ENOMEM; - mutex_init(&list->thread_lock); - list->hiddev = hiddev; - file->private_data = list; - - /* - * no need for locking because the USB major number - * is shared which usbcore guards against disconnect - */ - if (list->hiddev->exist) { - if (!list->hiddev->open++) { - res = hid_hw_open(hiddev->hid); - if (res < 0) - goto bail; - } - } else { - res = -ENODEV; - goto bail; - } - - spin_lock_irq(&list->hiddev->list_lock); - list_add_tail(&list->node, &hiddev->list); - spin_unlock_irq(&list->hiddev->list_lock); - mutex_lock(&hiddev->existancelock); - /* - * recheck exist with existance lock held to - * avoid opening a disconnected device - */ - if (!list->hiddev->exist) { - res = -ENODEV; - goto bail_unlock; - } - if (!list->hiddev->open++) - if (list->hiddev->exist) { - struct hid_device *hid = hiddev->hid; - res = hid_hw_power(hid, PM_HINT_FULLON); - if (res < 0) - goto bail_unlock; - res = hid_hw_open(hid); - if (res < 0) - goto bail_normal_power; - } - mutex_unlock(&hiddev->existancelock); - return 0; -bail_normal_power: - hid_hw_power(hid, PM_HINT_NORMAL); -bail_unlock: + res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV; mutex_unlock(&hiddev->existancelock); - spin_lock_irq(&list->hiddev->list_lock); - list_del(&list->node); - spin_unlock_irq(&list->hiddev->list_lock); -bail: - file->private_data = NULL; - vfree(list); return res; } From patchwork Tue Jan 14 10:01:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233912 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4281EC33CB2 for ; Tue, 14 Jan 2020 10:16:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 16720207FF for ; Tue, 14 Jan 2020 10:16:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996996; bh=+PI48K9XTvgjwsMAYb2zfC9iKKt9NZ6/WaU3LZy+OyI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=DvxtSOhaMUsqBLOK3o3WXNonCG6eKoYjZx4fxSpnluxC3mpwtE7oLul49T6ZeUwtr t8dFY8s+uUpaPVMeKHZv6qh8i+4TJcdZvImvMqXDfNtDFyKXLTCiDPc7Rm420gP74i fkNgFhlcLZIUuEZj/OMHCHpAGodXSUpwpVpK95LQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731217AbgANKJF (ORCPT ); Tue, 14 Jan 2020 05:09:05 -0500 Received: from mail.kernel.org ([198.145.29.99]:41338 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731214AbgANKJF (ORCPT ); Tue, 14 Jan 2020 05:09:05 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4F8892467A; Tue, 14 Jan 2020 10:09:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996544; bh=+PI48K9XTvgjwsMAYb2zfC9iKKt9NZ6/WaU3LZy+OyI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CRXJrjGWiL/vBIOx51IJtYNogX0phv7PPaTW7SRVxNDV2HawdNmz3bUpzrgLJby1B atzp7tQivCPO3IbcowIN8roANmKKXc3SPFys41TTCzcOC677ynTlGAIN2/LAfkQ/ff 9r+44paFn64/WZrzoz9s62YNcFPTwICWjHc8YjA8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Laurent Pinchart , Roger Whittaker Subject: [PATCH 4.19 41/46] USB: Fix: Dont skip endpoint descriptors with maxpacket=0 Date: Tue, 14 Jan 2020 11:01:58 +0100 Message-Id: <20200114094348.257779024@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alan Stern commit 2548288b4fb059b2da9ceada172ef763077e8a59 upstream. It turns out that even though endpoints with a maxpacket length of 0 aren't useful for data transfer, the descriptors do serve other purposes. In particular, skipping them will also skip over other class-specific descriptors for classes such as UVC. This unexpected side effect has caused some UVC cameras to stop working. In addition, the USB spec requires that when isochronous endpoint descriptors are present in an interface's altsetting 0 (which is true on some devices), the maxpacket size _must_ be set to 0. Warning about such things seems like a bad idea. This patch updates an earlier commit which would log a warning and skip these endpoint descriptors. Now we only log a warning, and we don't even do that for isochronous endpoints in altsetting 0. We don't need to worry about preventing endpoints with maxpacket = 0 from ever being used for data transfers; usb_submit_urb() already checks for this. Reported-and-tested-by: Roger Whittaker Fixes: d482c7bb0541 ("USB: Skip endpoints with 0 maxpacket length") Signed-off-by: Alan Stern CC: Laurent Pinchart Link: https://marc.info/?l=linux-usb&m=157790377329882&w=2 Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2001061040270.1514-100000@iolanthe.rowland.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/config.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct dev endpoint->desc.wMaxPacketSize = cpu_to_le16(8); } - /* Validate the wMaxPacketSize field */ + /* + * Validate the wMaxPacketSize field. + * Some devices have isochronous endpoints in altsetting 0; + * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 + * (see the end of section 5.6.3), so don't warn about them. + */ maxp = usb_endpoint_maxp(&endpoint->desc); - if (maxp == 0) { - dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", + if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { + dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", cfgno, inum, asnum, d->bEndpointAddress); - goto skip_to_next_endpoint_or_interface_descriptor; } /* Find the highest legal maxpacket size for this endpoint */ From patchwork Tue Jan 14 10:02:00 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233907 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8732DC33CB3 for ; Tue, 14 Jan 2020 10:16:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 549C4207FF for ; Tue, 14 Jan 2020 10:16:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997011; bh=XQLkSruPo+o5PUSErv4u/zaJfbC1EOrkYq7lBk8SaLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2o/Ga/t+BDlzFLtDuYCKTb3de7i+raR7H87pYJBenTDG81//+4HqsYGMtOMVLDRjW rdle2gOCQ9EA4Deq5Zbs/UmmOOsog6jn54dGK1eFzknYktU2ticgpISHOHGE85yPKH E2nOVcAT1uFCHcCe3QNsxp9kRsTtd6DvGaYhy2+Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729613AbgANKIg (ORCPT ); Tue, 14 Jan 2020 05:08:36 -0500 Received: from mail.kernel.org ([198.145.29.99]:40144 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729094AbgANKIe (ORCPT ); Tue, 14 Jan 2020 05:08:34 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 89247207FF; Tue, 14 Jan 2020 10:08:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996514; bh=XQLkSruPo+o5PUSErv4u/zaJfbC1EOrkYq7lBk8SaLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Opt09eAgz/DaGEyCv+VwY/HmC9Wvz91gDVRHBiFX2aBypdO/7beOf9QDmVaRt+Sz4 8Y+VseF1RI2F2W+TYoqKd6/J7haTb0L6RIC2ScyVlwQS45RPlsaOTUZSkJslCWvqkF MhByH/yfkcTsYnuHNRmBzWYHHjUMJyrKEocuLDrw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jacopo Mondi , Marcel Partap , Merlijn Wajer , Michael Scott , NeKit , Pavel Machek , Sebastian Reichel , Tony Lindgren , Kishon Vijay Abraham I Subject: [PATCH 4.19 43/46] phy: cpcap-usb: Fix flakey host idling and enumerating of devices Date: Tue, 14 Jan 2020 11:02:00 +0100 Message-Id: <20200114094348.528047360@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tony Lindgren commit 049226b9fd7442149dcbcf55f15408f5973cceda upstream. We must let the USB host idle things properly before we switch to debug UART mode. Otherwise the USB host may never idle after disconnecting devices, and that causes the next enumeration to be flakey. Cc: Jacopo Mondi Cc: Marcel Partap Cc: Merlijn Wajer Cc: Michael Scott Cc: NeKit Cc: Pavel Machek Cc: Sebastian Reichel Acked-by: Pavel Machek Fixes: 6d6ce40f63af ("phy: cpcap-usb: Add CPCAP PMIC USB support") Signed-off-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Greg Kroah-Hartman --- drivers/phy/motorola/phy-cpcap-usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/phy/motorola/phy-cpcap-usb.c +++ b/drivers/phy/motorola/phy-cpcap-usb.c @@ -281,13 +281,13 @@ static void cpcap_usb_detect(struct work return; } + cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); + /* Default to debug UART mode */ error = cpcap_usb_set_uart_mode(ddata); if (error) goto out_err; - cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); - dev_dbg(ddata->dev, "set UART mode\n"); return; From patchwork Tue Jan 14 10:02:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 233908 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B11D7C33CB6 for ; Tue, 14 Jan 2020 10:16:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8503924676 for ; Tue, 14 Jan 2020 10:16:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578997008; bh=T67fHZqidlAyh8FbzLOG1P11xKFtdBYShqTE/DNKaeg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ebghn5DbEkmvPCfXpwfNj6QlXV1ag+qRnytOanO1v+SBvyxAhn793LokSawExlgXC dN85En41CEAJP2CtJUQGfAVfF2yD5RUwdU7/o1Rin9PkFrmLZaOHpNi5a7An5LMU9Y i5vPzbzzof0K5ioLda3ZgD3Xmx8g3sbZq76sGlIM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730633AbgANKIn (ORCPT ); Tue, 14 Jan 2020 05:08:43 -0500 Received: from mail.kernel.org ([198.145.29.99]:40436 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731061AbgANKIm (ORCPT ); Tue, 14 Jan 2020 05:08:42 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 08A8420678; Tue, 14 Jan 2020 10:08:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996522; bh=T67fHZqidlAyh8FbzLOG1P11xKFtdBYShqTE/DNKaeg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zq/lreziWcqXQqg6p8JG2MMaNq7OeGJUWPzv2Q+5cwzNi0KDE1GukPqz7VTPClrsd gMxcTFD8ataIMnamYDIo2T5ICg1Cuk8GJpxGbKIFjU9dtvW+LNUHNGEZSv4q2HiF95 MPURjWIKR3DNhKdNlD3Ar/JmuPAFGhpmexhqHj+0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jozsef Kadlecsik , syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com, Florian Westphal , Pablo Neira Ayuso Subject: [PATCH 4.19 46/46] netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present Date: Tue, 14 Jan 2020 11:02:03 +0100 Message-Id: <20200114094348.890539049@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094339.608068818@linuxfoundation.org> References: <20200114094339.608068818@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Florian Westphal commit 22dad713b8a5ff488e07b821195270672f486eb2 upstream. The set uadt functions assume lineno is never NULL, but it is in case of ip_set_utest(). syzkaller managed to generate a netlink message that calls this with LINENO attr present: general protection fault: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104 Call Trace: ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867 nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563 pass a dummy lineno storage, its easier than patching all set implementations. This seems to be a day-0 bug. Cc: Jozsef Kadlecsik Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com Fixes: a7b4f989a6294 ("netfilter: ipset: IP set core support") Signed-off-by: Florian Westphal Acked-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/ipset/ip_set_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1666,6 +1666,7 @@ static int ip_set_utest(struct net *net, struct ip_set *set; struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; int ret = 0; + u32 lineno; if (unlikely(protocol_failed(attr) || !attr[IPSET_ATTR_SETNAME] || @@ -1682,7 +1683,7 @@ static int ip_set_utest(struct net *net, return -IPSET_ERR_PROTOCOL; rcu_read_lock_bh(); - ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); + ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); rcu_read_unlock_bh(); /* Userspace can't trigger element to be re-added */ if (ret == -EAGAIN)