- Kernel - mailweb.openeuler.org

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:18, dqh 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] spi: Cleanup on failure of initial setup
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:18, dqh 写道: > From: Lukas Wunner <lukas(a)wunner.de> > > stable inclusion > from stable-v5.10.44 > commit fa05ba61967ad051f5f2b7c4f39d6c56719c9900 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=470 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 2ec6f20b33eb4f62ab90bdcd620436c883ec3af6 ] > > Commit c7299fea6769 ("spi: Fix spi device unregister flow") changed the > SPI core's behavior if the ->setup() hook returns an error upon adding > an spi_device: Before, the ->cleanup() hook was invoked to free any > allocations that were made by ->setup(). With the commit, that's no > longer the case, so the ->setup() hook is expected to free the > allocations itself. > > I've identified 5 drivers which depend on the old behavior and am fixing > them up hereinafter: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c > spi-omap2-mcspi.c spi-pxa2xx.c > > Importantly, ->setup() is not only invoked on spi_device *addition*: > It may subsequently be called to *change* SPI parameters. If changing > these SPI parameters fails, freeing memory allocations would be wrong. > That should only be done if the spi_device is finally destroyed. > I am therefore using a bool "initial_setup" in 4 of the affected drivers > to differentiate between the invocation on *adding* the spi_device and > any subsequent invocations: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c > spi-omap2-mcspi.c > > In spi-pxa2xx.c, it seems the ->setup() hook can only fail on spi_device > addition, not any subsequent calls. It therefore doesn't need the bool. > > It's worth noting that 5 other drivers already perform a cleanup if the > ->setup() hook fails. Before c7299fea6769, they caused a double-free > if ->setup() failed on spi_device addition. Since the commit, they're > fine. These drivers are: spi-mpc512x-psc.c spi-pl022.c spi-s3c64xx.c > spi-st-ssc4.c spi-tegra114.c > > (spi-pxa2xx.c also already performs a cleanup, but only in one of > several error paths.) > > Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") > Signed-off-by: Lukas Wunner <lukas(a)wunner.de> > Cc: Saravana Kannan <saravanak(a)google.com> > Acked-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> # pxa2xx > Link: https://lore.kernel.org/r/f76a0599469f265b69c371538794101fa37b5536.16221493… > Signed-off-by: Mark Brown <broonie(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: dqh <1486653795(a)qq.com> > --- > drivers/spi/spi-bitbang.c | 18 ++++++++++++++---- > drivers/spi/spi-fsl-spi.c | 4 ++++ > drivers/spi/spi-omap-uwire.c | 9 ++++++++- > drivers/spi/spi-omap2-mcspi.c | 33 ++++++++++++++++++++------------- > drivers/spi/spi-pxa2xx.c | 9 ++++++++- > 5 files changed, 54 insertions(+), 19 deletions(-) > > diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c > index 1a7352abd878..3d8948a17095 100644 > --- a/drivers/spi/spi-bitbang.c > +++ b/drivers/spi/spi-bitbang.c > @@ -181,6 +181,8 @@ int spi_bitbang_setup(struct spi_device *spi) > { > struct spi_bitbang_cs *cs = spi->controller_state; > struct spi_bitbang *bitbang; > + bool initial_setup = false; > + int retval; > > bitbang = spi_master_get_devdata(spi->master); > > @@ -189,22 +191,30 @@ int spi_bitbang_setup(struct spi_device *spi) > if (!cs) > return -ENOMEM; > spi->controller_state = cs; > + initial_setup = true; > } > > /* per-word shift register access, in hardware or bitbanging */ > cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)]; > - if (!cs->txrx_word) > - return -EINVAL; > + if (!cs->txrx_word) { > + retval = -EINVAL; > + goto err_free; > + } > > if (bitbang->setup_transfer) { > - int retval = bitbang->setup_transfer(spi, NULL); > + retval = bitbang->setup_transfer(spi, NULL); > if (retval < 0) > - return retval; > + goto err_free; > } > > dev_dbg(&spi->dev, "%s, %u nsec/bit\n", __func__, 2 * cs->nsecs); > > return 0; > + > +err_free: > + if (initial_setup) > + kfree(cs); > + return retval; > } > EXPORT_SYMBOL_GPL(spi_bitbang_setup); > > diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c > index d0e5aa18b7ba..bdf94cc7be1a 100644 > --- a/drivers/spi/spi-fsl-spi.c > +++ b/drivers/spi/spi-fsl-spi.c > @@ -440,6 +440,7 @@ static int fsl_spi_setup(struct spi_device *spi) > { > struct mpc8xxx_spi *mpc8xxx_spi; > struct fsl_spi_reg __iomem *reg_base; > + bool initial_setup = false; > int retval; > u32 hw_mode; > struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi); > @@ -452,6 +453,7 @@ static int fsl_spi_setup(struct spi_device *spi) > if (!cs) > return -ENOMEM; > spi_set_ctldata(spi, cs); > + initial_setup = true; > } > mpc8xxx_spi = spi_master_get_devdata(spi->master); > > @@ -475,6 +477,8 @@ static int fsl_spi_setup(struct spi_device *spi) > retval = fsl_spi_setup_transfer(spi, NULL); > if (retval < 0) { > cs->hw_mode = hw_mode; /* Restore settings */ > + if (initial_setup) > + kfree(cs); > return retval; > } > > diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c > index 71402f71ddd8..df28c6664aba 100644 > --- a/drivers/spi/spi-omap-uwire.c > +++ b/drivers/spi/spi-omap-uwire.c > @@ -424,15 +424,22 @@ static int uwire_setup_transfer(struct spi_device *spi, struct spi_transfer *t) > static int uwire_setup(struct spi_device *spi) > { > struct uwire_state *ust = spi->controller_state; > + bool initial_setup = false; > + int status; > > if (ust == NULL) { > ust = kzalloc(sizeof(*ust), GFP_KERNEL); > if (ust == NULL) > return -ENOMEM; > spi->controller_state = ust; > + initial_setup = true; > } > > - return uwire_setup_transfer(spi, NULL); > + status = uwire_setup_transfer(spi, NULL); > + if (status && initial_setup) > + kfree(ust); > + > + return status; > } > > static void uwire_cleanup(struct spi_device *spi) > diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c > index d4c9510af393..3596bbe4b776 100644 > --- a/drivers/spi/spi-omap2-mcspi.c > +++ b/drivers/spi/spi-omap2-mcspi.c > @@ -1032,8 +1032,22 @@ static void omap2_mcspi_release_dma(struct spi_master *master) > } > } > > +static void omap2_mcspi_cleanup(struct spi_device *spi) > +{ > + struct omap2_mcspi_cs *cs; > + > + if (spi->controller_state) { > + /* Unlink controller state from context save list */ > + cs = spi->controller_state; > + list_del(&cs->node); > + > + kfree(cs); > + } > +} > + > static int omap2_mcspi_setup(struct spi_device *spi) > { > + bool initial_setup = false; > int ret; > struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); > struct omap2_mcspi_regs *ctx = &mcspi->ctx; > @@ -1051,35 +1065,28 @@ static int omap2_mcspi_setup(struct spi_device *spi) > spi->controller_state = cs; > /* Link this to context save list */ > list_add_tail(&cs->node, &ctx->cs); > + initial_setup = true; > } > > ret = pm_runtime_get_sync(mcspi->dev); > if (ret < 0) { > pm_runtime_put_noidle(mcspi->dev); > + if (initial_setup) > + omap2_mcspi_cleanup(spi); > > return ret; > } > > ret = omap2_mcspi_setup_transfer(spi, NULL); > + if (ret && initial_setup) > + omap2_mcspi_cleanup(spi); > + > pm_runtime_mark_last_busy(mcspi->dev); > pm_runtime_put_autosuspend(mcspi->dev); > > return ret; > } > > -static void omap2_mcspi_cleanup(struct spi_device *spi) > -{ > - struct omap2_mcspi_cs *cs; > - > - if (spi->controller_state) { > - /* Unlink controller state from context save list */ > - cs = spi->controller_state; > - list_del(&cs->node); > - > - kfree(cs); > - } > -} > - > static irqreturn_t omap2_mcspi_irq_handler(int irq, void *data) > { > struct omap2_mcspi *mcspi = data; > diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c > index d6b534d38e5d..56a62095ec8c 100644 > --- a/drivers/spi/spi-pxa2xx.c > +++ b/drivers/spi/spi-pxa2xx.c > @@ -1254,6 +1254,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip, > chip->gpio_cs_inverted = spi->mode & SPI_CS_HIGH; > > err = gpiod_direction_output(gpiod, !chip->gpio_cs_inverted); > + if (err) > + gpiod_put(chip->gpiod_cs); > } > > return err; > @@ -1267,6 +1269,7 @@ static int setup(struct spi_device *spi) > struct driver_data *drv_data = > spi_controller_get_devdata(spi->controller); > uint tx_thres, tx_hi_thres, rx_thres; > + int err; > > switch (drv_data->ssp_type) { > case QUARK_X1000_SSP: > @@ -1413,7 +1416,11 @@ static int setup(struct spi_device *spi) > if (drv_data->ssp_type == CE4100_SSP) > return 0; > > - return setup_cs(spi, chip, chip_info); > + err = setup_cs(spi, chip, chip_info); > + if (err) > + kfree(chip); > + > + return err; > } > > static void cleanup(struct spi_device *spi)

1 0

Re: [PATCH openEuler-21.03] usb: chipidea: udc: assign interrupt number to USB gadget structure
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:19, chensiyan96 写道: > From: Li Jun <jun.li(a)nxp.com> > > stable inclusion > from stable-v5.10.44 > commit 2e2145ccfbcb0dd38d8423681d22b595ca735846 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=376 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 9e3927f6373da54cb17e17f4bd700907e1123d2f ] > > Chipidea also need sync interrupt before unbind the udc while > gadget remove driver, otherwise setup irq handling may happen > while unbind, see below dump generated from android function > switch stress test: > > [ 4703.503056] android_work: sent uevent USB_STATE=CONNECTED > [ 4703.514642] android_work: sent uevent USB_STATE=DISCONNECTED > [ 4703.651339] android_work: sent uevent USB_STATE=CONNECTED > [ 4703.661806] init: Control message: Processed ctl.stop for 'adbd' from pid: 561 (system_server) > [ 4703.673469] init: processing action (init.svc.adbd=stopped) from (/system/etc/init/hw/init.usb.configfs.rc:14) > [ 4703.676451] Unable to handle kernel read from unreadable memory at virtual address 0000000000000090 > [ 4703.676454] Mem abort info: > [ 4703.676458] ESR = 0x96000004 > [ 4703.676461] EC = 0x25: DABT (current EL), IL = 32 bits > [ 4703.676464] SET = 0, FnV = 0 > [ 4703.676466] EA = 0, S1PTW = 0 > [ 4703.676468] Data abort info: > [ 4703.676471] ISV = 0, ISS = 0x00000004 > [ 4703.676473] CM = 0, WnR = 0 > [ 4703.676478] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004a867000 > [ 4703.676481] [0000000000000090] pgd=0000000000000000, p4d=0000000000000000 > [ 4703.676503] Internal error: Oops: 96000004 [#1] PREEMPT SMP > [ 4703.758297] Modules linked in: synaptics_dsx_i2c moal(O) mlan(O) > [ 4703.764327] CPU: 0 PID: 235 Comm: lmkd Tainted: G W O 5.10.9-00001-g3f5fd8487c38-dirty #63 > [ 4703.773720] Hardware name: NXP i.MX8MNano EVK board (DT) > [ 4703.779033] pstate: 60400085 (nZCv daIf +PAN -UAO -TCO BTYPE=--) > [ 4703.785046] pc : _raw_write_unlock_bh+0xc0/0x2c8 > [ 4703.789667] lr : android_setup+0x4c/0x168 > [ 4703.793676] sp : ffff80001256bd80 > [ 4703.796989] x29: ffff80001256bd80 x28: 00000000000000a8 > [ 4703.802304] x27: ffff800012470000 x26: ffff80006d923000 > [ 4703.807616] x25: ffff800012471000 x24: ffff00000b091140 > [ 4703.812929] x23: ffff0000077dbd38 x22: ffff0000077da490 > [ 4703.818242] x21: ffff80001256be30 x20: 0000000000000000 > [ 4703.823554] x19: 0000000000000080 x18: ffff800012561048 > [ 4703.828867] x17: 0000000000000000 x16: 0000000000000039 > [ 4703.834180] x15: ffff8000106ad258 x14: ffff80001194c277 > [ 4703.839493] x13: 0000000000003934 x12: 0000000000000000 > [ 4703.844805] x11: 0000000000000000 x10: 0000000000000001 > [ 4703.850117] x9 : 0000000000000000 x8 : 0000000000000090 > [ 4703.855429] x7 : 6f72646e61203a70 x6 : ffff8000124f2450 > [ 4703.860742] x5 : ffffffffffffffff x4 : 0000000000000009 > [ 4703.866054] x3 : ffff8000108a290c x2 : ffff00007fb3a9c8 > [ 4703.871367] x1 : 0000000000000000 x0 : 0000000000000090 > [ 4703.876681] Call trace: > [ 4703.879129] _raw_write_unlock_bh+0xc0/0x2c8 > [ 4703.883397] android_setup+0x4c/0x168 > [ 4703.887059] udc_irq+0x824/0xa9c > [ 4703.890287] ci_irq+0x124/0x148 > [ 4703.893429] __handle_irq_event_percpu+0x84/0x268 > [ 4703.898131] handle_irq_event+0x64/0x14c > [ 4703.902054] handle_fasteoi_irq+0x110/0x210 > [ 4703.906236] __handle_domain_irq+0x8c/0xd4 > [ 4703.910332] gic_handle_irq+0x6c/0x124 > [ 4703.914081] el1_irq+0xdc/0x1c0 > [ 4703.917221] _raw_spin_unlock_irq+0x20/0x54 > [ 4703.921405] finish_task_switch+0x84/0x224 > [ 4703.925502] __schedule+0x4a4/0x734 > [ 4703.928990] schedule+0xa0/0xe8 > [ 4703.932132] do_notify_resume+0x150/0x184 > [ 4703.936140] work_pending+0xc/0x40c > [ 4703.939633] Code: d5384613 521b0a69 d5184609 f9800111 (885ffd01) > [ 4703.945732] ---[ end trace ba5c1875ae49d53c ]--- > [ 4703.950350] Kernel panic - not syncing: Oops: Fatal exception in interrupt > [ 4703.957223] SMP: stopping secondary CPUs > [ 4703.961151] Kernel Offset: disabled > [ 4703.964638] CPU features: 0x0240002,2000200c > [ 4703.968905] Memory Limit: none > [ 4703.971963] Rebooting in 5 seconds.. > > Tested-by: faqiang.zhu <faqiang.zhu(a)nxp.com> > Signed-off-by: Li Jun <jun.li(a)nxp.com> > Link: https://lore.kernel.org/r/1620989984-7653-1-git-send-email-jun.li@nxp.com > Signed-off-by: Peter Chen <peter.chen(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: chensiyan96 <3225973902(a)qq.com> > --- > drivers/usb/chipidea/udc.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c > index 60ea932afe2b..5f35cdd2cf1d 100644 > --- a/drivers/usb/chipidea/udc.c > +++ b/drivers/usb/chipidea/udc.c > @@ -2055,6 +2055,7 @@ static int udc_start(struct ci_hdrc *ci) > ci->gadget.name = ci->platdata->name; > ci->gadget.otg_caps = otg_caps; > ci->gadget.sg_supported = 1; > + ci->gadget.irq = ci->irq; > > if (ci->platdata->flags & CI_HDRC_REQUIRES_ALIGNED_DMA) > ci->gadget.quirk_avoids_skb_reserve = 1;

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:25, ZhuoliHuang 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:26, lihao 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:27, zanderzhao 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] scsi: core: Fix failure handling of scsi_add_host_with_dma()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:32, dongenyang 写道: > From: Ming Lei <ming.lei(a)redhat.com> > > stable inclusion > from stable-v5.10.44 > commit 146446a43b3dbaa3a58364ef99fd606b3f324832 > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=361 > CVE: NA > > ------------------------------------------------- > > commit 3719f4ff047e20062b8314c23ec3cab84d74c908 upstream. > > When scsi_add_host_with_dma() returns failure, the caller will call > scsi_host_put(shost) to release everything allocated for this host > instance. Consequently we can't also free allocated stuff in > scsi_add_host_with_dma(), otherwise we will end up with a double free. > > Strictly speaking, host resource allocations should have been done in > scsi_host_alloc(). However, the allocations may need information which is > not yet provided by the driver when that function is called. So leave the > allocations where they are but rely on host device's release handler to > free resources. > > Link: https://lore.kernel.org/r/20210602133029.2864069-3-ming.lei@redhat.com > Cc: Bart Van Assche <bvanassche(a)acm.org> > Cc: John Garry <john.garry(a)huawei.com> > Cc: Hannes Reinecke <hare(a)suse.de> > Tested-by: John Garry <john.garry(a)huawei.com> > Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> > Reviewed-by: John Garry <john.garry(a)huawei.com> > Reviewed-by: Hannes Reinecke <hare(a)suse.de> > Signed-off-by: Ming Lei <ming.lei(a)redhat.com> > Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: dongenyang <sdlpdey(a)163.com> > --- > drivers/scsi/hosts.c | 14 ++++++-------- > 1 file changed, 6 insertions(+), 8 deletions(-) > > diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c > index 2f162603876f..85ec3cce43f1 100644 > --- a/drivers/scsi/hosts.c > +++ b/drivers/scsi/hosts.c > @@ -278,23 +278,22 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, > > if (!shost->work_q) { > error = -EINVAL; > - goto out_free_shost_data; > + goto out_del_dev; > } > } > > error = scsi_sysfs_add_host(shost); > if (error) > - goto out_destroy_host; > + goto out_del_dev; > > scsi_proc_host_add(shost); > scsi_autopm_put_host(shost); > return error; > > - out_destroy_host: > - if (shost->work_q) > - destroy_workqueue(shost->work_q); > - out_free_shost_data: > - kfree(shost->shost_data); > + /* > + * Any host allocation in this function will be freed in > + * scsi_host_dev_release(). > + */ > out_del_dev: > device_del(&shost->shost_dev); > out_del_gendev: > @@ -304,7 +303,6 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, > pm_runtime_disable(&shost->shost_gendev); > pm_runtime_set_suspended(&shost->shost_gendev); > pm_runtime_put_noidle(&shost->shost_gendev); > - scsi_mq_destroy_tags(shost); > fail: > return error; > }

1 0

Re: [PATCH openEuler-21.03] USB: f_ncm: ncm_bitrate (speed) is unsigned
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:32, xjx00 写道: > From: Maciej Żenczykowski <maze(a)google.com> > > stable inclusion > from stable-v5.10.44 > commit 0f5a20b1fd9da3ac9f7c6edcad522712ca694d5c > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=358 > CVE: NA > > ------------------------------------------------- > > commit 3370139745853f7826895293e8ac3aec1430508e upstream. > > [ 190.544755] configfs-gadget gadget: notify speed -44967296 > > This is because 4250000000 - 2**32 is -44967296. > > Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added") > Cc: Brooke Basile <brookebasile(a)gmail.com> > Cc: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> > Cc: Felipe Balbi <balbi(a)kernel.org> > Cc: Lorenzo Colitti <lorenzo(a)google.com> > Cc: Yauheni Kaliuta <yauheni.kaliuta(a)nokia.com> > Cc: Linux USB Mailing List <linux-usb(a)vger.kernel.org> > Acked-By: Lorenzo Colitti <lorenzo(a)google.com> > Signed-off-by: Maciej Żenczykowski <maze(a)google.com> > Cc: stable <stable(a)vger.kernel.org> > Link: https://lore.kernel.org/r/20210608005344.3762668-1-zenczykowski@gmail.com > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: xjx00 <xjxyklwx(a)126.com> > --- > drivers/usb/gadget/function/f_ncm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c > index 019bea8e09cc..0d23c6c11a13 100644 > --- a/drivers/usb/gadget/function/f_ncm.c > +++ b/drivers/usb/gadget/function/f_ncm.c > @@ -583,7 +583,7 @@ static void ncm_do_notify(struct f_ncm *ncm) > data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); > data[1] = data[0]; > > - DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget)); > + DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget)); > ncm->notify_state = NCM_NOTIFY_CONNECT; > break; > }

1 0

Re: [PATCH openEuler-21.03] gpio: wcd934x: Fix shift-out-of-bounds error
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 20:18, zcj 写道: > From: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> > > stable inclusion > from stable-v5.10.44 > commit e0b518a2eb44d8a74c19e50f79a8ed393e96d634 > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=463 > CVE: NA > > ------------------------------------------------- > > commit dbec64b11c65d74f31427e2b9d5746fbf17bf840 upstream. > > bit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1) > which is not right, and this was caught by below usban check > > UBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14 > > Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") > Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> > Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> > Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> > Signed-off-by: Bartosz Golaszewski <bgolaszewski(a)baylibre.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: zcj <2459770937(a)qq.com> > --- > drivers/gpio/gpio-wcd934x.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c > index 1cbce5990855..97e6caedf1f3 100644 > --- a/drivers/gpio/gpio-wcd934x.c > +++ b/drivers/gpio/gpio-wcd934x.c > @@ -7,7 +7,7 @@ > #include <linux/slab.h> > #include <linux/of_device.h> > > -#define WCD_PIN_MASK(p) BIT(p - 1) > +#define WCD_PIN_MASK(p) BIT(p) > #define WCD_REG_DIR_CTL_OFFSET 0x42 > #define WCD_REG_VAL_CTL_OFFSET 0x43 > #define WCD934X_NPINS 5

1 0

Re: [PATCH openEuler-21.03] regulator: fan53880: Fix missing n_voltages setting
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 20:49, lantianbaiyun 写道: > From: Axel Lin <axel.lin(a)ingics.com> > > stable inclusion > from stable-v5.10.44 > commit 5a5f5cfb5f0996d65eae3cc034513d90f4be6783 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=401 > CVE: NA > > ------------------------------------------------- > > commit 34991ee96fd8477479dd15adadceb6b28b30d9b0 upstream. > > Fixes: e6dea51e2d41 ("regulator: fan53880: Add initial support") > Signed-off-by: Axel Lin <axel.lin(a)ingics.com> > Acked-by: Christoph Fritz <chf.fritz(a)googlemail.com> > Link: https://lore.kernel.org/r/20210517105325.1227393-1-axel.lin@ingics.com > Signed-off-by: Mark Brown <broonie(a)kernel.org> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: lantianbaiyun <lianyi21(a)mails.ucas.ac.cn> > --- > drivers/regulator/fan53880.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/regulator/fan53880.c b/drivers/regulator/fan53880.c > index e83eb4fb1876..1684faf82ed2 100644 > --- a/drivers/regulator/fan53880.c > +++ b/drivers/regulator/fan53880.c > @@ -51,6 +51,7 @@ static const struct regulator_ops fan53880_ops = { > REGULATOR_LINEAR_RANGE(800000, 0xf, 0x73, 25000), \ > }, \ > .n_linear_ranges = 2, \ > + .n_voltages = 0x74, \ > .vsel_reg = FAN53880_LDO ## _num ## VOUT, \ > .vsel_mask = 0x7f, \ > .enable_reg = FAN53880_ENABLE, \ > @@ -76,6 +77,7 @@ static const struct regulator_desc fan53880_regulators[] = { > REGULATOR_LINEAR_RANGE(600000, 0x1f, 0xf7, 12500), > }, > .n_linear_ranges = 2, > + .n_voltages = 0xf8, > .vsel_reg = FAN53880_BUCKVOUT, > .vsel_mask = 0x7f, > .enable_reg = FAN53880_ENABLE, > @@ -95,6 +97,7 @@ static const struct regulator_desc fan53880_regulators[] = { > REGULATOR_LINEAR_RANGE(3000000, 0x4, 0x70, 25000), > }, > .n_linear_ranges = 2, > + .n_voltages = 0x71, > .vsel_reg = FAN53880_BOOSTVOUT, > .vsel_mask = 0x7f, > .enable_reg = FAN53880_ENABLE_BOOST,

1 0