FAILED: patch "[PATCH] pps: Fix a use-after-free" failed to apply to 5.10-stable tree
Subsystems (5)
[email protected]
maintainerThe patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x c79a39dc8d060b9e64e8b0fa9d245d44befeefbe
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025020422-tragedy-splashing-50db@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c79a39dc8d060b9e64e8b0fa9d245d44befeefbe Mon Sep 17 00:00:00 2001
From: Calvin Owens <[email protected]>
Date: Mon, 11 Nov 2024 20:13:29 -0800
Subject: [PATCH] pps: Fix a use-after-free
On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting:
pps pps1: removed
------------[ cut here ]------------
kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150
CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1
Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : kobject_put+0x120/0x150
lr : kobject_put+0x120/0x150
sp : ffffffc0803d3ae0
x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001
x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440
x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600
x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20
x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
kobject_put+0x120/0x150
cdev_put+0x20/0x3c
__fput+0x2c4/0x2d8
____fput+0x1c/0x38
task_work_run+0x70/0xfc
do_exit+0x2a0/0x924
do_group_exit+0x34/0x90
get_signal+0x7fc/0x8c0
do_signal+0x128/0x13b4
do_notify_resume+0xdc/0x160
el0_svc+0xd4/0xf8
el0t_64_sync_handler+0x140/0x14c
el0t_64_sync+0x190/0x194
---[ end trace 0000000000000000 ]---...followed by more symptoms of corruption, with similar stacks:
refcount_t: underflow; use-after-free.
kernel BUG at lib/list_debug.c:62!
Kernel panic - not syncing: Oops - BUG: Fatal exception
This happens because pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(), but, as the comment above cdev_del() notes, fops for previously opened cdevs are still callable even after cdev_del() returns. I think this bug has always been there: I can't explain why it suddenly started happening every time I reboot this particular board.
In commit d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source."), George Spelvin suggested removing the embedded cdev. That seems like the simplest way to fix this, so I've implemented his suggestion, using __register_chrdev() with pps_idr becoming the source of truth for which minor corresponds to which device.
But now that pps_idr defines userspace visibility instead of cdev_add(), we need to be sure the pps->dev refcount can't reach zero while userspace can still find it again. So, the idr_remove() call moves to pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.
pps_core: source serial1 got cdev (251:1)
<...>
pps pps1: removed
pps_core: unregistering pps1
pps_core: deallocating pps1
drivers/pps/clients/pps-gpio.c +2 -2
@@ -214,8 +214,8 @@ static int pps_gpio_probe(struct platform_device *pdev)return -EINVAL ; } -dev_info (data->pps->dev,"Registered IRQ %d as PPS source\n" , - data->irq); +dev_dbg (&data->pps->dev,"Registered IRQ %d as PPS source\n" , + data->irq);return 0 ; }
drivers/pps/clients/pps-ktimer.c +2 -2
@@ -56,7 +56,7 @@ static struct pps_source_info pps_ktimer_info = { static void __exit pps_ktimer_exit(void) { -dev_info (pps->dev,"ktimer PPS source unregistered\n" ); +dev_dbg (&pps->dev,"ktimer PPS source unregistered\n" );del_timer_sync (&ktimer);pps_unregister_source (pps);
@@ -74,7 +74,7 @@ static int __init pps_ktimer_init(void)timer_setup (&ktimer, pps_ktimer_event,0 );mod_timer (&ktimer, jiffies +HZ ); -dev_info (pps->dev,"ktimer PPS source registered\n" ); +dev_dbg (&pps->dev,"ktimer PPS source registered\n" );return 0 ; }
drivers/pps/clients/pps-ldisc.c +3 -3
@@ -32,7 +32,7 @@ static void pps_tty_dcd_change(struct tty_struct *tty, bool active)pps_event (pps, &ts, active ?PPS_CAPTUREASSERT :PPS_CAPTURECLEAR ,NULL ); -dev_dbg (pps->dev,"PPS %s at %lu\n" , +dev_dbg (&pps->dev,"PPS %s at %lu\n" , active ?"assert" :"clear" , jiffies); }
@@ -69,7 +69,7 @@ static int pps_tty_open(struct tty_struct *tty) goto err_unregister; } -dev_info (pps->dev,"source \"%s\" added\n" , info.path); +dev_dbg (&pps->dev,"source \"%s\" added\n" , info.path);return 0 ;
@@ -89,7 +89,7 @@ static void pps_tty_close(struct tty_struct *tty)if (WARN_ON (!pps))return ; -dev_info (pps->dev,"removed\n" ); +dev_info (&pps->dev,"removed\n" );pps_unregister_source (pps); }
drivers/pps/clients/pps_parport.c +2 -2
@@ -81,7 +81,7 @@ static void parport_irq(void *handle)/* check the signal (no signal means the pulse is lost this time) */ if (!signal_is_set (port)) {local_irq_restore (flags); -dev_err (dev->pps->dev,"lost the signal\n" ); +dev_err (&dev->pps->dev,"lost the signal\n" ); goto out_assert; }
@@ -98,7 +98,7 @@ static void parport_irq(void *handle)/* timeout */ dev->cw_err++;if (dev->cw_err >=CLEAR_WAIT_MAX_ERRORS ) { -dev_err (dev->pps->dev,"disabled clear edge capture after %d" +dev_err (&dev->pps->dev,"disabled clear edge capture after %d" " timeouts\n" , dev->cw_err); dev->cw =0 ; dev->cw_err =0 ;
drivers/pps/kapi.c +5 -5
@@ -41,7 +41,7 @@ static void pps_add_offset(struct pps_ktime *ts, struct pps_ktime *offset)static void pps_echo_client_default (struct pps_device *pps,int event,void *data) { -dev_info (pps->dev,"echo %s %s\n" , +dev_info (&pps->dev,"echo %s %s\n" , event &PPS_CAPTUREASSERT ?"assert" :"" , event &PPS_CAPTURECLEAR ?"clear" :"" ); }
@@ -112,7 +112,7 @@ struct pps_device *pps_register_source(struct pps_source_info *info, goto kfree_pps; } -dev_info (pps->dev,"new PPS source %s\n" , info->name); +dev_dbg (&pps->dev,"new PPS source %s\n" , info->name);return pps;
@@ -166,7 +166,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,/* check event type */ BUG_ON ((event & (PPS_CAPTUREASSERT |PPS_CAPTURECLEAR )) ==0 ); -dev_dbg (pps->dev,"PPS event at %lld.%09ld\n" , +dev_dbg (&pps->dev,"PPS event at %lld.%09ld\n" , (s64 )ts->ts_real.tv_sec, ts->ts_real.tv_nsec);timespec_to_pps_ktime (&ts_real, ts->ts_real);
@@ -188,7 +188,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,/* Save the time stamp */ pps->assert_tu = ts_real; pps->assert_sequence++; -dev_dbg (pps->dev,"capture assert seq #%u\n" , +dev_dbg (&pps->dev,"capture assert seq #%u\n" , pps->assert_sequence); captured = ~0 ;
@@ -202,7 +202,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,/* Save the time stamp */ pps->clear_tu = ts_real; pps->clear_sequence++; -dev_dbg (pps->dev,"capture clear seq #%u\n" , +dev_dbg (&pps->dev,"capture clear seq #%u\n" , pps->clear_sequence); captured = ~0 ;
drivers/pps/kc.c +5 -5
@@ -43,11 +43,11 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) pps_kc_hardpps_mode =0 ; pps_kc_hardpps_dev =NULL ;spin_unlock_irq (&pps_kc_hardpps_lock); -dev_info (pps->dev,"unbound kernel" +dev_info (&pps->dev,"unbound kernel" " consumer\n" ); }else {spin_unlock_irq (&pps_kc_hardpps_lock); -dev_err (pps->dev,"selected kernel consumer" +dev_err (&pps->dev,"selected kernel consumer" " is not bound\n" );return -EINVAL ; }
@@ -57,11 +57,11 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) pps_kc_hardpps_mode = bind_args->edge; pps_kc_hardpps_dev = pps;spin_unlock_irq (&pps_kc_hardpps_lock); -dev_info (pps->dev,"bound kernel consumer: " +dev_info (&pps->dev,"bound kernel consumer: " "edge=0x%x\n" , bind_args->edge); }else {spin_unlock_irq (&pps_kc_hardpps_lock); -dev_err (pps->dev,"another kernel consumer" +dev_err (&pps->dev,"another kernel consumer" " is already bound\n" );return -EINVAL ; }
@@ -83,7 +83,7 @@ void pps_kc_remove(struct pps_device *pps) pps_kc_hardpps_mode =0 ; pps_kc_hardpps_dev =NULL ;spin_unlock_irq (&pps_kc_hardpps_lock); -dev_info (pps->dev,"unbound kernel consumer" +dev_info (&pps->dev,"unbound kernel consumer" " on device removal\n" ); }else spin_unlock_irq (&pps_kc_hardpps_lock);
drivers/pps/pps.c +66 -61
288 lines not on this page · raw message
drivers/ptp/ptp_ocp.c +1 -1
@@ -4420,7 +4420,7 @@ ptp_ocp_complete(struct ptp_ocp *bp) pps =pps_lookup_dev (bp->ptp);if (pps) -ptp_ocp_symlink (bp, pps->dev,"pps" ); +ptp_ocp_symlink (bp, &pps->dev,"pps" );ptp_ocp_debugfs_add_device (bp);
include/linux/pps_kernel.h +1 -2
@@ -56,8 +56,7 @@ struct pps_device {unsigned int id;/* PPS source unique ID */ void const *lookup_cookie;/* For pps_lookup_dev() only */ -struct cdev cdev; -struct device *dev; +struct device dev;struct fasync_struct *async_queue;/* fasync method */ spinlock_t lock; };
PATCH 1/1 pps: Fix a use-after-free
On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting:
pps pps1: removed
------------[ cut here ]------------
kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150
CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1
Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : kobject_put+0x120/0x150
lr : kobject_put+0x120/0x150
sp : ffffffc0803d3ae0
x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001
x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440
x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600
x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20
x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
kobject_put+0x120/0x150
cdev_put+0x20/0x3c
__fput+0x2c4/0x2d8
____fput+0x1c/0x38
task_work_run+0x70/0xfc
do_exit+0x2a0/0x924
do_group_exit+0x34/0x90
get_signal+0x7fc/0x8c0
do_signal+0x128/0x13b4
do_notify_resume+0xdc/0x160
el0_svc+0xd4/0xf8
el0t_64_sync_handler+0x140/0x14c
el0t_64_sync+0x190/0x194
---[ end trace 0000000000000000 ]---...followed by more symptoms of corruption, with similar stacks:
refcount_t: underflow; use-after-free.
kernel BUG at lib/list_debug.c:62!
Kernel panic - not syncing: Oops - BUG: Fatal exception
This happens because pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(), but, as the comment above cdev_del() notes, fops for previously opened cdevs are still callable even after cdev_del() returns. I think this bug has always been there: I can't explain why it suddenly started happening every time I reboot this particular board.
In commit d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source."), George Spelvin suggested removing the embedded cdev. That seems like the simplest way to fix this, so I've implemented his suggestion, using __register_chrdev() with pps_idr becoming the source of truth for which minor corresponds to which device.
But now that pps_idr defines userspace visibility instead of cdev_add(), we need to be sure the pps->dev refcount can't reach zero while userspace can still find it again. So, the idr_remove() call moves to pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.
pps_core: source serial1 got cdev (251:1)
<...>
pps pps1: removed
pps_core: unregistering pps1
pps_core: deallocating pps1
--- drivers/pps/clients/pps-gpio.c | 4 +- drivers/pps/clients/pps-ktimer.c | 4 +- drivers/pps/clients/pps-ldisc.c | 6 +- drivers/pps/clients/pps_parport.c | 4 +- drivers/pps/kapi.c | 10 +-- drivers/pps/kc.c | 10 +-- drivers/pps/pps.c | 127 ++++++++++++++++-------------- include/linux/pps_kernel.h | 3 +- 8 files changed, 86 insertions(+), 82 deletions(-)
drivers/pps/clients/pps-gpio.c +2 -2
@@ -232,8 +232,8 @@ static int pps_gpio_probe(struct platform_device *pdev)return -EINVAL ; } -dev_info (data->pps->dev,"Registered IRQ %d as PPS source\n" , - data->irq); +dev_dbg (&data->pps->dev,"Registered IRQ %d as PPS source\n" , + data->irq);return 0 ; }
drivers/pps/clients/pps-ktimer.c +2 -2
@@ -56,7 +56,7 @@ static struct pps_source_info pps_ktimer_info = { static void __exit pps_ktimer_exit(void) { -dev_info (pps->dev,"ktimer PPS source unregistered\n" ); +dev_dbg (&pps->dev,"ktimer PPS source unregistered\n" );del_timer_sync (&ktimer);pps_unregister_source (pps);
@@ -74,7 +74,7 @@ static int __init pps_ktimer_init(void)timer_setup (&ktimer, pps_ktimer_event,0 );mod_timer (&ktimer, jiffies +HZ ); -dev_info (pps->dev,"ktimer PPS source registered\n" ); +dev_dbg (&pps->dev,"ktimer PPS source registered\n" );return 0 ; }
drivers/pps/clients/pps-ldisc.c +3 -3
@@ -34,7 +34,7 @@ static void pps_tty_dcd_change(struct tty_struct *tty, unsigned int status)pps_event (pps, &ts, status ?PPS_CAPTUREASSERT :PPS_CAPTURECLEAR ,NULL ); -dev_dbg (pps->dev,"PPS %s at %lu\n" , +dev_dbg (&pps->dev,"PPS %s at %lu\n" , status ?"assert" :"clear" , jiffies); }
@@ -71,7 +71,7 @@ static int pps_tty_open(struct tty_struct *tty) goto err_unregister; } -dev_info (pps->dev,"source \"%s\" added\n" , info.path); +dev_dbg (&pps->dev,"source \"%s\" added\n" , info.path);return 0 ;
@@ -91,7 +91,7 @@ static void pps_tty_close(struct tty_struct *tty)if (WARN_ON (!pps))return ; -dev_info (pps->dev,"removed\n" ); +dev_info (&pps->dev,"removed\n" );pps_unregister_source (pps); }
drivers/pps/clients/pps_parport.c +2 -2
@@ -83,7 +83,7 @@ static void parport_irq(void *handle)/* check the signal (no signal means the pulse is lost this time) */ if (!signal_is_set (port)) {local_irq_restore (flags); -dev_err (dev->pps->dev,"lost the signal\n" ); +dev_err (&dev->pps->dev,"lost the signal\n" ); goto out_assert; }
@@ -100,7 +100,7 @@ static void parport_irq(void *handle)/* timeout */ dev->cw_err++;if (dev->cw_err >=CLEAR_WAIT_MAX_ERRORS ) { -dev_err (dev->pps->dev,"disabled clear edge capture after %d" +dev_err (&dev->pps->dev,"disabled clear edge capture after %d" " timeouts\n" , dev->cw_err); dev->cw =0 ; dev->cw_err =0 ;
drivers/pps/kapi.c +5 -5
@@ -41,7 +41,7 @@ static void pps_add_offset(struct pps_ktime *ts, struct pps_ktime *offset)static void pps_echo_client_default (struct pps_device *pps,int event,void *data) { -dev_info (pps->dev,"echo %s %s\n" , +dev_info (&pps->dev,"echo %s %s\n" , event &PPS_CAPTUREASSERT ?"assert" :"" , event &PPS_CAPTURECLEAR ?"clear" :"" ); }
@@ -112,7 +112,7 @@ struct pps_device *pps_register_source(struct pps_source_info *info, goto kfree_pps; } -dev_info (pps->dev,"new PPS source %s\n" , info->name); +dev_dbg (&pps->dev,"new PPS source %s\n" , info->name);return pps;
@@ -166,7 +166,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,/* check event type */ BUG_ON ((event & (PPS_CAPTUREASSERT |PPS_CAPTURECLEAR )) ==0 ); -dev_dbg (pps->dev,"PPS event at %lld.%09ld\n" , +dev_dbg (&pps->dev,"PPS event at %lld.%09ld\n" , (s64 )ts->ts_real.tv_sec, ts->ts_real.tv_nsec);timespec_to_pps_ktime (&ts_real, ts->ts_real);
@@ -188,7 +188,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,/* Save the time stamp */ pps->assert_tu = ts_real; pps->assert_sequence++; -dev_dbg (pps->dev,"capture assert seq #%u\n" , +dev_dbg (&pps->dev,"capture assert seq #%u\n" , pps->assert_sequence); captured = ~0 ;
@@ -202,7 +202,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,/* Save the time stamp */ pps->clear_tu = ts_real; pps->clear_sequence++; -dev_dbg (pps->dev,"capture clear seq #%u\n" , +dev_dbg (&pps->dev,"capture clear seq #%u\n" , pps->clear_sequence); captured = ~0 ;
drivers/pps/kc.c +5 -5
@@ -43,11 +43,11 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) pps_kc_hardpps_mode =0 ; pps_kc_hardpps_dev =NULL ;spin_unlock_irq (&pps_kc_hardpps_lock); -dev_info (pps->dev,"unbound kernel" +dev_info (&pps->dev,"unbound kernel" " consumer\n" ); }else {spin_unlock_irq (&pps_kc_hardpps_lock); -dev_err (pps->dev,"selected kernel consumer" +dev_err (&pps->dev,"selected kernel consumer" " is not bound\n" );return -EINVAL ; }
@@ -57,11 +57,11 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) pps_kc_hardpps_mode = bind_args->edge; pps_kc_hardpps_dev = pps;spin_unlock_irq (&pps_kc_hardpps_lock); -dev_info (pps->dev,"bound kernel consumer: " +dev_info (&pps->dev,"bound kernel consumer: " "edge=0x%x\n" , bind_args->edge); }else {spin_unlock_irq (&pps_kc_hardpps_lock); -dev_err (pps->dev,"another kernel consumer" +dev_err (&pps->dev,"another kernel consumer" " is already bound\n" );return -EINVAL ; }
@@ -83,7 +83,7 @@ void pps_kc_remove(struct pps_device *pps) pps_kc_hardpps_mode =0 ; pps_kc_hardpps_dev =NULL ;spin_unlock_irq (&pps_kc_hardpps_lock); -dev_info (pps->dev,"unbound kernel consumer" +dev_info (&pps->dev,"unbound kernel consumer" " on device removal\n" ); }else spin_unlock_irq (&pps_kc_hardpps_lock);
drivers/pps/pps.c +66 -61
288 lines not on this page · raw message
include/linux/pps_kernel.h +1 -2
@@ -56,8 +56,7 @@ struct pps_device {unsigned int id;/* PPS source unique ID */ void const *lookup_cookie;/* For pps_lookup_dev() only */ -struct cdev cdev; -struct device *dev; +struct device dev;struct fasync_struct *async_queue;/* fasync method */ spinlock_t lock; };
Signature · 1 line
2.47.2
Re: [PATCH 5.10.y] pps: Fix a use-after-free
[ Sasha's backport helper bot ]
Hi,
Found matching upstream commit: c79a39dc8d060b9e64e8b0fa9d245d44befeefbe
Status in newer kernel trees:
6.13.y | Present (different SHA1: d487d68916ad) 6.12.y | Present (different SHA1: 2423d77f7ee9) 6.6.y | Present (different SHA1: 73f8d5a93c8f) 6.1.y | Not found
5.15.y | Not found
5.10.y | Not found
Note: The patch differs from the upstream commit:
---
1: c79a39dc8d060 ! 1: 4ded4bb10e446 pps: Fix a use-after-free
@@ Commit message
+ (cherry picked from commit c79a39dc8d060b9e64e8b0fa9d245d44befeefbe)
+ Signed-off-by: Calvin Owens <[email protected]>
## drivers/pps/clients/pps-gpio.c ##
@@ drivers/pps/clients/pps-gpio.c: static int pps_gpio_probe(struct platform_device *pdev)
@@ drivers/pps/clients/pps-ktimer.c: static int __init pps_ktimer_init(void)
}
## drivers/pps/clients/pps-ldisc.c ##
-@@ drivers/pps/clients/pps-ldisc.c: static void pps_tty_dcd_change(struct tty_struct *tty, bool active)
- pps_event(pps, &ts, active ? PPS_CAPTUREASSERT :
+@@ drivers/pps/clients/pps-ldisc.c: static void pps_tty_dcd_change(struct tty_struct *tty, unsigned int status)
+ pps_event(pps, &ts, status ? PPS_CAPTUREASSERT :
PPS_CAPTURECLEAR, NULL);
- dev_dbg(pps->dev, "PPS %s at %lu\n",
+ dev_dbg(&pps->dev, "PPS %s at %lu\n",
- active ? "assert" : "clear", jiffies);
+ status ? "assert" : "clear", jiffies);
}
@@ drivers/pps/clients/pps-ldisc.c: static int pps_tty_open(struct tty_struct *tty)
@@ drivers/pps/pps.c: EXPORT_SYMBOL(pps_lookup_dev);
{
- int err;
-
- pps_class = class_create("pps");
+ pps_class = class_create(THIS_MODULE, "pps");
if (IS_ERR(pps_class)) {
pr_err("failed to allocate class\n");
@@ drivers/pps/pps.c: static int __init pps_init(void)
@@ drivers/pps/pps.c: static int __init pps_init(void)
subsys_initcall(pps_init);
- ## drivers/ptp/ptp_ocp.c ##
-@@ drivers/ptp/ptp_ocp.c: ptp_ocp_complete(struct ptp_ocp *bp) -
- pps = pps_lookup_dev(bp->ptp);
- if (pps)
-- ptp_ocp_symlink(bp, pps->dev, "pps");
-+ ptp_ocp_symlink(bp, &pps->dev, "pps");
-
- ptp_ocp_debugfs_add_device(bp);
-
-
## include/linux/pps_kernel.h ##
@@ include/linux/pps_kernel.h: struct pps_device {
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Failed |
Build Errors:
Build error for stable/linux-5.10.y:
In file included from ./include/linux/kernel.h:15,
from ./include/linux/list.h:9,
from ./include/linux/kobject.h:19,
from ./include/linux/of.h:17,
from ./include/linux/clk-provider.h:9,
from drivers/clk/qcom/clk-rpmh.c:6:
drivers/clk/qcom/clk-rpmh.c: In function 'clk_rpmh_bcm_send_cmd':
./include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types]
20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
| ^~
./include/linux/minmax.h:26:18: note: in expansion of macro '__typecheck'
26 | (__typecheck(x, y) && __no_side_effects(x, y))
| ^~~~~~~~~~~
./include/linux/minmax.h:36:31: note: in expansion of macro '__safe_cmp'
36 | __builtin_choose_expr(__safe_cmp(x, y), \
| ^~~~~~~~~~
./include/linux/minmax.h:45:25: note: in expansion of macro '__careful_cmp'
45 | #define min(x, y) __careful_cmp(x, y, <)
| ^~~~~~~~~~~~~
drivers/clk/qcom/clk-rpmh.c:273:21: note: in expansion of macro 'min'
273 | cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK);
| ^~~
In file included from ./include/linux/mm.h:30,
from ./include/linux/pagemap.h:8,
from ./include/linux/buffer_head.h:14,
from fs/udf/udfdecl.h:12,
from fs/udf/super.c:41:
fs/udf/super.c: In function 'udf_fill_partdesc_info':
./include/linux/overflow.h:70:22: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types]
70 | (void) (&__a == &__b); \
| ^~
fs/udf/super.c:1155:21: note: in expansion of macro 'check_add_overflow'
1155 | if (check_add_overflow(map->s_partition_len,
| ^~~~~~~~~~~~~~~~~~
Segmentation fault
make: *** [Makefile:1207: vmlinux] Error 139
make: Target '__all' not remade because of errors.