This is a note to let you know that I've just added the patch titled
component: do not dereference opaque pointer in debugfs
to my driver-core git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
in the driver-core-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the driver-core-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From ef9ffc1e5f1ac73ecd2fb3b70db2a3b2472ff2f7 Mon Sep 17 00:00:00 2001
From: Lubomir Rintel <lkundrak(a)v3.sk>
Date: Mon, 18 Nov 2019 12:54:31 +0100
Subject: component: do not dereference opaque pointer in debugfs
The match data does not have to be a struct device pointer, and indeed
very often is not. Attempt to treat it as such easily results in a
crash.
For the components that are not registered, we don't know which device
is missing. Once it it is there, we can use the struct component to get
the device and whether it's bound or not.
Fixes: 59e73854b5fd ('component: add debugfs support')
Signed-off-by: Lubomir Rintel <lkundrak(a)v3.sk>
Cc: stable <stable(a)vger.kernel.org>
Cc: Arnaud Pouliquen <arnaud.pouliquen(a)st.com>
Link: https://lore.kernel.org/r/20191118115431.63626-1-lkundrak@v3.sk
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/base/component.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/base/component.c b/drivers/base/component.c
index 3a09036e772a..c7879f5ae2fb 100644
--- a/drivers/base/component.c
+++ b/drivers/base/component.c
@@ -101,11 +101,11 @@ static int component_devices_show(struct seq_file *s, void *data)
seq_printf(s, "%-40s %20s\n", "device name", "status");
seq_puts(s, "-------------------------------------------------------------\n");
for (i = 0; i < match->num; i++) {
- struct device *d = (struct device *)match->compare[i].data;
+ struct component *component = match->compare[i].component;
- seq_printf(s, "%-40s %20s\n", dev_name(d),
- match->compare[i].component ?
- "registered" : "not registered");
+ seq_printf(s, "%-40s %20s\n",
+ component ? dev_name(component->dev) : "(unknown)",
+ component ? (component->bound ? "bound" : "not bound") : "not registered");
}
mutex_unlock(&component_mutex);
--
2.24.1
On Tue, Jan 14, 2020 at 2:09 PM Sasha Levin <sashal(a)kernel.org> wrote:
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: ec527c318036 ("x86/power: Fix 'nosmt' vs hibernation triple fault during resume").
>
> The bot has tested the following trees: v5.4.11, v4.19.95, v4.14.164, v4.9.209.
>
> v5.4.11: Build OK!
> v4.19.95: Failed to apply! Possible dependencies:
> 34d66caf251d ("x86/speculation: Remove redundant arch_smt_update() invocation")
> de7b77e5bb94 ("cpu/hotplug: Create SMT sysfs interface for all arches")
>
> v4.14.164: Failed to apply! Possible dependencies:
> 34d66caf251d ("x86/speculation: Remove redundant arch_smt_update() invocation")
> de7b77e5bb94 ("cpu/hotplug: Create SMT sysfs interface for all arches")
>
> v4.9.209: Failed to apply! Possible dependencies:
> 34d66caf251d ("x86/speculation: Remove redundant arch_smt_update() invocation")
> de7b77e5bb94 ("cpu/hotplug: Create SMT sysfs interface for all arches")
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
According to the changelog text, the patch is only needed on v5.2 and
higher, so this
is all good.
Arnd
The driver was issuing synchronous uninterruptible control requests
without using a timeout. This could lead to the driver hanging
on open() or tiocmset() due to a malfunctioning (or malicious) device
until the device is physically disconnected.
The USB upper limit of five seconds per request should be more than
enough.
Fixes: 309a057932ab ("USB: opticon: add rts and cts support")
Cc: stable <stable(a)vger.kernel.org> # 2.6.39
Cc: Martin Jansen <martin.jansen(a)opticon.com>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
This was reported to me off-list to be an issue with some opticon
devices. Let's address the obvious bug while waiting for a bug report
to be sent to the list.
Johan
drivers/usb/serial/opticon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index cb7aac9cd9e7..ed2b4e6dca38 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -113,7 +113,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
retval = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
requesttype,
USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
- 0, 0, buffer, 1, 0);
+ 0, 0, buffer, 1, USB_CTRL_SET_TIMEOUT);
kfree(buffer);
if (retval < 0)
--
2.24.1