linux-stable.git/drivers/of/platform.c, branch v4.17.4

of: platform: stop accessing invalid dev in of_platform_device_destroy

2018-07-03T09:26:54+00:00

commit 522811e944ed9b36806faa019faec10f9d259cca upstream.

Immediately after the platform_device_unregister() the device will be
cleaned up. Accessing the freed pointer immediately after that will
crash the system.

Found this bug when kernel is built with CONFIG_PAGE_POISONING and testing
loading/unloading audio drivers in a loop on Qcom platforms.

Fix this by moving of_node_clear_flag() just before the unregister calls.

Below is the crash trace:

Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c03
Mem abort info:
  ESR = 0x96000021
  Exception class = DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000021
  CM = 0, WnR = 0
[006b6b6b6b6b6c03] address between user and kernel address ranges
Internal error: Oops: 96000021 [#1] PREEMPT SMP
Modules linked in:
CPU: 2 PID: 1784 Comm: sh Tainted: G        W         4.17.0-rc7-02230-ge3a63a7ef641-dirty #204
Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : clear_bit+0x18/0x2c
lr : of_platform_device_destroy+0x64/0xb8
sp : ffff00000c9c3930
x29: ffff00000c9c3930 x28: ffff80003d39b200
x27: ffff000008bb1000 x26: 0000000000000040
x25: 0000000000000124 x24: ffff80003a9a3080
x23: 0000000000000060 x22: ffff00000939f518
x21: ffff80003aa79e98 x20: ffff80003aa3dae0
x19: ffff80003aa3c890 x18: ffff800009feb794
x17: 0000000000000000 x16: 0000000000000000
x15: ffff800009feb790 x14: 0000000000000000
x13: ffff80003a058778 x12: ffff80003a058728
x11: ffff80003a058750 x10: 0000000000000000
x9 : 0000000000000006 x8 : ffff80003a825988
x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000001
x5 : 0000000000000000 x4 : 0000000000000001
x3 : 0000000000000008 x2 : 0000000000000001
x1 : 6b6b6b6b6b6b6c03 x0 : 0000000000000000
Process sh (pid: 1784, stack limit = 0x        (ptrval))
Call trace:
 clear_bit+0x18/0x2c
 q6afe_remove+0x20/0x38
 apr_device_remove+0x30/0x70
 device_release_driver_internal+0x170/0x208
 device_release_driver+0x14/0x20
 bus_remove_device+0xcc/0x150
 device_del+0x10c/0x310
 device_unregister+0x1c/0x70
 apr_remove_device+0xc/0x18
 device_for_each_child+0x50/0x80
 apr_remove+0x18/0x20
 rpmsg_dev_remove+0x38/0x68
 device_release_driver_internal+0x170/0x208
 device_release_driver+0x14/0x20
 bus_remove_device+0xcc/0x150
 device_del+0x10c/0x310
 device_unregister+0x1c/0x70
 qcom_smd_remove_device+0xc/0x18
 device_for_each_child+0x50/0x80
 qcom_smd_unregister_edge+0x3c/0x70
 smd_subdev_remove+0x18/0x28
 rproc_stop+0x48/0xd8
 rproc_shutdown+0x60/0xe8
 state_store+0xbc/0xf8
 dev_attr_store+0x18/0x28
 sysfs_kf_write+0x3c/0x50
 kernfs_fop_write+0x118/0x1e0
 __vfs_write+0x18/0x110
 vfs_write+0xa4/0x1a8
 ksys_write+0x48/0xb0
 sys_write+0xc/0x18
 el0_svc_naked+0x30/0x34
Code: d2800022 8b400c21 f9800031 9ac32043 (c85f7c22)
---[ end trace 32020935775616a2 ]---

Signed-off-by: Srinivas Kandagatla 
Cc: stable@vger.kernel.org
Signed-off-by: Rob Herring 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2018-02-02T00:35:31+00:00

Pull ARM SoC driver updates from Arnd Bergmann:
 "A number of new drivers get added this time, along with many
  low-priority bugfixes. The most interesting changes by subsystem are:

  bus drivers:
   - Updates to the Broadcom bus interface driver to support newer SoC
     types
   - The TI OMAP sysc driver now supports updated DT bindings

  memory controllers:
   - A new driver for Tegra186 gets added
   - A new driver for the ti-emif sram, to allow relocating
     suspend/resume handlers there

  SoC specific:
   - A new driver for Qualcomm QMI, the interface to the modem on MSM
     SoCs
   - A new driver for power domains on the actions S700 SoC
   - A driver for the Xilinx Zynq VCU logicoreIP

  reset controllers:
   - A new driver for Amlogic Meson-AGX
   - various bug fixes

  tee subsystem:
   - A new user interface got added to enable asynchronous communication
     with the TEE supplicant.
   - A new method of using user space memory for communication with the
     TEE is added"

* tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (84 commits)
  of: platform: fix OF node refcount leak
  soc: fsl: guts: Add a NULL check for devm_kasprintf()
  bus: ti-sysc: Fix smartreflex sysc mask
  psci: add CPU_IDLE dependency
  soc: xilinx: Fix Kconfig alignment
  soc: xilinx: xlnx_vcu: Use bitwise & rather than logical && on clkoutdiv
  soc: xilinx: xlnx_vcu: Depends on HAS_IOMEM for xlnx_vcu
  soc: bcm: brcmstb: Be multi-platform compatible
  soc: brcmstb: biuctrl: exit without warning on non brcmstb platforms
  Revert "soc: brcmstb: Only register SoC device on STB platforms"
  bus: omap: add MODULE_LICENSE tags
  soc: brcmstb: Only register SoC device on STB platforms
  tee: shm: Potential NULL dereference calling tee_shm_register()
  soc: xilinx: xlnx_vcu: Add Xilinx ZYNQMP VCU logicoreIP init driver
  dt-bindings: soc: xilinx: Add DT bindings to xlnx_vcu driver
  soc: xilinx: Create folder structure for soc specific drivers
  of: platform: populate /firmware/ node from of_platform_default_populate_init()
  soc: samsung: Add SPDX license identifiers
  soc: qcom: smp2p: Use common error handling code in qcom_smp2p_probe()
  tee: shm: don't put_page on null shm->pages
  ...

of: platform: fix OF node refcount leak

2018-01-23T09:15:11+00:00

We need to call of_node_put() for device nodes obtained with
of_find_node_by_path().

Fixes: 3aa0582fdb82 ("of: platform: populate /firmware/ node from of_platform_default_populate_init()")
Reported-by: Loys Ollivier 
Cc: Frank Rowand 
Signed-off-by: Sudeep Holla 
Acked-by: Rob Herring 
Signed-off-by: Andy Gross 
Signed-off-by: Arnd Bergmann

of: Use SPDX license tag for DT files

2018-01-08T14:22:45+00:00

Convert remaining DT files to use SPDX-License-Identifier tags.

Cc: Benjamin Herrenschmidt 
Cc: Guennadi Liakhovetski 
Cc: Paul Mackerras 
Cc: Pantelis Antoniou 
Reviewed-by: Frank Rowand 
Reviewed-by: Philippe Ombredanne 
Signed-off-by: Rob Herring

of: platform: populate /firmware/ node from of_platform_default_populate_init()

2018-01-04T20:00:20+00:00

Since "/firmware" does not have its own "compatible" property as it's
just collection of nodes representing firmware interface, it's sub-nodes
are not populated during system initialization.

Currently different firmware drivers search the /firmware/ node and
populate the sub-node devices selectively. Instead we can populate
the /firmware/ node during init to avoid more drivers continuing to
populate the devices selectively.

To generalize the solution this patch populates the /firmware/ node
explicitly from of_platform_default_populate_init().

Cc: Arnd Bergmann 
Cc: Rob Herring 
Signed-off-by: Sudeep Holla 
Acked-by: Rob Herring 
Acked-by: Bjorn Andersson 
Tested-by: Bjorn Andersson 
Signed-off-by: Andy Gross

soc: qcom: Remote filesystem memory driver

2017-10-22T10:06:34+00:00

The Qualcomm remote file system protocol is used by certain remoteprocs,
in particular the modem, to read and write persistent storage in
platforms where only the application CPU has physical storage access.

The protocol is based on a set of QMI-encoded control-messages and a
shared memory buffer for exchaning the data. This driver implements the
latter, providing the user space service access to the carved out chunk
of memory.

Acked-by: Rob Herring 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Andy Gross

of/platform: Generalize /reserved-memory handling

2017-10-22T10:06:33+00:00

By iterating over all /reserved-memory child nodes and match each one to
a list of compatibles that we want to treat specially, we can easily
extend the list of compatibles to handle - without having to resort to
of_platform_populate() that would create unnecessary platform_devices.

Reviewed-by: Rob Herring 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Andy Gross

of: Use PLATFORM_DEVID_NONE definition

2017-08-25T15:50:31+00:00

Use dedicated definition instead of plain -1 where it's appropriate.

No functional change intended.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Rob Herring

of: Convert to using %pOF instead of full_name

2017-07-18T22:09:18+00:00

Now that we have a custom printf format specifier, convert users of
full_name to use %pOF instead. This is preparation to remove storing
of the full path string for each node.

Signed-off-by: Rob Herring

Merge tag 'devicetree-for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2017-07-07T17:37:54+00:00

Pull DeviceTree updates from Rob Herring:

- vsprintf format specifier %pOF for device_node's. This will enable us
to stop storing the full node names. Conversion of users will happen
next cycle.

- Update documentation to point to DT specification instead of ePAPR.

- Split out graph and property functions to a separate file.

- New of-graph functions for ALSA

- Add vendor prefixes for RISC-V, Linksys, iWave Systems, Roofull,
Itead, and BananaPi.

- Improve dtx_diff utility filename printing.

* tag 'devicetree-for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (32 commits)
of: document /sys/firmware/fdt
dt-bindings: Add RISC-V vendor prefix
vsprintf: Add %p extension "%pOF" for device tree
of: find_node_by_full_name rewrite to compare each level
of: use kbasename instead of open coding
dt-bindings: thermal: add file extension to brcm,ns-thermal
of: update ePAPR references to point to Devicetree Specification
scripts/dtc: dtx_diff - Show real file names in diff header
of: detect invalid phandle in overlay
of: be consistent in form of file mode
of: make __of_attach_node() static
of: address.c header comment typo
of: fdt.c header comment typo
of: make of_fdt_is_compatible() static
dt-bindings: display-timing.txt convert non-ascii characters to ascii
Documentation: remove overlay-notes reference to non-existent file
dt-bindings: usb: exynos-usb: Add missing required VDD properties
dt-bindings: Add vendor prefix for Linksys
MAINTAINERS: add device tree ABI documentation file
of: Add vendor prefix for iWave Systems Technologies Pvt. Ltd
...