linux-stable.git/drivers/memstick, branch v5.4.151

memstick: rtsx_usb_ms: fix UAF

2021-07-14T14:53:13+00:00

[ Upstream commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 ]

This patch fixes the following issues:
1. memstick_free_host() will free the host, so the use of ms_dev(host) after
it will be a problem. To fix this, move memstick_free_host() after when we
are done with ms_dev(host).
2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove
and free host otherwise memstick_check will be called and UAF will
happen.

[   11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357077]  rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357376]  platform_remove+0x2a/0x50
[   11.367531] Freed by task 298:
[   11.368537]  kfree+0xa4/0x2a0
[   11.368711]  device_release+0x51/0xe0
[   11.368905]  kobject_put+0xa2/0x120
[   11.369090]  rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms]
[   11.369386]  platform_remove+0x2a/0x50

[   12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0
[   12.045432]  mutex_lock+0xc9/0xd0
[   12.046080]  memstick_check+0x6a/0x578 [memstick]
[   12.046509]  process_one_work+0x46d/0x750
[   12.052107] Freed by task 297:
[   12.053115]  kfree+0xa4/0x2a0
[   12.053272]  device_release+0x51/0xe0
[   12.053463]  kobject_put+0xa2/0x120
[   12.053647]  rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms]
[   12.053939]  platform_remove+0x2a/0x50

Signed-off-by: Tong Zhang 
Co-developed-by: Ulf Hansson 
Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin

memstick: r592: Fix error return in r592_probe()

2020-12-30T10:51:18+00:00

[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]

Fix to return a error code from the error handling case instead of 0.

Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng 
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin

memstick: fix a double-free bug in memstick_check

2020-12-30T10:51:11+00:00

[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]

kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.

Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot 
Signed-off-by: Qinglang Miao 
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson 
Signed-off-by: Sasha Levin

memstick: Skip allocating card when removing host

2020-10-07T06:01:25+00:00

commit 62c59a8786e6bb75569cee91dab66e9da3ff4b68 upstream.

After commit 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power
management"), removing module rtsx_usb_ms will be stuck.

The deadlock is caused by powering on and powering off at the same time,
the former one is when memstick_check() is flushed, and the later is called
by memstick_remove_host().

Soe let's skip allocating card to prevent this issue.

Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management")
Signed-off-by: Kai-Heng Feng 
Link: https://lore.kernel.org/r/20200925084952.13220-1-kai.heng.feng@canonical.com
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson 
Signed-off-by: Greg Kroah-Hartman

memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'

2019-10-09T09:08:03+00:00

If 'jmb38x_ms_count_slots()' returns 0, we must undo the previous
'pci_request_regions()' call.

Goto 'err_out_int' to fix it.

Fixes: 60fdd931d577 ("memstick: add support for JMicron jmb38x MemoryStick host controller")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe JAILLET 
Signed-off-by: Ulf Hansson

ms_block: fix spelling mistake "randomally" -> "randomly"

2019-09-11T14:11:01+00:00

There is a spelling mistake in a dbg_verbose message. Fix it.

Signed-off-by: Colin Ian King 
Signed-off-by: Ulf Hansson

memstick: r592: Use dev_get_drvdata

2019-09-11T13:58:39+00:00

Instead of using to_pci_dev + pci_get_drvdata,
use dev_get_drvdata to make code simpler.

Signed-off-by: Chuhong Yuan 
Signed-off-by: Ulf Hansson

Merge tag 'mmc-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

2019-07-12T01:11:21+00:00

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Let the dma map ops deal with bouncing and drop dma_max_pfn() from
     the dma-mapping interface for ARM
   - Convert the generic MMC DT doc to YAML schemas
   - Drop questionable support for powered-on re-init of SDIO cards at
     runtime resume and for SDIO HW reset
   - Prevent questionable re-init of powered-on removable SDIO cards at
     system resume
   - Cleanup and clarify some SDIO core code

  MMC host:
   - tmio: Make runtime PM enablement more flexible for variants
   - tmio/renesas_sdhi: Rename DT doc tmio_mmc.txt to renesas,sdhi.txt
     to clarify
   - sdhci-pci: Add support for Intel EHL
   - sdhci-pci-o2micro: Enable support for 8-bit bus
   - sdhci-msm: Prevent acquiring a mutex while holding a spin_lock
   - sdhci-of-esdhc: Improve clock management and tuning
   - sdhci_am654: Enable support for 4 and 8-bit bus on J721E
   - sdhci-sprd: Use pinctrl for a proper signal voltage switch
   - sdhci-sprd: Add support for HS400 enhanced strobe mode
   - sdhci-sprd: Enable PHY DLL and allow delay config to stabilize the
     clock
   - sdhci-sprd: Add support for optional gate clock
   - sunxi-mmc: Convert DT doc to YAML schemas
   - meson-gx: Add support for broken DRAM access for DMA

  MEMSTICK core:
   - Fixup error path of memstick_init()"

* tag 'mmc-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (52 commits)
  mmc: sdhci_am654: Add dependency on MMC_SDHCI_AM654
  mmc: alcor: remove a redundant greater or equal to zero comparison
  mmc: sdhci-msm: fix mutex while in spinlock
  mmc: sdhci_am654: Make some symbols static
  dma-mapping: remove dma_max_pfn
  mmc: core: let the dma map ops handle bouncing
  dt-binding: mmc: rename tmio_mmc.txt to renesas,sdhi.txt
  mmc: sdhci-sprd: Add pin control support for voltage switch
  dt-bindings: mmc: sprd: Add pinctrl support
  mmc: sdhci-sprd: Add start_signal_voltage_switch ops
  mmc: sdhci-pci: Add support for Intel EHL
  mmc: tmio: Use dma_max_mapping_size() instead of a workaround
  mmc: sdio: Drop unused in-parameter from mmc_sdio_init_card()
  mmc: sdio: Drop unused in-parameter to mmc_sdio_reinit_card()
  mmc: sdio: Don't re-initialize powered-on removable SDIO cards at resume
  mmc: sdio: Drop powered-on re-init at runtime resume and HW reset
  mmc: sdio: Move comment about re-initialization to mmc_sdio_reinit_card()
  mmc: sdio: Drop mmc_claim|release_host() in mmc_sdio_power_restore()
  mmc: sdio: Turn sdio_run_irqs() into static
  mmc: sdhci: Fix indenting on SDHCI_CTRL_8BITBUS
  ...

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19T15:09:55+00:00

Based on 2 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation #

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 4122 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Enrico Weigelt 
Reviewed-by: Kate Stewart 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
Signed-off-by: Greg Kroah-Hartman

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234

2019-06-19T15:09:07+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation this program is
  distributed in the hope that it will be useful but without any
  warranty without even the implied warranty of merchantability or
  fitness for a particular purpose see the gnu general public license
  for more details you should have received a copy of the gnu general
  public license along with this program if not see http www gnu org
  licenses

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 503 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Alexios Zavras 
Reviewed-by: Allison Randal 
Reviewed-by: Enrico Weigelt 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190602204653.811534538@linutronix.de
Signed-off-by: Greg Kroah-Hartman