- Kernel - mailweb.openeuler.org

Re: [PATCH openEuler-21.03] usb: chipidea: udc: assign interrupt number to USB gadget structure
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:19, chensiyan96 写道: > From: Li Jun <jun.li(a)nxp.com> > > stable inclusion > from stable-v5.10.44 > commit 2e2145ccfbcb0dd38d8423681d22b595ca735846 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=376 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 9e3927f6373da54cb17e17f4bd700907e1123d2f ] > > Chipidea also need sync interrupt before unbind the udc while > gadget remove driver, otherwise setup irq handling may happen > while unbind, see below dump generated from android function > switch stress test: > > [ 4703.503056] android_work: sent uevent USB_STATE=CONNECTED > [ 4703.514642] android_work: sent uevent USB_STATE=DISCONNECTED > [ 4703.651339] android_work: sent uevent USB_STATE=CONNECTED > [ 4703.661806] init: Control message: Processed ctl.stop for 'adbd' from pid: 561 (system_server) > [ 4703.673469] init: processing action (init.svc.adbd=stopped) from (/system/etc/init/hw/init.usb.configfs.rc:14) > [ 4703.676451] Unable to handle kernel read from unreadable memory at virtual address 0000000000000090 > [ 4703.676454] Mem abort info: > [ 4703.676458] ESR = 0x96000004 > [ 4703.676461] EC = 0x25: DABT (current EL), IL = 32 bits > [ 4703.676464] SET = 0, FnV = 0 > [ 4703.676466] EA = 0, S1PTW = 0 > [ 4703.676468] Data abort info: > [ 4703.676471] ISV = 0, ISS = 0x00000004 > [ 4703.676473] CM = 0, WnR = 0 > [ 4703.676478] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004a867000 > [ 4703.676481] [0000000000000090] pgd=0000000000000000, p4d=0000000000000000 > [ 4703.676503] Internal error: Oops: 96000004 [#1] PREEMPT SMP > [ 4703.758297] Modules linked in: synaptics_dsx_i2c moal(O) mlan(O) > [ 4703.764327] CPU: 0 PID: 235 Comm: lmkd Tainted: G W O 5.10.9-00001-g3f5fd8487c38-dirty #63 > [ 4703.773720] Hardware name: NXP i.MX8MNano EVK board (DT) > [ 4703.779033] pstate: 60400085 (nZCv daIf +PAN -UAO -TCO BTYPE=--) > [ 4703.785046] pc : _raw_write_unlock_bh+0xc0/0x2c8 > [ 4703.789667] lr : android_setup+0x4c/0x168 > [ 4703.793676] sp : ffff80001256bd80 > [ 4703.796989] x29: ffff80001256bd80 x28: 00000000000000a8 > [ 4703.802304] x27: ffff800012470000 x26: ffff80006d923000 > [ 4703.807616] x25: ffff800012471000 x24: ffff00000b091140 > [ 4703.812929] x23: ffff0000077dbd38 x22: ffff0000077da490 > [ 4703.818242] x21: ffff80001256be30 x20: 0000000000000000 > [ 4703.823554] x19: 0000000000000080 x18: ffff800012561048 > [ 4703.828867] x17: 0000000000000000 x16: 0000000000000039 > [ 4703.834180] x15: ffff8000106ad258 x14: ffff80001194c277 > [ 4703.839493] x13: 0000000000003934 x12: 0000000000000000 > [ 4703.844805] x11: 0000000000000000 x10: 0000000000000001 > [ 4703.850117] x9 : 0000000000000000 x8 : 0000000000000090 > [ 4703.855429] x7 : 6f72646e61203a70 x6 : ffff8000124f2450 > [ 4703.860742] x5 : ffffffffffffffff x4 : 0000000000000009 > [ 4703.866054] x3 : ffff8000108a290c x2 : ffff00007fb3a9c8 > [ 4703.871367] x1 : 0000000000000000 x0 : 0000000000000090 > [ 4703.876681] Call trace: > [ 4703.879129] _raw_write_unlock_bh+0xc0/0x2c8 > [ 4703.883397] android_setup+0x4c/0x168 > [ 4703.887059] udc_irq+0x824/0xa9c > [ 4703.890287] ci_irq+0x124/0x148 > [ 4703.893429] __handle_irq_event_percpu+0x84/0x268 > [ 4703.898131] handle_irq_event+0x64/0x14c > [ 4703.902054] handle_fasteoi_irq+0x110/0x210 > [ 4703.906236] __handle_domain_irq+0x8c/0xd4 > [ 4703.910332] gic_handle_irq+0x6c/0x124 > [ 4703.914081] el1_irq+0xdc/0x1c0 > [ 4703.917221] _raw_spin_unlock_irq+0x20/0x54 > [ 4703.921405] finish_task_switch+0x84/0x224 > [ 4703.925502] __schedule+0x4a4/0x734 > [ 4703.928990] schedule+0xa0/0xe8 > [ 4703.932132] do_notify_resume+0x150/0x184 > [ 4703.936140] work_pending+0xc/0x40c > [ 4703.939633] Code: d5384613 521b0a69 d5184609 f9800111 (885ffd01) > [ 4703.945732] ---[ end trace ba5c1875ae49d53c ]--- > [ 4703.950350] Kernel panic - not syncing: Oops: Fatal exception in interrupt > [ 4703.957223] SMP: stopping secondary CPUs > [ 4703.961151] Kernel Offset: disabled > [ 4703.964638] CPU features: 0x0240002,2000200c > [ 4703.968905] Memory Limit: none > [ 4703.971963] Rebooting in 5 seconds.. > > Tested-by: faqiang.zhu <faqiang.zhu(a)nxp.com> > Signed-off-by: Li Jun <jun.li(a)nxp.com> > Link: https://lore.kernel.org/r/1620989984-7653-1-git-send-email-jun.li@nxp.com > Signed-off-by: Peter Chen <peter.chen(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: chensiyan96 <3225973902(a)qq.com> > --- > drivers/usb/chipidea/udc.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c > index 60ea932afe2b..5f35cdd2cf1d 100644 > --- a/drivers/usb/chipidea/udc.c > +++ b/drivers/usb/chipidea/udc.c > @@ -2055,6 +2055,7 @@ static int udc_start(struct ci_hdrc *ci) > ci->gadget.name = ci->platdata->name; > ci->gadget.otg_caps = otg_caps; > ci->gadget.sg_supported = 1; > + ci->gadget.irq = ci->irq; > > if (ci->platdata->flags & CI_HDRC_REQUIRES_ALIGNED_DMA) > ci->gadget.quirk_avoids_skb_reserve = 1;

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:25, ZhuoliHuang 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:26, lihao 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:27, zanderzhao 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] scsi: core: Fix failure handling of scsi_add_host_with_dma()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:32, dongenyang 写道: > From: Ming Lei <ming.lei(a)redhat.com> > > stable inclusion > from stable-v5.10.44 > commit 146446a43b3dbaa3a58364ef99fd606b3f324832 > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=361 > CVE: NA > > ------------------------------------------------- > > commit 3719f4ff047e20062b8314c23ec3cab84d74c908 upstream. > > When scsi_add_host_with_dma() returns failure, the caller will call > scsi_host_put(shost) to release everything allocated for this host > instance. Consequently we can't also free allocated stuff in > scsi_add_host_with_dma(), otherwise we will end up with a double free. > > Strictly speaking, host resource allocations should have been done in > scsi_host_alloc(). However, the allocations may need information which is > not yet provided by the driver when that function is called. So leave the > allocations where they are but rely on host device's release handler to > free resources. > > Link: https://lore.kernel.org/r/20210602133029.2864069-3-ming.lei@redhat.com > Cc: Bart Van Assche <bvanassche(a)acm.org> > Cc: John Garry <john.garry(a)huawei.com> > Cc: Hannes Reinecke <hare(a)suse.de> > Tested-by: John Garry <john.garry(a)huawei.com> > Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> > Reviewed-by: John Garry <john.garry(a)huawei.com> > Reviewed-by: Hannes Reinecke <hare(a)suse.de> > Signed-off-by: Ming Lei <ming.lei(a)redhat.com> > Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: dongenyang <sdlpdey(a)163.com> > --- > drivers/scsi/hosts.c | 14 ++++++-------- > 1 file changed, 6 insertions(+), 8 deletions(-) > > diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c > index 2f162603876f..85ec3cce43f1 100644 > --- a/drivers/scsi/hosts.c > +++ b/drivers/scsi/hosts.c > @@ -278,23 +278,22 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, > > if (!shost->work_q) { > error = -EINVAL; > - goto out_free_shost_data; > + goto out_del_dev; > } > } > > error = scsi_sysfs_add_host(shost); > if (error) > - goto out_destroy_host; > + goto out_del_dev; > > scsi_proc_host_add(shost); > scsi_autopm_put_host(shost); > return error; > > - out_destroy_host: > - if (shost->work_q) > - destroy_workqueue(shost->work_q); > - out_free_shost_data: > - kfree(shost->shost_data); > + /* > + * Any host allocation in this function will be freed in > + * scsi_host_dev_release(). > + */ > out_del_dev: > device_del(&shost->shost_dev); > out_del_gendev: > @@ -304,7 +303,6 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, > pm_runtime_disable(&shost->shost_gendev); > pm_runtime_set_suspended(&shost->shost_gendev); > pm_runtime_put_noidle(&shost->shost_gendev); > - scsi_mq_destroy_tags(shost); > fail: > return error; > }

1 0

Re: [PATCH openEuler-21.03] USB: f_ncm: ncm_bitrate (speed) is unsigned
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:32, xjx00 写道: > From: Maciej Żenczykowski <maze(a)google.com> > > stable inclusion > from stable-v5.10.44 > commit 0f5a20b1fd9da3ac9f7c6edcad522712ca694d5c > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=358 > CVE: NA > > ------------------------------------------------- > > commit 3370139745853f7826895293e8ac3aec1430508e upstream. > > [ 190.544755] configfs-gadget gadget: notify speed -44967296 > > This is because 4250000000 - 2**32 is -44967296. > > Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added") > Cc: Brooke Basile <brookebasile(a)gmail.com> > Cc: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> > Cc: Felipe Balbi <balbi(a)kernel.org> > Cc: Lorenzo Colitti <lorenzo(a)google.com> > Cc: Yauheni Kaliuta <yauheni.kaliuta(a)nokia.com> > Cc: Linux USB Mailing List <linux-usb(a)vger.kernel.org> > Acked-By: Lorenzo Colitti <lorenzo(a)google.com> > Signed-off-by: Maciej Żenczykowski <maze(a)google.com> > Cc: stable <stable(a)vger.kernel.org> > Link: https://lore.kernel.org/r/20210608005344.3762668-1-zenczykowski@gmail.com > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: xjx00 <xjxyklwx(a)126.com> > --- > drivers/usb/gadget/function/f_ncm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c > index 019bea8e09cc..0d23c6c11a13 100644 > --- a/drivers/usb/gadget/function/f_ncm.c > +++ b/drivers/usb/gadget/function/f_ncm.c > @@ -583,7 +583,7 @@ static void ncm_do_notify(struct f_ncm *ncm) > data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); > data[1] = data[0]; > > - DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget)); > + DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget)); > ncm->notify_state = NCM_NOTIFY_CONNECT; > break; > }

1 0

Re: [PATCH openEuler-21.03] gpio: wcd934x: Fix shift-out-of-bounds error
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 20:18, zcj 写道: > From: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> > > stable inclusion > from stable-v5.10.44 > commit e0b518a2eb44d8a74c19e50f79a8ed393e96d634 > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=463 > CVE: NA > > ------------------------------------------------- > > commit dbec64b11c65d74f31427e2b9d5746fbf17bf840 upstream. > > bit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1) > which is not right, and this was caught by below usban check > > UBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14 > > Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") > Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> > Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> > Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> > Signed-off-by: Bartosz Golaszewski <bgolaszewski(a)baylibre.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: zcj <2459770937(a)qq.com> > --- > drivers/gpio/gpio-wcd934x.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c > index 1cbce5990855..97e6caedf1f3 100644 > --- a/drivers/gpio/gpio-wcd934x.c > +++ b/drivers/gpio/gpio-wcd934x.c > @@ -7,7 +7,7 @@ > #include <linux/slab.h> > #include <linux/of_device.h> > > -#define WCD_PIN_MASK(p) BIT(p - 1) > +#define WCD_PIN_MASK(p) BIT(p) > #define WCD_REG_DIR_CTL_OFFSET 0x42 > #define WCD_REG_VAL_CTL_OFFSET 0x43 > #define WCD934X_NPINS 5

1 0

Re: [PATCH openEuler-21.03] regulator: fan53880: Fix missing n_voltages setting
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 20:49, lantianbaiyun 写道: > From: Axel Lin <axel.lin(a)ingics.com> > > stable inclusion > from stable-v5.10.44 > commit 5a5f5cfb5f0996d65eae3cc034513d90f4be6783 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=401 > CVE: NA > > ------------------------------------------------- > > commit 34991ee96fd8477479dd15adadceb6b28b30d9b0 upstream. > > Fixes: e6dea51e2d41 ("regulator: fan53880: Add initial support") > Signed-off-by: Axel Lin <axel.lin(a)ingics.com> > Acked-by: Christoph Fritz <chf.fritz(a)googlemail.com> > Link: https://lore.kernel.org/r/20210517105325.1227393-1-axel.lin@ingics.com > Signed-off-by: Mark Brown <broonie(a)kernel.org> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: lantianbaiyun <lianyi21(a)mails.ucas.ac.cn> > --- > drivers/regulator/fan53880.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/regulator/fan53880.c b/drivers/regulator/fan53880.c > index e83eb4fb1876..1684faf82ed2 100644 > --- a/drivers/regulator/fan53880.c > +++ b/drivers/regulator/fan53880.c > @@ -51,6 +51,7 @@ static const struct regulator_ops fan53880_ops = { > REGULATOR_LINEAR_RANGE(800000, 0xf, 0x73, 25000), \ > }, \ > .n_linear_ranges = 2, \ > + .n_voltages = 0x74, \ > .vsel_reg = FAN53880_LDO ## _num ## VOUT, \ > .vsel_mask = 0x7f, \ > .enable_reg = FAN53880_ENABLE, \ > @@ -76,6 +77,7 @@ static const struct regulator_desc fan53880_regulators[] = { > REGULATOR_LINEAR_RANGE(600000, 0x1f, 0xf7, 12500), > }, > .n_linear_ranges = 2, > + .n_voltages = 0xf8, > .vsel_reg = FAN53880_BUCKVOUT, > .vsel_mask = 0x7f, > .enable_reg = FAN53880_ENABLE, > @@ -95,6 +97,7 @@ static const struct regulator_desc fan53880_regulators[] = { > REGULATOR_LINEAR_RANGE(3000000, 0x4, 0x70, 25000), > }, > .n_linear_ranges = 2, > + .n_voltages = 0x71, > .vsel_reg = FAN53880_BOOSTVOUT, > .vsel_mask = 0x7f, > .enable_reg = FAN53880_ENABLE_BOOST,

1 0

Re: [PATCH openEuler-21.03] NFSv4: Fix second deadlock in nfs4_evict_inode()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 20:55, smilezhangs 写道: > From: Trond Myklebust <trond.myklebust(a)hammerspace.com> > > stable inclusion > from stable-v5.10.44 > commit d973bd0d6e7f9b4ea976cc619e8d6e0d235b9056 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=462 > CVE: NA > > ------------------------------------------------- > > commit c3aba897c6e67fa464ec02b1f17911577d619713 upstream. > > If the inode is being evicted but has to return a layout first, then > that too can cause a deadlock in the corner case where the server > reboots. > > Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: Hang <haihangyiyuan(a)163.com> > Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> > Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> > --- > fs/nfs/nfs4proc.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c > index c92d6ff0fcea..eedcbe6832fb 100644 > --- a/fs/nfs/nfs4proc.c > +++ b/fs/nfs/nfs4proc.c > @@ -9619,15 +9619,20 @@ int nfs4_proc_layoutreturn(struct nfs4_layoutreturn *lrp, bool sync) > &task_setup_data.rpc_client, &msg); > > dprintk("--> %s\n", __func__); > + lrp->inode = nfs_igrab_and_active(lrp->args.inode); > if (!sync) { > - lrp->inode = nfs_igrab_and_active(lrp->args.inode); > if (!lrp->inode) { > nfs4_layoutreturn_release(lrp); > return -EAGAIN; > } > task_setup_data.flags |= RPC_TASK_ASYNC; > } > - nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, 0); > + if (!lrp->inode) > + nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, > + 1); > + else > + nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, > + 0); > task = rpc_run_task(&task_setup_data); > if (IS_ERR(task)) > return PTR_ERR(task);

1 0

Re: [PATCH openEuler-21.03] net/nfc/rawsock.c: fix a permission check bug
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 21:10, lf 写道: > From: Jeimon <jjjinmeng.zhou(a)gmail.com> > > stable inclusion > from stable-v5.10.44 > commit 1e5cab50208c8fb7351b798cb1d569debfeb994a > bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=371 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ] > > The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable(). > > Signed-off-by: Jeimon <jjjinmeng.zhou(a)gmail.com> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: lf <15042944259(a)163.com> > --- > net/nfc/rawsock.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c > index 9c7eb8455ba8..5f1d438a0a23 100644 > --- a/net/nfc/rawsock.c > +++ b/net/nfc/rawsock.c > @@ -329,7 +329,7 @@ static int rawsock_create(struct net *net, struct socket *sock, > return -ESOCKTNOSUPPORT; > > if (sock->type == SOCK_RAW) { > - if (!capable(CAP_NET_RAW)) > + if (!ns_capable(net->user_ns, CAP_NET_RAW)) > return -EPERM; > sock->ops = &rawsock_raw_ops; > } else {

1 0