kernel/linux.git/drivers/greybus, branch v5.10.257

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

2024-07-05T07:12:32+00:00

commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree. Signed-off-by: Sicong Huang Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com Cc: Ronnie Sahlberg Signed-off-by: Greg Kroah-Hartman

greybus: svc: fix an error handling bug in gb_svc_hello()

2022-04-08T12:39:50+00:00

commit 5f8583a3b7552092582a92e7bbd2153319929ad7 upstream. Cleanup if gb_svc_queue_deferred_request() fails. Link: https://lore.kernel.org/r/20220202072016.GA6748@kili Fixes: ee2f2074fdb2 ("greybus: svc: reconfig APBridgeA-Switch link to handle required load") Cc: stable@vger.kernel.org # 4.9 [johan: fix commit summary prefix and rename label ] Signed-off-by: Dan Carpenter Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

drivers/greybus: Use kobj_to_dev()

2020-09-04T16:06:01+00:00

Use kobj_to_dev() instead of container_of() Signed-off-by: Wang Qing Acked-by: Viresh Kumar Acked-by: Johan Hovold Link: https://lore.kernel.org/r/1597289690-22857-1-git-send-email-wangqing@vivo.com Signed-off-by: Greg Kroah-Hartman

greybus: Use fallthrough pseudo-keyword

2020-07-29T14:58:08+00:00

Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200727183258.GA28571@embeddedor Signed-off-by: Greg Kroah-Hartman

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-13T16:57:21+00:00

Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over '---help---'"), the number of '---help---' has been gradually decreasing, but there are still more than 2400 instances. This commit finishes the conversion. While I touched the lines, I also fixed the indentation. There are a variety of indentation styles found. a) 4 spaces + '---help---' b) 7 spaces + '---help---' c) 8 spaces + '---help---' d) 1 space + 1 tab + '---help---' e) 1 tab + '---help---' (correct indentation) f) 1 tab + 1 space + '---help---' g) 1 tab + 2 spaces + '---help---' In order to convert all of them to 1 tab + 'help', I ran the following commend: $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/' Signed-off-by: Masahiro Yamada

greybus: Replace zero-length array with flexible-array

2020-05-13T11:59:13+00:00

The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] sizeof(flexible-array-member) triggers a warning because flexible array members have incomplete type[1]. There are some instances of code in which the sizeof operator is being incorrectly/erroneously applied to zero-length arrays and the result is zero. Such instances may be hiding some bugs. So, this work (flexible-array member conversions) will also help to get completely rid of those sorts of issues. This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200507185318.GA14393@embeddedor Signed-off-by: Greg Kroah-Hartman

greybus: fix typos in GREYBUS/GREYBUS_ES2 help text

2020-04-29T10:05:45+00:00

Fix typos ("an" -> "a", "chose" -> "choose") in Kconfig Signed-off-by: Zenyu Sy Link: https://lore.kernel.org/r/20200426060048.14019-1-zenyu@tuta.io Signed-off-by: Greg Kroah-Hartman

greybus: remove excessive check in gb_connection_hd_cport_quiesce()

2019-10-10T13:24:19+00:00

Function pointer "hd->driver->cport_quiesce" is already checked at the beginning of gb_connection_hd_cport_quiesce(). Thus, the second check can be removed. Signed-off-by: Denis Efremov Acked-by: Johan Hovold Link: https://lore.kernel.org/r/20190925213656.8950-1-efremov@linux.com Signed-off-by: Greg Kroah-Hartman

staging: greybus: move es2 to drivers/greybus/

2019-08-27T17:03:08+00:00

The es2 Greybus host controller has long been stable, so move it out of drivers/staging/ to drivers/greybus/ Cc: Johan Hovold Cc: greybus-dev@lists.linaro.org Cc: linux-kernel@vger.kernel.org Acked-by: Viresh Kumar Acked-by: Alex Elder Link: https://lore.kernel.org/r/20190825055429.18547-10-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

staging: greybus: move the greybus core to drivers/greybus

2019-08-27T17:03:04+00:00

The Greybus core code has been stable for a long time, and has been shipping for many years in millions of phones. With the advent of a recent Google Summer of Code project, and a number of new devices in the works from various companies, it is time to get the core greybus code out of staging as it really is going to be with us for a while. Cc: Johan Hovold Cc: linux-kernel@vger.kernel.org Cc: greybus-dev@lists.linaro.org Acked-by: Viresh Kumar Acked-by: Alex Elder Link: https://lore.kernel.org/r/20190825055429.18547-9-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman