1. 22 Nov, 2022 2 commits
  2. 18 Nov, 2022 1 commit
  3. 16 Nov, 2022 3 commits
    • Yang Yingliang's avatar
      regulator: core: fix UAF in destroy_regulator() · 1f386d68
      Yang Yingliang authored
      I got a UAF report as following:
      
      ==================================================================
      BUG: KASAN: use-after-free in __lock_acquire+0x935/0x2060
      Read of size 8 at addr ffff88810e838220 by task python3/268
      Call Trace:
       <TASK>
       dump_stack_lvl+0x67/0x83
       print_report+0x178/0x4b0
       kasan_report+0x90/0x190
       __lock_acquire+0x935/0x2060
       lock_acquire+0x156/0x400
       _raw_spin_lock+0x2a/0x40
       lockref_get+0x11/0x30
       simple_recursive_removal+0x41/0x440
       debugfs_remove.part.12+0x32/0x50
       debugfs_remove+0x29/0x30
       _regulator_put.cold.54+0x3e/0x27f
       regulator_put+0x1f/0x30
       release_nodes+0x6a/0xa0
       devres_release_all+0xf8/0x150
      
      Allocated by task 37:
       kasan_save_stack+0x1c/0x40
       kasan_set_track+0x21/0x30
       __kasan_slab_alloc+0x5d/0x70
       slab_post_alloc_hook+0x62/0x510
       kmem_cache_alloc_lru+0x222/0x5a0
       __d_alloc+0x31/0x440
       d_alloc+0x30/0xf0
       d_alloc_parallel+0xc4/0xd20
       __lookup_slow+0x15e/0x2f0
       lookup_one_len+0x13a/0x150
       start_creating+0xea/0x190
       debugfs_create_dir+0x1e/0x210
       create_regulator+0x254/0x4e0
       _regulator_get+0x2a1/0x467
       _devm_regulator_get+0x5a/0xb0
       regulator_virtual_probe+0xb9/0x1a0
      
      Freed by task 30:
       kasan_save_stack+0x1c/0x40
       kasan_set_track+0x21/0x30
       kasan_save_free_info+0x2a/0x50
       __kasan_slab_free+0x102/0x190
       kmem_cache_free+0xf6/0x600
       rcu_core+0x54c/0x12b0
       __do_softirq+0xf2/0x5e3
      
      Last potentially related work creation:
       kasan_save_stack+0x1c/0x40
       __kasan_record_aux_stack+0x98/0xb0
       call_rcu+0x42/0x700
       dentry_free+0x6c/0xd0
       __dentry_kill+0x23b/0x2d0
       dput.part.31+0x431/0x780
       simple_recursive_removal+0xa9/0x440
       debugfs_remove.part.12+0x32/0x50
       debugfs_remove+0x29/0x30
       regulator_unregister+0xe3/0x230
       release_nodes+0x6a/0xa0
      
      ==================================================================
      
      Here is how happened:
      
      processor A					processor B
      regulator_register()
        rdev_init_debugfs()
          rdev->debugfs = debugfs_create_dir()
      						devm_regulator_get()
      						  rdev = regulator_dev_lookup()
      						  create_regulator(rdev)
      						    // using rdev->debugfs as parent
      						    debugfs_create_dir(rdev->debugfs)
      
      mfd_remove_devices_fn()
        release_nodes()
          regulator_unregister()
            // free rdev->debugfs
            debugfs_remove_recursive(rdev->debugfs)
      						release_nodes()
      						  destroy_regulator()
      						    debugfs_remove_recursive() <- causes UAF
      
      In devm_regulator_get(), after getting rdev, the refcount
      is get, so fix this by moving debugfs_remove_recursive()
      to regulator_dev_release(), then it can be proctected by
      the refcount, the 'rdev->debugfs' can not be freed until
      the refcount is 0.
      
      Fixes: 5de70519 ("regulator: Add basic per consumer debugfs")
      Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Link: https://lore.kernel.org/r/20221116033706.3595812-1-yangyingliang@huawei.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      1f386d68
    • Yang Yingliang's avatar
      regulator: rt5759: fix OOB in validate_desc() · 7920e0fb
      Yang Yingliang authored
      I got the following OOB report:
      
       BUG: KASAN: slab-out-of-bounds in validate_desc+0xba/0x109
       Read of size 8 at addr ffff888107db8ff0 by task python3/253
       Call Trace:
        <TASK>
        dump_stack_lvl+0x67/0x83
        print_report+0x178/0x4b0
        kasan_report+0x90/0x190
        validate_desc+0xba/0x109
        gpiod_set_value_cansleep+0x40/0x5a
        regulator_ena_gpio_ctrl+0x93/0xfc
        _regulator_do_enable.cold.61+0x89/0x163
        set_machine_constraints+0x140a/0x159c
        regulator_register.cold.73+0x762/0x10cd
        devm_regulator_register+0x57/0xb0
        rt5759_probe+0x3a0/0x4ac [rt5759_regulator]
      
      The desc used in validate_desc() is passed from 'reg_cfg.ena_gpiod',
      which is not initialized. Fix this by initializing 'reg_cfg' to 0.
      
      Fixes: 7b36ddb2 ("regulator: rt5759: Add support for Richtek RT5759 DCDC converter")
      Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Link: https://lore.kernel.org/r/20221116092943.1668326-1-yangyingliang@huawei.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      7920e0fb
    • Zeng Heng's avatar
      regulator: core: fix kobject release warning and memory leak in regulator_register() · 5f4b204b
      Zeng Heng authored
      Here is a warning report about lack of registered release()
      from kobject lib:
      
      Device '(null)' does not have a release() function, it is broken and must be fixed.
      WARNING: CPU: 0 PID: 48430 at drivers/base/core.c:2332 device_release+0x104/0x120
      Call Trace:
       kobject_put+0xdc/0x180
       put_device+0x1b/0x30
       regulator_register+0x651/0x1170
       devm_regulator_register+0x4f/0xb0
      
      When regulator_register() returns fail and directly goto `clean` symbol,
      rdev->dev has not registered release() function yet (which is registered
      by regulator_class in the following), so rdev needs to be freed manually.
      If rdev->dev.of_node is not NULL, which means the of_node has gotten by
      regulator_of_get_init_data(), it needs to call of_node_put() to avoid
      refcount leak.
      
      Otherwise, only calling put_device() would lead memory leak of rdev
      in further:
      
      unreferenced object 0xffff88810d0b1000 (size 2048):
        comm "107-i2c-rtq6752", pid 48430, jiffies 4342258431 (age 1341.780s)
        backtrace:
          kmalloc_trace+0x22/0x110
          regulator_register+0x184/0x1170
          devm_regulator_register+0x4f/0xb0
      
      When regulator_register() returns fail and goto `wash` symbol,
      rdev->dev has registered release() function, so directly call
      put_device() to cleanup everything.
      
      Fixes: d3c73156 ("regulator: plug of_node leak in regulator_register()'s error path")
      Signed-off-by: default avatarZeng Heng <zengheng4@huawei.com>
      Link: https://lore.kernel.org/r/20221116074339.1024240-1-zengheng4@huawei.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      5f4b204b
  4. 29 Sep, 2022 2 commits
  5. 26 Sep, 2022 1 commit
  6. 23 Sep, 2022 2 commits
  7. 19 Sep, 2022 2 commits
  8. 13 Sep, 2022 5 commits
  9. 09 Sep, 2022 3 commits
  10. 08 Sep, 2022 1 commit
  11. 05 Sep, 2022 2 commits
  12. 04 Sep, 2022 5 commits
    • Linus Torvalds's avatar
      Linux 6.0-rc4 · 7e18e42e
      Linus Torvalds authored
      7e18e42e
    • Linus Torvalds's avatar
      Merge tag 'powerpc-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 59954972
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       - Fix handling of PCI domains in /proc on 32-bit systems using the
         recently added support for numbering buses from zero for each domain.
      
       - A fix and a revert for some changes to use READ/WRITE_ONCE() which
         caused problems with KASAN enabled due to sanitisation calls being
         introduced in low-level paths that can't cope with it.
      
       - Fix build errors on 32-bit caused by the syscall table being
         misaligned sometimes.
      
       - Two fixes to get IBM Cell native machines booting again, which had
         bit-rotted while my QS22 was temporarily out of action.
      
       - Fix the papr_scm driver to not assume the order of events returned by
         the hypervisor is stable, and a related compile fix.
      
      Thanks to Aneesh Kumar K.V, Christophe Leroy, Jordan Niethe, Kajol Jain,
      Masahiro Yamada, Nathan Chancellor, Pali Rohár, Vaibhav Jain, and Zhouyi
      Zhou.
      
      * tag 'powerpc-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/papr_scm: Ensure rc is always initialized in papr_scm_pmu_register()
        Revert "powerpc/irq: Don't open code irq_soft_mask helpers"
        powerpc: Fix hard_irq_disable() with sanitizer
        powerpc/rtas: Fix RTAS MSR[HV] handling for Cell
        Revert "powerpc: Remove unused FW_FEATURE_NATIVE references"
        powerpc: align syscall table for ppc32
        powerpc/pci: Enable PCI domains in /proc when PCI bus numbers are not unique
        powerpc/papr_scm: Fix nvdimm event mappings
      59954972
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 685ed983
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
       "s390:
      
         - PCI interpretation compile fixes
      
        RISC-V:
      
         - fix unused variable warnings in vcpu_timer.c
      
         - move extern sbi_ext declarations to a header
      
        x86:
      
         - check validity of argument to KVM_SET_MP_STATE
      
         - use guest's global_ctrl to completely disable guest PEBS
      
         - fix a memory leak on memory allocation failure
      
         - mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES
      
         - fix build failure with Clang integrated assembler
      
         - fix MSR interception
      
         - always flush TLBs when enabling dirty logging"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: check validity of argument to KVM_SET_MP_STATE
        perf/x86/core: Completely disable guest PEBS via guest's global_ctrl
        KVM: x86: fix memoryleak in kvm_arch_vcpu_create()
        KVM: x86: Mask off unsupported and unknown bits of IA32_ARCH_CAPABILITIES
        KVM: s390: pci: Hook to access KVM lowlevel from VFIO
        riscv: kvm: move extern sbi_ext declarations to a header
        riscv: kvm: vcpu_timer: fix unused variable warnings
        KVM: selftests: Fix ambiguous mov in KVM_ASM_SAFE()
        KVM: selftests: Fix KVM_EXCEPTION_MAGIC build with Clang
        KVM: VMX: Heed the 'msr' argument in msr_write_intercepted()
        kvm: x86: mmu: Always flush TLBs when enabling dirty logging
        kvm: x86: mmu: Drop the need_remote_flush() function
      685ed983
    • Nick Desaulniers's avatar
      Makefile.extrawarn: re-enable -Wformat for clang; take 2 · b0839b28
      Nick Desaulniers authored
      -Wformat was recently re-enabled for builds with clang, then quickly
      re-disabled, due to concerns stemming from the frequency of default
      argument promotion related warning instances.
      
      commit 258fafcd ("Makefile.extrawarn: re-enable -Wformat for clang")
      commit 21f9c8a1 ("Revert "Makefile.extrawarn: re-enable -Wformat for clang"")
      
      ISO WG14 has ratified N2562 to address default argument promotion
      explicitly for printf, as part of the upcoming ISO C2X standard.
      
      The behavior of clang was changed in clang-16 to not warn for the cited
      cases in all language modes.
      
      Add a version check, so that users of clang-16 now get the full effect
      of -Wformat. For older clang versions, re-enable flags under the
      -Wformat group that way users still get some useful checks related to
      format strings, without noisy default argument promotion warnings. I
      intentionally omitted -Wformat-y2k and -Wformat-security from being
      re-enabled, which are also part of -Wformat in clang-16.
      
      Link: https://github.com/ClangBuiltLinux/linux/issues/378
      Link: https://github.com/llvm/llvm-project/issues/57102
      Link: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2562.pdfSuggested-by: default avatarJustin Stitt <jstitt007@gmail.com>
      Suggested-by: default avatarNathan Chancellor <nathan@kernel.org>
      Suggested-by: default avatarYoungmin Nam <youngmin.nam@samsung.com>
      Signed-off-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Reviewed-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      Reviewed-by: default avatarNathan Chancellor <nathan@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b0839b28
    • Linus Torvalds's avatar
      Merge tag 'gpio-fixes-for-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux · 7726d4c3
      Linus Torvalds authored
      Pull gpio fixes from Bartosz Golaszewski:
       "A a set of fixes from the GPIO subsystem.
      
        Most are small driver fixes except the realtek-otto driver patch which
        is pretty big but addresses a significant flaw that can cause the CPU
        to stay infinitely busy on uncleared ISR on some platforms.
      
        Summary:
         - MAINTAINERS update
         - fix resource leaks in gpio-mockup and gpio-pxa
         - add missing locking in gpio-pca953x
         - use 32-bit I/O in gpio-realtek-otto
         - make irq_chip structures immutable in four more drivers"
      
      * tag 'gpio-fixes-for-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
        gpio: ws16c48: Make irq_chip immutable
        gpio: 104-idio-16: Make irq_chip immutable
        gpio: 104-idi-48: Make irq_chip immutable
        gpio: 104-dio-48e: Make irq_chip immutable
        gpio: realtek-otto: switch to 32-bit I/O
        gpio: pca953x: Add mutex_lock for regcache sync in PM
        gpio: mockup: remove gpio debugfs when remove device
        gpio: pxa: use devres for the clock struct
        MAINTAINERS: rectify entry for XILINX GPIO DRIVER
      7726d4c3
  13. 03 Sep, 2022 11 commits