Sean Young
eff2ccdfd2
media: imon: invalid dereference in imon_touch_event
commit f3f5ba42c58d56d50f539854d8cc188944e96087 upstream.
The touch timer is set up in intf1. If the second interface does not exist,
the timer and touch input device are not setup and we get the following
error, when touch events are reported via intf0.
kernel BUG at kernel/time/timer.c:956!
invalid opcode: 0000 [#1] SMP KASAN
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc1+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__mod_timer kernel/time/timer.c:956 [inline]
RIP: 0010:__mod_timer kernel/time/timer.c:949 [inline]
RIP: 0010:mod_timer+0x5a2/0xb50 kernel/time/timer.c:1100
Code: 45 10 c7 44 24 14 ff ff ff ff 48 89 44 24 08 48 8d 45 20 48 c7 44 24 18 00 00 00 00 48 89 04 24 e9 5a fc ff ff e8 ae ce 0e 00 <0f> 0b e8 a7 ce 0e 00 4c 89 74 24 20 e9 37 fe ff ff e8 98 ce 0e 00
RSP: 0018:ffff8881db209930 EFLAGS: 00010006
RAX: ffffffff86c2b200 RBX: 00000000ffffa688 RCX: ffffffff83efc583
RDX: 0000000000000100 RSI: ffffffff812f4d82 RDI: ffff8881d2356200
RBP: ffff8881d23561e8 R08: ffffffff86c2b200 R09: ffffed103a46abeb
R10: ffffed103a46abea R11: ffff8881d2355f53 R12: dffffc0000000000
R13: 1ffff1103b64132d R14: ffff8881d2355f50 R15: 0000000000000006
FS: 0000000000000000(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f75e2799000 CR3: 00000001d3b07000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
imon_touch_event drivers/media/rc/imon.c:1348 [inline]
imon_incoming_packet.isra.0+0x2546/0x2f10 drivers/media/rc/imon.c:1603
usb_rx_callback_intf0+0x151/0x1e0 drivers/media/rc/imon.c:1734
__usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1654
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1719
dummy_timer+0x120f/0x2fa2 drivers/usb/gadget/udc/dummy_hcd.c:1965
call_timer_fn+0x179/0x650 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x5e3/0x1490 kernel/time/timer.c:1786
__do_softirq+0x221/0x912 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x178/0x1a0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x12f/0x500 arch/x86/kernel/apic/apic.c:1137
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
RIP: 0010:default_idle+0x28/0x2e0 arch/x86/kernel/process.c:581
Code: 90 90 41 56 41 55 65 44 8b 2d 44 3a 8f 7a 41 54 55 53 0f 1f 44 00 00 e8 36 ee d0 fb e9 07 00 00 00 0f 00 2d fa dd 4f 00 fb f4 <65> 44 8b 2d 20 3a 8f 7a 0f 1f 44 00 00 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffffff86c07da8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000007 RBX: ffffffff86c2b200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffffff86c2ba4c
RBP: fffffbfff0d85640 R08: ffffffff86c2b200 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
cpuidle_idle_call kernel/sched/idle.c:154 [inline]
do_idle+0x3b6/0x500 kernel/sched/idle.c:263
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:355
start_kernel+0x82a/0x864 init/main.c:784
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
Modules linked in:
Reported-by: syzbot+f49d12d34f2321cf4df2@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2019-11-29 10:10:17 +01:00 |
| .. |
|
accessibility
|
|
|
|
acpi
|
Power management fix for 5.4-rc6
|
2019-11-01 09:30:48 -07:00 |
|
amba
|
ARM updates for 5.4-rc:
|
2019-10-23 06:26:33 -04:00 |
|
android
|
binder: Don't modify VMA bounds in ->mmap handler
|
2019-10-17 05:58:44 -07:00 |
|
ata
|
ata: libahci_platform: Fix regulator_get_optional() misuse
|
2019-10-25 14:22:20 -06:00 |
|
atm
|
atm: he: clean up an indentation issue
|
2019-09-25 13:54:45 +02:00 |
|
auxdisplay
|
It's a somewhat calmer cycle for docs this time, as the churn of the mass
|
2019-09-17 16:22:26 -07:00 |
|
base
|
mm/memory_hotplug: fix try_offline_node()
|
2019-11-15 18:34:00 -08:00 |
|
bcma
|
bcma: make arrays pwr_info_offset and sprom_sizes static const, shrinks object size
|
2019-09-13 16:44:49 +03:00 |
|
block
|
nbd: prevent memory leak
|
2019-11-29 10:09:47 +01:00 |
|
bluetooth
|
Revert "Bluetooth: hci_ll: set operational frequency earlier"
|
2019-11-29 10:09:43 +01:00 |
|
bus
|
bus: ti-sysc: Fix watchdog quirk handling
|
2019-10-18 08:45:32 -07:00 |
|
cdrom
|
|
|
|
char
|
virtio_console: allocate inbufs in add_port() only if it is needed
|
2019-11-19 05:13:49 -05:00 |
|
clk
|
Fixes for various clk driver issues that happened because of code we
|
2019-11-08 08:15:01 -08:00 |
|
clocksource
|
- Fix scary messages in sh_mtu2 by using platform_irq_count() helper
|
2019-11-04 18:43:23 +01:00 |
|
connector
|
|
|
|
counter
|
|
|
|
cpufreq
|
cpufreq: Add NULL checks to show() and store() methods of cpufreq
|
2019-11-29 10:10:07 +01:00 |
|
cpuidle
|
cpuidle: haltpoll: Take 'idle=' override into account
|
2019-10-22 11:43:17 +02:00 |
|
crypto
|
inet: stop leaking jiffies on the wire
|
2019-11-01 14:57:52 -07:00 |
|
dax
|
|
|
|
dca
|
|
|
|
devfreq
|
|
|
|
dio
|
|
|
|
dma
|
dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle
|
2019-10-23 21:15:21 +05:30 |
|
dma-buf
|
dma-buf/resv: fix exclusive fence get
|
2019-10-10 17:05:20 +02:00 |
|
edac
|
EDAC/ghes: Fix Use after free in ghes_edac remove path
|
2019-10-17 11:27:05 +02:00 |
|
eisa
|
|
|
|
extcon
|
chrome platform changes for v5.4
|
2019-09-19 14:14:28 -07:00 |
|
firewire
|
|
|
|
firmware
|
efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
|
2019-10-31 09:40:21 +01:00 |
|
fpga
|
Char/Misc driver patches for 5.4-rc1
|
2019-09-18 11:14:31 -07:00 |
|
fsi
|
|
|
|
gnss
|
|
|
|
gpio
|
gpio fixes for v5.4-rc8
|
2019-11-13 22:58:01 +01:00 |
|
gpu
|
- Fix kernel oops on dumb_create ioctl on no crtc situation
|
2019-11-22 10:29:52 +10:00 |
|
greybus
|
|
|
|
hid
|
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
|
2019-11-07 11:54:54 -08:00 |
|
hsi
|
HSI changes for the 5.4 series
|
2019-09-22 12:02:21 -07:00 |
|
hv
|
Drivers: hv: vmbus: Fix harmless building warnings without CONFIG_PM_SLEEP
|
2019-10-01 14:49:45 -04:00 |
|
hwmon
|
hwmon: (ina3221) Fix read timeout issue
|
2019-10-28 18:46:55 -07:00 |
|
hwspinlock
|
|
|
|
hwtracing
|
intel_th: pci: Add Jasper Lake PCH support
|
2019-11-04 15:01:25 +01:00 |
|
i2c
|
i2c: core: fix use after free in of_i2c_notify
|
2019-11-15 22:01:13 +01:00 |
|
i3c
|
|
|
|
ide
|
|
|
|
idle
|
|
|
|
iio
|
iio: adc: stm32-adc: fix stopping dma
|
2019-10-27 15:57:19 +00:00 |
|
infiniband
