linux-toradex.git/drivers/uio/uio.c, branch v5.3.2

driver: uio: fix possible use-after-free in __uio_register_device

2019-01-31T15:36:52+00:00

In uio_dev_add_attributes() error handing case, idev is used after
device_unregister(), in which 'idev' has been released, touch idev cause
use-after-free.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian 
Reviewed-by: Hamish Martin 
Signed-off-by: Greg Kroah-Hartman

driver: uio: fix possible memory leak in __uio_register_device

2019-01-31T15:36:36+00:00

'idev' is malloced in __uio_register_device() and leak free it before
leaving from the uio_get_minor() error handing case, it will cause
memory leak.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian 
Reviewed-by: Hamish Martin 
Signed-off-by: Greg Kroah-Hartman

uio: remove redundant check

2019-01-22T11:03:16+00:00

It is not necessary to check idev->info several times under
mutex lock, so just remove redundant check.

Signed-off-by: Chengguang Xu 
Signed-off-by: Greg Kroah-Hartman

uio: fix potential memory leak in error case

2019-01-22T11:03:16+00:00

Should jump to lable err_infoopen when idev->info is NULL
in uio_open().

Signed-off-by: Chengguang Xu 
Signed-off-by: Greg Kroah-Hartman

uio: dismiss waiters on device unregistration

2018-11-27T10:19:10+00:00

When the device is unregistered, it should wake up the blocking waiters.
Otherwise, they will sleep forever.

Signed-off-by: Zhaolong Zhang 
Signed-off-by: Greg Kroah-Hartman

uio: Fix an Oops on load

2018-11-11T17:21:46+00:00

I was trying to solve a double free but I introduced a more serious
NULL dereference bug.  The problem is that if there is an IRQ which
triggers immediately, then we need "info->uio_dev" but it's not set yet.

This patch puts the original initialization back to how it was and just
sets info->uio_dev to NULL on the error path so it should solve both
the Oops and the double free.

Fixes: f019f07ecf6a ("uio: potential double frees if __uio_register_device() fails")
Reported-by: Mathias Thore 
Signed-off-by: Dan Carpenter 
Cc: stable 
Tested-by: Mathias Thore 
Signed-off-by: Greg Kroah-Hartman

uio: make symbol 'uio_class_registered' static

2018-10-02T22:38:14+00:00

Fixes the following sparse warning:

drivers/uio/uio.c:277:6: warning:
 symbol 'uio_class_registered' was not declared. Should it be static?

Fixes: ae61cf5b9913 ("uio: ensure class is registered before devices")
Signed-off-by: Wei Yongjun 
Signed-off-by: Greg Kroah-Hartman

uio: introduce UIO_MEM_IOVA

2018-09-25T18:33:24+00:00

Introduce the concept of mapping physical memory locations that
are normal memory. The new type UIO_MEM_IOVA are similar to
existing UIO_MEM_PHYS but the backing memory is not marked as uncached.

Also, indent related switch to the currently used style.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Greg Kroah-Hartman

uio: convert to vm_fault_t

2018-09-12T07:46:46+00:00

As part of commit 9b85e95a3080 ("uio: Change return
type to vm_fault_t") in 4.19-rc1, this conversion
was missed. Now converted 'ret' to vm_fault_t type.

Signed-off-by: Souptick Joarder 
Signed-off-by: Greg Kroah-Hartman

uio: ensure class is registered before devices

2018-09-12T07:46:46+00:00

When both uio and the uio drivers are built in the kernel, it is possible
for a driver to register devices before the uio class is registered.

This may result in a NULL pointer dereference later on in
get_device_parent() when accessing the class glue_dirs spinlock.

The trace looks like that:

Unable to handle kernel NULL pointer dereference at virtual address 00000140
[...]
[] _raw_spin_lock+0x14/0x48
[] device_add+0x154/0x6a0
[] device_create_groups_vargs+0x120/0x128
[] device_create+0x54/0x60
[] __uio_register_device+0x120/0x4a8
[] jaguar2_pci_probe+0x2d4/0x558
[] local_pci_probe+0x3c/0xb8
[] pci_device_probe+0x11c/0x180
[] driver_probe_device+0x22c/0x2d8
[] __driver_attach+0xbc/0xc0
[] bus_for_each_dev+0x4c/0x98
[] driver_attach+0x20/0x28
[] bus_add_driver+0x1b8/0x228
[] driver_register+0x60/0xf8
[] __pci_register_driver+0x40/0x48

Return EPROBE_DEFER in that case so the driver can register the device
later.

Signed-off-by: Alexandre Belloni 
Signed-off-by: Greg Kroah-Hartman