kernel/linux.git/drivers/greybus, branch v6.1.168

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

2024-06-21T12:36:00+00:00

commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree. Signed-off-by: Sicong Huang Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com Cc: Ronnie Sahlberg Signed-off-by: Greg Kroah-Hartman

greybus: svc: clean up link configuration hack at hello

2022-02-04T14:27:44+00:00

Commit ee2f2074fdb2 ("greybus: svc: reconfig APBridgeA-Switch link to handle required load") added a temporary hack which reconfigures the link at HELLO by abusing the deferred request processing mechanism. Restructure the HELLO request processing so that the link-configuration work is queued before creating the debugfs files and add a comment explaining why it's there. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: svc: clean up hello error path

2022-02-04T14:27:44+00:00

While currently safe, it is unnecessary (and confusing) to try to destroy the watchdog when watchdog creation fails. Change the corresponding error path to only deregister the svc. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: svc: fix an error handling bug in gb_svc_hello()

2022-02-04T14:27:44+00:00

Cleanup if gb_svc_queue_deferred_request() fails. Link: https://lore.kernel.org/r/20220202072016.GA6748@kili Fixes: ee2f2074fdb2 ("greybus: svc: reconfig APBridgeA-Switch link to handle required load") Cc: stable@vger.kernel.org # 4.9 [johan: fix commit summary prefix and rename label ] Signed-off-by: Dan Carpenter Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: es2: fix typo in a comment

2021-12-21T09:13:26+00:00

The double `for' in the comment in line 81 is repeated. Remove one of them from the comment. Reviewed-by: Alex Elder Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20211212031657.41169-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman

greybus: es2: fix kernel-doc warnings

2021-04-16T05:26:50+00:00

Fix these kernel-doc complaints: ../drivers/greybus/es2.c:79: warning: bad line: ../drivers/greybus/es2.c:100: warning: cannot understand function prototype: 'struct es2_ap_dev ' es2.c:126: warning: Function parameter or member 'cdsi1_in_use' not described in 'es2_ap_dev' Cc: Johan Hovold Cc: Alex Elder Cc: Greg Kroah-Hartman Cc: greybus-dev@lists.linaro.org (moderated for non-subscribers) Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20210415054338.2223-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman

greybus: remove stray nul byte in apb_log_enable_read output

2021-04-02T14:24:56+00:00

Including a nul byte in the otherwise human-readable ascii output from this debugfs file is probably not intended. Acked-by: Alex Elder Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20210326152254.733066-1-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman

greybus: es2: drop short control-transfer checks

2021-01-26T18:20:11+00:00

There's no need to check for short USB control transfers when sending data using so remove the redundant sanity checks. Reviewed-by: Viresh Kumar Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210118144629.25533-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: remove h from printk format specifier

2021-01-05T14:18:23+00:00

See Documentation/core-api/printk-formats.rst. h should no longer be used in the format specifier for printk. Reviewed-by: Alex Elder Signed-off-by: Tom Rix Link: https://lore.kernel.org/r/20201215145306.1901598-1-trix@redhat.com Signed-off-by: Greg Kroah-Hartman

drivers/greybus: Use kobj_to_dev()

2020-09-04T16:06:01+00:00

Use kobj_to_dev() instead of container_of() Signed-off-by: Wang Qing Acked-by: Viresh Kumar Acked-by: Johan Hovold Link: https://lore.kernel.org/r/1597289690-22857-1-git-send-email-wangqing@vivo.com Signed-off-by: Greg Kroah-Hartman