kernel.git/drivers/char/xillybus, branch linux-5.16.y

char: xillybus: fix msg_ep UAF in xillyusb_probe()

2021-10-19T07:40:18Z

When endpoint_alloc() return failed in xillyusb_setup_base_eps(), 'xdev->msg_ep' will be freed but not set to NULL. That lets program enter fail handling to cleanup_dev() in xillyusb_probe(). Check for 'xdev->msg_ep' is invalid in cleanup_dev() because 'xdev->msg_ep' did not set to NULL when was freed. So the UAF problem for 'xdev->msg_ep' is triggered. ================================================================== BUG: KASAN: use-after-free in fifo_mem_release+0x1f4/0x210 CPU: 0 PID: 166 Comm: kworker/0:2 Not tainted 5.15.0-rc5+ #19 Call Trace: dump_stack_lvl+0xe2/0x152 print_address_description.constprop.0+0x21/0x140 ? fifo_mem_release+0x1f4/0x210 kasan_report.cold+0x7f/0x11b ? xillyusb_probe+0x530/0x700 ? fifo_mem_release+0x1f4/0x210 fifo_mem_release+0x1f4/0x210 ? __sanitizer_cov_trace_pc+0x1d/0x50 endpoint_dealloc+0x35/0x2b0 cleanup_dev+0x90/0x120 xillyusb_probe+0x59a/0x700 ... Freed by task 166: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x109/0x140 kfree+0x117/0x4c0 xillyusb_probe+0x606/0x700 Set 'xdev->msg_ep' to NULL after being freed in xillyusb_setup_base_eps() to fix the UAF problem. Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)") Cc: stable Acked-by: Eli Billauer Signed-off-by: Ziyang Xuan Link: https://lore.kernel.org/r/20211016052047.1611983-1-william.xuanziyang@huawei.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Eliminate redundant wrappers to DMA related calls

2021-10-05T14:11:11Z

The driver was originally written with the assumption that a different API must be used for DMA-related functions if the device is PCIe based or if not. Since Xillybus' driver supports devices on a PCIe bus (with xillybus_pcie) as well as connected directly to the processor (with xillybus_of), it originally used wrapper functions that ensure that a different API is used for each. This patch eliminates the said wrapper functions, as all use the same dma_* API now. This is most notable by the code deleted in xillybus_pcie.c and xillybus_of.c. It also eliminates the OF driver's check for a "dma-coherent" attribute in the device's OF entry, since this is taken care of by the kernel's implementation of dma_sync_single_for_*(). There is however still need for one wrapper function, which is merged from xillybus_pcie.c and xillybus_of.c into xillybus_core.c: The call to dma_map_single() is wrapped by a function that uses the Managed Device (devres) framework, in the absence of a relevant function in the current kernel's API. Suggested-by: Christophe JAILLET Suggested-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210929094442.46383-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Simplify 'xillybus_init_endpoint()'

2021-09-14T09:12:56Z

Ths first argument of 'xillybus_init_endpoint()' is now useless. Remove it. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/ba687c1eff5dc8f21422323f57164d06f25d4169.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of remaining deprecated pci_ API

2021-09-14T09:12:56Z

'struct xilly_endpoint' has a 'dev' field which is a 'struct device *' and a 'pdev' field which is 'struct pci_dev *'. Both fields are initialized by 'xillybus_init_endpoint()' and in 'xillybus_pcie.c', we have: xillybus_init_endpoint(pdev, &pdev->dev, &pci_hw); ^ ^ xilly_endpoint.pdev = ___| |___ = xilly_endpoint.dev So the modification from pci_ to dma_ function is straightforward. Update all remaining deprecated pci_ function calls to equivalent dma_ API function. Switching from 'ep->pdev' to 'ep->dev' makes the transformation straightforward. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/19d67ac0208a609aef1e28278b3f2477aa714029.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of 'pci_unmap_single()'

2021-09-14T09:12:56Z

'struct xilly_mapping' includes a 'void *device' field which holds, depending of the context, a 'struct device *' or a 'struct pci_dev *'. This field is then used with 'pci_umap_single()' in 'xillybus_pcie.c' and with 'dma_umap_single()' in 'xillybus_of.c'. In order to remove usage of the deprecated 'pci_unmap_single()' API, turn the 'void *device' field from 'struct xilly_mapping', into an explicit 'struct device *device' and use 'dma_umap_single()' everywhere. In order to update 'xillybus_pcie.c', use the 'dev' field instead of the 'pdev' field from the 'struct xilly_endpoint'. Both fields are initialized by 'xillybus_init_endpoint()' and in 'xillybus_pcie.c', we have: xillybus_init_endpoint(pdev, &pdev->dev, &pci_hw); ^ ^ xilly_endpoint.pdev = ___| |___ = xilly_endpoint.dev So the modification from pci_ to dma_ function is straightforward. While at it, remove a comment that is wrong, because in the case above, both 'dev' and 'pdev' are not NULL. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/baa3f6c7f009d9c231ae320bf1d568268bfef089.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of the deprecated 'pci-dma-compat.h' API

2021-09-14T09:12:56Z

In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant part are given below. 'xilly_pci_direction()' has been hand modified to simplify it slightly. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/e25aa2a804972c5d4f06c4c4e0511e11ff97a425.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Fix spelling mistake "overflew" -> "overflowed"

2021-06-03T12:11:08Z

There is a spelling mistake in a dev_err message. Fix it. Acked-by: Eli Billauer Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210601102201.8489-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove unneeded MODULE_VERSION() usage

2021-06-03T12:10:03Z

MODULE_VERSION is useless for in-kernel drivers, so these are removed from files in drivers/char/xillybus/ Reported-by: Greg Kroah-Hartman Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210528092242.51104-2-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)

2021-05-27T12:07:41Z

The XillyUSB driver is the USB variant for the Xillybus FPGA IP core. Even though it presents a nearly identical API on the FPGA and host, it's almost a complete rewrite of the driver: The framework for exchanging data on a USB bus is fundamentally different from doing the same with a PCIe interface, which leaves very little in common between the existing driver and the new one for XillyUSB. Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210526100311.56327-3-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Move class-related functions to new xillybus_class.c

2021-05-27T12:07:41Z

This patch is a preparation for adding another related driver, XillyUSB. In order to share some code between the existing Xillybus driver and the one to be added, some functions are moved to xillybus_class.c XILLYBUS_CLASS is added to Kconfig and is common to all drivers in this group. The relation with the existing XILLYBUS symbol is "select" rather than "depends on" XILLYBUS_CLASS, or else "make olddefconfig" will silently turn off XILLYBUS, which is currently enabled in several distributions. XILLYBUS_CLASS doesn't depend on anything else, hence using it with "select" poses no risk for a broken configuration. After the future addition of the XillyUSB module, the tree of symbols will be as follows: XILLYBUS_CLASS --+-- XILLYBUS --+-- XILLYBUS_PCIE | | | +-- XILLYBUS_OF | +-- XILLYUSB XILLYBUS is for drivers based upon memory registers + DMA-based interfaces, and it's combined with XILLYBUS_PCIE and/or XILLYBUS_OF. XILLYUSB is for the USB variant only. Or a more detailed, bottom-up outline: * CONFIG_XILLYBUS_PCIE -> xillybus_pcie.c: Functions related to PCIe. * CONFIG_XILLYBUS_OF -> xillybus_of.c: Functions related to Xillybus as a peripheral on an FPGA / Processor combo chip. * CONFIG_XILLYBUS -> xillybus_core.c: Functions that are common to the two above, mainly access to the peripheral with memory-mapped registers and DMA. * CONFIG_XILLYUSB -> xillyusb.c: The driver for the USB variant, accesses the peripheral through the USB framework. * CONFIG_XILLYBUS_CLASS -> xillybus_class.c: The new module, which contains the class and API parts that would otherwise appear both in xillybus_core.c and xillyusb.c. Contains utility functions for the two latter. And since I'm at it, comments on the module names are added in the Kconfig's help part. The functions are exported with the non-GPL EXPORT_SYMBOL (a matter of taste). Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210526100311.56327-2-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman