4.14.212-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.14.212-rc1 review
This is the start of the stable review cycle for the 4.14.212 release. There are 31 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 12 Dec 2020 14:25:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.212-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.212-rc1
Masami Hiramatsu <[email protected]>
x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
Luo Meng <[email protected]>
Input: i8042 - fix error return code in i8042_setup_aux()
Zhihao Cheng <[email protected]>
i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
Bob Peterson <[email protected]>
gfs2: check for empty rgrp tree in gfs2_ri_update
Steven Rostedt (VMware) <[email protected]>
tracing: Fix userstacktrace option for instances
Peter Ujfalusi <[email protected]>
spi: bcm2835: Release the DMA channel if probe fails after dma_init
Lukas Wunner <[email protected]>
spi: bcm2835: Fix use-after-free on unbind
Lukas Wunner <[email protected]>
spi: bcm-qspi: Fix use-after-free on unbind
Lukas Wunner <[email protected]>
spi: Introduce device-managed SPI controller allocation
Suravee Suthikulpanit <[email protected]>
iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
Samuel Thibault <[email protected]>
speakup: Reject setting the speakup line discipline outside of speakup
Christian Eggers <[email protected]>
i2c: imx: Check for I2SR_IAL after every byte
Christian Eggers <[email protected]>
i2c: imx: Fix reset of I2SR_IAL flag
Qian Cai <[email protected]>
mm/swapfile: do not sleep with a spin lock held
Paulo Alcantara <[email protected]>
cifs: fix potential use-after-free in cifs_echo_request()
Naveen N. Rao <[email protected]>
ftrace: Fix updating FTRACE_FL_TRAMP
Takashi Iwai <[email protected]>
ALSA: hda/generic: Add option to enforce preferred_dacs pairs
Kailang Yang <[email protected]>
ALSA: hda/realtek - Add new codec supported for ALC897
Jann Horn <[email protected]>
tty: Fix ->session locking
Jann Horn <[email protected]>
tty: Fix ->pgrp locking in tiocspgrp()
Bjørn Mork <[email protected]>
USB: serial: option: fix Quectel BG96 matching
Giacinto Cifelli <[email protected]>
USB: serial: option: add support for Thales Cinterion EXS82
Vincent Palatin <[email protected]>
USB: serial: option: add Fibocom NL668 variants
Johan Hovold <[email protected]>
USB: serial: ch341: sort device-id entries
Jan-Niklas Burfeind <[email protected]>
USB: serial: ch341: add new Product ID for CH341A
Johan Hovold <[email protected]>
USB: serial: kl5kusb105: fix memleak on open
Vamsi Krishna Samavedam <[email protected]>
usb: gadget: f_fs: Use local copy of descriptors for userspace copy
Eric Dumazet <[email protected]>
geneve: pull IP header before ECN decapsulation
Toke Høiland-Jørgensen <[email protected]>
vlan: consolidate VLAN parsing code and limit max parsing depth
Hans de Goede <[email protected]>
pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
Hans de Goede <[email protected]>
pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output
-------------
Diffstat:
Makefile | 4 +- arch/x86/include/asm/insn.h | 15 +++++++ arch/x86/kernel/uprobes.c | 10 +++-- drivers/i2c/busses/i2c-imx.c | 30 +++++++++++--- drivers/i2c/busses/i2c-qup.c | 3 +- drivers/input/serio/i8042.c | 3 +- drivers/iommu/amd_iommu_types.h | 2 +- drivers/net/geneve.c | 20 +++++++-- drivers/pinctrl/intel/pinctrl-baytrail.c | 67 ++++++++++++++++++++++++------- drivers/spi/spi-bcm-qspi.c | 34 ++++++---------- drivers/spi/spi-bcm2835.c | 22 +++++----- drivers/spi/spi.c | 58 +++++++++++++++++++++++++- drivers/staging/speakup/spk_ttyio.c | 38 +++++++++++------- drivers/tty/tty_io.c | 7 +++- drivers/tty/tty_jobctrl.c | 44 ++++++++++++++------ drivers/usb/gadget/function/f_fs.c | 6 ++- drivers/usb/serial/ch341.c | 5 ++- drivers/usb/serial/kl5kusb105.c | 10 ++--- drivers/usb/serial/option.c | 10 +++-- fs/cifs/connect.c | 2 + fs/gfs2/rgrp.c | 4 ++ include/linux/if_vlan.h | 29 +++++++++---- include/linux/spi/spi.h | 19 +++++++++ include/linux/tty.h | 4 ++ include/net/inet_ecn.h | 1 + kernel/trace/ftrace.c | 22 +++++++++- kernel/trace/trace.c | 7 ++-- kernel/trace/trace.h | 6 ++- mm/swapfile.c | 4 +- sound/pci/hda/hda_generic.c | 12 ++++-- sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/patch_realtek.c | 2 + tools/objtool/arch/x86/include/asm/insn.h | 15 +++++++ 33 files changed, 387 insertions(+), 129 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/31 pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output
From: Hans de Goede <[email protected]>
commit e2b74419e5cc7cfc58f3e785849f73f8fa0af5b3 upstream
Suspending Goodix touchscreens requires changing the interrupt pin to output before sending them a power-down command. Followed by wiggling the interrupt pin to wake the device up, after which it is put back in input mode.
On Cherry Trail device the interrupt pin is listed as a GpioInt ACPI resource so we can do this without problems as long as we release the IRQ before changing the pin to output mode.
On Bay Trail devices with a Goodix touchscreen direct-irq mode is used in combination with listing the pin as a normal GpioIo resource. This works fine, but this triggers the WARN in byt_gpio_set_direction-s output path because direct-irq support is enabled on the pin.
This commit replaces the WARN call with a dev_info_once call, fixing a bunch of WARN splats in dmesg on each suspend/resume cycle.
--- drivers/pinctrl/intel/pinctrl-baytrail.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pinctrl/intel/pinctrl-baytrail.c +4 -4
@@ -1034,15 +1034,15 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, value &= ~BYT_DIR_MASK ;if (input) value |=BYT_OUTPUT_EN ; -else +else if (readl (conf_reg) &BYT_DIRECT_IRQ_EN )/* * Before making any direction modifications, do a check if gpio * is set for direct IRQ. On baytrail, setting GPIO to output -* does not make sense, so let's at least warn the caller before +* does not make sense, so let's at least inform the caller before * they shoot themselves in the foot. */ -WARN (readl (conf_reg) &BYT_DIRECT_IRQ_EN , -"Potential Error: Setting GPIO with direct_irq_en to output" ); +dev_info_once (vg->dev,"Potential Error: Setting GPIO with direct_irq_en to output" ); +writel (value, val_reg);raw_spin_unlock_irqrestore (&byt_lock, flags);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 2/31 pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 156abe2961601d60a8c2a60c6dc8dd6ce7adcdaf upstream
The pins on the Bay Trail SoC have separate input-buffer and output-buffer enable bits and a read of the level bit of the value register will always return the value from the input-buffer.
The BIOS of a device may configure a pin in output-only mode, only enabling the output buffer, and write 1 to the level bit to drive the pin high. This 1 written to the level bit will be stored inside the data-latch of the output buffer.
But a subsequent read of the value register will return 0 for the level bit because the input-buffer is disabled. This causes a read-modify-write as done by byt_gpio_set_direction() to write 0 to the level bit, driving the pin low!
Before this commit byt_gpio_direction_output() relied on pinctrl_gpio_direction_output() to set the direction, followed by a call to byt_gpio_set() to apply the selected value. This causes the pin to go low between the pinctrl_gpio_direction_output() and byt_gpio_set() calls.
Change byt_gpio_direction_output() to directly make the register modifications itself instead. Replacing the 2 subsequent writes to the value register with a single write.
Note that the pinctrl code does not keep track internally of the direction, so not going through pinctrl_gpio_direction_output() is not an issue.
This issue was noticed on a Trekstor SurfTab Twin 10.1. When the panel is already on at boot (no external monitor connected), then the i915 driver does a gpiod_get(..., GPIOD_OUT_HIGH) for the panel-enable GPIO. The temporarily going low of that GPIO was causing the panel to reset itself after which it would not show an image until it was turned off and back on again (until a full modeset was done on it). This commit fixes this.
This commit also updates the byt_gpio_direction_input() to use direct register accesses instead of going through pinctrl_gpio_direction_input(), to keep it consistent with byt_gpio_direction_output().
Note for backporting, this commit depends on:
commit e2b74419e5cc ("pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output")
--- drivers/pinctrl/intel/pinctrl-baytrail.c | 67 +++++++++++++++++++----- 1 file changed, 53 insertions(+), 14 deletions(-)
drivers/pinctrl/intel/pinctrl-baytrail.c +53 -14
@@ -1017,6 +1017,21 @@ static void byt_gpio_disable_free(struct pinctrl_dev *pctl_dev,pm_runtime_put (&vg->pdev->dev); } +static void byt_gpio_direct_irq_check (struct byt_gpio *vg, +unsigned int offset) +{ +void __iomem *conf_reg =byt_gpio_reg (vg, offset,BYT_CONF0_REG ); + +/* +* Before making any direction modifications, do a check if gpio is set +* for direct IRQ. On Bay Trail, setting GPIO to output does not make +* sense, so let's at least inform the caller before they shoot +* themselves in the foot. +*/ +if (readl (conf_reg) &BYT_DIRECT_IRQ_EN ) +dev_info_once (&vg->pdev->dev,"Potential Error: Setting GPIO with direct_irq_en to output" ); +} + static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, struct pinctrl_gpio_range *range, unsigned int offset,
@@ -1024,7 +1039,6 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, {struct byt_gpio *vg =pinctrl_dev_get_drvdata (pctl_dev);void __iomem *val_reg =byt_gpio_reg (vg, offset,BYT_VAL_REG ); -void __iomem *conf_reg =byt_gpio_reg (vg, offset,BYT_CONF0_REG );unsigned long flags;u32 value;
@@ -1034,14 +1048,8 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, value &= ~BYT_DIR_MASK ;if (input) value |=BYT_OUTPUT_EN ; -else if (readl (conf_reg) &BYT_DIRECT_IRQ_EN ) -/* -* Before making any direction modifications, do a check if gpio -* is set for direct IRQ. On baytrail, setting GPIO to output -* does not make sense, so let's at least inform the caller before -* they shoot themselves in the foot. -*/ -dev_info_once (vg->dev,"Potential Error: Setting GPIO with direct_irq_en to output" ); +else +byt_gpio_direct_irq_check (vg, offset);writel (value, val_reg);
@@ -1382,19 +1390,50 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)static int byt_gpio_direction_input (struct gpio_chip *chip,unsigned int offset) { -return pinctrl_gpio_direction_input (chip->base + offset); +struct byt_gpio *vg =gpiochip_get_data (chip); +void __iomem *val_reg =byt_gpio_reg (vg, offset,BYT_VAL_REG ); +unsigned long flags; +u32 reg; + +raw_spin_lock_irqsave (&byt_lock, flags); + + reg =readl (val_reg); + reg &= ~BYT_DIR_MASK ; + reg |=BYT_OUTPUT_EN ; +writel (reg, val_reg); + +raw_spin_unlock_irqrestore (&byt_lock, flags); +return 0 ; } +/* +* Note despite the temptation this MUST NOT be converted into a call to +* pinctrl_gpio_direction_output() + byt_gpio_set() that does not work this +* MUST be done as a single BYT_VAL_REG register write. +* See the commit message of the commit adding this comment for details. +*/ static int byt_gpio_direction_output (struct gpio_chip *chip,unsigned int offset,int value) { -int ret =pinctrl_gpio_direction_output (chip->base + offset); +struct byt_gpio *vg =gpiochip_get_data (chip); +void __iomem *val_reg =byt_gpio_reg (vg, offset,BYT_VAL_REG ); +unsigned long flags; +u32 reg; -if (ret) -return ret; +raw_spin_lock_irqsave (&byt_lock, flags); -byt_gpio_set (chip, offset, value); +byt_gpio_direct_irq_check (vg, offset); + reg =readl (val_reg); + reg &= ~BYT_DIR_MASK ; +if (value) + reg |=BYT_LEVEL ; +else + reg &= ~BYT_LEVEL ; + +writel (reg, val_reg); + +raw_spin_unlock_irqrestore (&byt_lock, flags);return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 3/31 vlan: consolidate VLAN parsing code and limit max parsing depth
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 469aceddfa3ed16e17ee30533fae45e90f62efd8 ]
Toshiaki pointed out that we now have two very similar functions to extract the L3 protocol number in the presence of VLAN tags. And Daniel pointed out that the unbounded parsing loop makes it possible for maliciously crafted packets to loop through potentially hundreds of tags.
Fix both of these issues by consolidating the two parsing functions and limiting the VLAN tag parsing to a max depth of 8 tags. As part of this, switch over __vlan_get_protocol() to use skb_header_pointer() instead of pskb_may_pull(), to avoid the possible side effects of the latter and keep the skb pointer 'const' through all the parsing functions.
v2:
- Use limit of 8 tags instead of 32 (matching XMIT_RECURSION_LIMIT)
--- include/linux/if_vlan.h | 29 ++++++++++++++++++++++------- include/net/inet_ecn.h | 1 + 2 files changed, 23 insertions(+), 7 deletions(-)
include/linux/if_vlan.h +22 -7
@@ -30,6 +30,8 @@#define VLAN_ETH_DATA_LEN 1500/* Max. octets in payload */ #define VLAN_ETH_FRAME_LEN 1518/* Max. octets in frame sans FCS */ +#define VLAN_MAX_DEPTH 8/* Max. number of nested VLAN tags parsed */ +/* * struct vlan_hdr - vlan header * @h_vlan_TCI: priority and VLAN ID
@@ -534,10 +536,10 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)* Returns the EtherType of the packet, regardless of whether it is * vlan encapsulated (normal or hardware accelerated) or not. */ -static inline __be16 __vlan_get_protocol (struct sk_buff *skb,__be16 type, +static inline __be16 __vlan_get_protocol (const struct sk_buff *skb,__be16 type,int *depth) { -unsigned int vlan_depth = skb->mac_len; +unsigned int vlan_depth = skb->mac_len, parse_depth =VLAN_MAX_DEPTH ;/* if type is 802.1Q/AD then the header should already be * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
@@ -552,13 +554,12 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type, vlan_depth =ETH_HLEN ; }do { -struct vlan_hdr *vh; +struct vlan_hdr vhdr, *vh; -if (unlikely (!pskb_may_pull (skb, - vlan_depth +VLAN_HLEN ))) + vh =skb_header_pointer (skb, vlan_depth,sizeof (vhdr), &vhdr); +if (unlikely (!vh || !--parse_depth))return 0 ; - vh = (struct vlan_hdr *)(skb->data + vlan_depth); type = vh->h_vlan_encapsulated_proto; vlan_depth +=VLAN_HLEN ; }while (eth_type_vlan (type));
@@ -577,11 +578,25 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,* Returns the EtherType of the packet, regardless of whether it is * vlan encapsulated (normal or hardware accelerated) or not. */ -static inline __be16 vlan_get_protocol (struct sk_buff *skb) +static inline __be16 vlan_get_protocol (const struct sk_buff *skb) {return __vlan_get_protocol (skb, skb->protocol,NULL ); } +/* A getter for the SKB protocol field which will handle VLAN tags consistently +* whether VLAN acceleration is enabled or not. +*/ +static inline __be16 skb_protocol (const struct sk_buff *skb,bool skip_vlan) +{ +if (!skip_vlan) +/* VLAN acceleration strips the VLAN header from the skb and +* moves it to skb->vlan_proto +*/ +return skb_vlan_tag_present (skb) ? skb->vlan_proto : skb->protocol; + +return vlan_get_protocol (skb); +} +static inline void vlan_set_encap_proto (struct sk_buff *skb,struct vlan_hdr *vhdr) {
include/net/inet_ecn.h +1 -0
@@ -4,6 +4,7 @@#include <linux/ip.h> #include <linux/skbuff.h> +#include <linux/if_vlan.h> #include <net/inet_sock.h> #include <net/dsfield.h>
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 4/31 geneve: pull IP header before ECN decapsulation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
IP_ECN_decapsulate() and IP6_ECN_decapsulate() assume IP header is already pulled.
geneve does not ensure this yet.
Fixing this generically in IP_ECN_decapsulate() and IP6_ECN_decapsulate() is not possible, since callers pass a pointer that might be freed by pskb_may_pull()
syzbot reported :
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:238 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate+0x345/0x1db0 include/net/inet_ecn.h:260 CPU: 1 PID: 8941 Comm: syz-executor.0 Not tainted 5.10.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197 __INET_ECN_decapsulate include/net/inet_ecn.h:238 [inline] INET_ECN_decapsulate+0x345/0x1db0 include/net/inet_ecn.h:260 geneve_rx+0x2103/0x2980 include/net/inet_ecn.h:306 geneve_udp_encap_recv+0x105c/0x1340 drivers/net/geneve.c:377 udp_queue_rcv_one_skb+0x193a/0x1af0 net/ipv4/udp.c:2093 udp_queue_rcv_skb+0x282/0x1050 net/ipv4/udp.c:2167 udp_unicast_rcv_skb net/ipv4/udp.c:2325 [inline] __udp4_lib_rcv+0x399d/0x5880 net/ipv4/udp.c:2394 udp_rcv+0x5c/0x70 net/ipv4/udp.c:2564 ip_protocol_deliver_rcu+0x572/0xc50 net/ipv4/ip_input.c:204 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x583/0x8d0 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:449 [inline] ip_rcv_finish net/ipv4/ip_input.c:428 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0x5c3/0x840 net/ipv4/ip_input.c:539 __netif_receive_skb_one_core net/core/dev.c:5315 [inline] __netif_receive_skb+0x1ec/0x640 net/core/dev.c:5429 process_backlog+0x523/0xc10 net/core/dev.c:6319 napi_poll+0x420/0x1010 net/core/dev.c:6763 net_rx_action+0x35c/0xd40 net/core/dev.c:6833 __do_softirq+0x1a9/0x6fa kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x6e/0x90 arch/x86/kernel/irq_64.c:77 do_softirq kernel/softirq.c:343 [inline] __local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:195 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:730 [inline] __dev_queue_xmit+0x3a9b/0x4520 net/core/dev.c:4167 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4173 packet_snd net/packet/af_packet.c:2992 [inline] packet_sendmsg+0x86f9/0x99d0 net/packet/af_packet.c:3017 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg net/socket.c:671 [inline] __sys_sendto+0x9dc/0xc80 net/socket.c:1992 __do_sys_sendto net/socket.c:2004 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:2000 __x64_sys_sendto+0x6e/0x90 net/socket.c:2000 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/net/geneve.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/net/geneve.c +16 -4
@@ -254,11 +254,21 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,skb_dst_set (skb, &tun_dst->dst);/* Ignore packet loops (and multicast echo) */ -if (ether_addr_equal (eth_hdr (skb)->h_source, geneve->dev->dev_addr)) { - geneve->dev->stats.rx_errors++; - goto drop; +if (ether_addr_equal (eth_hdr (skb)->h_source, geneve->dev->dev_addr)) + goto rx_error; + +switch (skb_protocol (skb, true)) { +case htons (ETH_P_IP ): +if (pskb_may_pull (skb,sizeof (struct iphdr ))) + goto rx_error; +break ; +case htons (ETH_P_IPV6 ): +if (pskb_may_pull (skb,sizeof (struct ipv6hdr ))) + goto rx_error; +break ; +default : + goto rx_error; } - oiph =skb_network_header (skb);skb_reset_network_header (skb);
@@ -299,6 +309,8 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,u64_stats_update_end (&stats->syncp); }return ; +rx_error: + geneve->dev->stats.rx_errors++; drop:/* Consume bad packet */ kfree_skb (skb);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 5/31 usb: gadget: f_fs: Use local copy of descriptors for userspace copy
In reply to Greg Kroah-HartmanFrom: Vamsi Krishna Samavedam <[email protected]>
commit a4b98a7512f18534ce33a7e98e49115af59ffa00 upstream.
The function may be unbound causing the ffs_ep and its descriptors to be freed while userspace is in the middle of an ioctl requesting the same descriptors. Avoid dangling pointer reference by first making a local copy of desctiptors before releasing the spinlock.
--- drivers/usb/gadget/function/f_fs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_fs.c +4 -2
@@ -1244,7 +1244,7 @@ static long ffs_epfile_ioctl(struct filecase FUNCTIONFS_ENDPOINT_DESC : {int desc_idx; -struct usb_endpoint_descriptor *desc; +struct usb_endpoint_descriptor desc1, *desc;switch (epfile->ffs->gadget->speed) {case USB_SPEED_SUPER :
@@ -1256,10 +1256,12 @@ static long ffs_epfile_ioctl(struct filedefault : desc_idx =0 ; } + desc = epfile->ep->descs[desc_idx]; +memcpy (&desc1, desc, desc->bLength);spin_unlock_irq (&epfile->ffs->eps_lock); - ret =copy_to_user ((void *)value, desc, desc->bLength); + ret =copy_to_user ((void *)value, &desc1, desc1.bLength);if (ret) ret = -EFAULT ;return ret;
Greg Kroah-Hartman
maintainerPATCH 6/31 USB: serial: kl5kusb105: fix memleak on open
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 3f203f057edfcf6bd02c6b942799262bfcf31f73 upstream.
Fix memory leak of control-message transfer buffer on successful open().
--- drivers/usb/serial/kl5kusb105.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/usb/serial/kl5kusb105.c +4 -6
@@ -281,12 +281,12 @@ static int klsi_105_open(struct tty_str priv->cfg.unknown2 = cfg->unknown2;spin_unlock_irqrestore (&priv->lock, flags); +kfree (cfg); +/* READ_ON and urb submission */ rc =usb_serial_generic_open (tty, port); -if (rc) { - retval = rc; - goto err_free_cfg; - } +if (rc) +return rc; rc = usb_control_msg(port->serial->dev, usb_sndctrlpipe(port->serial->dev, 0),
@@ -329,8 +329,6 @@ err_disable_read: KLSI_TIMEOUT); err_generic_close:usb_serial_generic_close (port); -err_free_cfg: -kfree (cfg);return retval; }
Greg Kroah-Hartman
maintainerPATCH 7/31 USB: serial: ch341: add new Product ID for CH341A
In reply to Greg Kroah-HartmanFrom: Jan-Niklas Burfeind <[email protected]>
commit 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63 upstream.
Add PID for CH340 that's found on a ch341 based Programmer made by keeyees. The specific device that contains the serial converter is described
here: http://www.keeyees.com/a/Products/ej/36.html
The driver works flawlessly as soon as the new PID (0x5512) is added to it.
--- drivers/usb/serial/ch341.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/ch341.c +1 -0
@@ -86,6 +86,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x4348, 0x5523) }, { USB_DEVICE(0x1a86, 0x7522) }, { USB_DEVICE(0x1a86, 0x7523) }, + { USB_DEVICE(0x1a86, 0x5512) }, { USB_DEVICE(0x1a86, 0x5523) }, { }, };
Greg Kroah-Hartman
maintainerPATCH 8/31 USB: serial: ch341: sort device-id entries
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit bf193bfc12dbc3754fc8a6e0e1e3702f1af2f772 upstream.
Keep the device-id entries sorted to make it easier to add new ones in the right spot.
--- drivers/usb/serial/ch341.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/serial/ch341.c +3 -3
@@ -83,11 +83,11 @@#define CH341_LCR_CS5 0x00static const struct usb_device_id id_table[] = { - {USB_DEVICE (0x4348 ,0x5523 ) }, - {USB_DEVICE (0x1a86 ,0x7522 ) }, - {USB_DEVICE (0x1a86 ,0x7523 ) }, {USB_DEVICE (0x1a86 ,0x5512 ) }, {USB_DEVICE (0x1a86 ,0x5523 ) }, + {USB_DEVICE (0x1a86 ,0x7522 ) }, + {USB_DEVICE (0x1a86 ,0x7523 ) }, + {USB_DEVICE (0x4348 ,0x5523 ) }, { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 9/31 USB: serial: option: add Fibocom NL668 variants
In reply to Greg Kroah-HartmanFrom: Vincent Palatin <[email protected]>
commit 5e4d659b10fde14403adb2e215df4a3168fe8465 upstream.
Update the USB serial option driver support for the Fibocom NL668 Cat.4 LTE modules as there are actually several different variants. Got clarifications from Fibocom, there are distinct products:
- VID:PID 1508:1001, NL668 for IOT (no MBIM interface)
- VID:PID 2cb7:01a0, NL668-AM and NL652-EU are laptop M.2 cards (with MBIM interfaces for Windows/Linux/Chrome OS), respectively for Americas and Europe.
usb-devices output for the laptop M.2 cards:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=01a0 Rev=03.18 S: Manufacturer=Fibocom Wireless Inc. S: Product=Fibocom NL652-EU Modem S: SerialNumber=0123456789ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
--- drivers/usb/serial/option.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/serial/option.c +2 -1
@@ -2048,12 +2048,13 @@ static const struct usb_device_id option .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, - { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ .driver_info = RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
Greg Kroah-Hartman
maintainerPATCH 10/31 USB: serial: option: add support for Thales Cinterion EXS82
In reply to Greg Kroah-HartmanFrom: Giacinto Cifelli <[email protected]>
commit 6d6556c04ebaeaf4e7fa8b791c97e2a7c41b38a3 upstream.
