linux-dev/drivers/char/xillybus, branch master

char: xillybus: fix a refcount leak in cleanup_dev()

2022-04-24T15:30:45Z

usb_get_dev is called in xillyusb_probe. So it is better to call usb_put_dev before xdev is released. Acked-by: Eli Billauer Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220406075703.23464-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: replace usage of found with dedicated list iterator variable

2022-04-24T15:24:12Z

To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1]. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ Acked-by: Eli Billauer Signed-off-by: Jakob Koschel Link: https://lore.kernel.org/r/20220324070939.59297-1-jakobkoschel@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: fix msg_ep UAF in xillyusb_probe()

2021-10-19T07:40:18Z

When endpoint_alloc() return failed in xillyusb_setup_base_eps(), 'xdev->msg_ep' will be freed but not set to NULL. That lets program enter fail handling to cleanup_dev() in xillyusb_probe(). Check for 'xdev->msg_ep' is invalid in cleanup_dev() because 'xdev->msg_ep' did not set to NULL when was freed. So the UAF problem for 'xdev->msg_ep' is triggered. ================================================================== BUG: KASAN: use-after-free in fifo_mem_release+0x1f4/0x210 CPU: 0 PID: 166 Comm: kworker/0:2 Not tainted 5.15.0-rc5+ #19 Call Trace: dump_stack_lvl+0xe2/0x152 print_address_description.constprop.0+0x21/0x140 ? fifo_mem_release+0x1f4/0x210 kasan_report.cold+0x7f/0x11b ? xillyusb_probe+0x530/0x700 ? fifo_mem_release+0x1f4/0x210 fifo_mem_release+0x1f4/0x210 ? __sanitizer_cov_trace_pc+0x1d/0x50 endpoint_dealloc+0x35/0x2b0 cleanup_dev+0x90/0x120 xillyusb_probe+0x59a/0x700 ... Freed by task 166: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0x109/0x140 kfree+0x117/0x4c0 xillyusb_probe+0x606/0x700 Set 'xdev->msg_ep' to NULL after being freed in xillyusb_setup_base_eps() to fix the UAF problem. Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)") Cc: stable Acked-by: Eli Billauer Signed-off-by: Ziyang Xuan Link: https://lore.kernel.org/r/20211016052047.1611983-1-william.xuanziyang@huawei.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Eliminate redundant wrappers to DMA related calls

2021-10-05T14:11:11Z

The driver was originally written with the assumption that a different API must be used for DMA-related functions if the device is PCIe based or if not. Since Xillybus' driver supports devices on a PCIe bus (with xillybus_pcie) as well as connected directly to the processor (with xillybus_of), it originally used wrapper functions that ensure that a different API is used for each. This patch eliminates the said wrapper functions, as all use the same dma_* API now. This is most notable by the code deleted in xillybus_pcie.c and xillybus_of.c. It also eliminates the OF driver's check for a "dma-coherent" attribute in the device's OF entry, since this is taken care of by the kernel's implementation of dma_sync_single_for_*(). There is however still need for one wrapper function, which is merged from xillybus_pcie.c and xillybus_of.c into xillybus_core.c: The call to dma_map_single() is wrapped by a function that uses the Managed Device (devres) framework, in the absence of a relevant function in the current kernel's API. Suggested-by: Christophe JAILLET Suggested-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210929094442.46383-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Simplify 'xillybus_init_endpoint()'

2021-09-14T09:12:56Z

Ths first argument of 'xillybus_init_endpoint()' is now useless. Remove it. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/ba687c1eff5dc8f21422323f57164d06f25d4169.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of remaining deprecated pci_ API

2021-09-14T09:12:56Z

'struct xilly_endpoint' has a 'dev' field which is a 'struct device *' and a 'pdev' field which is 'struct pci_dev *'. Both fields are initialized by 'xillybus_init_endpoint()' and in 'xillybus_pcie.c', we have: xillybus_init_endpoint(pdev, &pdev->dev, &pci_hw); ^ ^ xilly_endpoint.pdev = ___| |___ = xilly_endpoint.dev So the modification from pci_ to dma_ function is straightforward. Update all remaining deprecated pci_ function calls to equivalent dma_ API function. Switching from 'ep->pdev' to 'ep->dev' makes the transformation straightforward. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/19d67ac0208a609aef1e28278b3f2477aa714029.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of 'pci_unmap_single()'

2021-09-14T09:12:56Z

'struct xilly_mapping' includes a 'void *device' field which holds, depending of the context, a 'struct device *' or a 'struct pci_dev *'. This field is then used with 'pci_umap_single()' in 'xillybus_pcie.c' and with 'dma_umap_single()' in 'xillybus_of.c'. In order to remove usage of the deprecated 'pci_unmap_single()' API, turn the 'void *device' field from 'struct xilly_mapping', into an explicit 'struct device *device' and use 'dma_umap_single()' everywhere. In order to update 'xillybus_pcie.c', use the 'dev' field instead of the 'pdev' field from the 'struct xilly_endpoint'. Both fields are initialized by 'xillybus_init_endpoint()' and in 'xillybus_pcie.c', we have: xillybus_init_endpoint(pdev, &pdev->dev, &pci_hw); ^ ^ xilly_endpoint.pdev = ___| |___ = xilly_endpoint.dev So the modification from pci_ to dma_ function is straightforward. While at it, remove a comment that is wrong, because in the case above, both 'dev' and 'pdev' are not NULL. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/baa3f6c7f009d9c231ae320bf1d568268bfef089.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove usage of the deprecated 'pci-dma-compat.h' API

2021-09-14T09:12:56Z

In [1], Christoph Hellwig has proposed to remove the wrappers in include/linux/pci-dma-compat.h. Some reasons why this API should be removed have been given by Julia Lawall in [2]. A coccinelle script has been used to perform the needed transformation Only relevant part are given below. 'xilly_pci_direction()' has been hand modified to simplify it slightly. It has been compile tested. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) [1]: https://lore.kernel.org/kernel-janitors/20200421081257.GA131897@infradead.org/ [2]: https://lore.kernel.org/kernel-janitors/alpine.DEB.2.22.394.2007120902170.2424@hadrien/ Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/e25aa2a804972c5d4f06c4c4e0511e11ff97a425.1630083668.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

char: xillybus: Fix spelling mistake "overflew" -> "overflowed"

2021-06-03T12:11:08Z

There is a spelling mistake in a dev_err message. Fix it. Acked-by: Eli Billauer Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210601102201.8489-1-colin.king@canonical.com Signed-off-by: Greg Kroah-Hartman

char: xillybus: Remove unneeded MODULE_VERSION() usage

2021-06-03T12:10:03Z

MODULE_VERSION is useless for in-kernel drivers, so these are removed from files in drivers/char/xillybus/ Reported-by: Greg Kroah-Hartman Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20210528092242.51104-2-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman