July 2024 - Linux-stable-mirror

[RESEND PATCH] rtc: ds1343: Force SPI chip select to be active high

by Ian Abbott

Commit 3b52093dc917 ("rtc: ds1343: Do not hardcode SPI mode flags") bit-flips (^=) the existing SPI_CS_HIGH setting in the SPI mode during device probe. This will set it to the wrong value if the spi-cs-high property has been set in the devicetree node. Just force it to be set active high and get rid of some commentary that attempted to explain why flipping the bit was the correct choice. Fixes: 3b52093dc917 ("rtc: ds1343: Do not hardcode SPI mode flags") Cc: <stable(a)vger.kernel.org> # 5.6+ Cc: Linus Walleij <linus.walleij(a)linaro.org> Cc: Mark Brown <broonie(a)kernel.org> Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk> --- drivers/rtc/rtc-ds1343.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/rtc/rtc-ds1343.c b/drivers/rtc/rtc-ds1343.c index ed5a6ba89a3e..484b5756b55c 100644 --- a/drivers/rtc/rtc-ds1343.c +++ b/drivers/rtc/rtc-ds1343.c @@ -361,13 +361,10 @@ static int ds1343_probe(struct spi_device *spi) if (!priv) return -ENOMEM; - /* RTC DS1347 works in spi mode 3 and - * its chip select is active high. Active high should be defined as - * "inverse polarity" as GPIO-based chip selects can be logically - * active high but inverted by the GPIO library. + /* + * RTC DS1347 works in spi mode 3 and its chip select is active high. */ - spi->mode |= SPI_MODE_3; - spi->mode ^= SPI_CS_HIGH; + spi->mode |= SPI_MODE_3 | SPI_CS_HIGH; spi->bits_per_word = 8; res = spi_setup(spi); if (res) -- 2.43.0

1 year, 1 month

3
6
0 0

[PATCH v3] block: fix deadlock between sd_remove & sd_release

by Yang Yang

Our test report the following hung task: [ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds. [ 2538.459427] Call trace: [ 2538.459430] __switch_to+0x174/0x338 [ 2538.459436] __schedule+0x628/0x9c4 [ 2538.459442] schedule+0x7c/0xe8 [ 2538.459447] schedule_preempt_disabled+0x24/0x40 [ 2538.459453] __mutex_lock+0x3ec/0xf04 [ 2538.459456] __mutex_lock_slowpath+0x14/0x24 [ 2538.459459] mutex_lock+0x30/0xd8 [ 2538.459462] del_gendisk+0xdc/0x350 [ 2538.459466] sd_remove+0x30/0x60 [ 2538.459470] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459474] device_release_driver+0x18/0x28 [ 2538.459478] bus_remove_device+0x15c/0x174 [ 2538.459483] device_del+0x1d0/0x358 [ 2538.459488] __scsi_remove_device+0xa8/0x198 [ 2538.459493] scsi_forget_host+0x50/0x70 [ 2538.459497] scsi_remove_host+0x80/0x180 [ 2538.459502] usb_stor_disconnect+0x68/0xf4 [ 2538.459506] usb_unbind_interface+0xd4/0x280 [ 2538.459510] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459514] device_release_driver+0x18/0x28 [ 2538.459518] bus_remove_device+0x15c/0x174 [ 2538.459523] device_del+0x1d0/0x358 [ 2538.459528] usb_disable_device+0x84/0x194 [ 2538.459532] usb_disconnect+0xec/0x300 [ 2538.459537] hub_event+0xb80/0x1870 [ 2538.459541] process_scheduled_works+0x248/0x4dc [ 2538.459545] worker_thread+0x244/0x334 [ 2538.459549] kthread+0x114/0x1bc [ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds. [ 2538.461014] Call trace: [ 2538.461016] __switch_to+0x174/0x338 [ 2538.461021] __schedule+0x628/0x9c4 [ 2538.461025] schedule+0x7c/0xe8 [ 2538.461030] blk_queue_enter+0xc4/0x160 [ 2538.461034] blk_mq_alloc_request+0x120/0x1d4 [ 2538.461037] scsi_execute_cmd+0x7c/0x23c [ 2538.461040] ioctl_internal_command+0x5c/0x164 [ 2538.461046] scsi_set_medium_removal+0x5c/0xb0 [ 2538.461051] sd_release+0x50/0x94 [ 2538.461054] blkdev_put+0x190/0x28c [ 2538.461058] blkdev_release+0x28/0x40 [ 2538.461063] __fput+0xf8/0x2a8 [ 2538.461066] __fput_sync+0x28/0x5c [ 2538.461070] __arm64_sys_close+0x84/0xe8 [ 2538.461073] invoke_syscall+0x58/0x114 [ 2538.461078] el0_svc_common+0xac/0xe0 [ 2538.461082] do_el0_svc+0x1c/0x28 [ 2538.461087] el0_svc+0x38/0x68 [ 2538.461090] el0t_64_sync_handler+0x68/0xbc [ 2538.461093] el0t_64_sync+0x1a8/0x1ac T1: T2: sd_remove del_gendisk __blk_mark_disk_dead blk_freeze_queue_start ++q->mq_freeze_depth bdev_release mutex_lock(&disk->open_mutex) sd_release scsi_execute_cmd blk_queue_enter wait_event(!q->mq_freeze_depth) mutex_lock(&disk->open_mutex) SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in this scenario. This is a classic ABBA deadlock. To fix the deadlock, make sure we don't try to acquire disk->open_mutex after freezing the queue. Cc: stable(a)vger.kernel.org Fixes: eec1be4c30df ("block: delete partitions later in del_gendisk") Signed-off-by: Yang Yang <yang.yang(a)vivo.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> --- Changes from v2: - Add Fixes: and Cc: stable by suggestion Changes from v1: - Modify commit message by suggestion --- block/genhd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/genhd.c b/block/genhd.c index 8f1f3c6b4d67..c5fca3e893a0 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -663,12 +663,12 @@ void del_gendisk(struct gendisk *disk) */ if (!test_bit(GD_DEAD, &disk->state)) blk_report_disk_dead(disk, false); - __blk_mark_disk_dead(disk); /* * Drop all partitions now that the disk is marked dead. */ mutex_lock(&disk->open_mutex); + __blk_mark_disk_dead(disk); xa_for_each_start(&disk->part_tbl, idx, part, 1) drop_partition(part); mutex_unlock(&disk->open_mutex); -- 2.34.1

1 year, 1 month

3
2
0 0

[PATCH 6.10 00/11] 6.10.1-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.10.1 release. There are 11 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 25 Jul 2024 12:28:30 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.1-rc2… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.10.1-rc2 Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Allow thermal zones to tell the core to ignore them Pavel Begunkov <asml.silence(a)gmail.com> io_uring: fix error pbuf checking Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Limit Speaker Volume to +12dB maximum Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Use header defines for Speaker Volume control definition Hao Ge <gehao(a)kylinos.cn> tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() David Howells <dhowells(a)redhat.com> cifs: Fix setting of zero_point after DIO write David Howells <dhowells(a)redhat.com> cifs: Fix server re-repick on subrequest retry Steve French <stfrench(a)microsoft.com> cifs: fix noisy message on copy_file_range David Howells <dhowells(a)redhat.com> cifs: Fix missing fscache invalidation David Howells <dhowells(a)redhat.com> cifs: Fix missing error code set Kees Cook <kees(a)kernel.org> ext4: use memtostr_pad() for s_volume_name ------------- Diffstat: Makefile | 4 +-- drivers/char/tpm/tpm2-sessions.c | 5 +-- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 7 +++- drivers/thermal/thermal_core.c | 51 ++++++++++++++--------------- drivers/thermal/thermal_core.h | 3 ++ drivers/thermal/thermal_helpers.c | 2 ++ fs/ext4/ext4.h | 2 +- fs/ext4/ioctl.c | 2 +- fs/smb/client/cifsfs.c | 2 +- fs/smb/client/file.c | 21 +++++++++--- fs/smb/client/smb2pdu.c | 3 -- include/sound/cs35l56.h | 2 +- io_uring/kbuf.c | 4 ++- sound/soc/codecs/cs35l56.c | 6 +++- 14 files changed, 69 insertions(+), 45 deletions(-)

