summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-04-19[media] xc2028: avoid use after freeMauro Carvalho Chehab
If struct xc2028_config is passed without a firmware name, the following trouble may happen: [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner [11009.907491] ================================================================== [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40 [11009.907992] Read of size 1 by task modprobe/28992 [11009.907994] ============================================================================= [11009.907997] BUG kmalloc-16 (Tainted: G W ): kasan: bad access detected [11009.907999] ----------------------------------------------------------------------------- [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992 [11009.908012] ___slab_alloc+0x581/0x5b0 [11009.908014] __slab_alloc+0x51/0x90 [11009.908017] __kmalloc+0x27b/0x350 [11009.908022] xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] [11009.908026] usb_hcd_submit_urb+0x1e8/0x1c60 [11009.908029] usb_submit_urb+0xb0e/0x1200 [11009.908032] usb_serial_generic_write_start+0xb6/0x4c0 [11009.908035] usb_serial_generic_write+0x92/0xc0 [11009.908039] usb_console_write+0x38a/0x560 [11009.908045] call_console_drivers.constprop.14+0x1ee/0x2c0 [11009.908051] console_unlock+0x40d/0x900 [11009.908056] vprintk_emit+0x4b4/0x830 [11009.908061] vprintk_default+0x1f/0x30 [11009.908064] printk+0x99/0xb5 [11009.908067] kasan_report_error+0x10a/0x550 [11009.908070] __asan_report_load1_noabort+0x43/0x50 [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992 [11009.908077] __slab_free+0x2ec/0x460 [11009.908080] kfree+0x266/0x280 [11009.908083] xc2028_set_config+0x90/0x630 [tuner_xc2028] [11009.908086] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908090] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908094] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908098] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908101] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908105] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908108] do_one_initcall+0x141/0x300 [11009.908111] do_init_module+0x1d0/0x5ad [11009.908114] load_module+0x6666/0x9ba0 [11009.908117] SyS_finit_module+0x108/0x130 [11009.908120] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x (null) flags=0x2ffff8000004080 [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001 [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00 ....*....(...... [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff ...........j.... [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G B W 4.5.0-rc1+ #43 [11009.908140] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015 [11009.908142] ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80 [11009.908148] ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280 [11009.908153] ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4 [11009.908158] Call Trace: [11009.908162] [<ffffffff81932007>] dump_stack+0x4b/0x64 [11009.908165] [<ffffffff81556759>] print_trailer+0xf9/0x150 [11009.908168] [<ffffffff8155ccb4>] object_err+0x34/0x40 [11009.908171] [<ffffffff8155f260>] kasan_report_error+0x230/0x550 [11009.908175] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908179] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908182] [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50 [11009.908185] [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0 [11009.908189] [<ffffffff8194cea6>] ? strcmp+0x96/0xb0 [11009.908192] [<ffffffff8194cea6>] strcmp+0x96/0xb0 [11009.908196] [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028] [11009.908200] [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908203] [<ffffffff8155ea78>] ? memset+0x28/0x30 [11009.908206] [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028] [11009.908211] [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908215] [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb] [11009.908219] [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb] [11009.908222] [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x] [11009.908226] [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x] [11009.908230] [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10 [11009.908233] [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80 [11009.908238] [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908242] [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb] [11009.908245] [<ffffffff8195222d>] ? string+0x14d/0x1f0 [11009.908249] [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0 [11009.908253] [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0 [11009.908257] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908260] [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0 [11009.908264] [<ffffffff812e9846>] ? __module_address+0xb6/0x360 [11009.908268] [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0 [11009.908271] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908275] [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290 [11009.908278] [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300 [11009.908282] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908285] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908289] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908292] [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10 [11009.908296] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908299] [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400 [11009.908302] [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300 [11009.908306] [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20 [11009.908309] [<ffffffff8159e708>] ? put_object+0x48/0x70 [11009.908314] [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908317] [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908320] [<ffffffffa0150000>] ? 