This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
------------- Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.6.1-rc1
Dafna Hirschfeld dafna.hirschfeld@collabora.com media: v4l2-core: fix a use-after-free bug of sd->devnode
Johan Hovold johan@kernel.org media: xirlink_cit: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: stv06xx: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: dib0700: fix rc endpoint lookup
Johan Hovold johan@kernel.org media: ov519: add missing endpoint sanity checks
Eric Biggers ebiggers@google.com libfs: fix infoleak in simple_attr_read()
Kai-Heng Feng kai.heng.feng@canonical.com ahci: Add Intel Comet Lake H RAID PCI ID
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: annotate nested gc_list vs tx queue locking
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: fix init/remove vs IRQ race
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: add proper "compatible" string
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
Larry Finger Larry.Finger@lwfinger.net staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
Dan Carpenter dan.carpenter@oracle.com staging: kpc2000: prevent underflow in cpld_reconfigure()
Johan Hovold johan@kernel.org media: usbtv: fix control-message timeouts
Johan Hovold johan@kernel.org media: flexcop-usb: fix endpoint sanity check
Mans Rullgard mans@mansr.com usb: musb: fix crash with highmen PIO and usbmon
Qiujun Huang hqjagain@gmail.com USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
Matthias Reichl hias@horus.com USB: cdc-acm: restore capability check order
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add Wistron Neweb D19Q1
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add BroadMobi BM806U
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add support for ASKEY WWHC050
Daniel Borkmann daniel@iogearbox.net bpf: Undo incorrect __reg_bound_offset32 handling
-------------
Diffstat:
Makefile | 4 +-- drivers/ata/ahci.c | 1 + drivers/media/usb/b2c2/flexcop-usb.c | 6 ++-- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +-- drivers/media/usb/gspca/ov519.c | 10 ++++++ drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 +++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 +++ drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +-- drivers/media/v4l2-core/v4l2-device.c | 1 + drivers/staging/kpc2000/kpc2000/core.c | 4 +-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + .../bindings/net/wireless/siliabs,wfx.txt | 7 ++-- drivers/staging/wfx/bus_sdio.c | 15 ++++---- drivers/staging/wfx/bus_spi.c | 41 +++++++++++++--------- drivers/staging/wfx/main.c | 21 ++++++----- drivers/staging/wfx/main.h | 1 - drivers/staging/wfx/queue.c | 16 ++++----- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ drivers/staging/wlan-ng/prism2usb.c | 1 + drivers/usb/class/cdc-acm.c | 18 +++++----- drivers/usb/musb/musb_host.c | 17 +++------ drivers/usb/serial/io_edgeport.c | 2 +- drivers/usb/serial/option.c | 6 ++++ fs/libfs.c | 8 +++-- kernel/bpf/verifier.c | 19 ---------- 27 files changed, 149 insertions(+), 104 deletions(-)
From: Daniel Borkmann daniel@iogearbox.net
commit f2d67fec0b43edce8c416101cdc52e71145b5fef upstream.
Anatoly has been fuzzing with kBdysch harness and reported a hang in one of the outcomes:
0: (b7) r0 = 808464432 1: (7f) r0 >>= r0 2: (14) w0 -= 808464432 3: (07) r0 += 808464432 4: (b7) r1 = 808464432 5: (de) if w1 s<= w0 goto pc+0 R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x30303020;0x10000001f)) R1_w=invP808464432 R10=fp0 6: (07) r0 += -2144337872 7: (14) w0 -= -1607454672 8: (25) if r0 > 0x30303030 goto pc+0 R0_w=invP(id=0,umin_value=271581184,umax_value=271581311,var_off=(0x10300000;0x7f)) R1_w=invP808464432 R10=fp0 9: (76) if w0 s>= 0x303030 goto pc+2 12: (95) exit
from 8 to 9: safe
from 5 to 6: R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x30303020;0x10000001f)) R1_w=invP808464432 R10=fp0 6: (07) r0 += -2144337872 7: (14) w0 -= -1607454672 8: (25) if r0 > 0x30303030 goto pc+0 R0_w=invP(id=0,umin_value=271581184,umax_value=271581311,var_off=(0x10300000;0x7f)) R1_w=invP808464432 R10=fp0 9: safe
from 8 to 9: safe verification time 589 usec stack depth 0 processed 17 insns (limit 1000000) [...]
The underlying program was xlated as follows:
# bpftool p d x i 9 0: (b7) r0 = 808464432 1: (7f) r0 >>= r0 2: (14) w0 -= 808464432 3: (07) r0 += 808464432 4: (b7) r1 = 808464432 5: (de) if w1 s<= w0 goto pc+0 6: (07) r0 += -2144337872 7: (14) w0 -= -1607454672 8: (25) if r0 > 0x30303030 goto pc+0 9: (76) if w0 s>= 0x303030 goto pc+2 10: (05) goto pc-1 11: (05) goto pc-1 12: (95) exit
The verifier rewrote original instructions it recognized as dead code with 'goto pc-1', but reality differs from verifier simulation in that we're actually able to trigger a hang due to hitting the 'goto pc-1' instructions.
Taking different examples to make the issue more obvious: in this example we're probing bounds on a completely unknown scalar variable in r1:
[...] 5: R0_w=inv1 R1_w=inv(id=0) R10=fp0 5: (18) r2 = 0x4000000000 7: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R10=fp0 7: (18) r3 = 0x2000000000 9: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R3_w=inv137438953472 R10=fp0 9: (18) r4 = 0x400 11: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R10=fp0 11: (18) r5 = 0x200 13: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0 13: (2d) if r1 > r2 goto pc+4 R0_w=inv1 R1_w=inv(id=0,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0 14: R0_w=inv1 R1_w=inv(id=0,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0 14: (ad) if r1 < r3 goto pc+3 R0_w=inv1 R1_w=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0 15: R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0 15: (2e) if w1 > w4 goto pc+2 R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7f00000000)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0 16: R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7f00000000)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0 16: (ae) if w1 < w5 goto pc+1 R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7f00000000)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0 [...]
We're first probing lower/upper bounds via jmp64, later we do a similar check via jmp32 and examine the resulting var_off there. After fall-through in insn 14, we get the following bounded r1 with 0x7fffffffff unknown marked bits in the variable section.
Thus, after knowing r1 <= 0x4000000000 and r1 >= 0x2000000000:
max: 0b100000000000000000000000000000000000000 / 0x4000000000 var: 0b111111111111111111111111111111111111111 / 0x7fffffffff min: 0b010000000000000000000000000000000000000 / 0x2000000000
Now, in insn 15 and 16, we perform a similar probe with lower/upper bounds in jmp32.
Thus, after knowing r1 <= 0x4000000000 and r1 >= 0x2000000000 and w1 <= 0x400 and w1 >= 0x200:
max: 0b100000000000000000000000000000000000000 / 0x4000000000 var: 0b111111100000000000000000000000000000000 / 0x7f00000000 min: 0b010000000000000000000000000000000000000 / 0x2000000000
The lower/upper bounds haven't changed since they have high bits set in u64 space and the jmp32 tests can only refine bounds in the low bits.
However, for the var part the expectation would have been 0x7f000007ff or something less precise up to 0x7fffffffff. A outcome of 0x7f00000000 is not correct since it would contradict the earlier probed bounds where we know that the result should have been in [0x200,0x400] in u32 space. Therefore, tests with such info will lead to wrong verifier assumptions later on like falsely predicting conditional jumps to be always taken, etc.
The issue here is that __reg_bound_offset32()'s implementation from commit 581738a681b6 ("bpf: Provide better register bounds after jmp32 instructions") makes an incorrect range assumption:
static void __reg_bound_offset32(struct bpf_reg_state *reg) { u64 mask = 0xffffFFFF; struct tnum range = tnum_range(reg->umin_value & mask, reg->umax_value & mask); struct tnum lo32 = tnum_cast(reg->var_off, 4); struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32);
reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range)); }
In the above walk-through example, __reg_bound_offset32() as-is chose a range after masking with 0xffffffff of [0x0,0x0] since umin:0x2000000000 and umax:0x4000000000 and therefore the lo32 part was clamped to 0x0 as well. However, in the umin:0x2000000000 and umax:0x4000000000 range above we'd end up with an actual possible interval of [0x0,0xffffffff] for u32 space instead.
In case of the original reproducer, the situation looked as follows at insn 5 for r0:
[...] 5: R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x0; 0x1ffffffff)) R1_w=invP808464432 R10=fp0 0x30303030 0x13030302f 5: (de) if w1 s<= w0 goto pc+0 R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x30303020; 0x10000001f)) R1_w=invP808464432 R10=fp0 0x30303030 0x13030302f [...]
After the fall-through, we similarly forced the var_off result into the wrong range [0x30303030,0x3030302f] suggesting later on that fixed bits must only be of 0x30303020 with 0x10000001f unknowns whereas such assumption can only be made when both bounds in hi32 range match.
Originally, I was thinking to fix this by moving reg into a temp reg and use proper coerce_reg_to_size() helper on the temp reg where we can then based on that define the range tnum for later intersection:
static void __reg_bound_offset32(struct bpf_reg_state *reg) { struct bpf_reg_state tmp = *reg; struct tnum lo32, hi32, range;
coerce_reg_to_size(&tmp, 4); range = tnum_range(tmp.umin_value, tmp.umax_value); lo32 = tnum_cast(reg->var_off, 4); hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32); reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range)); }
In the case of the concrete example, this gives us a more conservative unknown section. Thus, after knowing r1 <= 0x4000000000 and r1 >= 0x2000000000 and w1 <= 0x400 and w1 >= 0x200:
max: 0b100000000000000000000000000000000000000 / 0x4000000000 var: 0b111111111111111111111111111111111111111 / 0x7fffffffff min: 0b010000000000000000000000000000000000000 / 0x2000000000
However, above new __reg_bound_offset32() has no effect on refining the knowledge of the register contents. Meaning, if the bounds in hi32 range mismatch we'll get the identity function given the range reg spans [0x0,0xffffffff] and we cast var_off into lo32 only to later on binary or it again with the hi32.
Likewise, if the bounds in hi32 range match, then we mask both bounds with 0xffffffff, use the resulting umin/umax for the range to later intersect the lo32 with it. However, _prior_ called __reg_bound_offset() did already such intersection on the full reg and we therefore would only repeat the same operation on the lo32 part twice.
Given this has no effect and the original commit had false assumptions, this patch reverts the code entirely which is also more straight forward for stable trees: apparently 581738a681b6 got auto-selected by Sasha's ML system and misclassified as a fix, so it got sucked into v5.4 where it should never have landed. A revert is low-risk also from a user PoV since it requires a recent kernel and llc to opt-into -mcpu=v3 BPF CPU to generate jmp32 instructions. A proper bounds refinement would need a significantly more complex approach which is currently being worked, but no stable material [0]. Hence revert is best option for stable. After the revert, the original reported program gets rejected as follows:
1: (7f) r0 >>= r0 2: (14) w0 -= 808464432 3: (07) r0 += 808464432 4: (b7) r1 = 808464432 5: (de) if w1 s<= w0 goto pc+0 R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x0; 0x1ffffffff)) R1_w=invP808464432 R10=fp0 6: (07) r0 += -2144337872 7: (14) w0 -= -1607454672 8: (25) if r0 > 0x30303030 goto pc+0 R0_w=invP(id=0,umax_value=808464432,var_off=(0x0; 0x3fffffff)) R1_w=invP808464432 R10=fp0 9: (76) if w0 s>= 0x303030 goto pc+2 R0=invP(id=0,umax_value=3158063,var_off=(0x0; 0x3fffff)) R1=invP808464432 R10=fp0 10: (30) r0 = *(u8 *)skb[808464432] BPF_LD_[ABS|IND] uses reserved fields processed 11 insns (limit 1000000) [...]
[0] https://lore.kernel.org/bpf/158507130343.15666.8018068546764556975.stgit@joh...
Fixes: 581738a681b6 ("bpf: Provide better register bounds after jmp32 instructions") Reported-by: Anatoly Trosinenko anatoly.trosinenko@gmail.com Signed-off-by: Daniel Borkmann daniel@iogearbox.net Signed-off-by: Alexei Starovoitov ast@kernel.org Link: https://lore.kernel.org/bpf/20200330160324.15259-2-daniel@iogearbox.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- kernel/bpf/verifier.c | 19 ------------------- 1 file changed, 19 deletions(-)
--- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1034,17 +1034,6 @@ static void __reg_bound_offset(struct bp reg->umax_value)); }
-static void __reg_bound_offset32(struct bpf_reg_state *reg) -{ - u64 mask = 0xffffFFFF; - struct tnum range = tnum_range(reg->umin_value & mask, - reg->umax_value & mask); - struct tnum lo32 = tnum_cast(reg->var_off, 4); - struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32); - - reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range)); -} - /* Reset the min/max bounds of a register */ static void __mark_reg_unbounded(struct bpf_reg_state *reg) { @@ -5717,10 +5706,6 @@ static void reg_set_min_max(struct bpf_r /* We might have learned some bits from the bounds. */ __reg_bound_offset(false_reg); __reg_bound_offset(true_reg); - if (is_jmp32) { - __reg_bound_offset32(false_reg); - __reg_bound_offset32(true_reg); - } /* Intersecting with the old var_off might have improved our bounds * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), * then new var_off is (0; 0x7f...fc) which improves our umax. @@ -5830,10 +5815,6 @@ static void reg_set_min_max_inv(struct b /* We might have learned some bits from the bounds. */ __reg_bound_offset(false_reg); __reg_bound_offset(true_reg); - if (is_jmp32) { - __reg_bound_offset32(false_reg); - __reg_bound_offset32(true_reg); - } /* Intersecting with the old var_off might have improved our bounds * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), * then new var_off is (0; 0x7f...fc) which improves our umax.
From: Pawel Dembicki paweldembicki@gmail.com
commit 007d20dca2376a751b1dad03442f118438b7e65e upstream.
ASKEY WWHC050 is a mcie LTE modem. The oem configuration states:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
Tested on openwrt distribution.
Co-developed-by: Cezary Jackiewicz cezary@eko.one.pl Signed-off-by: Cezary Jackiewicz cezary@eko.one.pl Signed-off-by: Pawel Dembicki paweldembicki@gmail.com Cc: stable stable@vger.kernel.org Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1992,6 +1992,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */
From: Pawel Dembicki paweldembicki@gmail.com
commit 6cb2669cb97fc4fdf526127159ac59caae052247 upstream.
BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem. Tested hardware BM806U is mounted on D-Link DWR-921-C3 router.
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2020 ProdID=2033 Rev= 2.28 S: Manufacturer=Mobile Connect S: Product=Mobile Connect S: SerialNumber=f842866cfd5a C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Co-developed-by: Cezary Jackiewicz cezary@eko.one.pl Signed-off-by: Cezary Jackiewicz cezary@eko.one.pl Signed-off-by: Pawel Dembicki paweldembicki@gmail.com Cc: stable stable@vger.kernel.org Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1996,6 +1996,8 @@ static const struct usb_device_id option .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */ + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
From: Pawel Dembicki paweldembicki@gmail.com
commit dfee7e2f478346b12ea651d5c28b069f6a4af563 upstream.
This modem is embedded on dlink dwr-960 router. The oem configuration states:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1435 ProdID=d191 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
Tested on openwrt distribution
Signed-off-by: Pawel Dembicki paweldembicki@gmail.com Cc: stable stable@vger.kernel.org Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1992,6 +1992,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
From: Matthias Reichl hias@horus.com
commit 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 upstream.
commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") introduced a regression by changing the order of capability and close settings change checks. When running with CAP_SYS_ADMIN setting the close settings to the values already set resulted in -EOPNOTSUPP.
Fix this by changing the check order back to how it was before.
Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") Cc: Anthony Mallet anthony.mallet@laas.fr Cc: stable stable@vger.kernel.org Cc: Oliver Neukum oneukum@suse.com Signed-off-by: Matthias Reichl hias@horus.com Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/usb/class/cdc-acm.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -923,16 +923,16 @@ static int set_serial_info(struct tty_st
mutex_lock(&acm->port.mutex);
- if ((ss->close_delay != old_close_delay) || - (ss->closing_wait != old_closing_wait)) { - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN)) { + if ((ss->close_delay != old_close_delay) || + (ss->closing_wait != old_closing_wait)) retval = -EPERM; - else { - acm->port.close_delay = close_delay; - acm->port.closing_wait = closing_wait; - } - } else - retval = -EOPNOTSUPP; + else + retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; + }
mutex_unlock(&acm->port.mutex); return retval;
From: Qiujun Huang hqjagain@gmail.com
commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream.
Fix slab-out-of-bounds read in the interrupt-URB completion handler.
The boundary condition should be (length - 1) as we access data[position + 1].
Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang hqjagain@gmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable stable@vger.kernel.org Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/usb/serial/io_edgeport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -710,7 +710,7 @@ static void edge_interrupt_callback(stru /* grab the txcredits for the ports if available */ position = 2; portNumber = 0; - while ((position < length) && + while ((position < length - 1) && (portNumber < edge_serial->serial->num_ports)) { txCredits = data[position] | (data[position+1] << 8); if (txCredits) {
From: Mans Rullgard mans@mansr.com
commit 52974d94a206ce428d9d9b6eaa208238024be82a upstream.
When handling a PIO bulk transfer with highmem buffer, a temporary mapping is assigned to urb->transfer_buffer. After the transfer is complete, an invalid address is left behind in this pointer. This is not ordinarily a problem since nothing touches that buffer before the urb is released. However, when usbmon is active, usbmon_urb_complete() calls (indirectly) mon_bin_get_data() which does access the transfer buffer if it is set. To prevent an invalid memory access here, reset urb->transfer_buffer to NULL when finished (musb_host_rx()), or do not set it at all (musb_host_tx()).
Fixes: 8e8a55165469 ("usb: musb: host: Handle highmem in PIO mode") Signed-off-by: Mans Rullgard mans@mansr.com Cc: stable@vger.kernel.org Signed-off-by: Bin Liu b-liu@ti.com Link: https://lore.kernel.org/r/20200316211136.2274-8-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/usb/musb/musb_host.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
--- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -1436,10 +1436,7 @@ done: * We need to map sg if the transfer_buffer is * NULL. */ - if (!urb->transfer_buffer) - qh->use_sg = true; - - if (qh->use_sg) { + if (!urb->transfer_buffer) { /* sg_miter_start is already done in musb_ep_program */ if (!sg_miter_next(&qh->sg_miter)) { dev_err(musb->controller, "error: sg list empty\n"); @@ -1447,9 +1444,8 @@ done: status = -EINVAL; goto done; } - urb->transfer_buffer = qh->sg_miter.addr; length = min_t(u32, length, qh->sg_miter.length); - musb_write_fifo(hw_ep, length, urb->transfer_buffer); + musb_write_fifo(hw_ep, length, qh->sg_miter.addr); qh->sg_miter.consumed = length; sg_miter_stop(&qh->sg_miter); } else { @@ -1458,11 +1454,6 @@ done:
qh->segsize = length;
- if (qh->use_sg) { - if (offset + length >= urb->transfer_buffer_length) - qh->use_sg = false; - } - musb_ep_select(mbase, epnum); musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY); @@ -1977,8 +1968,10 @@ finish: urb->actual_length += xfer_len; qh->offset += xfer_len; if (done) { - if (qh->use_sg) + if (qh->use_sg) { qh->use_sg = false; + urb->transfer_buffer = NULL; + }
if (urb->status == -EINPROGRESS) urb->status = status;
From: Johan Hovold johan@kernel.org
commit bca243b1ce0e46be26f7c63b5591dfbb41f558e5 upstream.
commit 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") added an endpoint sanity check to address a NULL-pointer dereference on probe. Unfortunately the check was done on the current altsetting which was later changed.
Fix this by moving the sanity check to after the altsetting is changed.
