<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers, branch v5.4.42</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>clk: Unlink clock if failed to prepare or enable</title>
<updated>2020-05-20T06:20:37+00:00</updated>
<author>
<name>Marc Zyngier</name>
<email>maz@kernel.org</email>
</author>
<published>2020-05-05T14:09:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=01febb33cb6e10a49ddbcd4a21e59b3e44ce3d4f'/>
<id>01febb33cb6e10a49ddbcd4a21e59b3e44ce3d4f</id>
<content type='text'>
commit 018d4671b9bbd4a5c55cf6eab3e1dbc70a50b66e upstream.

On failing to prepare or enable a clock, remove the core structure
from the list it has been inserted as it is about to be freed.

This otherwise leads to random crashes when subsequent clocks get
registered, during which parsing of the clock tree becomes adventurous.

Observed with QEMU's RPi-3 emulation.

Fixes: 12ead77432f2 ("clk: Don't try to enable critical clocks if prepare failed")
Signed-off-by: Marc Zyngier &lt;maz@kernel.org&gt;
Cc: Guenter Roeck &lt;linux@roeck-us.net&gt;
Cc: Stephen Boyd &lt;sboyd@kernel.org&gt;
Cc: Michael Turquette &lt;mturquette@baylibre.com&gt;
Link: https://lkml.kernel.org/r/20200505140953.409430-1-maz@kernel.org
Signed-off-by: Stephen Boyd &lt;sboyd@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 018d4671b9bbd4a5c55cf6eab3e1dbc70a50b66e upstream.

On failing to prepare or enable a clock, remove the core structure
from the list it has been inserted as it is about to be freed.

This otherwise leads to random crashes when subsequent clocks get
registered, during which parsing of the clock tree becomes adventurous.

Observed with QEMU's RPi-3 emulation.

Fixes: 12ead77432f2 ("clk: Don't try to enable critical clocks if prepare failed")
Signed-off-by: Marc Zyngier &lt;maz@kernel.org&gt;
Cc: Guenter Roeck &lt;linux@roeck-us.net&gt;
Cc: Stephen Boyd &lt;sboyd@kernel.org&gt;
Cc: Michael Turquette &lt;mturquette@baylibre.com&gt;
Link: https://lkml.kernel.org/r/20200505140953.409430-1-maz@kernel.org
Signed-off-by: Stephen Boyd &lt;sboyd@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: legacy: fix error return code in cdc_bind()</title>
<updated>2020-05-20T06:20:36+00:00</updated>
<author>
<name>Wei Yongjun</name>
<email>weiyongjun1@huawei.com</email>
</author>
<published>2020-05-07T05:13:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=5e553801462b8292be85a007f4441f30299b52b5'/>
<id>5e553801462b8292be85a007f4441f30299b52b5</id>
<content type='text'>
commit e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b upstream.

If 'usb_otg_descriptor_alloc()' fails, we must return a
negative error code -ENOMEM, not 0.

Fixes: ab6796ae9833 ("usb: gadget: cdc2: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Signed-off-by: Wei Yongjun &lt;weiyongjun1@huawei.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b upstream.

If 'usb_otg_descriptor_alloc()' fails, we must return a
negative error code -ENOMEM, not 0.

Fixes: ab6796ae9833 ("usb: gadget: cdc2: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Signed-off-by: Wei Yongjun &lt;weiyongjun1@huawei.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: legacy: fix error return code in gncm_bind()</title>
<updated>2020-05-20T06:20:36+00:00</updated>
<author>
<name>Wei Yongjun</name>
<email>weiyongjun1@huawei.com</email>
</author>
<published>2020-05-07T05:13:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=7e5c1db8ad153a08c4fba3451f7a9088227ba934'/>
<id>7e5c1db8ad153a08c4fba3451f7a9088227ba934</id>
<content type='text'>
commit e27d4b30b71c66986196d8a1eb93cba9f602904a upstream.

If 'usb_otg_descriptor_alloc()' fails, we must return a
negative error code -ENOMEM, not 0.

Fixes: 1156e91dd7cc ("usb: gadget: ncm: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Signed-off-by: Wei Yongjun &lt;weiyongjun1@huawei.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e27d4b30b71c66986196d8a1eb93cba9f602904a upstream.

If 'usb_otg_descriptor_alloc()' fails, we must return a
negative error code -ENOMEM, not 0.

Fixes: 1156e91dd7cc ("usb: gadget: ncm: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot &lt;hulkci@huawei.com&gt;
Signed-off-by: Wei Yongjun &lt;weiyongjun1@huawei.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: audio: Fix a missing error return value in audio_bind()</title>
<updated>2020-05-20T06:20:36+00:00</updated>
<author>
<name>Christophe JAILLET</name>
<email>christophe.jaillet@wanadoo.fr</email>
</author>
<published>2020-05-03T10:47:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8228b67369649f5106497262fb041d38cb1c62e8'/>
<id>8228b67369649f5106497262fb041d38cb1c62e8</id>
<content type='text'>
commit 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf upstream.

If 'usb_otg_descriptor_alloc()' fails, we must return an error code, not 0.

Fixes: 56023ce0fd70 ("usb: gadget: audio: allocate and init otg descriptor by otg capabilities")
Reviewed-by: Peter Chen &lt;peter.chen@nxp.com&gt;
Signed-off-by: Christophe JAILLET &lt;christophe.jaillet@wanadoo.fr&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf upstream.

If 'usb_otg_descriptor_alloc()' fails, we must return an error code, not 0.

Fixes: 56023ce0fd70 ("usb: gadget: audio: allocate and init otg descriptor by otg capabilities")
Reviewed-by: Peter Chen &lt;peter.chen@nxp.com&gt;
Signed-off-by: Christophe JAILLET &lt;christophe.jaillet@wanadoo.fr&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'</title>
<updated>2020-05-20T06:20:35+00:00</updated>
<author>
<name>Christophe JAILLET</name>
<email>christophe.jaillet@wanadoo.fr</email>
</author>
<published>2020-04-27T18:04:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8ef4520017695a32512c0f7315e20d081d48b42b'/>
<id>8ef4520017695a32512c0f7315e20d081d48b42b</id>
<content type='text'>
commit ccaef7e6e354fb65758eaddd3eae8065a8b3e295 upstream.

'dev' is allocated in 'net2272_probe_init()'. It must be freed in the error
handling path, as already done in the remove function (i.e.
'net2272_plat_remove()')

Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Signed-off-by: Christophe JAILLET &lt;christophe.jaillet@wanadoo.fr&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit ccaef7e6e354fb65758eaddd3eae8065a8b3e295 upstream.

'dev' is allocated in 'net2272_probe_init()'. It must be freed in the error
handling path, as already done in the remove function (i.e.
'net2272_plat_remove()')

Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Signed-off-by: Christophe JAILLET &lt;christophe.jaillet@wanadoo.fr&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>dwc3: Remove check for HWO flag in dwc3_gadget_ep_reclaim_trb_sg()</title>
<updated>2020-05-20T06:20:35+00:00</updated>
<author>
<name>John Stultz</name>
<email>john.stultz@linaro.org</email>
</author>
<published>2020-05-04T23:12:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=20a6d2455cde5db0883c1181cf6f580e945a040a'/>
<id>20a6d2455cde5db0883c1181cf6f580e945a040a</id>
<content type='text'>
commit 00e21763f2c8cab21b7befa52996d1b18bde5c42 upstream.

The check for the HWO flag in dwc3_gadget_ep_reclaim_trb_sg()
causes us to break out of the loop before we call
dwc3_gadget_ep_reclaim_completed_trb(), which is what likely
should be clearing the HWO flag.

This can cause odd behavior where we never reclaim all the trbs
in the sg list, so we never call giveback on a usb req, and that
will causes transfer stalls.

This effectively resovles the adb stalls seen on HiKey960
after userland changes started only using AIO in adbd.

Cc: YongQin Liu &lt;yongqin.liu@linaro.org&gt;
Cc: Anurag Kumar Vulisha &lt;anurag.kumar.vulisha@xilinx.com&gt;
Cc: Yang Fei &lt;fei.yang@intel.com&gt;
Cc: Thinh Nguyen &lt;thinhn@synopsys.com&gt;
Cc: Tejas Joglekar &lt;tejas.joglekar@synopsys.com&gt;
Cc: Andrzej Pietrasiewicz &lt;andrzej.p@collabora.com&gt;
Cc: Jack Pham &lt;jackp@codeaurora.org&gt;
Cc: Josh Gao &lt;jmgao@google.com&gt;
Cc: Todd Kjos &lt;tkjos@google.com&gt;
Cc: Felipe Balbi &lt;balbi@kernel.org&gt;
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org #4.20+
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 00e21763f2c8cab21b7befa52996d1b18bde5c42 upstream.

The check for the HWO flag in dwc3_gadget_ep_reclaim_trb_sg()
causes us to break out of the loop before we call
dwc3_gadget_ep_reclaim_completed_trb(), which is what likely
should be clearing the HWO flag.

This can cause odd behavior where we never reclaim all the trbs
in the sg list, so we never call giveback on a usb req, and that
will causes transfer stalls.

This effectively resovles the adb stalls seen on HiKey960
after userland changes started only using AIO in adbd.

Cc: YongQin Liu &lt;yongqin.liu@linaro.org&gt;
Cc: Anurag Kumar Vulisha &lt;anurag.kumar.vulisha@xilinx.com&gt;
Cc: Yang Fei &lt;fei.yang@intel.com&gt;
Cc: Thinh Nguyen &lt;thinhn@synopsys.com&gt;
Cc: Tejas Joglekar &lt;tejas.joglekar@synopsys.com&gt;
Cc: Andrzej Pietrasiewicz &lt;andrzej.p@collabora.com&gt;
Cc: Jack Pham &lt;jackp@codeaurora.org&gt;
Cc: Josh Gao &lt;jmgao@google.com&gt;
Cc: Todd Kjos &lt;tkjos@google.com&gt;
Cc: Felipe Balbi &lt;balbi@kernel.org&gt;
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org #4.20+
Signed-off-by: John Stultz &lt;john.stultz@linaro.org&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks</title>
<updated>2020-05-20T06:20:35+00:00</updated>
<author>
<name>Justin Swartz</name>
<email>justin.swartz@risingedge.co.za</email>
</author>
<published>2020-01-14T16:25:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=4f6815e429a8a8576599dcf361eca470677f1ab6'/>
<id>4f6815e429a8a8576599dcf361eca470677f1ab6</id>
<content type='text'>
commit cec9d101d70a3509da9bd2e601e0b242154ce616 upstream.

The following changes prevent the unrecoverable freezes and rcu_sched
stall warnings experienced in each of my attempts to take advantage of
lima.

Replace the COMPOSITE_NOGATE definition of aclk_gpu_pre with a
COMPOSITE that retains the selection of HDMIPHY as the PLL source, but
instead makes uses of the aclk_gpu PLL source gate and parent names
defined by mux_pll_src_4plls_p rather than mux_aclk_gpu_pre_p.

Remove the now unused mux_aclk_gpu_pre_p and the four named but also
unused definitions (cpll_gpu, gpll_gpu, hdmiphy_gpu and usb480m_gpu)
of the aclk_gpu PLL source gate.

Use the correct gate offset for aclk_gpu and aclk_gpu_noc.

Fixes: 307a2e9ac524 ("clk: rockchip: add clock controller for rk3228")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Swartz &lt;justin.swartz@risingedge.co.za&gt;
[double-checked against SoC manual and added fixes tag]
Link: https://lore.kernel.org/r/20200114162503.7548-1-justin.swartz@risingedge.co.za
Signed-off-by: Heiko Stuebner &lt;heiko@sntech.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit cec9d101d70a3509da9bd2e601e0b242154ce616 upstream.

