From: Greg Kroah-Hartman Date: Sat, 7 Dec 2019 12:24:14 +0000 (+0100) Subject: drop queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch X-Git-Tag: v5.4.3~67 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cf15e0ce2a8ac3183018783b9fd9df292d6cc2c9;p=thirdparty%2Fkernel%2Fstable-queue.git drop queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch --- diff --git a/queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch b/queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch deleted file mode 100644 index 3cd32fb6adc..00000000000 --- a/queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 0aecc2dd80345b10cd6ab210a77b3ecc83ca4bdc Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Nov 2018 05:40:54 -0500 -Subject: media: coda: fix memory corruption in case more than 32 instances are - opened - -From: Philipp Zabel - -[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ] - -The ffz() return value is undefined if the instance mask does not -contain any zeros. If it returned 32, the following set_bit would -corrupt the debugfs_root pointer. -Switch to IDA for context index allocation. This also removes the -artificial 32 instance limit for all except CodaDx6. - -Signed-off-by: Philipp Zabel -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/coda/coda-common.c | 26 +++++++++-------------- - drivers/media/platform/coda/coda.h | 3 ++- - 2 files changed, 12 insertions(+), 17 deletions(-) - -diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c -index 323aad3c89de6..154aa7d73a8d2 100644 ---- a/drivers/media/platform/coda/coda-common.c -+++ b/drivers/media/platform/coda/coda-common.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1644,17 +1645,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq, - return coda_queue_init(priv, dst_vq); - } - --static int coda_next_free_instance(struct coda_dev *dev) --{ -- int idx = ffz(dev->instance_mask); -- -- if ((idx < 0) || -- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES)) -- return -EBUSY; -- -- return idx; --} -- - /* - * File operations - */ -@@ -1663,7 +1653,8 @@ static int coda_open(struct file *file) - { - struct video_device *vdev = video_devdata(file); - struct coda_dev *dev = video_get_drvdata(vdev); -- struct coda_ctx *ctx = NULL; -+ struct coda_ctx *ctx; -+ unsigned int max = ~0; - char *name; - int ret; - int idx; -@@ -1672,12 +1663,13 @@ static int coda_open(struct file *file) - if (!ctx) - return -ENOMEM; - -- idx = coda_next_free_instance(dev); -+ if (dev->devtype->product == CODA_DX6) -+ max = CODADX6_MAX_INSTANCES - 1; -+ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL); - if (idx < 0) { - ret = idx; - goto err_coda_max; - } -- set_bit(idx, &dev->instance_mask); - - name = kasprintf(GFP_KERNEL, "context%d", idx); - if (!name) { -@@ -1771,8 +1763,8 @@ err_clk_per: - err_pm_get: - v4l2_fh_del(&ctx->fh); - v4l2_fh_exit(&ctx->fh); -- clear_bit(ctx->idx, &dev->instance_mask); - err_coda_name_init: -+ ida_free(&dev->ida, ctx->idx); - err_coda_max: - kfree(ctx); - return ret; -@@ -1811,7 +1803,7 @@ static int coda_release(struct file *file) - pm_runtime_put_sync(&dev->plat_dev->dev); - v4l2_fh_del(&ctx->fh); - v4l2_fh_exit(&ctx->fh); -- clear_bit(ctx->idx, &dev->instance_mask); -+ ida_free(&dev->ida, ctx->idx); - if (ctx->ops->release) - ctx->ops->release(ctx); - debugfs_remove_recursive(ctx->debugfs_entry); -@@ -2192,6 +2184,7 @@ static int coda_probe(struct platform_device *pdev) - - mutex_init(&dev->dev_mutex); - mutex_init(&dev->coda_mutex); -+ ida_init(&dev->ida); - - dev->debugfs_root = debugfs_create_dir("coda", NULL); - if (!dev->debugfs_root) -@@ -2276,6 +2269,7 @@ static int coda_remove(struct platform_device *pdev) - coda_free_aux_buf(dev, &dev->tempbuf); - coda_free_aux_buf(dev, &dev->workbuf); - debugfs_remove_recursive(dev->debugfs_root); -+ ida_destroy(&dev->ida); - return 0; - } - -diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h -index 96532b06bd9e1..239f6bb2fca42 100644 ---- a/drivers/media/platform/coda/coda.h -+++ b/drivers/media/platform/coda/coda.h -@@ -16,6 +16,7 @@ - #define __CODA_H__ - - #include -+#include - #include - #include - #include -@@ -93,7 +94,7 @@ struct coda_dev { - struct v4l2_m2m_dev *m2m_dev; - struct vb2_alloc_ctx *alloc_ctx; - struct list_head instances; -- unsigned long instance_mask; -+ struct ida ida; - struct dentry *debugfs_root; - }; - --- -2.20.1 - diff --git a/queue-4.4/series b/queue-4.4/series index 337c0395c6f..27f2f03c66c 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -27,7 +27,6 @@ math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch rtc-max8997-fix-the-returned-value-in-case-of-error-.patch rtc-dt-binding-abx80x-fix-resistance-scale.patch arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch -media-coda-fix-memory-corruption-in-case-more-than-3.patch dmaengine-coh901318-fix-a-double-lock-bug.patch dmaengine-coh901318-remove-unused-variable.patch acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch