1. 17 2月, 2017 2 次提交
  2. 18 7月, 2016 1 次提交
  3. 08 7月, 2016 1 次提交
    • R
      Bluetooth: btmrvl: fix slab-out-of-bounds access in btmrvl_sdio · d2f30240
      Ricky Liang 提交于
      Kasan reported slab-out-of-bounds access in btmrvl_sdio:
      
      [   33.055400] ==================================================================
      [   33.062585] BUG: KASAN: slab-out-of-bounds in memcpy+0x24/0x50 at addr ffffffc0d89b4a00
      [   33.070529] Read of size 256 by task btmrvl_main_ser/3576
      [   33.075885] =============================================================================
      [   33.084002] BUG kmalloc-256 (Tainted: G    B         ): kasan: bad access detected
      [   33.091511] -----------------------------------------------------------------------------
      <snip...>
      [   33.413498] Call trace:
      [   33.415928] [<ffffffc00020a440>] dump_backtrace+0x0/0x190
      [   33.421288] [<ffffffc00020a5ec>] show_stack+0x1c/0x28
      [   33.426305] [<ffffffc000b3288c>] dump_stack+0xa0/0xf8
      [   33.431320] [<ffffffc000396130>] print_trailer+0x158/0x16c
      [   33.436765] [<ffffffc0003962cc>] object_err+0x48/0x5c
      [   33.441780] [<ffffffc00039be24>] kasan_report+0x344/0x510
      [   33.447141] [<ffffffc00039afd8>] __asan_loadN+0x20/0x150
      [   33.452413] [<ffffffc00039b60c>] memcpy+0x20/0x50
      [   33.457084] [<ffffffc000595fcc>] swiotlb_tbl_map_single+0x2ec/0x310
      [   33.463305] [<ffffffc000596b54>] map_single+0x24/0x30
      [   33.468320] [<ffffffc0005970c8>] swiotlb_map_sg_attrs+0xec/0x21c
      [   33.474286] [<ffffffc000219d4c>] __swiotlb_map_sg_attrs+0x48/0xec
      [   33.480339] [<ffffffc0008ea610>] msdc_prepare_data.isra.11+0xf0/0x11c
      [   33.486733] [<ffffffc0008ecbd0>] msdc_ops_request+0x74/0xf0
      [   33.492266] [<ffffffc0008c6b38>] __mmc_start_request+0x78/0x8c
      [   33.498057] [<ffffffc0008c6d6c>] mmc_start_request+0x220/0x240
      [   33.503848] [<ffffffc0008c6e04>] mmc_wait_for_req+0x78/0x250
      [   33.509468] [<ffffffc0008d70fc>] mmc_io_rw_extended+0x2ec/0x388
      [   33.515347] [<ffffffc0008d8fc0>] sdio_io_rw_ext_helper+0x160/0x268
      [   33.521483] [<ffffffc0008d93fc>] sdio_writesb+0x40/0x50
      [   33.526677] [<ffffffbffc338b38>] btmrvl_sdio_host_to_card+0x124/0x1bc [btmrvl_sdio]
      [   33.534283] [<ffffffbffc3290a0>] btmrvl_service_main_thread+0x384/0x428 [btmrvl]
      [   33.541626] [<ffffffc0002518e8>] kthread+0x140/0x158
      [   33.546550] Memory state around the buggy address:
      [   33.551305]  ffffffc0d89b4980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [   33.558474]  ffffffc0d89b4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [   33.565643] >ffffffc0d89b4a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
      [   33.572809]                                                                 ^
      [   33.579889]  ffffffc0d89b4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [   33.587055]  ffffffc0d89b4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      [   33.594221] ==================================================================
      
      The cause of this is that btmrvl_sdio_host_to_card can access memory region
      out of its allocated space due to:
      
        1. the requested block size is smaller than SDIO_BLOCK_SIZE, and/or
        2. the allocated memory is not BTSDIO_DMA_ALIGN-aligned.
      
      This patch fixes the issue by allocating a buffer which is big enough for
      SDIO_BLOCK_SIZE transfer and/or BTSDIO_DMA_ALIGN address relocation.
      Signed-off-by: NRicky Liang <jcliang@chromium.org>
      Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
      d2f30240
  4. 03 5月, 2016 1 次提交
  5. 11 3月, 2016 1 次提交
  6. 06 1月, 2016 1 次提交
  7. 05 1月, 2016 1 次提交
    • C
      Bluetooth: btmrvl: fix hung task warning dump · 86f7ac77
      Chin-Ran Lo 提交于
      It's been observed that when bluetooth driver fails to
      activate the firmware, below hung task warning dump is
      displayed after 120 seconds.
      
      [   36.461022] Bluetooth: vendor=0x2df, device=0x912e, class=255, fn=2
      [   56.512128] Bluetooth: FW failed to be active in time!
      [   56.517264] Bluetooth: Downloading firmware failed!
      [  240.252176] INFO: task kworker/3:2:129 blocked for more than 120 seconds.
      [  240.258931]       Not tainted 3.18.0 #254
      [  240.262972] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      [  240.270751] kworker/3:2     D ffffffc000205760     0   129      2 0x00000000
      [  240.277825] Workqueue: events request_firmware_work_func
      [  240.283134] Call trace:
      [  240.285581] [<ffffffc000205760>] __switch_to+0x80/0x8c
      [  240.290693] [<ffffffc00088dae0>] __schedule+0x540/0x7b8
      [  240.295921] [<ffffffc00088ddd0>] schedule+0x78/0x84
      [  240.300764] [<ffffffc0006dfd48>] __mmc_claim_host+0xe8/0x1c8
      [  240.306395] [<ffffffc0006edd6c>] sdio_claim_host+0x74/0x84
      [  240.311840] [<ffffffbffc163d08>] 0xffffffbffc163d08
      [  240.316685] [<ffffffbffc165104>] 0xffffffbffc165104
      [  240.321524] [<ffffffbffc130cf8>] mwifiex_dnld_fw+0x98/0x110 [mwifiex]
      [  240.327918] [<ffffffbffc12ee88>] mwifiex_remove_card+0x2c4/0x5fc [mwifiex]
      [  240.334741] [<ffffffc000596780>] request_firmware_work_func+0x44/0x80
      [  240.341127] [<ffffffc00023b934>] process_one_work+0x2ec/0x50c
      [  240.346831] [<ffffffc00023c6a0>] worker_thread+0x350/0x470
      [  240.352272] [<ffffffc0002419bc>] kthread+0xf0/0xfc
      [  240.357019] 2 locks held by kworker/3:2/129:
      [  240.361248]  #0:  ("events"){.+.+.+}, at: [<ffffffc00023b840>] process_one_work+0x1f8/0x50c
      [  240.369562]  #1:  ((&fw_work->work)){+.+.+.}, at: [<ffffffc00023b840>] process_one_work+0x1f8/0x50c
      [  240.378589]   task                        PC stack   pid father
      [  240.384501] kworker/1:1     D ffffffc000205760     0    40      2 0x00000000
      [  240.391524] Workqueue: events mtk_atomic_work
      [  240.395884] Call trace:
      [  240.398317] [<ffffffc000205760>] __switch_to+0x80/0x8c
      [  240.403448] [<ffffffc00027279c>] lock_acquire+0x128/0x164
      [  240.408821] kworker/3:2     D ffffffc000205760     0   129      2 0x00000000
      [  240.415867] Workqueue: events request_firmware_work_func
      [  240.421138] Call trace:
      [  240.423589] [<ffffffc000205760>] __switch_to+0x80/0x8c
      [  240.428688] [<ffffffc00088dae0>] __schedule+0x540/0x7b8
      [  240.433886] [<ffffffc00088ddd0>] schedule+0x78/0x84
      [  240.438732] [<ffffffc0006dfd48>] __mmc_claim_host+0xe8/0x1c8
      [  240.444361] [<ffffffc0006edd6c>] sdio_claim_host+0x74/0x84
      [  240.449801] [<ffffffbffc163d08>] 0xffffffbffc163d08
      [  240.454649] [<ffffffbffc165104>] 0xffffffbffc165104
      [  240.459486] [<ffffffbffc130cf8>] mwifiex_dnld_fw+0x98/0x110 [mwifiex]
      [  240.465882] [<ffffffbffc12ee88>] mwifiex_remove_card+0x2c4/0x5fc [mwifiex]
      [  240.472705] [<ffffffc000596780>] request_firmware_work_func+0x44/0x80
      [  240.479090] [<ffffffc00023b934>] process_one_work+0x2ec/0x50c
      [  240.484794] [<ffffffc00023c6a0>] worker_thread+0x350/0x470
      [  240.490231] [<ffffffc0002419bc>] kthread+0xf0/0xfc
      
      This patch adds missing sdio_release_host() call so that wlan driver
      thread can claim sdio host.
      
      Fixes: 4863e4cc ("Bluetooth: btmrvl: release sdio bus after firmware is up")
      Signed-off-by: NChin-Ran Lo <crlo@marvell.com>
      Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
      Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
      86f7ac77
  8. 20 11月, 2015 1 次提交
  9. 26 9月, 2015 1 次提交
  10. 22 9月, 2015 3 次提交
  11. 29 8月, 2015 1 次提交
  12. 11 8月, 2015 1 次提交
  13. 14 5月, 2015 1 次提交
  14. 06 1月, 2015 2 次提交
  15. 04 12月, 2014 2 次提交
  16. 30 9月, 2014 2 次提交
  17. 15 7月, 2014 1 次提交
  18. 03 7月, 2014 1 次提交
  19. 29 3月, 2014 1 次提交
  20. 28 3月, 2014 1 次提交
  21. 04 12月, 2013 1 次提交
    • B
      Bluetooth: btmrvl: use cal-data from device-tree instead of conf file · 433a9389
      Bing Zhao 提交于
      Some ARM versions of Chromebook need to download a new calibration
      data from host driver to firmware. They do have EEPROM but still
      need a piece of new calibration data in test mode.
      
      The cal-data is platform dependent. It's simpler and more feasible
      to use device tree based cal-data instead of configuration file
      based cal-data.
      
      This patch remove configuration file based cal-data downloading
      and replace it using cal-data from device tree.
      
      When CONFIG_OF is not selected, or the specific property is not
      present in the device tree, the calibration downloading will not
      happen.
      
      Cc: Mike Frysinger <vapier@chromium.org>
      Cc: Amitkumar Karwar <akarwar@marvell.com>
      Signed-off-by: NBing Zhao <bzhao@marvell.com>
      Signed-off-by: NHyuckjoo Lee <hyuckjoo.lee@samsung.com>
      Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
      433a9389
  22. 11 10月, 2013 1 次提交
  23. 02 10月, 2013 2 次提交
  24. 21 8月, 2013 1 次提交
  25. 14 6月, 2013 1 次提交
  26. 12 6月, 2013 1 次提交
  27. 24 4月, 2013 2 次提交
  28. 19 4月, 2013 1 次提交
  29. 16 3月, 2013 1 次提交
  30. 11 10月, 2012 1 次提交
  31. 28 9月, 2012 2 次提交
    • A
      Bluetooth: btmrvl: Fix skb buffer overflow · 9cb23dd4
      Andrei Emeltchenko 提交于
      Add extra check to avoid skb buffer overflow. Fixes crash below:
      
       [  101.030427] ------------[ cut here ]------------
       [  101.030459] kernel BUG at net/core/skbuff.c:127!
       [  101.030486] invalid opcode: 0000 [#1] SMP
      ...
       [  101.030806] Pid: 2010, comm: btmrvl_main_ser Not tainted 3.5.0+ #80 Laptop
       [  101.030859] EIP: 0060:[<c14f2ba9>] EFLAGS: 00010282 CPU: 0
       [  101.030894] EIP is at skb_put+0x99/0xa0
       [  101.030919] EAX: 00000080 EBX: f129380b ECX: ef923540 EDX: 00000001
       [  101.030956] ESI: f00a4000 EDI: 00001003 EBP: ed4a5efc ESP: ed4a5ecc
       [  101.030992]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
       [  101.031024] CR0: 8005003b CR2: 08fca014 CR3: 30960000 CR4: 000407f0
       [  101.031062] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
       [  101.031100] DR6: ffff0ff0 DR7: 00000400
       [  101.031125] Process btmrvl_main_ser (pid: 2010, ti=ed4a4000 task=ef923540 task.ti=ed4a4000)
       [  101.031174] Stack:
       [  101.031188]  c18126f8 c1651938 f853f8d2 00001003 00001003 f1292800 f1292808 f129380b
       [  101.031250]  f1292940 f00a4000 eddb1280 efc0f9c0 ed4a5f44 f853f8d2 00000040 00000000
       [  101.031312]  ef923540 c15ee096 ef923540 eddb12d4 00000004 f00a4000 00000040 00000000
       [  101.031376] Call Trace:
       [  101.031396]  [<f853f8d2>] ? btmrvl_sdio_process_int_status+0x272/0x3d0 [btmrvl_sdio]
       [  101.031444]  [<f853f8d2>] btmrvl_sdio_process_int_status+0x272/0x3d0 [btmrvl_sdio]
       [  101.031488]  [<c15ee096>] ? _raw_spin_unlock_irqrestore+0x36/0x70
       [  101.031526]  [<f85a46e4>] btmrvl_service_main_thread+0x244/0x300 [btmrvl]
       [  101.031568]  [<f853fb50>] ? btmrvl_sdio_poll_card_status.isra.6.constprop.7+0x90/0x90 [btmrvl_sdio]
       [  101.031619]  [<c107eda0>] ? try_to_wake_up+0x270/0x270
       [  101.031648]  [<f85a44a0>] ? btmrvl_process_event+0x3b0/0x3b0 [btmrvl]
       [  101.031686]  [<c106d19d>] kthread+0x7d/0x90
       [  101.031713]  [<c106d120>] ? flush_kthread_work+0x150/0x150
       [  101.031745]  [<c15f5a82>] kernel_thread_helper+0x6/0x10
      ...
       [  101.032008] EIP: [<c14f2ba9>] skb_put+0x99/0xa0 SS:ESP 0068:ed4a5ecc
       [  101.056125] ---[ end trace a0bd01d1a9a796c8 ]---
      Signed-off-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
      9cb23dd4
    • A
      Bluetooth: btmrvl: Use DIV_ROUND_UP macro · e678bad5
      Andrei Emeltchenko 提交于
      The kernel.h macro DIV_ROUND_UP performs the computation
      (((n) + (d) - 1) / (d))
      Signed-off-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
      e678bad5