1 year, 1 month

8
7
0 0

Linux 6.10.1

by Greg Kroah-Hartman

I'm announcing the release of the 6.10.1 kernel. All users of the 6.10 kernel series must upgrade. The updated 6.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 7 +++ drivers/thermal/thermal_core.c | 51 +++++++++++++--------------- drivers/thermal/thermal_core.h | 3 + drivers/thermal/thermal_helpers.c | 2 + fs/ext4/ext4.h | 2 - fs/ext4/ioctl.c | 2 - fs/smb/client/cifsfs.c | 2 - fs/smb/client/file.c | 21 +++++++++-- fs/smb/client/smb2pdu.c | 3 - include/sound/cs35l56.h | 2 - io_uring/kbuf.c | 4 +- sound/soc/codecs/cs35l56.c | 6 ++- 14 files changed, 68 insertions(+), 44 deletions(-) David Howells (4): cifs: Fix missing error code set cifs: Fix missing fscache invalidation cifs: Fix server re-repick on subrequest retry cifs: Fix setting of zero_point after DIO write Greg Kroah-Hartman (1): Linux 6.10.1 Hao Ge (1): tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Kees Cook (1): ext4: use memtostr_pad() for s_volume_name Pavel Begunkov (1): io_uring: fix error pbuf checking Rafael J. Wysocki (1): thermal: core: Allow thermal zones to tell the core to ignore them Richard Fitzgerald (2): ASoC: cs35l56: Use header defines for Speaker Volume control definition ASoC: cs35l56: Limit Speaker Volume to +12dB maximum Steve French (1): cifs: fix noisy message on copy_file_range

1 year, 1 month

1
1
0 0

Linux 6.10.1

by Greg Kroah-Hartman

I'm announcing the release of the 6.10.1 kernel. All users of the 6.10 kernel series must upgrade. The updated 6.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 - drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 7 +++ drivers/thermal/thermal_core.c | 51 +++++++++++++--------------- drivers/thermal/thermal_core.h | 3 + drivers/thermal/thermal_helpers.c | 2 + fs/ext4/ext4.h | 2 - fs/ext4/ioctl.c | 2 - fs/smb/client/cifsfs.c | 2 - fs/smb/client/file.c | 21 +++++++++-- fs/smb/client/smb2pdu.c | 3 - include/sound/cs35l56.h | 2 - io_uring/kbuf.c | 4 +- sound/soc/codecs/cs35l56.c | 6 ++- 14 files changed, 68 insertions(+), 44 deletions(-) David Howells (4): cifs: Fix missing error code set cifs: Fix missing fscache invalidation cifs: Fix server re-repick on subrequest retry cifs: Fix setting of zero_point after DIO write Greg Kroah-Hartman (1): Linux 6.10.1 Hao Ge (1): tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Kees Cook (1): ext4: use memtostr_pad() for s_volume_name Pavel Begunkov (1): io_uring: fix error pbuf checking Rafael J. Wysocki (1): thermal: core: Allow thermal zones to tell the core to ignore them Richard Fitzgerald (2): ASoC: cs35l56: Use header defines for Speaker Volume control definition ASoC: cs35l56: Limit Speaker Volume to +12dB maximum Steve French (1): cifs: fix noisy message on copy_file_range

1 year, 1 month

1
1
0 0

[PATCH] drm/nouveau: fix a possible null pointer dereference

by Ma Ke

In ch7006_encoder_get_modes(), the return value of drm_mode_duplicate() is used directly in drm_mode_probed_add(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: 6ee738610f41 ("drm/nouveau: Add DRM driver for NVIDIA GPUs") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/gpu/drm/i2c/ch7006_drv.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i2c/ch7006_drv.c b/drivers/gpu/drm/i2c/ch7006_drv.c index 131512a5f3bd..48bf6e4e8bdb 100644 --- a/drivers/gpu/drm/i2c/ch7006_drv.c +++ b/drivers/gpu/drm/i2c/ch7006_drv.c @@ -229,6 +229,7 @@ static int ch7006_encoder_get_modes(struct drm_encoder *encoder, { struct ch7006_priv *priv = to_ch7006_priv(encoder); const struct ch7006_mode *mode; + struct drm_display_mode *encoder_mode = NULL; int n = 0; for (mode = ch7006_modes; mode->mode.clock; mode++) { @@ -236,8 +237,11 @@ static int ch7006_encoder_get_modes(struct drm_encoder *encoder, ~mode->valid_norms & 1<<priv->norm) continue; - drm_mode_probed_add(connector, - drm_mode_duplicate(encoder->dev, &mode->mode)); + encoder_mode = drm_mode_duplicate(encoder->dev, &mode->mode); + if (!encoder_mode) + return 0; + + drm_mode_probed_add(connector, encoder_mode); n++; } -- 2.25.1

1 year, 1 month

1
0
0 0

[PATCH fro 6.11 0/2] ASoC SOF: ipc4-topology: Fix LinkID handling for ChainDMA

by Peter Ujfalusi

Hi, A recent patch available in 6.10 [1] uncovered two issues on how the DMA Link ID is tracked with ChainDMA and can cause under specific conditions [2] to cause a DSP panic. The issue is not academic as we have one user report of it: https://github.com/thesofproject/linux/issues/5116 The patches have been marked for stable backport to made there way to 6.10. The first patch is fixing a code move patch, for older than 6.9 we would need different patch to fix the original code, but since the issue is only valid for 6.10, I will do that at a later time. Mark, can you please schedule these as fixes for 6.11 to get them fast to 6.10? Thank you. [1] ebd3b3014eeb ("ASoC: SOF: pcm: reset all PCM sources in case of xruns") [2] https://github.com/thesofproject/linux/pull/5119#issuecomment-2244770449 Regards, Peter --- Peter Ujfalusi (2): ASoC: SOF: ipc4-topology: Only handle dai_config with HW_PARAMS for ChainDMA ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare sound/soc/sof/ipc4-topology.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) -- 2.45.2

1 year, 1 month

2
3
0 0

Re: CVE-2024-39471: drm/amdgpu: add error handle to avoid out-of-bounds

by Siddh Raman Pant

(Mail V2: Send to correct mailing list and CCing relevant people.) On Tue, 25 Jun 2024 16:29:04 +0200, Greg Kroah-Hartman wrote: > In the Linux kernel, the following vulnerability has been resolved: > > drm/amdgpu: add error handle to avoid out-of-bounds > > if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should > be stop to avoid out-of-bounds read, so directly return -EINVAL. > > The Linux kernel CVE team has assigned CVE-2024-39471 to this issue. This commit has a bug which was fixed by 6769a23697f1. It should be immediately backported, otherwise this "fix" doesn't do anything since gcc will optimise out the check. Thanks, Siddh

1 year, 1 month

1
0
0 0

[PATCH v2 RESEND] drm/client: fix null pointer dereference in drm_client_modeset_probe

by Ma Ke

In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: cf13909aee05 ("drm/fb-helper: Move out modeset config code") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v2: - added the recipient's email address, due to the prolonged absence of a response from the recipients. - added Cc stable. --- drivers/gpu/drm/drm_client_modeset.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c index 31af5cf37a09..cca37b225385 100644 --- a/drivers/gpu/drm/drm_client_modeset.c +++ b/drivers/gpu/drm/drm_client_modeset.c @@ -880,6 +880,9 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, kfree(modeset->mode); modeset->mode = drm_mode_duplicate(dev, mode); + if (!modeset->mode) + continue; + drm_connector_get(connector); modeset->connectors[modeset->num_connectors++] = connector; modeset->x = offset->x; -- 2.25.1

1 year, 1 month

2
1
0 0

[PATCH v2] spi: ppc4xx: handle irq_of_parse_and_map() errors

by Ma Ke

Zero and negative number is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0. Cc: stable(a)vger.kernel.org Fixes: 44dab88e7cc9 ("spi: add spi_ppc4xx driver") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v2: - added Cc stable line; - added Fixes line. --- drivers/spi/spi-ppc4xx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/spi/spi-ppc4xx.c b/drivers/spi/spi-ppc4xx.c index 942c3117ab3a..01fdecbf132d 100644 --- a/drivers/spi/spi-ppc4xx.c +++ b/drivers/spi/spi-ppc4xx.c @@ -413,6 +413,9 @@ static int spi_ppc4xx_of_probe(struct platform_device *op) /* Request IRQ */ hw->irqnum = irq_of_parse_and_map(np, 0); + if (hw->irqnum <= 0) + goto free_host; + ret = request_irq(hw->irqnum, spi_ppc4xx_int, 0, "spi_ppc4xx_of", (void *)hw); if (ret) { -- 2.25.1

1 year, 1 month

3
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2024