linux-stable.git/drivers/w1, branch linux-6.13.y Linux kernel stable tree w1: fix NULL pointer dereference in probe 2025-04-10T12:41:45+00:00 Chenyuan Yang chenyuan0y@gmail.com 2025-01-11T18:18:03+00:00 64ab50577c59bb7049bec6b5c42d1c38e4029f29 [ Upstream commit 0dd6770a72f138dabea9eae87f3da6ffa68f0d06 ] The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set. This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device. Fix the race by ensuring client ops are set before enabling the port via w1_uart_serdev_open(). Fixes: a3c08804364e ("w1: add UART w1 bus driver") Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> Acked-by: Christoph Winklhofer <cj.winklhofer@gmail.com> Link: https://lore.kernel.org/r/20250111181803.2283611-1-chenyuan0y@gmail.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 0dd6770a72f138dabea9eae87f3da6ffa68f0d06 ]

The w1_uart_probe() function calls w1_uart_serdev_open() (which includes
devm_serdev_device_open()) before setting the client ops via
serdev_device_set_client_ops(). This ordering can trigger a NULL pointer
dereference in the serdev controller's receive_buf handler, as it assumes
serdev->ops is valid when SERPORT_ACTIVE is set.

This is similar to the issue fixed in commit 5e700b384ec1
("platform/chrome: cros_ec_uart: properly fix race condition") where
devm_serdev_device_open() was called before fully initializing the
device.

Fix the race by ensuring client ops are set before enabling the port via
w1_uart_serdev_open().

Fixes: a3c08804364e ("w1: add UART w1 bus driver")
Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Acked-by: Christoph Winklhofer <cj.winklhofer@gmail.com>
Link: https://lore.kernel.org/r/20250111181803.2283611-1-chenyuan0y@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Get rid of 'remove_new' relic from platform driver struct 2024-12-01T23:12:43+00:00 Linus Torvalds torvalds@linux-foundation.org 2024-12-01T23:12:43+00:00 e70140ba0d2b1a30467d4af6bcfe761327b9ec95 The continual trickle of small conversion patches is grating on me, and is really not helping. Just get rid of the 'remove_new' member function, which is just an alias for the plain 'remove', and had a comment to that effect: /* * .remove_new() is a relic from a prototype conversion of .remove(). * New drivers are supposed to implement .remove(). Once all drivers are * converted to not use .remove_new any more, it will be dropped. */ This was just a tree-wide 'sed' script that replaced '.remove_new' with '.remove', with some care taken to turn a subsequent tab into two tabs to make things line up. I did do some minimal manual whitespace adjustment for places that used spaces to line things up. Then I just removed the old (sic) .remove_new member function, and this is the end result. No more unnecessary conversion noise. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
The continual trickle of small conversion patches is grating on me, and
is really not helping.  Just get rid of the 'remove_new' member
function, which is just an alias for the plain 'remove', and had a
comment to that effect:

  /*
   * .remove_new() is a relic from a prototype conversion of .remove().
   * New drivers are supposed to implement .remove(). Once all drivers are
   * converted to not use .remove_new any more, it will be dropped.
   */

This was just a tree-wide 'sed' script that replaced '.remove_new' with
'.remove', with some care taken to turn a subsequent tab into two tabs
to make things line up.

I did do some minimal manual whitespace adjustment for places that used
spaces to line things up.

Then I just removed the old (sic) .remove_new member function, and this
is the end result.  No more unnecessary conversion noise.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
w1: ds2482: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-06T17:18:32+00:00 Uwe Kleine-König u.kleine-koenig@baylibre.com 2024-09-06T14:11:33+00:00 b39121354f95cdca77d7576a979c5cbe387a9eed This driver doesn't use the driver_data member of struct i2c_device_id, so don't explicitly initialize this member. This prepares putting driver_data in an anonymous union which requires either no initialization or named designators. But it's also a nice cleanup on its own. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://lore.kernel.org/r/20240725160909.326143-2-u.kleine-koenig@baylibre.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20240906141135.72080-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This driver doesn't use the driver_data member of struct i2c_device_id,
so don't explicitly initialize this member.

This prepares putting driver_data in an anonymous union which requires
either no initialization or named designators. But it's also a nice
cleanup on its own.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20240725160909.326143-2-u.kleine-koenig@baylibre.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240906141135.72080-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
w1: Drop allocation error message 2024-05-28T15:45:02+00:00 Thorsten Blum thorsten.blum@toblux.com 2024-05-27T13:49:47+00:00 26bf5fc86033162dbd2d5759094cbd724313d55b Drop the custom error message because kzalloc() already prints allocation failures. Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com> Link: https://lore.kernel.org/r/20240527134946.338398-2-thorsten.blum@toblux.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
Drop the custom error message because kzalloc() already prints
allocation failures.

Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
Link: https://lore.kernel.org/r/20240527134946.338398-2-thorsten.blum@toblux.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
w1: Add missing newline and fix typos in w1_bus_master comment 2024-05-27T11:51:29+00:00 Thorsten Blum thorsten.blum@toblux.com 2024-05-27T09:27:47+00:00 56813b244e5f2ace887f04c4a69a2a0041992297 - Add missing newline before @return - s/bytes/byte/ - s/handles/handle/ - s/exists/exist/ in dev_info() message Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com> Link: https://lore.kernel.org/r/20240527092746.263038-2-thorsten.blum@toblux.com [krzysztof: squash "w1: Fix typo in dev_info() message"] Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
- Add missing newline before @return
- s/bytes/byte/
- s/handles/handle/
- s/exists/exist/ in dev_info() message

Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
Link: https://lore.kernel.org/r/20240527092746.263038-2-thorsten.blum@toblux.com
[krzysztof: squash "w1: Fix typo in dev_info() message"]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
w1: gpio: Don't use "proxy" headers 2024-03-25T11:06:37+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2024-03-07T14:35:51+00:00 cde37a5bdb0ed2c4c7b86ef688e5fdb697525a57 Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20240307143644.3787260-6-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
Update header inclusions to follow IWYU (Include What You Use)
principle.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240307143644.3787260-6-andriy.shevchenko@linux.intel.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
w1: gpio: Remove duplicate NULL checks 2024-03-25T11:06:37+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2024-03-07T14:35:50+00:00 540d3f15c0aa2baf7e9b48a4e516391c179daab2 gpiod_set_value() is NULL-aware, no need to check that in the caller. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20240307143644.3787260-5-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
gpiod_set_value() is NULL-aware, no need to check that in the caller.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20240307143644.3787260-5-andriy.shevchenko@linux.intel.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
w1: gpio: Use sizeof(*pointer) instead of sizeof(type) 2024-03-25T11:06:37+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2024-03-07T14:35:49+00:00 ef2b810e1152d77686032e7dc064ff89b4350b00 It is preferred to use sizeof(*pointer) instead of sizeof(type). The type of the variable can change and one needs not change the former (unlike the latter). No functional change intended. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20240307143644.3787260-4-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
It is preferred to use sizeof(*pointer) instead of sizeof(type).
The type of the variable can change and one needs not change
the former (unlike the latter). No functional change intended.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20240307143644.3787260-4-andriy.shevchenko@linux.intel.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
w1: gpio: Switch to use dev_err_probe() 2024-03-25T11:06:36+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2024-03-07T14:35:48+00:00 9e085c045868a6a727b3bd0fc7840ccc9e04d3a3 Switch to use dev_err_probe() to simplify the error path and unify a message template. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20240307143644.3787260-3-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
Switch to use dev_err_probe() to simplify the error path and
unify a message template.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20240307143644.3787260-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
w1: gpio: Make use of device properties 2024-03-25T11:06:36+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2024-03-07T14:35:47+00:00 8b39a723ef1fa3737e11832ca11183bbaeda2498 Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20240307143644.3787260-2-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 
Convert the module to be property provider agnostic and allow
it to be used on non-OF platforms.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240307143644.3787260-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>