- 26 Aug, 2019 13 commits
-
-
Maciej S. Szmigiero authored
Medion 7134 has two i2c eeproms on the same i2c bus sharing the same bus addresses: the first one for SAA7134 chip config and the second one behind TDA10046 DVB-T demod chip i2c gate storing its firmware. The TV tuner on this board is not behind this i2c gate. Due to the bus conflict described above, the card PCI SVID / SSID sometimes gets garbled after a reboot, which makes it necessary to specify the card model manually as an insmod option in order for it to be detected reliably. To avoid this, let's just leave the gate permanently closed so the eeprom chips won't clash. The demod firmware load is done with its i2c gate closed anyway so it is not affected by this change. Signed-off-by:
Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
Wolfram Sang authored
No need to check the argument of i2c_unregister_device() because the function itself does it. Signed-off-by:
Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by:
-
Wolfram Sang authored
No need to check the argument of i2c_unregister_device() because the function itself does it. Signed-off-by:
-
Colin Ian King authored
Variable retval is initialized to a value that is never read so this assignment is redundant. Clean up the code by removing retval completely and just return the error return from the call to i2c_add_adapter. Addresses-Coverity: ("Unused value") Signed-off-by:Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Hans de Goede authored
Like a bunch of other MSI laptops the MS-1039 uses a 0c45:627b SN9C201 + OV7660 webcam which is mounted upside down. Add it to the sn9c20x flip_dmi_table to deal with this. Cc: stable@vger.kernel.org Reported-by:
Rui Salvaterra <rsalvaterra@gmail.com> Signed-off-by:
Hans de Goede <hdegoede@redhat.com> Signed-off-by:
-
Wenwen Wang authored
If an error occurs in this function, no cleanup is executed, leading to memory/resource leaks. To fix this issue, introduce two labels to perform the cleanup work. Signed-off-by:
Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by:
-
Wenwen Wang authored
In fdp1_open(), 'ctx' is allocated through kzalloc(). However, it is not deallocated if v4l2_ctrl_new_std() fails, leading to a memory leak bug. To fix this issue, free 'ctx' before going to the 'done' label. Signed-off-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Wenwen Wang authored
If saa7146_register_device() fails, no cleanup is executed, leading to memory/resource leaks. To fix this issue, perform necessary cleanup work before returning the error. Signed-off-by:
-
Wenwen Wang authored
In cx231xx_load_firmware(), 'p_buffer' is allocated through vmalloc() to hold the firmware. However, after the usage, it is not deallocated, leading to a memory leak bug. Signed-off-by:
-
Wenwen Wang authored
In submit_urbs(), 'cam->sbuf[i].data' is allocated through kmalloc_array(). However, it is not deallocated if the following allocation for urbs fails. To fix this issue, free 'cam->sbuf[i].data' if usb_alloc_urb() fails. Signed-off-by:
-
Philipp Zabel authored
Add a single imx-media mem2mem video device that uses the IPU IC PP (image converter post processing) task for scaling and colorspace conversion. On i.MX6Q/DL SoCs with two IPUs currently only the first IPU is used. The hardware only supports writing to destination buffers up to 1024x1024 pixels in a single pass, arbitrary sizes can be achieved by rendering multiple tiles per frame. [slongerbeam@gmail.com: use ipu_image_convert_adjust(), fix device_run() error handling, add missing media-device header, unregister and remove the mem2mem device in error paths in imx_media_probe_complete() and in imx_media_remove(), updated for sync subdev registration] Signed-off-by:
Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by:
Steve Longerbeam <slongerbeam@gmail.com> Signed-off-by:
-
Hans Verkuil authored
If cec_notifier_cec_adap_unregister() is called before cec_unregister_adapter() then everything is OK (and this is the case today). But if it is the other way around, then cec_notifier_unregister() is called first, and that doesn't set n->cec_adap to NULL. So if e.g. cec_notifier_set_phys_addr() is called after cec_notifier_unregister() but before cec_unregister_adapter() then n->cec_adap points to an unregistered and likely deleted cec adapter. So just set n->cec_adap->notifier and n->cec_adap to NULL for rubustness. Eventually cec_notifier_unregister will disappear and this will be simplified substantially. Signed-off-by:
-
Hans Verkuil authored
Check if cec_s_conn_info is called with a valid cec adapter, do nothing if it is invalid. This makes it possible to call this function even if CEC support is disabled in the kernel config. Signed-off-by:
-
- 23 Aug, 2019 4 commits
-
-
Maxime Ripard authored
The older CSI drivers have camera capture interface different from the one in the newer ones. This IP is pretty simple. Some variants (one controller out of two instances on some SoCs) have an ISP embedded, but there's no code that make use of it, so we ignored that part for now. [Sakari Ailus: Wrapped a few long lines, set mbus code using a macro.] Signed-off-by:
Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Maxime Ripard authored
The Makefile and Kconfig for the sun6i CSI driver are included in the main Makefile / KConfig file. Since we're going to add a new CSI driver for an older chip, and the Cedrus driver eventually, it makes more sense to put those in our directory. Signed-off-by:
-
Maxime Ripard authored
The Allwinner A10 CMOS Sensor Interface is a camera capture interface also used in later (A10s, A13, A20, R8 and GR8) SoCs. On some SoCs, like the A10, there's multiple instances of that controller, with one instance supporting more channels and having an ISP. [Sakari Ailus: Add type: object to the endpoint node.] Reviewed-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Alexandre Kroupski authored
In case of sensor malfunction, stop streaming timeout takes much longer than expected. This is due to conversion of time to jiffies: milliseconds multiplied with HZ (ticks/second) gives out a value of jiffies with 10^3 greater. We need to also divide by 10^3 to obtain the right jiffies value. In other words FRAME_INTERVAL_MILLI_SEC must be in seconds in order to multiply by HZ and get the right jiffies value to add to the current jiffies for the timeout expire time. Fixes: 195ebc43 ("[media] V4L: at91: add Atmel Image Sensor Interface (ISI) support") Signed-off-by:
Alexandre Kroupski <alexandre.kroupski@ingenico.com> Reviewed-by:
Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by:
-
- 21 Aug, 2019 23 commits
-
-
Maxime Ripard authored
The older Allwinner SoCs have a IR receiver supported in Linux, with a matching Device Tree binding. Now that we have the DT validation in place, let's convert the device tree bindings for that controller over to a YAML schemas. Reviewed-by:
Sean Young <sean@mess.org> Signed-off-by:
-
Maxime Ripard authored
The RC controllers have a bunch of generic properties that are needed in a device tree. Add a YAML schemas for those. Reviewed-by:
-
Tomas Bortoli authored
The function at issue does not always initialize each byte allocated for 'b' and can therefore leak uninitialized memory to a USB device in the call to usb_bulk_msg() Use kzalloc() instead of kmalloc() Signed-off-by:
Tomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com Signed-off-by:
-
Nishka Dasgupta authored
Static structure en_templ, of type dvb_ca_en50221, is not used except to be copied into a local variable. Hence make it const to prevent unintended modification of the original fields. Issue found with Coccinelle. Signed-off-by:
Nishka Dasgupta <nishkadg.linux@gmail.com> Signed-off-by:
-
Nishka Dasgupta authored
The static structure ec168_props, of type dvb_usb_device_properties, is used only once, when it is assigned to field props of the constant structure ec168_driver_info. As this means that ec168_props will never be modified, make it const as well in order to prevent unintended modification of its fields. Issue found with Coccinelle. Signed-off-by:
-
Nishka Dasgupta authored
Static structure fdtv_ca, of type dvb_device, is only used when it is passed as the third argument to function dvb_register_device(). However, in the definition of dvb_register_device, the third parameter is declared as constant. Hence make fdtv_ca const as well. Issue found with Coccinelle. Signed-off-by:
-
Nishka Dasgupta authored
Static structure dst_config, of type dst_config, is not used except to be assigned as the value of field state of a variable having type dst_state *. In the definition of dst_state, field config is declared as const. Hence dst_config, when assigned to config, cannot be modified. Therefore, make dst_config const as well. Issue found with Coccinelle. Signed-off-by:
-
Jan Pieter van Woerkom authored
commit 5fa88151 ("[media] dvb-usb-cxusb: Geniatech T230 - resync TS FIFO after lock") does not solve the problem for all devices. This is the same issue reported on the T230C, which was moved to the dvbsky.c driver to work around this issue in commit 57422405 ("media: dvbsky: MyGica T230C support"). In addition, the cxusb driver causes an oops when unplugging the device while streaming; this problem does not happen any more. Signed-off-by:
Jan Pieter van Woerkom <jp@jpvw.nl> Tested-by:
James Hutchinson <jahutchinson99@googlemail.com> Signed-off-by:
-
Jan Pieter van Woerkom authored
Remove this device from the cxusb driver so it can be added to the dvbsky driver. Signed-off-by:
-
Wenwen Wang authored
In dvb_create_media_entity(), 'dvbdev->entity' is allocated through kzalloc(). Then, 'dvbdev->pads' is allocated through kcalloc(). However, if kcalloc() fails, the allocated 'dvbdev->entity' is not deallocated, leading to a memory leak bug. To fix this issue, free 'dvbdev->entity' before returning -ENOMEM. Signed-off-by:
-
Sean Young authored
This protocol responds to a real philips rc-mm remote; it does not respond to IR encoded with the encoder in ir-rcmm-decoder.c. Signed-off-by:
-
Wenwen Wang authored
In cx24117_load_firmware(), 'buf' is allocated through kmalloc() to hold the firmware. However, if i2c_transfer() fails, it is not deallocated, leading to a memory leak bug. Signed-off-by:
-
Wenwen Wang authored
In dib7000pc_detection(), 'tx' and 'rx' are allocated through kzalloc() respectively. However, if DiB7000PC is detected, they are not deallocated, leading to memory leaks. To fix this issue, create a label to free 'tx' and 'rx' before returning from the function. Signed-off-by:
-
A Sun authored
Fix and eliminate mceusb's IR length limit for IR signals transmitted to the MCE IR blaster ports. An IR signal TX exceeding 306 pulse/space samples presently causes -EINVAL return error. There's no such limitation nor error with the MCE device hardware. And valid IR signals exist with more than 400 pulse/space for the control of certain appliances (eg Panasonic ACXA75C00600 air conditioner). The scope of this patch is limited to the mceusb driver. There are still IR signal TX length and time constraints that related modules of rc core (eg LIRC) impose, further up the driver stack. Changes for mceusb_tx_ir(): Converts and sends LIRC IR pulse/space sequence to MCE device IR pulse/space format. Break long length LIRC sequence into multiple (unlimited number of) parts for sending to the MCE device. Reduce kernel stack IR buffer size: 128 (was 384) Increase MCE IR data packet size: 31 (was 5) Zero time LIRC pulse/space no longer copied to MCE IR data. Eliminate overwriting the source/input LIRC IR data in txbuf[]. Eliminate -EINVAL return; return number of IR samples sent (>0) or MCE write error code (<0). New mce_write() and mce_write_callback(): Implements synchronous blocking I/O, with timeout, for writing/sending data to the MCE device. An unlimited multipart IR signal sent to the MCE device faster than real time requires flow control absent with the original mce_request_packet() and mce_async_callback() asynchronous I/O implementation. Also absent is TX error feedback. mce_write() combines and replaces mce_request_packet() and mce_async_callback() with conversion to synchronous I/O. mce_write() returns bytes sent (>0) or MCE device write error (<0). Debug hex dump TX data before processing. Rename mce_async_out() -> mce_command_out(): The original name is misleading with underlying synchronous I/O implementation. Function renamed to mce_command_out(). Changes in mceusb_handle_command(): Add support for MCE device error case MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)" Changes in mceusb_dev_printdata(): Changes support test and debug of multipart TX IR. Add buffer boundary information (offset and buffer size) to TX hex dump. Correct TX trace bug "Raw IR data, 0 pulse/space samples" Add trace for MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)" Other changes: The driver's write to USB device architecture change (async to sync I/O) is significant so we bump DRIVER_VERSION to "1.95" (from "1.94"). Tests: $ cat -n irdata1 | head -3 1 carrier 36000 2 pulse 6350 3 space 6350 $ cat -n irdata1 | tail -3 76 pulse 6350 77 space 6350 78 pulse 6350 $ ir-ctl -s irdata1 [1549021.073612] mceusb 1-1.3:1.0: requesting 36000 HZ carrier [1549021.073635] mceusb 1-1.3:1.0: tx data[0]: 9f 06 01 45 (len=4 sz=4) [1549021.073649] mceusb 1-1.3:1.0: Request carrier of 35714 Hz (period 28us) [1549021.073848] mceusb 1-1.3:1.0: tx done status = 4 (wait = 100, expire = 100 (1000ms), urb->actual_length = 4, urb->status = 0) [1549021.074689] mceusb 1-1.3:1.0: rx data[0]: 9f 06 01 45 (len=4 sz=4) [1549021.074701] mceusb 1-1.3:1.0: Got carrier of 35714 Hz (period 28us) [1549021.102023] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3) [1549021.102036] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03 [1549021.102219] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0) [1549021.131979] mceusb 1-1.3:1.0: tx data[0]: 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 91 ff (len=81 sz=81) [1549021.131992] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples [1549021.133592] mceusb 1-1.3:1.0: tx done status = 81 (wait = 100, expire = 100 (1000ms), urb->actual_length = 81, urb->status = 0) Hex dumps limited to 64 bytes. 0xff is MCE maximum time pulse, 0x7f is MCE maximum time space. $ cat -n irdata2 | head -3 1 carrier 36000 2 pulse 50 3 space 50 $ cat -n irdata2 | tail -3 254 pulse 50 255 space 50 256 pulse 50 $ ir-ctl -s irdata2 [1549306.586998] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3) [1549306.587015] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03 [1549306.587252] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0) [1549306.613275] mceusb 1-1.3:1.0: tx data[0]: 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 (len=128 sz=128) [1549306.613291] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples [1549306.614837] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0) [1549306.614861] mceusb 1-1.3:1.0: tx data[0]: 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 (len=128 sz=128) [1549306.614869] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples [1549306.620199] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0) [1549306.620212] mceusb 1-1.3:1.0: tx data[0]: 89 81 01 81 01 81 01 81 01 81 80 (len=11 sz=11) [1549306.620221] mceusb 1-1.3:1.0: Raw IR data, 9 pulse/space samples [1549306.633294] mceusb 1-1.3:1.0: tx done status = 11 (wait = 98, expire = 100 (1000ms), urb->actual_length = 11, urb->status = 0) Hex dumps limited to 64 bytes. 0x81 is MCE minimum time pulse, 0x01 is MCE minimum time space. TX IR part 3 sz=11 shows 20msec I/O blocking delay (100expire - 98wait = 2jiffies) Signed-off-by:A Sun <as1033x@comcast.net> Signed-off-by:
-
Christian Hewitt authored
This is a simple NEC remote control device shipped with the HardKernel ODROID range of SBC devices. Signed-off-by:
Christian Hewitt <christianshewitt@gmail.com> Signed-off-by:
-
Christian Hewitt authored
The WeTek Play 2 Android STB ships with an unusual remote where the main up/down/left/right/enter controls are surrounded with an outer ring of additional keys which are listed in clockwise order. Signed-off-by:
-
Christian Hewitt authored
The WeTek Hub Android STB ships with a simple NEC remote. Signed-off-by:
-
Christian Hewitt authored
The Tanix TX5 max Android STB ships with a simple NEC remote. Signed-off-by:
-
Christian Hewitt authored
The Tanix TX3 mini Android STB ships with a simple NEC remote. Signed-off-by:
-
Christian Hewitt authored
Khadas VIM and Edge SBC devices use the same NEC remote device. The remote includes a mouse button for Android use. This has been mapped to KEY_MUTE. Signed-off-by:
-
Christian Hewitt authored
The X96-Max Android STB ships with a simple NEC remote. It includes a TV section with preset buttons for controlling a TV. These are not configurable, but are noted to aid visual recognition of the device. Signed-off-by:
-
Marc Gonzalez authored
Use cmd_init() to fill a struct si2168_cmd command. Signed-off-by:
Marc Gonzalez <marc.w.gonzalez@free.fr> Signed-off-by:
-
Sean Young authored
KASAN: global-out-of-bounds Read in dvb_pll_attach Syzbot reported global-out-of-bounds Read in dvb_pll_attach, while accessing id[dvb_pll_devcount], because dvb_pll_devcount was 65, that is more than size of 'id' which is DVB_PLL_MAX(64). Rather than increasing dvb_pll_devcount every time, use ida so that numbers are allocated correctly. This does mean that no more than 64 devices can be attached at the same time, but this is more than sufficient. usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) usb 1-1: media controller created dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. tc90522 0-0018: Toshiba TC90522 attached. usb 1-1: DVB: registering adapter 0 frontend 0 (Toshiba TC90522 ISDB-T module)... dvbdev: dvb_create_media_entity: media entity 'Toshiba TC90522 ISDB-T module' registered. ================================================================== BUG: KASAN: global-out-of-bounds in dvb_pll_attach+0x6c5/0x830 drivers/media/dvb-frontends/dvb-pll.c:798 Read of size 4 at addr ffffffff89c9e5e0 by task kworker/0:1/12 CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.2.0-rc6+ #13 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description+0x67/0x231 mm/kasan/report.c:188 __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:317 kasan_report+0xe/0x20 mm/kasan/common.c:614 dvb_pll_attach+0x6c5/0x830 drivers/media/dvb-frontends/dvb-pll.c:798 dvb_pll_probe+0xfe/0x174 drivers/media/dvb-frontends/dvb-pll.c:877 i2c_device_probe+0x790/0xaa0 drivers/i2c/i2c-core-base.c:389 really_probe+0x281/0x660 drivers/base/dd.c:509 driver_probe_device+0x104/0x210 drivers/base/dd.c:670 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:843 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2111 i2c_new_client_device+0x5b3/0xc40 drivers/i2c/i2c-core-base.c:778 i2c_new_device+0x19/0x50 drivers/i2c/i2c-core-base.c:821 dvb_module_probe+0xf9/0x220 drivers/media/dvb-core/dvbdev.c:985 friio_tuner_attach+0x125/0x1d0 drivers/media/usb/dvb-usb-v2/gl861.c:536 dvb_usbv2_adapter_frontend_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:675 [inline] dvb_usbv2_adapter_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:804 [inline] dvb_usbv2_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:865 [inline] dvb_usbv2_probe.cold+0x24dc/0x255d drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:980 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x660 drivers/base/dd.c:509 driver_probe_device+0x104/0x210 drivers/base/dd.c:670 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:843 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2111 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x660 drivers/base/dd.c:509 driver_probe_device+0x104/0x210 drivers/base/dd.c:670 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777 bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 __device_attach+0x217/0x360 drivers/base/dd.c:843 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 device_add+0xae6/0x16f0 drivers/base/core.c:2111 usb_new_device.cold+0x8c1/0x1016 drivers/usb/core/hub.c:2534 hub_port_connect drivers/usb/core/hub.c:5089 [inline] hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] port_event drivers/usb/core/hub.c:5350 [inline] hub_event+0x1ada/0x3590 drivers/usb/core/hub.c:5432 process_one_work+0x905/0x1570 kernel/workqueue.c:2269 process_scheduled_works kernel/workqueue.c:2331 [inline] worker_thread+0x7ab/0xe20 kernel/workqueue.c:2417 kthread+0x30b/0x410 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the variable: id+0x100/0x120 Memory state around the buggy address: ffffffff89c9e480: fa fa fa fa 00 00 fa fa fa fa fa fa 00 00 00 00 ffffffff89c9e500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffffffff89c9e580: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa ^ ffffffff89c9e600: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa ffffffff89c9e680: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa ================================================================== Reported-by: syzbot+8a8f48672560c8ca59dd@syzkaller.appspotmail.com Signed-off-by:
-
