linux-stable.git/drivers/memstick/host, branch v5.13.2

memstick: rtsx_usb_ms: fix UAF

2021-07-14T15:06:25+00:00

[ Upstream commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 ]

This patch fixes the following issues:
1. memstick_free_host() will free the host, so the use of ms_dev(host) after
it will be a problem. To fix this, move memstick_free_host() after when we
are done with ms_dev(host).
2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove
and free host otherwise memstick_check will be called and UAF will
happen.

[   11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357077]  rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357376]  platform_remove+0x2a/0x50
[   11.367531] Freed by task 298:
[   11.368537]  kfree+0xa4/0x2a0
[   11.368711]  device_release+0x51/0xe0
[   11.368905]  kobject_put+0xa2/0x120
[   11.369090]  rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms]
[   11.369386]  platform_remove+0x2a/0x50

[   12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0
[   12.045432]  mutex_lock+0xc9/0xd0
[   12.046080]  memstick_check+0x6a/0x578 [memstick]
[   12.046509]  process_one_work+0x46d/0x750
[   12.052107] Freed by task 297:
[   12.053115]  kfree+0xa4/0x2a0
[   12.053272]  device_release+0x51/0xe0
[   12.053463]  kobject_put+0xa2/0x120
[   12.053647]  rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms]
[   12.053939]  platform_remove+0x2a/0x50

Signed-off-by: Tong Zhang 
Co-developed-by: Ulf Hansson 
Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin

memstick: r592: ignore kfifo_out() return code again

2021-04-26T09:08:23+00:00

A minor cleanup to address a clang warning removed an assigned
but unused local variable, but this now caused a gcc warning as
kfifo_out() is annotated to require checking its return code:

In file included from drivers/memstick/host/r592.h:13,
                 from drivers/memstick/host/r592.c:21:
drivers/memstick/host/r592.c: In function 'r592_flush_fifo_write':
include/linux/kfifo.h:588:1: error: ignoring return value of '__kfifo_uint_must_check_helper' declared with attribute 'warn_unused_result' [-Werror=unused-result]
  588 | __kfifo_uint_must_check_helper( \
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  589 | ({ \
      | ~~~~
  590 |         typeof((fifo) + 1) __tmp = (fifo); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  591 |         typeof(__tmp->ptr) __buf = (buf); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  592 |         unsigned long __n = (n); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~
  593 |         const size_t __recsize = sizeof(*__tmp->rectype); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  594 |         struct __kfifo *__kfifo = &__tmp->kfifo; \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  595 |         (__recsize) ?\
      |         ~~~~~~~~~~~~~~
  596 |         __kfifo_out_r(__kfifo, __buf, __n, __recsize) : \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  597 |         __kfifo_out(__kfifo, __buf, __n); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  598 | }) \
      | ~~~~
  599 | )
      | ~
drivers/memstick/host/r592.c:367:9: note: in expansion of macro 'kfifo_out'
  367 |         kfifo_out(&dev->pio_fifo, buffer, 4);
      |         ^~~~~~~~~

The value was never checked here, and the purpose of the function
is only to flush the contents, so restore the old behavior but
add a cast to void and a comment, which hopefully warns with neither
gcc nor clang now.

If anyone has an idea for how to fix it without ignoring the return
code, that is probably better.

Fixes: 4b00ed3c5072 ("memstick: r592: remove unused variable")
Signed-off-by: Arnd Bergmann 
Link: https://lore.kernel.org/r/20210421135215.3414589-1-arnd@kernel.org
Signed-off-by: Ulf Hansson

memstick: r592: remove unused variable

2021-04-15T09:00:03+00:00

Fix the following clang warning:

drivers/memstick/host/r592.c:363:6: warning: variable ‘len’ set but not
used [-Wunused-but-set-variable].

Reported-by: Abaci Robot 
Signed-off-by: Jiapeng Chong 
Link: https://lore.kernel.org/r/1618366903-94346-1-git-send-email-jiapeng.chong@linux.alibaba.com
Signed-off-by: Ulf Hansson

memstick: r592: Fix error return in r592_probe()

2020-12-04T11:27:10+00:00

Fix to return a error code from the error handling case instead of 0.

Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng 
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson

memstick: tifm: remove unneeded semicolon

2020-11-16T10:59:28+00:00

A semicolon is not needed after a switch statement.

Signed-off-by: Tom Rix 
Link: https://lore.kernel.org/r/20201031142756.2140029-1-trix@redhat.com
Signed-off-by: Ulf Hansson

memstick: jmb38x_ms: remove unneeded semicolon

2020-11-16T10:59:28+00:00

A semicolon is not needed after a switch statement.

Signed-off-by: Tom Rix 
Link: https://lore.kernel.org/r/20201031142505.2139539-1-trix@redhat.com
Signed-off-by: Ulf Hansson

treewide: Use fallthrough pseudo-keyword

2020-08-23T22:36:59+00:00

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva

Merge tag 'mmc-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

2020-08-05T20:23:24+00:00

Pull MMC updates from Ulf Hansson:
 "MMC core:

   - Add a new host cap bit and a corresponding DT property, to support
     power cycling of the card by FW at system suspend/resume.

   - Fix clock rate setting for SDIO in SDR12/SDR25 speed-mode

   - Fix switch to 1/4-bit mode at system suspend/resume for SD-combo
     cards

   - Convert the mmc-pwrseq DT bindings to the json-schema

   - Always allow the card detect uevent to be consumed by userspace

  MMC host controllers:

   - Convert a few DT bindings to the json-schema

   - mtk-sd:
      - Add support for command queue through cqhci
      - Add support for the MT6779 variant

   - renesas_sdhi_internal_dmac:
      - Fix dma unmapping in the error path

   - sdhci_am654:
      - Add support for the AM65x PG2.0 variant
      - Extend support for phys/clocks

   - sdhci-cadence:
      - Drop incorrect HW tuning for SD mode

   - sdhci-msm:
      - Add support for interconnect bandwidth scaling
      - Enable internal voltage control
      - Enable low power state for pinctrls

   - sdhci-of-at91:
      - Ludovic Desroches handovers maintenance to Eugen Hristev

   - sdhci-pci-gli:
      - Improve clock handling for GL975x

   - sdhci-pci-o2micro:
      - Add HW tuning for SDR104 mode
      - Fix support for O2 host controller Seabird1"

* tag 'mmc-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (66 commits)
  mmc: mediatek: make function msdc_cqe_disable() static
  MAINTAINERS: mmc: sdhci-of-at91: handover maintenance to Eugen Hristev
  dt-bindings: mmc: mediatek: Add document for mt6779
  mmc: mediatek: command queue support
  mmc: mediatek: refine msdc timeout api
  mmc: mediatek: add MT6779 MMC driver support
  mmc: sdhci-pci-o2micro: Add HW tuning for SDR104 mode
  mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1
  mmc: via-sdmmc: use generic power management
  memstick: jmb38x_ms: use generic power management
  mmc: sdhci-cadence: do not use hardware tuning for SD mode
  mmc: sdhci-pci-gli: Set SDR104's clock to 205MHz and enable SSC for GL975x
  mmc: cqhci: Fix a print format for the task descriptor
  mmc: sdhci-of-arasan: fix timings allocation code
  mmc: sdhci: Fix a potential uninitialized variable
  dt-bindings: mmc: renesas,sdhi: convert to YAML
  dt-bindings: mmc: convert arasan sdhci bindings to yaml
  mmc: sdhci: Fix potential null pointer access while accessing vqmmc
  mmc: core: Add MMC_CAP2_FULL_PWR_CYCLE_IN_SUSPEND
  dt-bindings: mmc: Add full-pwr-cycle-in-suspend property
  ...

memstick: jmb38x_ms: use generic power management

2020-07-24T10:24:13+00:00

Drivers using legacy PM have to manage PCI states and device's PM states
themselves. They also need to take care of configuration registers.

With improved and powerful support of generic PM, PCI Core takes care of
above mentioned, device-independent, jobs.

This driver makes use of PCI helper functions like
pci_save/restore_state(), pci_enable/disable_device(),
pci_set_power_state() and pci_set_master() to do required operations. In
generic mode, they are no longer needed.

Change function parameter in both .suspend() and .resume() to
"struct device*" type. Use to_pci_dev() and dev_get_drvdata() to get
"struct pci_dev*" variable and drv data.

Compile-tested only.

Signed-off-by: Vaibhav Gupta 
Link: https://lore.kernel.org/r/20200720111625.306681-1-vaibhavgupta40@gmail.com
Signed-off-by: Ulf Hansson

treewide: Remove uninitialized_var() usage

2020-07-16T19:35:15+00:00

Using uninitialized_var() is dangerous as it papers over real bugs[1]
(or can in the future), and suppresses unrelated compiler warnings
(e.g. "unused variable"). If the compiler thinks it is uninitialized,
either simply initialize the variable or make compiler changes.

In preparation for removing[2] the[3] macro[4], remove all remaining
needless uses with the following script:

git grep '\buninitialized_var\b' | cut -d: -f1 | sort -u | \
	xargs perl -pi -e \
		's/\buninitialized_var\(([^\)]+)\)/\1/g;
		 s:\s*/\* (GCC be quiet|to make compiler happy) \*/$::g;'

drivers/video/fbdev/riva/riva_hw.c was manually tweaked to avoid
pathological white-space.

No outstanding warnings were found building allmodconfig with GCC 9.3.0
for x86_64, i386, arm64, arm, powerpc, powerpc64le, s390x, mips, sparc64,
alpha, and m68k.

[1] https://lore.kernel.org/lkml/20200603174714.192027-1-glider@google.com/
[2] https://lore.kernel.org/lkml/CA+55aFw+Vbj0i=1TGqCR5vQkCzWJ0QxK6CernOU6eedsudAixw@mail.gmail.com/
[3] https://lore.kernel.org/lkml/CA+55aFwgbgqhbp1fkxvRKEpzyR5J8n1vKT1VZdz9knmPuXhOeg@mail.gmail.com/
[4] https://lore.kernel.org/lkml/CA+55aFz2500WfbKXAx8s67wrm9=yVJu65TpLgN_ybYNv0VEOKA@mail.gmail.com/

Reviewed-by: Leon Romanovsky  # drivers/infiniband and mlx4/mlx5
Acked-by: Jason Gunthorpe  # IB
Acked-by: Kalle Valo  # wireless drivers
Reviewed-by: Chao Yu  # erofs
Signed-off-by: Kees Cook