From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751673AbdAYOlO (ORCPT <rfc822;w@1wt.eu>);
        Wed, 25 Jan 2017 09:41:14 -0500
Received: from mail.linuxfoundation.org ([140.211.169.12]:33620 "EHLO
        mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750762AbdAYOlN (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 25 Jan 2017 09:41:13 -0500
Date: Wed, 25 Jan 2017 15:41:21 +0100
From: Greg KH <gregkh@linuxfoundation.org>
To: "Luis R. Rodriguez" <mcgrof@kernel.org>
Cc: ming.lei@canonical.com, keescook@chromium.org,
        linux-kernel-dev@beckhoff.com, jakub.kicinski@netronome.com,
        chris@chris-wilson.co.uk, oss-drivers@netronome.com,
        johannes@sipsolutions.net, j@w1.fi, teg@jklm.no, kay@vrfy.org,
        jwboyer@fedoraproject.org, dmitry.torokhov@gmail.com,
        seth.forshee@canonical.com, bjorn.andersson@linaro.org,
        linux-kernel@vger.kernel.org, wagi@monom.org, stephen.boyd@linaro.org,
        zohar@linux.vnet.ibm.com, tiwai@suse.de, dwmw2@infradead.org,
        fengguang.wu@intel.com, dhowells@redhat.com,
        arend.vanspriel@broadcom.com, kvalo@codeaurora.org,
        "[3.10+]" <stable@vger.kernel.org>
Subject: Re: [PATCH 7/7] firmware: firmware: fix NULL pointer dereference in
 __fw_load_abort()
Message-ID: <20170125144121.GA15767@kroah.com>
References: <20170118200141.GH13946@wotan.suse.de>
 <20170123161111.5925-1-mcgrof@kernel.org>
 <20170123161111.5925-8-mcgrof@kernel.org>
 <20170125105204.GA5919@kroah.com>
 <20170125133631.GP13946@wotan.suse.de>
 <20170125134250.GQ13946@wotan.suse.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170125134250.GQ13946@wotan.suse.de>
User-Agent: Mutt/1.7.2 (2016-11-26)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Jan 25, 2017 at 02:42:50PM +0100, Luis R. Rodriguez wrote:
> On Wed, Jan 25, 2017 at 02:36:31PM +0100, Luis R. Rodriguez wrote:
> > On Wed, Jan 25, 2017 at 11:52:04AM +0100, Greg KH wrote:
> > > On Mon, Jan 23, 2017 at 08:11:11AM -0800, Luis R. Rodriguez wrote:
> > > > Since commit 5d47ec02c37ea632398cb251c884e3a488dff794
> > > > ("firmware: Correct handling of fw_state_wait() return value")
> > > > fw_load_abort(fw_priv) could be called twice and lead us to a
> > > > kernel crash. This happens only when the firmware fallback mechanism
> > > > (regular or custom) is used. The fallback mechanism exposes a sysfs
> > > > interface for userspace to upload a file and notify the kernel when
> > > > the file is loaded and ready, or to cancel an upload by echo'ing -1
> > > > into on the loading file:
> > > > 
> > > > echo -n "-1" > /sys/$DEVPATH/loading
> > > > 
> > > > This will call fw_load_abort(). Some distributions actually have
> > > > a udev rule in place to *always* immediately cancel all firmware
> > > > fallback mechanism requests (Debian, OpenSUSE), they have:
> 
> I made a typo here, OpenSUSE in fact does not carry this. Its so far
> only Debian I am aware of.
> 
> > > >   $ cat /lib/udev/rules.d/50-firmware.rules
> > > >   # stub for immediately telling the kernel that userspace firmware loading
> > > >   # failed; necessary to avoid long timeouts with CONFIG_FW_LOADER_USER_HELPER=y
> > > >   SUBSYSTEM=="firmware", ACTION=="add", ATTR{loading}="-1

Please resend this as a single patch, to be applied to 4.10-final, with
the above fix, and I will be glad to take it.  Never mix patches in a
series that are for -final and for -next.

thanks,

greg k-h