September 2022 - Linux-stable-mirror

FAILED: patch "[PATCH] tty: n_gsm: avoid call of sleeping functions from atomic" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 902e02ea9385 ("tty: n_gsm: avoid call of sleeping functions from atomic context") c9ab053e56ce ("tty: n_gsm: replace kicktimer with delayed_work") 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") 32dd59f96924 ("tty: n_gsm: fix race condition in gsmld_write()") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 902e02ea9385373ce4b142576eef41c642703955 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin <pchelkin(a)ispras.ru> Date: Mon, 29 Aug 2022 16:16:40 +0300 Subject: [PATCH] tty: n_gsm: avoid call of sleeping functions from atomic context Syzkaller reports the following problem: BUG: sleeping function called from invalid context at kernel/printk/printk.c:2347 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-executor423 3 locks held by syz-executor423/1105: #0: ffff8881468b9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x90 drivers/tty/tty_ldisc.c:266 #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: tty_write_lock drivers/tty/tty_io.c:952 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: do_tty_write drivers/tty/tty_io.c:975 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write.constprop.0+0x2a8/0x8e0 drivers/tty/tty_io.c:1118 #2: ffff88801b06c398 (&gsm->tx_lock){....}-{2:2}, at: gsmld_write+0x5e/0x150 drivers/tty/n_gsm.c:2717 irq event stamp: 3482 hardirqs last enabled at (3481): [<ffffffff81d13343>] __get_reqs_available+0x143/0x2f0 fs/aio.c:946 hardirqs last disabled at (3482): [<ffffffff87d39722>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3482): [<ffffffff87d39722>] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:159 softirqs last enabled at (3408): [<ffffffff87e01002>] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (3401): [<ffffffff87e01002>] asm_call_irq_on_stack+0x12/0x20 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 2 PID: 1105 Comm: syz-executor423 Not tainted 5.10.137-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 ___might_sleep.cold+0x1e8/0x22e kernel/sched/core.c:7304 console_lock+0x19/0x80 kernel/printk/printk.c:2347 do_con_write+0x113/0x1de0 drivers/tty/vt/vt.c:2909 con_write+0x22/0xc0 drivers/tty/vt/vt.c:3296 gsmld_write+0xd0/0x150 drivers/tty/n_gsm.c:2720 do_tty_write drivers/tty/tty_io.c:1028 [inline] file_tty_write.constprop.0+0x502/0x8e0 drivers/tty/tty_io.c:1118 call_write_iter include/linux/fs.h:1903 [inline] aio_write+0x355/0x7b0 fs/aio.c:1580 __io_submit_one fs/aio.c:1952 [inline] io_submit_one+0xf45/0x1a90 fs/aio.c:1999 __do_sys_io_submit fs/aio.c:2058 [inline] __se_sys_io_submit fs/aio.c:2028 [inline] __x64_sys_io_submit+0x18c/0x2f0 fs/aio.c:2028 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 The problem happens in the following control flow: gsmld_write(...) spin_lock_irqsave(&gsm->tx_lock, flags) // taken a spinlock on TX data con_write(...) do_con_write(...) console_lock() might_sleep() // -> bug As far as console_lock() might sleep it should not be called with spinlock held. The patch replaces tx_lock spinlock with mutex in order to avoid the problem. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 32dd59f96924 ("tty: n_gsm: fix race condition in gsmld_write()") Cc: stable <stable(a)kernel.org> Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Link: https://lore.kernel.org/r/20220829131640.69254-3-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index e23225aff5d9..01c112e2e214 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -248,7 +248,7 @@ struct gsm_mux { bool constipated; /* Asked by remote to shut up */ bool has_devices; /* Devices were registered */ - spinlock_t tx_lock; + struct mutex tx_mutex; unsigned int tx_bytes; /* TX data outstanding */ #define TX_THRESH_HI 8192 #define TX_THRESH_LO 2048 @@ -680,7 +680,6 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control) struct gsm_msg *msg; u8 *dp; int ocr; - unsigned long flags; msg = gsm_data_alloc(gsm, addr, 0, control); if (!msg) @@ -702,10 +701,10 @@ static int gsm_send(struct gsm_mux *gsm, int addr, int cr, int control) gsm_print_packet("Q->", addr, cr, control, NULL, 0); - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); list_add_tail(&msg->list, &gsm->tx_ctrl_list); gsm->tx_bytes += msg->len; - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); gsmld_write_trigger(gsm); return 0; @@ -730,7 +729,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci) spin_unlock_irqrestore(&dlci->lock, flags); /* Clear data packets in MUX write queue */ - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); list_for_each_entry_safe(msg, nmsg, &gsm->tx_data_list, list) { if (msg->addr != addr) continue; @@ -738,7 +737,7 @@ static void gsm_dlci_clear_queues(struct gsm_mux *gsm, struct gsm_dlci *dlci) list_del(&msg->list); kfree(msg); } - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); } /** @@ -1024,10 +1023,9 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) { - unsigned long flags; - spin_lock_irqsave(&dlci->gsm->tx_lock, flags); + mutex_lock(&dlci->gsm->tx_mutex); __gsm_data_queue(dlci, msg); - spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); + mutex_unlock(&dlci->gsm->tx_mutex); } /** @@ -1039,7 +1037,7 @@ static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) * is data. Keep to the MRU of the mux. This path handles the usual tty * interface which is a byte stream with optional modem data. * - * Caller must hold the tx_lock of the mux. + * Caller must hold the tx_mutex of the mux. */ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) @@ -1099,7 +1097,7 @@ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) * is data. Keep to the MRU of the mux. This path handles framed data * queued as skbuffs to the DLCI. * - * Caller must hold the tx_lock of the mux. + * Caller must hold the tx_mutex of the mux. */ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, @@ -1115,7 +1113,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, if (dlci->adaption == 4) overhead = 1; - /* dlci->skb is locked by tx_lock */ + /* dlci->skb is locked by tx_mutex */ if (dlci->skb == NULL) { dlci->skb = skb_dequeue_tail(&dlci->skb_list); if (dlci->skb == NULL) @@ -1169,7 +1167,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, * Push an empty frame in to the transmit queue to update the modem status * bits and to transmit an optional break. * - * Caller must hold the tx_lock of the mux. + * Caller must hold the tx_mutex of the mux. */ static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci, @@ -1283,13 +1281,12 @@ static int gsm_dlci_data_sweep(struct gsm_mux *gsm) static void gsm_dlci_data_kick(struct gsm_dlci *dlci) { - unsigned long flags; int sweep; if (dlci->constipated) return; - spin_lock_irqsave(&dlci->gsm->tx_lock, flags); + mutex_lock(&dlci->gsm->tx_mutex); /* If we have nothing running then we need to fire up */ sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO); if (dlci->gsm->tx_bytes == 0) { @@ -1300,7 +1297,7 @@ static void gsm_dlci_data_kick(struct gsm_dlci *dlci) } if (sweep) gsm_dlci_data_sweep(dlci->gsm); - spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); + mutex_unlock(&dlci->gsm->tx_mutex); } /* @@ -1994,14 +1991,13 @@ static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len) static void gsm_kick_timeout(struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); - unsigned long flags; int sent = 0; - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); /* If we have nothing running then we need to fire up */ if (gsm->tx_bytes < TX_THRESH_LO) sent = gsm_dlci_data_sweep(gsm); - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); if (sent && debug & 4) pr_info("%s TX queue stalled\n", __func__); @@ -2531,6 +2527,7 @@ static void gsm_free_mux(struct gsm_mux *gsm) break; } } + mutex_destroy(&gsm->tx_mutex); mutex_destroy(&gsm->mutex); kfree(gsm->txframe); kfree(gsm->buf); @@ -2602,6 +2599,7 @@ static struct gsm_mux *gsm_alloc_mux(void) } spin_lock_init(&gsm->lock); mutex_init(&gsm->mutex); + mutex_init(&gsm->tx_mutex); kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); @@ -2610,7 +2608,6 @@ static struct gsm_mux *gsm_alloc_mux(void) INIT_WORK(&gsm->tx_work, gsmld_write_task); init_waitqueue_head(&gsm->event); spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2635,6 +2632,7 @@ static struct gsm_mux *gsm_alloc_mux(void) } spin_unlock(&gsm_mux_lock); if (i == MAX_MUX) { + mutex_destroy(&gsm->tx_mutex); mutex_destroy(&gsm->mutex); kfree(gsm->txframe); kfree(gsm->buf); @@ -2790,17 +2788,16 @@ static void gsmld_write_trigger(struct gsm_mux *gsm) static void gsmld_write_task(struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work); - unsigned long flags; int i, ret; /* All outstanding control channel and control messages and one data * frame is sent. */ ret = -ENODEV; - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); if (gsm->tty) ret = gsm_data_kick(gsm); - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); if (ret >= 0) for (i = 0; i < NUM_DLCI; i++) @@ -3008,7 +3005,6 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, const unsigned char *buf, size_t nr) { struct gsm_mux *gsm = tty->disc_data; - unsigned long flags; int space; int ret; @@ -3016,13 +3012,13 @@ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, return -ENODEV; ret = -ENOBUFS; - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); space = tty_write_room(tty); if (space >= nr) ret = tty->ops->write(tty, buf, nr); else set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); return ret; } @@ -3319,14 +3315,13 @@ static struct tty_ldisc_ops tty_ldisc_packet = { static void gsm_modem_upd_via_data(struct gsm_dlci *dlci, u8 brk) { struct gsm_mux *gsm = dlci->gsm; - unsigned long flags; if (dlci->state != DLCI_OPEN || dlci->adaption != 2) return; - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); gsm_dlci_modem_output(gsm, dlci, brk); - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); } /**

2 years

1
0
0 0

FAILED: patch "[PATCH] tty: n_gsm: replace kicktimer with delayed_work" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: c9ab053e56ce ("tty: n_gsm: replace kicktimer with delayed_work") 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") 06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2") 284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From c9ab053e56ce13a949977398c8edc12e6c02fc95 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin <pchelkin(a)ispras.ru> Date: Mon, 29 Aug 2022 16:16:39 +0300 Subject: [PATCH] tty: n_gsm: replace kicktimer with delayed_work A kick_timer timer_list is replaced with kick_timeout delayed_work to be able to synchronize with mutexes as a prerequisite for the introduction of tx_mutex. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") Cc: stable <stable(a)kernel.org> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Suggested-by: Hillf Danton <hdanton(a)sina.com> Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Link: https://lore.kernel.org/r/20220829131640.69254-2-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index d6598ca3640f..e23225aff5d9 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -256,7 +256,7 @@ struct gsm_mux { struct list_head tx_data_list; /* Pending data packets */ /* Control messages */ - struct timer_list kick_timer; /* Kick TX queuing on timeout */ + struct delayed_work kick_timeout; /* Kick TX queuing on timeout */ struct timer_list t2_timer; /* Retransmit timer for commands */ int cretries; /* Command retry counter */ struct gsm_control *pending_cmd;/* Our current pending command */ @@ -1009,7 +1009,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) gsm->tx_bytes += msg->len; gsmld_write_trigger(gsm); - mod_timer(&gsm->kick_timer, jiffies + 10 * gsm->t1 * HZ / 100); + schedule_delayed_work(&gsm->kick_timeout, 10 * gsm->t1 * HZ / 100); } /** @@ -1984,16 +1984,16 @@ static void gsm_dlci_command(struct gsm_dlci *dlci, const u8 *data, int len) } /** - * gsm_kick_timer - transmit if possible - * @t: timer contained in our gsm object + * gsm_kick_timeout - transmit if possible + * @work: work contained in our gsm object * * Transmit data from DLCIs if the queue is empty. We can't rely on * a tty wakeup except when we filled the pipe so we need to fire off * new data ourselves in other cases. */ -static void gsm_kick_timer(struct timer_list *t) +static void gsm_kick_timeout(struct work_struct *work) { - struct gsm_mux *gsm = from_timer(gsm, t, kick_timer); + struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); unsigned long flags; int sent = 0; @@ -2458,7 +2458,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) } /* Finish outstanding timers, making sure they are done */ - del_timer_sync(&gsm->kick_timer); + cancel_delayed_work_sync(&gsm->kick_timeout); del_timer_sync(&gsm->t2_timer); /* Finish writing to ldisc */ @@ -2605,7 +2605,7 @@ static struct gsm_mux *gsm_alloc_mux(void) kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); + INIT_DELAYED_WORK(&gsm->kick_timeout, gsm_kick_timeout); timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); INIT_WORK(&gsm->tx_work, gsmld_write_task); init_waitqueue_head(&gsm->event);

2 years

1
0
0 0

FAILED: patch "[PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") 06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2") 284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device") 1ec92e974277 ("tty: n_gsm: fix decoupled mux resource") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Sat, 27 Aug 2022 22:47:19 +0900 Subject: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux() syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Cc: stable <stable(a)kernel.org> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 38688cb16c20..d6598ca3640f 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm) if (dlci == NULL) return -ENOMEM; - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - init_waitqueue_head(&gsm->event); - spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); - if (gsm->encoding == 0) gsm->receive = gsm0_receive; else @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void) kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); + INIT_WORK(&gsm->tx_work, gsmld_write_task); + init_waitqueue_head(&gsm->event); + spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty) gsmld_attach_gsm(tty, gsm); - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - return 0; }

2 years

1
0
0 0

FAILED: patch "[PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") 06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2") 284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device") 1ec92e974277 ("tty: n_gsm: fix decoupled mux resource") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Sat, 27 Aug 2022 22:47:19 +0900 Subject: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux() syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Cc: stable <stable(a)kernel.org> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 38688cb16c20..d6598ca3640f 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm) if (dlci == NULL) return -ENOMEM; - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - init_waitqueue_head(&gsm->event); - spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); - if (gsm->encoding == 0) gsm->receive = gsm0_receive; else @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void) kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); + INIT_WORK(&gsm->tx_work, gsmld_write_task); + init_waitqueue_head(&gsm->event); + spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty) gsmld_attach_gsm(tty, gsm); - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - return 0; }

2 years

1
0
0 0

FAILED: patch "[PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") 06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2") 284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device") 1ec92e974277 ("tty: n_gsm: fix decoupled mux resource") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Sat, 27 Aug 2022 22:47:19 +0900 Subject: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux() syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Cc: stable <stable(a)kernel.org> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 38688cb16c20..d6598ca3640f 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm) if (dlci == NULL) return -ENOMEM; - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - init_waitqueue_head(&gsm->event); - spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); - if (gsm->encoding == 0) gsm->receive = gsm0_receive; else @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void) kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); + INIT_WORK(&gsm->tx_work, gsmld_write_task); + init_waitqueue_head(&gsm->event); + spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty) gsmld_attach_gsm(tty, gsm); - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - return 0; }

2 years

1
0
0 0

FAILED: patch "[PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") 06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2") 284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device") 1ec92e974277 ("tty: n_gsm: fix decoupled mux resource") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Sat, 27 Aug 2022 22:47:19 +0900 Subject: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux() syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Cc: stable <stable(a)kernel.org> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 38688cb16c20..d6598ca3640f 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm) if (dlci == NULL) return -ENOMEM; - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - init_waitqueue_head(&gsm->event); - spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); - if (gsm->encoding == 0) gsm->receive = gsm0_receive; else @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void) kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); + INIT_WORK(&gsm->tx_work, gsmld_write_task); + init_waitqueue_head(&gsm->event); + spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty) gsmld_attach_gsm(tty, gsm); - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - return 0; }

2 years

1
0
0 0

FAILED: patch "[PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()") 734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()") 0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path") bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off") c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") 556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()") 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") 925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output") f4f7d6328721 ("tty: n_gsm: fix software flow control handling") c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option") a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling") 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") 73029a4d7161 ("tty: n_gsm: fix reset fifo race condition") 398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding") 17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush") deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order") 7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling") 06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2") 284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device") 1ec92e974277 ("tty: n_gsm: fix decoupled mux resource") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Date: Sat, 27 Aug 2022 22:47:19 +0900 Subject: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux() syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+cf155def4e717db68a12(a)syzkaller.appspotmail.com> Cc: stable <stable(a)kernel.org> Acked-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKUR… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 38688cb16c20..d6598ca3640f 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm) if (dlci == NULL) return -ENOMEM; - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - init_waitqueue_head(&gsm->event); - spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); - if (gsm->encoding == 0) gsm->receive = gsm0_receive; else @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void) kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); + INIT_WORK(&gsm->tx_work, gsmld_write_task); + init_waitqueue_head(&gsm->event); + spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty) gsmld_attach_gsm(tty, gsm); - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - INIT_WORK(&gsm->tx_work, gsmld_write_task); - return 0; }

2 years

1
0
0 0

FAILED: patch "[PATCH] drm/i915/dsi: fix dual-link DSI backlight and CABC ports for" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 875c6d2711f6 ("drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+") 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs. global parts") c2fdb424d322 ("drm/i915/bios: Split VBT parsing to global vs. panel specific parts") c3fbcf60bc74 ("drm/i915/bios: Split parse_driver_features() into two parts") 75bd0d5e4ead ("drm/i915/pps: Split pps_init_delays() into distinct parts") 822e5ae701af ("drm/i915: Extract intel_edp_fixup_vbt_bpp()") 949665a6e237 ("drm/i915: Respect VBT seamless DRRS min refresh rate") 790b45f1bc67 ("drm/i915/bios: Parse the seamless DRRS min refresh rate") 901a0cad2ab8 ("drm/i915/bios: Get access to the tail end of the LFP data block") 13367132a7ad ("drm/i915/bios: Reorder panel DTD parsing") 5ab58d6996d7 ("drm/i915/bios: Validate the panel_name table") 58b2e3829ec6 ("drm/i915/bios: Trust the LFP data pointers") 514003e1421e ("drm/i915/bios: Validate LFP data table pointers") 918f3025960f ("drm/i915/bios: Use the copy of the LFP data table always") e163cfb4c96d ("drm/i915/bios: Make copies of VBT data blocks") d58a3d699797 ("drm/i915/bios: Use the cached BDB version") ca2a3c9204ec ("drm/i915/bios: Extract struct lvds_lfp_data_ptr_table") 001b6169a920 ("drm/i915: Allow static DRRS on LVDS") 1159c8339278 ("drm/i915: Allow static DRRS on all eDP ports") f244cdfa72b8 ("drm/i915: Move intel_drrs_compute_config() into intel_dp.c") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 875c6d2711f6c97e58c52288b4231f3072711d61 Mon Sep 17 00:00:00 2001 From: Jani Nikula <jani.nikula(a)intel.com> Date: Tue, 16 Aug 2022 18:37:21 +0300 Subject: [PATCH] drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+ The VBT dual-link DSI backlight and CABC still use ports A and C, both in Bspec and code, while display 11+ DSI only supports ports A and B. Assume port C actually means port B for display 11+ when parsing VBT. Bspec: 20154 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6476 Cc: stable(a)vger.kernel.org Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/8c462718bcc7b36a83e09d0a5eef0… (cherry picked from commit ab55165d73a444606af1530cd0d6448b04370f68) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index 51dde5bfd956..198a2f4920cc 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -1596,6 +1596,8 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, struct intel_panel *panel, enum port port) { + enum port port_bc = DISPLAY_VER(i915) >= 11 ? PORT_B : PORT_C; + if (!panel->vbt.dsi.config->dual_link || i915->vbt.version < 197) { panel->vbt.dsi.bl_ports = BIT(port); if (panel->vbt.dsi.config->cabc_supported) @@ -1609,11 +1611,11 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, panel->vbt.dsi.bl_ports = BIT(PORT_A); break; case DL_DCS_PORT_C: - panel->vbt.dsi.bl_ports = BIT(PORT_C); + panel->vbt.dsi.bl_ports = BIT(port_bc); break; default: case DL_DCS_PORT_A_AND_C: - panel->vbt.dsi.bl_ports = BIT(PORT_A) | BIT(PORT_C); + panel->vbt.dsi.bl_ports = BIT(PORT_A) | BIT(port_bc); break; } @@ -1625,12 +1627,12 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, panel->vbt.dsi.cabc_ports = BIT(PORT_A); break; case DL_DCS_PORT_C: - panel->vbt.dsi.cabc_ports = BIT(PORT_C); + panel->vbt.dsi.cabc_ports = BIT(port_bc); break; default: case DL_DCS_PORT_A_AND_C: panel->vbt.dsi.cabc_ports = - BIT(PORT_A) | BIT(PORT_C); + BIT(PORT_A) | BIT(port_bc); break; } }