Fixes: 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") Cc: Oliver Neukum oneukum@suse.com Cc: stable stable@vger.kernel.org Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Sean Young sean@mess.org Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/usb/b2c2/flexcop-usb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/media/usb/b2c2/flexcop-usb.c +++ b/drivers/media/usb/b2c2/flexcop-usb.c @@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexc return ret; }
+ if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1) + return -ENODEV; + switch (fc_usb->udev->speed) { case USB_SPEED_LOW: err("cannot handle USB speed because it is too slow."); @@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_ struct flexcop_device *fc = NULL; int ret;
- if (intf->cur_altsetting->desc.bNumEndpoints < 1) - return -ENODEV; - if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) { err("out of memory\n"); return -ENOMEM;
From: Johan Hovold johan@kernel.org
commit 536f561d871c5781bc33d26d415685211b94032e upstream.
The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on various user requests due to a malfunctioning (or malicious) device until the device is physically disconnected.
The USB upper limit of five seconds per request should be more than enough.
Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber") Fixes: c53a846c48f2 ("[media] usbtv: add video controls") Cc: stable stable@vger.kernel.org # 3.11 Signed-off-by: Johan Hovold johan@kernel.org Acked-by: Lubomir Rintel lkundrak@v3.sk Reviewed-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/media/usb/usbtv/usbtv-core.c +++ b/drivers/media/usb/usbtv/usbtv-core.c @@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv,
ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - value, index, NULL, 0, 0); + value, index, NULL, 0, USB_CTRL_GET_TIMEOUT); if (ret < 0) return ret; } --- a/drivers/media/usb/usbtv/usbtv-video.c +++ b/drivers/media/usb/usbtv/usbtv-video.c @@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl ret = usb_control_msg(usbtv->udev, usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0, USBTV_BASE + 0x0244, (void *)data, 3, 0); + 0, USBTV_BASE + 0x0244, (void *)data, 3, + USB_CTRL_GET_TIMEOUT); if (ret < 0) goto error; } @@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0, index, (void *)data, size, 0); + 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
error: if (ret < 0)
From: Dan Carpenter dan.carpenter@oracle.com
commit 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 upstream.
This function should not allow negative values of "wr_val". If negatives are allowed then capping the upper bound at 7 is meaningless. Let's make it unsigned.
Fixes: 7dc7967fc39a ("staging: kpc2000: add initial set of Daktronics drivers") Signed-off-by: Dan Carpenter dan.carpenter@oracle.com Cc: stable stable@vger.kernel.org Link: https://lore.kernel.org/r/20200224103325.hrxdnaeqsthplu42@kili.mountain Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/kpc2000/kpc2000/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/staging/kpc2000/kpc2000/core.c +++ b/drivers/staging/kpc2000/kpc2000/core.c @@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct d const char *buf, size_t count) { struct kp2000_device *pcard = dev_get_drvdata(dev); - long wr_val; + unsigned long wr_val; int rv;
- rv = kstrtol(buf, 0, &wr_val); + rv = kstrtoul(buf, 0, &wr_val); if (rv < 0) return rv; if (wr_val > 7)
From: Larry Finger Larry.Finger@lwfinger.net
commit 38ef48f7d4b7342f145a1b4f96023bde99aeb245 upstream.
The ASUS USB-N10 Nano B1 has been reported as a new RTL8188EU device. Add it to the device tables.
Signed-off-by: Larry Finger Larry.Finger@lwfinger.net Reported-by: kovi zraetn@gmail.com Cc: Stable stable@vger.kernel.org Link: https://lore.kernel.org/r/20200321180011.26153-1-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c +++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c @@ -32,6 +32,7 @@ static const struct usb_device_id rtw_us /****** 8188EUS ********/ {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */ {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */ + {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */ {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
From: Qiujun Huang hqjagain@gmail.com
commit a1f165a6b738f0c9d744bad4af7a53909278f5fc upstream.
We should cancel hw->usb_work before kfree(hw).
Reported-by: syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang hqjagain@gmail.com Cc: stable stable@vger.kernel.org Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.c... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/wlan-ng/prism2usb.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/staging/wlan-ng/prism2usb.c +++ b/drivers/staging/wlan-ng/prism2usb.c @@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(str
cancel_work_sync(&hw->link_bh); cancel_work_sync(&hw->commsqual_bh); + cancel_work_sync(&hw->usb_work);
/* Now we complete any outstanding commands * and tell everyone who is waiting for their
From: Qiujun Huang hqjagain@gmail.com
commit 1165dd73e811a07d947aee218510571f516081f6 upstream.
We can't handle the case length > WLAN_DATA_MAXLEN. Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't read more than that.
Thanks-to: Hillf Danton hdanton@sina.com Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang hqjagain@gmail.com Cc: stable stable@vger.kernel.org Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3372,6 +3372,8 @@ static void hfa384x_int_rxmonitor(struct WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { pr_debug("overlen frm: len=%zd\n", skblen - sizeof(struct p80211_caphdr)); + + return; }
skb = dev_alloc_skb(skblen);
From: Michał Mirosław mirq-linux@rere.qmqm.pl
commit eec6e3ee636ec3adaa85ebe4b4acaacfcf06277e upstream.
Add "compatible" string matching "vendor,chip" template and proper GPIO flags handling. Keep support for old name and reset polarity for older devicetrees.
Cc: stable@vger.kernel.org # d3a5bcb4a17f ("gpio: add gpiod_toggle_active_low()") Cc: stable@vger.kernel.org Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access") Signed-off-by: Michał Mirosław mirq-linux@rere.qmqm.pl Link: https://lore.kernel.org/r/0e6dda06f145676861860f073a53dc95987c7ab5.158141684... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt | 7 ++--- drivers/staging/wfx/bus_spi.c | 14 +++++++--- 2 files changed, 14 insertions(+), 7 deletions(-)
--- a/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt +++ b/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt @@ -6,7 +6,7 @@ SPI You have to declare the WFxxx chip in your device tree.
Required properties: - - compatible: Should be "silabs,wfx-spi" + - compatible: Should be "silabs,wf200" - reg: Chip select address of device - spi-max-frequency: Maximum SPI clocking speed of device in Hz - interrupts-extended: Should contain interrupt line (interrupt-parent + @@ -15,6 +15,7 @@ Required properties: Optional properties: - reset-gpios: phandle of gpio that will be used to reset chip during probe. Without this property, you may encounter issues with warm boot. + (Legacy: when compatible == "silabs,wfx-spi", the gpio is inverted.)
Please consult Documentation/devicetree/bindings/spi/spi-bus.txt for optional SPI connection related properties, @@ -23,12 +24,12 @@ Example:
&spi1 { wfx { - compatible = "silabs,wfx-spi"; + compatible = "silabs,wf200"; pinctrl-names = "default"; pinctrl-0 = <&wfx_irq &wfx_gpios>; interrupts-extended = <&gpio 16 IRQ_TYPE_EDGE_RISING>; wakeup-gpios = <&gpio 12 GPIO_ACTIVE_HIGH>; - reset-gpios = <&gpio 13 GPIO_ACTIVE_HIGH>; + reset-gpios = <&gpio 13 GPIO_ACTIVE_LOW>; reg = <0>; spi-max-frequency = <42000000>; }; --- a/drivers/staging/wfx/bus_spi.c +++ b/drivers/staging/wfx/bus_spi.c @@ -27,6 +27,8 @@ MODULE_PARM_DESC(gpio_reset, "gpio numbe #define SET_WRITE 0x7FFF /* usage: and operation */ #define SET_READ 0x8000 /* usage: or operation */
+#define WFX_RESET_INVERTED 1 + static const struct wfx_platform_data wfx_spi_pdata = { .file_fw = "wfm_wf200", .file_pds = "wf200.pds", @@ -201,9 +203,11 @@ static int wfx_spi_probe(struct spi_devi if (!bus->gpio_reset) { dev_warn(&func->dev, "try to load firmware anyway\n"); } else { - gpiod_set_value(bus->gpio_reset, 0); - udelay(100); + if (spi_get_device_id(func)->driver_data & WFX_RESET_INVERTED) + gpiod_toggle_active_low(bus->gpio_reset); gpiod_set_value(bus->gpio_reset, 1); + udelay(100); + gpiod_set_value(bus->gpio_reset, 0); udelay(2000); }
@@ -244,14 +248,16 @@ static int wfx_spi_remove(struct spi_dev * stripped. */ static const struct spi_device_id wfx_spi_id[] = { - { "wfx-spi", 0 }, + { "wfx-spi", WFX_RESET_INVERTED }, + { "wf200", 0 }, { }, }; MODULE_DEVICE_TABLE(spi, wfx_spi_id);
#ifdef CONFIG_OF static const struct of_device_id wfx_spi_of_match[] = { - { .compatible = "silabs,wfx-spi" }, + { .compatible = "silabs,wfx-spi", .data = (void *)WFX_RESET_INVERTED }, + { .compatible = "silabs,wf200" }, { }, }; MODULE_DEVICE_TABLE(of, wfx_spi_of_match);
From: Michał Mirosław mirq-linux@rere.qmqm.pl
commit 4033714d6cbe04893aa0708d1fcaa45dd8eb3f53 upstream.
Current code races in init/exit with interrupt handlers. This is noticed by the warning below. Fix it by using devres for ordering allocations and IRQ de/registration.
WARNING: CPU: 0 PID: 827 at drivers/staging/wfx/bus_spi.c:142 wfx_spi_irq_handler+0x5c/0x64 [wfx] race condition in driver init/deinit
Cc: stable@vger.kernel.org Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access") Signed-off-by: Michał Mirosław mirq-linux@rere.qmqm.pl Reviewed-by: Jérôme Pouiller jerome.pouiller@silabs.com Link: https://lore.kernel.org/r/f0c66cbb3110c2736cd4357c753fba8c14ee3aee.158141684... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/wfx/bus_sdio.c | 15 ++++++--------- drivers/staging/wfx/bus_spi.c | 27 ++++++++++++++------------- drivers/staging/wfx/main.c | 21 +++++++++++++-------- drivers/staging/wfx/main.h | 1 - 4 files changed, 33 insertions(+), 31 deletions(-)
--- a/drivers/staging/wfx/bus_sdio.c +++ b/drivers/staging/wfx/bus_sdio.c @@ -200,25 +200,23 @@ static int wfx_sdio_probe(struct sdio_fu if (ret) goto err0;
- ret = wfx_sdio_irq_subscribe(bus); - if (ret) - goto err1; - bus->core = wfx_init_common(&func->dev, &wfx_sdio_pdata, &wfx_sdio_hwbus_ops, bus); if (!bus->core) { ret = -EIO; - goto err2; + goto err1; }
+ ret = wfx_sdio_irq_subscribe(bus); + if (ret) + goto err1; + ret = wfx_probe(bus->core); if (ret) - goto err3; + goto err2;
return 0;
-err3: - wfx_free_common(bus->core); err2: wfx_sdio_irq_unsubscribe(bus); err1: @@ -234,7 +232,6 @@ static void wfx_sdio_remove(struct sdio_ struct wfx_sdio_priv *bus = sdio_get_drvdata(func);
wfx_release(bus->core); - wfx_free_common(bus->core); wfx_sdio_irq_unsubscribe(bus); sdio_claim_host(func); sdio_disable_func(func); --- a/drivers/staging/wfx/bus_spi.c +++ b/drivers/staging/wfx/bus_spi.c @@ -156,6 +156,11 @@ static void wfx_spi_request_rx(struct wo wfx_bh_request_rx(bus->core); }
+static void wfx_flush_irq_work(void *w) +{ + flush_work(w); +} + static size_t wfx_spi_align_size(void *priv, size_t size) { // Most of SPI controllers avoid DMA if buffer size is not 32bit aligned @@ -211,22 +216,23 @@ static int wfx_spi_probe(struct spi_devi udelay(2000); }
- ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler, - IRQF_TRIGGER_RISING, "wfx", bus); - if (ret) - return ret; - INIT_WORK(&bus->request_rx, wfx_spi_request_rx); bus->core = wfx_init_common(&func->dev, &wfx_spi_pdata, &wfx_spi_hwbus_ops, bus); if (!bus->core) return -EIO;
- ret = wfx_probe(bus->core); + ret = devm_add_action_or_reset(&func->dev, wfx_flush_irq_work, + &bus->request_rx); if (ret) - wfx_free_common(bus->core); + return ret; + + ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler, + IRQF_TRIGGER_RISING, "wfx", bus); + if (ret) + return ret;
- return ret; + return wfx_probe(bus->core); }
static int wfx_spi_remove(struct spi_device *func) @@ -234,11 +240,6 @@ static int wfx_spi_remove(struct spi_dev struct wfx_spi_priv *bus = spi_get_drvdata(func);
wfx_release(bus->core); - wfx_free_common(bus->core); - // A few IRQ will be sent during device release. Hopefully, no IRQ - // should happen after wdev/wvif are released. - devm_free_irq(&func->dev, func->irq, bus); - flush_work(&bus->request_rx); return 0; }
--- a/drivers/staging/wfx/main.c +++ b/drivers/staging/wfx/main.c @@ -262,6 +262,16 @@ static int wfx_send_pdata_pds(struct wfx return ret; }
+static void wfx_free_common(void *data) +{ + struct wfx_dev *wdev = data; + + mutex_destroy(&wdev->rx_stats_lock); + mutex_destroy(&wdev->conf_mutex); + wfx_tx_queues_deinit(wdev); + ieee80211_free_hw(wdev->hw); +} + struct wfx_dev *wfx_init_common(struct device *dev, const struct wfx_platform_data *pdata, const struct hwbus_ops *hwbus_ops, @@ -332,15 +342,10 @@ struct wfx_dev *wfx_init_common(struct d wfx_init_hif_cmd(&wdev->hif_cmd); wfx_tx_queues_init(wdev);
- return wdev; -} + if (devm_add_action_or_reset(dev, wfx_free_common, wdev)) + return NULL;
-void wfx_free_common(struct wfx_dev *wdev) -{ - mutex_destroy(&wdev->rx_stats_lock); - mutex_destroy(&wdev->conf_mutex); - wfx_tx_queues_deinit(wdev); - ieee80211_free_hw(wdev->hw); + return wdev; }
int wfx_probe(struct wfx_dev *wdev) --- a/drivers/staging/wfx/main.h +++ b/drivers/staging/wfx/main.h @@ -34,7 +34,6 @@ struct wfx_dev *wfx_init_common(struct d const struct wfx_platform_data *pdata, const struct hwbus_ops *hwbus_ops, void *hwbus_priv); -void wfx_free_common(struct wfx_dev *wdev);
int wfx_probe(struct wfx_dev *wdev); void wfx_release(struct wfx_dev *wdev);
From: Michał Mirosław mirq-linux@rere.qmqm.pl
commit e2525a95cc0887c7dc0549cb5d0ac3e796e1d54c upstream.
Lockdep is complaining about recursive locking, because it can't make a difference between locked skb_queues. Annotate nested locks and avoid double bh_disable/enable.
[...] insmod/815 is trying to acquire lock: cb7d6418 (&(&list->lock)->rlock){+...}, at: wfx_tx_queues_clear+0xfc/0x198 [wfx]
but task is already holding lock: cb7d61f4 (&(&list->lock)->rlock){+...}, at: wfx_tx_queues_clear+0xa0/0x198 [wfx]
[...] Possible unsafe locking scenario:
CPU0 ---- lock(&(&list->lock)->rlock); lock(&(&list->lock)->rlock);
Cc: stable@vger.kernel.org Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames") Signed-off-by: Michał Mirosław mirq-linux@rere.qmqm.pl Link: https://lore.kernel.org/r/5e30397af95854b4a7deea073b730c00229f42ba.158141684... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/staging/wfx/queue.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/staging/wfx/queue.c +++ b/drivers/staging/wfx/queue.c @@ -130,12 +130,12 @@ static void wfx_tx_queue_clear(struct wf spin_lock_bh(&queue->queue.lock); while ((item = __skb_dequeue(&queue->queue)) != NULL) skb_queue_head(gc_list, item); - spin_lock_bh(&stats->pending.lock); + spin_lock_nested(&stats->pending.lock, 1); for (i = 0; i < ARRAY_SIZE(stats->link_map_cache); ++i) { stats->link_map_cache[i] -= queue->link_map_cache[i]; queue->link_map_cache[i] = 0; } - spin_unlock_bh(&stats->pending.lock); + spin_unlock(&stats->pending.lock); spin_unlock_bh(&queue->queue.lock); }
@@ -207,9 +207,9 @@ void wfx_tx_queue_put(struct wfx_dev *wd
++queue->link_map_cache[tx_priv->link_id];
- spin_lock_bh(&stats->pending.lock); + spin_lock_nested(&stats->pending.lock, 1); ++stats->link_map_cache[tx_priv->link_id]; - spin_unlock_bh(&stats->pending.lock); + spin_unlock(&stats->pending.lock); spin_unlock_bh(&queue->queue.lock); }
@@ -237,11 +237,11 @@ static struct sk_buff *wfx_tx_queue_get( __skb_unlink(skb, &queue->queue); --queue->link_map_cache[tx_priv->link_id];
- spin_lock_bh(&stats->pending.lock); + spin_lock_nested(&stats->pending.lock, 1); __skb_queue_tail(&stats->pending, skb); if (!--stats->link_map_cache[tx_priv->link_id]) wakeup_stats = true; - spin_unlock_bh(&stats->pending.lock); + spin_unlock(&stats->pending.lock); } spin_unlock_bh(&queue->queue.lock); if (wakeup_stats) @@ -259,10 +259,10 @@ int wfx_pending_requeue(struct wfx_dev * spin_lock_bh(&queue->queue.lock); ++queue->link_map_cache[tx_priv->link_id];
- spin_lock_bh(&stats->pending.lock); + spin_lock_nested(&stats->pending.lock, 1); ++stats->link_map_cache[tx_priv->link_id]; __skb_unlink(skb, &stats->pending); - spin_unlock_bh(&stats->pending.lock); + spin_unlock(&stats->pending.lock); __skb_queue_tail(&queue->queue, skb); spin_unlock_bh(&queue->queue.lock); return 0;
From: Kai-Heng Feng kai.heng.feng@canonical.com
commit 32d2545462c6cede998267b86e57cda5d1dc2225 upstream.
Add the PCI ID to the driver list to support this new device.
Cc: stable@vger.kernel.org Signed-off-by: Kai-Heng Feng kai.heng.feng@canonical.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/ata/ahci.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/ata/ahci.c +++ b/drivers/ata/ahci.c @@ -401,6 +401,7 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/ { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/ { PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */ + { PCI_VDEVICE(INTEL, 0x06d7), board_ahci }, /* Comet Lake-H RAID */ { PCI_VDEVICE(INTEL, 0x0f22), board_ahci_mobile }, /* Bay Trail AHCI */ { PCI_VDEVICE(INTEL, 0x0f23), board_ahci_mobile }, /* Bay Trail AHCI */ { PCI_VDEVICE(INTEL, 0x22a3), board_ahci_mobile }, /* Cherry Tr. AHCI */
From: Eric Biggers ebiggers@google.com
commit a65cab7d7f05c2061a3e2490257d3086ff3202c6 upstream.
Reading from a debugfs file at a nonzero position, without first reading at position 0, leaks uninitialized memory to userspace.
It's a bit tricky to do this, since lseek() and pread() aren't allowed on these files, and write() doesn't update the position on them. But writing to them with splice() *does* update the position:
#define _GNU_SOURCE 1 #include <fcntl.h> #include <stdio.h> #include <unistd.h> int main() { int pipes[2], fd, n, i; char buf[32];
pipe(pipes); write(pipes[1], "0", 1); fd = open("/sys/kernel/debug/fault_around_bytes", O_RDWR); splice(pipes[0], NULL, fd, NULL, 1, 0); n = read(fd, buf, sizeof(buf)); for (i = 0; i < n; i++) printf("%02x", buf[i]); printf("\n"); }
Output: 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a30
Fix the infoleak by making simple_attr_read() always fill simple_attr::get_buf if it hasn't been filled yet.
Reported-by: syzbot+fcab69d1ada3e8d6f06b@syzkaller.appspotmail.com Reported-by: Alexander Potapenko glider@google.com Fixes: acaefc25d21f ("[PATCH] libfs: add simple attribute files") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers ebiggers@google.com Acked-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20200308023849.988264-1-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- fs/libfs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
--- a/fs/libfs.c +++ b/fs/libfs.c @@ -891,7 +891,7 @@ int simple_attr_open(struct inode *inode { struct simple_attr *attr;
- attr = kmalloc(sizeof(*attr), GFP_KERNEL); + attr = kzalloc(sizeof(*attr), GFP_KERNEL); if (!attr) return -ENOMEM;
@@ -931,9 +931,11 @@ ssize_t simple_attr_read(struct file *fi if (ret) return ret;
- if (*ppos) { /* continued read */ + if (*ppos && attr->get_buf[0]) { + /* continued read */ size = strlen(attr->get_buf); - } else { /* first read */ + } else { + /* first read */ u64 val; ret = attr->get(attr->data, &val); if (ret)
From: Johan Hovold johan@kernel.org
commit 998912346c0da53a6dbb71fab3a138586b596b30 upstream.
Make sure to check that we have at least one endpoint before accessing the endpoint array to avoid dereferencing a NULL-pointer on stream start.
Note that these sanity checks are not redundant as the driver is mixing looking up altsettings by index and by number, which need not coincide.
Fixes: 1876bb923c98 ("V4L/DVB (12079): gspca_ov519: add support for the ov511 bridge") Fixes: b282d87332f5 ("V4L/DVB (12080): gspca_ov519: Fix ov518+ with OV7620AE (Trust spacecam 320)") Cc: stable stable@vger.kernel.org # 2.6.31 Cc: Hans de Goede hdegoede@redhat.com Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/usb/gspca/ov519.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
--- a/drivers/media/usb/gspca/ov519.c +++ b/drivers/media/usb/gspca/ov519.c @@ -3477,6 +3477,11 @@ static void ov511_mode_init_regs(struct return; }
+ if (alt->desc.bNumEndpoints < 1) { + sd->gspca_dev.usb_err = -ENODEV; + return; + } + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);
@@ -3603,6 +3608,11 @@ static void ov518_mode_init_regs(struct return; }
+ if (alt->desc.bNumEndpoints < 1) { + sd->gspca_dev.usb_err = -ENODEV; + return; + } + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2);
From: Johan Hovold johan@kernel.org
commit f52981019ad8d6718de79b425a574c6bddf81f7c upstream.
Make sure to use the current alternate setting when verifying the interface descriptors to avoid submitting an URB to an invalid endpoint.
Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on.
Fixes: c4018fa2e4c0 ("[media] dib0700: fix RC support on Hauppauge Nova-TD") Cc: stable stable@vger.kernel.org # 3.16 Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Sean Young sean@mess.org Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/usb/dvb-usb/dib0700_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -818,7 +818,7 @@ int dib0700_rc_setup(struct dvb_usb_devi
/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
- if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1) + if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1) return -ENODEV;
purb = usb_alloc_urb(0, GFP_KERNEL); @@ -838,7 +838,7 @@ int dib0700_rc_setup(struct dvb_usb_devi * Some devices like the Hauppauge NovaTD model 52009 use an interrupt * endpoint, while others use a bulk one. */ - e = &intf->altsetting[0].endpoint[rc_ep].desc; + e = &intf->cur_altsetting->endpoint[rc_ep].desc; if (usb_endpoint_dir_in(e)) { if (usb_endpoint_xfer_bulk(e)) { pipe = usb_rcvbulkpipe(d->udev, rc_ep);
From: Johan Hovold johan@kernel.org
commit 485b06aadb933190f4bc44e006076bc27a23f205 upstream.
Make sure to check that we have two alternate settings and at least one endpoint before accessing the second altsetting structure and dereferencing the endpoint arrays.
This specifically avoids dereferencing NULL-pointers or corrupting memory when a device does not have the expected descriptors.
Note that the sanity checks in stv06xx_start() and pb0100_start() are not redundant as the driver is mixing looking up altsettings by index and by number, which may not coincide.
Fixes: 8668d504d72c ("V4L/DVB (12082): gspca_stv06xx: Add support for st6422 bridge and sensor") Fixes: c0b33bdc5b8d ("[media] gspca-stv06xx: support bandwidth changing") Cc: stable stable@vger.kernel.org # 2.6.31 Cc: Hans de Goede hdegoede@redhat.com Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 ++++++++++++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 ++++ 2 files changed, 22 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c +++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c @@ -282,6 +282,9 @@ static int stv06xx_start(struct gspca_de return -EIO; }
+ if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size); if (err < 0) @@ -306,11 +309,21 @@ out:
static int stv06xx_isoc_init(struct gspca_dev *gspca_dev) { + struct usb_interface_cache *intfc; struct usb_host_interface *alt; struct sd *sd = (struct sd *) gspca_dev;
+ intfc = gspca_dev->dev->actconfig->intf_cache[0]; + + if (intfc->num_altsetting < 2) + return -ENODEV; + + alt = &intfc->altsetting[1]; + + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + /* Start isoc bandwidth "negotiation" at max isoc bandwidth */ - alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]);
@@ -323,6 +336,10 @@ static int stv06xx_isoc_nego(struct gspc struct usb_host_interface *alt; struct sd *sd = (struct sd *) gspca_dev;
+ /* + * Existence of altsetting and endpoint was verified in + * stv06xx_isoc_init() + */ alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode]; --- a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c +++ b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c @@ -185,6 +185,10 @@ static int pb0100_start(struct sd *sd) alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt); if (!alt) return -ENODEV; + + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
/* If we don't have enough bandwidth use a lower framerate */
From: Johan Hovold johan@kernel.org
commit a246b4d547708f33ff4d4b9a7a5dbac741dc89d8 upstream.
Make sure to check that we have two alternate settings and at least one endpoint before accessing the second altsetting structure and dereferencing the endpoint arrays.
This specifically avoids dereferencing NULL-pointers or corrupting memory when a device does not have the expected descriptors.
Note that the sanity check in cit_get_packet_size() is not redundant as the driver is mixing looking up altsettings by index and by number, which may not coincide.
Fixes: 659fefa0eb17 ("V4L/DVB: gspca_xirlink_cit: Add support for camera with a bcd version of 0.01") Fixes: 59f8b0bf3c12 ("V4L/DVB: gspca_xirlink_cit: support bandwidth changing for devices with 1 alt setting") Cc: stable stable@vger.kernel.org # 2.6.37 Cc: Hans de Goede hdegoede@redhat.com Signed-off-by: Johan Hovold johan@kernel.org Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/gspca/xirlink_cit.c +++ b/drivers/media/usb/gspca/xirlink_cit.c @@ -1442,6 +1442,9 @@ static int cit_get_packet_size(struct gs return -EIO; }
+ if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); }
@@ -2626,6 +2629,7 @@ static int sd_start(struct gspca_dev *gs
static int sd_isoc_init(struct gspca_dev *gspca_dev) { + struct usb_interface_cache *intfc; struct usb_host_interface *alt; int max_packet_size;
@@ -2641,8 +2645,17 @@ static int sd_isoc_init(struct gspca_dev break; }
+ intfc = gspca_dev->dev->actconfig->intf_cache[0]; + + if (intfc->num_altsetting < 2) + return -ENODEV; + + alt = &intfc->altsetting[1]; + + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + /* Start isoc bandwidth "negotiation" at max isoc bandwidth */ - alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size);
return 0; @@ -2665,6 +2678,9 @@ static int sd_isoc_nego(struct gspca_dev break; }
+ /* + * Existence of altsetting and endpoint was verified in sd_isoc_init() + */ alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); if (packet_size <= min_packet_size)
From: Dafna Hirschfeld dafna.hirschfeld@collabora.com
commit 6990570f7e0a6078e11b9c5dc13f4b6e3f49a398 upstream.
sd->devnode is released after calling v4l2_subdev_release. Therefore it should be set to NULL so that the subdev won't hold a pointer to a released object. This fixes a reference after free bug in function v4l2_device_unregister_subdev
Fixes: 0e43734d4c46e ("media: v4l2-subdev: add release() internal op")
Cc: stable@vger.kernel.org Signed-off-by: Dafna Hirschfeld dafna.hirschfeld@collabora.com Reviewed-by: Ezequiel Garcia ezequiel@collabora.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/media/v4l2-core/v4l2-device.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/media/v4l2-core/v4l2-device.c +++ b/drivers/media/v4l2-core/v4l2-device.c @@ -179,6 +179,7 @@ static void v4l2_subdev_release(struct v
if (sd->internal_ops && sd->internal_ops->release) sd->internal_ops->release(sd); + sd->devnode = NULL; module_put(owner); }
On Tue, 31 Mar 2020 at 14:30, Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Perf build broken on Linux next and mainline and now on stable-rc-5.6 branch. where as building kernel Image is successful on arm64, arm, x86_64, and i386.
I have reported this problem on March 25th https://lore.kernel.org/linux-next/CA+G9fYtr+Je4=pLWUgUvPNzUSUmg04oXPJ8zFwTR...
On Tue, Mar 31, 2020 at 11:08 AM Naresh Kamboju naresh.kamboju@linaro.org wrote:
Perf build broken on Linux next and mainline and now on stable-rc-5.6 branch.
Strange. What is it that triggers the problem for you? It works fine here.. The error looks like some kind of command line quoting error, but I don't see the direct cause.
Have you bisected the failure? Build failures should be particularly easy and quick to bisect.
Linus
Em Tue, Mar 31, 2020 at 11:20:37AM -0700, Linus Torvalds escreveu:
On Tue, Mar 31, 2020 at 11:08 AM Naresh Kamboju naresh.kamboju@linaro.org wrote:
Perf build broken on Linux next and mainline and now on stable-rc-5.6 branch.
Strange. What is it that triggers the problem for you? It works fine here.. The error looks like some kind of command line quoting error, but I don't see the direct cause.
Have you bisected the failure? Build failures should be particularly easy and quick to bisect.
Naresh, can you try with the patch below? There was some back and forth about a second patch in a series and this fell thru the cracks.
And also, BTW, can you please send me instructions on how to get hold of the toolchain you use to crossbuild perf, so that I can add it to my set of test build containers?
- Arnaldo
---
From: He Zhe zhe.he@windriver.com
The $(CC) passed to arch_errno_names.sh may include a series of parameters along with gcc itself. To avoid overwriting the following parameters of arch_errno_names.sh and break the build like below, we just pick up the first word of the $(CC).
find: unknown predicate `-m64/arch' x86_64-wrs-linux-gcc: warning: '-x c' after last input file has no effect x86_64-wrs-linux-gcc: error: unrecognized command line option '-m64/include/uapi/asm-generic/errno.h' x86_64-wrs-linux-gcc: fatal error: no input files
Signed-off-by: He Zhe zhe.he@windriver.com --- tools/perf/Makefile.perf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf index 3eda9d4..7114c11 100644 --- a/tools/perf/Makefile.perf +++ b/tools/perf/Makefile.perf @@ -573,7 +573,7 @@ arch_errno_hdr_dir := $(srctree)/tools arch_errno_tbl := $(srctree)/tools/perf/trace/beauty/arch_errno_names.sh
$(arch_errno_name_array): $(arch_errno_tbl) - $(Q)$(SHELL) '$(arch_errno_tbl)' $(CC) $(arch_errno_hdr_dir) > $@ + $(Q)$(SHELL) '$(arch_errno_tbl)' $(firstword $(CC)) $(arch_errno_hdr_dir) > $@
sync_file_range_arrays := $(beauty_outdir)/sync_file_range_arrays.c sync_file_range_tbls := $(srctree)/tools/perf/trace/beauty/sync_file_range.sh
Hello!
On Tue, 31 Mar 2020 at 13:29, Arnaldo Carvalho de Melo arnaldo.melo@gmail.com wrote:
Em Tue, Mar 31, 2020 at 11:20:37AM -0700, Linus Torvalds escreveu:
On Tue, Mar 31, 2020 at 11:08 AM Naresh Kamboju naresh.kamboju@linaro.org wrote:
Perf build broken on Linux next and mainline and now on stable-rc-5.6 branch.
Strange. What is it that triggers the problem for you? It works fine here.. The error looks like some kind of command line quoting error, but I don't see the direct cause.
Have you bisected the failure? Build failures should be particularly easy and quick to bisect.
Naresh, can you try with the patch below? There was some back and forth about a second patch in a series and this fell thru the cracks.
I tried that patch, did not help.
Bisection led to the expected merge, "perf-urgent-for-linus", so I went one by one and found this commit: a7ffd416d804 ("perf python: Fix clang detection when using CC=clang-version"). Specifically, the line that fails is:
cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline()
with:
Traceback (most recent call last): File "util/setup.py", line 6, in <module> cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline() File "/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot-native/usr/lib/python2.7/subprocess.py", line 394, in __init__ errread, errwrite) File "/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot-native/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child raise child_exception OSError: [Errno 2] No such file or directory
There, the value for CC is "aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot".
And also, BTW, can you please send me instructions on how to get hold of the toolchain you use to crossbuild perf, so that I can add it to my set of test build containers?
It's an OE build, so it's bound to take quite a bit of space. I'll try to get something dockerized so that it's easier to replicate.
Thanks and greetings!
Daniel Díaz daniel.diaz@linaro.org
- Arnaldo
From: He Zhe zhe.he@windriver.com
The $(CC) passed to arch_errno_names.sh may include a series of parameters along with gcc itself. To avoid overwriting the following parameters of arch_errno_names.sh and break the build like below, we just pick up the first word of the $(CC).
find: unknown predicate `-m64/arch' x86_64-wrs-linux-gcc: warning: '-x c' after last input file has no effect x86_64-wrs-linux-gcc: error: unrecognized command line option '-m64/include/uapi/asm-generic/errno.h' x86_64-wrs-linux-gcc: fatal error: no input files
Signed-off-by: He Zhe zhe.he@windriver.com
tools/perf/Makefile.perf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf index 3eda9d4..7114c11 100644 --- a/tools/perf/Makefile.perf +++ b/tools/perf/Makefile.perf @@ -573,7 +573,7 @@ arch_errno_hdr_dir := $(srctree)/tools arch_errno_tbl := $(srctree)/tools/perf/trace/beauty/arch_errno_names.sh
$(arch_errno_name_array): $(arch_errno_tbl)
$(Q)$(SHELL) '$(arch_errno_tbl)' $(CC) $(arch_errno_hdr_dir) > $@
$(Q)$(SHELL) '$(arch_errno_tbl)' $(firstword $(CC)) $(arch_errno_hdr_dir) > $@sync_file_range_arrays := $(beauty_outdir)/sync_file_range_arrays.c sync_file_range_tbls := $(srctree)/tools/perf/trace/beauty/sync_file_range.sh -- 2.7.4
Em Tue, Mar 31, 2020 at 05:18:57PM -0600, Daniel Díaz escreveu:
On Tue, 31 Mar 2020 at 13:29, Arnaldo Carvalho de Melo arnaldo.melo@gmail.com wrote:
Em Tue, Mar 31, 2020 at 11:20:37AM -0700, Linus Torvalds escreveu:
On Tue, Mar 31, 2020 at 11:08 AM Naresh Kamboju naresh.kamboju@linaro.org wrote:
Perf build broken on Linux next and mainline and now on stable-rc-5.6 branch.
Strange. What is it that triggers the problem for you? It works fine here.. The error looks like some kind of command line quoting error, but I don't see the direct cause.
Have you bisected the failure? Build failures should be particularly easy and quick to bisect.
Naresh, can you try with the patch below? There was some back and forth about a second patch in a series and this fell thru the cracks.
I tried that patch, did not help.
Bisection led to the expected merge, "perf-urgent-for-linus", so I went one by one and found this commit: a7ffd416d804 ("perf python: Fix clang detection when using CC=clang-version"). Specifically, the line that fails is:
cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline()
with:
Traceback (most recent call last): File "util/setup.py", line 6, in <module> cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline() File "/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot-native/usr/lib/python2.7/subprocess.py", line 394, in __init__ errread, errwrite) File "/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot-native/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child raise child_exception OSError: [Errno 2] No such file or directory
There, the value for CC is "aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot".
Yeah, the assumption was that CC would be just the compiler, whatever options needed for compiling would be in CFLAGS, so the solution should be similar to the other patch, i.e. split CC and get the first word to use with 'cc -v', i.e.:
[perfbuilder@five ~]$ podman run --entrypoint=/bin/sh --rm -ti acmel/linux-perf-tools-build-ubuntu:18.04-x-arm64 $ [perfbuilder@five ~]$ podman run --entrypoint=/bin/bash --rm -ti acmel/linux-perf-tools-build-ubuntu:18.04-x-arm64 perfbuilder@92dcc3ff8814:/$ python3 Python 3.6.9 (default, Nov 7 2019, 10:44:02) [GCC 8.3.0] on linux Type "help", "copyright", "credits" or "license" for more information.
from subprocess import Popen a = Popen(["aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot", "-v"])
Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3.6/subprocess.py", line 729, in __init__ restore_signals, start_new_session) File "/usr/lib/python3.6/subprocess.py", line 1364, in _execute_child raise child_exception_type(errno_num, err_msg, err_filename) FileNotFoundError: [Errno 2] No such file or directory: 'aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot': 'aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot'
a = Popen(["aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot".split()[0], "-v"]) Using built-in specs.
COLLECT_GCC=aarch64-linux-gnu-gcc COLLECT_LTO_WRAPPER=/usr/lib/gcc-cross/aarch64-linux-gnu/7/lto-wrapper Target: aarch64-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu/Linaro 7.5.0-3ubuntu1~18.04' --with-bugurl=file:///usr/share/doc/gcc-7/README.Bugs --enable-languages=c,ada,c++,go,d,fortran,objc,obj-c++ --prefix=/usr --with-gcc-major-version-only --program-suffix=-7 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-libquadmath --disable-libquadmath-support --enable-plugin --enable-default-pie --with-system-zlib --enable-multiarch --enable-fix-cortex-a53-843419 --disable-werror --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=aarch64-linux-gnu --program-prefix=aarch64-linux-gnu- --includedir=/usr/aarch64-linux-gnu/include Thread model: posix gcc version 7.5.0 (Ubuntu/Linaro 7.5.0-3ubuntu1~18.04)
Can you please try the one-liner at the end of this message?
And also, BTW, can you please send me instructions on how to get hold of the toolchain you use to crossbuild perf, so that I can add it to my set of test build containers?
It's an OE build, so it's bound to take quite a bit of space. I'll try to get something dockerized so that it's easier to replicate.
Thanks a lot!
- Arnaldo
From 2a88ba6ddf54a4340f5a5f896705d5e42561e210 Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo acme@redhat.com Date: Wed, 1 Apr 2020 09:33:59 -0300 Subject: [PATCH 1/1] perf python: Fix clang detection to strip out options passed in $CC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit
The clang check in the python setup.py file expected $CC to be just the name of the compiler, not the compiler + options, i.e. all options were expected to be passed in $CFLAGS, this ends up making it fail in systems where CC is set to, e.g.:
"aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot"
Like this:
$ python3
from subprocess import Popen a = Popen(["aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot", "-v"])
Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3.6/subprocess.py", line 729, in __init__ restore_signals, start_new_session) File "/usr/lib/python3.6/subprocess.py", line 1364, in _execute_child raise child_exception_type(errno_num, err_msg, err_filename) FileNotFoundError: [Errno 2] No such file or directory: 'aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot': 'aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot'
Make it more robust, covering this case, by passing cc.split()[0] as the first arg to popen().
Reported-by: Daniel Díaz daniel.diaz@linaro.org Reported-by: Naresh Kamboju naresh.kamboju@linaro.org Cc: Adrian Hunter adrian.hunter@intel.com Cc: Arnaldo Carvalho de Melo arnaldo.melo@gmail.com, Cc: Jiri Olsa jolsa@kernel.org Cc: Namhyung Kim namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com --- tools/perf/util/setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py index 8a065a6f9713..347b2c0789e4 100644 --- a/tools/perf/util/setup.py +++ b/tools/perf/util/setup.py @@ -3,7 +3,7 @@ from subprocess import Popen, PIPE from re import sub
cc = getenv("CC") -cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline() +cc_is_clang = b"clang version" in Popen([cc.split()[0], "-v"], stderr=PIPE).stderr.readline()
def clang_has_option(option): return [o for o in Popen([cc, option], stderr=PIPE).stderr.readlines() if b"unknown argument" in o] == [ ]
Hello!
