linux-stable.git/drivers/rapidio, branch linux-4.9.y

rapidio: devices: fix missing put_device in mport_cdev_open

2023-01-07T11:07:15+00:00

[ Upstream commit d5b6e6eba3af11cb2a2791fa36a2524990fcde1a ]

When kfifo_alloc fails, the refcount of chdev->dev is left incremental.
We should use put_device(&chdev->dev) to decrease the ref count of
chdev->dev to avoid refcount leak.

Link: https://lkml.kernel.org/r/20221203085721.13146-1-caixinchen1@huawei.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Cai Xinchen 
Cc: Alexandre Bounine 
Cc: Dan Carpenter 
Cc: Jakob Koschel 
Cc: John Hubbard 
Cc: Matt Porter 
Cc: Wang Weiyang 
Cc: Yang Yingliang 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: fix possible UAF when kfifo_alloc() fails

2023-01-07T11:07:15+00:00

[ Upstream commit 02d7d89f816951e0862147d751b1150d67aaebdd ]

If kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free
priv. But priv is still in the chdev->file_list, then list traversal
may cause UAF. This fixes the following smatch warning:

drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list

Link: https://lkml.kernel.org/r/20221123095147.52408-1-wangweiyang2@huawei.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Wang Weiyang 
Cc: Alexandre Bounine 
Cc: Dan Carpenter 
Cc: Jakob Koschel 
Cc: John Hubbard 
Cc: Matt Porter 
Cc: Yang Yingliang 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: rio: fix possible name leak in rio_register_mport()

2023-01-07T11:07:14+00:00

[ Upstream commit e92a216d16bde65d21a3227e0fb2aa0794576525 ]

If device_register() returns error, the name allocated by dev_set_name()
need be freed.  It should use put_device() to give up the reference in the
error path, so that the name can be freed in kobject_cleanup(), and
list_del() is called to delete the port from rio_mports.

Link: https://lkml.kernel.org/r/20221114152636.2939035-3-yangyingliang@huawei.com
Fixes: 2aaf308b95b2 ("rapidio: rework device hierarchy and introduce mport class of devices")
Signed-off-by: Yang Yingliang 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: fix possible name leaks when rio_add_device() fails

2023-01-07T11:07:14+00:00

[ Upstream commit f9574cd48679926e2a569e1957a5a1bcc8a719ac ]

Patch series "rapidio: fix three possible memory leaks".

This patchset fixes three name leaks in error handling.
 - patch #1 fixes two name leaks while rio_add_device() fails.
 - patch #2 fixes a name leak while  rio_register_mport() fails.

This patch (of 2):

If rio_add_device() returns error, the name allocated by dev_set_name()
need be freed.  It should use put_device() to give up the reference in the
error path, so that the name can be freed in kobject_cleanup(), and the
'rdev' can be freed in rio_release_dev().

Link: https://lkml.kernel.org/r/20221114152636.2939035-1-yangyingliang@huawei.com
Link: https://lkml.kernel.org/r/20221114152636.2939035-2-yangyingliang@huawei.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
Signed-off-by: Yang Yingliang 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: handle create_workqueue() failure

2021-05-26T09:29:06+00:00

commit 69ce3ae36dcb03cdf416b0862a45369ddbf50fdf upstream.

In case create_workqueue() fails, release all resources and return -ENOMEM
to caller to avoid potential NULL pointer deref later. Move up the
create_workequeue() call to return early and avoid unwinding the call to
riocm_rx_fill().

Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andrew Morton 
Cc: Linus Torvalds 
Cc: stable 
Signed-off-by: Anirudh Rayabharam 
Link: https://lore.kernel.org/r/20210503115736.2104747-46-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails"

2021-05-26T09:29:06+00:00

commit 5e68b86c7b7c059c0f0ec4bf8adabe63f84a61eb upstream.

This reverts commit 23015b22e47c5409620b1726a677d69e5cd032ba.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit has a memory leak on the error path here, it does
not clean up everything properly.

Cc: Kangjie Lu 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andrew Morton 
Cc: Linus Torvalds 
Fixes: 23015b22e47c ("rapidio: fix a NULL pointer dereference when create_workqueue() fails")
Cc: stable 
Link: https://lore.kernel.org/r/20210503115736.2104747-45-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

rapidio: fix the missed put_device() for rio_mport_add_riodev

2020-10-29T08:05:39+00:00

[ Upstream commit 85094c05eeb47d195a74a25366a2db066f1c9d47 ]

rio_mport_add_riodev() misses to call put_device() when the device already
exists.  Add the missed function call to fix it.

Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Jing Xiangfeng 
Signed-off-by: Andrew Morton 
Reviewed-by: Dan Carpenter 
Cc: Matt Porter 
Cc: Alexandre Bounine 
Cc: Gustavo A. R. Silva 
Cc: John Hubbard 
Cc: Kees Cook 
Cc: Madhuparna Bhowmik 
Link: https://lkml.kernel.org/r/20200922072525.42330-1-jingxiangfeng@huawei.com
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

rapidio: fix error handling path

2020-10-29T08:05:39+00:00

[ Upstream commit fa63f083b3492b5ed5332b8d7c90b03b5ef24a1d ]

rio_dma_transfer() attempts to clamp the return value of
pin_user_pages_fast() to be >= 0.  However, the attempt fails because
nr_pages is overridden a few lines later, and restored to the undesirable
-ERRNO value.

The return value is ultimately stored in nr_pages, which in turn is passed
to unpin_user_pages(), which expects nr_pages >= 0, else, disaster.

Fix this by fixing the nesting of the assignment to nr_pages: nr_pages
should be clamped to zero if pin_user_pages_fast() returns -ERRNO, or set
to the return value of pin_user_pages_fast(), otherwise.

[jhubbard@nvidia.com: new changelog]

Fixes: e8de370188d09 ("rapidio: add mport char device driver")
Signed-off-by: Souptick Joarder 
Signed-off-by: Andrew Morton 
Reviewed-by: Ira Weiny 
Reviewed-by: John Hubbard 
Cc: Matthew Wilcox 
Cc: Matt Porter 
Cc: Alexandre Bounine 
Cc: Gustavo A. R. Silva 
Cc: Madhuparna Bhowmik 
Cc: Dan Carpenter 
Link: https://lkml.kernel.org/r/1600227737-20785-1-git-send-email-jrdr.linux@gmail.com
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

rapidio: Replace 'select' DMAENGINES 'with depends on'

2020-09-23T06:46:15+00:00

[ Upstream commit d2b86100245080cfdf1e95e9e07477474c1be2bd ]

Enabling a whole subsystem from a single driver 'select' is frowned
upon and won't be accepted in new drivers, that need to use 'depends on'
instead. Existing selection of DMAENGINES will then cause circular
dependencies. Replace them with a dependency.

Signed-off-by: Laurent Pinchart 
Acked-by: Randy Dunlap 
Signed-off-by: Sasha Levin

rapidio: fix an error in get_user_pages_fast() error handling

2020-05-27T14:42:02+00:00

commit ffca476a0a8d26de767cc41d62b8ca7f540ecfdd upstream.

In the case of get_user_pages_fast() returning fewer pages than
requested, rio_dma_transfer() does not quite do the right thing.  It
attempts to release all the pages that were requested, rather than just
the pages that were pinned.

Fix the error handling so that only the pages that were successfully
pinned are released.

Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: John Hubbard 
Signed-off-by: Andrew Morton 
Reviewed-by: Andrew Morton 
Cc: Matt Porter 
Cc: Alexandre Bounine 
Cc: Sumit Semwal 
Cc: Dan Carpenter 
Cc: 
Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman