Commit graph

3338 commits

Author SHA1 Message Date
Joe Hattori
7663d04594 ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
commit 676fe1f6f74db988191dab5df3bf256908177072 upstream.

The OF node reference obtained by of_parse_phandle_with_args() is not
released on early return. Add a of_node_put() call before returning.

Fixes: 8996b89d6bc9 ("ata: add platform driver for Calxeda AHCI controller")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-02 17:00:49 +01:00
Mark Tomlinson
73420703cc usb: host: max3421-hcd: Correctly abort a USB request.
commit 0d2ada05227881f3d0722ca2364e3f7a860a301f upstream.

If the current USB request was aborted, the spi thread would not respond
to any further requests. This is because the "curr_urb" pointer would
not become NULL, so no further requests would be taken off the queue.
The solution here is to set the "urb_done" flag, as this will cause the
correct handling of the URB. Also clear interrupts that should only be
expected if an URB is in progress.

Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Cc: stable <stable@kernel.org>
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20241124221430.1106080-1-mark.tomlinson@alliedtelesis.co.nz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-02 17:00:49 +01:00
a2c2b2e29e Revert "battery: sec_battery: export {CURRENT/VOLTAGE}_MAX to sysfs"
This reverts commit 2bda4b9d8f.
2024-12-18 20:58:37 +01:00
Jesse Chan
2bda4b9d8f battery: sec_battery: export {CURRENT/VOLTAGE}_MAX to sysfs
Change-Id: I54c775bb80c2151bdc69ea9fb53a48a34327bbef
2024-12-18 20:00:53 +01:00
Tim Zimmermann
1f0634fe2b drivers: net: wireless: scsc: don't delete or deactivate AP interface in slsi_del_station
* This function is meant for cleaning up going from STA to AP mode
* On latest 18.1 builds deleting/deactivating AP interface causes
  hotspot not to work, hostapd starts up and system says hotspot
  is on, but due to a kernel error (vif type isn't set to AP anymore)
  SSID isn't actually broadcasted and clients can't find nor connect
  to the hotspot
* So let's remove this as removing it doesn't seem to have any
  negative consequences but fixes hotspot, also disable an
  ugly warning caused by this which isn't actually a problem

Change-Id: I5a656fd38697b9be09ecdc5f344bc343458aeaaf
2024-12-18 19:46:36 +01:00
78cce1edd9 drivers: samsung: exynos-cpupm.c: Fully nuke cpupm_debug 2024-12-18 18:43:43 +01:00
94813c91ed drivers: samsung: exynos-cpupm.c: Fully nuke cpupm_debug_info 2024-12-18 18:41:51 +01:00
8e2888567b drivers: samsung: exynos-cpupm.c: Add #ifdef CONFIG__EXYNOS_DEBUG_INFO 2024-12-18 18:38:09 +01:00
041f237b67 drivers: samsung: exynos-cpupm.c: Switch from sched_clock to ktime_get 2024-12-18 18:32:21 +01:00
ae83e3b222 drivers: samsung: exynos-cpupm.c: Switch from cpu_clock to sched_clock 2024-12-18 18:31:07 +01:00
146859f714 drivers: samsung: exynos-cpupm.c: Switch from local_clock to ktime_get_ns 2024-12-18 18:30:28 +01:00
4780062b8a drivers: samsung: exynos-ehld.c: Nuke ehld->sjtag_en = dbg_snapshot_get_sjtag_status(); 2024-12-18 18:27:27 +01:00
87f1a878dc drivers: samsung: exynos-adv-tracer.c: Switch from local_clock to ktime_get_ns 2024-12-18 18:24:34 +01:00
Ksawlii
d2a123efff Revert "BACKPORT: FROMLIST: binder: fix freeze UAF in binder_release_work()"
This reverts commit 5380adeb80.
2024-12-18 15:46:58 +01:00
Ksawlii
d61e735066 Revert "BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze"
This reverts commit 1cf14664be.
2024-12-18 15:46:57 +01:00
Ksawlii
4a640601c9 Revert "BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output"
This reverts commit 4554485eb2.
2024-12-18 15:46:56 +01:00
Carlos Llamas
5380adeb80 BACKPORT: FROMLIST: binder: fix freeze UAF in binder_release_work()
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
  Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211

  CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
  Hardware name: linux,dummy-virt (DT)
  Workqueue: events binder_deferred_func
  Call trace:
   binder_release_work+0x398/0x3d0
   binder_deferred_func+0xb60/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8

  Allocated by task 703:
   __kmalloc_cache_noprof+0x130/0x280
   binder_thread_write+0xdb4/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190
   invoke_syscall+0x6c/0x254

  Freed by task 211:
   kfree+0xc4/0x230
   binder_deferred_func+0xae8/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8
  ==================================================================

This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 366003708
Link: https://lore.kernel.org/all/20240924184401.76043-4-cmllamas@google.com/
Change-Id: Icc40e7dd6157981f4adbea7243e55be118552321
[cmllamas: drop BINDER_STAT_FREEZE as it's not supported here]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-12-18 15:03:54 +01:00
Carlos Llamas
1cf14664be BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:

  unreferenced object 0xffff38e8cfa36180 (size 64):
    comm "binder-util", pid 655, jiffies 4294936641
    hex dump (first 32 bytes):
      b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff  .....8.......8..
      0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00  ........<.K.....
    backtrace (crc 95983b32):
      [<000000000d0582cf>] kmemleak_alloc+0x34/0x40
      [<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280
      [<00000000313b1704>] binder_thread_write+0xdec/0x439c
      [<000000000cbd33bb>] binder_ioctl+0x1b68/0x22cc
      [<000000002bbedeeb>] __arm64_sys_ioctl+0x124/0x190
      [<00000000b439adee>] invoke_syscall+0x6c/0x254
      [<00000000173558fc>] el0_svc_common.constprop.0+0xac/0x230
      [<0000000084f72311>] do_el0_svc+0x40/0x58
      [<000000008b872457>] el0_svc+0x38/0x78
      [<00000000ee778653>] el0t_64_sync_handler+0x120/0x12c
      [<00000000a8ec61bf>] el0t_64_sync+0x190/0x194

This patch fixes the leak by ensuring that any pending entries in
proc->delivered_freeze are freed during binder_deferred_release().

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-8-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 1db76ec2b4b206ff943e292a0b55e68ff3443598
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Iafdec3421c521b4b591b94455deba7ee5102c8ca
[cmllamas: drop BINDER_STAT_FREEZE and use binder_proc_ext_entry()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-12-18 15:03:35 +01:00
Carlos Llamas
4554485eb2 BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output
Add the pending proc->delivered_freeze work to the debugfs output. This
information was omitted in the original implementation of the freeze
notification and can be valuable for debugging issues.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-9-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit cb2aeb2ec25884133110ffe5a67ff3cf7dee5ceb
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Ifc9a22b52e38c35af661732486fa1f154adb34de
[cmllamas: fix KMI break with binder_proc_ext_entry()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-12-18 15:03:31 +01:00
Samuel Pascua
04ff6cbc91 drivers: soc: acpm: Prevent optimization of 'acpm_initdata'
More optimization issues when compiling with Clang. Panics happen when the device goes into standby with the following report.

<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM:: MIF down. cur_count: 5, acc_count: 5
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM:: MIF_UP history:
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM: mifuser: 0x540000, time: 5:35:40, latency: 1955[usec]
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM: mifuser: 0x400000, time: 5:35:40, latency: 1956[usec]
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM: mifuser: 0x100000, time: 5:35:41, latency: 1954[usec]
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM: mifuser: 0x400000, time: 5:35:41, latency: 1955[usec]
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] EXYNOS-PM: mifuser: 0x100000, time: 5:35:41, latency: 1955[usec]
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] Unable to handle kernel paging request at virtual address ffffff800b346f9c
<2>[ 1470.900859]  [0:  Binder:4157_2: 8735] sec_debug_set_extra_info_fault = KERN / 0xffffff800b346f9c
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735] Mem abort info:
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735]   Exception class = DABT (current EL), IL = 32 bits
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735]   SET = 0, FnV = 0
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735]   EA = 0, S1PTW = 0
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735] Data abort info:
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735]   ISV = 0, ISS = 0x00000061
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735]   CM = 0, WnR = 1
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735] swapper pgtable: 4k pages, 39-bit VAs, pgd = ffffff800a66a000
<1>[ 1470.900859]  [0:  Binder:4157_2: 8735] [ffffff800b346f9c] *pgd=000000097cdfe003, *pud=000000097cdfe003, *pmd=00000009740b7003, *pte=00e800000203f707
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] Internal error: Oops: 96000061 [#1] PREEMPT SMP
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] Modules linked in:
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] Process Binder:4157_2 (pid: 8735, stack limit = 0xffffff8039708000)
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] debug-snapshot: core register saved(CPU:0)
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] L2ECTLR_EL1: 0000000000000007
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] L2ECTLR_EL1 valid_bit(30) is NOT set (0x0)
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] CPUMERRSR: 0000000008000001, L2MERRSR: 0000000010200c00
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] CPUMERRSR valid_bit(31) is NOT set (0x0)
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] L2MERRSR valid_bit(31) is NOT set (0x0)
<0>[ 1470.900859]  [0:  Binder:4157_2: 8735] debug-snapshot: context saved(CPU:0)
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] debug-snapshot: item - log_kevents is disabled
<6>[ 1470.900859]  [0:  Binder:4157_2: 8735] TIF_FOREIGN_FPSTATE: 1, FP/SIMD depth 0, cpu: 0
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] CPU: 0 PID: 8735 Comm: Binder:4157_2 Not tainted 4.14.113 - Fresh Core-user #1
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] Hardware name: Samsung A50 LTN OPEN rev04 board based on Exynos9610 (DT)
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] task: ffffffc0466d6000 task.stack: ffffff8039708000
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] PC is at acpm_get_inform+0x90/0x100
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] LR is at acpm_get_inform+0x7c/0x100
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] pc : [<ffffff8008505cd4>] lr : [<ffffff8008505cc0>] pstate: 604001c5
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] sp : ffffff803970bac0
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x29: ffffff803970bac0 x28: ffffffc0466d6000
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x27: ffffff8008e44b64 x26: ffffff8008e44b3e
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x25: ffffff8009e5f210 x24: 0000000010624dd3
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x23: 0000000000000029 x22: 0000000000000018
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x21: ffffff8009e2c000 x20: ffffff8008ef6785
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x19: ffffff8008ef674c x18: 00000000000000a0
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x17: ffffff8009b3023c x16: 0000000000000001
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x15: ffffff8008c8a964 x14: 202c303030303031
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x13: 7830203a72657375 x12: 0000000000000000
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x11: 0000000000000000 x10: ffffffffffffffff
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x9 : ffffff800b346f00 x8 : ffffff800b346f00
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x7 : 203a79636e657461 x6 : ffffff80f615273c
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x5 : 000000000000221f x4 : 000000000000000c
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x3 : 000000000000000a x2 : 0000000000000000
<4>[ 1470.900859]  [0:  Binder:4157_2: 8735] x1 : 00000000000001c0 x0 : 0000000000000041

Similar solution as d855e6f. Make the structs volatile to prevent optimization.

Signed-off-by: John Vincent <git@tensevntysevn.cf>
Signed-off-by: Samuel Pascua <sgpascua@ngcp.ph>
2024-12-18 15:02:50 +01:00
xxmustafacooTR
5843cd8543 drivers: soc: samsung: acpm: disable lto 2024-12-18 15:02:45 +01:00
xxmustafacooTR
9ca91577b1 fvmap: optimize voltages 2024-12-18 15:02:40 +01:00
Redick Lin
70c79241d2 soc: samsung: acpm: extend the timeout for acpm ipc retry
Extend it from 15ms to 200ms

Bug: 172883429
Change-Id: I39e8e860dfeaa4d1d3b702f06dca51dd01bc8367
Signed-off-by: Redick Lin <redicklin@google.com>
2024-12-18 15:02:36 +01:00
Nahuel Gómez
27515e820a battery: sm5451_charger: fix build on 5.10
debugfs_create_x32 is a void.

