linux-stable.git/drivers/hsi, branch linux-5.4.y

HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

2025-05-02T05:39:18+00:00

commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream.

In the ssi_protocol_probe() function, &ssi->work is bound with
ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function
within the ssip_pn_ops structure is capable of starting the
work.

If we remove the module which will call ssi_protocol_remove()
to make a cleanup, it will free ssi through kfree(ssi),
while the work mentioned above will be used. The sequence
of operations that may lead to a UAF bug is as follows:

CPU0                                    CPU1

                        | ssip_xmit_work
ssi_protocol_remove     |
kfree(ssi);             |
                        | struct hsi_client *cl = ssi->cl;
                        | // use ssi

Fix it by ensuring that the work is canceled before proceeding
with the cleanup in ssi_protocol_remove().

Signed-off-by: Kaixin Wang 
Acked-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn
Signed-off-by: Sebastian Reichel 
Signed-off-by: Greg Kroah-Hartman

HSI: omap_ssi_core: Fix error handling in ssi_init()

2023-01-18T10:41:28+00:00

[ Upstream commit 3ffa9f713c39a213a08d9ff13ab983a8aa5d8b5d ]

The ssi_init() returns the platform_driver_register() directly without
checking its return value, if platform_driver_register() failed, the
ssi_pdriver is not unregistered.
Fix by unregister ssi_pdriver when the last platform_driver_register()
failed.

Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
Signed-off-by: Yuan Can 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: omap_ssi_core: fix possible memory leak in ssi_probe()

2023-01-18T10:41:27+00:00

[ Upstream commit 1aff514e1d2bd47854dbbdf867970b9d463d4c57 ]

If ssi_add_controller() returns error, it should call hsi_put_controller()
to give up the reference that was set in hsi_alloc_controller(), so that
it can call hsi_controller_release() to free controller and ports that
allocated in hsi_alloc_controller().

Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver")
Signed-off-by: Yang Yingliang 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()

2023-01-18T10:41:27+00:00

[ Upstream commit f5181c35ed7ba0ceb6e42872aad1334d994b0175 ]

In error label 'out1' path in ssi_probe(), the pm_runtime_enable()
has not been called yet, so pm_runtime_disable() is not needed.

Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver")
Signed-off-by: Yang Yingliang 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: omap_ssi_port: Fix dma_map_sg error check

2022-10-26T11:22:36+00:00

[ Upstream commit 551e325bbd3fb8b5a686ac1e6cf76e5641461cf2 ]

dma_map_sg return 0 on error, in case of error return -EIO
to caller.

Cc: Sebastian Reichel 
Cc: linux-kernel@vger.kernel.org (open list)
Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver")
Signed-off-by: Jack Wang 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: omap_ssi: Fix refcount leak in ssi_probe

2022-10-26T11:22:35+00:00

[ Upstream commit 9a2ea132df860177b33c9fd421b26c4e9a0a9396 ]

When returning or breaking early from a
for_each_available_child_of_node() loop, we need to explicitly call
of_node_put() on the child node to possibly release the node.

Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver")
Signed-off-by: Miaoqian Lin 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: core: Fix return freed object in hsi_new_client

2022-01-27T08:19:41+00:00

[ Upstream commit a1ee1c08fcd5af03187dcd41dcab12fd5b379555 ]

cl is freed on error of calling device_register, but this
object is return later, which will cause uaf issue. Fix it
by return NULL on error.

Signed-off-by: Chengfeng Ye 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: core: fix resource leaks in hsi_add_client_from_dt()

2021-05-14T07:44:25+00:00

[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ]

If some of the allocations fail between the dev_set_name() and the
device_register() then the name will not be freed.  Fix this by
moving dev_set_name() directly in front of the call to device_register().

Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices")
Signed-off-by: Dan Carpenter 
Reviewed-by: Jason Gunthorpe 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: Fix PM usage counter unbalance in ssi_hw_init

2021-03-04T09:26:26+00:00

[ Upstream commit aa57e77b3d28f0df07149d88c47bc0f3aa77330b ]

pm_runtime_get_sync will increment pm usage counter
even it failed. Forgetting to putting operation will
result in reference leak here. We fix it by replacing
it with pm_runtime_resume_and_get to keep usage counter
balanced.

Fixes: b209e047bc743 ("HSI: Introduce OMAP SSI driver")
Signed-off-by: Zhang Qilong 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin

HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()

2020-12-30T10:51:13+00:00

[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]

In current code, it jumps to ida_simple_remove() when ida_simple_get()
failes to allocate an ID. Just return to fix it.

Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
Signed-off-by: Jing Xiangfeng 
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin