Since the dma_buf_dentry_ops ops are set on the dma-buf dentry, in
alloc_file_pseudo, and this is before the dma-buf is assigned to
dentry->d_fsdata, in dma_buf_getfile, it is possible for the
dma_buf_dentry_ops functions to be called with dentry->d_fsdata == NULL.
For example:
BUG: KASAN: null-ptr-deref in dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
Call trace:
dump_backtrace+0x0/0x2c8 arch/arm64/kernel/time.c:50
show_stack+0x20/0x2c arch/arm64/kernel/traps.c:140
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x154/0x1f4 lib/dump_stack.c:118
__kasan_report+0x1ac/0x218 mm/kasan/report.c:510
kasan_report+0x10/0x18 mm/kasan/common.c:634
check_memory_region_inline mm/kasan/generic.c:181 [inline]
__asan_load4+0x90/0x98 mm/kasan/generic.c:250
dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
__dentry_kill+0x294/0x31c fs/dcache.c:584
dentry_kill fs/dcache.c:673 [inline]
dput+0x250/0x380 fs/dcache.c:859
path_put+0x24/0x40 fs/namei.c:485
alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235
dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585
ion_dmabuf_alloc+0x168/0x1d4 drivers/staging/android/ion/ion_dma_buf.c:394
ion_alloc_fd drivers/staging/android/ion/ion.c:54 [inline]
ion_ioctl+0x24c/0x5c8 drivers/staging/android/ion/ion.c:194
vfs_ioctl fs/ioctl.c:47 [inline]
do_vfs_ioctl+0x55c/0xcb4 fs/ioctl.c:699
ksys_ioctl fs/ioctl.c:714 [inline]
__do_sys_ioctl fs/ioctl.c:721 [inline]
__se_sys_ioctl fs/ioctl.c:719 [inline]
__arm64_sys_ioctl+0xa0/0xe4 fs/ioctl.c:719
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common+0x130/0x294 arch/arm64/kernel/syscall.c:117
el0_svc_handler+0xdc/0xec arch/arm64/kernel/syscall.c:163
el0_svc+0x8/0xc arch/arm64/kernel/entry.S:1031
Ideally we would change the dma-buf code to ensure that the
dma_buf_dentry_ops ops are set on the dma-buf dentry after the dentry's
d_fsdata has been set, however there does not appear to be a clean way to
do this.
For example if the dma_buf_fs_type was changed so that it's dops weren't
configured the alloc_file_pseudo function would still assign the anon_ops
to the dma-buf dentry, and if we then tried to configure the dma-buf
dentry's dentry_operations later on, using d_set_d_op, the function would
WARN since the dma-buf's dentry already has its dentry_operations
configured.
So instead change the dma_buf_dentry_ops functions to handle the case
where the dma-buf dentry's d_fsdata may be NULL.
Change-Id: Idb1ef749c623b17fb8b7ce90f0c472a5ba298297
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Enable CONFIG_QCOM_INITIAL_LOGBUF for Holi. This enables
copying of dmesg logs into separate buffer at 100 sec from
bootup.
Change-Id: I36b7addc6060fc6cea03cc2cf006d454c9a1a6d6
Signed-off-by: Ashish Bhimanpalliwar <abhiman@codeaurora.org>
Below race can come, if trace_open and resize of
cpu buffer is running parallely on different cpus
CPUX CPUY
ring_buffer_resize
atomic_read(&buffer->resize_disabled)
tracing_open
tracing_reset_online_cpus
ring_buffer_reset_cpu
rb_reset_cpu
rb_update_pages
remove/insert pages
resetting pointer
This race can cause data abort or some times infine loop in rb_remove_pages
and rb_insert_pages while checking pages for sanity.
Take ring buffer lock in rb reset to avoid resetting of cpu buffer.
Change-Id: I1d3344cca99e936d4e04a0e430e0ef9a975404c8
Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>
This change is for general scheduler improvement.
Change-Id: I7a9b4008cdf7082f8ce3645bf5459b4afff1ff8a
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
To support LTE peak data rates of 150MBPS Uplink for DUN+SoftAP usecases
Change-Id: I947b6338661cab3d3346d280b3ec4ccbac6b2f94
Signed-off-by: Paras Singh Jain <parassin@codeaurora.org>
When ECM is enabled, disable ECM if display goes blank, and reenable
ECM once display restores to unblank. This helps in keeping ECM HW
enabled only when display is active.
Meanwhile, update the logic a little bit on calculating the average
current. When any of the accumulated values is invalid, just ignore
the calculation instead of disabling the ECM.
Change-Id: Ibfe973df4dabd1b1cd48927ce567a094da6382a3
Signed-off-by: Fenglin Wu <fenglinw@codeaurora.org>
epfile's ep pointer may be NULL during adb transfer
and composition switch happening in parallel. As part
of composition switch, first it is set to NONE. Setting
sys.usb.config to NONE stops adb and disables the composition.
stop adb is not blocking call and adb still might be doing
epfile read/write for some time when function unbind is
ongoing making the data structures NULL.
To fix this crash, call usb_ep_dequeue only if ep->ep is
valid. Similarly in success case, return ep->status only
if ep->ep is valid otherwise return -ENODEV.
Change-Id: Ic152fc1db31cad6f97b8d16d91350dad857a4bf9
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Glink irq for all the remote edges are registered with same name
glink-native. It is difficult to distinguish each irq in logs.
Appending remote edge name to generic irq name.
Change-Id: I6ead87e0e4adae204535b599d07d9471387c861b
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
Add support to use parent_map structure for mux clk parent.
Change-Id: I3f3655387bd8a7a3046a801ece921576d4e69e4b
Signed-off-by: Naveen Yadav <naveenky@codeaurora.org>
There could be instances where the RCG configuration update or readback
could fail. Notify the caller of the failure. Add support to change
scope of mux_div_get_src_div() in order to use it globally.
Change-Id: Ica07c28cede695785db81697effcb40ab6b717d4
Signed-off-by: Amit Nischal <anischal@codeaurora.org>
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Signed-off-by: Naveen Yadav <naveenky@codeaurora.org>
