kernel.git/drivers/char/xillybus, branch linux-6.3.y

char: xillybus: Fix trivial bug with mutex

2022-11-23T18:44:04Z

@unit_mutex protects @unit from being freed, so obviously it should be released after @unit is used, and not before. This is a follow-up to commit 282a4b71816b ("char: xillybus: Prevent use-after-free due to race condition") which ensures, among others, the protection of @private_data after @unit_mutex has been released. Reported-by: Hyunwoo Kim Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20221117071825.3942-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Prevent use-after-free due to race condition

2022-11-11T09:32:41Z

The driver for XillyUSB devices maintains a kref reference count on each xillyusb_dev structure, which represents a physical device. This reference count reaches zero when the device has been disconnected and there are no open file descriptors that are related to the device. When this occurs, kref_put() calls cleanup_dev(), which clears up the device's data, including the structure itself. However, when xillyusb_open() is called, this reference count becomes tricky: This function needs to obtain the xillyusb_dev structure that relates to the inode's major and minor (as there can be several such). xillybus_find_inode() (which is defined in xillybus_class.c) is called for this purpose. xillybus_find_inode() holds a mutex that is global in xillybus_class.c to protect the list of devices, and releases this mutex before returning. As a result, nothing protects the xillyusb_dev's reference counter from being decremented to zero before xillyusb_open() increments it on its own behalf. Hence the structure can be freed due to a rare race condition. To solve this, a mutex is added. It is locked by xillyusb_open() before the call to xillybus_find_inode() and is released only after the kref counter has been incremented on behalf of the newly opened inode. This protects the kref reference counters of all xillyusb_dev structs from being decremented by xillyusb_disconnect() during this time segment, as the call to kref_put() in this function is done with the same lock held. There is no need to hold the lock on other calls to kref_put(), because if xillybus_find_inode() finds a struct, xillyusb_disconnect() has not made the call to remove it, and hence not made its call to kref_put(), which takes place afterwards. Hence preventing xillyusb_disconnect's call to kref_put() is enough to ensure that the reference doesn't reach zero before it's incremented by xillyusb_open(). It would have been more natural to increment the reference count in xillybus_find_inode() of course, however this function is also called by Xillybus' driver for PCIe / OF, which registers a completely different structure. Therefore, xillybus_find_inode() treats these structures as void pointers, and accordingly can't make any changes. Reported-by: Hyunwoo Kim Suggested-by: Alan Stern Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20221030094209.65916-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: fix a refcount leak in cleanup_dev()

2022-04-24T15:30:45Z

usb_get_dev is called in xillyusb_probe. So it is better to call usb_put_dev before xdev is released. Acked-by: Eli Billauer Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220406075703.23464-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: replace usage of found with dedicated list iterator variable

2022-04-24T15:24:12Z

To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1]. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Acked-by: Eli Billauer Signed-off-by: Jakob Koschel Link: https://lore.kernel.org/r/20220324070939.59297-1-jakobkoschel@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: fix msg_ep UAF in xillyusb_probe()

2021-10-19T07:40:18Z

When endpoint_alloc() return failed in xillyusb_setup_base_eps(), 'xdev->msg_ep' will be freed but not set to NULL. That lets program enter fail handling to cleanup_dev() in xillyusb_probe(). Check for 'xdev->msg_ep' is invalid in cleanup_dev() because 'xdev->msg_ep' did not set to NULL when was freed. So the UAF problem for 'xdev->msg_ep' is triggered. ================================================================== BUG: KASAN: use-after-free in fifo_mem_release+0x1f4/0x210 CPU: 0 PID: 166 Comm: kworker/0:2 Not tainted 5.15.0-rc5+ #19 Call Trace: dump_stack_lvl+0xe2/0x152 print_address_description.constprop.0+0x21/0x140 ? fifo_mem_release+0x1f4/0x210 kasan_report.cold+0x7f/0x11b ? xillyusb_probe+0x530/0x700 ? fifo_mem_release+0x1f4/0x210 fifo_mem_release+0x1f4/0x210 ? __sanitizer_cov_trace_pc+0x1d/0x50 endpoint_dealloc+0x35/0x2b0 cleanup_dev+0x90/0x120 xillyusb_probe+0x59a/0x700 ... Freed by task 166: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x109/0x140 kfree+0x117/0x4c0 xillyusb_probe+0x606/0x700 Set 'xdev->msg_ep' to NULL after being freed in xillyusb_setup_base_eps() to fix the UAF problem. Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)") Cc: stable Acked-by: Eli Billauer Signed-off-by: Ziyang Xuan Link: https://lore.kernel.org/r/20211016052047.1611983-1-william.xuanziyang@huawei.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Eliminate redundant wrappers to DMA related calls

2021-10-05T14:11:11Z

The driver was originally written with the assumption that a different API must be used for DMA-related functions if the device is PCIe based or if not. Since Xillybus' driver supports devices on a PCIe bus (with xillybus_pcie) as well as connected directly to the processor (with xillybus_of), it originally used wrapper functions that ensure that a different API is used for each. This patch eliminates the said wrapper functions, as all use the same dma_* API now. This is most notable by the code deleted in xillybus_pcie.c and xillybus_of.c. It also eliminates the OF driver's check for a "dma-coherent" attribute in the device's OF entry, since this is taken care of by the kernel's implementation of dma_sync_single_for_*(). There is however still need for one wrapper function, which is merged from xillybus_pcie.c and xillybus_of.c into xillybus_core.c: The call to dma_map_single() is wrapped by a function that uses the Managed Device (devres) framework, in the absence of a relevant function in the current kernel's API. Suggested-by: Christophe JAILLET Suggested-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210929094442.46383-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Simplify 'xillybus_init_endpoint()'

2021-09-14T09:12:56Z

Ths first argument of 'xillybus_init_endpoint()' is now useless. Remove it. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/ba687c1eff5dc8f21422323f57164d06f25d4169.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of remaining deprecated pci_ API

2021-09-14T09:12:56Z

'struct xilly_endpoint' has a 'dev' field which is a 'struct device *' and a 'pdev' field which is 'struct pci_dev *'. Both fields are initialized by 'xillybus_init_endpoint()' and in 'xillybus_pcie.c', we have: xillybus_init_endpoint(pdev, &pdev->dev, &pci_hw); ^ ^ xilly_endpoint.pdev = ___| |___ = xilly_endpoint.dev So the modification from pci_ to dma_ function is straightforward. Update all remaining deprecated pci_ function calls to equivalent dma_ API function. Switching from 'ep->pdev' to 'ep->dev' makes the transformation straightforward. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/19d67ac0208a609aef1e28278b3f2477aa714029.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of 'pci_unmap_single()'

2021-09-14T09:12:56Z

'struct xilly_mapping' includes a 'void *device' field which holds, depending of the context, a 'struct device *' or a 'struct pci_dev *'. This field is then used with 'pci_umap_single()' in 'xillybus_pcie.c' and with 'dma_umap_single()' in 'xillybus_of.c'. In order to remove usage of the deprecated 'pci_unmap_single()' API, turn the 'void *device' field from 'struct xilly_mapping', into an explicit 'struct device *device' and use 'dma_umap_single()' everywhere. In order to update 'xillybus_pcie.c', use the 'dev' field instead of the 'pdev' field from the 'struct xilly_endpoint'. Both fields are initialized by 'xillybus_init_endpoint()' and in 'xillybus_pcie.c', we have: xillybus_init_endpoint(pdev, &pdev->dev, &pci_hw); ^ ^ xilly_endpoint.pdev = ___| |___ = xilly_endpoint.dev So the modification from pci_ to dma_ function is straightforward. While at it, remove a comment that is wrong, because in the case above, both 'dev' and 'pdev' are not NULL. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/baa3f6c7f009d9c231ae320bf1d568268bfef089.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of the deprecated 'pci-dma-compat.h' API

2021-09-14T09:12:56Z

In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant part are given below. 'xilly_pci_direction()' has been hand modified to simplify it slightly. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/e25aa2a804972c5d4f06c4c4e0511e11ff97a425.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman