February 2021 - Linux-stable-mirror

[patch 007/173] ntfs: check for valid standard information attribute

by Andrew Morton

From: Rustam Kovhaev <rkovhaev(a)gmail.com> Subject: ntfs: check for valid standard information attribute Mounting a corrupted filesystem with NTFS resulted in a kernel crash. We should check for valid STANDARD_INFORMATION attribute offset and length before trying to access it Link: https://lkml.kernel.org/r/20210217155930.1506815-1-rkovhaev@gmail.com Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969 Signed-off-by: Rustam Kovhaev <rkovhaev(a)gmail.com> Reported-by: syzbot+c584225dabdea2f71969(a)syzkaller.appspotmail.com Tested-by: syzbot+c584225dabdea2f71969(a)syzkaller.appspotmail.com Acked-by: Anton Altaparmakov <anton(a)tuxera.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ntfs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/fs/ntfs/inode.c~ntfs-check-for-valid-standard-information-attribute +++ a/fs/ntfs/inode.c @@ -629,6 +629,12 @@ static int ntfs_read_locked_inode(struct } a = ctx->attr; /* Get the standard information attribute value. */ + if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset) + + le32_to_cpu(a->data.resident.value_length) > + (u8 *)ctx->mrec + vol->mft_record_size) { + ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode."); + goto unm_err_out; + } si = (STANDARD_INFORMATION*)((u8*)a + le16_to_cpu(a->data.resident.value_offset)); _

3 years, 11 months

1
0
0 0

stable-rc/queue/4.14 baseline: 73 runs, 1 regressions (v4.14.222-5-gc78acb198d13)

by kernelci.org bot

stable-rc/queue/4.14 baseline: 73 runs, 1 regressions (v4.14.222-5-gc78acb198d13) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------------+-------+--------------+----------+-----------+------------ meson-gxm-q200 | arm64 | lab-baylibre | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.14/kernel/v4.14.22… Test: baseline Tree: stable-rc Branch: queue/4.14 Describe: v4.14.222-5-gc78acb198d13 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: c78acb198d13debdef40970f9b55215f60b41939 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------------+-------+--------------+----------+-----------+------------ meson-gxm-q200 | arm64 | lab-baylibre | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/plan/id/60367093f127d44236addce3 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-8 (aarch64-linux-gnu-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.222-5-gc78acb198d1… HTML log: https://storage.kernelci.org//stable-rc/queue-4.14/v4.14.222-5-gc78acb198d1… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60367093f127d44236addce4 failing since 78 days (last pass: v4.14.210-20-gc32b9f7cbda7, first fail: v4.14.210-20-g5ea7913395d3)

3 years, 11 months

1
0
0 0

stable-rc/queue/5.10 baseline: 116 runs, 1 regressions (v5.10.18-12-gbc43384c353ef)

by kernelci.org bot

stable-rc/queue/5.10 baseline: 116 runs, 1 regressions (v5.10.18-12-gbc43384c353ef) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions --------------------+-------+--------------+----------+-----------+------------ r8a77950-salvator-x | arm64 | lab-baylibre | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.10/kernel/v5.10.18… Test: baseline Tree: stable-rc Branch: queue/5.10 Describe: v5.10.18-12-gbc43384c353ef URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: bc43384c353ef751ec8234ca4e7fee95daff11b5 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions --------------------+-------+--------------+----------+-----------+------------ r8a77950-salvator-x | arm64 | lab-baylibre | gcc-8 | defconfig | 1 Details: https://kernelci.org/test/plan/id/60366efc3e7b40a0f8addd0e Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-8 (aarch64-linux-gnu-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.18-12-gbc43384c353… HTML log: https://storage.kernelci.org//stable-rc/queue-5.10/v5.10.18-12-gbc43384c353… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.login: https://kernelci.org/test/case/id/60366efc3e7b40a0f8addd0f new failure (last pass: v5.10.18-6-g7931b7eb2357)

3 years, 11 months

1
0
0 0

[PATCH 5.10 00/29] 5.10.18-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.18 release. There are 29 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 24 Feb 2021 12:07:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.18-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.18-rc1 Matwey V. Kornilov <matwey(a)sai.msu.ru> media: pwc: Use correct device for DMA Filipe Manana <fdmanana(a)suse.com> btrfs: fix crash after non-aligned direct IO write with O_DSYNC David Sterba <dsterba(a)suse.com> btrfs: fix backport of 2175bf57dc952 in 5.10.13 Trent Piepho <tpiepho(a)gmail.com> Bluetooth: btusb: Always fallback to alt 1 for WBS Linus Torvalds <torvalds(a)linux-foundation.org> tty: protect tty_write from odd low-level tty disciplines Jan Beulich <jbeulich(a)suse.com> xen-blkback: fix error handling in xen_blkbk_map() Jan Beulich <jbeulich(a)suse.com> xen-scsiback: don't "handle" error by BUG() Jan Beulich <jbeulich(a)suse.com> xen-netback: don't "handle" error by BUG() Jan Beulich <jbeulich(a)suse.com> xen-blkback: don't "handle" error by BUG() Stefano Stabellini <stefano.stabellini(a)xilinx.com> xen/arm: don't ignore return errors from set_phys_to_machine Jan Beulich <jbeulich(a)suse.com> Xen/gntdev: correct error checking in gntdev_map_grant_pages() Jan Beulich <jbeulich(a)suse.com> Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() Jan Beulich <jbeulich(a)suse.com> Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() Jan Beulich <jbeulich(a)suse.com> Xen/x86: don't bail early from clear_foreign_p2m_mapping() Yonatan Linik <yonatanlinik(a)gmail.com> net: fix proc_fs init handling in af_packet and tls Wang Hai <wanghai38(a)huawei.com> net: bridge: Fix a warning when del bridge sysfs Eelco Chaudron <echaudro(a)redhat.com> net: openvswitch: fix TTL decrement exception action execution Pablo Neira Ayuso <pablo(a)netfilter.org> net: sched: incorrect Kconfig dependencies on Netfilter modules Lorenzo Bianconi <lorenzo(a)kernel.org> mt76: mt7615: fix rdd mcu cmd endianness Felix Fietkau <nbd(a)nbd.name> mt76: mt7915: fix endian issues wenxu <wenxu(a)ucloud.cn> net/sched: fix miss init the mru in qdisc_skb_cb Florian Westphal <fw(a)strlen.de> mptcp: skip to next candidate if subflow has unacked data Loic Poulain <loic.poulain(a)linaro.org> net: qrtr: Fix port ID for control messages Max Gurtovoy <mgurtovoy(a)nvidia.com> IB/isert: add module param to set sg_tablesize for IO cmd Stefano Garzarella <sgarzare(a)redhat.com> vdpa_sim: add get_config callback in vdpasim_dev_attr Stefano Garzarella <sgarzare(a)redhat.com> vdpa_sim: make 'config' generic and usable for any device type Stefano Garzarella <sgarzare(a)redhat.com> vdpa_sim: store parsed MAC address in a buffer Stefano Garzarella <sgarzare(a)redhat.com> vdpa_sim: add struct vdpasim_dev_attr for device attributes Max Gurtovoy <mgurtovoy(a)nvidia.com> vdpa_sim: remove hard-coded virtq count ------------- Diffstat: Makefile | 4 +- arch/arm/xen/p2m.c | 6 +- arch/x86/xen/p2m.c | 15 ++--- drivers/block/xen-blkback/blkback.c | 32 +++++---- drivers/bluetooth/btusb.c | 20 ++---- drivers/infiniband/ulp/isert/ib_isert.c | 27 +++++++- drivers/infiniband/ulp/isert/ib_isert.h | 6 ++ drivers/media/usb/pwc/pwc-if.c | 22 +++--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 89 ++++++++++++++++++------- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 87 ++++++++++++++++++------ drivers/net/xen-netback/netback.c | 4 +- drivers/tty/tty_io.c | 5 +- drivers/vdpa/vdpa_sim/vdpa_sim.c | 83 ++++++++++++++++------- drivers/xen/gntdev.c | 37 +++++----- drivers/xen/xen-scsiback.c | 4 +- fs/btrfs/ctree.h | 6 +- fs/btrfs/inode.c | 6 +- include/xen/grant_table.h | 1 + net/bridge/br.c | 5 +- net/core/dev.c | 2 + net/mptcp/protocol.c | 5 +- net/openvswitch/actions.c | 15 ++--- net/packet/af_packet.c | 2 + net/qrtr/qrtr.c | 2 +- net/sched/Kconfig | 6 +- net/tls/tls_proc.c | 3 + 26 files changed, 337 insertions(+), 157 deletions(-)

3 years, 11 months

10
44
0 0

ceph: downgrade warning from mdsmap decode to debug

by Jeff Layton

Hi, we'd like to request that you pull this commit into stable kernels. It's a trivial patch that just downgrades a (harmless) kernel warning message to debug level. The warning can be very chatty in some situations, and it'd be nice to silence it. -----------------------------8<------------------------------- commit ccd1acdf1c49b835504b235461fd24e2ed826764 Author: Luis Henriques <lhenriques(a)suse.de> Date: Thu Nov 12 11:25:32 2020 +0000 ceph: downgrade warning from mdsmap decode to debug While the MDS cluster is unstable and changing state the client may get mdsmap updates that will trigger warnings: [144692.478400] ceph: mdsmap_decode got incorrect state(up:standby-replay) [144697.489552] ceph: mdsmap_decode got incorrect state(up:standby-replay) [144697.489580] ceph: mdsmap_decode got incorrect state(up:standby-replay) This patch downgrades these warnings to debug, as they may flood the logs if the cluster is unstable for a while. Signed-off-by: Luis Henriques <lhenriques(a)suse.de> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Thanks! -- Jeff Layton <jlayton(a)kernel.org>

3 years, 11 months

2
1
0 0

[PATCH 0/2] Set CLEAR_PAYLOAD_ID_TABLE as broadcast request

by Wayne Lin

While testing MST hotplug events on daisy chain monitors, find out that CLEAR_PAYLOAD_ID_TABLE is not broadcasted and payload id table is not reset. Dig in deeper and find out two parts needed to be fixed. 1. Link_Count_Total & Link_Count_Remaining of Broadcast message are incorrect. Should set lct=1 & lcr=6 2. CLEAR_PAYLOAD_ID_TABLE request message is not set as path broadcast request message. Should fix this. Wayne Lin (2): drm/dp_mst: Revise broadcast msg lct & lcr drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast drivers/gpu/drm/drm_dp_mst_topology.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) -- 2.17.1

3 years, 11 months

4
11
0 0

stable-rc/queue/4.19 baseline: 94 runs, 2 regressions (v4.19.177-6-gc2abc0d9dcbc4)

by kernelci.org bot

stable-rc/queue/4.19 baseline: 94 runs, 2 regressions (v4.19.177-6-gc2abc0d9dcbc4) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -----------+------+--------------+----------+-----------------------+------------ da850-lcdk | arm | lab-baylibre | gcc-8 | davinci_all_defconfig | 2 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F4.19/kernel/v4.19.17… Test: baseline Tree: stable-rc Branch: queue/4.19 Describe: v4.19.177-6-gc2abc0d9dcbc4 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: c2abc0d9dcbc4934a6d27d1c6f2a0550a2cccd7c Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -----------+------+--------------+----------+-----------------------+------------ da850-lcdk | arm | lab-baylibre | gcc-8 | davinci_all_defconfig | 2 Details: https://kernelci.org/test/plan/id/60365cac0fc00930d7addcde Results: 3 PASS, 2 FAIL, 0 SKIP Full config: davinci_all_defconfig Compiler: gcc-8 (arm-linux-gnueabihf-gcc (Debian 8.3.0-2) 8.3.0) Plain log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.177-6-gc2abc0d9dcb… HTML log: https://storage.kernelci.org//stable-rc/queue-4.19/v4.19.177-6-gc2abc0d9dcb… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/kci-2020.05-4-g97706c5d… * baseline.dmesg.alert: https://kernelci.org/test/case/id/60365cac0fc00930d7addce2 new failure (last pass: v4.19.177-3-gf35f4fc2fb4e) 3 lines 2021-02-24 14:02:59.215000+00:00 kern :alert : raw: 00000000 00000100 00000200 00000000 00000004 0000000a ffffff7f 00000000 2021-02-24 14:02:59.215000+00:00 kern :alert : page dumped because: nonzero mapcount 2021-02-24 14:02:59.275000+00:00 <8><LAVA_SIGNAL_TESTCASE TEST_CASE_ID=alert RESULT=fail UNITS=lines MEASUREMENT=3> * baseline.dmesg.emerg: https://kernelci.org/test/case/id/60365cac0fc00930d7addce3 new failure (last pass: v4.19.177-3-gf35f4fc2fb4e) 2 lines 2021-02-24 14:02:59.418000+00:00 kern :emerg : flags: 0x0() 2021-02-24 14:02:59.504000+00:00 <8><LAVA_SIGNAL_TESTCASE TEST_CASE_ID=emerg RESULT=fail UNITS=lines MEASUREMENT=2> 2021-02-24 14:02:59.504000+00:00 + set +x 2021-02-24 14:02:59.504000+00:00 <8><LAVA_SIGNAL_ENDRUN 0_dmesg 756530_1.5.2.4.1> 2021-02-24 14:02:59.609000+00:00 #

3 years, 11 months

1
0
0 0

Please apply "xen-netback: delete NAPI instance when queue fails to initialize" to v4.4.y

by SeongJae Park

This is a request for merge of upstream commit 4a658527271b ("xen-netback: delete NAPI instance when queue fails to initialize") on v4.4.y tree. If 'xenvif_connect()' fails after successful 'netif_napi_add()', the napi is not cleaned up. Because 'create_queues()' frees the queues in its error handling code, if the 'xenvif_free()' is called for the vif, use-after-free occurs. The upstream commit fixes the problem by cleaning up the napi in the 'xenvif_connect()'. Attaching the original patch below for your convenience. Tested-by: Markus Boehme <markubo(a)amazon.de> Thanks, SeongJae Park ==================================== >8 ======================================= >From 4a658527271bce43afb1cf4feec89afe6716ca59 Mon Sep 17 00:00:00 2001 From: David Vrabel <david.vrabel(a)citrix.com> Date: Fri, 15 Jan 2016 14:55:35 +0000 Subject: [PATCH] xen-netback: delete NAPI instance when queue fails to initialize When xenvif_connect() fails it may leave a stale NAPI instance added to the device. Make sure we delete it in the error path. Signed-off-by: David Vrabel <david.vrabel(a)citrix.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> --- drivers/net/xen-netback/interface.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c index e7bd63eb2876..3bba6ceee132 100644 --- a/drivers/net/xen-netback/interface.c +++ b/drivers/net/xen-netback/interface.c @@ -615,6 +615,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref, queue->tx_irq = 0; err_unmap: xenvif_unmap_frontend_rings(queue); + netif_napi_del(&queue->napi); err: module_put(THIS_MODULE); return err; -- 2.17.1

3 years, 11 months

2
2
0 0

[PATCH v7] tpm: fix reference counting for struct tpm_chip

by Lino Sanfilippo

From: Lino Sanfilippo <l.sanfilippo(a)kunbus.com> The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [<c0410c3c>] (unwind_backtrace) from [<c040b580>] (show_stack+0x10/0x14) [<c040b580>] (show_stack) from [<c1092174>] (dump_stack+0xc4/0xd8) [<c1092174>] (dump_stack) from [<c0445a30>] (__warn+0x104/0x108) [<c0445a30>] (__warn) from [<c0445aa8>] (warn_slowpath_fmt+0x74/0xb8) [<c0445aa8>] (warn_slowpath_fmt) from [<c08435d0>] (kobject_get+0xa0/0xa4) [<c08435d0>] (kobject_get) from [<bf0a715c>] (tpm_try_get_ops+0x14/0x54 [tpm]) [<bf0a715c>] (tpm_try_get_ops [tpm]) from [<bf0a7d6c>] (tpm_common_write+0x38/0x60 [tpm]) [<bf0a7d6c>] (tpm_common_write [tpm]) from [<c05a7ac0>] (vfs_write+0xc4/0x3c0) [<c05a7ac0>] (vfs_write) from [<c05a7ee4>] (ksys_write+0x58/0xcc) [<c05a7ee4>] (ksys_write) from [<c04001a0>] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm<n>") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases. Cc: stable(a)vger.kernel.org Fixes: fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm<n>") Fixes: 8979b02aaf1d ("tpm: Fix reference count to main device") Co-developed-by: Jason Gunthorpe <jgg(a)ziepe.ca> Signed-off-by: Jason Gunthorpe <jgg(a)ziepe.ca> Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com> --- drivers/char/tpm/tpm-chip.c | 48 ++++++++----------------------------- drivers/char/tpm/tpm.h | 1 + drivers/char/tpm/tpm2-space.c | 55 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+), 38 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index ddaeceb..3f59f09 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -274,14 +274,6 @@ static void tpm_dev_release(struct device *dev) kfree(chip); } -static void tpm_devs_release(struct device *dev) -{ - struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); - - /* release the master device reference */ - put_device(&chip->dev); -} - /** * tpm_class_shutdown() - prepare the TPM device for loss of power. * @dev: device to which the chip is associated. @@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, chip->dev_num = rc; device_initialize(&chip->dev); - device_initialize(&chip->devs); chip->dev.class = tpm_class; chip->dev.class->shutdown_pre = tpm_class_shutdown; @@ -352,39 +343,20 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, chip->dev.parent = pdev; chip->dev.groups = chip->groups; - chip->devs.parent = pdev; - chip->devs.class = tpmrm_class; - chip->devs.release = tpm_devs_release; - /* get extra reference on main device to hold on - * behalf of devs. This holds the chip structure - * while cdevs is in use. The corresponding put - * is in the tpm_devs_release (TPM2 only) - */ - if (chip->flags & TPM_CHIP_FLAG_TPM2) - get_device(&chip->dev); - if (chip->dev_num == 0) chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); else chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); - chip->devs.devt = - MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); - rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); if (rc) goto out; - rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); - if (rc) - goto out; if (!pdev) chip->flags |= TPM_CHIP_FLAG_VIRTUAL; cdev_init(&chip->cdev, &tpm_fops); - cdev_init(&chip->cdevs, &tpmrm_fops); chip->cdev.owner = THIS_MODULE; - chip->cdevs.owner = THIS_MODULE; rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); if (rc) { @@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, return chip; out: - put_device(&chip->devs); put_device(&chip->dev); return ERR_PTR(rc); } @@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) } if (chip->flags & TPM_CHIP_FLAG_TPM2) { - rc = cdev_device_add(&chip->cdevs, &chip->devs); - if (rc) { - dev_err(&chip->devs, - "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", - dev_name(&chip->devs), MAJOR(chip->devs.devt), - MINOR(chip->devs.devt), rc); - return rc; - } + rc = tpm_devs_add(chip); + if (rc) + goto out_cdev; } /* Make the chip available. */ @@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) idr_replace(&dev_nums_idr, chip, chip->dev_num); mutex_unlock(&idr_lock); + return 0; + +out_cdev: + cdev_device_del(&chip->cdev, &chip->dev); return rc; } @@ -640,8 +610,10 @@ void tpm_chip_unregister(struct tpm_chip *chip) if (IS_ENABLED(CONFIG_HW_RANDOM_TPM)) hwrng_unregister(&chip->hwrng); tpm_bios_log_teardown(chip); - if (chip->flags & TPM_CHIP_FLAG_TPM2) + if (chip->flags & TPM_CHIP_FLAG_TPM2) { cdev_device_del(&chip->cdevs, &chip->devs); + put_device(&chip->devs); + } tpm_del_char_device(chip); } EXPORT_SYMBOL_GPL(tpm_chip_unregister); diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 947d1db..ac4b2dc 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -238,6 +238,7 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, size_t cmdsiz); int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, size_t *bufsiz); +int tpm_devs_add(struct tpm_chip *chip); void tpm_bios_log_setup(struct tpm_chip *chip); void tpm_bios_log_teardown(struct tpm_chip *chip); diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index 784b8b3..2f8bb3e 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -571,3 +571,58 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, dev_err(&chip->dev, "%s: error %d\n", __func__, rc); return rc; } + +/* + * Put the reference to the main device. + */ +static void tpm_devs_release(struct device *dev) +{ + struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); + + /* release the master device reference */ + put_device(&chip->dev); +} + +/* + * Add a device file to expose TPM spaces. Also take a reference to the + * main device. + */ +int tpm_devs_add(struct tpm_chip *chip) +{ + int rc; + + device_initialize(&chip->devs); + chip->devs.parent = chip->dev.parent; + chip->devs.class = tpmrm_class; + + /* + * Get extra reference on main device to hold on behalf of devs. + * This holds the chip structure while cdevs is in use. The + * corresponding put is in the tpm_devs_release. + */ + get_device(&chip->dev); + chip->devs.release = tpm_devs_release; + chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); + cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdevs.owner = THIS_MODULE; + + rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto out_devs; + + rc = cdev_device_add(&chip->cdevs, &chip->devs); + if (rc) { + dev_err(&chip->devs, + "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", + dev_name(&chip->devs), MAJOR(chip->devs.devt), + MINOR(chip->devs.devt), rc); + goto out_devs; + } + + return 0; + +out_devs: + put_device(&chip->devs); + + return rc; +} -- 2.7.4

3 years, 11 months

2
1
0 0

[PATCH v6] tpm: fix reference counting for struct tpm_chip

by Lino Sanfilippo

From: Lino Sanfilippo <l.sanfilippo(a)kunbus.com> The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [<c0410c3c>] (unwind_backtrace) from [<c040b580>] (show_stack+0x10/0x14) [<c040b580>] (show_stack) from [<c1092174>] (dump_stack+0xc4/0xd8) [<c1092174>] (dump_stack) from [<c0445a30>] (__warn+0x104/0x108) [<c0445a30>] (__warn) from [<c0445aa8>] (warn_slowpath_fmt+0x74/0xb8) [<c0445aa8>] (warn_slowpath_fmt) from [<c08435d0>] (kobject_get+0xa0/0xa4) [<c08435d0>] (kobject_get) from [<bf0a715c>] (tpm_try_get_ops+0x14/0x54 [tpm]) [<bf0a715c>] (tpm_try_get_ops [tpm]) from [<bf0a7d6c>] (tpm_common_write+0x38/0x60 [tpm]) [<bf0a7d6c>] (tpm_common_write [tpm]) from [<c05a7ac0>] (vfs_write+0xc4/0x3c0) [<c05a7ac0>] (vfs_write) from [<c05a7ee4>] (ksys_write+0x58/0xcc) [<c05a7ee4>] (ksys_write) from [<c04001a0>] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm<n>") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases. Cc: stable(a)vger.kernel.org Fixes: fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm<n>") Fixes: 8979b02aaf1d ("tpm: Fix reference count to main device") Co-developed-by: Jason Gunthorpe <jgg(a)ziepe.ca> Signed-off-by: Jason Gunthorpe <jgg(a)ziepe.ca> Signed-off-by: Lino Sanfilippo <l.sanfilippo(a)kunbus.com> --- drivers/char/tpm/tpm-chip.c | 48 ++++++++----------------------------- drivers/char/tpm/tpm.h | 1 + drivers/char/tpm/tpm2-space.c | 55 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+), 38 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index ddaeceb..ae6e414 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -274,14 +274,6 @@ static void tpm_dev_release(struct device *dev) kfree(chip); } -static void tpm_devs_release(struct device *dev) -{ - struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); - - /* release the master device reference */ - put_device(&chip->dev); -} - /** * tpm_class_shutdown() - prepare the TPM device for loss of power. * @dev: device to which the chip is associated. @@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, chip->dev_num = rc; device_initialize(&chip->dev); - device_initialize(&chip->devs); chip->dev.class = tpm_class; chip->dev.class->shutdown_pre = tpm_class_shutdown; @@ -352,39 +343,20 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, chip->dev.parent = pdev; chip->dev.groups = chip->groups; - chip->devs.parent = pdev; - chip->devs.class = tpmrm_class; - chip->devs.release = tpm_devs_release; - /* get extra reference on main device to hold on - * behalf of devs. This holds the chip structure - * while cdevs is in use. The corresponding put - * is in the tpm_devs_release (TPM2 only) - */ - if (chip->flags & TPM_CHIP_FLAG_TPM2) - get_device(&chip->dev); - if (chip->dev_num == 0) chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); else chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); - chip->devs.devt = - MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); - rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); if (rc) goto out; - rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); - if (rc) - goto out; if (!pdev) chip->flags |= TPM_CHIP_FLAG_VIRTUAL; cdev_init(&chip->cdev, &tpm_fops); - cdev_init(&chip->cdevs, &tpmrm_fops); chip->cdev.owner = THIS_MODULE; - chip->cdevs.owner = THIS_MODULE; rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); if (rc) { @@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, return chip; out: - put_device(&chip->devs); put_device(&chip->dev); return ERR_PTR(rc); } @@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) } if (chip->flags & TPM_CHIP_FLAG_TPM2) { - rc = cdev_device_add(&chip->cdevs, &chip->devs); - if (rc) { - dev_err(&chip->devs, - "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", - dev_name(&chip->devs), MAJOR(chip->devs.devt), - MINOR(chip->devs.devt), rc); - return rc; - } + rc = tpm_devs_add(chip); + if (rc) + goto del_cdev; } /* Make the chip available. */ @@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) idr_replace(&dev_nums_idr, chip, chip->dev_num); mutex_unlock(&idr_lock); + return 0; + +del_cdev: + cdev_device_del(&chip->cdev, &chip->dev); return rc; } @@ -640,8 +610,10 @@ void tpm_chip_unregister(struct tpm_chip *chip) if (IS_ENABLED(CONFIG_HW_RANDOM_TPM)) hwrng_unregister(&chip->hwrng); tpm_bios_log_teardown(chip); - if (chip->flags & TPM_CHIP_FLAG_TPM2) + if (chip->flags & TPM_CHIP_FLAG_TPM2) { cdev_device_del(&chip->cdevs, &chip->devs); + put_device(&chip->devs); + } tpm_del_char_device(chip); } EXPORT_SYMBOL_GPL(tpm_chip_unregister); diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 947d1db..ac4b2dc 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -238,6 +238,7 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, size_t cmdsiz); int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, size_t *bufsiz); +int tpm_devs_add(struct tpm_chip *chip); void tpm_bios_log_setup(struct tpm_chip *chip); void tpm_bios_log_teardown(struct tpm_chip *chip); diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index 784b8b3..6d17f77 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -571,3 +571,58 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, dev_err(&chip->dev, "%s: error %d\n", __func__, rc); return rc; } + +/* + * Put the reference to the main device. + */ +static void tpm_devs_release(struct device *dev) +{ + struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); + + /* release the master device reference */ + put_device(&chip->dev); +} + +/* + * Add a device file to expose TPM spaces. Also take a reference to the + * main device. + */ +int tpm_devs_add(struct tpm_chip *chip) +{ + int rc; + + device_initialize(&chip->devs); + chip->devs.parent = chip->dev.parent; + chip->devs.class = tpmrm_class; + + /* + * Get extra reference on main device to hold on behalf of devs. + * This holds the chip structure while cdevs is in use. The + * corresponding put is in the tpm_devs_release. + */ + get_device(&chip->dev); + chip->devs.release = tpm_devs_release; + chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); + cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdevs.owner = THIS_MODULE; + + rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto out_put_devs; + + rc = cdev_device_add(&chip->cdevs, &chip->devs); + if (rc) { + dev_err(&chip->devs, + "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", + dev_name(&chip->devs), MAJOR(chip->devs.devt), + MINOR(chip->devs.devt), rc); + goto out_put_devs; + } + + return 0; + +out_put_devs: + put_device(&chip->devs); + + return rc; +} -- 2.7.4

3 years, 11 months

2
5
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2021