scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
Subsystems (7)
Sasha Levin
maintainerPATCH 1/24 scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit fd48c056a32ed6e7754c7c475490f3bed54ed378 ]
This fixes a compilation warning in pscsi_complete_cmd():
drivers/target/target_core_pscsi.c: In function ‘pscsi_complete_cmd’:
drivers/target/target_core_pscsi.c:624:5: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */
--- drivers/target/target_core_pscsi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/target/target_core_pscsi.c +2 -1
@@ -629,8 +629,9 @@ static void pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg,unsigned char *buf; buf =transport_kmap_data_sg (cmd); -if (!buf) +if (!buf) { ;/* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */ + }if (cdb[0 ] ==MODE_SENSE_10 ) {if (!(buf[3 ] &0x80 ))
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 2/24 media: ite-cir: check for receive overflow
From: Sean Young <[email protected]>
[ Upstream commit 28c7afb07ccfc0a939bb06ac1e7afe669901c65a ]
It's best if this condition is reported.
--- drivers/media/rc/ite-cir.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/rc/ite-cir.c +7 -1
@@ -292,8 +292,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data)/* read the interrupt flags */ iflags = dev->params.get_irq_causes (dev); +/* Check for RX overflow */ +if (iflags &ITE_IRQ_RX_FIFO_OVERRUN ) { +dev_warn (&dev->rdev->dev,"receive overflow\n" ); +ir_raw_event_reset (dev->rdev); + } +/* check for the receive interrupt */ -if (iflags & (ITE_IRQ_RX_FIFO |ITE_IRQ_RX_FIFO_OVERRUN )) { +if (iflags &ITE_IRQ_RX_FIFO ) {/* read the FIFO bytes */ rx_bytes = dev->params.get_rx_bytes(dev, rx_buf,
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 3/24 extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged
In reply to Sasha LevinFrom: Hans de Goede <[email protected]>
[ Upstream commit c309a3e8793f7e01c4a4ec7960658380572cb576 ]
When the jack is partially inserted and then removed again it may be removed while the hpdet code is running. In this case the following may happen:
1. The "JACKDET rise" or ""JACKDET fall" IRQ triggers
2. arizona_jackdet runs and takes info->lock
3. The "HPDET" IRQ triggers
4. arizona_hpdet_irq runs, blocks on info->lock
5. arizona_jackdet calls arizona_stop_mic() and clears info->hpdet_done
6. arizona_jackdet releases info->lock
7. arizona_hpdet_irq now can continue running and:
7.1 Calls arizona_start_mic() (if a mic was detected)
7.2 sets info->hpdet_done
Step 7 is undesirable / a bug:
7.1 causes the device to stay in a high power-state (with MICVDD enabled) 7.2 causes hpdet to not run on the next jack insertion, which in turn
causes the EXTCON_JACK_HEADPHONE state to never get set
This fixes both issues by skipping these 2 steps when arizona_hpdet_irq runs after the jack has been unplugged.
--- drivers/extcon/extcon-arizona.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/extcon/extcon-arizona.c +9 -8
@@ -601,7 +601,7 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data)struct arizona *arizona = info->arizona;int id_gpio = arizona->pdata.hpdet_id_gpio;unsigned int report =EXTCON_JACK_HEADPHONE ; -int ret, reading; +int ret, reading, state;bool mic = false;mutex_lock (&info->lock);
@@ -614,12 +614,11 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) }/* If the cable was removed while measuring ignore the result */ - ret =extcon_get_state (info->edev,EXTCON_MECHANICAL ); -if (ret <0 ) { -dev_err (arizona->dev,"Failed to check cable state: %d\n" , - ret); + state =extcon_get_state (info->edev,EXTCON_MECHANICAL ); +if (state <0 ) { +dev_err (arizona->dev,"Failed to check cable state: %d\n" , state); goto out; - }else if (!ret) { + }else if (!state) {dev_dbg (arizona->dev,"Ignoring HPDET for removed cable\n" ); goto done; }
@@ -672,7 +671,7 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) ARIZONA_ACCDET_MODE_MASK, ARIZONA_ACCDET_MODE_MIC);/* If we have a mic then reenable MICDET */ -if (mic || info->mic) +if (state && (mic || info->mic))arizona_start_mic (info);if (info->hpdet_active) {
@@ -680,7 +679,9 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) info->hpdet_active = false; } - info->hpdet_done = true; +/* Do not set hp_det done when the cable has been unplugged */ +if (state) + info->hpdet_done = true; out:mutex_unlock (&info->lock);
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 4/24 media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
In reply to Sasha LevinFrom: Daniel Niv <[email protected]>
[ Upstream commit c759b2970c561e3b56aa030deb13db104262adfe ]
Add a fix for the memory leak bugs that can occur when the saa7164_encoder_register() function fails.
The function allocates memory without explicitly freeing
it when errors occur.
Add a better error handling that deallocate the unused buffers before the function exits during a fail.
--- drivers/media/pci/saa7164/saa7164-encoder.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/media/pci/saa7164/saa7164-encoder.c +11 -9
@@ -1030,7 +1030,7 @@ int saa7164_encoder_register(struct saa7164_port *port)"(errno = %d), NO PCI configuration\n" , __func__, result); result = -ENOMEM ; - goto failed; + goto fail_pci; }/* Establish encoder defaults here */
@@ -1084,7 +1084,7 @@ int saa7164_encoder_register(struct saa7164_port *port) 100000, ENCODER_DEF_BITRATE);if (hdl->error) { result = hdl->error; - goto failed; + goto fail_hdl; } port->std =V4L2_STD_NTSC_M ;
@@ -1102,7 +1102,7 @@ int saa7164_encoder_register(struct saa7164_port *port)printk (KERN_INFO "%s: can't allocate mpeg device\n" , dev->name); result = -ENOMEM ; - goto failed; + goto fail_hdl; } port->v4l_device->ctrl_handler = hdl;
@@ -1113,10 +1113,7 @@ int saa7164_encoder_register(struct saa7164_port *port)if (result <0 ) {printk (KERN_INFO "%s: can't register mpeg device\n" , dev->name); -/* TODO: We're going to leak here if we don't dealloc -The buffers above. The unreg function can't deal wit it. -*/ - goto failed; + goto fail_reg; } printk(KERN_INFO "%s: registered device video%d [mpeg]\n",
@@ -1138,9 +1135,14 @@ int saa7164_encoder_register(struct saa7164_port *port)saa7164_api_set_encoder (port);saa7164_api_get_encoder (port); +return 0 ; - result =0 ; -failed: +fail_reg: +video_device_release (port->v4l_device); + port->v4l_device =NULL ; +fail_hdl: +v4l2_ctrl_handler_free (hdl); +fail_pci:return result; }
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 5/24 media: gspca/sq905.c: fix uninitialized variable
In reply to Sasha LevinFrom: Hans Verkuil <[email protected]>
[ Upstream commit eaaea4681984c79d2b2b160387b297477f0c1aab ]
act_len can be uninitialized if usb_bulk_msg() returns an error. Set it to 0 to avoid a KMSAN error.
--- drivers/media/usb/gspca/sq905.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/sq905.c +1 -1
@@ -172,7 +172,7 @@ static int sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock) { int ret; -int act_len; +int act_len =0 ; gspca_dev->usb_buf[0 ] ='\0' ;if (need_lock)
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 6/24 media: pci: saa7164: Rudimentary spelling fixes in the file saa7164-types.h
In reply to Sasha LevinFrom: Bhaskar Chowdhury <[email protected]>
[ Upstream commit 4b19f9716ad89af51f07f9b611aabfd5fd80c625 ]
s/structues/structures/
s/decies/decides/
--- drivers/media/pci/saa7164/saa7164-types.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/pci/saa7164/saa7164-types.h +2 -2
@@ -21,7 +21,7 @@/* TODO: Cleanup and shorten the namespace */ -/* Some structues are passed directly to/from the firmware and +/* Some structures are passed directly to/from the firmware and * have strict alignment requirements. This is one of them. */ struct tmComResHWDescr {
@@ -42,7 +42,7 @@ struct tmComResHWDescr {/* This is DWORD aligned on windows but I can't find the right * gcc syntax to match the binary data from the device. * I've manually padded with Reserved[3] bytes to match the hardware, -* but this could break if GCC decies to pack in a different way. +* but this could break if GCC decides to pack in a different way. */ struct tmComResInterfaceDescr {u8 bLength;
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 7/24 power: supply: Use IRQF_ONESHOT
In reply to Sasha LevinFrom: dongjian <[email protected]>
[ Upstream commit 2469b836fa835c67648acad17d62bc805236a6ea ]
Fixes coccicheck error:
drivers/power/supply/pm2301_charger.c:1089:7-27: ERROR:
drivers/power/supply/lp8788-charger.c:502:8-28: ERROR:
drivers/power/supply/tps65217_charger.c:239:8-33: ERROR:
drivers/power/supply/tps65090-charger.c:303:8-33: ERROR:
Threaded IRQ with no primary handler requested without IRQF_ONESHOT
--- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/pm2301_charger.c | 2 +- drivers/power/supply/tps65090-charger.c | 2 +- drivers/power/supply/tps65217_charger.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/power/supply/lp8788-charger.c +1 -1
@@ -532,7 +532,7 @@ static int lp8788_set_irqs(struct platform_device *pdev, ret =request_threaded_irq (virq,NULL , lp8788_charger_irq_thread, -0 , name, pchg); +IRQF_ONESHOT , name, pchg);if (ret)break ; }
drivers/power/supply/pm2301_charger.c +1 -1
@@ -1098,7 +1098,7 @@ static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client, ret =request_threaded_irq (gpio_to_irq (pm2->pdata->gpio_irq_number),NULL , pm2xxx_charger_irq[0 ].isr, - pm2->pdata->irq_type, + pm2->pdata->irq_type |IRQF_ONESHOT , pm2xxx_charger_irq[0 ].name, pm2);if (ret !=0 ) {
drivers/power/supply/tps65090-charger.c +1 -1
@@ -311,7 +311,7 @@ static int tps65090_charger_probe(struct platform_device *pdev)if (irq != -ENXIO ) { ret =devm_request_threaded_irq (&pdev->dev, irq,NULL , - tps65090_charger_isr,0 ,"tps65090-charger" , cdata); + tps65090_charger_isr,IRQF_ONESHOT ,"tps65090-charger" , cdata);if (ret) { dev_err(cdata->dev, "Unable to register irq %d err %d\n", irq,
drivers/power/supply/tps65217_charger.c +1 -1
@@ -238,7 +238,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)if (irq != -ENXIO ) { ret =devm_request_threaded_irq (&pdev->dev, irq,NULL , tps65217_charger_irq, -0 ,"tps65217-charger" , +IRQF_ONESHOT ,"tps65217-charger" , charger);if (ret) { dev_err(charger->dev,
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 8/24 drm/bridge/analogix/anx78xx: Setup encoder before registering connector
In reply to Sasha LevinFrom: Lyude Paul <[email protected]>
[ Upstream commit 9962849d0871f5e53d0e3b3d84561f8f2847fbf4 ]
Since encoder mappings for connectors are exposed to userspace, we should be attaching the encoder before exposing the connector to userspace. Just a drive-by fix for an issue I noticed while fixing up usages of drm_dp_aux_init()/drm_dp_aux_register() across the tree.
--- drivers/gpu/drm/bridge/analogix-anx78xx.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/analogix-anx78xx.c +6 -6
@@ -1045,12 +1045,6 @@ static int anx78xx_bridge_attach(struct drm_bridge *bridge)drm_connector_helper_add (&anx78xx->connector, &anx78xx_connector_helper_funcs); - err =drm_connector_register (&anx78xx->connector); -if (err) { -DRM_ERROR ("Failed to register connector: %d\n" , err); -return err; - } - anx78xx->connector.polled =DRM_CONNECTOR_POLL_HPD ; err = drm_mode_connector_attach_encoder(&anx78xx->connector,
@@ -1060,6 +1054,12 @@ static int anx78xx_bridge_attach(struct drm_bridge *bridge)return err; } + err =drm_connector_register (&anx78xx->connector); +if (err) { +DRM_ERROR ("Failed to register connector: %d\n" , err); +return err; + } +return 0 ; }
Signature · 6 lines
2.30.2 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH AUTOSEL 4.9 08/24] drm/bridge/analogix/anx78xx: Setup encoder before registering connector
I would drop this patch for all of the stable kernel versions, it doesn't really fix any user reported issues.
The other patches CC'd to me look fine for stable though
Quoted 51 lines · Sasha Levin
From: Lyude Paul <[email protected]>
[ Upstream commit
9962849d0871f5e53d0e3b3d84561f8f2847fbf4]Since encoder mappings for connectors are exposed to userspace, we should be attaching the encoder before exposing the connector to userspace. Just a drive-by fix for an issue I noticed while fixing up usages of drm_dp_aux_init()/drm_dp_aux_register() across the tree.
Signed-off-by Lyude Paul <[email protected]>Reviewed-by Robert Foss <[email protected]>Link:
https://patchwork.freedesktop.org/patch/msgid/[email protected]Signed-off-by Sasha Levin <[email protected]>---
drivers/gpu/drm/bridge/analogix-anx78xx.c | 12 ++++++------1 file changed, 6 insertions(+), 6 deletions(-)drivers/gpu/drm/bridge/analogix-anx78xx.c +0
-0@@ -1045,12 +1045,6 @@ static int anx78xx_bridge_attach(struct drm_bridge *bridge) drm_connector_helper_add(&anx78xx->connector, &anx78xx_connector_helper_funcs);
- err =drm_connector_register(&anx78xx->connector); - if (err) {
- DRM_ERROR("Failed to register connector: %d\n", err); - return err;
- }
-
anx78xx->connector.polled =DRM_CONNECTOR_POLL_HPD;
err = drm_mode_connector_attach_encoder(&anx78xx->connector,drivers/gpu/drm/bridge/analogix-anx78xx.c +0
-0@@ -1060,6 +1054,12 @@ static int anx78xx_bridge_attach(struct drm_bridge *bridge) return err; }
+ err =drm_connector_register(&anx78xx->connector); + if (err) {
+ DRM_ERROR("Failed to register connector: %d\n", err); + return err;
+ }
+
return 0;
}
Signature · 3 lines
Cheers, Lyude Paul (she/her) Software Engineer at Red Hat
Sasha Levin
maintainerRe: [PATCH AUTOSEL 4.9 08/24] drm/bridge/analogix/anx78xx: Setup encoder before registering connector
Quoted 2 lines · Lyude Paul
I would drop this patch for all of the stable kernel versions, it doesn't really fix any user reported issues.
Will do, thanks!
Signature · 2 lines
Thanks, Sasha
Sasha Levin
maintainerPATCH 9/24 drm/bridge/analogix/anx78xx: Cleanup on error in anx78xx_bridge_attach()
In reply to Sasha LevinFrom: Lyude Paul <[email protected]>
[ Upstream commit 212ee8db84600f7b279b8645c62a112bff310995 ]
Just another issue I noticed while correcting usages of drm_dp_aux_init()/drm_dp_aux_register() around the tree. If any of the steps in anx78xx_bridge_attach() fail, we end up leaking resources. So, let's fix that (and fix leaking a DP AUX adapter in the process) by unrolling on errors.
--- drivers/gpu/drm/bridge/analogix-anx78xx.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/analogix-anx78xx.c +8 -3
@@ -1039,7 +1039,7 @@ static int anx78xx_bridge_attach(struct drm_bridge *bridge) DRM_MODE_CONNECTOR_DisplayPort);if (err) {DRM_ERROR ("Failed to initialize connector: %d\n" , err); -return err; + goto aux_unregister; } drm_connector_helper_add(&anx78xx->connector,
@@ -1051,16 +1051,21 @@ static int anx78xx_bridge_attach(struct drm_bridge *bridge) bridge->encoder);if (err) {DRM_ERROR ("Failed to link up connector to encoder: %d\n" , err); -return err; + goto connector_cleanup; } err =drm_connector_register (&anx78xx->connector);if (err) {DRM_ERROR ("Failed to register connector: %d\n" , err); -return err; + goto connector_cleanup; }return 0 ; +connector_cleanup: +drm_connector_cleanup (&anx78xx->connector); +aux_unregister: +drm_dp_aux_unregister (&anx78xx->aux); +return err; } static bool anx78xx_bridge_mode_fixup(struct drm_bridge *bridge,
Signature · 6 lines
2.30.2 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Sasha Levin
maintainerPATCH 10/24 scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
In reply to Sasha LevinFrom: Bart Van Assche <[email protected]>
[ Upstream commit a2b2cc660822cae08c351c7f6b452bfd1330a4f7 ]
This patch fixes the following Coverity warning:
CID 361199 (#1 of 1): Unchecked return value (CHECKED_RETURN)
3. check_return: Calling qla24xx_get_isp_stats without checking return value (as is done elsewhere 4 out of 5 times).
--- drivers/scsi/qla2xxx/qla_attr.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_attr.c +7 -1
@@ -1909,6 +1909,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) vha->qla_stats.jiffies_at_last_reset =get_jiffies_64 ();if (IS_FWI2_CAPABLE (ha)) { +int rval; + stats =dma_alloc_coherent (&ha->pdev->dev,sizeof (*stats), &stats_dma,GFP_KERNEL );if (!stats) {
@@ -1918,7 +1920,11 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) }/* reset firmware statistics */ -qla24xx_get_isp_stats (base_vha, stats, stats_dma,BIT_0 ); + rval =qla24xx_get_isp_stats (base_vha, stats, stats_dma,BIT_0 ); +if (rval !=QLA_SUCCESS ) +ql_log (ql_log_warn, vha,0x70de , +"Resetting ISP statistics failed: rval = %d\n" , + rval);dma_free_coherent (&ha->pdev->dev,sizeof (*stats), stats, stats_dma);
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 11/24 scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
In reply to Sasha LevinFrom: "Ewan D. Milne" <[email protected]>
[ Upstream commit bc3f2b42b70eb1b8576e753e7d0e117bbb674496 ]
Some arrays return ILLEGAL_REQUEST with ASC 00h if they don't support the RTPG extended header so remove the check for INVALID FIELD IN CDB.
--- drivers/scsi/device_handler/scsi_dh_alua.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/device_handler/scsi_dh_alua.c +3 -2
@@ -564,10 +564,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)* even though it shouldn't according to T10. * The retry without rtpg_ext_hdr_req set * handles this. +* Note: some arrays return a sense key of ILLEGAL_REQUEST +* with ASC 00h if they don't support the extended header. */ if (!(pg->flags &ALUA_RTPG_EXT_HDR_UNSUPP ) && - sense_hdr.sense_key ==ILLEGAL_REQUEST && - sense_hdr.asc ==0x24 && sense_hdr.ascq ==0 ) { + sense_hdr.sense_key ==ILLEGAL_REQUEST ) { pg->flags |=ALUA_RTPG_EXT_HDR_UNSUPP ; goto retry; }
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 12/24 media: em28xx: fix memory leak
In reply to Sasha LevinFrom: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 ]
If some error occurs, URB buffers should also be freed. If they aren't freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB buffers as dvb is set to NULL. The function in which error occurs should do all the cleanup for the allocations it had done.
Tested the patch with the reproducer provided by syzbot. This patch fixes the memleak.
--- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/usb/em28xx/em28xx-dvb.c +1 -0
@@ -1967,6 +1967,7 @@ static int em28xx_dvb_init(struct em28xx *dev)return result; out_free: +em28xx_uninit_usb_xfer (dev,EM28XX_DIGITAL_MODE );kfree (dvb); dev->dvb =NULL ; goto ret;
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 13/24 clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return
In reply to Sasha LevinFrom: Colin Ian King <[email protected]>
[ Upstream commit 657d4d1934f75a2d978c3cf2086495eaa542e7a9 ]
There is an error return path that is not kfree'ing socfpga_clk leading to a memory leak. Fix this by adding in the missing kfree call.
Addresses-Coverity: ("Resource leak")
--- drivers/clk/socfpga/clk-gate-a10.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/socfpga/clk-gate-a10.c +1 -0
@@ -157,6 +157,7 @@ static void __init __socfpga_gate_init(struct device_node *node,if (IS_ERR (socfpga_clk->sys_mgr_base_addr)) {pr_err ("%s: failed to find altr,sys-mgr regmap!\n" , __func__); +kfree (socfpga_clk);return ; } }
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 14/24 power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()
In reply to Sasha LevinFrom: Yang Yingliang <[email protected]>
[ Upstream commit b6cfa007b3b229771d9588970adb4ab3e0487f49 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/power/supply/generic-adc-battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/generic-adc-battery.c +1 -1
@@ -384,7 +384,7 @@ static int gab_remove(struct platform_device *pdev) }kfree (adc_bat->psy_desc.properties); -cancel_delayed_work (&adc_bat->bat_work); +cancel_delayed_work_sync (&adc_bat->bat_work);return 0 ; }
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 15/24 power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()
In reply to Sasha LevinFrom: Yang Yingliang <[email protected]>
[ Upstream commit 68ae256945d2abe9036a7b68af4cc65aff79d5b7 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/power/supply/s3c_adc_battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/s3c_adc_battery.c +1 -1
@@ -392,7 +392,7 @@ static int s3c_adc_bat_remove(struct platform_device *pdev)gpio_free (pdata->gpio_charge_finished); } -cancel_delayed_work (&bat_work); +cancel_delayed_work_sync (&bat_work);if (pdata->exit) pdata->exit ();
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 16/24 media: adv7604: fix possible use-after-free in adv76xx_remove()
In reply to Sasha LevinFrom: Yang Yingliang <[email protected]>
[ Upstream commit fa56f5f1fe31c2050675fa63b84963ebd504a5b3 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/media/i2c/adv7604.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/adv7604.c +1 -1
@@ -3541,7 +3541,7 @@ static int adv76xx_remove(struct i2c_client *client)io_write (sd,0x6e ,0 );io_write (sd,0x73 ,0 ); -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);v4l2_async_unregister_subdev (sd);media_entity_cleanup (&sd->entity);adv76xx_unregister_clients (to_state (sd));
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 17/24 media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()
In reply to Sasha LevinFrom: Yang Yingliang <[email protected]>
[ Upstream commit 2c9541720c66899adf6f3600984cf3ef151295ad ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/media/i2c/adv7511-v4l2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/adv7511-v4l2.c +1 -1
@@ -1976,7 +1976,7 @@ static int adv7511_remove(struct i2c_client *client)adv7511_set_isr (sd, false);adv7511_init_setup (sd); -cancel_delayed_work (&state->edid_handler); +cancel_delayed_work_sync (&state->edid_handler);i2c_unregister_device (state->i2c_edid);if (state->i2c_cec)i2c_unregister_device (state->i2c_cec);
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 18/24 media: i2c: adv7842: fix possible use-after-free in adv7842_remove()
In reply to Sasha LevinFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4a15275b6a18597079f18241c87511406575179a ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/media/i2c/adv7842.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/adv7842.c +1 -1
@@ -3598,7 +3598,7 @@ static int adv7842_remove(struct i2c_client *client)struct adv7842_state *state =to_state (sd);adv7842_irq_enable (sd, false); -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);v4l2_device_unregister_subdev (sd);media_entity_cleanup (&sd->entity);adv7842_unregister_clients (sd);
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 19/24 media: dvb-usb: fix memory leak in dvb_usb_adapter_init
In reply to Sasha LevinFrom: Pavel Skripkin <[email protected]>
[ Upstream commit b7cd0da982e3043f2eec7235ac5530cb18d6af1d ]
syzbot reported memory leak in dvb-usb. The problem was in invalid error handling in dvb_usb_adapter_init().
for (n = 0; n < d->props.num_adapters; n++) {
....
if ((ret = dvb_usb_adapter_stream_init(adap)) ||
(ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) ||
(ret = dvb_usb_adapter_frontend_init(adap))) {
return ret;
}
...
d->num_adapters_initialized++;...
}
In case of error in dvb_usb_adapter_dvb_init() or dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be incremented, but dvb_usb_adapter_exit() relies on it:
for (n = 0; n < d->num_adapters_initialized; n++)
So, allocated objects won't be freed.
--- drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb/dvb-usb-init.c +16 -4
@@ -82,11 +82,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) } } -if ((ret =dvb_usb_adapter_stream_init (adap)) || - (ret =dvb_usb_adapter_dvb_init (adap, adapter_nrs)) || - (ret =dvb_usb_adapter_frontend_init (adap))) { + ret =dvb_usb_adapter_stream_init (adap); +if (ret)return ret; - } + + ret =dvb_usb_adapter_dvb_init (adap, adapter_nrs); +if (ret) + goto dvb_init_err; + + ret =dvb_usb_adapter_frontend_init (adap); +if (ret) + goto frontend_init_err;/* use exclusive FE lock if there is multiple shared FEs */ if (adap->fe_adap[1 ].fe)
@@ -106,6 +112,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) }return 0 ; + +frontend_init_err: +dvb_usb_adapter_dvb_exit (adap); +dvb_init_err: +dvb_usb_adapter_stream_exit (adap); +return ret; }static int dvb_usb_adapter_exit (struct dvb_usb_device *d)
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 20/24 media: gscpa/stv06xx: fix memory leak
In reply to Sasha LevinFrom: Hans Verkuil <[email protected]>
[ Upstream commit 4f4e6644cd876c844cdb3bea2dd7051787d5ae25 ]
For two of the supported sensors the stv06xx driver allocates memory which is stored in sd->sensor_priv. This memory is freed on a disconnect, but if the probe() fails, then it isn't freed and so this leaks memory.
Add a new probe_error() op that drivers can use to free any allocated memory in case there was a probe failure.
Thanks to Pavel Skripkin <[email protected]> for discovering the cause of the memory leak.
--- drivers/media/usb/gspca/gspca.c | 2 ++ drivers/media/usb/gspca/gspca.h | 1 + drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 +++++++++ 3 files changed, 12 insertions(+)
drivers/media/usb/gspca/gspca.c +2 -0
@@ -2146,6 +2146,8 @@ int gspca_dev_probe2(struct usb_interface *intf,#endif v4l2_ctrl_handler_free (gspca_dev->vdev.ctrl_handler);v4l2_device_unregister (&gspca_dev->v4l2_dev); +if (sd_desc->probe_error) + sd_desc->probe_error (gspca_dev);kfree (gspca_dev->usb_buf);kfree (gspca_dev);return ret;
drivers/media/usb/gspca/gspca.h +1 -0
@@ -101,6 +101,7 @@ struct sd_desc {cam_cf_op config;/* called on probe */ cam_op init;/* called on probe and resume */ cam_op init_controls;/* called on probe */ +cam_v_op probe_error;/* called if probe failed, do cleanup here */ cam_op start;/* called on stream on after URBs creation */ cam_pkt_op pkt_scan;/* optional operations */
drivers/media/usb/gspca/stv06xx/stv06xx.c +9 -0
@@ -541,12 +541,21 @@ static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,static int stv06xx_config (struct gspca_dev *gspca_dev,const struct usb_device_id *id); +static void stv06xx_probe_error (struct gspca_dev *gspca_dev) +{ +struct sd *sd = (struct sd *)gspca_dev; + +kfree (sd->sensor_priv); + sd->sensor_priv =NULL ; +} +/* sub-driver description */ static const struct sd_desc sd_desc = { .name =MODULE_NAME , .config = stv06xx_config, .init = stv06xx_init, .init_controls = stv06xx_init_controls, + .probe_error = stv06xx_probe_error, .start = stv06xx_start, .stopN = stv06xx_stopN, .pkt_scan = stv06xx_pkt_scan,
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 21/24 drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
In reply to Sasha LevinFrom: Marijn Suijten <[email protected]>
[ Upstream commit 2ad52bdb220de5ab348098e3482b01235d15a842 ]
Leaving this at a close-to-maximum register value 0xFFF0 means it takes very long for the MDSS to generate a software vsync interrupt when the hardware TE interrupt doesn't arrive. Configuring this to double the vtotal (like some downstream kernels) leads to a frame to take at most twice before the vsync signal, until hardware TE comes up.
In this case the hardware interrupt responsible for providing this signal - "disp-te" gpio - is not hooked up to the mdp5 vsync/pp logic at all. This solves severe panel update issues observed on at least the Xperia Loire and Tone series, until said gpio is properly hooked up to an irq.
--- drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c +9 -1
@@ -128,9 +128,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN; cfg |=MDP5_PP_SYNC_CONFIG_VSYNC_COUNT (vclks_line); +/* +* Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on +* the vsync_clk equating to roughly half the desired panel refresh rate. +* This is only necessary as stability fallback if interrupts from the +* panel arrive too late or not at all, but is currently used by default +* because these panel interrupts are not wired up yet. +*/ mdp5_write (mdp5_kms,REG_MDP5_PP_SYNC_CONFIG_VSYNC (pp_id), cfg);mdp5_write (mdp5_kms, -REG_MDP5_PP_SYNC_CONFIG_HEIGHT (pp_id),0xfff0 ); +REG_MDP5_PP_SYNC_CONFIG_HEIGHT (pp_id), (2 * mode->vtotal)); +mdp5_write (mdp5_kms,REG_MDP5_PP_VSYNC_INIT_VAL (pp_id), mode->vdisplay);mdp5_write (mdp5_kms,REG_MDP5_PP_RD_PTR_IRQ (pp_id), mode->vdisplay +1 );
Signature · 6 lines
2.30.2 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Sasha Levin
maintainerPATCH 22/24 drm/amdgpu: fix NULL pointer dereference
In reply to Sasha LevinFrom: Guchun Chen <[email protected]>
[ Upstream commit 3c3dc654333f6389803cdcaf03912e94173ae510 ]
ttm->sg needs to be checked before accessing its child member.
Call Trace: amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu] ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm] ttm_bo_release+0x17d/0x300 [ttm] amdgpu_bo_unref+0x1a/0x30 [amdgpu] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu] kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu] kfd_ioctl+0x222/0x400 [amdgpu] ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu] __x64_sys_ioctl+0x8e/0xd0 ? __context_tracking_exit+0x52/0x90 do_syscall_64+0x33/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f97f264d317 Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317 RDX: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003 RBP: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004 R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16 R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -1
@@ -652,7 +652,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_tt *ttm) DMA_BIDIRECTIONAL :DMA_TO_DEVICE ;/* double check that we don't free the table twice */ -if (!ttm->sg->sgl) +if (!ttm->sg || !ttm->sg->sgl)return ;/* free the sg table and pages again */
Signature · 6 lines
2.30.2 _______________________________________________ amd-gfx mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/amd-gfx
Sasha Levin
maintainerPATCH 23/24 scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response
In reply to Sasha LevinFrom: James Smart <[email protected]>
[ Upstream commit fffd18ec6579c2d9c72b212169259062fe747888 ]
Fix a crash caused by a double put on the node when the driver completed an ACC for an unsolicted abort on the same node. The second put was executed by lpfc_nlp_not_used() and is wrong because the completion routine executes the nlp_put when the iocbq was released. Additionally, the driver is issuing a LOGO then immediately calls lpfc_nlp_set_state to put the node into NPR. This call does nothing.
Remove the lpfc_nlp_not_used call and additional set_state in the completion routine. Remove the lpfc_nlp_set_state post issue_logo. Isn't necessary.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 2 -- drivers/scsi/lpfc/lpfc_sli.c | 1 - 2 files changed, 3 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +0 -2
@@ -1606,8 +1606,6 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport, ndlp->nlp_last_elscmd =ELS_CMD_PLOGI ;lpfc_issue_els_logo (vport, ndlp,0 ); - ndlp->nlp_prev_state =NLP_STE_REG_LOGIN_ISSUE ; -lpfc_nlp_set_state (vport, ndlp,NLP_STE_NPR_NODE );return ndlp->nlp_state; }
drivers/scsi/lpfc/lpfc_sli.c +0 -1
@@ -15252,7 +15252,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba,if (cmd_iocbq) { ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1;lpfc_nlp_put (ndlp); -lpfc_nlp_not_used (ndlp);lpfc_sli_release_iocbq (phba, cmd_iocbq); }
Signature · 1 line
2.30.2
Sasha Levin
maintainerPATCH 24/24 scsi: libfc: Fix a format specifier
In reply to Sasha LevinFrom: Bart Van Assche <[email protected]>
[ Upstream commit 90d6697810f06aceea9de71ad836a8c7669789cd ]
Since the 'mfs' member has been declared as 'u32' in include/scsi/libfc.h, use the %u format specifier instead of %hu. This patch fixes the following clang compiler warning:
warning: format specifies type
'unsigned short' but the argument has type 'u32' (aka 'unsigned int')
[-Wformat]
"lport->mfs:%hu\n", mfs, lport->mfs);
~~~ ^~~~~~~~~~
%u--- drivers/scsi/libfc/fc_lport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libfc/fc_lport.c +1 -1
@@ -1751,7 +1751,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,if (mfs <FC_SP_MIN_MAX_PAYLOAD || mfs >FC_SP_MAX_MAX_PAYLOAD ) {FC_LPORT_DBG (lport,"FLOGI bad mfs:%hu response, " -"lport->mfs:%hu\n" , mfs, lport->mfs); +"lport->mfs:%u\n" , mfs, lport->mfs);fc_lport_error (lport, fp); goto out; }
Signature · 1 line
2.30.2