linux-stable.git/drivers/rapidio, branch linux-5.10.y

rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()

2026-03-04T12:20:20+00:00

[ Upstream commit 666183dcdd9ad3b8156a1df7f204f728f720380f ]

When idtab allocation fails, net is not registered with rio_add_net() yet,
so kfree(net) is sufficient to release the memory.  Set mport->net to NULL
to avoid dangling pointer.

Link: https://lkml.kernel.org/r/20260121013508.195836-1-lihaoxiang@isrc.iscas.ac.cn
Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code")
Signed-off-by: Haoxiang Li 
Reviewed-by: Andrew Morton 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

drivers/rapidio/rio_cm.c: prevent possible heap overwrite

2025-06-27T10:04:20+00:00

commit 50695153d7ddde3b1696dbf0085be0033bf3ddb3 upstream.

In

riocm_cdev_ioctl(RIO_CM_CHAN_SEND)
   -> cm_chan_msg_send()
      -> riocm_ch_send()

cm_chan_msg_send() checks that userspace didn't send too much data but
riocm_ch_send() failed to check that userspace sent sufficient data.  The
result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr
which were outside the bounds of the space which cm_chan_msg_send()
allocated.

Address this by teaching riocm_ch_send() to check that the entire
rio_ch_chan_hdr was copied in from userspace.

Reported-by: maher azz 
Cc: Matt Porter 
Cc: Alexandre Bounine 
Cc: Linus Torvalds 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

rapidio: fix an API misues when rio_add_net() fails

2025-03-13T11:47:37+00:00

commit b2ef51c74b0171fde7eb69b6152d3d2f743ef269 upstream.

rio_add_net() calls device_register() and fails when device_register()
fails.  Thus, put_device() should be used rather than kfree().  Add
"mport->net = NULL;" to avoid a use after free issue.

Link: https://lkml.kernel.org/r/20250227073409.3696854-1-haoxiang_li2024@163.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Haoxiang Li 
Reviewed-by: Dan Carpenter 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: Yang Yingliang 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

rapidio: add check for rio_add_net() in rio_scan_alloc_net()

2025-03-13T11:47:37+00:00

commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream.

The return value of rio_add_net() should be checked.  If it fails,
put_device() should be called to free the memory and give up the reference
initialized in rio_add_net().

Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com
Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code")
Signed-off-by: Yang Yingliang 
Signed-off-by: Haoxiang Li 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: Dan Carpenter 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

rapidio: devices: fix missing put_device in mport_cdev_open

2023-01-14T09:15:23+00:00

[ Upstream commit d5b6e6eba3af11cb2a2791fa36a2524990fcde1a ]

When kfifo_alloc fails, the refcount of chdev->dev is left incremental.
We should use put_device(&chdev->dev) to decrease the ref count of
chdev->dev to avoid refcount leak.

Link: https://lkml.kernel.org/r/20221203085721.13146-1-caixinchen1@huawei.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Cai Xinchen 
Cc: Alexandre Bounine 
Cc: Dan Carpenter 
Cc: Jakob Koschel 
Cc: John Hubbard 
Cc: Matt Porter 
Cc: Wang Weiyang 
Cc: Yang Yingliang 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: fix possible UAF when kfifo_alloc() fails

2023-01-14T09:15:22+00:00

[ Upstream commit 02d7d89f816951e0862147d751b1150d67aaebdd ]

If kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free
priv. But priv is still in the chdev->file_list, then list traversal
may cause UAF. This fixes the following smatch warning:

drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list

Link: https://lkml.kernel.org/r/20221123095147.52408-1-wangweiyang2@huawei.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Wang Weiyang 
Cc: Alexandre Bounine 
Cc: Dan Carpenter 
Cc: Jakob Koschel 
Cc: John Hubbard 
Cc: Matt Porter 
Cc: Yang Yingliang 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: rio: fix possible name leak in rio_register_mport()

2023-01-14T09:15:20+00:00

[ Upstream commit e92a216d16bde65d21a3227e0fb2aa0794576525 ]

If device_register() returns error, the name allocated by dev_set_name()
need be freed.  It should use put_device() to give up the reference in the
error path, so that the name can be freed in kobject_cleanup(), and
list_del() is called to delete the port from rio_mports.

Link: https://lkml.kernel.org/r/20221114152636.2939035-3-yangyingliang@huawei.com
Fixes: 2aaf308b95b2 ("rapidio: rework device hierarchy and introduce mport class of devices")
Signed-off-by: Yang Yingliang 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: fix possible name leaks when rio_add_device() fails

2023-01-14T09:15:20+00:00

[ Upstream commit f9574cd48679926e2a569e1957a5a1bcc8a719ac ]

Patch series "rapidio: fix three possible memory leaks".

This patchset fixes three name leaks in error handling.
 - patch #1 fixes two name leaks while rio_add_device() fails.
 - patch #2 fixes a name leak while  rio_register_mport() fails.

This patch (of 2):

If rio_add_device() returns error, the name allocated by dev_set_name()
need be freed.  It should use put_device() to give up the reference in the
error path, so that the name can be freed in kobject_cleanup(), and the
'rdev' can be freed in rio_release_dev().

Link: https://lkml.kernel.org/r/20221114152636.2939035-1-yangyingliang@huawei.com
Link: https://lkml.kernel.org/r/20221114152636.2939035-2-yangyingliang@huawei.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
Signed-off-by: Yang Yingliang 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Signed-off-by: Andrew Morton 
Signed-off-by: Sasha Levin

rapidio: handle create_workqueue() failure

2021-05-26T10:06:52+00:00

commit 69ce3ae36dcb03cdf416b0862a45369ddbf50fdf upstream.

In case create_workqueue() fails, release all resources and return -ENOMEM
to caller to avoid potential NULL pointer deref later. Move up the
create_workequeue() call to return early and avoid unwinding the call to
riocm_rx_fill().

Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andrew Morton 
Cc: Linus Torvalds 
Cc: stable 
Signed-off-by: Anirudh Rayabharam 
Link: https://lore.kernel.org/r/20210503115736.2104747-46-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails"

2021-05-26T10:06:52+00:00

commit 5e68b86c7b7c059c0f0ec4bf8adabe63f84a61eb upstream.

This reverts commit 23015b22e47c5409620b1726a677d69e5cd032ba.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit has a memory leak on the error path here, it does
not clean up everything properly.

Cc: Kangjie Lu 
Cc: Alexandre Bounine 
Cc: Matt Porter 
Cc: Andrew Morton 
Cc: Linus Torvalds 
Fixes: 23015b22e47c ("rapidio: fix a NULL pointer dereference when create_workqueue() fails")
Cc: stable 
Link: https://lore.kernel.org/r/20210503115736.2104747-45-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman