- Kernel - mailweb.openeuler.org

Re: [PATCH openEuler-21.03] drm/msm/a6xx: avoid shadow NULL reference in failure path
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:02, lzb 写道: > From: Jonathan Marek <jonathan(a)marek.ca> > > stable inclusion > from stable-v5.10.44 > commit fd681a8c7ac8f649a0718f6cbf2fe75d0587c9a2 > bugzilla: > CVE: NA > > https://bugzilla.openeuler.org/show_bug.cgi?id=472-------------------------… > > commit ce86c239e4d218ae6040bec18e6d19a58edb8b7c upstream. > > If a6xx_hw_init() fails before creating the shadow_bo, the a6xx_pm_suspend > code referencing it will crash. Change the condition to one that avoids > this problem (note: creation of shadow_bo is behind this same condition) > > Fixes: e8b0b994c3a5 ("drm/msm/a6xx: Clear shadow on suspend") > Signed-off-by: Jonathan Marek <jonathan(a)marek.ca> > Reviewed-by: Akhil P Oommen <akhilpo(a)codeaurora.org> > Link: https://lore.kernel.org/r/20210513171431.18632-6-jonathan@marek.ca > Signed-off-by: Rob Clark <robdclark(a)chromium.org> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: lzb <zbliancs(a)qq.com> > --- > drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c > index 722c2fe3bfd5..7061ba457c5b 100644 > --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c > +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c > @@ -1055,7 +1055,7 @@ static int a6xx_pm_suspend(struct msm_gpu *gpu) > if (ret) > return ret; > > - if (adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami) > + if (a6xx_gpu->shadow_bo) > for (i = 0; i < gpu->nr_rings; i++) > a6xx_gpu->shadow[i] = 0; >

1 0

Re: [PATCH openEuler-21.03] sched/fair: Make sure to update tg contrib for blocked load
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:09, wjy 写道: > From: Vincent Guittot <vincent.guittot(a)linaro.org> > > stable inclusion > from stable-v5.10.44 > commit 32e22db8b25ea165bd9e446c7f92b089c8568eaf > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=379 > CVE: NA > > ------------------------------------------------- > > commit 02da26ad5ed6ea8680e5d01f20661439611ed776 upstream. > > During the update of fair blocked load (__update_blocked_fair()), we > update the contribution of the cfs in tg->load_avg if cfs_rq's pelt > has decayed. Nevertheless, the pelt values of a cfs_rq could have > been recently updated while propagating the change of a child. In this > case, cfs_rq's pelt will not decayed because it has already been > updated and we don't update tg->load_avg. > > __update_blocked_fair > ... > for_each_leaf_cfs_rq_safe: child cfs_rq > update cfs_rq_load_avg() for child cfs_rq > ... > update_load_avg(cfs_rq_of(se), se, 0) > ... > update cfs_rq_load_avg() for parent cfs_rq > -propagation of child's load makes parent cfs_rq->load_sum > becoming null > -UPDATE_TG is not set so it doesn't update parent > cfs_rq->tg_load_avg_contrib > .. > for_each_leaf_cfs_rq_safe: parent cfs_rq > update cfs_rq_load_avg() for parent cfs_rq > - nothing to do because parent cfs_rq has already been updated > recently so cfs_rq->tg_load_avg_contrib is not updated > ... > parent cfs_rq is decayed > list_del_leaf_cfs_rq parent cfs_rq > - but it still contibutes to tg->load_avg > > we must set UPDATE_TG flags when propagting pending load to the parent > > Fixes: 039ae8bcf7a5 ("sched/fair: Fix O(nr_cgroups) in the load balancing path") > Reported-by: Odin Ugedal <odin(a)uged.al> > Signed-off-by: Vincent Guittot <vincent.guittot(a)linaro.org> > Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> > Reviewed-by: Odin Ugedal <odin(a)uged.al> > Link: https://lkml.kernel.org/r/20210527122916.27683-3-vincent.guittot@linaro.org > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: wjy <464310675(a)qq.com> > --- > kernel/sched/fair.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c > index 1ad0e52487f6..43497d88a330 100644 > --- a/kernel/sched/fair.c > +++ b/kernel/sched/fair.c > @@ -7961,7 +7961,7 @@ static bool __update_blocked_fair(struct rq *rq, bool *done) > /* Propagate pending load changes to the parent, if any: */ > se = cfs_rq->tg->se[cpu]; > if (se && !skip_blocked_update(se)) > - update_load_avg(cfs_rq_of(se), se, 0); > + update_load_avg(cfs_rq_of(se), se, UPDATE_TG); > > /* > * There can be a lot of idle CPU cgroups. Don't let fully

1 0

Re: [PATCH openEuler-21.03] NFSv4: Fix second deadlock in nfs4_evict_inode()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:13, wyp 写道: > From: Trond Myklebust <trond.myklebust(a)hammerspace.com> > > stable inclusion > from stable-v5.10.44 > commit d973bd0d6e7f9b4ea976cc619e8d6e0d235b9056 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=462 > CVE: NA > > ------------------------------------------------- > > commit c3aba897c6e67fa464ec02b1f17911577d619713 upstream. > > If the inode is being evicted but has to return a layout first, then > that too can cause a deadlock in the corner case where the server > reboots. > > Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > Signed-off-by: Hang <haihangyiyuan(a)163.com> > Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> > Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> > --- > fs/nfs/nfs4proc.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c > index c92d6ff0fcea..eedcbe6832fb 100644 > --- a/fs/nfs/nfs4proc.c > +++ b/fs/nfs/nfs4proc.c > @@ -9619,15 +9619,20 @@ int nfs4_proc_layoutreturn(struct nfs4_layoutreturn *lrp, bool sync) > &task_setup_data.rpc_client, &msg); > > dprintk("--> %s\n", __func__); > + lrp->inode = nfs_igrab_and_active(lrp->args.inode); > if (!sync) { > - lrp->inode = nfs_igrab_and_active(lrp->args.inode); > if (!lrp->inode) { > nfs4_layoutreturn_release(lrp); > return -EAGAIN; > } > task_setup_data.flags |= RPC_TASK_ASYNC; > } > - nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, 0); > + if (!lrp->inode) > + nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, > + 1); > + else > + nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, > + 0); > task = rpc_run_task(&task_setup_data); > if (IS_ERR(task)) > return PTR_ERR(task);

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:15, gpj 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:18, dqh 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] spi: Cleanup on failure of initial setup
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:18, dqh 写道: > From: Lukas Wunner <lukas(a)wunner.de> > > stable inclusion > from stable-v5.10.44 > commit fa05ba61967ad051f5f2b7c4f39d6c56719c9900 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=470 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 2ec6f20b33eb4f62ab90bdcd620436c883ec3af6 ] > > Commit c7299fea6769 ("spi: Fix spi device unregister flow") changed the > SPI core's behavior if the ->setup() hook returns an error upon adding > an spi_device: Before, the ->cleanup() hook was invoked to free any > allocations that were made by ->setup(). With the commit, that's no > longer the case, so the ->setup() hook is expected to free the > allocations itself. > > I've identified 5 drivers which depend on the old behavior and am fixing > them up hereinafter: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c > spi-omap2-mcspi.c spi-pxa2xx.c > > Importantly, ->setup() is not only invoked on spi_device *addition*: > It may subsequently be called to *change* SPI parameters. If changing > these SPI parameters fails, freeing memory allocations would be wrong. > That should only be done if the spi_device is finally destroyed. > I am therefore using a bool "initial_setup" in 4 of the affected drivers > to differentiate between the invocation on *adding* the spi_device and > any subsequent invocations: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c > spi-omap2-mcspi.c > > In spi-pxa2xx.c, it seems the ->setup() hook can only fail on spi_device > addition, not any subsequent calls. It therefore doesn't need the bool. > > It's worth noting that 5 other drivers already perform a cleanup if the > ->setup() hook fails. Before c7299fea6769, they caused a double-free > if ->setup() failed on spi_device addition. Since the commit, they're > fine. These drivers are: spi-mpc512x-psc.c spi-pl022.c spi-s3c64xx.c > spi-st-ssc4.c spi-tegra114.c > > (spi-pxa2xx.c also already performs a cleanup, but only in one of > several error paths.) > > Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") > Signed-off-by: Lukas Wunner <lukas(a)wunner.de> > Cc: Saravana Kannan <saravanak(a)google.com> > Acked-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> # pxa2xx > Link: https://lore.kernel.org/r/f76a0599469f265b69c371538794101fa37b5536.16221493… > Signed-off-by: Mark Brown <broonie(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: dqh <1486653795(a)qq.com> > --- > drivers/spi/spi-bitbang.c | 18 ++++++++++++++---- > drivers/spi/spi-fsl-spi.c | 4 ++++ > drivers/spi/spi-omap-uwire.c | 9 ++++++++- > drivers/spi/spi-omap2-mcspi.c | 33 ++++++++++++++++++++------------- > drivers/spi/spi-pxa2xx.c | 9 ++++++++- > 5 files changed, 54 insertions(+), 19 deletions(-) > > diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c > index 1a7352abd878..3d8948a17095 100644 > --- a/drivers/spi/spi-bitbang.c > +++ b/drivers/spi/spi-bitbang.c > @@ -181,6 +181,8 @@ int spi_bitbang_setup(struct spi_device *spi) > { > struct spi_bitbang_cs *cs = spi->controller_state; > struct spi_bitbang *bitbang; > + bool initial_setup = false; > + int retval; > > bitbang = spi_master_get_devdata(spi->master); > > @@ -189,22 +191,30 @@ int spi_bitbang_setup(struct spi_device *spi) > if (!cs) > return -ENOMEM; > spi->controller_state = cs; > + initial_setup = true; > } > > /* per-word shift register access, in hardware or bitbanging */ > cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)]; > - if (!cs->txrx_word) > - return -EINVAL; > + if (!cs->txrx_word) { > + retval = -EINVAL; > + goto err_free; > + } > > if (bitbang->setup_transfer) { > - int retval = bitbang->setup_transfer(spi, NULL); > + retval = bitbang->setup_transfer(spi, NULL); > if (retval < 0) > - return retval; > + goto err_free; > } > > dev_dbg(&spi->dev, "%s, %u nsec/bit\n", __func__, 2 * cs->nsecs); > > return 0; > + > +err_free: > + if (initial_setup) > + kfree(cs); > + return retval; > } > EXPORT_SYMBOL_GPL(spi_bitbang_setup); > > diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c > index d0e5aa18b7ba..bdf94cc7be1a 100644 > --- a/drivers/spi/spi-fsl-spi.c > +++ b/drivers/spi/spi-fsl-spi.c > @@ -440,6 +440,7 @@ static int fsl_spi_setup(struct spi_device *spi) > { > struct mpc8xxx_spi *mpc8xxx_spi; > struct fsl_spi_reg __iomem *reg_base; > + bool initial_setup = false; > int retval; > u32 hw_mode; > struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi); > @@ -452,6 +453,7 @@ static int fsl_spi_setup(struct spi_device *spi) > if (!cs) > return -ENOMEM; > spi_set_ctldata(spi, cs); > + initial_setup = true; > } > mpc8xxx_spi = spi_master_get_devdata(spi->master); > > @@ -475,6 +477,8 @@ static int fsl_spi_setup(struct spi_device *spi) > retval = fsl_spi_setup_transfer(spi, NULL); > if (retval < 0) { > cs->hw_mode = hw_mode; /* Restore settings */ > + if (initial_setup) > + kfree(cs); > return retval; > } > > diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c > index 71402f71ddd8..df28c6664aba 100644 > --- a/drivers/spi/spi-omap-uwire.c > +++ b/drivers/spi/spi-omap-uwire.c > @@ -424,15 +424,22 @@ static int uwire_setup_transfer(struct spi_device *spi, struct spi_transfer *t) > static int uwire_setup(struct spi_device *spi) > { > struct uwire_state *ust = spi->controller_state; > + bool initial_setup = false; > + int status; > > if (ust == NULL) { > ust = kzalloc(sizeof(*ust), GFP_KERNEL); > if (ust == NULL) > return -ENOMEM; > spi->controller_state = ust; > + initial_setup = true; > } > > - return uwire_setup_transfer(spi, NULL); > + status = uwire_setup_transfer(spi, NULL); > + if (status && initial_setup) > + kfree(ust); > + > + return status; > } > > static void uwire_cleanup(struct spi_device *spi) > diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c > index d4c9510af393..3596bbe4b776 100644 > --- a/drivers/spi/spi-omap2-mcspi.c > +++ b/drivers/spi/spi-omap2-mcspi.c > @@ -1032,8 +1032,22 @@ static void omap2_mcspi_release_dma(struct spi_master *master) > } > } > > +static void omap2_mcspi_cleanup(struct spi_device *spi) > +{ > + struct omap2_mcspi_cs *cs; > + > + if (spi->controller_state) { > + /* Unlink controller state from context save list */ > + cs = spi->controller_state; > + list_del(&cs->node); > + > + kfree(cs); > + } > +} > + > static int omap2_mcspi_setup(struct spi_device *spi) > { > + bool initial_setup = false; > int ret; > struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); > struct omap2_mcspi_regs *ctx = &mcspi->ctx; > @@ -1051,35 +1065,28 @@ static int omap2_mcspi_setup(struct spi_device *spi) > spi->controller_state = cs; > /* Link this to context save list */ > list_add_tail(&cs->node, &ctx->cs); > + initial_setup = true; > } > > ret = pm_runtime_get_sync(mcspi->dev); > if (ret < 0) { > pm_runtime_put_noidle(mcspi->dev); > + if (initial_setup) > + omap2_mcspi_cleanup(spi); > > return ret; > } > > ret = omap2_mcspi_setup_transfer(spi, NULL); > + if (ret && initial_setup) > + omap2_mcspi_cleanup(spi); > + > pm_runtime_mark_last_busy(mcspi->dev); > pm_runtime_put_autosuspend(mcspi->dev); > > return ret; > } > > -static void omap2_mcspi_cleanup(struct spi_device *spi) > -{ > - struct omap2_mcspi_cs *cs; > - > - if (spi->controller_state) { > - /* Unlink controller state from context save list */ > - cs = spi->controller_state; > - list_del(&cs->node); > - > - kfree(cs); > - } > -} > - > static irqreturn_t omap2_mcspi_irq_handler(int irq, void *data) > { > struct omap2_mcspi *mcspi = data; > diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c > index d6b534d38e5d..56a62095ec8c 100644 > --- a/drivers/spi/spi-pxa2xx.c > +++ b/drivers/spi/spi-pxa2xx.c > @@ -1254,6 +1254,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip, > chip->gpio_cs_inverted = spi->mode & SPI_CS_HIGH; > > err = gpiod_direction_output(gpiod, !chip->gpio_cs_inverted); > + if (err) > + gpiod_put(chip->gpiod_cs); > } > > return err; > @@ -1267,6 +1269,7 @@ static int setup(struct spi_device *spi) > struct driver_data *drv_data = > spi_controller_get_devdata(spi->controller); > uint tx_thres, tx_hi_thres, rx_thres; > + int err; > > switch (drv_data->ssp_type) { > case QUARK_X1000_SSP: > @@ -1413,7 +1416,11 @@ static int setup(struct spi_device *spi) > if (drv_data->ssp_type == CE4100_SSP) > return 0; > > - return setup_cs(spi, chip, chip_info); > + err = setup_cs(spi, chip, chip_info); > + if (err) > + kfree(chip); > + > + return err; > } > > static void cleanup(struct spi_device *spi)

1 0

Re: [PATCH openEuler-21.03] usb: chipidea: udc: assign interrupt number to USB gadget structure
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:19, chensiyan96 写道: > From: Li Jun <jun.li(a)nxp.com> > > stable inclusion > from stable-v5.10.44 > commit 2e2145ccfbcb0dd38d8423681d22b595ca735846 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=376 > CVE: NA > > ------------------------------------------------- > > [ Upstream commit 9e3927f6373da54cb17e17f4bd700907e1123d2f ] > > Chipidea also need sync interrupt before unbind the udc while > gadget remove driver, otherwise setup irq handling may happen > while unbind, see below dump generated from android function > switch stress test: > > [ 4703.503056] android_work: sent uevent USB_STATE=CONNECTED > [ 4703.514642] android_work: sent uevent USB_STATE=DISCONNECTED > [ 4703.651339] android_work: sent uevent USB_STATE=CONNECTED > [ 4703.661806] init: Control message: Processed ctl.stop for 'adbd' from pid: 561 (system_server) > [ 4703.673469] init: processing action (init.svc.adbd=stopped) from (/system/etc/init/hw/init.usb.configfs.rc:14) > [ 4703.676451] Unable to handle kernel read from unreadable memory at virtual address 0000000000000090 > [ 4703.676454] Mem abort info: > [ 4703.676458] ESR = 0x96000004 > [ 4703.676461] EC = 0x25: DABT (current EL), IL = 32 bits > [ 4703.676464] SET = 0, FnV = 0 > [ 4703.676466] EA = 0, S1PTW = 0 > [ 4703.676468] Data abort info: > [ 4703.676471] ISV = 0, ISS = 0x00000004 > [ 4703.676473] CM = 0, WnR = 0 > [ 4703.676478] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004a867000 > [ 4703.676481] [0000000000000090] pgd=0000000000000000, p4d=0000000000000000 > [ 4703.676503] Internal error: Oops: 96000004 [#1] PREEMPT SMP > [ 4703.758297] Modules linked in: synaptics_dsx_i2c moal(O) mlan(O) > [ 4703.764327] CPU: 0 PID: 235 Comm: lmkd Tainted: G W O 5.10.9-00001-g3f5fd8487c38-dirty #63 > [ 4703.773720] Hardware name: NXP i.MX8MNano EVK board (DT) > [ 4703.779033] pstate: 60400085 (nZCv daIf +PAN -UAO -TCO BTYPE=--) > [ 4703.785046] pc : _raw_write_unlock_bh+0xc0/0x2c8 > [ 4703.789667] lr : android_setup+0x4c/0x168 > [ 4703.793676] sp : ffff80001256bd80 > [ 4703.796989] x29: ffff80001256bd80 x28: 00000000000000a8 > [ 4703.802304] x27: ffff800012470000 x26: ffff80006d923000 > [ 4703.807616] x25: ffff800012471000 x24: ffff00000b091140 > [ 4703.812929] x23: ffff0000077dbd38 x22: ffff0000077da490 > [ 4703.818242] x21: ffff80001256be30 x20: 0000000000000000 > [ 4703.823554] x19: 0000000000000080 x18: ffff800012561048 > [ 4703.828867] x17: 0000000000000000 x16: 0000000000000039 > [ 4703.834180] x15: ffff8000106ad258 x14: ffff80001194c277 > [ 4703.839493] x13: 0000000000003934 x12: 0000000000000000 > [ 4703.844805] x11: 0000000000000000 x10: 0000000000000001 > [ 4703.850117] x9 : 0000000000000000 x8 : 0000000000000090 > [ 4703.855429] x7 : 6f72646e61203a70 x6 : ffff8000124f2450 > [ 4703.860742] x5 : ffffffffffffffff x4 : 0000000000000009 > [ 4703.866054] x3 : ffff8000108a290c x2 : ffff00007fb3a9c8 > [ 4703.871367] x1 : 0000000000000000 x0 : 0000000000000090 > [ 4703.876681] Call trace: > [ 4703.879129] _raw_write_unlock_bh+0xc0/0x2c8 > [ 4703.883397] android_setup+0x4c/0x168 > [ 4703.887059] udc_irq+0x824/0xa9c > [ 4703.890287] ci_irq+0x124/0x148 > [ 4703.893429] __handle_irq_event_percpu+0x84/0x268 > [ 4703.898131] handle_irq_event+0x64/0x14c > [ 4703.902054] handle_fasteoi_irq+0x110/0x210 > [ 4703.906236] __handle_domain_irq+0x8c/0xd4 > [ 4703.910332] gic_handle_irq+0x6c/0x124 > [ 4703.914081] el1_irq+0xdc/0x1c0 > [ 4703.917221] _raw_spin_unlock_irq+0x20/0x54 > [ 4703.921405] finish_task_switch+0x84/0x224 > [ 4703.925502] __schedule+0x4a4/0x734 > [ 4703.928990] schedule+0xa0/0xe8 > [ 4703.932132] do_notify_resume+0x150/0x184 > [ 4703.936140] work_pending+0xc/0x40c > [ 4703.939633] Code: d5384613 521b0a69 d5184609 f9800111 (885ffd01) > [ 4703.945732] ---[ end trace ba5c1875ae49d53c ]--- > [ 4703.950350] Kernel panic - not syncing: Oops: Fatal exception in interrupt > [ 4703.957223] SMP: stopping secondary CPUs > [ 4703.961151] Kernel Offset: disabled > [ 4703.964638] CPU features: 0x0240002,2000200c > [ 4703.968905] Memory Limit: none > [ 4703.971963] Rebooting in 5 seconds.. > > Tested-by: faqiang.zhu <faqiang.zhu(a)nxp.com> > Signed-off-by: Li Jun <jun.li(a)nxp.com> > Link: https://lore.kernel.org/r/1620989984-7653-1-git-send-email-jun.li@nxp.com > Signed-off-by: Peter Chen <peter.chen(a)kernel.org> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: chensiyan96 <3225973902(a)qq.com> > --- > drivers/usb/chipidea/udc.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c > index 60ea932afe2b..5f35cdd2cf1d 100644 > --- a/drivers/usb/chipidea/udc.c > +++ b/drivers/usb/chipidea/udc.c > @@ -2055,6 +2055,7 @@ static int udc_start(struct ci_hdrc *ci) > ci->gadget.name = ci->platdata->name; > ci->gadget.otg_caps = otg_caps; > ci->gadget.sg_supported = 1; > + ci->gadget.irq = ci->irq; > > if (ci->platdata->flags & CI_HDRC_REQUIRES_ALIGNED_DMA) > ci->gadget.quirk_avoids_skb_reserve = 1;

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:25, ZhuoliHuang 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:26, lihao 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

Re: [PATCH openEuler-21.03] net: mdiobus: get rid of a BUG_ON()
by chengjian (D) 26 Oct '21

26 Oct '21

Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> 在 2021/10/23 17:27, zanderzhao 写道: > From: Dan Carpenter <dan.carpenter(a)oracle.com> > > stable inclusion > from stable-v5.10.44 > commit be23c4af3d8a1b986fe9b43b8966797653a76ca4 > bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=341 > CVE: NA > > -------------------------------- > > [ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] > > We spotted a bug recently during a review where a driver was > unregistering a bus that wasn't registered, which would trigger this > BUG_ON(). Let's handle that situation more gracefully, and just print > a warning and return. > > Reported-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> > Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> > Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > Signed-off-by: wangqing <wangqing(a)uniontech.com> > Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> > Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> > --- > drivers/net/phy/mdio_bus.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 757e950fb745..b848439fa837 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -608,7 +608,8 @@ void mdiobus_unregister(struct mii_bus *bus) > struct mdio_device *mdiodev; > int i; > > - BUG_ON(bus->state != MDIOBUS_REGISTERED); > + if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) > + return; > bus->state = MDIOBUS_UNREGISTERED; > > for (i = 0; i < PHY_MAX_ADDR; i++) {

1 0

2025

2024

2023

2022

2021

2020

2019

Kernel