The following changes prevent the unrecoverable freezes and rcu_sched
stall warnings experienced in each of my attempts to take advantage of
lima.

Replace the COMPOSITE_NOGATE definition of aclk_gpu_pre with a
COMPOSITE that retains the selection of HDMIPHY as the PLL source, but
instead makes uses of the aclk_gpu PLL source gate and parent names
defined by mux_pll_src_4plls_p rather than mux_aclk_gpu_pre_p.

Remove the now unused mux_aclk_gpu_pre_p and the four named but also
unused definitions (cpll_gpu, gpll_gpu, hdmiphy_gpu and usb480m_gpu)
of the aclk_gpu PLL source gate.

Use the correct gate offset for aclk_gpu and aclk_gpu_noc.

Fixes: 307a2e9ac524 ("clk: rockchip: add clock controller for rk3228")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Swartz &lt;justin.swartz@risingedge.co.za&gt;
[double-checked against SoC manual and added fixes tag]
Link: https://lore.kernel.org/r/20200114162503.7548-1-justin.swartz@risingedge.co.za
Signed-off-by: Heiko Stuebner &lt;heiko@sntech.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: add basic atomic check for cursor plane</title>
<updated>2020-05-20T06:20:33+00:00</updated>
<author>
<name>Simon Ser</name>
<email>contact@emersion.fr</email>
</author>
<published>2020-03-30T09:23:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=57aa19acfc220af0b7888996a3313795c37ecdac'/>
<id>57aa19acfc220af0b7888996a3313795c37ecdac</id>
<content type='text'>
commit 626bf90fe03fa080d8df06bb0397c95c53ae8e27 upstream.

This patch adds a basic cursor check when an atomic test-only commit is
performed. The position and size of the cursor plane is checked.

This should fix user-space relying on atomic checks to assign buffers to
planes.

Signed-off-by: Simon Ser &lt;contact@emersion.fr&gt;
Reported-by: Roman Gilg &lt;subdiff@gmail.com&gt;
References: https://github.com/emersion/libliftoff/issues/46
Cc: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: Harry Wentland &lt;hwentlan@amd.com&gt;
Reviewed-by: Nicholas Kazlauskas &lt;nicholas.kazlauskas@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 626bf90fe03fa080d8df06bb0397c95c53ae8e27 upstream.

This patch adds a basic cursor check when an atomic test-only commit is
performed. The position and size of the cursor plane is checked.

This should fix user-space relying on atomic checks to assign buffers to
planes.

Signed-off-by: Simon Ser &lt;contact@emersion.fr&gt;
Reported-by: Roman Gilg &lt;subdiff@gmail.com&gt;
References: https://github.com/emersion/libliftoff/issues/46
Cc: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: Harry Wentland &lt;hwentlan@amd.com&gt;
Reviewed-by: Nicholas Kazlauskas &lt;nicholas.kazlauskas@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Make the "Reducing compressed framebufer size" message be DRM_INFO_ONCE()</title>
<updated>2020-05-20T06:20:32+00:00</updated>
<author>
<name>Peter Jones</name>
<email>pjones@redhat.com</email>
</author>
<published>2018-07-06T19:04:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=da55eeb3245ae1aa8426c926b485d946b787f5ea'/>
<id>da55eeb3245ae1aa8426c926b485d946b787f5ea</id>
<content type='text'>
commit 82152d424b6cb6fc1ede7d03d69c04e786688740 upstream.

This was sort of annoying me:

random:~$ dmesg | tail -1
[523884.039227] [drm] Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.
random:~$ dmesg | grep -c "Reducing the compressed"
47

This patch makes it DRM_INFO_ONCE() just like the similar message
farther down in that function is pr_info_once().

Cc: stable@vger.kernel.org
Signed-off-by: Peter Jones &lt;pjones@redhat.com&gt;
Acked-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1745
Link: https://patchwork.freedesktop.org/patch/msgid/20180706190424.29194-1-pjones@redhat.com
[vsyrjala: Rebase due to per-device logging]
Signed-off-by: Ville Syrjälä &lt;ville.syrjala@linux.intel.com&gt;
(cherry picked from commit 6b7fc6a3e6af4ff5773949d0fed70d8e7f68d5ce)
[Rodrigo: port back to DRM_INFO_ONCE]
Signed-off-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 82152d424b6cb6fc1ede7d03d69c04e786688740 upstream.

This was sort of annoying me:

random:~$ dmesg | tail -1
[523884.039227] [drm] Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.
random:~$ dmesg | grep -c "Reducing the compressed"
47

This patch makes it DRM_INFO_ONCE() just like the similar message
farther down in that function is pr_info_once().

Cc: stable@vger.kernel.org
Signed-off-by: Peter Jones &lt;pjones@redhat.com&gt;
Acked-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1745
Link: https://patchwork.freedesktop.org/patch/msgid/20180706190424.29194-1-pjones@redhat.com
[vsyrjala: Rebase due to per-device logging]
Signed-off-by: Ville Syrjälä &lt;ville.syrjala@linux.intel.com&gt;
(cherry picked from commit 6b7fc6a3e6af4ff5773949d0fed70d8e7f68d5ce)
[Rodrigo: port back to DRM_INFO_ONCE]
Signed-off-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list</title>
<updated>2020-05-20T06:20:32+00:00</updated>
<author>
<name>Sriharsha Allenki</name>
<email>sallenki@codeaurora.org</email>
</author>
<published>2020-05-14T11:04:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=c6a1ce81b43eb796b1d222b537b7a6fec54a2709'/>
<id>c6a1ce81b43eb796b1d222b537b7a6fec54a2709</id>
<content type='text'>
commit 3c6f8cb92c9178fc0c66b580ea3df1fa3ac1155a upstream.

On platforms with IOMMU enabled, multiple SGs can be coalesced into one
by the IOMMU driver. In that case the SG list processing as part of the
completion of a urb on a bulk endpoint can result into a NULL pointer
dereference with the below stack dump.

&lt;6&gt; Unable to handle kernel NULL pointer dereference at virtual address 0000000c
&lt;6&gt; pgd = c0004000
&lt;6&gt; [0000000c] *pgd=00000000
&lt;6&gt; Internal error: Oops: 5 [#1] PREEMPT SMP ARM
&lt;2&gt; PC is at xhci_queue_bulk_tx+0x454/0x80c
&lt;2&gt; LR is at xhci_queue_bulk_tx+0x44c/0x80c
&lt;2&gt; pc : [&lt;c08907c4&gt;]    lr : [&lt;c08907bc&gt;]    psr: 000000d3
&lt;2&gt; sp : ca337c80  ip : 00000000  fp : ffffffff
&lt;2&gt; r10: 00000000  r9 : 50037000  r8 : 00004000
&lt;2&gt; r7 : 00000000  r6 : 00004000  r5 : 00000000  r4 : 00000000
&lt;2&gt; r3 : 00000000  r2 : 00000082  r1 : c2c1a200  r0 : 00000000
&lt;2&gt; Flags: nzcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment none
&lt;2&gt; Control: 10c0383d  Table: b412c06a  DAC: 00000051
&lt;6&gt; Process usb-storage (pid: 5961, stack limit = 0xca336210)
&lt;snip&gt;
&lt;2&gt; [&lt;c08907c4&gt;] (xhci_queue_bulk_tx)
&lt;2&gt; [&lt;c0881b3c&gt;] (xhci_urb_enqueue)
&lt;2&gt; [&lt;c0831068&gt;] (usb_hcd_submit_urb)
&lt;2&gt; [&lt;c08350b4&gt;] (usb_sg_wait)
&lt;2&gt; [&lt;c089f384&gt;] (usb_stor_bulk_transfer_sglist)
&lt;2&gt; [&lt;c089f2c0&gt;] (usb_stor_bulk_srb)
&lt;2&gt; [&lt;c089fe38&gt;] (usb_stor_Bulk_transport)
&lt;2&gt; [&lt;c089f468&gt;] (usb_stor_invoke_transport)
&lt;2&gt; [&lt;c08a11b4&gt;] (usb_stor_control_thread)
&lt;2&gt; [&lt;c014a534&gt;] (kthread)

The above NULL pointer dereference is the result of block_len and the
sent_len set to zero after the first SG of the list when IOMMU driver
is enabled. Because of this the loop of processing the SGs has run
more than num_sgs which resulted in a sg_next on the last SG of the
list which has SG_END set.

Fix this by check for the sg before any attributes of the sg are
accessed.

[modified reason for null pointer dereference in commit message subject -Mathias]
Fixes: f9c589e142d04 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Sriharsha Allenki &lt;sallenki@codeaurora.org&gt;
Signed-off-by: Mathias Nyman &lt;mathias.nyman@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20200514110432.25564-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3c6f8cb92c9178fc0c66b580ea3df1fa3ac1155a upstream.

On platforms with IOMMU enabled, multiple SGs can be coalesced into one
by the IOMMU driver. In that case the SG list processing as part of the
completion of a urb on a bulk endpoint can result into a NULL pointer
dereference with the below stack dump.

&lt;6&gt; Unable to handle kernel NULL pointer dereference at virtual address 0000000c
&lt;6&gt; pgd = c0004000
&lt;6&gt; [0000000c] *pgd=00000000
&lt;6&gt; Internal error: Oops: 5 [#1] PREEMPT SMP ARM
&lt;2&gt; PC is at xhci_queue_bulk_tx+0x454/0x80c
&lt;2&gt; LR is at xhci_queue_bulk_tx+0x44c/0x80c
&lt;2&gt; pc : [&lt;c08907c4&gt;]    lr : [&lt;c08907bc&gt;]    psr: 000000d3
&lt;2&gt; sp : ca337c80  ip : 00000000  fp : ffffffff
&lt;2&gt; r10: 00000000  r9 : 50037000  r8 : 00004000
&lt;2&gt; r7 : 00000000  r6 : 00004000  r5 : 00000000  r4 : 00000000
&lt;2&gt; r3 : 00000000  r2 : 00000082  r1 : c2c1a200  r0 : 00000000
&lt;2&gt; Flags: nzcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment none
&lt;2&gt; Control: 10c0383d  Table: b412c06a  DAC: 00000051
&lt;6&gt; Process usb-storage (pid: 5961, stack limit = 0xca336210)
&lt;snip&gt;
&lt;2&gt; [&lt;c08907c4&gt;] (xhci_queue_bulk_tx)
&lt;2&gt; [&lt;c0881b3c&gt;] (xhci_urb_enqueue)
&lt;2&gt; [&lt;c0831068&gt;] (usb_hcd_submit_urb)
&lt;2&gt; [&lt;c08350b4&gt;] (usb_sg_wait)
&lt;2&gt; [&lt;c089f384&gt;] (usb_stor_bulk_transfer_sglist)
&lt;2&gt; [&lt;c089f2c0&gt;] (usb_stor_bulk_srb)
&lt;2&gt; [&lt;c089fe38&gt;] (usb_stor_Bulk_transport)
&lt;2&gt; [&lt;c089f468&gt;] (usb_stor_invoke_transport)
&lt;2&gt; [&lt;c08a11b4&gt;] (usb_stor_control_thread)
&lt;2&gt; [&lt;c014a534&gt;] (kthread)

The above NULL pointer dereference is the result of block_len and the
sent_len set to zero after the first SG of the list when IOMMU driver
is enabled. Because of this the loop of processing the SGs has run
more than num_sgs which resulted in a sg_next on the last SG of the
list which has SG_END set.

Fix this by check for the sg before any attributes of the sg are
accessed.

[modified reason for null pointer dereference in commit message subject -Mathias]
Fixes: f9c589e142d04 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Sriharsha Allenki &lt;sallenki@codeaurora.org&gt;
Signed-off-by: Mathias Nyman &lt;mathias.nyman@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20200514110432.25564-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
