Re: Patch testing request

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

want 2 args (repo, branch), got 5

>
> diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
> index 91899d185e31..d7d63c1aa993 100644
> --- a/drivers/base/firmware_loader/fallback.c
> +++ b/drivers/base/firmware_loader/fallback.c
> @@ -89,12 +89,11 @@ static void __fw_load_abort(struct fw_priv *fw_priv)
> {
> /*
> * There is a small window in which user can write to 'loading'
> - * between loading done and disappearance of 'loading'
> + * between loading done/aborted and disappearance of 'loading'
> */
> - if (fw_sysfs_done(fw_priv))
> + if (fw_state_is_aborted(fw_priv) || fw_sysfs_done(fw_priv))
> return;
>
> - list_del_init(&fw_priv->pending_list);
> fw_state_aborted(fw_priv);
> }
>
> @@ -280,7 +279,6 @@ static ssize_t firmware_loading_store(struct device *dev,
> * Same logic as fw_load_abort, only the DONE bit
> * is ignored and we set ABORT only on failure.
> */
> - list_del_init(&fw_priv->pending_list);
> if (rc) {
> fw_state_aborted(fw_priv);
> written = rc;
> @@ -513,6 +511,11 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout)
> }
>
> mutex_lock(&fw_lock);
> + if (fw_state_is_aborted(fw_priv)) {
> + mutex_unlock(&fw_lock);
> + retval = -EINTR;
> + goto out;
> + }
> list_add(&fw_priv->pending_list, &pending_fw_head);
> mutex_unlock(&fw_lock);
>
> @@ -535,11 +538,10 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout)
> if (fw_state_is_aborted(fw_priv)) {
> if (retval == -ERESTARTSYS)
> retval = -EINTR;
> - else
> - retval = -EAGAIN;
> } else if (fw_priv->is_paged_buf && !fw_priv->data)
> retval = -ENOMEM;
>
> +out:
> device_del(f_dev);
> err_put_dev:
> put_device(f_dev);
> diff --git a/drivers/base/firmware_loader/firmware.h b/drivers/base/firmware_loader/firmware.h
> index 63bd29fdcb9c..a3014e9e2c85 100644
> --- a/drivers/base/firmware_loader/firmware.h
> +++ b/drivers/base/firmware_loader/firmware.h
> @@ -117,8 +117,16 @@ static inline void __fw_state_set(struct fw_priv *fw_priv,
>
> WRITE_ONCE(fw_st->status, status);
>
> - if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
> + if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) {
> +#ifdef CONFIG_FW_LOADER_USER_HELPER
> + /*
> + * Doing this here ensures that the fw_priv is deleted from
> + * the pending list in all abort/done paths.
> + */
> + list_del_init(&fw_priv->pending_list);
> +#endif
> complete_all(&fw_st->completion);
> + }
> }
>
> static inline void fw_state_aborted(struct fw_priv *fw_priv)
> diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
> index 4fdb8219cd08..68c549d71230 100644
> --- a/drivers/base/firmware_loader/main.c
> +++ b/drivers/base/firmware_loader/main.c
> @@ -783,8 +783,10 @@ static void fw_abort_batch_reqs(struct firmware *fw)
> return;
>
> fw_priv = fw->priv;
> + mutex_lock(&fw_lock);
> if (!fw_state_is_aborted(fw_priv))
> fw_state_aborted(fw_priv);
> + mutex_unlock(&fw_lock);
> }
>
> /* called from request_firmware() and request_firmware_work_func() */