2 years

1
0
0 0

FAILED: patch "[PATCH] drm/i915/dsi: fix dual-link DSI backlight and CABC ports for" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 875c6d2711f6 ("drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+") 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs. global parts") c2fdb424d322 ("drm/i915/bios: Split VBT parsing to global vs. panel specific parts") c3fbcf60bc74 ("drm/i915/bios: Split parse_driver_features() into two parts") 75bd0d5e4ead ("drm/i915/pps: Split pps_init_delays() into distinct parts") 822e5ae701af ("drm/i915: Extract intel_edp_fixup_vbt_bpp()") 949665a6e237 ("drm/i915: Respect VBT seamless DRRS min refresh rate") 790b45f1bc67 ("drm/i915/bios: Parse the seamless DRRS min refresh rate") 901a0cad2ab8 ("drm/i915/bios: Get access to the tail end of the LFP data block") 13367132a7ad ("drm/i915/bios: Reorder panel DTD parsing") 5ab58d6996d7 ("drm/i915/bios: Validate the panel_name table") 58b2e3829ec6 ("drm/i915/bios: Trust the LFP data pointers") 514003e1421e ("drm/i915/bios: Validate LFP data table pointers") 918f3025960f ("drm/i915/bios: Use the copy of the LFP data table always") e163cfb4c96d ("drm/i915/bios: Make copies of VBT data blocks") d58a3d699797 ("drm/i915/bios: Use the cached BDB version") ca2a3c9204ec ("drm/i915/bios: Extract struct lvds_lfp_data_ptr_table") 001b6169a920 ("drm/i915: Allow static DRRS on LVDS") 1159c8339278 ("drm/i915: Allow static DRRS on all eDP ports") f244cdfa72b8 ("drm/i915: Move intel_drrs_compute_config() into intel_dp.c") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 875c6d2711f6c97e58c52288b4231f3072711d61 Mon Sep 17 00:00:00 2001 From: Jani Nikula <jani.nikula(a)intel.com> Date: Tue, 16 Aug 2022 18:37:21 +0300 Subject: [PATCH] drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+ The VBT dual-link DSI backlight and CABC still use ports A and C, both in Bspec and code, while display 11+ DSI only supports ports A and B. Assume port C actually means port B for display 11+ when parsing VBT. Bspec: 20154 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6476 Cc: stable(a)vger.kernel.org Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/8c462718bcc7b36a83e09d0a5eef0… (cherry picked from commit ab55165d73a444606af1530cd0d6448b04370f68) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index 51dde5bfd956..198a2f4920cc 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -1596,6 +1596,8 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, struct intel_panel *panel, enum port port) { + enum port port_bc = DISPLAY_VER(i915) >= 11 ? PORT_B : PORT_C; + if (!panel->vbt.dsi.config->dual_link || i915->vbt.version < 197) { panel->vbt.dsi.bl_ports = BIT(port); if (panel->vbt.dsi.config->cabc_supported) @@ -1609,11 +1611,11 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, panel->vbt.dsi.bl_ports = BIT(PORT_A); break; case DL_DCS_PORT_C: - panel->vbt.dsi.bl_ports = BIT(PORT_C); + panel->vbt.dsi.bl_ports = BIT(port_bc); break; default: case DL_DCS_PORT_A_AND_C: - panel->vbt.dsi.bl_ports = BIT(PORT_A) | BIT(PORT_C); + panel->vbt.dsi.bl_ports = BIT(PORT_A) | BIT(port_bc); break; } @@ -1625,12 +1627,12 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, panel->vbt.dsi.cabc_ports = BIT(PORT_A); break; case DL_DCS_PORT_C: - panel->vbt.dsi.cabc_ports = BIT(PORT_C); + panel->vbt.dsi.cabc_ports = BIT(port_bc); break; default: case DL_DCS_PORT_A_AND_C: panel->vbt.dsi.cabc_ports = - BIT(PORT_A) | BIT(PORT_C); + BIT(PORT_A) | BIT(port_bc); break; } }

2 years

1
0
0 0

FAILED: patch "[PATCH] drm/i915/dsi: fix dual-link DSI backlight and CABC ports for" failed to apply to 5.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. Possible dependencies: 875c6d2711f6 ("drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+") 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs. global parts") c2fdb424d322 ("drm/i915/bios: Split VBT parsing to global vs. panel specific parts") c3fbcf60bc74 ("drm/i915/bios: Split parse_driver_features() into two parts") 75bd0d5e4ead ("drm/i915/pps: Split pps_init_delays() into distinct parts") 822e5ae701af ("drm/i915: Extract intel_edp_fixup_vbt_bpp()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 875c6d2711f6c97e58c52288b4231f3072711d61 Mon Sep 17 00:00:00 2001 From: Jani Nikula <jani.nikula(a)intel.com> Date: Tue, 16 Aug 2022 18:37:21 +0300 Subject: [PATCH] drm/i915/dsi: fix dual-link DSI backlight and CABC ports for display 11+ The VBT dual-link DSI backlight and CABC still use ports A and C, both in Bspec and code, while display 11+ DSI only supports ports A and B. Assume port C actually means port B for display 11+ when parsing VBT. Bspec: 20154 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6476 Cc: stable(a)vger.kernel.org Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/8c462718bcc7b36a83e09d0a5eef0… (cherry picked from commit ab55165d73a444606af1530cd0d6448b04370f68) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index 51dde5bfd956..198a2f4920cc 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -1596,6 +1596,8 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, struct intel_panel *panel, enum port port) { + enum port port_bc = DISPLAY_VER(i915) >= 11 ? PORT_B : PORT_C; + if (!panel->vbt.dsi.config->dual_link || i915->vbt.version < 197) { panel->vbt.dsi.bl_ports = BIT(port); if (panel->vbt.dsi.config->cabc_supported) @@ -1609,11 +1611,11 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, panel->vbt.dsi.bl_ports = BIT(PORT_A); break; case DL_DCS_PORT_C: - panel->vbt.dsi.bl_ports = BIT(PORT_C); + panel->vbt.dsi.bl_ports = BIT(port_bc); break; default: case DL_DCS_PORT_A_AND_C: - panel->vbt.dsi.bl_ports = BIT(PORT_A) | BIT(PORT_C); + panel->vbt.dsi.bl_ports = BIT(PORT_A) | BIT(port_bc); break; } @@ -1625,12 +1627,12 @@ static void parse_dsi_backlight_ports(struct drm_i915_private *i915, panel->vbt.dsi.cabc_ports = BIT(PORT_A); break; case DL_DCS_PORT_C: - panel->vbt.dsi.cabc_ports = BIT(PORT_C); + panel->vbt.dsi.cabc_ports = BIT(port_bc); break; default: case DL_DCS_PORT_A_AND_C: panel->vbt.dsi.cabc_ports = - BIT(PORT_A) | BIT(PORT_C); + BIT(PORT_A) | BIT(port_bc); break; } }

2 years

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror September 2022