Signed-off-by: Nahuel Gómez <nahuelgomez329@gmail.com>
2024-12-18 12:15:56 +01:00
Nahuel Gómez
7fb3935edb battery: import sm5451_charger driver from F926B
Signed-off-by: Nahuel Gómez <nahuelgomez329@gmail.com>
2024-12-18 12:15:51 +01:00
Nahuel Gómez
cb6a5e60da battery: nuke sm5451_charger driver from a53x
Signed-off-by: Nahuel Gómez <nahuelgomez329@gmail.com>
2024-12-18 12:15:46 +01:00
1bcc615dc7 Reapply "mfc: Import IS_UHD_RES definition"
This reverts commit d9434755e0.
2024-12-18 11:46:00 +01:00
427697671c Reapply "mfc: Reduce QoS boosting from Samsung hacks"
This reverts commit e1b24976b4.
2024-12-18 11:25:12 +01:00
0a8f9b7b96 Reapply "media: v4l: Use interruptible waits"
This reverts commit 1d724a61ea.
2024-12-18 11:24:07 +01:00
d9434755e0 Revert "mfc: Import IS_UHD_RES definition"
This reverts commit 50f2fde1f2.
2024-12-18 11:06:02 +01:00
1d724a61ea Revert "media: v4l: Use interruptible waits"
This reverts commit 4c1b6e4beb.
2024-12-18 09:40:12 +01:00
e1b24976b4 Revert "mfc: Reduce QoS boosting from Samsung hacks"
This reverts commit 9ba60fb174.
2024-12-17 23:31:44 +01:00
Ksawlii
87f89d5a22 drivers: media,net,staging: Make temp_buffer unused 2024-12-17 23:12:17 +01:00
ed56d57a18 drivers: media,net,staging: Nuke ld.lld warnings 2024-12-17 22:23:59 +01:00
8530406bc1 drivers: exynos: camera: is-vender.c: Specify enum camera2_sensor_hdr_mode 2024-12-17 22:01:43 +01:00
48e91d7106 drivers: sm5714_typec.c: Specify enum typec_port_type 2024-12-17 21:57:37 +01:00
7fc0858b6e drivers: sec_input: stm_cmd.c: Expand snprintf sizes 2024-12-17 21:43:20 +01:00
yehonatan2020
50f2fde1f2 mfc: Import IS_UHD_RES definition 2024-12-17 20:32:27 +01:00
ThunderStorms21th
4c1b6e4beb media: v4l: Use interruptible waits
Allow these tasks to be preempted in order to reduce latency.

Signed-off-by: Tyler Nijmeh <tylernij@gmail.com>
Signed-off-by: Forenche <prahul2003@gmail.com>
Signed-off-by: John Vincent <git@tensevntysevn.cf>

Signed-off-by: ThunderStorms21th <pinakastorm@gmail.com>
2024-12-17 20:24:21 +01:00
ThunderStorms21th
9ba60fb174 mfc: Reduce QoS boosting from Samsung hacks
By default, everything is set to 240fps for optimal playback performance However, the situation is not always true, as it applies to cases when the video bitrate isn't necessarily high, causing high power consumption

Reduce and limit the boosting needed. For decoder, only apply for UHD
video resolution

Signed-off-by: Diep Quynh <remilia.1505@gmail.com>
[TenSeventy7: Negative unsigned integer fixes already present on 9610]
Signed-off-by: John Vincent <git@tensevntysevn.cf>

Signed-off-by: ThunderStorms21th <pinakastorm@gmail.com>
2024-12-17 20:24:17 +01:00
Nahuel Gómez
e52d6db0bf fvmap: set undervolt to -4%
This should be more stable for all users.

Signed-off-by: Nahuel Gómez <nahuelgomez329@gmail.com>
2024-12-17 19:42:15 +01:00
Dan Carpenter
aa7844c04c octeontx2-pf: Fix otx2_get_fecparam()
commit 38b5133ad607ecdcc8d24906d1ac9cc8df41acd5 upstream.

Static checkers complained about an off by one read overflow in
otx2_get_fecparam() and we applied two conflicting fixes for it.

Correct: b0aae0bde26f ("octeontx2: Fix condition.")
  Wrong: 93efb0c65683 ("octeontx2-pf: Fix out-of-bounds read in otx2_get_fecparam()")

Revert the incorrect fix.

Fixes: 93efb0c65683 ("octeontx2-pf: Fix out-of-bounds read in otx2_get_fecparam()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:35 +01:00
David S. Miller
c6ba8a5b1b octeontx2: Fix condition.
commit b0aae0bde26f276401640e05e81a8a0ce3d8f70e upstream.

Fixes: 93efb0c656837 ("octeontx2-pf: Fix out-of-bounds read in otx2_get_fecparam()")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:35 +01:00
Thadeu Lima de Souza Cascardo
68a21184eb media: uvcvideo: Require entities to have a non-zero unique ID
commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195 upstream.

Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
unique ID.

```
Each Unit and Terminal within the video function is assigned a unique
identification number, the Unit ID (UID) or Terminal ID (TID), contained in
the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
reserved for undefined ID,
```

So, deny allocating an entity with ID 0 or an ID that belongs to a unit
that is already added to the list of entities.

This also prevents some syzkaller reproducers from triggering warnings due
to a chain of entities referring to themselves. In one particular case, an
Output Unit is connected to an Input Unit, both with the same ID of 1. But
when looking up for the source ID of the Output Unit, that same entity is
found instead of the input entity, which leads to such warnings.

In another case, a backward chain was considered finished as the source ID
was 0. Later on, that entity was found, but its pads were not valid.

Here is a sample stack trace for one of those cases.

[   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   20.830206] usb 1-1: Using ep0 maxpacket: 8
[   20.833501] usb 1-1: config 0 descriptor??
[   21.038518] usb 1-1: string descriptor 0 read error: -71
[   21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
[   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
[   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
[   21.042218] ------------[ cut here ]------------
[   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
[   21.043195] Modules linked in:
[   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
[   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[   21.044639] Workqueue: usb_hub_wq hub_event
[   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
[   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
[   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
[   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
[   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
[   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
[   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
[   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
[   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
[   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
[   21.051136] PKRU: 55555554
[   21.051331] Call Trace:
[   21.051480]  <TASK>
[   21.051611]  ? __warn+0xc4/0x210
[   21.051861]  ? media_create_pad_link+0x2c4/0x2e0
[   21.052252]  ? report_bug+0x11b/0x1a0
[   21.052540]  ? trace_hardirqs_on+0x31/0x40
[   21.052901]  ? handle_bug+0x3d/0x70
[   21.053197]  ? exc_invalid_op+0x1a/0x50
[   21.053511]  ? asm_exc_invalid_op+0x1a/0x20
[   21.053924]  ? media_create_pad_link+0x91/0x2e0
[   21.054364]  ? media_create_pad_link+0x2c4/0x2e0
[   21.054834]  ? media_create_pad_link+0x91/0x2e0
[   21.055131]  ? _raw_spin_unlock+0x1e/0x40
[   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210
[   21.055837]  uvc_mc_register_entities+0x358/0x400
[   21.056144]  uvc_register_chains+0x1fd/0x290
[   21.056413]  uvc_probe+0x380e/0x3dc0
[   21.056676]  ? __lock_acquire+0x5aa/0x26e0
[   21.056946]  ? find_held_lock+0x33/0xa0
[   21.057196]  ? kernfs_activate+0x70/0x80
[   21.057533]  ? usb_match_dynamic_id+0x1b/0x70
[   21.057811]  ? find_held_lock+0x33/0xa0
[   21.058047]  ? usb_match_dynamic_id+0x55/0x70
[   21.058330]  ? lock_release+0x124/0x260
[   21.058657]  ? usb_match_one_id_intf+0xa2/0x100
[   21.058997]  usb_probe_interface+0x1ba/0x330
[   21.059399]  really_probe+0x1ba/0x4c0
[   21.059662]  __driver_probe_device+0xb2/0x180
[   21.059944]  driver_probe_device+0x5a/0x100
[   21.060170]  __device_attach_driver+0xe9/0x160
[   21.060427]  ? __pfx___device_attach_driver+0x10/0x10
[   21.060872]  bus_for_each_drv+0xa9/0x100
[   21.061312]  __device_attach+0xed/0x190
[   21.061812]  device_initial_probe+0xe/0x20
[   21.062229]  bus_probe_device+0x4d/0xd0
[   21.062590]  device_add+0x308/0x590
[   21.062912]  usb_set_configuration+0x7b6/0xaf0
[   21.063403]  usb_generic_driver_probe+0x36/0x80
[   21.063714]  usb_probe_device+0x7b/0x130
[   21.063936]  really_probe+0x1ba/0x4c0
[   21.064111]  __driver_probe_device+0xb2/0x180
[   21.064577]  driver_probe_device+0x5a/0x100
[   21.065019]  __device_attach_driver+0xe9/0x160
[   21.065403]  ? __pfx___device_attach_driver+0x10/0x10
[   21.065820]  bus_for_each_drv+0xa9/0x100
[   21.066094]  __device_attach+0xed/0x190
[   21.066535]  device_initial_probe+0xe/0x20
[   21.066992]  bus_probe_device+0x4d/0xd0
[   21.067250]  device_add+0x308/0x590
[   21.067501]  usb_new_device+0x347/0x610
[   21.067817]  hub_event+0x156b/0x1e30
[   21.068060]  ? process_scheduled_works+0x48b/0xaf0
[   21.068337]  process_scheduled_works+0x5a3/0xaf0
[   21.068668]  worker_thread+0x3cf/0x560
[   21.068932]  ? kthread+0x109/0x1b0
[   21.069133]  kthread+0x197/0x1b0
[   21.069343]  ? __pfx_worker_thread+0x10/0x10
[   21.069598]  ? __pfx_kthread+0x10/0x10
[   21.069908]  ret_from_fork+0x32/0x40
[   21.070169]  ? __pfx_kthread+0x10/0x10
[   21.070424]  ret_from_fork_asm+0x1a/0x30
[   21.070737]  </TASK>

Cc: stable@vger.kernel.org
Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
Reported-by: syzbot+dd320d114deb3f5bb79b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20240913180601.1400596-2-cascardo@igalia.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ ribalda: The context around the changes differs from master. This
  version is also missing the gpio unit, so that part is gone from the
  patch. ]
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:35 +01:00
Damien Le Moal
112d05a5ec scsi: core: Fix scsi_mode_select() buffer length handling
commit a7d6840bed0c2b16ac3071b74b5fcf08fc488241 upstream.

The MODE SELECT(6) command allows handling mode page buffers that are up to
255 bytes, including the 4 byte header needed in front of the page
buffer. For requests larger than this limit, automatically use the MODE
SELECT(10) command.

In both cases, since scsi_mode_select() adds the mode select page header,
checks on the buffer length value must include this header size to avoid
overflows of the command CDB allocation length field.

While at it, use put_unaligned_be16() for setting the header block
descriptor length and CDB allocation length when using MODE SELECT(10).

[mkp: fix MODE SENSE vs. MODE SELECT confusion]

Link: https://lore.kernel.org/r/20210820070255.682775-3-damien.lemoal@wdc.com
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:35 +01:00
Damien Le Moal
a01e4e46e9 scsi: sd: Fix sd_do_mode_sense() buffer length handling
commit c749301ebee82eb5e97dec14b6ab31a4aabe37a6 upstream.

For devices that explicitly asked for MODE SENSE(10) use, make sure that
scsi_mode_sense() is called with a buffer of at least 8 bytes so that the
sense header fits.

Link: https://lore.kernel.org/r/20210820070255.682775-4-damien.lemoal@wdc.com
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:35 +01:00
Damien Le Moal
0f475924d6 PCI: rockchip-ep: Fix address translation unit programming
commit 64f093c4d99d797b68b407a9d8767aadc3e3ea7a upstream.