|
RDMA/hns: Correct the value of srq_desc_size
|
2019-11-06 13:37:02 -04:00 |
|
input
|
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
|
2019-11-22 16:57:26 -08:00 |
|
interconnect
|
interconnect: Add locking in icc_set_tag()
|
2019-10-20 12:14:41 +03:00 |
|
iommu
|
iommu/vt-d: Fix panic after kexec -p for kdump
|
2019-10-30 10:30:22 +01:00 |
|
ipack
|
|
|
|
irqchip
|
irqchip updates for 5.4, take 2
|
2019-10-25 14:25:15 +02:00 |
|
isdn
|
net: use skb_queue_empty_lockless() in poll() handlers
|
2019-10-28 13:33:41 -07:00 |
|
leds
|
leds: lm3532: Fix optional led-max-microamp prop error handling
|
2019-09-12 20:45:52 +02:00 |
|
lightnvm
|
|
|
|
macintosh
|
cpufreq: Use per-policy frequency QoS
|
2019-10-21 02:05:21 +02:00 |
|
mailbox
|
mailbox: qcom-apcs: fix max_register value
|
2019-09-17 00:54:29 -05:00 |
|
mcb
|
|
|
|
md
|
md/raid10: prevent access of uninitialized resync_pages offset
|
2019-11-29 10:09:45 +01:00 |
|
media
|
media: imon: invalid dereference in imon_touch_event
|
2019-11-29 10:10:17 +01:00 |
|
memory
|
|
|
|
memstick
|
memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
|
2019-10-09 11:08:03 +02:00 |
|
message
|
|
|
|
mfd
|
mfd: mt6397: Fix probe after changing mt6397-core
|
2019-10-24 08:49:25 +01:00 |
|
misc
|
misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach
|
2019-10-04 18:22:14 +02:00 |
|
mmc
|
mmc: sdhci-of-at91: fix quirk2 overwrite
|
2019-11-14 14:57:53 +01:00 |
|
mtd
|
mtd: rawnand: au1550nd: Fix au_read_buf16() prototype
|
2019-10-07 09:56:36 +02:00 |
|
mux
|
|
|
|
net
|
ath10k: restore QCA9880-AR1A (v1) detection
|
2019-11-29 10:09:42 +01:00 |
|
nfc
|
nfc: port100: handle command failure cleanly
|
2019-11-21 11:48:17 -08:00 |
|
ntb
|
NTB: fix IDT Kconfig typos/spellos
|
2019-09-23 17:20:40 -04:00 |
|
nubus
|
|
|
|
nvdimm
|
libnvdimm fixes v5.4-rc1
|
2019-09-29 10:33:41 -07:00 |
|
nvme
|
for-linus-2019-11-08
|
2019-11-08 18:15:55 -08:00 |
|
nvmem
|
Char/Misc driver patches for 5.4-rc1
|
2019-09-18 11:14:31 -07:00 |
|
of
|
of: reserved_mem: add missing of_node_put() for proper ref-counting
|
2019-10-23 15:15:05 -05:00 |
|
opp
|
opp: Reinitialize the list_kref before adding the static OPPs again
|
2019-10-23 10:58:44 +05:30 |
|
oprofile
|
|
|
|
parisc
|
parisc: Remove 32-bit DMA enforcement from sba_iommu
|
2019-10-14 21:44:26 +02:00 |
|
parport
|
Char/Misc driver patches for 5.4-rc1
|
2019-09-18 11:14:31 -07:00 |
|
pci
|
PCI: PM: Fix pci_power_up()
|
2019-10-15 23:51:36 +02:00 |
|
pcmcia
|
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
|
2019-09-28 08:14:15 -07:00 |
|
perf
|
|
|
|
phy
|
pci-v5.4-changes
|
2019-09-23 19:16:01 -07:00 |
|
pinctrl
|
pinctrl: stmfx: fix valid_mask init sequence
|
2019-11-07 10:06:46 +01:00 |
|
platform
|
platform/x86: i2c-multi-instantiate: Fail the probe if no IRQ provided
|
2019-10-14 15:31:50 +03:00 |
|
pnp
|
|
|
|
power
|
power supply and reset changes for the v5.4 series
|
2019-09-22 12:04:59 -07:00 |
|
powercap
|
Power management updates for 5.4-rc1
|
2019-09-17 19:15:14 -07:00 |
|
pps
|
|
|
|
ps3
|
|
|
|
ptp
|
ptp: Introduce strict checking of external time stamp options.
|
2019-11-15 12:48:32 -08:00 |
|
pwm
|
pwm: bcm-iproc: Prevent unloading the driver module while in use
|
2019-11-08 18:38:06 +01:00 |
|
rapidio
|
|
|
|
ras
|
|
|
|
regulator
|
regulator: Fixes for v5.4
|
2019-10-23 15:31:17 -04:00 |
|
remoteproc
|
remoteproc updates for v5.4
|
2019-09-22 10:55:08 -07:00 |
|
reset
|
reset: fix of_reset_control_get_count kerneldoc comment
|
2019-10-24 10:26:33 +02:00 |
|
rpmsg
|
rpmsg: glink-smem: Name the edge based on parent remoteproc
|
2019-09-17 15:33:31 -07:00 |
|
rtc
|
RTC for 5.4
|
2019-09-22 11:05:43 -07:00 |
|
s390
|
s390/qeth: return proper errno on IO error
|
2019-11-20 12:29:47 -08:00 |
|
sbus
|
|
|
|
scsi
|
SCSI fixes on 20191111
|
2019-11-11 09:14:36 -08:00 |
|
sfi
|
|
|
|
sh
|
|
|
|
siox
|
|
|
|
slimbus
|
|
|
|
soc
|
soc: imx: gpc: fix initialiser format
|
2019-10-26 19:47:31 +08:00 |
|
soundwire
|
soundwire: slave: fix scanf format
|
2019-10-24 16:55:45 +05:30 |
|
spi
|
LED updates for 5.4-rc1
|
2019-09-17 18:40:42 -07:00 |
|
spmi
|
|
|
|
ssb
|
ssb: make array pwr_info_offset static const, makes object smaller
|
2019-09-13 17:23:18 +03:00 |
|
staging
|
Remove VirtualBox guest shared folders filesystem
|
2019-11-12 15:22:24 -08:00 |
|
target
|
SCSI fixes on 20191101
|
2019-11-02 11:15:52 -07:00 |
|
tc
|
|
|
|
tee
|
tee/shm: untag user pointers in tee_shm_register
|
2019-09-25 17:51:41 -07:00 |
|
thermal
|
cpufreq: Use per-policy frequency QoS
|
2019-10-21 02:05:21 +02:00 |
|
thunderbolt
|
thunderbolt: Drop unnecessary read when writing LC command in Ice Lake
|
2019-10-08 12:08:21 +03:00 |
|
tty
|
8250-men-mcb: fix error checking when get_num_ports returns -ENODEV
|
2019-10-15 21:38:41 +02:00 |
|
uio
|
Char/Misc driver patches for 5.4-rc1
|
2019-09-18 11:14:31 -07:00 |
|
usb
|
usb: dwc3: gadget: fix race when disabling ep with cancelled xfers
|
2019-10-31 18:57:54 +01:00 |
|
vfio
|
vfio/type1: Initialize resv_msi_base
|
2019-10-15 14:07:01 -06:00 |
|
vhost
|
vringh: fix copy direction of vringh_iov_push_kern()
|
2019-10-28 04:25:04 -04:00 |
|
video
|
- Some new documentation for GEM shmem madvise helpers
|
2019-11-08 12:12:57 +10:00 |
|
virt
|
virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
|
2019-10-10 14:50:32 +02:00 |
|
virtio
|
virtio_balloon: fix shrinker count
|
2019-11-20 02:15:57 -05:00 |
|
visorbus
|
|
|
|
vlynq
|
|
|
|
vme
|
|
|
|
w1
|
w1: ds250x: Fix build error without CRC16
|
2019-10-10 15:35:41 +02:00 |
|
watchdog
|
watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading
|
2019-11-05 16:58:12 +01:00 |
|
xen
|
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
|
2019-10-19 17:09:11 -04:00 |
|
zorro
|
|
|
|
Kconfig
|
Staging/IIO driver patches for 5.4-rc1
|
2019-09-18 11:05:34 -07:00 |
|
Makefile
|
Staging/IIO driver patches for 5.4-rc1
|
2019-09-18 11:05:34 -07:00 |