linux-stable.git/drivers/base/property.c, branch v4.6

device property: Avoid potential dereferences of invalid pointers

2016-04-27T21:40:02+00:00

Since fwnode may hold ERR_PTR(-ENODEV) or it may be NULL,
the fwnode type checks is_of_node(), is_acpi_node() and is
is_pset_node() need to consider it. Using IS_ERR_OR_NULL()
to check it.

Fixes: 0d67e0fa1664 (device property: fix for a case of use-after-free)
Reported-by: Dan Carpenter 
Signed-off-by: Heikki Krogerus 
[ rjw: Subject & changelog ]
Signed-off-by: Rafael J. Wysocki

device property: convert to use match_string() helper

2016-03-17T22:09:34+00:00

The new helper returns index of the mathing string in an array.  We
would use it here.

Signed-off-by: Andy Shevchenko 
Reviewed-by: Mika Westerberg 
Acked-by: Rafael J. Wysocki 
Cc: Rasmus Villemoes 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

device property: fix for a case of use-after-free

2016-03-10T20:33:16+00:00

In device_remove_property_set(), the secondary fwnode needs
to be cleared before the pset is freed. This fixes a
use-after-free when a property set is providing the primary
fwnode.

As a result of the fix, the primary fwnode may end up
containing ERR_PTR(-ENODEV), so also adding checks for it to
the property handling code.

Reported-by: John Youn 
Signed-off-by: Heikki Krogerus 
Signed-off-by: Rafael J. Wysocki

device property: fwnode->secondary may contain ERR_PTR(-ENODEV)

2016-03-09T00:07:43+00:00

This fixes BUG triggered when fwnode->secondary is not NULL,
but has ERR_PTR(-ENODEV) instead.

BUG: unable to handle kernel paging request at ffffffffffffffed
IP: [] __fwnode_property_read_string+0x26/0x160
PGD 200e067 PUD 2010067 PMD 0
Oops: 0000 [#1] SMP KASAN
Modules linked in: dwc3_pci(+) dwc3
CPU: 0 PID: 1138 Comm: modprobe Not tainted 4.5.0-rc5+ #61
task: ffff88015aaf5b00 ti: ffff88007b958000 task.ti: ffff88007b958000
RIP: 0010:[]  [] __fwnode_property_read_string+0x26/0x160
RSP: 0018:ffff88007b95eff8  EFLAGS: 00010246
RAX: fffffbfffffffffd RBX: ffffffffffffffed RCX: ffff88015999cd37
RDX: dffffc0000000000 RSI: ffffffff81e11bc0 RDI: ffffffffffffffed
RBP: ffff88007b95f020 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88007b90f7cf R11: 0000000000000000 R12: ffff88007b95f0a0
R13: 00000000fffffffa R14: ffffffff81e11bc0 R15: ffff880159ea37a0
FS:  00007ff35f46c700(0000) GS:ffff88015b800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffffffffffed CR3: 000000007b8be000 CR4: 00000000001006f0
Stack:
 ffff88015999cd20 ffffffff81e11bc0 ffff88007b95f0a0 ffff88007b383dd8
 ffff880159ea37a0 ffff88007b95f048 ffffffff81677d03 ffff88007b952460
 ffffffff81e11bc0 ffff88007b95f0a0 ffff88007b95f070 ffffffff81677d40
Call Trace:
 [] fwnode_property_read_string+0x43/0x50
 [] device_property_read_string+0x30/0x40
...

Fixes: 362c0b30249e (device property: Fallback to secondary fwnode if primary misses the property)
Signed-off-by: Heikki Krogerus 
Signed-off-by: Rafael J. Wysocki

device property: avoid allocations of 0 length

2016-01-01T01:09:51+00:00

Arrays can not have zero elements by definition of the unified device
properties. If such property comes from outside we should not allow it to pass.
Otherwise memory allocation on 0 length will return non-NULL value, which we
currently don't check.

Prevent memory allocations of 0 length.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Rafael J. Wysocki

device property: the secondary fwnode needs to depend on the primary

2016-01-01T01:09:51+00:00

This fixes NULL pointer dereference when the primary fwnode handle
does not exist, for example with PCI devices that do not have ACPI
companion.

Signed-off-by: Heikki Krogerus 
Signed-off-by: Andy Shevchenko 
Signed-off-by: Rafael J. Wysocki

device property: Take a copy of the property set

2015-12-07T01:29:23+00:00

It is convenient if the property set associated with the device secondary
firmware node is a copy of the original. This allows passing property set
from a stack for example for devices created dynamically. This also ties
the property set lifetime to the associated device.

Because of that we provide new function device_remove_property_set() that
is used to disassociate and release memory allocated for the property set.

Signed-off-by: Mika Westerberg 
Signed-off-by: Andy Shevchenko 
Signed-off-by: Rafael J. Wysocki

device property: Fallback to secondary fwnode if primary misses the property

2015-12-07T01:29:23+00:00

The struct fwnode has notion of secondary fwnode. This is supposed to used
as fallback if the primary firmware interface (DT, ACPI) does not have the
property in question.

However, the current implementation never checks the secondary node which
prevents one to add default "built-in" properties to devices.

This patch adds fallback to the secondary fwnode if the primary fwnode
returns that the property does not exists.

Signed-off-by: Mika Westerberg 
Signed-off-by: Andy Shevchenko 
Signed-off-by: Rafael J. Wysocki

device property: improve readability of macros

2015-12-07T01:29:23+00:00

There is no functional change.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Rafael J. Wysocki

device property: keep single value inplace

2015-12-07T01:29:22+00:00

We may save a lot of lines of code and space by keeping single values inside
the struct property_entry. Refactor the implementation to do so.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Rafael J. Wysocki