kernel/linux.git/drivers/greybus, branch v6.6.132

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

2024-06-21T12:38:48+00:00

commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree. Signed-off-by: Sicong Huang Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com Cc: Ronnie Sahlberg Signed-off-by: Greg Kroah-Hartman

greybus: Use alloc_ordered_workqueue() to create ordered workqueues

2023-05-08T23:52:27+00:00

BACKGROUND ========== When multiple work items are queued to a workqueue, their execution order doesn't match the queueing order. They may get executed in any order and simultaneously. When fully serialized execution - one by one in the queueing order - is needed, an ordered workqueue should be used which can be created with alloc_ordered_workqueue(). However, alloc_ordered_workqueue() was a later addition. Before it, an ordered workqueue could be obtained by creating an UNBOUND workqueue with @max_active==1. This originally was an implementation side-effect which was broken by 4c16bd327c74 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered"). Because there were users that depended on the ordered execution, 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered") made workqueue allocation path to implicitly promote UNBOUND workqueues w/ @max_active==1 to ordered workqueues. While this has worked okay, overloading the UNBOUND allocation interface this way creates other issues. It's difficult to tell whether a given workqueue actually needs to be ordered and users that legitimately want a min concurrency level wq unexpectedly gets an ordered one instead. With planned UNBOUND workqueue updates to improve execution locality and more prevalence of chiplet designs which can benefit from such improvements, this isn't a state we wanna be in forever. This patch series audits all callsites that create an UNBOUND workqueue w/ @max_active==1 and converts them to alloc_ordered_workqueue() as necessary. WHAT TO LOOK FOR ================ The conversions are from alloc_workqueue(WQ_UNBOUND | flags, 1, args..) to alloc_ordered_workqueue(flags, args...) which don't cause any functional changes. If you know that fully ordered execution is not ncessary, please let me know. I'll drop the conversion and instead add a comment noting the fact to reduce confusion while conversion is in progress. If you aren't fully sure, it's completely fine to let the conversion through. The behavior will stay exactly the same and we can always reconsider later. As there are follow-up workqueue core changes, I'd really appreciate if the patch can be routed through the workqueue tree w/ your acks. Thanks. Signed-off-by: Tejun Heo Acked-by: Greg Kroah-Hartman Acked-by: Johan Hovold Acked-by: Alex Elder Cc: greybus-dev@lists.linaro.org

driver core: make struct bus_type.uevent() take a const *

2023-01-27T12:45:52+00:00

The uevent() callback in struct bus_type should not be modifying the device that is passed into it, so mark it as a const * and propagate the function signature changes out into all relevant subsystems that use this callback. Acked-by: Rafael J. Wysocki Acked-by: Hans de Goede Link: https://lore.kernel.org/r/20230111113018.459199-16-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

greybus: svc: Use kstrtobool() instead of strtobool()

2022-11-10T18:03:58+00:00

strtobool() is the same as kstrtobool(). However, the latter is more used within the kernel. In order to remove strtobool() and slightly simplify kstrtox.h, switch to the other function name. While at it, include the corresponding header file () Signed-off-by: Christophe JAILLET Reviewed-by: Johan Hovold Reviewed-by: Alex Elder Link: https://lore.kernel.org/r/ebf1e6988a53a455990230a37cf759ee542ea7ec.1667336095.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

greybus: svc: clean up link configuration hack at hello

2022-02-04T14:27:44+00:00

Commit ee2f2074fdb2 ("greybus: svc: reconfig APBridgeA-Switch link to handle required load") added a temporary hack which reconfigures the link at HELLO by abusing the deferred request processing mechanism. Restructure the HELLO request processing so that the link-configuration work is queued before creating the debugfs files and add a comment explaining why it's there. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: svc: clean up hello error path

2022-02-04T14:27:44+00:00

While currently safe, it is unnecessary (and confusing) to try to destroy the watchdog when watchdog creation fails. Change the corresponding error path to only deregister the svc. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: svc: fix an error handling bug in gb_svc_hello()

2022-02-04T14:27:44+00:00

Cleanup if gb_svc_queue_deferred_request() fails. Link: https://lore.kernel.org/r/20220202072016.GA6748@kili Fixes: ee2f2074fdb2 ("greybus: svc: reconfig APBridgeA-Switch link to handle required load") Cc: stable@vger.kernel.org # 4.9 [johan: fix commit summary prefix and rename label ] Signed-off-by: Dan Carpenter Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

greybus: es2: fix typo in a comment

2021-12-21T09:13:26+00:00

The double `for' in the comment in line 81 is repeated. Remove one of them from the comment. Reviewed-by: Alex Elder Signed-off-by: Jason Wang Link: https://lore.kernel.org/r/20211212031657.41169-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman

greybus: es2: fix kernel-doc warnings

2021-04-16T05:26:50+00:00

Fix these kernel-doc complaints: ../drivers/greybus/es2.c:79: warning: bad line: ../drivers/greybus/es2.c:100: warning: cannot understand function prototype: 'struct es2_ap_dev ' es2.c:126: warning: Function parameter or member 'cdsi1_in_use' not described in 'es2_ap_dev' Cc: Johan Hovold Cc: Alex Elder Cc: Greg Kroah-Hartman Cc: greybus-dev@lists.linaro.org (moderated for non-subscribers) Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20210415054338.2223-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman

greybus: remove stray nul byte in apb_log_enable_read output

2021-04-02T14:24:56+00:00

Including a nul byte in the otherwise human-readable ascii output from this debugfs file is probably not intended. Acked-by: Alex Elder Signed-off-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20210326152254.733066-1-linux@rasmusvillemoes.dk Signed-off-by: Greg Kroah-Hartman