There is a single option port in this modem, and it is used as debug port.
lsusb -v for this device:
Bus 001 Device 002: ID 1e2d:006c
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 239 Miscellaneous Device
bDeviceSubClass 2 ?
bDeviceProtocol 1 Interface Association
bMaxPacketSize0 64
idVendor 0x1e2d
idProduct 0x006c
bcdDevice 0.00
iManufacturer 4 iProduct 3 iSerial 5 bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 243
bNumInterfaces 7
bConfigurationValue 1
iConfiguration 2
bmAttributes 0xe0
Self Powered
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Association:
bLength 8
bDescriptorType 11
bFirstInterface 1
bInterfaceCount 2
bFunctionClass 2 Communications
bFunctionSubClass 2 Abstract (modem)
bFunctionProtocol 1 AT-commands (v.25ter)
iFunction 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 1 AT-commands (v.25ter)
iInterface 0
CDC Header:
bcdCDC 1.10
CDC ACM:
bmCapabilities 0x02
line coding and serial state
CDC Call Management:
bmCapabilities 0x03
call management
use DataInterface
bDataInterface 2
CDC Union:
bMasterInterface 1
bSlaveInterface 2
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Association:
bLength 8
bDescriptorType 11
bFirstInterface 3
bInterfaceCount 2
bFunctionClass 2 Communications
bFunctionSubClass 2 Abstract (modem)
bFunctionProtocol 1 AT-commands (v.25ter)
iFunction 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 1 AT-commands (v.25ter)
iInterface 0
CDC Header:
bcdCDC 1.10
CDC ACM:
bmCapabilities 0x02
line coding and serial state
CDC Call Management:
bmCapabilities 0x03
call management
use DataInterface
bDataInterface 4
CDC Union:
bMasterInterface 3
bSlaveInterface 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 4
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Association:
bLength 8
bDescriptorType 11
bFirstInterface 5
bInterfaceCount 2
bFunctionClass 2 Communications
bFunctionSubClass 2 Abstract (modem)
bFunctionProtocol 1 AT-commands (v.25ter)
iFunction 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 5
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 6 Ethernet Networking
bInterfaceProtocol 0
iInterface 0
CDC Header:
bcdCDC 1.10
CDC Ethernet:
iMacAddress 1 (??)
bmEthernetStatistics 0x00000000
wMaxSegmentSize 16384
wNumberMCFilters 0x0001
bNumberPowerFilters 0
CDC Union:
bMasterInterface 5
bSlaveInterface 6
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 6
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 6
bAlternateSetting 1
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -422,6 +422,7 @@ static void option_instat_callback(struc#define CINTERION_PRODUCT_PH8 0x0053#define CINTERION_PRODUCT_AHXX 0x0055#define CINTERION_PRODUCT_PLXX 0x0060 +#define CINTERION_PRODUCT_EXS82 0x006c#define CINTERION_PRODUCT_PH8_2RMNET 0x0082#define CINTERION_PRODUCT_PH8_AUDIO 0x0083#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
@@ -1905,6 +1906,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff), .driver_info = RSVD(0) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EXS82, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
Greg Kroah-Hartman
maintainerPATCH 11/31 USB: serial: option: fix Quectel BG96 matching
In reply to Greg Kroah-HartmanFrom: Bjørn Mork <[email protected]>
commit c98fff7332dbd6e028969f8c2bda3d7bc7a024d8 upstream.
This is a partial revert of commit 2bb70f0a4b23 ("USB: serial:
option: support dynamic Quectel USB compositions")
The Quectel BG96 is different from most other modern Quectel modems, having serial functions with 3 endpoints using ff/ff/ff and ff/fe/ff class/subclass/protocol. Including it in the change to accommodate dynamic function mapping was incorrect.
Revert to interface number matching for the BG96, assuming static layout of the RMNET function on interface 4. This restores support for the serial functions on interfaces 2 and 3.
Full lsusb output for the BG96:
Bus 002 Device 003: ID 2c7c:0296
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x2c7c
idProduct 0x0296
bcdDevice 0.00
iManufacturer 3 Qualcomm, Incorporated
iProduct 2 Qualcomm CDMA Technologies MSM
iSerial 4 d1098243
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 145
bNumInterfaces 5
bConfigurationValue 1
iConfiguration 1 Qualcomm Configuration
bmAttributes 0xe0
Self Powered
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 254
bInterfaceProtocol 255
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 4
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x88 EP 8 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x05 EP 5 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
--- drivers/usb/serial/option.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/serial/option.c +2 -3
@@ -1109,9 +1109,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff), .driver_info = NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0xff, 0xff), - .driver_info = NUMEP2 }, - { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0, 0) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
Greg Kroah-Hartman
maintainerPATCH 12/31 tty: Fix ->pgrp locking in tiocspgrp()
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.
tiocspgrp() takes two tty_struct pointers: One to the tty that userspace passed to ioctl() (tty) and one to the TTY being changed (real_tty). These pointers are different when ioctl() is called with a master fd.
To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.
This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on both sides of a PTY pair to corrupt the refcount of struct pid, leading to use-after-free errors.
--- drivers/tty/tty_jobctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/tty_jobctrl.c +2 -2
@@ -493,10 +493,10 @@ static int tiocspgrp(struct tty_struct *if (session_of_pgrp (pgrp) !=task_session (current)) goto out_unlock; retval =0 ; -spin_lock_irq (&tty->ctrl_lock); +spin_lock_irq (&real_tty->ctrl_lock);put_pid (real_tty->pgrp); real_tty->pgrp =get_pid (pgrp); -spin_unlock_irq (&tty->ctrl_lock); +spin_unlock_irq (&real_tty->ctrl_lock); out_unlock:rcu_read_unlock ();return retval;
Greg Kroah-Hartman
maintainerPATCH 13/31 tty: Fix ->session locking
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9 upstream.
Currently, locking of ->session is very inconsistent; most places protect it using the legacy tty mutex, but disassociate_ctty(), __do_SAK(), tiocspgrp() and tiocgsid() don't.
Two of the writers hold the ctrl_lock (because they already need it for ->pgrp), but __proc_set_tty() doesn't do that yet.
On a PREEMPT=y system, an unprivileged user can theoretically abuse this broken locking to read 4 bytes of freed memory via TIOCGSID if tiocgsid() is preempted long enough at the right point. (Other things might also go wrong, especially if root-only ioctls are involved; I'm not sure about that.)
Change the locking on ->session such that:
- tty_lock() is held by all writers: By making disassociate_ctty() hold it. This should be fine because the same lock can already be taken through the call to tty_vhangup_session().
The tricky part is that we need to shorten the area covered by siglock to be able to take tty_lock() without ugly retry logic; as far as I can tell, this should be fine, since nothing in the signal_struct is touched in the if (tty) branch.
- ctrl_lock is held by all writers: By changing __proc_set_tty() to hold the lock a little longer.
- All readers that aren't holding tty_lock() hold ctrl_lock: By adding locking to tiocgsid() and __do_SAK(), and expanding the area covered by ctrl_lock in tiocspgrp().
--- drivers/tty/tty_io.c | 7 ++++++- drivers/tty/tty_jobctrl.c | 44 +++++++++++++++++++++++++++++++------------- include/linux/tty.h | 4 ++++ 3 files changed, 41 insertions(+), 14 deletions(-)
drivers/tty/tty_io.c +6 -1
@@ -2739,10 +2739,14 @@ void __do_SAK(struct tty_struct *tty)struct task_struct *g, *p;struct pid *session;int i; +unsigned long flags;if (!tty)return ; - session = tty->session; + +spin_lock_irqsave (&tty->ctrl_lock, flags); + session =get_pid (tty->session); +spin_unlock_irqrestore (&tty->ctrl_lock, flags);tty_ldisc_flush (tty);
@@ -2774,6 +2778,7 @@ void __do_SAK(struct tty_struct *tty) task_unlock(p); }while_each_thread (g, p);read_unlock (&tasklist_lock); +put_pid (session);#endif }
drivers/tty/tty_jobctrl.c +31 -13
105 lines not on this page · raw message
include/linux/tty.h +4 -0
@@ -305,6 +305,10 @@ struct tty_struct {struct termiox *termiox;/* May be NULL for unsupported */ char name[64 ];struct pid *pgrp;/* Protected by ctrl lock */ +/* +* Writes protected by both ctrl lock and legacy mutex, readers must use +* at least one of them. +*/ struct pid *session;unsigned long flags;int count;
Greg Kroah-Hartman
maintainerPATCH 14/31 ALSA: hda/realtek - Add new codec supported for ALC897
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit e5782a5d5054bf1e03cb7fbd87035037c2a22698 upstream.
Enable new codec supported for ALC897.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -392,6 +392,7 @@ static void alc_fill_eapd_coef(struct hdalc_update_coef_idx (codec,0x7 ,1 <<5 ,0 );break ;case 0x10ec0892 : +case 0x10ec0897 :alc_update_coef_idx (codec,0x7 ,1 <<5 ,0 );break ;case 0x10ec0899 :
@@ -8443,6 +8444,7 @@ static const struct hda_device_id snd_hdHDA_CODEC_ENTRY (0x10ec0888 ,"ALC888" , patch_alc882),HDA_CODEC_ENTRY (0x10ec0889 ,"ALC889" , patch_alc882),HDA_CODEC_ENTRY (0x10ec0892 ,"ALC892" , patch_alc662), +HDA_CODEC_ENTRY (0x10ec0897 ,"ALC897" , patch_alc662),HDA_CODEC_ENTRY (0x10ec0899 ,"ALC898" , patch_alc882),HDA_CODEC_ENTRY (0x10ec0900 ,"ALC1150" , patch_alc882), HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882),
Greg Kroah-Hartman
maintainerPATCH 15/31 ALSA: hda/generic: Add option to enforce preferred_dacs pairs
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 242d990c158d5b1dabd166516e21992baef5f26a upstream.
The generic parser accepts the preferred_dacs[] pairs as a hint for assigning a DAC to each pin, but this hint doesn't work always effectively. Currently it's merely a secondary choice after the trial with the path index failed. This made sometimes it difficult to assign DACs without mimicking the connection list and/or the badness table.
This patch adds a new flag, obey_preferred_dacs, that changes the behavior of the parser. As its name stands, the parser obeys the given preferred_dacs[] pairs by skipping the path index matching and giving a high penalty if no DAC is assigned by the pairs. This mode will help for assigning the fixed DACs forcibly from the codec driver.
--- sound/pci/hda/hda_generic.c | 12 ++++++++---- sound/pci/hda/hda_generic.h | 1 + 2 files changed, 9 insertions(+), 4 deletions(-)
sound/pci/hda/hda_generic.c +8 -4
@@ -1374,16 +1374,20 @@ static int try_assign_dacs(struct hda_costruct nid_path *path;hda_nid_t pin = pins[i]; - path =snd_hda_get_path_from_idx (codec, path_idx[i]); -if (path) { - badness +=assign_out_path_ctls (codec, path); -continue ; +if (!spec->obey_preferred_dacs) { + path =snd_hda_get_path_from_idx (codec, path_idx[i]); +if (path) { + badness +=assign_out_path_ctls (codec, path); +continue ; + } } dacs[i] =get_preferred_dac (codec, pin);if (dacs[i]) {if (is_dac_already_used (codec, dacs[i])) badness += bad->shared_primary; + }else if (spec->obey_preferred_dacs) { + badness +=BAD_NO_PRIMARY_DAC ; }if (!dacs[i])
sound/pci/hda/hda_generic.h +1 -0
@@ -230,6 +230,7 @@ struct hda_gen_spec { unsigned int power_down_unused:1; /* power down unused widgets */ unsigned int dac_min_mute:1; /* minimal = mute for DACs */ unsigned int suppress_vmaster:1; /* don't create vmaster kctls */ + unsigned int obey_preferred_dacs:1; /* obey preferred_dacs assignment *//* other internal flags */ unsigned int no_analog:1; /* digital I/O only */
Greg Kroah-Hartman
maintainerPATCH 16/31 ftrace: Fix updating FTRACE_FL_TRAMP
In reply to Greg Kroah-HartmanFrom: Naveen N. Rao <[email protected]>
commit 4c75b0ff4e4bf7a45b5aef9639799719c28d0073 upstream.
On powerpc, kprobe-direct.tc triggered FTRACE_WARN_ON() in ftrace_get_addr_new() followed by the below message:
Bad trampoline accounting at: 000000004222522f (wake_up_process+0xc/0x20) (f0000001)
The set of steps leading to this involved:
- modprobe ftrace-direct-too
- enable_probe
- modprobe ftrace-direct
- rmmod ftrace-direct <-- trigger
The problem turned out to be that we were not updating flags in the ftrace record properly. From the above message about the trampoline accounting being bad, it can be seen that the ftrace record still has FTRACE_FL_TRAMP set though ftrace-direct module is going away. This happens because we are checking if any ftrace_ops has the FTRACE_FL_TRAMP flag set _before_ updating the filter hash.
The fix for this is to look for any _other_ ftrace_ops that also needs FTRACE_FL_TRAMP.
--- kernel/trace/ftrace.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
kernel/trace/ftrace.c +21 -1
@@ -1715,6 +1715,8 @@ static bool test_rec_ops_needs_regs(strustatic struct ftrace_ops *ftrace_find_tramp_ops_any (struct dyn_ftrace *rec);static struct ftrace_ops * +ftrace_find_tramp_ops_any_other (struct dyn_ftrace *rec,struct ftrace_ops *op_exclude); +static struct ftrace_ops *ftrace_find_tramp_ops_next (struct dyn_ftrace *rec,struct ftrace_ops *ops); static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
@@ -1852,7 +1854,7 @@ static bool __ftrace_hash_rec_update(str* to it. */ if (ftrace_rec_count (rec) ==1 && -ftrace_find_tramp_ops_any (rec)) +ftrace_find_tramp_ops_any_other (rec, ops)) rec->flags |=FTRACE_FL_TRAMP ;else rec->flags &= ~FTRACE_FL_TRAMP ;
@@ -2274,6 +2276,24 @@ ftrace_find_tramp_ops_any(struct dyn_ftrcontinue ;if (hash_contains_ip (ip, op->func_hash)) +return op; + }while_for_each_ftrace_op (op); + +return NULL ; +} + +static struct ftrace_ops * +ftrace_find_tramp_ops_any_other (struct dyn_ftrace *rec,struct ftrace_ops *op_exclude) +{ +struct ftrace_ops *op; +unsigned long ip = rec->ip; + +do_for_each_ftrace_op (op, ftrace_ops_list) { + +if (op == op_exclude || !op->trampoline) +continue ; + +if (hash_contains_ip (ip, op->func_hash))return op; }while_for_each_ftrace_op (op);
Greg Kroah-Hartman
maintainerPATCH 17/31 cifs: fix potential use-after-free in cifs_echo_request()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 212253367dc7b49ed3fc194ce71b0992eacaecf2 upstream.
This patch fixes a potential use-after-free bug in cifs_echo_request().
For instance,
thread 1
--------
cifs_demultiplex_thread()
clean_demultiplex_info()
kfree(server)
thread 2 (workqueue)
--------
apic_timer_interrupt()
smp_apic_timer_interrupt()
irq_exit()
__do_softirq()
run_timer_softirq()
call_timer_fn()
cifs_echo_request() <- use-after-free in server ptr--- fs/cifs/connect.c | 2 ++ 1 file changed, 2 insertions(+)
fs/cifs/connect.c +2 -0
@@ -756,6 +756,8 @@ static void clean_demultiplex_info(struclist_del_init (&server->tcp_ses_list);spin_unlock (&cifs_tcp_ses_lock); +cancel_delayed_work_sync (&server->echo); +spin_lock (&GlobalMid_Lock); server->tcpStatus = CifsExiting;spin_unlock (&GlobalMid_Lock);
Greg Kroah-Hartman
maintainerPATCH 18/31 mm/swapfile: do not sleep with a spin lock held
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
commit b11a76b37a5aa7b07c3e3eeeaae20b25475bddd3 upstream.
We can't call kvfree() with a spin lock held, so defer it. Fixes a might_sleep() runtime warning.
--- mm/swapfile.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/swapfile.c +3 -1
@@ -2828,6 +2828,7 @@ late_initcall(max_swapfiles_check);static struct swap_info_struct *alloc_swap_info (void ) {struct swap_info_struct *p; +struct swap_info_struct *defer =NULL ;unsigned int type;int i;int size =sizeof (*p) + nr_node_ids *sizeof (struct plist_node );
@@ -2857,7 +2858,7 @@ static struct swap_info_struct *alloc_swsmp_wmb (); nr_swapfiles++; }else { -kvfree (p); + defer = p; p = swap_info[type];/* * Do not memset this entry: a racing procfs swap_next()
@@ -2870,6 +2871,7 @@ static struct swap_info_struct *alloc_swplist_node_init (&p->avail_lists[i],0 ); p->flags =SWP_USED ;spin_unlock (&swap_lock); +kvfree (defer);spin_lock_init (&p->lock);spin_lock_init (&p->cont_lock);
Greg Kroah-Hartman
maintainerPATCH 19/31 i2c: imx: Fix reset of I2SR_IAL flag
In reply to Greg Kroah-HartmanFrom: Christian Eggers <[email protected]>
commit 384a9565f70a876c2e78e58c5ca0bbf0547e4f6d upstream.
According to the "VFxxx Controller Reference Manual" (and the comment block starting at line 97), Vybrid requires writing a one for clearing an interrupt flag. Syncing the method for clearing I2SR_IIF in i2c_imx_isr().
--- drivers/i2c/busses/i2c-imx.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/i2c/busses/i2c-imx.c +15 -5
@@ -413,6 +413,19 @@ static void i2c_imx_dma_free(struct imx_ dma->chan_using =NULL ; } +static void i2c_imx_clear_irq (struct imx_i2c_struct *i2c_imx,unsigned int bits) +{ +unsigned int temp; + +/* +* i2sr_clr_opcode is the value to clear all interrupts. Here we want to +* clear only <bits>, so we write ~i2sr_clr_opcode with just <bits> +* toggled. This is required because i.MX needs W0C and Vybrid uses W1C. +*/ + temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits; +imx_i2c_write_reg (temp, i2c_imx,IMX_I2C_I2SR ); +} +static int i2c_imx_bus_busy (struct imx_i2c_struct *i2c_imx,int for_busy) {unsigned long orig_jiffies = jiffies;
@@ -425,8 +438,7 @@ static int i2c_imx_bus_busy(struct imx_i/* check for arbitration lost */ if (temp &I2SR_IAL ) { - temp &= ~I2SR_IAL ; -imx_i2c_write_reg (temp, i2c_imx,IMX_I2C_I2SR ); +i2c_imx_clear_irq (i2c_imx,I2SR_IAL );return -EAGAIN ; }
@@ -595,9 +607,7 @@ static irqreturn_t i2c_imx_isr(int irq,if (temp &I2SR_IIF ) {/* save status register */ i2c_imx->i2csr = temp; - temp &= ~I2SR_IIF ; - temp |= (i2c_imx->hwdata->i2sr_clr_opcode &I2SR_IIF ); -imx_i2c_write_reg (temp, i2c_imx,IMX_I2C_I2SR ); +i2c_imx_clear_irq (i2c_imx,I2SR_IIF );wake_up (&i2c_imx->queue);return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 20/31 i2c: imx: Check for I2SR_IAL after every byte
In reply to Greg Kroah-HartmanFrom: Christian Eggers <[email protected]>
commit 1de67a3dee7a279ebe4d892b359fe3696938ec15 upstream.
Arbitration Lost (IAL) can happen after every single byte transfer. If arbitration is lost, the I2C hardware will autonomously switch from master mode to slave. If a transfer is not aborted in this state, consecutive transfers will not be executed by the hardware and will timeout.
Tested (not extensively) on Vybrid VF500 (Toradex VF50):
--- drivers/i2c/busses/i2c-imx.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/i2c/busses/i2c-imx.c +10 -0
@@ -465,6 +465,16 @@ static int i2c_imx_trx_complete(struct idev_dbg (&i2c_imx->adapter.dev,"<%s> Timeout\n" , __func__);return -ETIMEDOUT ; } + +/* check for arbitration lost */ +if (i2c_imx->i2csr &I2SR_IAL ) { +dev_dbg (&i2c_imx->adapter.dev,"<%s> Arbitration lost\n" , __func__); +i2c_imx_clear_irq (i2c_imx,I2SR_IAL ); + + i2c_imx->i2csr =0 ; +return -EAGAIN ; + } +dev_dbg (&i2c_imx->adapter.dev,"<%s> TRX complete\n" , __func__); i2c_imx->i2csr =0 ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 21/31 speakup: Reject setting the speakup line discipline outside of speakup
In reply to Greg Kroah-HartmanFrom: Samuel Thibault <[email protected]>
commit f0992098cadb4c9c6a00703b66cafe604e178fea upstream.
Speakup exposing a line discipline allows userland to try to use it, while it is deemed to be useless, and thus uselessly exposes potential bugs. One of them is simply that in such a case if the line sends data, spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth is NULL.
This change restricts the use of the speakup line discipline to speakup drivers, thus avoiding such kind of issues altogether.
--- drivers/staging/speakup/spk_ttyio.c | 38 +++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-)
drivers/staging/speakup/spk_ttyio.c +23 -15
@@ -46,28 +46,20 @@ static int spk_ttyio_ldisc_open(struct t {struct spk_ldisc_data *ldisc_data; +if (tty != speakup_tty) +/* Somebody tried to use this line discipline outside speakup */ +return -ENODEV ; +if (tty->ops->write ==NULL )return -EOPNOTSUPP ; -mutex_lock (&speakup_tty_mutex); -if (speakup_tty) { -mutex_unlock (&speakup_tty_mutex); -return -EBUSY ; - } - speakup_tty = tty; - ldisc_data =kmalloc (sizeof (struct spk_ldisc_data ),GFP_KERNEL ); -if (!ldisc_data) { - speakup_tty =NULL ; -mutex_unlock (&speakup_tty_mutex); -pr_err ("speakup: Failed to allocate ldisc_data.\n" ); +if (!ldisc_data)return -ENOMEM ; - }sema_init (&ldisc_data->sem,0 ); ldisc_data->buf_free = true; - speakup_tty->disc_data = ldisc_data; -mutex_unlock (&speakup_tty_mutex); + tty->disc_data = ldisc_data;return 0 ; }
@@ -184,9 +176,25 @@ static int spk_ttyio_initialise_ldisc(sttty_unlock (tty); +mutex_lock (&speakup_tty_mutex); + speakup_tty = tty; ret =tty_set_ldisc (tty,N_SPEAKUP );if (ret) -pr_err ("speakup: Failed to set N_SPEAKUP on tty\n" ); + speakup_tty =NULL ; +mutex_unlock (&speakup_tty_mutex); + +if (!ret) +/* Success */ +return 0 ; + +pr_err ("speakup: Failed to set N_SPEAKUP on tty\n" ); + +tty_lock (tty); +if (tty->ops->close) + tty->ops->close (tty,NULL ); +tty_unlock (tty); + +tty_kclose (tty);return ret; }
Greg Kroah-Hartman
maintainerPATCH 22/31 iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
commit 4165bf015ba9454f45beaad621d16c516d5c5afe upstream.
According to the AMD IOMMU spec, the commit 73db2fc595f3 ("iommu/amd: Increase interrupt remapping table limit to 512 entries") also requires the interrupt table length (IntTabLen) to be set to 9 (power of 2) in the device table mapping entry (DTE).
--- drivers/iommu/amd_iommu_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd_iommu_types.h +1 -1
@@ -255,7 +255,7 @@#define DTE_IRQ_REMAP_INTCTL_MASK (0x3ULL << 60)#define DTE_IRQ_TABLE_LEN_MASK (0xfULL << 1)#define DTE_IRQ_REMAP_INTCTL (2ULL << 60) -#define DTE_IRQ_TABLE_LEN (8ULL << 1) +#define DTE_IRQ_TABLE_LEN (9ULL << 1)#define DTE_IRQ_REMAP_ENABLE 1ULL#define PAGE_MODE_NONE 0x00
Greg Kroah-Hartman
maintainerPATCH 23/31 spi: Introduce device-managed SPI controller allocation
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
[ Upstream commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 ]
SPI driver probing currently comprises two steps, whereas removal comprises only one step:
spi_alloc_master()
spi_register_controller()
spi_unregister_controller()
That's because spi_unregister_controller() calls device_unregister() instead of device_del(), thereby releasing the reference on the spi_controller which was obtained by spi_alloc_master().
An SPI driver's private data is contained in the same memory allocation as the spi_controller struct. Thus, once spi_unregister_controller() has been called, the private data is inaccessible. But some drivers need to access it after spi_unregister_controller() to perform further teardown steps.
Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which release a reference on the spi_controller struct only after the driver has unbound, thereby keeping the memory allocation accessible. Change spi_unregister_controller() to not release a reference if the spi_controller was allocated by one of these new devm functions.
The present commit is small enough to be backportable to stable. It allows fixing drivers which use the private data in their ->remove() hook after it's been freed. It also allows fixing drivers which neglect to release a reference on the spi_controller in the probe error path.
Long-term, most SPI drivers shall be moved over to the devm functions introduced herein. The few that can't shall be changed in a treewide commit to explicitly release the last reference on the controller. That commit shall amend spi_unregister_controller() to no longer release a reference, thereby completing the migration.
As a result, the behaviour will be less surprising and more consistent with subsystems such as IIO, which also includes the private data in the allocation of the generic iio_dev struct, but calls device_del() in iio_device_unregister().
--- drivers/spi/spi.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++- include/linux/spi/spi.h | 19 +++++++++++++++ 2 files changed, 76 insertions(+), 1 deletion(-)
drivers/spi/spi.c +57 -1
@@ -2043,6 +2043,49 @@ struct spi_controller *__spi_alloc_contr }EXPORT_SYMBOL_GPL (__spi_alloc_controller); +static void devm_spi_release_controller (struct device *dev,void *ctlr) +{ +spi_controller_put (*(struct spi_controller **)ctlr); +} + +/** +* __devm_spi_alloc_controller - resource-managed __spi_alloc_controller() +* @dev: physical device of SPI controller +* @size: how much zeroed driver-private data to allocate +* @slave: whether to allocate an SPI master (false) or SPI slave (true) +* Context: can sleep +* +* Allocate an SPI controller and automatically release a reference on it +* when @dev is unbound from its driver. Drivers are thus relieved from +* having to call spi_controller_put(). +* +* The arguments to this function are identical to __spi_alloc_controller(). +* +* Return: the SPI controller structure on success, else NULL. +*/ +struct spi_controller *__devm_spi_alloc_controller (struct device *dev, +unsigned int size, +bool slave) +{ +struct spi_controller **ptr, *ctlr; + + ptr =devres_alloc (devm_spi_release_controller,sizeof (*ptr), +GFP_KERNEL ); +if (!ptr) +return NULL ; + + ctlr =__spi_alloc_controller (dev, size, slave); +if (ctlr) { + *ptr = ctlr; +devres_add (dev, ptr); + }else { +devres_free (ptr); + } + +return ctlr; +} +EXPORT_SYMBOL_GPL (__devm_spi_alloc_controller); +#ifdef CONFIG_OF static int of_spi_register_master (struct spi_controller *ctlr) {
@@ -2261,6 +2304,11 @@ int devm_spi_register_controller(struct }EXPORT_SYMBOL_GPL (devm_spi_register_controller); +static int devm_spi_match_controller (struct device *dev,void *res,void *ctlr) +{ +return *(struct spi_controller **)res == ctlr; +} +static int __unregister (struct device *dev,void *null) {spi_unregister_device (to_spi_device (dev));
@@ -2300,7 +2348,15 @@ void spi_unregister_controller(struct splist_del (&ctlr->list);mutex_unlock (&board_lock); -device_unregister (&ctlr->dev); +device_del (&ctlr->dev); + +/* Release the last reference on the controller if its driver +* has not yet been converted to devm_spi_alloc_master/slave(). +*/ +if (!devres_find (ctlr->dev.parent, devm_spi_release_controller, + devm_spi_match_controller, ctlr)) +put_device (&ctlr->dev); +/* free bus id */ mutex_lock (&board_lock);if (found == ctlr)
include/linux/spi/spi.h +19 -0
@@ -638,6 +638,25 @@ static inline struct spi_controller *spireturn __spi_alloc_controller (host, size, true); } +struct spi_controller *__devm_spi_alloc_controller (struct device *dev, +unsigned int size, +bool slave); + +static inline struct spi_controller *devm_spi_alloc_master (struct device *dev, +unsigned int size) +{ +return __devm_spi_alloc_controller (dev, size, false); +} + +static inline struct spi_controller *devm_spi_alloc_slave (struct device *dev, +unsigned int size) +{ +if (!IS_ENABLED (CONFIG_SPI_SLAVE )) +return NULL ; + +return __devm_spi_alloc_controller (dev, size, true); +} +extern int spi_register_controller (struct spi_controller *ctlr);extern int devm_spi_register_controller (struct device *dev,struct spi_controller *ctlr);
Greg Kroah-Hartman
maintainerPATCH 24/31 spi: bcm-qspi: Fix use-after-free on unbind
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 63c5395bb7a9777a33f0e7b5906f2c0170a23692 upstream
bcm_qspi_remove() calls spi_unregister_master() even though bcm_qspi_probe() calls devm_spi_register_master(). The spi_master is therefore unregistered and freed twice on unbind.
Moreover, since commit 0392727c261b ("spi: bcm-qspi: Handle clock probe deferral"), bcm_qspi_probe() leaks the spi_master allocation if the call to devm_clk_get_optional() fails.
Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound and also avoids the spi_master leak on probe.
While at it, fix an ordering issue in bcm_qspi_remove() wherein spi_unregister_master() is called after uninitializing the hardware, disabling the clock and freeing an IRQ data structure. The correct order is to call spi_unregister_master() *before* those teardown steps because bus accesses may still be ongoing until that function returns.
--- drivers/spi/spi-bcm-qspi.c | 34 ++++++++++++---------------------- 1 file changed, 12 insertions(+), 22 deletions(-)
drivers/spi/spi-bcm-qspi.c +12 -22
@@ -1219,7 +1219,7 @@ int bcm_qspi_probe(struct platform_devicif (!of_match_node (bcm_qspi_of_match, dev->of_node))return -ENODEV ; - master =spi_alloc_master (dev,sizeof (struct bcm_qspi )); + master =devm_spi_alloc_master (dev,sizeof (struct bcm_qspi ));if (!master) {dev_err (dev,"error allocating spi_master\n" );return -ENOMEM ;
@@ -1253,21 +1253,17 @@ int bcm_qspi_probe(struct platform_devicif (res) { qspi->base[MSPI ] =devm_ioremap_resource (dev, res); -if (IS_ERR (qspi->base[MSPI ])) { - ret =PTR_ERR (qspi->base[MSPI ]); - goto qspi_resource_err; - } +if (IS_ERR (qspi->base[MSPI ])) +return PTR_ERR (qspi->base[MSPI ]); }else { - goto qspi_resource_err; +return 0 ; } res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"bspi" );if (res) { qspi->base[BSPI ] =devm_ioremap_resource (dev, res); -if (IS_ERR (qspi->base[BSPI ])) { - ret =PTR_ERR (qspi->base[BSPI ]); - goto qspi_resource_err; - } +if (IS_ERR (qspi->base[BSPI ])) +return PTR_ERR (qspi->base[BSPI ]); qspi->bspi_mode = true; }else { qspi->bspi_mode = false;
@@ -1278,18 +1274,14 @@ int bcm_qspi_probe(struct platform_devic res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"cs_reg" );if (res) { qspi->base[CHIP_SELECT ] =devm_ioremap_resource (dev, res); -if (IS_ERR (qspi->base[CHIP_SELECT ])) { - ret =PTR_ERR (qspi->base[CHIP_SELECT ]); - goto qspi_resource_err; - } +if (IS_ERR (qspi->base[CHIP_SELECT ])) +return PTR_ERR (qspi->base[CHIP_SELECT ]); } qspi->dev_ids =kcalloc (num_irqs,sizeof (struct bcm_qspi_dev_id ),GFP_KERNEL ); -if (!qspi->dev_ids) { - ret = -ENOMEM ; - goto qspi_resource_err; - } +if (!qspi->dev_ids) +return -ENOMEM ;for (val =0 ; val < num_irqs; val++) { irq =-1 ;
@@ -1365,7 +1357,7 @@ int bcm_qspi_probe(struct platform_devic qspi->xfer_mode.addrlen =-1 ; qspi->xfer_mode.hp =-1 ; - ret =devm_spi_register_master (&pdev->dev, master); + ret =spi_register_master (master);if (ret <0 ) {dev_err (dev,"can't register master\n" ); goto qspi_reg_err;
@@ -1378,8 +1370,6 @@ qspi_reg_err:clk_disable_unprepare (qspi->clk); qspi_probe_err:kfree (qspi->dev_ids); -qspi_resource_err: -spi_master_put (master);return ret; }/* probe function to be called by SoC specific platform driver probe */
@@ -1389,10 +1379,10 @@ int bcm_qspi_remove(struct platform_devi {struct bcm_qspi *qspi =platform_get_drvdata (pdev); +spi_unregister_master (qspi->master);bcm_qspi_hw_uninit (qspi);clk_disable_unprepare (qspi->clk);kfree (qspi->dev_ids); -spi_unregister_master (qspi->master);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 25/31 spi: bcm2835: Fix use-after-free on unbind
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
[ Upstream commit e1483ac030fb4c57734289742f1c1d38dca61e22 ]
bcm2835_spi_remove() accesses the driver's private data after calling spi_unregister_controller() even though that function releases the last reference on the spi_controller and thereby frees the private data.
Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound.
--- drivers/spi/spi-bcm2835.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
drivers/spi/spi-bcm2835.c +5 -10
@@ -737,7 +737,7 @@ static int bcm2835_spi_probe(struct platstruct resource *res;int err; - master =spi_alloc_master (&pdev->dev,sizeof (*bs)); + master =devm_spi_alloc_master (&pdev->dev,sizeof (*bs));if (!master) {dev_err (&pdev->dev,"spi_alloc_master() failed\n" );return -ENOMEM ;
@@ -759,23 +759,20 @@ static int bcm2835_spi_probe(struct plat res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); bs->regs =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (bs->regs)) { - err =PTR_ERR (bs->regs); - goto out_master_put; - } +if (IS_ERR (bs->regs)) +return PTR_ERR (bs->regs); bs->clk =devm_clk_get (&pdev->dev,NULL );if (IS_ERR (bs->clk)) { err =PTR_ERR (bs->clk);dev_err (&pdev->dev,"could not get clk: %d\n" , err); - goto out_master_put; +return err; } bs->irq =platform_get_irq (pdev,0 );if (bs->irq <=0 ) {dev_err (&pdev->dev,"could not get IRQ: %d\n" , bs->irq); - err = bs->irq ? bs->irq : -ENODEV ; - goto out_master_put; +return bs->irq ? bs->irq : -ENODEV ; }clk_prepare_enable (bs->clk);
@@ -803,8 +800,6 @@ static int bcm2835_spi_probe(struct plat out_clk_disable:clk_disable_unprepare (bs->clk); -out_master_put: -spi_master_put (master);return err; }
Greg Kroah-Hartman
maintainerPATCH 26/31 spi: bcm2835: Release the DMA channel if probe fails after dma_init
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit 666224b43b4bd4612ce3b758c038f9bc5c5e3fcb ]
The DMA channel was not released if either devm_request_irq() or devm_spi_register_controller() failed.
--- drivers/spi/spi-bcm2835.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/spi/spi-bcm2835.c +4 -3
@@ -787,18 +787,19 @@ static int bcm2835_spi_probe(struct plat dev_name(&pdev->dev), master);if (err) {dev_err (&pdev->dev,"could not request IRQ: %d\n" , err); - goto out_clk_disable; + goto out_dma_release; } err =spi_register_master (master);if (err) {dev_err (&pdev->dev,"could not register SPI master: %d\n" , err); - goto out_clk_disable; + goto out_dma_release; }return 0 ; -out_clk_disable: +out_dma_release: +bcm2835_dma_release (master);clk_disable_unprepare (bs->clk);return err; }
Greg Kroah-Hartman
maintainerPATCH 27/31 tracing: Fix userstacktrace option for instances
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit bcee5278958802b40ee8b26679155a6d9231783e upstream.
When the instances were able to use their own options, the userstacktrace option was left hardcoded for the top level. This made the instance userstacktrace option bascially into a nop, and will confuse users that set it, but nothing happens (I was confused when it happened to me!)
--- kernel/trace/trace.c | 7 ++++--- kernel/trace/trace.h | 6 ++++-- 2 files changed, 8 insertions(+), 5 deletions(-)
kernel/trace/trace.c +4 -3
@@ -2404,7 +2404,7 @@ void trace_buffer_unlock_commit_regs(str* two. They are that meaningful. */ ftrace_trace_stack (tr, buffer, flags, regs ?0 :4 , pc, regs); -ftrace_trace_userstack (buffer, flags, pc); +ftrace_trace_userstack (tr, buffer, flags, pc); }/*
@@ -2734,14 +2734,15 @@ void trace_dump_stack(int skip) static DEFINE_PER_CPU(int, user_stack_count);void -ftrace_trace_userstack (struct ring_buffer *buffer,unsigned long flags,int pc) +ftrace_trace_userstack (struct trace_array *tr, +struct ring_buffer *buffer,unsigned long flags,int pc) {struct trace_event_call *call = &event_user_stack;struct ring_buffer_event *event;struct userstack_entry *entry;struct stack_trace trace; -if (!(global_trace.trace_flags &TRACE_ITER_USERSTACKTRACE )) +if (!(tr->trace_flags &TRACE_ITER_USERSTACKTRACE ))return ;/*
kernel/trace/trace.h +4 -2
@@ -739,13 +739,15 @@ void update_max_tr_single(struct trace_a#endif /* CONFIG_TRACER_MAX_TRACE */ #ifdef CONFIG_STACKTRACE -void ftrace_trace_userstack (struct ring_buffer *buffer,unsigned long flags, +void ftrace_trace_userstack (struct trace_array *tr, +struct ring_buffer *buffer,unsigned long flags,int pc);void __trace_stack (struct trace_array *tr,unsigned long flags,int skip,int pc);#else -static inline void ftrace_trace_userstack (struct ring_buffer *buffer, +static inline void ftrace_trace_userstack (struct trace_array *tr, +struct ring_buffer *buffer,unsigned long flags,int pc) { }
Greg Kroah-Hartman
maintainerPATCH 28/31 gfs2: check for empty rgrp tree in gfs2_ri_update
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
commit 778721510e84209f78e31e2ccb296ae36d623f5e upstream.
If gfs2 tries to mount a (corrupt) file system that has no resource groups it still tries to set preferences on the first one, which causes a kernel null pointer dereference. This patch adds a check to function gfs2_ri_update so this condition is detected and reported back as an error.
--- fs/gfs2/rgrp.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/gfs2/rgrp.c +4 -0
@@ -990,6 +990,10 @@ static int gfs2_ri_update(struct gfs2_inif (error <0 )return error; +if (RB_EMPTY_ROOT (&sdp->sd_rindex_tree)) { +fs_err (sdp,"no resource groups found in the file system.\n" ); +return -ENOENT ; + }set_rgrp_preferences (sdp); sdp->sd_rindex_uptodate =1 ;
Greg Kroah-Hartman
maintainerPATCH 29/31 i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit e9acf0298c664f825e6f1158f2a97341bf9e03ca upstream.
Fix to return the error code from qup_i2c_change_state() instaed of 0 in qup_i2c_bam_schedule_desc().
--- drivers/i2c/busses/i2c-qup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-qup.c +2 -1
@@ -846,7 +846,8 @@ static int qup_i2c_bam_do_xfer(struct quif (ret || qup->bus_err || qup->qup_err) {reinit_completion (&qup->xfer); -if (qup_i2c_change_state (qup,QUP_RUN_STATE )) { + ret =qup_i2c_change_state (qup,QUP_RUN_STATE ); +if (ret) {dev_err (qup->dev,"change to run state timed out" ); goto desc_err; }
Greg Kroah-Hartman
maintainerPATCH 30/31 Input: i8042 - fix error return code in i8042_setup_aux()
In reply to Greg Kroah-HartmanFrom: Luo Meng <[email protected]>
commit 855b69857830f8d918d715014f05e59a3f7491a0 upstream.
Fix to return a negative error code from the error handling case instead of 0 in function i8042_setup_aux(), as done elsewhere in this function.
--- drivers/input/serio/i8042.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/input/serio/i8042.c +2 -1
@@ -1458,7 +1458,8 @@ static int __init i8042_setup_aux(void)if (error) goto err_free_ports; -if (aux_enable ()) + error =aux_enable (); +if (error) goto err_free_irq; i8042_aux_irq_registered = true;
Greg Kroah-Hartman
maintainerPATCH 31/31 x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 4e9a5ae8df5b3365183150f6df49e49dece80d8c upstream
Since insn.prefixes.nbytes can be bigger than the size of insn.prefixes.bytes[] when a prefix is repeated, the proper check must be
insn.prefixes.bytes[i] != 0 and i < 4
instead of using insn.prefixes.nbytes.
Introduce a for_each_insn_prefix() macro for this purpose. Debugged by Kees Cook <[email protected]>.
[ bp: Massage commit message, sync with the respective header in tools/
and drop "we". ]
--- arch/x86/include/asm/insn.h | 15 +++++++++++++++ arch/x86/kernel/uprobes.c | 10 ++++++---- tools/objtool/arch/x86/include/asm/insn.h | 15 +++++++++++++++ 3 files changed, 36 insertions(+), 4 deletions(-)
arch/x86/include/asm/insn.h +15 -0
@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(return insn_offset_displacement (insn) + insn->displacement.nbytes; } +/** +* for_each_insn_prefix() -- Iterate prefixes in the instruction +* @insn: Pointer to struct insn. +* @idx: Index storage. +* @prefix: Prefix byte. +* +* Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix +* and the index is stored in @idx (note that this @idx is just for a cursor, +* do not change it.) +* Since prefixes.nbytes can be bigger than 4 if some prefixes +* are repeated, it cannot be used for looping over the prefixes. +*/ +#define for_each_insn_prefix (insn, idx, prefix) \ + for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++) +#define POP_SS_OPCODE 0x1f#define MOV_SREG_OPCODE 0x8e
arch/x86/kernel/uprobes.c +6 -4
@@ -268,10 +268,11 @@ static volatile u32 good_2byte_insns[256static bool is_prefix_bad (struct insn *insn) { +insn_byte_t p;int i; -for (i =0 ; i < insn->prefixes.nbytes; i++) { -switch (insn->prefixes.bytes[i]) { +for_each_insn_prefix (insn, i, p) { +switch (p) {case 0x26 :/* INAT_PFX_ES */ case 0x2E :/* INAT_PFX_CS */ case 0x36 :/* INAT_PFX_DS */
@@ -711,6 +712,7 @@ static const struct uprobe_xol_ops brancstatic int branch_setup_xol_ops (struct arch_uprobe *auprobe,struct insn *insn) {u8 opc1 =OPCODE1 (insn); +insn_byte_t p;int i;switch (opc1) {
@@ -741,8 +743,8 @@ static int branch_setup_xol_ops(struct a* Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 prefix. * No one uses these insns, reject any branch insns with such prefix. */ -for (i =0 ; i < insn->prefixes.nbytes; i++) { -if (insn->prefixes.bytes[i] ==0x66 ) +for_each_insn_prefix (insn, i, p) { +if (p ==0x66 )return -ENOTSUPP ; }
tools/objtool/arch/x86/include/asm/insn.h +15 -0
@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(return insn_offset_displacement (insn) + insn->displacement.nbytes; } +/** +* for_each_insn_prefix() -- Iterate prefixes in the instruction +* @insn: Pointer to struct insn. +* @idx: Index storage. +* @prefix: Prefix byte. +* +* Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix +* and the index is stored in @idx (note that this @idx is just for a cursor, +* do not change it.) +* Since prefixes.nbytes can be bigger than 4 if some prefixes +* are repeated, it cannot be used for looping over the prefixes. +*/ +#define for_each_insn_prefix (insn, idx, prefix) \ + for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++) +#define POP_SS_OPCODE 0x1f#define MOV_SREG_OPCODE 0x8e
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.212 release. There are 31 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 12 Dec 2020 14:25:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.212-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
10 boots: 10 pass, 0 fail
16 tests: 16 pass, 0 failLinux version: 4.14.212-rc1-gad2d75a4fc6e
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.212 release. There are 31 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 12 Dec 2020 14:25:47 +0000. Anything received after that time might be too late.
Build results:
total: 168 pass: 168 fail: 0 Qemu test results: total: 404 pass: 404 fail: 0
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.212 release. There are 31 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 12 Dec 2020 14:25:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.212-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.212-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: ad2d75a4fc6e81e11297320a54abb176b5de8dca
git describe: v4.14.211-31-gad2d75a4fc6e
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.211-31-gad2d75a4fc6e
No regressions (compared to build v4.14.211)
No fixes (compared to build v4.14.211)
Ran 36132 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- mips
- qemu-arm64-kasan
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* linux-log-parser
* install-android-platform-tools-r2600
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* perf
* ltp-commands-tests
* ltp-controllers-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-sched-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* libhugetlbfs
* ltp-fs-tests
* ltp-open-posix-tests
* v4l2-compliance
* rcutorture
* fwts
* kvm-unit-tests
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org