summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2019-09-19tegra: dc: events.c: fix error about unknown pragmaApalis-TK1_Console-Image_3.0b3.118-20191231Max Krummenacher
Fixes: '3f76b6ebb8c tegra: dc: events.c: fix error about packed' if GCC < 9.0.1 is used. | events.c:195:32: error: unknown option after '#pragma GCC diagnostic' kind [-Werror=pragmas] | #pragma GCC diagnostic warning "-Waddress-of-packed-member" | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
2019-09-16tegra: dc: events.c: fix error about packedMax Krummenacher
With GCC 9.2.0 we get the following error twice: | events.c:194:36: error: taking address of packed member of 'struct <anonymous>' | may result in an unaligned pointer value [-Werror=address-of-packed-member] | tegra_dc_ext_queue_event(control, &pack.event); | ^~~~~~~~~~~ Demote error to warning. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
2019-04-24Modify the way vi2 handles frame grabbing.Peter Gielda
(cherry picked from commit 0a8984655b5239833a3e6e0d54c7c867dbc7ea63) This fixes the dual camera use case. Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2019-04-23mmc: tegra: fix type of flag in KconfigOleksandr Suvorov
Fix a type of flag of disabling HS200 mode on tegra sdhci. Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
2019-02-06tegra-xusb: fix module compilationDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2019-01-30apalis-tk1: can: mfd: k20: use level interrupts and prioritize txDominik Sliwa
Prioritize CAN TX trafic, and move from edge to level triggered interrupts. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com>
2018-12-27apalis-tk1: mfd: k20: extra cycles for fifo cleanupDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-12-27apalis-tk1: mfd: k20: release fw after flashingDominik Sliwa
Previously fw was not released when K20 was flashed successfully Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29gk20a: use kcalloc() to allocate arraysRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29nvavp: avoid needless string copiesRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29gk20a: mark gk20a_init_pmu_setup_sw() staticRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29gk20a: do not BUG if the ioctl size does not matchRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29xhci-tegra: fix compiler warningsRolf Eike Beer
Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29Tegra: fix potential one byte overflows when calling strncpy()Rolf Eike Beer
Causes build failures with gcc 8. Signed-off-by: Rolf Eike Beer <eb@emlix.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29apalis-tk1: lvds: fix dts and allow setting lane4 drive strengthDominik Sliwa
Previously, lvds-drive-strength was located in a wrong node and there was no control of the 5th lane. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29Input: atmel_mxt_ts - fix reset-gpio for level based irqsSebastian Reichel
The current reset-gpio support triggers an interrupt storm on platforms using the maxtouch with level based interrupt. The Motorola Droid 4, which I used for some of the tests is not affected, since it uses a edge based interrupt. This change avoids the interrupt storm by enabling the device while its interrupt is disabled. Afterwards we wait 100ms. This is important for two reasons: The device is unresponsive for some time (~22ms for mxt224E) and the CHG (interrupt) line is not working properly for 100ms. We don't need to wait for any following interrupts, since the following mxt_initialize() checks for bootloader mode anyways. This fixes a boot issue on GE PPD (watchdog kills device due to interrupt storm) and does not cause regression on Motorola Droid 4. Fixes: f657b00df22e ("Input: atmel_mxt_ts - add support for reset line") Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Reviewed-by: Pavel Machek <pavel@ucw.cz> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit ca1cd36cef00260db6b35b32d863e0c580c0488d) Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-11-29Input: atmel_mxt_ts - add support for reset lineSebastian Reichel
Provide support for controlling reset pin. If this is not driven correctly the device will be held in reset and will not respond. Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit f657b00df22e231da217ca0162a75db452475e8f) Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-10-09Input: atmel_mxt_ts - use more managed resourcesSebastian Reichel
Switch mxt_data and interrupt to resource managed allocation methods, which cleans up the driver slightly and prepares for adding reset GPIO support. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit 8cc8446b9b62ef954b630ed30e53bd1553e916a6)
2018-10-09Input: atmel_mxt_ts - add T100 as a readable objectMaxime Roussin-Bélanger
When using the 'object' sysfs attribute, T100 is not displayed in the output. Signed-off-by: Maxime Roussin-Bélanger <maxime.roussinbelanger@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit 089b50d95948f691589cca4d81f1f8761747dbaa)
2018-10-09Input: touchscreen - use local variables consistentlyDominik Sliwa
If a function declares a variable to access a structure element, use it consistently. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> (cherry picked from commit d7ddf15414dd598b9b875664e6b7aebe6c988f5d)
2018-10-09Revert "input: atmel_mxt_ts: support reset gpio line"Dominik Sliwa
This reverts commit 22a2065b9a3fa6ad458e3100b66c4acaa05f2466.
2018-09-27net: igb: implement SIOCSMIIREG and allow SIOCGMIIREG to set pagesApalis-TK1_LXDE-Image_2.8b4.129-20181005Dominik Sliwa
Before SIOCGMIIREG was only able to access page 0 registers. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27bus_client.c: fix build with gcc8Max Krummenacher
/build/krm/oe-core_master/build/tmp-glibc/work-shared/apalis-tk1/kernel-source/drivers/video/tegra/host/bus_client.c: In function 'nvhost_channelctl': /build/krm/oe-core_master/build/tmp-glibc/work-shared/apalis-tk1/kernel-source/drivers/video/tegra/host/bus_client.c:894:11: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=] "%s_%s", dev_name(&pdata->pdev->dev), name); ^ /build/krm/oe-core_master/build/tmp-glibc/work-shared/apalis-tk1/kernel-source/drivers/video/tegra/host/bus_client.c:893:3: note: 'snprintf' output 2 or more bytes (assuming 33) into a destination of size 32 snprintf(set_name, sizeof(set_name), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "%s_%s", dev_name(&pdata->pdev->dev), name); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: can: k20: change tx complete signalingDominik Sliwa
In fw version 1.2 K20 CANINTF_TX now indicates TX in progress, not TX completed. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: mfd: k20: add fw_ignore and fw_reload parametersDominik Sliwa
Parameter fw_ignore disables fw version check. Parameter fw_reload forces k20 firmware reflash via EzPort. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27i2c: sw-edid: add a driver which simulates edidMax Krummenacher
This adds a driver which simulates a i2c bus with an attached EDID memory. The memory content is read from the device tree. This allows to simulate EDID data which may differ from an attached display. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: lvds: allow setting LVDS drive strength in dtDominik Sliwa
Hardcoded value was used before. This allows setting drive strength values in the devicetree. Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-09-27apalis-tk1: improve pcie reset for reliable gigabit ethernet operationMarcel Ziswiler
While the PCIe reset implementation seems to work it currently resets multiple times due to not differentiating which PCIe port needs resetting. Improve this by doing specific reset per port only. Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Acked-by: Max Krummenacher <max.krummenacher@toradex.com>
2018-06-22media: tegra_camera: stop capturing on errorApalis-TK1_LXDE-Image_2.8b3.111-20180626Gerard Salvatella
Kernel hangs if camera capture errors are not handled to allow for a way out of the the capture thread. Signed-off-by: Gerard Salvatella <gerard.salvatella@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: mfd: k20: cleanup and fw version 1.1 supportDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21apalis-tk1: fix issues when using eDP display-outDominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-06-21Merge tag 'tegra-l4t-r21.7' into toradex_tk1_l4t_r21.7-nextMarcel Ziswiler
Merge NVIDIA's latest Linux for Tegra aka L4T R21.7 Linux kernel changes from git://nv-tegra.nvidia.com/linux-3.10.git commit: e78bb38b883c42edf81766a1d557aed74458e08f Conflicts involved missing 24-bit LVDS support and a single whitespace aka tab difference in drivers/video/tegra/dc/sor.c. Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-04-28host1x: prevent speculative load related leakJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Ifc618c00cee497e6d84cac01a9b73fcecbe8f260 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650036 (cherry picked from commit 164f8684deb5b15a53c60a60c7d9b8e3bf5af5be) Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1682714 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698611 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-28gpu: nvgpu: add speculative load barrier (ctrl IOCTLs)Jeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem insert a speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Ib6c4b2f99b85af3119cce3882fe35ab47509c76f Signed-off-by: Alex Waterman <alexw@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1640500 Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650050 (cherry picked from commit f293fa670fd2f4fbe170f1e372e9aa237283c67a) Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1682715 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1698610 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com>
2018-04-19HID: core: prevent out-of-bound readingsAmulya Y
Plugging a Logitech DJ receiver with KASAN activated raises a bunch of out-of-bound readings. The fields are allocated up to MAX_USAGE, meaning that potentially, we do not have enough fields to fit the incoming values. Add checks and silence KASAN. Bug 1823317 Bug 1935735 Change-Id: Ib3ba92572acbdd4c9ec265e54a45f92606107700 Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Signed-off-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-on: http://git-master/r/1259928 (cherry picked from commit fbc389a39540e177bfa4d49b9214dfe408ef2d4a) Reviewed-on: https://git-master.nvidia.com/r/1690285 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19tty: Prevent ldisc drivers from re-using stale tty fieldsPeter Hurley
Line discipline drivers may mistakenly misuse ldisc-related fields when initializing. For example, a failure to initialize tty->receive_room in the N_GIGASET_M101 line discipline was recently found and fixed [1]. Now, the N_X25 line discipline has been discovered accessing the previous line discipline's already-freed private data [2]. Harden the ldisc interface against misuse by initializing revelant tty fields before instancing the new line discipline. [1] commit fd98e9419d8d622a4de91f76b306af6aa627aa9c Author: Tilman Schmidt <tilman@imap.cc> Date: Tue Jul 14 00:37:13 2015 +0200 isdn/gigaset: reset tty->receive_room when attaching ser_gigaset [2] Report from Sasha Levin <sasha.levin@oracle.com> [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Bug 1823317 Bug 1935735 Change-Id: Ica54faa9334c587594cc19bc9da007340fda672d Cc: Tilman Schmidt <tilman@imap.cc> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259925 (cherry picked from commit 2b1401855a2bdd31556a93feba50dd0dc0bb70e8) Reviewed-on: https://git-master.nvidia.com/r/1690300 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19[media] xc2028: avoid use after freeMauro Carvalho Chehab
If struct xc2028_config is passed without a firmware name, the following trouble may happen: [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner [11009.907491] ================================================================== [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40 [11009.907992] Read of size 1 by task modprobe/28992 [11009.907994] ============================================================================= [11009.907997] BUG kmalloc-16 (Tainted: G W ): kasan: bad access detected [11009.907999] ----------------------------------------------------------------------------- [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992 [11009.908012] ___slab_alloc+0x581/0x5b0 [11009.908014] __slab_alloc+0x51/0x90 [11009.908017] __kmalloc+0x27b/0x350 [11009.908022] xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] [11009.908026] usb_hcd_submit_urb+0x1e8/0x1c60 [11009.908029] usb_submit_urb+0xb0e/0x1200 [11009.908032] usb_serial_generic_write_start+0xb6/0x4c0 [11009.908035] usb_serial_generic_write+0x92/0xc0 [11009.908039] usb_console_write+0x38a/0x560 [11009.908045] call_console_drivers.constprop.14+0x1ee/0x2c0 [11009.908051] console_unlock+0x40d/0x900 [11009.908056] vprintk_emit+0x4b4/0x830 [11009.908061] vprintk_default+0x1f/0x30 [11009.908064] printk+0x99/0xb5 [11009.908067] kasan_report_error+0x10a/0x550 [11009.908070] __asan_report_load1_noabort+0x43/0x50 [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992 [11009.908077] __slab_free+0x2ec/0x460 [11009.908080] kfree+0x266/0x280 [11009.908083] xc2028_set_config+0x90/0x630 [tuner_xc2028] [11009.908086] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908090] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908094] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908098] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908101] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908105] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908108] do_one_initcall+0x141/0x300 [11009.908111] do_init_module+0x1d0/0x5ad [11009.908114] load_module+0x6666/0x9ba0 [11009.908117] SyS_finit_module+0x108/0x130 [11009.908120] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x (null) flags=0x2ffff8000004080 [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001 [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00 ....*....(...... [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff ...........j.... [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G B W 4.5.0-rc1+ #43 [11009.908140] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015 [11009.908142] ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80 [11009.908148] ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280 [11009.908153] ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4 [11009.908158] Call Trace: [11009.908162] [<ffffffff81932007>] dump_stack+0x4b/0x64 [11009.908165] [<ffffffff81556759>] print_trailer+0xf9/0x150 [11009.908168] [<ffffffff8155ccb4>] object_err+0x34/0x40 [11009.908171] [<ffffffff8155f260>] kasan_report_error+0x230/0x550 [11009.908175] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908179] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908182] [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50 [11009.908185] [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0 [11009.908189] [<ffffffff8194cea6>] ? strcmp+0x96/0xb0 [11009.908192] [<ffffffff8194cea6>] strcmp+0x96/0xb0 [11009.908196] [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028] [11009.908200] [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908203] [<ffffffff8155ea78>] ? memset+0x28/0x30 [11009.908206] [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028] [11009.908211] [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908215] [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb] [11009.908219] [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb] [11009.908222] [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x] [11009.908226] [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x] [11009.908230] [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10 [11009.908233] [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80 [11009.908238] [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908242] [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb] [11009.908245] [<ffffffff8195222d>] ? string+0x14d/0x1f0 [11009.908249] [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0 [11009.908253] [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0 [11009.908257] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908260] [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0 [11009.908264] [<ffffffff812e9846>] ? __module_address+0xb6/0x360 [11009.908268] [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0 [11009.908271] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908275] [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290 [11009.908278] [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300 [11009.908282] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908285] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908289] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908292] [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10 [11009.908296] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908299] [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400 [11009.908302] [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300 [11009.908306] [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20 [11009.908309] [<ffffffff8159e708>] ? put_object+0x48/0x70 [11009.908314] [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908317] [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908320] [<ffffffffa0150000>] ? 0xffffffffa0150000 [11009.908324] [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908327] [<ffffffff810021b1>] do_one_initcall+0x141/0x300 [11009.908330] [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 [11009.908333] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908337] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908340] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908343] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908346] [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0 [11009.908350] [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad [11009.908353] [<ffffffff812f2626>] load_module+0x6666/0x9ba0 [11009.908356] [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50 [11009.908361] [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb] [11009.908366] [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20 [11009.908369] [<ffffffff815bc940>] ? open_exec+0x50/0x50 [11009.908374] [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0 [11009.908377] [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130 [11009.908379] [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0 [11009.908383] [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14 [11009.908394] [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908396] Memory state around the buggy address: [11009.908398] ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908401] ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [11009.908405] ^ [11009.908407] ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908409] ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908411] ================================================================== In order to avoid it, let's set the cached value of the firmware name to NULL after freeing it. While here, return an error if the memory allocation fails. Bug 1823317 Bug 1935735 Change-Id: I1825fc7eb08bd458ed5413fea8b47de539c9b23f Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1690296 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19sg: Fix double-free when drives detach during SG_IOCalvin Owens
In sg_common_write(), we free the block request and return -ENODEV if the device is detached in the middle of the SG_IO ioctl(). Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we end up freeing rq->cmd in the already free rq object, and then free the object itself out from under the current user. This ends up corrupting random memory via the list_head on the rq object. The most common crash trace I saw is this: ------------[ cut here ]------------ kernel BUG at block/blk-core.c:1420! Call Trace: [<ffffffff81281eab>] blk_put_request+0x5b/0x80 [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg] [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg] [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70 [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg] [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg] [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520 [<ffffffff81258967>] ? file_has_perm+0x97/0xb0 [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0 [<ffffffff81602afb>] tracesys+0xdd/0xe2 RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0 The solution is straightforward: just set srp->rq to NULL in the failure branch so that sg_finish_rem_req() doesn't attempt to re-free it. Additionally, since sg_rq_end_io() will never be called on the object when this happens, we need to free memory backing ->cmd if it isn't embedded in the object itself. KASAN was extremely helpful in finding the root cause of this bug. Bug 1823317 Bug 1935735 Change-Id: I883243dce583cd79e28facaa2cdd81157b293d74 Signed-off-by: Calvin Owens <calvinowens@fb.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259958 (cherry picked from commit b49da4529988ca02bddaed8091a7f5e91105970a) Reviewed-on: https://git-master.nvidia.com/r/1690295 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-19staging: ion: Fix ION subsystem privilege vulnerabilityGagan Grover