0xffffffffa0150000 [11009.908324] [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908327] [<ffffffff810021b1>] do_one_initcall+0x141/0x300 [11009.908330] [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 [11009.908333] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908337] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908340] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908343] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908346] [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0 [11009.908350] [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad [11009.908353] [<ffffffff812f2626>] load_module+0x6666/0x9ba0 [11009.908356] [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50 [11009.908361] [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb] [11009.908366] [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20 [11009.908369] [<ffffffff815bc940>] ? open_exec+0x50/0x50 [11009.908374] [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0 [11009.908377] [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130 [11009.908379] [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0 [11009.908383] [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14 [11009.908394] [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908396] Memory state around the buggy address: [11009.908398] ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908401] ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [11009.908405] ^ [11009.908407] ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908409] ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908411] ================================================================== In order to avoid it, let's set the cached value of the firmware name to NULL after freeing it. While here, return an error if the memory allocation fails. Bug 1823317 Bug 1935735 Change-Id: I1825fc7eb08bd458ed5413fea8b47de539c9b23f Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1690296 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19sg: Fix double-free when drives detach during SG_IOCalvin Owens
In sg_common_write(), we free the block request and return -ENODEV if the device is detached in the middle of the SG_IO ioctl(). Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we end up freeing rq->cmd in the already free rq object, and then free the object itself out from under the current user. This ends up corrupting random memory via the list_head on the rq object. The most common crash trace I saw is this: ------------[ cut here ]------------ kernel BUG at block/blk-core.c:1420! Call Trace: [<ffffffff81281eab>] blk_put_request+0x5b/0x80 [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg] [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg] [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70 [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg] [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg] [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520 [<ffffffff81258967>] ? file_has_perm+0x97/0xb0 [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0 [<ffffffff81602afb>] tracesys+0xdd/0xe2 RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0 The solution is straightforward: just set srp->rq to NULL in the failure branch so that sg_finish_rem_req() doesn't attempt to re-free it. Additionally, since sg_rq_end_io() will never be called on the object when this happens, we need to free memory backing ->cmd if it isn't embedded in the object itself. KASAN was extremely helpful in finding the root cause of this bug. Bug 1823317 Bug 1935735 Change-Id: I883243dce583cd79e28facaa2cdd81157b293d74 Signed-off-by: Calvin Owens <calvinowens@fb.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259958 (cherry picked from commit b49da4529988ca02bddaed8091a7f5e91105970a) Reviewed-on: https://git-master.nvidia.com/r/1690295 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19block: fix use-after-free in sys_ioprio_get()Omar Sandoval
get_task_ioprio() accesses the task->io_context without holding the task lock and thus can race with exit_io_context(), leading to a use-after-free. The reproducer below hits this within a few seconds on my 4-core QEMU VM: int main(int argc, char **argv) { pid_t pid, child; long nproc, i; /* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */ syscall(SYS_ioprio_set, 1, 0, 0x6000); nproc = sysconf(_SC_NPROCESSORS_ONLN); for (i = 0; i < nproc; i++) { pid = fork(); assert(pid != -1); if (pid == 0) { for (;;) { pid = fork(); assert(pid != -1); if (pid == 0) { _exit(0); } else { child = wait(NULL); assert(child == pid); } } } pid = fork(); assert(pid != -1); if (pid == 0) { for (;;) { /* ioprio_get(IOPRIO_WHO_PGRP, 0); */ syscall(SYS_ioprio_get, 2, 0); } } } for (;;) { /* ioprio_get(IOPRIO_WHO_PGRP, 0); */ syscall(SYS_ioprio_get, 2, 0); } return 0; } This gets us KASAN dumps like this: [ 35.526914] ================================================================== [ 35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c [ 35.530009] Read of size 2 by task ioprio-gpf/363 [ 35.530009] ============================================================================= [ 35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected [ 35.530009] ----------------------------------------------------------------------------- [ 35.530009] Disabling lock debugging due to kernel taint [ 35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360 [ 35.530009] ___slab_alloc+0x55d/0x5a0 [ 35.530009] __slab_alloc.isra.20+0x2b/0x40 [ 35.530009] kmem_cache_alloc_node+0x84/0x200 [ 35.530009] create_task_io_context+0x2b/0x370 [ 35.530009] get_task_io_context+0x92/0xb0 [ 35.530009] copy_process.part.8+0x5029/0x5660 [ 35.530009] _do_fork+0x155/0x7e0 [ 35.530009] SyS_clone+0x19/0x20 [ 35.530009] do_syscall_64+0x195/0x3a0 [ 35.530009] return_from_SYSCALL_64+0x0/0x6a [ 35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060 [ 35.530009] __slab_free+0x27b/0x3d0 [ 35.530009] kmem_cache_free+0x1fb/0x220 [ 35.530009] put_io_context+0xe7/0x120 [ 35.530009] put_io_context_active+0x238/0x380 [ 35.530009] exit_io_context+0x66/0x80 [ 35.530009] do_exit+0x158e/0x2b90 [ 35.530009] do_group_exit+0xe5/0x2b0 [ 35.530009] SyS_exit_group+0x1d/0x20 [ 35.530009] entry_SYSCALL_64_fastpath+0x1a/0xa4 [ 35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080 [ 35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001 [ 35.530009] ================================================================== Fix it by grabbing the task lock while we poke at the io_context. Bug 1823317 Bug 1935735 Change-Id: If331a4574b63e9288d1019c45c28af82731e9abb Cc: stable@vger.kernel.org Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Omar Sandoval <osandov@fb.com> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259972 (cherry picked from commit 15e376e5d8b1399d02814cf8b1481f7ac40dc483) Reviewed-on: https://git-master.nvidia.com/r/1690294 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19block: fix use-after-free in seq fileVegard Nossum
I got a KASAN report of use-after-free: ================================================================== BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508 Read of size 8 by task trinity-c1/315 ============================================================================= BUG kmalloc-32 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315 ___slab_alloc+0x4f1/0x520 __slab_alloc.isra.58+0x56/0x80 kmem_cache_alloc_trace+0x260/0x2a0 disk_seqf_start+0x66/0x110 traverse+0x176/0x860 seq_read+0x7e3/0x11a0 proc_reg_read+0xbc/0x180 do_loop_readv_writev+0x134/0x210 do_readv_writev+0x565/0x660 vfs_readv+0x67/0xa0 do_preadv+0x126/0x170 SyS_preadv+0xc/0x10 do_syscall_64+0x1a1/0x460 return_from_SYSCALL_64+0x0/0x6a INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315 __slab_free+0x17a/0x2c0 kfree+0x20a/0x220 disk_seqf_stop+0x42/0x50 traverse+0x3b5/0x860 seq_read+0x7e3/0x11a0 proc_reg_read+0xbc/0x180 do_loop_readv_writev+0x134/0x210 do_readv_writev+0x565/0x660 vfs_readv+0x67/0xa0 do_preadv+0x126/0x170 SyS_preadv+0xc/0x10 do_syscall_64+0x1a1/0x460 return_from_SYSCALL_64+0x0/0x6a CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G B 4.7.0+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480 ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480 ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970 Call Trace: [<ffffffff81d6ce81>] dump_stack+0x65/0x84 [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0 [<ffffffff814704ff>] object_err+0x2f/0x40 [<ffffffff814754d1>] kasan_report_error+0x221/0x520 [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40 [<ffffffff83888161>] klist_iter_exit+0x61/0x70 [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10 [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50 [<ffffffff8151f812>] seq_read+0x4b2/0x11a0 [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180 [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210 [<ffffffff814b4c45>] do_readv_writev+0x565/0x660 [<ffffffff814b8a17>] vfs_readv+0x67/0xa0 [<ffffffff814b8de6>] do_preadv+0x126/0x170 [<ffffffff814b92ec>] SyS_preadv+0xc/0x10 This problem can occur in the following situation: open() - pread() - .seq_start() - iter = kmalloc() // succeeds - seqf->private = iter - .seq_stop() - kfree(seqf->private) - pread() - .seq_start() - iter = kmalloc() // fails - .seq_stop() - class_dev_iter_exit(seqf->private) // boom! old pointer As the comment in disk_seqf_stop() says, stop is called even if start failed, so we need to reinitialise the private pointer to NULL when seq iteration stops. An alternative would be to set the private pointer to NULL when the kmalloc() in disk_seqf_start() fails. Bug 1823317 Bug 1935735 Change-Id: Ic3f82ef82c570866b48c5ea8e195d8e504570d80 Cc: stable@vger.kernel.org Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259961 (cherry picked from commit 9d4a4a8711e9570c3ead013b64ff6e8bad05afbc) Reviewed-on: https://git-master.nvidia.com/r/1690293 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19ALSA: usb-audio: Fix double-free in error paths after ↵Vladis Dronov
snd_usb_add_audio_stream() call create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and create_uaxx_quirk() functions allocate the audioformat object by themselves and free it upon error before returning. However, once the object is linked to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be double-freed, eventually resulting in a memory corruption. This patch fixes these failures in the error paths by unlinking the audioformat object before freeing it. Based on a patch by Takashi Iwai <tiwai@suse.de> [Note for stable backports: this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()')] Bug 1823317 Bug 1935735 Change-Id: I4f65a902a19e7b21e8bc0fa21efd833c8360a3cf Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358 Reported-by: Ralf Spenneberg <ralf@spenneberg.net> Cc: <stable@vger.kernel.org> # see the note above Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259999 (cherry picked from commit 14e09c3233fb7578c778b70ec3933ba5cadfccb6) Reviewed-on: https://git-master.nvidia.com/r/1690292 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19tcp: fix use after free in tcp_xmit_retransmit_queue()Eric Dumazet
When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Bug 1823317 Bug 1935735 Change-Id: I9bf709b21e5637f338c34d894617f33d84f93ecc Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1260003 (cherry picked from commit 0c20962647685008dfc6a15fb8a2169ed2abafe6) Reviewed-on: https://git-master.nvidia.com/r/1690290 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19staging: ion: Fix ION subsystem privilege vulnerabilityGagan Grover
A malicious application can take advantage of the ION kmalloc heap to create a specific memory chunk size to exercise a rowhammer attack on the physical hardware. The fix is designed to disable ION heap type. CVE-2016-6728: A-30400942 Bug 1823317 Change-Id: I6b6d891a85da0c175f88cc1a3e48875796db80d4 Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1690291 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-03arm64: define speculation barrierJames Huang
The instruction sequency "dsb sy" followed by "isb" functions as a speculation barrier, which prevents the instructions after that from being speculatively executed. bug 2039126 Change-Id: Ie3b7b873a12002617e60510ed8759bdaa7cd7057 Signed-off-by: Bo Yan <byan@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1618222 Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650093 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit f125c60045878513902cac4a084fde9a516eb3e2) Reviewed-on: https://git-master.nvidia.com/r/1660782 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-04-03v4l2: prevent speculative loadJeetesh Burman
bug 2039126 Change-Id: Id1908c3058c9ecc0dfb4f2d85440a8d36db45db5 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650029 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 7a0213eca150614fe88d197a09d461fff6168652) Reviewed-on: https://git-master.nvidia.com/r/1660781 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-04-03cryptodev: prevent speculative load related leakJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Id85eb9c91932f358dd999b28dd53d7788b37ea04 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1640356 Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650014 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 25bd9436b11f41e23048c9515deae97900a46669) Reviewed-on: https://git-master.nvidia.com/r/1660780 Reviewed-by: Winnie Hsu <whsu@nvidia.com> Tested-by: Winnie Hsu <whsu@nvidia.com>
2018-04-03drivers: speculative load before bound-checkJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. Bug 1964290 CVE-2017-5753 Change-Id: I7382dbcc6e9f352fafd457301beafe753925f3c4 Signed-off-by: Hien Goi <hgoi@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650791 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 5cabd53985a30aa818896abdb64564a74c09ab9c) Reviewed-on: https://git-master.nvidia.com/r/1660772 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-04-03arm: define speculation barrierJeetesh Burman
The instruction sequency "dsb sy" followed by "isb" functions as a speculation barrier, which prevents the instructions after that from being speculatively executed. bug 2039126 Change-Id: I898aab771ff82b26b08214a06814d2e6e78969a7 Signed-off-by: Bo Yan <byan@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1618222 Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650093 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit f125c60045878513902cac4a084fde9a516eb3e2) Reviewed-on: https://git-master.nvidia.com/r/1660771 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-03-28apalis-tk1: handle backlight in the device treeApalis-TK1_LXDE-Image_2.8b2.97-20180331toradex_tk1_l4t_r21.6Dominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28pwm-backlight: Add optional enable GPIOThierry Reding
To support a wider variety of backlight setups, introduce an optional enable GPIO. Legacy users of the platform data already have a means of supporting GPIOs by using the .init(), .exit() and .notify() hooks. DT users however cannot use those, so an alternative method is required. In order to ease the introduction of the optional enable GPIO, make it available in the platform data first, so that existing users can be converted. Once that has happened a second patch will add code to make use of it in the driver. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 2b9b1620349e325f184c68cddf3b484499c163c0)
2018-03-28pwm-backlight: Disable backlight on shutdownThierry Reding
When a device is shut down, make sure to disable the backlight. If it stays lit, it gives the impression that the device hasn't turned off. Furthermore keeping the backlight on may consume power, which is not what users expect when they shut down a device. Tested-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 5f33b896246a2d9bdf01352de11d4dab96ba2fc9)
2018-03-28backlight: pwm_bl: Remove error message upon devm_kzalloc() failureFabio Estevam
No need to have a specific OOM message, since there is generic MM out of memory message in place. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com> (cherry picked from commit ca7a97add4d4a7b0602b3bd1eff5c89da8636713)
2018-03-28pwm-backlight: Remove unused variableThierry Reding
I forgot to remove this during earlier cleanup patches and only checked various builds for errors, not warnings. Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com> (cherry picked from commit 73d4e2b82b4bb1571b1a7f97012c0db8a0faef42)
2018-03-28pwm_backlight: avoid short blank screen while doing hibernationHuayi Li
Use SIMPLE_DEV_PM_OPS macro will initialize the member "freeze" and "thaw" of pwm_backlight_pm_ops as below, .freeze = suspend_fn, .thaw = resume_fn, then during the process of making hibernation snapshot, screen will be blank at the moment of freezing, and then light at the moment of thawing. this is not the right user experience for suspending to disk. so this patch drops freeze and thaw callback, make the LCD is always lighting before the final shutdown. Signed-off-by: Huayi Li <huayi.li@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com> (cherry picked from commit 1dea1fd09246ada581a99d0669108eea94b7bfee)
2018-03-28pwm-backlight: Fix brightness adjustmentThierry Reding
Split adjustment of the brightness (by changing the PWM duty cycle) from the power on sequence. This fixes an issue where the brightness can no longer be updated once the backlight has been enabled. Reported-by: Marc Dietrich <marvin24@gmx.de> Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit e4bfeda96872bfe6015cd360008b77cd3b981b2b)
2018-03-28pwm-backlight: Allow for non-increasing brightness levelsMike Dunn
Currently the driver assumes that the values specified in the brightness-levels device tree property increase as they are parsed from left to right. But boards that invert the signal between the PWM output and the backlight will need to specify decreasing brightness-levels. This patch removes the assumption that the last element of the array is the maximum value, and instead searches the array for the maximum value and uses that in the duty cycle calculation. Signed-off-by: Mike Dunn <mikedunn@newsguy.com> Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 8f43e18e2769b3b28383903d501b4da29e388aad)
2018-03-28pwm-backlight: Add power supply supportThierry Reding
Backlights require a power supply to work properly. This commit adds a regulator to power up and power down the backlight. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 22ceeee16eb8f0d04de3ef43a5174fb30ec18af9)
2018-03-28pwm-backlight: Use new enable_gpio fieldThierry Reding
Make use of the new enable_gpio field and allow it to be set from DT as well. Now that all legacy users of platform data have been converted to initialize this field to an invalid value, it is safe to use the field from the driver. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 8265b2e4e62632b01f998095d1bbda4d281629fe)
2018-03-28pwm-backlight: Track enable stateThierry Reding
Follow up patches will add support for more complex means of powering the backlight on and off such as using a regulator. To prevent calls to the regulator API from becoming unbalanced, keep track of the enabled state internally. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 97c38437115aa0c3fb2d50c488814b503ba529e0)
2018-03-28pwm-backlight: Refactor backlight power on/offThierry Reding
In preparation for adding an optional regulator and enable GPIO to the driver, split the power on and power off sequences into separate functions to reduce code duplication at the multiple call sites. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 62b744a87c1170b339f993aa3cfb22465974816a)
2018-03-28pwm-backlight: Improve readabilityThierry Reding
Add more blank lines to increase readability. While at it, remove a trailing blank line at the end of the file. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 668e63c6701d486c68b49ffffc0e5b7de1a2e95c)
2018-03-28backlight: use dev_get_platdata()Jingoo Han
Use the wrapper function for retrieving the platform data instead of accessing dev->platform_data directly. This is a cosmetic change to make the code simpler and enhance the readability. Signed-off-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit c512794cada491e008eeca822af7e4ad5db72a56)
2018-03-28Revert "video: backlight: pwm_bl: add pwm_gpio"Dominik Sliwa
This reverts commit 95730406a0e3bbd7f862718782924a3c367845a1.
2018-03-28Revert "video: backlight: EDP client for backlight"Dominik Sliwa
This reverts commit 74df06fb565b7250bc86d79727b66bb02259d54c.
2018-03-28Revert "EDP: remove old system EDP framework (pwm backlight driver)"Dominik Sliwa
This reverts commit 08a13bacb43f206239ae0f1ccbe37325993e2b1b.
2018-03-28Revert "backlight: pwm: Converting benign message to info"Dominik Sliwa
This reverts commit 153a5d54d1a10c5a35f6923e0c6423430d2c7c89.
2018-03-28mfd: apalis-tk1-k20: separate common header fileDominik Sliwa
Both firmware and kernel are using the same set of constants in a header file, this patch separates them in to a single file. That way it will be easier to track changes to FW or kernel. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28apalis-tk1: add atmel mxt-ts to device-treesDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28input: atmel_mxt_ts: support reset gpio lineDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28apalis-tk1: add atmel mxt to defconfigDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28input: touchscreen: atmel_mxt_ts: backport from kernel 4.9Dominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28apalis-tk1: remove platform dc initializationDominik Sliwa
DC initialization now relays only on device-tree entry. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28apalis-tk1:lvds: add option to select 24-bit lvds modeDominik Sliwa
Add ability to switch between 24.1 and 24.0 lvds modes. Mode description can be found in "Using 24-bpp LVDS Panels with Intel® Mobile Chipsets for Embedded Applications". Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28apalis-tk1: move display configuration to device-treeDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28can: mfd: apalis-tk1: v1.1 frequency adjustments and various fixesDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28mfd: apalis-tk1-k20: single transaction register readDominik Sliwa
This change also modifies SPI clock for ezPort mode. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28can: mfd: apalis-tk1-k20:increased clock speed, zero copyDominik Sliwa
Increased SPI speed for transfers and peripheral speed. Switch to cleaning IRQ flags on read, instead of separate write. Switched to zero-copy on SPI reads. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-26gpu: nvgpu: Add ref counting to channelsAlex Waterman
Make sure that the VM owned by a channel lives for at least as long as that channel does. If the channel's VM is cleaned up before the channel then use-after-free bugs can occur. Bug: 31680980 NvBug 1825464 Bug: 1885921 Change-Id: I0711781492a764b643c2ed1da1b3ba87fda72744 Signed-off-by: Alex Waterman <alexw@nvidia.com> Reviewed-on: https://git-psac.nvidia.com/r/#/c/9261 Signed-off-by: Debarshi Dutta <ddutta@nvidia.com> (cherry picked from commit e205f2720fcee61886e7979e9588602d691507ea) Reviewed-on: https://git-master.nvidia.com/r/1681801 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-03-19tegra-cryptodev:Avoid untrusted usrptr dereferenceMallikarjun Kasoju
In RSA operations use copy_from_user to get key data into local buffer before using it. This will avoid untrusted user pointer dereference. Coverity ID 24040 Bug 200192571 Bug 1932494 Change-Id: I9c8f3fd7cfc18121d9c2179127dfb28202f38cdb Signed-off-by: Mallikarjun Kasoju <mkasoju@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1676570 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-03-19ASoC: tegra: check ucode upper limitRavindra Lokhande
Check ucode size for upper limit. Bug 1901435 Bug 1954563 Bug 1917589 Signed-off-by: Ravindra Lokhande <rlokhande@nvidia.com> Signed-off-by: Xia Yang <xiay@nvidia.com> Change-Id: I2f455771147bb4466d154878d2461e472647c4fb Reviewed-on: https://git-master.nvidia.com/r/1575925 Reviewed-on: https://git-master.nvidia.com/r/1674399 GVS: Gerrit_Virtual_Submit Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Tested-by: James Huang <jamehuang@nvidia.com> Reviewed-by: James Huang <jamehuang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-03-14video: tegra: sor: set drive current for lane4David Pu
drive current for LANE4 was not set if configured as 24bpp lvds out. fix it by programming proper drive current register if using 24bpp out. Bug 1724122 Change-Id: Ie2ad71ace0b4f247e007e671be828230545b15f6 Signed-off-by: David Pu <dpu@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1544691 Reviewed-by: Automatic_Commit_Validation_User Tested-by: Wayne Wang (SW-TEGRA) <waywang@nvidia.com> GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-03-09gpu: nvgpu: Validate buffer_offset argumentDebarshi Dutta
Validate the mapping_size argument in the VM mapping IOCTL before attempting to use the argument for anything. Manual Cherry pick - https://git-master.nvidia.com/r/1547046 Bug 1954931 Bug 1965443 Change-Id: I81b22dc566c6c6f89e5e62604ce996376b33a343 Signed-off-by: Alex Waterman <alexw@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1547046 Signed-off-by: Debarshi Dutta <ddutta@nvidia.com> (cherry picked from commit e68391690cfcc23b77c68aec3f9605badea226ed in dev-kernel) Reviewed-on: https://git-master.nvidia.com/r/1671883 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-02-26thermal: add boundary check to set_cur_stateSrikar Srimath Tirumala
Prevent sysfs from setting a cur_state that exceeds the max cur_state of the cooling device. Bug 200334223 Bug 200331706 Bug 1968660 Bug 1968616 Change-Id: I935be6166a9e184683abfcdce70cb08cbe4a1350 Signed-off-by: Srikar Srimath Tirumala <srikars@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1558407 (cherry picked from commit 142cf9d96ed221124ea2b778dc37cf5db8d5702c) Reviewed-on: https://git-master.nvidia.com/r/1661413 Reviewed-on: https://git-master.nvidia.com/r/1662626 GVS: Gerrit_Virtual_Submit Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-02-06CRYPTO: disable crypto dev fot t124Konduri Praveen
disabling tegra SE crypto dev for t124 platform. Bug 1927682 Change-Id: I16a24009e8f528df4be40ec65aa621b4ac779e41 Signed-off-by: Konduri Praveen <kondurip@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1582395 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-02-06video: tegra: host: use lock to get syncpt nameGagan Grover
Use sp->syncpt_mutex lock to get syncpt name in syncpt_name_show() Without the lock, it is possible for user to read syncpt name in corrupted state if user read coincides with syncpt free Bug 1838598 Bug 1883567 Change-Id: I69ca5c1d80adaca4b93a337fe4a5debeb78f34fc Reviewed-on: http://git-master/r/1252580 Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1258020 (cherry picked from commit 9a7d12e49ca6c627dff2dc4c15fa9ba153e9265d in rel-24) Reviewed-on: https://git-master.nvidia.com/r/1513005 Signed-off-by: Debarshi Dutta <ddutta@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650064 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-01-31cryptodev: avoid untrusted user pointersKonduri Praveen
add algo variable for avoid the usage of user space pointers Bug 200286426 Change-Id: I7e208b45ba11348e7b89a429d457ae51ac29bde0 Signed-off-by: Konduri Praveen <kondurip@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1530560 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Mallikarjun Kasoju <mkasoju@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-18 18:50:05 +0000