linux-stable.git/drivers/rpmsg, branch v5.10.97

rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev

2022-02-01T16:25:43+00:00

commit 7a534ae89e34e9b51acb5a63dd0f88308178b46a upstream.

struct rpmsg_eptdev contains a struct cdev. The current code frees
the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is
a managed object, therefore its release is not predictable and the
rpmsg_eptdev could be freed before the cdev is entirely released.

The cdev_device_add/del() API was created to address this issue
(see commit '233ed09d7fda ("chardev: add helper function to register
char devs with a struct device")'), use it instead of cdev add/del().

Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
Suggested-by: Bjorn Andersson 
Signed-off-by: Matthias Kaehlcke 
Reviewed-by: Mathieu Poirier 
Reviewed-by: Stephen Boyd 
Reviewed-by: Bjorn Andersson 
Signed-off-by: Bjorn Andersson 
Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid
Signed-off-by: Greg Kroah-Hartman

rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev

2022-02-01T16:25:43+00:00

commit b7fb2dad571d1e21173c06cef0bced77b323990a upstream.

struct rpmsg_ctrldev contains a struct cdev. The current code frees
the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the
cdev is a managed object, therefore its release is not predictable
and the rpmsg_ctrldev could be freed before the cdev is entirely
released, as in the backtrace below.

[   93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c
[   93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0
[   93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v
[   93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G    B             5.4.163-lockdep #26
[   93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT)
[   93.730055] Workqueue: events kobject_delayed_cleanup
[   93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO)
[   93.740216] pc : debug_print_object+0x13c/0x1b0
[   93.744890] lr : debug_print_object+0x13c/0x1b0
[   93.749555] sp : ffffffacf5bc7940
[   93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000
[   93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000
[   93.763916] x25: ffffffd0734f856c x24: dfffffd000000000
[   93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0
[   93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0
[   93.780338] x19: ffffffd075199100 x18: 00000000000276e0
[   93.785814] x17: 0000000000000000 x16: dfffffd000000000
[   93.791291] x15: ffffffffffffffff x14: 6e6968207473696c
[   93.796768] x13: 0000000000000000 x12: ffffffd075e2b000
[   93.802244] x11: 0000000000000001 x10: 0000000000000000
[   93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900
[   93.813200] x7 : 0000000000000000 x6 : 0000000000000000
[   93.818676] x5 : 0000000000000080 x4 : 0000000000000000
[   93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001
[   93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061
[   93.835104] Call trace:
[   93.837644]  debug_print_object+0x13c/0x1b0
[   93.841963]  __debug_check_no_obj_freed+0x25c/0x3c0
[   93.846987]  debug_check_no_obj_freed+0x18/0x20
[   93.851669]  slab_free_freelist_hook+0xbc/0x1e4
[   93.856346]  kfree+0xfc/0x2f4
[   93.859416]  rpmsg_ctrldev_release_device+0x78/0xb8
[   93.864445]  device_release+0x84/0x168
[   93.868310]  kobject_cleanup+0x12c/0x298
[   93.872356]  kobject_delayed_cleanup+0x10/0x18
[   93.876948]  process_one_work+0x578/0x92c
[   93.881086]  worker_thread+0x804/0xcf8
[   93.884963]  kthread+0x2a8/0x314
[   93.888303]  ret_from_fork+0x10/0x18

The cdev_device_add/del() API was created to address this issue (see
commit '233ed09d7fda ("chardev: add helper function to register char
devs with a struct device")'), use it instead of cdev add/del().

Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
Signed-off-by: Sujit Kautkar 
Signed-off-by: Matthias Kaehlcke 
Reviewed-by: Mathieu Poirier 
Reviewed-by: Bjorn Andersson 
Reviewed-by: Stephen Boyd 
Signed-off-by: Bjorn Andersson 
Link: https://lore.kernel.org/r/20220110104706.v6.1.Iaac908f3e3149a89190ce006ba166e2d3fd247a3@changeid
Signed-off-by: Greg Kroah-Hartman

rpmsg: core: Clean up resources on announce_create failure.

2022-01-27T09:54:24+00:00

commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream.

During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an
error, the rpmsg device and default endpoint should be freed before
exiting the function.

Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend")
Suggested-by: Bjorn Andersson 
Signed-off-by: Arnaud Pouliquen 
Reviewed-by: Bjorn Andersson 
Cc: stable 
Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@foss.st.com
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman

rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()

2021-05-19T08:13:02+00:00

[ Upstream commit 26594c6bbb60c6bc87e3762a86ceece57d164c66 ]

When idr_find() returns NULL to intent, no error return code of
qcom_glink_rx_data() is assigned.
To fix this bug, ret is assigned with -ENOENT in this case.

Fixes: 64f95f87920d ("rpmsg: glink: Use the local intents when receiving data")
Reported-by: TOTE Robot 
Signed-off-by: Jia-Ju Bai 
Link: https://lore.kernel.org/r/20210306133624.17237-1-baijiaju1990@gmail.com
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

Merge tag 'rpmsg-v5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc

2020-10-22T19:58:21+00:00

Pull rpmsg updates from Bjorn Andersson:
 "This introduces rpmsg_char support for GLINK and fixes a few issues"

* tag 'rpmsg-v5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc:
  rpmsg: glink: Expose rpmsg name attr for glink
  rpmsg: glink: Add support for rpmsg glink chrdev
  rpmsg: Guard against null endpoint ops in destroy
  rpmsg: glink: Use complete_all for open states
  rpmsg: virtio: fix compilation warning for virtio_rpmsg_channel description
  rpmsg: Avoid double-free in mtk_rpmsg_register_device
  rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge()

rpmsg: glink: Expose rpmsg name attr for glink

2020-09-15T03:51:13+00:00

Expose the name field as an attr so clients listening to uevents for
rpmsg can identify the edge the events correspond to.

Signed-off-by: Chris Lew 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Deepak Kumar Singh 
Link: https://lore.kernel.org/r/1593017121-7953-5-git-send-email-deesin@codeaurora.org
Signed-off-by: Bjorn Andersson

rpmsg: glink: Add support for rpmsg glink chrdev

2020-09-15T03:51:07+00:00

RPMSG provides a char device interface to userspace. Probe the rpmsg
chrdev channel to enable the rpmsg_ctrl device creation on glink
transports.

Signed-off-by: Chris Lew 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Deepak Kumar Singh 
Link: https://lore.kernel.org/r/1593017121-7953-4-git-send-email-deesin@codeaurora.org
Signed-off-by: Bjorn Andersson

rpmsg: Guard against null endpoint ops in destroy

2020-09-15T03:51:03+00:00

In RPMSG GLINK the chrdev device will allocate an ept as part of the
rpdev creation. This device will not register endpoint ops even though
it has an allocated ept. Protect against the case where the device is
being destroyed.

Signed-off-by: Chris Lew 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Deepak Kumar Singh 
Link: https://lore.kernel.org/r/1593017121-7953-3-git-send-email-deesin@codeaurora.org
Signed-off-by: Bjorn Andersson

rpmsg: glink: Use complete_all for open states

2020-09-15T03:50:42+00:00

The open_req and open_ack completion variables are the state variables
to represet a remote channel as open. Use complete_all so there are no
races with waiters and using completion_done.

Signed-off-by: Chris Lew 
Signed-off-by: Arun Kumar Neelakantam 
Signed-off-by: Deepak Kumar Singh 
Link: https://lore.kernel.org/r/1593017121-7953-2-git-send-email-deesin@codeaurora.org
Signed-off-by: Bjorn Andersson

rpmsg: virtio: fix compilation warning for virtio_rpmsg_channel description

2020-09-15T03:48:12+00:00

Complete the virtio_rpmsg_channel structure description to fix a
compilation warning with W=1 option:

drivers/rpmsg/virtio_rpmsg_bus.c:95: warning: Cannot understand
 * @vrp: the remote processor this channel belongs to

Reviewed-by: Mathieu Poirier 
Signed-off-by: Arnaud Pouliquen 
Link: https://lore.kernel.org/r/20200731074850.3262-1-arnaud.pouliquen@st.com
Signed-off-by: Bjorn Andersson