releases/6.6.26/gpio-cdev-sanitize-the-label-before-requesting-the-interrupt.patch

   1 From b34490879baa847d16fc529c8ea6e6d34f004b38 Mon Sep 17 00:00:00 2001
   2 From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
   3 Date: Mon, 25 Mar 2024 10:02:42 +0100
   4 Subject: gpio: cdev: sanitize the label before requesting the interrupt
   5
   6 From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
   7
   8 commit b34490879baa847d16fc529c8ea6e6d34f004b38 upstream.
   9
  10 When an interrupt is requested, a procfs directory is created under
  11 "/proc/irq/<irqnum>/<label>" where <label> is the string passed to one of
  12 the request_irq() variants.
  13
  14 What follows is that the string must not contain the "/" character or
  15 the procfs mkdir operation will fail. We don't have such constraints for
  16 GPIO consumer labels which are used verbatim as interrupt labels for
  17 GPIO irqs. We must therefore sanitize the consumer string before
  18 requesting the interrupt.
  19
  20 Let's replace all "/" with ":".
  21
  22 Cc: stable@vger.kernel.org
  23 Reported-by: Stefan Wahren <wahrenst@gmx.net>
  24 Closes: https://lore.kernel.org/linux-gpio/39fe95cb-aa83-4b8b-8cab-63947a726754@gmx.net/
  25 Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
  26 Reviewed-by: Kent Gibson <warthog618@gmail.com>
  27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28 ---
  29  drivers/gpio/gpiolib-cdev.c |   38 ++++++++++++++++++++++++++++++++------
  30  1 file changed, 32 insertions(+), 6 deletions(-)
  31
  32 --- a/drivers/gpio/gpiolib-cdev.c
  33 +++ b/drivers/gpio/gpiolib-cdev.c
  34 @@ -1010,10 +1010,20 @@ static u32 gpio_v2_line_config_debounce_
  35         return 0;
  36  }
  37
  38 +static inline char *make_irq_label(const char *orig)
  39 +{
  40 +       return kstrdup_and_replace(orig, '/', ':', GFP_KERNEL);
  41 +}
  42 +
  43 +static inline void free_irq_label(const char *label)
  44 +{
  45 +       kfree(label);
  46 +}
  47 +
  48  static void edge_detector_stop(struct line *line)
  49  {
  50         if (line->irq) {
  51 -               free_irq(line->irq, line);
  52 +               free_irq_label(free_irq(line->irq, line));
  53                 line->irq = 0;
  54         }
  55
  56 @@ -1038,6 +1048,7 @@ static int edge_detector_setup(struct li
  57         unsigned long irqflags = 0;
  58         u64 eflags;
  59         int irq, ret;
  60 +       char *label;
  61
  62         eflags = edflags & GPIO_V2_LINE_EDGE_FLAGS;
  63         if (eflags && !kfifo_initialized(&line->req->events)) {
  64 @@ -1074,11 +1085,17 @@ static int edge_detector_setup(struct li
  65                         IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
  66         irqflags |= IRQF_ONESHOT;
  67
  68 +       label = make_irq_label(line->req->label);
  69 +       if (!label)
  70 +               return -ENOMEM;
  71 +
  72         /* Request a thread to read the events */
  73         ret = request_threaded_irq(irq, edge_irq_handler, edge_irq_thread,
  74 -                                  irqflags, line->req->label, line);
  75 -       if (ret)
  76 +                                  irqflags, label, line);
  77 +       if (ret) {
  78 +               free_irq_label(label);
  79                 return ret;
  80 +       }
  81
  82         line->irq = irq;
  83         return 0;
  84 @@ -1943,7 +1960,7 @@ static void lineevent_free(struct lineev
  85                 blocking_notifier_chain_unregister(&le->gdev->device_notifier,
  86                                                    &le->device_unregistered_nb);
  87         if (le->irq)
  88 -               free_irq(le->irq, le);
  89 +               free_irq_label(free_irq(le->irq, le));
  90         if (le->desc)
  91                 gpiod_free(le->desc);
  92         kfree(le->label);
  93 @@ -2091,6 +2108,7 @@ static int lineevent_create(struct gpio_
  94         int fd;
  95         int ret;
  96         int irq, irqflags = 0;
  97 +       char *label;
  98
  99         if (copy_from_user(&eventreq, ip, sizeof(eventreq)))
 100                 return -EFAULT;
 101 @@ -2175,15 +2193,23 @@ static int lineevent_create(struct gpio_
 102         if (ret)
 103                 goto out_free_le;
 104
 105 +       label = make_irq_label(le->label);
 106 +       if (!label) {
 107 +               ret = -ENOMEM;
 108 +               goto out_free_le;
 109 +       }
 110 +
 111         /* Request a thread to read the events */
 112         ret = request_threaded_irq(irq,
 113                                    lineevent_irq_handler,
 114                                    lineevent_irq_thread,
 115                                    irqflags,
 116 -                                  le->label,
 117 +                                  label,
 118                                    le);
 119 -       if (ret)
 120 +       if (ret) {
 121 +               free_irq_label(label);
 122                 goto out_free_le;
 123 +       }
 124
 125         le->irq = irq;
 126