On Wed, 1 Apr 2020 at 06:40, Arnaldo Carvalho de Melo arnaldo.melo@gmail.com wrote:
Can you please try the one-liner at the end of this message?
[...]
From 2a88ba6ddf54a4340f5a5f896705d5e42561e210 Mon Sep 17 00:00:00 2001 From: Arnaldo Carvalho de Melo acme@redhat.com Date: Wed, 1 Apr 2020 09:33:59 -0300 Subject: [PATCH 1/1] perf python: Fix clang detection to strip out options passed in $CC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit
The clang check in the python setup.py file expected $CC to be just the name of the compiler, not the compiler + options, i.e. all options were expected to be passed in $CFLAGS, this ends up making it fail in systems where CC is set to, e.g.:
"aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot"
Like this:
$ python3
from subprocess import Popen a = Popen(["aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot", "-v"])
Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python3.6/subprocess.py", line 729, in __init__ restore_signals, start_new_session) File "/usr/lib/python3.6/subprocess.py", line 1364, in _execute_child raise child_exception_type(errno_num, err_msg, err_filename) FileNotFoundError: [Errno 2] No such file or directory: 'aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot': 'aarch64-linux-gnu-gcc --sysroot=/oe/build/tmp/work/juno-linaro-linux/perf/1.0-r9/recipe-sysroot'
Make it more robust, covering this case, by passing cc.split()[0] as the first arg to popen().
Reported-by: Daniel Díaz daniel.diaz@linaro.org Reported-by: Naresh Kamboju naresh.kamboju@linaro.org Cc: Adrian Hunter adrian.hunter@intel.com Cc: Arnaldo Carvalho de Melo arnaldo.melo@gmail.com, Cc: Jiri Olsa jolsa@kernel.org Cc: Namhyung Kim namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com
tools/perf/util/setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py index 8a065a6f9713..347b2c0789e4 100644 --- a/tools/perf/util/setup.py +++ b/tools/perf/util/setup.py @@ -3,7 +3,7 @@ from subprocess import Popen, PIPE from re import sub
cc = getenv("CC") -cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline() +cc_is_clang = b"clang version" in Popen([cc.split()[0], "-v"], stderr=PIPE).stderr.readline()
def clang_has_option(option): return [o for o in Popen([cc, option], stderr=PIPE).stderr.readlines() if b"unknown argument" in o] == [ ] -- 2.21.1
This worked on top of torvalds/master and linux-stable-rc/linux-5.6.y.
Thanks and greetings!
Daniel Díaz daniel.diaz@linaro.org
Em Wed, Apr 01, 2020 at 07:45:53AM -0600, Daniel Díaz escreveu:
This worked on top of torvalds/master and linux-stable-rc/linux-5.6.y.
Thanks and greetings!
Thanks, I'm taking this as a:
Tested-by: Daniel Díaz daniel.diaz@linaro.org
Ok?
- Arnaldo
Daniel Díaz daniel.diaz@linaro.org
Hello!
On Wed, 1 Apr 2020 at 08:34, Arnaldo Carvalho de Melo arnaldo.melo@gmail.com wrote:
Em Wed, Apr 01, 2020 at 07:45:53AM -0600, Daniel Díaz escreveu:
This worked on top of torvalds/master and linux-stable-rc/linux-5.6.y.
Thanks and greetings!
Thanks, I'm taking this as a:
Tested-by: Daniel Díaz daniel.diaz@linaro.org
Ok?
Yes, I build-tested those.
Thanks and greetings!
Daniel Díaz daniel.diaz@linaro.org
On 3/31/20 2:59 AM, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks, -- Shuah
On Tue, Mar 31, 2020 at 01:32:53PM -0600, shuah wrote:
On 3/31/20 2:59 AM, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing these and letting me know.
greg k-h
On Tue, 2020-03-31 at 10:59 +0200, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux- stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.6.1-rc1
Dafna Hirschfeld dafna.hirschfeld@collabora.com media: v4l2-core: fix a use-after-free bug of sd->devnode
Johan Hovold johan@kernel.org media: xirlink_cit: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: stv06xx: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: dib0700: fix rc endpoint lookup
Johan Hovold johan@kernel.org media: ov519: add missing endpoint sanity checks
Eric Biggers ebiggers@google.com libfs: fix infoleak in simple_attr_read()
Kai-Heng Feng kai.heng.feng@canonical.com ahci: Add Intel Comet Lake H RAID PCI ID
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: annotate nested gc_list vs tx queue locking
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: fix init/remove vs IRQ race
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: add proper "compatible" string
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
Larry Finger Larry.Finger@lwfinger.net staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
Dan Carpenter dan.carpenter@oracle.com staging: kpc2000: prevent underflow in cpld_reconfigure()
Johan Hovold johan@kernel.org media: usbtv: fix control-message timeouts
Johan Hovold johan@kernel.org media: flexcop-usb: fix endpoint sanity check
Mans Rullgard mans@mansr.com usb: musb: fix crash with highmen PIO and usbmon
Qiujun Huang hqjagain@gmail.com USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
Matthias Reichl hias@horus.com USB: cdc-acm: restore capability check order
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add Wistron Neweb D19Q1
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add BroadMobi BM806U
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add support for ASKEY WWHC050
Daniel Borkmann daniel@iogearbox.net bpf: Undo incorrect __reg_bound_offset32 handling
Diffstat:
Makefile | 4 +-- drivers/ata/ahci.c | 1 + drivers/media/usb/b2c2/flexcop-usb.c | 6 ++-- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +-- drivers/media/usb/gspca/ov519.c | 10 ++++++ drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 +++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 +++ drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +-- drivers/media/v4l2-core/v4l2-device.c | 1 + drivers/staging/kpc2000/kpc2000/core.c | 4 +-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + .../bindings/net/wireless/siliabs,wfx.txt | 7 ++-- drivers/staging/wfx/bus_sdio.c | 15 ++++---- drivers/staging/wfx/bus_spi.c | 41 +++++++++++++--------- drivers/staging/wfx/main.c | 21 ++++++----- drivers/staging/wfx/main.h | 1 - drivers/staging/wfx/queue.c | 16 ++++----- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ drivers/staging/wlan-ng/prism2usb.c | 1 + drivers/usb/class/cdc-acm.c | 18 +++++----- drivers/usb/musb/musb_host.c | 17 +++------ drivers/usb/serial/io_edgeport.c | 2 +- drivers/usb/serial/option.c | 6 ++++ fs/libfs.c | 8 +++-- kernel/bpf/verifier.c | 19 ---------- 27 files changed, 149 insertions(+), 104 deletions(-)
Compiled, booted, and no regressions on my machine.
BR, Vitor
On 3/31/20 1:59 AM, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
Build results: total: 155 pass: 155 fail: 0 Qemu test results: total: 428 pass: 428 fail: 0
Guenter
On Tue, Mar 31, 2020 at 07:25:48PM -0700, Guenter Roeck wrote:
On 3/31/20 1:59 AM, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
Build results: total: 155 pass: 155 fail: 0 Qemu test results: total: 428 pass: 428 fail: 0
Wonderful, thanks for testing these and letting me know.
greg k-h
Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.6.1-rc1
Dafna Hirschfeld dafna.hirschfeld@collabora.com media: v4l2-core: fix a use-after-free bug of sd->devnode
Johan Hovold johan@kernel.org media: xirlink_cit: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: stv06xx: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: dib0700: fix rc endpoint lookup
Johan Hovold johan@kernel.org media: ov519: add missing endpoint sanity checks
Eric Biggers ebiggers@google.com libfs: fix infoleak in simple_attr_read()
Kai-Heng Feng kai.heng.feng@canonical.com ahci: Add Intel Comet Lake H RAID PCI ID
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: annotate nested gc_list vs tx queue locking
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: fix init/remove vs IRQ race
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: add proper "compatible" string
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
Larry Finger Larry.Finger@lwfinger.net staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
Dan Carpenter dan.carpenter@oracle.com staging: kpc2000: prevent underflow in cpld_reconfigure()
Johan Hovold johan@kernel.org media: usbtv: fix control-message timeouts
Johan Hovold johan@kernel.org media: flexcop-usb: fix endpoint sanity check
Mans Rullgard mans@mansr.com usb: musb: fix crash with highmen PIO and usbmon
Qiujun Huang hqjagain@gmail.com USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
Matthias Reichl hias@horus.com USB: cdc-acm: restore capability check order
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add Wistron Neweb D19Q1
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add BroadMobi BM806U
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add support for ASKEY WWHC050
Daniel Borkmann daniel@iogearbox.net bpf: Undo incorrect __reg_bound_offset32 handling
Diffstat:
Makefile | 4 +-- drivers/ata/ahci.c | 1 + drivers/media/usb/b2c2/flexcop-usb.c | 6 ++-- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +-- drivers/media/usb/gspca/ov519.c | 10 ++++++ drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 +++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 +++ drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +-- drivers/media/v4l2-core/v4l2-device.c | 1 + drivers/staging/kpc2000/kpc2000/core.c | 4 +-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + .../bindings/net/wireless/siliabs,wfx.txt | 7 ++-- drivers/staging/wfx/bus_sdio.c | 15 ++++---- drivers/staging/wfx/bus_spi.c | 41 +++++++++++++--------- drivers/staging/wfx/main.c | 21 ++++++----- drivers/staging/wfx/main.h | 1 - drivers/staging/wfx/queue.c | 16 ++++----- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ drivers/staging/wlan-ng/prism2usb.c | 1 + drivers/usb/class/cdc-acm.c | 18 +++++----- drivers/usb/musb/musb_host.c | 17 +++------ drivers/usb/serial/io_edgeport.c | 2 +- drivers/usb/serial/option.c | 6 ++++ fs/libfs.c | 8 +++-- kernel/bpf/verifier.c | 19 ---------- 27 files changed, 149 insertions(+), 104 deletions(-)
I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
Without it 5.6 is completely broken on iwlwifi.
Thanks, Woody
On Tue, Mar 31, 2020 at 11:06:16PM -0400, Woody Suwalski wrote:
Greg Kroah-Hartman wrote: I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
It should come in soon, in another release or so, when the next set of networking patches get sent to me.
thanks,
greg k-h
On Wed, Apr 01, 2020 at 07:51:52AM +0200, Greg Kroah-Hartman wrote:
On Tue, Mar 31, 2020 at 11:06:16PM -0400, Woody Suwalski wrote:
Greg Kroah-Hartman wrote: I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
It should come in soon, in another release or so, when the next set of networking patches get sent to me.
And also didn't hit Linus's tree until after this set of -rc patches went out, so it's not like I missed it or anything :)
thanks,
greg k-h
Greg Kroah-Hartman wrote:
On Wed, Apr 01, 2020 at 07:51:52AM +0200, Greg Kroah-Hartman wrote:
On Tue, Mar 31, 2020 at 11:06:16PM -0400, Woody Suwalski wrote:
Greg Kroah-Hartman wrote: I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
It should come in soon, in another release or so, when the next set of networking patches get sent to me.
And also didn't hit Linus's tree until after this set of -rc patches went out, so it's not like I missed it or anything :)
thanks,
greg k-h
My bad. It was supposed to be: I think that that patch should be considered soon... Thanks, Woody
On Wed, Apr 01, 2020 at 07:06:47AM -0400, Woody Suwalski wrote:
Greg Kroah-Hartman wrote:
On Wed, Apr 01, 2020 at 07:51:52AM +0200, Greg Kroah-Hartman wrote:
On Tue, Mar 31, 2020 at 11:06:16PM -0400, Woody Suwalski wrote:
Greg Kroah-Hartman wrote: I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
It should come in soon, in another release or so, when the next set of networking patches get sent to me.
And also didn't hit Linus's tree until after this set of -rc patches went out, so it's not like I missed it or anything :)
thanks,
greg k-h
My bad. It was supposed to be: I think that that patch should be considered soon...
It will be, give us a chance. I know the normal problem of "the only drivers that matter are the ones I use" applies here, but luckily I don't use that driver :)
thanks,
greg k-h
On 3/31/20 9:06 PM, Woody Suwalski wrote:
Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g...
or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.6.1-rc1
Dafna Hirschfeld dafna.hirschfeld@collabora.com media: v4l2-core: fix a use-after-free bug of sd->devnode
Johan Hovold johan@kernel.org media: xirlink_cit: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: stv06xx: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: dib0700: fix rc endpoint lookup
Johan Hovold johan@kernel.org media: ov519: add missing endpoint sanity checks
Eric Biggers ebiggers@google.com libfs: fix infoleak in simple_attr_read()
Kai-Heng Feng kai.heng.feng@canonical.com ahci: Add Intel Comet Lake H RAID PCI ID
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: annotate nested gc_list vs tx queue locking
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: fix init/remove vs IRQ race
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: add proper "compatible" string
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
Larry Finger Larry.Finger@lwfinger.net staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
Dan Carpenter dan.carpenter@oracle.com staging: kpc2000: prevent underflow in cpld_reconfigure()
Johan Hovold johan@kernel.org media: usbtv: fix control-message timeouts
Johan Hovold johan@kernel.org media: flexcop-usb: fix endpoint sanity check
Mans Rullgard mans@mansr.com usb: musb: fix crash with highmen PIO and usbmon
Qiujun Huang hqjagain@gmail.com USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
Matthias Reichl hias@horus.com USB: cdc-acm: restore capability check order
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add Wistron Neweb D19Q1
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add BroadMobi BM806U
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add support for ASKEY WWHC050
Daniel Borkmann daniel@iogearbox.net bpf: Undo incorrect __reg_bound_offset32 handling
Diffstat:
Makefile | 4 +-- drivers/ata/ahci.c | 1 + drivers/media/usb/b2c2/flexcop-usb.c | 6 ++-- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +-- drivers/media/usb/gspca/ov519.c | 10 ++++++ drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 +++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 +++ drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +-- drivers/media/v4l2-core/v4l2-device.c | 1 + drivers/staging/kpc2000/kpc2000/core.c | 4 +-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + .../bindings/net/wireless/siliabs,wfx.txt | 7 ++-- drivers/staging/wfx/bus_sdio.c | 15 ++++---- drivers/staging/wfx/bus_spi.c | 41 +++++++++++++--------- drivers/staging/wfx/main.c | 21 ++++++----- drivers/staging/wfx/main.h | 1 - drivers/staging/wfx/queue.c | 16 ++++----- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ drivers/staging/wlan-ng/prism2usb.c | 1 + drivers/usb/class/cdc-acm.c | 18 +++++----- drivers/usb/musb/musb_host.c | 17 +++------ drivers/usb/serial/io_edgeport.c | 2 +- drivers/usb/serial/option.c | 6 ++++ fs/libfs.c | 8 +++-- kernel/bpf/verifier.c | 19 ---------- 27 files changed, 149 insertions(+), 104 deletions(-)
I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
Without it 5.6 is completely broken on iwlwifi.
I am seeing this on my primary laptop with Linux 5.6. I switched back to Linux 5.6-rc7 for now. Is this issue introduced in 5.6 when Dave's networking pull? 5.6-rc7 is just fine.
wifi authentication keeps on failing and can't connect at all.
Just about to report this for 5.6 and saw this thread.
thanks, -- Shuah
On Wed, Apr 01, 2020 at 09:40:31AM -0600, shuah wrote:
On 3/31/20 9:06 PM, Woody Suwalski wrote:
Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g...
or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.6.1-rc1
Dafna Hirschfeld dafna.hirschfeld@collabora.com media: v4l2-core: fix a use-after-free bug of sd->devnode
Johan Hovold johan@kernel.org media: xirlink_cit: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: stv06xx: add missing descriptor sanity checks
Johan Hovold johan@kernel.org media: dib0700: fix rc endpoint lookup
Johan Hovold johan@kernel.org media: ov519: add missing endpoint sanity checks
Eric Biggers ebiggers@google.com libfs: fix infoleak in simple_attr_read()
Kai-Heng Feng kai.heng.feng@canonical.com ahci: Add Intel Comet Lake H RAID PCI ID
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: annotate nested gc_list vs tx queue locking
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: fix init/remove vs IRQ race
Michał Mirosław mirq-linux@rere.qmqm.pl staging: wfx: add proper "compatible" string
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
Qiujun Huang hqjagain@gmail.com staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
Larry Finger Larry.Finger@lwfinger.net staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
Dan Carpenter dan.carpenter@oracle.com staging: kpc2000: prevent underflow in cpld_reconfigure()
Johan Hovold johan@kernel.org media: usbtv: fix control-message timeouts
Johan Hovold johan@kernel.org media: flexcop-usb: fix endpoint sanity check
Mans Rullgard mans@mansr.com usb: musb: fix crash with highmen PIO and usbmon
Qiujun Huang hqjagain@gmail.com USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
Matthias Reichl hias@horus.com USB: cdc-acm: restore capability check order
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add Wistron Neweb D19Q1
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add BroadMobi BM806U
Pawel Dembicki paweldembicki@gmail.com USB: serial: option: add support for ASKEY WWHC050
Daniel Borkmann daniel@iogearbox.net bpf: Undo incorrect __reg_bound_offset32 handling
Diffstat:
Makefile | 4 +-- drivers/ata/ahci.c | 1 + drivers/media/usb/b2c2/flexcop-usb.c | 6 ++-- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +-- drivers/media/usb/gspca/ov519.c | 10 ++++++ drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 +++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 +++ drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +-- drivers/media/v4l2-core/v4l2-device.c | 1 + drivers/staging/kpc2000/kpc2000/core.c | 4 +-- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + .../bindings/net/wireless/siliabs,wfx.txt | 7 ++-- drivers/staging/wfx/bus_sdio.c | 15 ++++---- drivers/staging/wfx/bus_spi.c | 41 +++++++++++++--------- drivers/staging/wfx/main.c | 21 ++++++----- drivers/staging/wfx/main.h | 1 - drivers/staging/wfx/queue.c | 16 ++++----- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ drivers/staging/wlan-ng/prism2usb.c | 1 + drivers/usb/class/cdc-acm.c | 18 +++++----- drivers/usb/musb/musb_host.c | 17 +++------ drivers/usb/serial/io_edgeport.c | 2 +- drivers/usb/serial/option.c | 6 ++++ fs/libfs.c | 8 +++-- kernel/bpf/verifier.c | 19 ---------- 27 files changed, 149 insertions(+), 104 deletions(-)
I think you have missed the https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=be...
Without it 5.6 is completely broken on iwlwifi.
I am seeing this on my primary laptop with Linux 5.6. I switched back to Linux 5.6-rc7 for now. Is this issue introduced in 5.6 when Dave's networking pull? 5.6-rc7 is just fine.
wifi authentication keeps on failing and can't connect at all.
Just about to report this for 5.6 and saw this thread.
It will be in the next 5.6.y release, thanks.
greg k-h
On 31/03/2020 09:59, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.6: 13 builds: 13 pass, 0 fail 24 boots: 24 pass, 0 fail 40 tests: 40 pass, 0 fail
Linux version: 5.6.1-rc1-g579bffceae01 Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000, tegra194-p2972-0000, tegra20-ventana, tegra210-p2371-2180, tegra210-p3450-0000, tegra30-cardhu-a04
Cheers Jon
On Wed, Apr 01, 2020 at 09:57:37AM +0100, Jon Hunter wrote:
On 31/03/2020 09:59, Greg Kroah-Hartman wrote:
This is the start of the stable review cycle for the 5.6.1 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.6.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.6.y and the diffstat can be found below.
thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v5.6: 13 builds: 13 pass, 0 fail 24 boots: 24 pass, 0 fail 40 tests: 40 pass, 0 fail
Linux version: 5.6.1-rc1-g579bffceae01 Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000, tegra194-p2972-0000, tegra20-ventana, tegra210-p2371-2180, tegra210-p3450-0000, tegra30-cardhu-a04
Thanks for testing all of these and letting me know.
greg k-h
linux-stable-mirror@lists.linaro.org
-
Arnaldo Carvalho de Melo -
Daniel Díaz -
Greg Kroah-Hartman -
Guenter Roeck -
Jon Hunter -
Linus Torvalds -
Naresh Kamboju -
shuah -
Vitor Massaru Iha -
Woody Suwalski