From 9175ee1a99d57ec07d66ff572e1d5a724477ab37 Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Tue, 29 Nov 2022 10:36:01 -0600 Subject: firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called to destroy the memory pool that created by svc_create_memory_pool(). Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") Signed-off-by: Yang Yingliang Signed-off-by: Dinh Nguyen Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/stratix10-svc.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'drivers/firmware') diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index b4081f4d88a3..1a5640b3ab42 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -1138,13 +1138,17 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) /* allocate service controller and supporting channel */ controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); - if (!controller) - return -ENOMEM; + if (!controller) { + ret = -ENOMEM; + goto err_destroy_pool; + } chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL, sizeof(*chans), GFP_KERNEL | __GFP_ZERO); - if (!chans) - return -ENOMEM; + if (!chans) { + ret = -ENOMEM; + goto err_destroy_pool; + } controller->dev = dev; controller->num_chans = SVC_NUM_CHANNEL; @@ -1159,7 +1163,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL); if (ret) { dev_err(dev, "failed to allocate FIFO\n"); - return ret; + goto err_destroy_pool; } spin_lock_init(&controller->svc_fifo_lock); @@ -1221,6 +1225,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) err_free_kfifo: kfifo_free(&controller->svc_fifo); +err_destroy_pool: + gen_pool_destroy(genpool); return ret; } -- cgit v1.2.3 From d66a4c20ae55ac88136b4a3befd944c093ffa677 Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Tue, 29 Nov 2022 10:36:02 -0600 Subject: firmware: stratix10-svc: fix error handle while alloc/add device failed If add device "stratix10-rsu" failed in stratix10_svc_drv_probe(), the 'svc_fifo' and 'genpool' need be freed in the error path. If allocate or add device "intel-fcs" failed in stratix10_svc_drv_probe(), the device "stratix10-rsu" need be unregistered in the error path. Fixes: e6281c26674e ("firmware: stratix10-svc: Add support for FCS") Signed-off-by: Yang Yingliang Signed-off-by: Dinh Nguyen Link: https://lore.kernel.org/r/20221129163602.462369-2-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/stratix10-svc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'drivers/firmware') diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index 1a5640b3ab42..bde1f543f529 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -1202,19 +1202,20 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) ret = platform_device_add(svc->stratix10_svc_rsu); if (ret) { platform_device_put(svc->stratix10_svc_rsu); - return ret; + goto err_free_kfifo; } svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1); if (!svc->intel_svc_fcs) { dev_err(dev, "failed to allocate %s device\n", INTEL_FCS); - return -ENOMEM; + ret = -ENOMEM; + goto err_unregister_dev; } ret = platform_device_add(svc->intel_svc_fcs); if (ret) { platform_device_put(svc->intel_svc_fcs); - return ret; + goto err_unregister_dev; } dev_set_drvdata(dev, svc); @@ -1223,6 +1224,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) return 0; +err_unregister_dev: + platform_device_unregister(svc->stratix10_svc_rsu); err_free_kfifo: kfifo_free(&controller->svc_fifo); err_destroy_pool: -- cgit v1.2.3 From 7d12970f1746d47155f97113ac48b81fd8af8640 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Tue, 29 Nov 2022 22:38:55 +0000 Subject: firmware: dmi-sysfs: make pr_info messages rate limited Currently if a process repeat repeatedly reads the dmi sysfs raw event log /sys/firmware/dmi/entries/15-0/system_event_log/raw_event_log when GPNV support is missing or using an unknown access method the kernel log gets spammed with info messages. Make the messages rate limited to reduce the message spamming. Triggered when running sudo stress-ng --sysfs -t 5m. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20221129223855.1005674-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/dmi-sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/firmware') diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c index 66727ad3361b..9b6ce172175c 100644 --- a/drivers/firmware/dmi-sysfs.c +++ b/drivers/firmware/dmi-sysfs.c @@ -418,10 +418,10 @@ static ssize_t dmi_sel_raw_read_helper(struct dmi_sysfs_entry *entry, return dmi_sel_raw_read_phys32(entry, &sel, state->buf, state->pos, state->count); case DMI_SEL_ACCESS_METHOD_GPNV: - pr_info("dmi-sysfs: GPNV support missing.\n"); + pr_info_ratelimited("dmi-sysfs: GPNV support missing.\n"); return -EIO; default: - pr_info("dmi-sysfs: Unknown access method %02x\n", + pr_info_ratelimited("dmi-sysfs: Unknown access method %02x\n", sel.access_method); return -EIO; } -- cgit v1.2.3 From 18e126e97c961f7a93823795c879d7c085fe5098 Mon Sep 17 00:00:00 2001 From: Chen Zhongjin Date: Fri, 11 Nov 2022 09:53:26 +0800 Subject: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this. Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") Signed-off-by: Chen Zhongjin Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers/firmware') diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c index 9b6ce172175c..ed5aff0a4204 100644 --- a/drivers/firmware/dmi-sysfs.c +++ b/drivers/firmware/dmi-sysfs.c @@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, "%d-%d", dh->type, entry->instance); - if (*ret) { - kobject_put(&entry->kobj); - return; - } - /* Thread on the global list for cleanup */ spin_lock(&entry_list_lock); list_add_tail(&entry->list, &entry_list); spin_unlock(&entry_list_lock); + if (*ret) { + kobject_put(&entry->kobj); + return; + } + /* Handle specializations by type */ switch (dh->type) { case DMI_ENTRY_SYSTEM_EVENT_LOG: -- cgit v1.2.3 From e6acaf25cba14661211bb72181c35dd13b24f5b3 Mon Sep 17 00:00:00 2001 From: Alper Nebi Yasak Date: Sun, 22 Jan 2023 22:04:31 +0300 Subject: firmware: coreboot: framebuffer: Ignore reserved pixel color bits The coreboot framebuffer doesn't support transparency, its 'reserved' bit field is merely padding for byte/word alignment of pixel colors [1]. When trying to match the framebuffer to a simplefb format, the kernel driver unnecessarily requires the format's transparency bit field to exactly match this padding, even if the former is zero-width. Due to a coreboot bug [2] (fixed upstream), some boards misreport the reserved field's size as equal to its position (0x18 for both on a 'Lick' Chromebook), and the driver fails to probe where it would have otherwise worked fine with e.g. the a8r8g8b8 or x8r8g8b8 formats. Remove the transparency comparison with reserved bits. When the bits-per-pixel and other color components match, transparency will already be in a subset of the reserved field. Not forcing it to match reserved bits allows the driver to work on the boards which misreport the reserved field. It also enables using simplefb formats that don't have transparency bits, although this doesn't currently happen due to format support and ordering in linux/platform_data/simplefb.h. [1] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.19/src/commonlib/include/commonlib/coreboot_tables.h#255 [2] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.13/src/drivers/intel/fsp2_0/graphics.c#82 Signed-off-by: Alper Nebi Yasak Link: https://lore.kernel.org/r/20230122190433.195941-1-alpernebiyasak@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/google/framebuffer-coreboot.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'drivers/firmware') diff --git a/drivers/firmware/google/framebuffer-coreboot.c b/drivers/firmware/google/framebuffer-coreboot.c index c6dcc1ef93ac..c323a818805c 100644 --- a/drivers/firmware/google/framebuffer-coreboot.c +++ b/drivers/firmware/google/framebuffer-coreboot.c @@ -43,9 +43,7 @@ static int framebuffer_probe(struct coreboot_device *dev) fb->green_mask_pos == formats[i].green.offset && fb->green_mask_size == formats[i].green.length && fb->blue_mask_pos == formats[i].blue.offset && - fb->blue_mask_size == formats[i].blue.length && - fb->reserved_mask_pos == formats[i].transp.offset && - fb->reserved_mask_size == formats[i].transp.length) + fb->blue_mask_size == formats[i].blue.length) pdata.format = formats[i].name; } if (!pdata.format) -- cgit v1.2.3 From e42af72223fdd0a4eca49e1bb904856710fdd46c Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Tue, 7 Feb 2023 08:12:00 -0800 Subject: firmware: coreboot: Remove GOOGLE_COREBOOT_TABLE_ACPI/OF Kconfig entries Ever since commit a28aad66da8b ("firmware: coreboot: Collapse platform drivers into bus core") the Kconfig entries GOOGLE_COREBOOT_TABLE_OF and GOOGLE_COREBOOT_TABLE_ACPI have been dead. They have no "help" text and thus aren't user choosable. They also aren't "select"ed by anything. They also control the compilation of no code. Let's remove them. Fixes: a28aad66da8b ("firmware: coreboot: Collapse platform drivers into bus core") Signed-off-by: Douglas Anderson Reviewed-by: Guenter Roeck Reviewed-by: Jack Rosenthal Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20230207081130.1.I657776750156793721efa247ce6293445137bc8a@changeid Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/google/Kconfig | 8 -------- 1 file changed, 8 deletions(-) (limited to 'drivers/firmware') diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig index 9f190eab43ed..1bc7cbf2f65d 100644 --- a/drivers/firmware/google/Kconfig +++ b/drivers/firmware/google/Kconfig @@ -44,14 +44,6 @@ config GOOGLE_COREBOOT_TABLE device tree node /firmware/coreboot. If unsure say N. -config GOOGLE_COREBOOT_TABLE_ACPI - tristate - select GOOGLE_COREBOOT_TABLE - -config GOOGLE_COREBOOT_TABLE_OF - tristate - select GOOGLE_COREBOOT_TABLE - config GOOGLE_MEMCONSOLE tristate depends on GOOGLE_MEMCONSOLE_X86_LEGACY || GOOGLE_MEMCONSOLE_COREBOOT -- cgit v1.2.3