The Rockchip PCIe endpoint controller handles PCIe transfers addresses
by masking the lower bits of the programmed PCI address and using the
same number of lower bits masked from the CPU address space used for the
mapping. For a PCI mapping of <size> bytes starting from <pci_addr>,
the number of bits masked is the number of address bits changing in the
address range [pci_addr..pci_addr + size - 1].

However, rockchip_pcie_prog_ep_ob_atu() calculates num_pass_bits only
using the size of the mapping, resulting in an incorrect number of mask
bits depending on the value of the PCI address to map.

Fix this by introducing the helper function
rockchip_pcie_ep_ob_atu_num_bits() to correctly calculate the number of
mask bits to use to program the address translation unit. The number of
mask bits is calculated depending on both the PCI address and size of
the mapping, and clamped between 8 and 20 using the macros
ROCKCHIP_PCIE_AT_MIN_NUM_BITS and ROCKCHIP_PCIE_AT_MAX_NUM_BITS. As
defined in the Rockchip RK3399 TRM V1.3 Part2, Sections 17.5.5.1.1 and
17.6.8.2.1, this clamping is necessary because:

  1) The lower 8 bits of the PCI address to be mapped by the outbound
     region are ignored. So a minimum of 8 address bits are needed and
     imply that the PCI address must be aligned to 256.

  2) The outbound memory regions are 1MB in size. So while we can specify
     up to 63-bits for the PCI address (num_bits filed uses bits 0 to 5 of
     the outbound address region 0 register), we must limit the number of
     valid address bits to 20 to match the memory window maximum size (1
     << 20 = 1MB).

Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller")
Link: https://lore.kernel.org/r/20241017015849.190271-2-dlemoal@kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:35 +01:00
Zhang Zekun
d465ae6259 Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
This reverts commit 17f5f18085acb5e9d8d13d84a4e12bb3aff2bd64.

The origin mainline patch fix a buffer overflow issue in
amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel
6.1 and older kernels. This patch add a check in a wrong function in the
same file.

Signed-off-by: Zhang Zekun <zhangzekun11@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:34 +01:00
Alex Hung
bb0bca6758 drm/amd/display: Check BIOS images before it is used
commit 8b0ddf19cca2a352b2a7e01d99d3ba949a99c84c upstream.

BIOS images may fail to load and null checks are added before they are
used.

This fixes 6 NULL_RETURNS issues reported by Coverity.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:34 +01:00
Mathias Nyman
1139c4ae84 xhci: dbc: Fix STALL transfer event handling
commit 9044ad57b60b0556d42b6f8aa218a68865e810a4 upstream.

Don't flush all pending DbC data requests when an endpoint halts.

An endpoint may halt and xHC DbC triggers a STALL error event if there's
an issue with a bulk data transfer. The transfer should restart once xHC
DbC receives a ClearFeature(ENDPOINT_HALT) request from the host.

Once xHC DbC restarts it will start from the TRB pointed to by dequeue
field in the endpoint context, which might be the same TRB we got the
STALL event for. Turn the TRB to a no-op in this case to make sure xHC
DbC doesn't reuse and tries to retransmit this same TRB after we already
handled it, and gave its corresponding data request back.

Other STALL events might be completely bogus.
Lukasz Bartosik discovered that xHC DbC might issue spurious STALL events
if hosts sends a ClearFeature(ENDPOINT_HALT) request to non-halted
endpoints even without any active bulk transfers.

Assume STALL event is spurious if it reports 0 bytes transferred, and
the endpoint stopped on the STALLED TRB.
Don't give back the data request corresponding to the TRB in this case.

The halted status is per endpoint. Track it with a per endpoint flag
instead of the driver invented DbC wide DS_STALLED state.
DbC remains in DbC-Configured state even if endpoints halt. There is no
Stalled state in the DbC Port state Machine (xhci section 7.6.6)

Reported-by: Łukasz Bartosik <ukaszb@chromium.org>
Closes: https://lore.kernel.org/linux-usb/20240725074857.623299-1-ukaszb@chromium.org/
Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240905143300.1959279-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:24:34 +01:00