From: Sasha Levin Date: Tue, 14 Feb 2023 14:50:18 +0000 (-0500) Subject: Drop backport of nvmem: core: fix registration vs use race from 5.10 X-Git-Tag: v6.1.12~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a3c4cddc8cf0c193b115bde80a089e31f3b1a7e1;p=thirdparty%2Fkernel%2Fstable-queue.git Drop backport of nvmem: core: fix registration vs use race from 5.10 --- diff --git a/queue-5.10/nvmem-core-add-error-handling-for-dev_set_name.patch b/queue-5.10/nvmem-core-add-error-handling-for-dev_set_name.patch deleted file mode 100644 index fca8442f63a..00000000000 --- a/queue-5.10/nvmem-core-add-error-handling-for-dev_set_name.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 83fcce262e0ddca50148226b8d320b4b4948b7e3 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 16 Sep 2022 13:20:50 +0100 -Subject: nvmem: core: add error handling for dev_set_name - -From: Gaosheng Cui - -[ Upstream commit 5544e90c81261e82e02bbf7c6015a4b9c8c825ef ] - -The type of return value of dev_set_name is int, which may return -wrong result, so we add error handling for it to reclaim memory -of nvmem resource, and return early when an error occurs. - -Signed-off-by: Gaosheng Cui -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20220916122100.170016-4-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Stable-dep-of: ab3428cfd9aa ("nvmem: core: fix registration vs use race") -Signed-off-by: Sasha Levin ---- - drivers/nvmem/core.c | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index 48fbe49e3772b..9da4edbabfe75 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -661,18 +661,24 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - - switch (config->id) { - case NVMEM_DEVID_NONE: -- dev_set_name(&nvmem->dev, "%s", config->name); -+ rval = dev_set_name(&nvmem->dev, "%s", config->name); - break; - case NVMEM_DEVID_AUTO: -- dev_set_name(&nvmem->dev, "%s%d", config->name, nvmem->id); -+ rval = dev_set_name(&nvmem->dev, "%s%d", config->name, nvmem->id); - break; - default: -- dev_set_name(&nvmem->dev, "%s%d", -+ rval = dev_set_name(&nvmem->dev, "%s%d", - config->name ? : "nvmem", - config->name ? config->id : nvmem->id); - break; - } - -+ if (rval) { -+ ida_free(&nvmem_ida, nvmem->id); -+ kfree(nvmem); -+ return ERR_PTR(rval); -+ } -+ - nvmem->read_only = device_property_present(config->dev, "read-only") || - config->read_only || !nvmem->reg_write; - --- -2.39.0 - diff --git a/queue-5.10/nvmem-core-fix-cleanup-after-dev_set_name.patch b/queue-5.10/nvmem-core-fix-cleanup-after-dev_set_name.patch deleted file mode 100644 index 86fc6f7b4fc..00000000000 --- a/queue-5.10/nvmem-core-fix-cleanup-after-dev_set_name.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 98c0c20a6114ac98bb3f5ea476a64d9d81f89e31 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 27 Jan 2023 10:40:10 +0000 -Subject: nvmem: core: fix cleanup after dev_set_name() - -From: Russell King (Oracle) - -[ Upstream commit 560181d3ace61825f4ca9dd3481d6c0ee6709fa8 ] - -If dev_set_name() fails, we leak nvmem->wp_gpio as the cleanup does not -put this. While a minimal fix for this would be to add the gpiod_put() -call, we can do better if we split device_register(), and use the -tested nvmem_release() cleanup code by initialising the device early, -and putting the device. - -This results in a slightly larger fix, but results in clear code. - -Note: this patch depends on "nvmem: core: initialise nvmem->id early" -and "nvmem: core: remove nvmem_config wp_gpio". - -Fixes: 5544e90c8126 ("nvmem: core: add error handling for dev_set_name") -Cc: stable@vger.kernel.org -Reported-by: kernel test robot -Reported-by: Dan Carpenter -Signed-off-by: Russell King (Oracle) -[Srini: Fixed subject line and error code handing with wp_gpio while applying.] -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20230127104015.23839-6-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Stable-dep-of: ab3428cfd9aa ("nvmem: core: fix registration vs use race") -Signed-off-by: Sasha Levin ---- - drivers/nvmem/core.c | 22 ++++++++++------------ - 1 file changed, 10 insertions(+), 12 deletions(-) - -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index 38c05fce7d740..de356cdde4ce8 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -627,14 +627,18 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - - nvmem->id = rval; - -+ nvmem->dev.type = &nvmem_provider_type; -+ nvmem->dev.bus = &nvmem_bus_type; -+ nvmem->dev.parent = config->dev; -+ -+ device_initialize(&nvmem->dev); -+ - if (!config->ignore_wp) - nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp", - GPIOD_OUT_HIGH); - if (IS_ERR(nvmem->wp_gpio)) { -- ida_free(&nvmem_ida, nvmem->id); - rval = PTR_ERR(nvmem->wp_gpio); -- kfree(nvmem); -- return ERR_PTR(rval); -+ goto err_put_device; - } - - kref_init(&nvmem->refcnt); -@@ -646,9 +650,6 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - nvmem->stride = config->stride ?: 1; - nvmem->word_size = config->word_size ?: 1; - nvmem->size = config->size; -- nvmem->dev.type = &nvmem_provider_type; -- nvmem->dev.bus = &nvmem_bus_type; -- nvmem->dev.parent = config->dev; - nvmem->root_only = config->root_only; - nvmem->priv = config->priv; - nvmem->type = config->type; -@@ -671,11 +672,8 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - break; - } - -- if (rval) { -- ida_free(&nvmem_ida, nvmem->id); -- kfree(nvmem); -- return ERR_PTR(rval); -- } -+ if (rval) -+ goto err_put_device; - - nvmem->read_only = device_property_present(config->dev, "read-only") || - config->read_only || !nvmem->reg_write; -@@ -686,7 +684,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - - dev_dbg(&nvmem->dev, "Registering nvmem device %s\n", config->name); - -- rval = device_register(&nvmem->dev); -+ rval = device_add(&nvmem->dev); - if (rval) - goto err_put_device; - --- -2.39.0 - diff --git a/queue-5.10/nvmem-core-fix-registration-vs-use-race.patch b/queue-5.10/nvmem-core-fix-registration-vs-use-race.patch deleted file mode 100644 index 3952e43540b..00000000000 --- a/queue-5.10/nvmem-core-fix-registration-vs-use-race.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 72508842af2dca6b7676241dd7e86f9d515c4e51 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 27 Jan 2023 10:40:11 +0000 -Subject: nvmem: core: fix registration vs use race - -From: Russell King (Oracle) - -[ Upstream commit ab3428cfd9aa2f3463ee4b2909b5bb2193bd0c4a ] - -The i.MX6 CPU frequency driver sometimes fails to register at boot time -due to nvmem_cell_read_u32() sporadically returning -ENOENT. - -This happens because there is a window where __nvmem_device_get() in -of_nvmem_cell_get() is able to return the nvmem device, but as cells -have been setup, nvmem_find_cell_entry_by_node() returns NULL. - -The occurs because the nvmem core registration code violates one of the -fundamental principles of kernel programming: do not publish data -structures before their setup is complete. - -Fix this by making nvmem core code conform with this principle. - -Fixes: eace75cfdcf7 ("nvmem: Add a simple NVMEM framework for nvmem providers") -Cc: stable@vger.kernel.org -Signed-off-by: Russell King (Oracle) -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20230127104015.23839-7-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/nvmem/core.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index de356cdde4ce8..cdbd943d2c348 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -691,7 +691,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - if (config->compat) { - rval = nvmem_sysfs_setup_compat(nvmem, config); - if (rval) -- goto err_device_del; -+ goto err_put_device; - } - - if (config->cells) { -@@ -708,6 +708,12 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - if (rval) - goto err_remove_cells; - -+ dev_dbg(&nvmem->dev, "Registering nvmem device %s\n", config->name); -+ -+ rval = device_add(&nvmem->dev); -+ if (rval) -+ goto err_remove_cells; -+ - blocking_notifier_call_chain(&nvmem_notifier, NVMEM_ADD, nvmem); - - return nvmem; -@@ -716,8 +722,6 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - nvmem_device_remove_all_cells(nvmem); - if (config->compat) - nvmem_sysfs_remove_compat(nvmem, config); --err_device_del: -- device_del(&nvmem->dev); - err_put_device: - put_device(&nvmem->dev); - --- -2.39.0 - diff --git a/queue-5.10/nvmem-core-fix-return-value.patch b/queue-5.10/nvmem-core-fix-return-value.patch deleted file mode 100644 index ba93c792444..00000000000 --- a/queue-5.10/nvmem-core-fix-return-value.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 0c4862b1c1465e473bc961a02765490578bf5c20 Mon Sep 17 00:00:00 2001 -From: "Russell King (Oracle)" -Date: Fri, 27 Jan 2023 10:40:14 +0000 -Subject: nvmem: core: fix return value - -From: Russell King (Oracle) - -commit 0c4862b1c1465e473bc961a02765490578bf5c20 upstream. - -Dan Carpenter points out that the return code was not set in commit -60c8b4aebd8e ("nvmem: core: fix cleanup after dev_set_name()"), but -this is not the only issue - we also need to zero wp_gpio to prevent -gpiod_put() being called on an error value. - -Fixes: 560181d3ace6 ("nvmem: core: fix cleanup after dev_set_name()") -Cc: stable@vger.kernel.org -Reported-by: kernel test robot -Reported-by: Dan Carpenter -Signed-off-by: Russell King (Oracle) -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20230127104015.23839-10-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman ---- - drivers/nvmem/core.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -638,6 +638,7 @@ struct nvmem_device *nvmem_register(cons - GPIOD_OUT_HIGH); - if (IS_ERR(nvmem->wp_gpio)) { - rval = PTR_ERR(nvmem->wp_gpio); -+ nvmem->wp_gpio = NULL; - goto err_put_device; - } - diff --git a/queue-5.10/nvmem-core-remove-nvmem_config-wp_gpio.patch b/queue-5.10/nvmem-core-remove-nvmem_config-wp_gpio.patch deleted file mode 100644 index dd711fad54b..00000000000 --- a/queue-5.10/nvmem-core-remove-nvmem_config-wp_gpio.patch +++ /dev/null @@ -1,62 +0,0 @@ -From ba996d94abfdc5e826440e6cc695427a7ee5eb02 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 27 Jan 2023 10:40:09 +0000 -Subject: nvmem: core: remove nvmem_config wp_gpio - -From: Russell King (Oracle) - -[ Upstream commit 569653f022a29a1a44ea9de5308b657228303fa5 ] - -No one provides wp_gpio, so let's remove it to avoid issues with -the nvmem core putting this gpio. - -Cc: stable@vger.kernel.org -Signed-off-by: Russell King (Oracle) -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20230127104015.23839-5-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Stable-dep-of: ab3428cfd9aa ("nvmem: core: fix registration vs use race") -Signed-off-by: Sasha Levin ---- - drivers/nvmem/core.c | 4 +--- - include/linux/nvmem-provider.h | 2 -- - 2 files changed, 1 insertion(+), 5 deletions(-) - -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index 9da4edbabfe75..38c05fce7d740 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -627,9 +627,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) - - nvmem->id = rval; - -- if (config->wp_gpio) -- nvmem->wp_gpio = config->wp_gpio; -- else if (!config->ignore_wp) -+ if (!config->ignore_wp) - nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp", - GPIOD_OUT_HIGH); - if (IS_ERR(nvmem->wp_gpio)) { -diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h -index 39ec67689898b..5e07f3cfad301 100644 ---- a/include/linux/nvmem-provider.h -+++ b/include/linux/nvmem-provider.h -@@ -49,7 +49,6 @@ enum nvmem_type { - * @word_size: Minimum read/write access granularity. - * @stride: Minimum read/write access stride. - * @priv: User context passed to read/write callbacks. -- * @wp-gpio: Write protect pin - * @ignore_wp: Write Protect pin is managed by the provider. - * - * Note: A default "nvmem" name will be assigned to the device if -@@ -64,7 +63,6 @@ struct nvmem_config { - const char *name; - int id; - struct module *owner; -- struct gpio_desc *wp_gpio; - const struct nvmem_cell_info *cells; - int ncells; - enum nvmem_type type; --- -2.39.0 - diff --git a/queue-5.10/series b/queue-5.10/series index ab8b6a8778e..778016a369f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -87,10 +87,6 @@ fbdev-smscufx-fix-error-handling-code-in-ufx_usb_probe.patch f2fs-fix-to-do-sanity-check-on-i_extra_isize-in-is_alive.patch wifi-brcmfmac-check-the-count-value-of-channel-spec-to-prevent-out-of-bounds-reads.patch nvmem-core-fix-a-conflict-between-mtd-and-nvmem-on-w.patch -nvmem-core-add-error-handling-for-dev_set_name.patch -nvmem-core-remove-nvmem_config-wp_gpio.patch -nvmem-core-fix-cleanup-after-dev_set_name.patch -nvmem-core-fix-registration-vs-use-race.patch bpf-do-not-reject-when-the-stack-read-size-is-differ.patch iio-adc-twl6030-enable-measurement-of-vac.patch mm-migration-return-errno-when-isolate_huge_page-fai.patch @@ -136,4 +132,3 @@ arm64-dts-meson-gx-make-mmc-host-controller-interrupts-level-sensitive.patch arm64-dts-meson-g12-common-make-mmc-host-controller-interrupts-level-sensitive.patch arm64-dts-meson-axg-make-mmc-host-controller-interrupts-level-sensitive.patch fix-page-corruption-caused-by-racy-check-in-__free_pages.patch -nvmem-core-fix-return-value.patch