A malicious application can take advantage of the ION kmalloc heap to create a specific memory chunk size to exercise a rowhammer attack on the physical hardware. The fix is designed to disable ION heap type. CVE-2016-6728: A-30400942 Bug 1823317 Change-Id: I6b6d891a85da0c175f88cc1a3e48875796db80d4 Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1690291 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
2018-04-03v4l2: prevent speculative loadJeetesh Burman
bug 2039126 Change-Id: Id1908c3058c9ecc0dfb4f2d85440a8d36db45db5 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650029 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 7a0213eca150614fe88d197a09d461fff6168652) Reviewed-on: https://git-master.nvidia.com/r/1660781 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-04-03cryptodev: prevent speculative load related leakJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Id85eb9c91932f358dd999b28dd53d7788b37ea04 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1640356 Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650014 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 25bd9436b11f41e23048c9515deae97900a46669) Reviewed-on: https://git-master.nvidia.com/r/1660780 Reviewed-by: Winnie Hsu <whsu@nvidia.com> Tested-by: Winnie Hsu <whsu@nvidia.com>
2018-04-03drivers: speculative load before bound-checkJeetesh Burman
Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. Bug 1964290 CVE-2017-5753 Change-Id: I7382dbcc6e9f352fafd457301beafe753925f3c4 Signed-off-by: Hien Goi <hgoi@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650791 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 5cabd53985a30aa818896abdb64564a74c09ab9c) Reviewed-on: https://git-master.nvidia.com/r/1660772 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
2018-03-28apalis-tk1: handle backlight in the device treeApalis-TK1_LXDE-Image_2.8b2.97-20180331toradex_tk1_l4t_r21.6Dominik Sliwa
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
2018-03-28pwm-backlight: Disable backlight on shutdownThierry Reding
When a device is shut down, make sure to disable the backlight. If it stays lit, it gives the impression that the device hasn't turned off. Furthermore keeping the backlight on may consume power, which is not what users expect when they shut down a device. Tested-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 5f33b896246a2d9bdf01352de11d4dab96ba2fc9)
2018-03-28backlight: pwm_bl: Remove error message upon devm_kzalloc() failureFabio Estevam
No need to have a specific OOM message, since there is generic MM out of memory message in place. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com> (cherry picked from commit ca7a97add4d4a7b0602b3bd1eff5c89da8636713)
2018-03-28pwm-backlight: Remove unused variableThierry Reding
I forgot to remove this during earlier cleanup patches and only checked various builds for errors, not warnings. Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com> (cherry picked from commit 73d4e2b82b4bb1571b1a7f97012c0db8a0faef42)
2018-03-28pwm_backlight: avoid short blank screen while doing hibernationHuayi Li
Use SIMPLE_DEV_PM_OPS macro will initialize the member "freeze" and "thaw" of pwm_backlight_pm_ops as below, .freeze = suspend_fn, .thaw = resume_fn, then during the process of making hibernation snapshot, screen will be blank at the moment of freezing, and then light at the moment of thawing. this is not the right user experience for suspending to disk. so this patch drops freeze and thaw callback, make the LCD is always lighting before the final shutdown. Signed-off-by: Huayi Li <huayi.li@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Thierry Reding <thierry.reding@gmail.com> (cherry picked from commit 1dea1fd09246ada581a99d0669108eea94b7bfee)
2018-03-28pwm-backlight: Fix brightness adjustmentThierry Reding
Split adjustment of the brightness (by changing the PWM duty cycle) from the power on sequence. This fixes an issue where the brightness can no longer be updated once the backlight has been enabled. Reported-by: Marc Dietrich <marvin24@gmx.de> Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit e4bfeda96872bfe6015cd360008b77cd3b981b2b)
2018-03-28pwm-backlight: Allow for non-increasing brightness levelsMike Dunn
Currently the driver assumes that the values specified in the brightness-levels device tree property increase as they are parsed from left to right. But boards that invert the signal between the PWM output and the backlight will need to specify decreasing brightness-levels. This patch removes the assumption that the last element of the array is the maximum value, and instead searches the array for the maximum value and uses that in the duty cycle calculation. Signed-off-by: Mike Dunn <mikedunn@newsguy.com> Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 8f43e18e2769b3b28383903d501b4da29e388aad)
2018-03-28pwm-backlight: Add power supply supportThierry Reding
Backlights require a power supply to work properly. This commit adds a regulator to power up and power down the backlight. Signed-off-by: Thierry Reding <treding@nvidia.com> (cherry picked from commit 22ceeee16eb8f0d04de3ef43a5174fb30ec18af9)
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-14 14:23:55 +0000