From patchwork Wed Dec 22 14:20:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 527709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C198C4332F for ; Wed, 22 Dec 2021 14:20:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245680AbhLVOU4 (ORCPT ); Wed, 22 Dec 2021 09:20:56 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48764 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245661AbhLVOUy (ORCPT ); Wed, 22 Dec 2021 09:20:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 60A50B81CEC; Wed, 22 Dec 2021 14:20:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18A9BC36AE5; Wed, 22 Dec 2021 14:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1640182852; bh=VXHRu9vWDw42BMg8qFKp2aB9xZz+LqjogCH7p0sOnis=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oa2qHQLKPsWrUk+25xYzuA5ksPtac5H+NAxt7nwDXD/YZfnlNpagDu/7WKC6k68NZ dZWHIocO171QGQfmL5W15zwMSJyRrU7DGKCFrMKAMo+tuIvBXl55mQeOBQCd0jVKTs tGQqRt5LIhmuJr4U6dqQmmPHuvWmAiqh+amlvOhkVDqQ01F95TvG1hQXTW2Y80oo7W dr3WjtoBXTVWzAPPs11OrxJ2E+8cT3nLp9mI52hSsQvpJNvP271CqbPIKTdTHbc9CK B3bY7qrsdmN4MdRQHc/ktzD5RgVLs/48oMPkdITAgrP3A+2fdS5xKzbqqLCNUlYlsI YVU0mO2pz0/Pw== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1n02U0-0007uj-Mt; Wed, 22 Dec 2021 15:20:44 +0100 From: Johan Hovold To: "Lad, Prabhakar" Cc: Mauro Carvalho Chehab , Hans Verkuil , Kevin Hilman , Greg Kroah-Hartman , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Lad@xi.lan Subject: [PATCH 1/4] media: davinci: vpif: fix unbalanced runtime PM get Date: Wed, 22 Dec 2021 15:20:22 +0100 Message-Id: <20211222142025.30364-2-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211222142025.30364-1-johan@kernel.org> References: <20211222142025.30364-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Make sure to balance the runtime PM usage counter on driver unbind. Fixes: 407ccc65bfd2 ("[media] davinci: vpif: add pm_runtime support") Cc: stable@vger.kernel.org # 3.9 Cc: Lad, Prabhakar Signed-off-by: Johan Hovold Reviewed-by: Lad Prabhakar --- drivers/media/platform/davinci/vpif.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c index 5a89d885d0e3..9752a5ec36f7 100644 --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -495,6 +495,7 @@ static int vpif_probe(struct platform_device *pdev) static int vpif_remove(struct platform_device *pdev) { + pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); return 0; } From patchwork Wed Dec 22 14:20:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 527396 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB1A0C433F5 for ; Wed, 22 Dec 2021 14:21:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237093AbhLVOU4 (ORCPT ); Wed, 22 Dec 2021 09:20:56 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48750 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241186AbhLVOUy (ORCPT ); Wed, 22 Dec 2021 09:20:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 490B0B81CD6; Wed, 22 Dec 2021 14:20:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1215AC36AE8; Wed, 22 Dec 2021 14:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1640182852; bh=p2tpqMrb/8u2b/uYsVHFj/Wz9xJRNpu0RJPMbbPGvlE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a3BASscMyF0R4HGLKoTEBurIYADhcBzP9jhTmWA4UdQjbSbv0Va/qUJF9eWHmHBby TSNqk70vB47i2IQH4aI6VGQMb077ogJb87lAYEeChGTDhc/oekuvyNBBL7+OwbNn2g jBt6fIK6CQxomlYAUiZviTe/cS7ZitShwlvida/wneRTIcmMJPj6Et/7ahLSZre3hJ 7DkqUUxW98ihcbGN8fYiGZCm3+NBpXtIQs35pI40F6HP3rR5cvOg2FH9ivhmfCqyhn O/bPV6nouRJILBXUCgIwkWmtu9XnI4TmzGX+F/3QUPidHHpk3lS4f7kWy7/yBig28x 4+GaJumA8w2+w== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1n02U0-0007ul-P5; Wed, 22 Dec 2021 15:20:44 +0100 From: Johan Hovold To: "Lad, Prabhakar" Cc: Mauro Carvalho Chehab , Hans Verkuil , Kevin Hilman , Greg Kroah-Hartman , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 2/4] media: davinci: vpif: fix unbalanced runtime PM enable Date: Wed, 22 Dec 2021 15:20:23 +0100 Message-Id: <20211222142025.30364-3-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211222142025.30364-1-johan@kernel.org> References: <20211222142025.30364-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Make sure to disable runtime PM before returning on probe errors. Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") Cc: stable@vger.kernel.org # 4.12: 4024d6f601e3c Cc: Kevin Hilman Signed-off-by: Johan Hovold --- drivers/media/platform/davinci/vpif.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c index 9752a5ec36f7..1f5eacf48580 100644 --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_device *pdev) static struct resource *res_irq; struct platform_device *pdev_capture, *pdev_display; struct device_node *endpoint = NULL; + int ret; vpif_base = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(vpif_base)) @@ -456,8 +457,8 @@ static int vpif_probe(struct platform_device *pdev) res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); if (!res_irq) { dev_warn(&pdev->dev, "Missing IRQ resource.\n"); - pm_runtime_put(&pdev->dev); - return -EINVAL; + ret = -EINVAL; + goto err_put_rpm; } pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), @@ -491,6 +492,12 @@ static int vpif_probe(struct platform_device *pdev) } return 0; + +err_put_rpm: + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + + return ret; } static int vpif_remove(struct platform_device *pdev) From patchwork Wed Dec 22 14:20:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 527397 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF397C433F5 for ; Wed, 22 Dec 2021 14:20:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245670AbhLVOUz (ORCPT ); Wed, 22 Dec 2021 09:20:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237093AbhLVOUx (ORCPT ); Wed, 22 Dec 2021 09:20:53 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31A9DC061574; Wed, 22 Dec 2021 06:20:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C6F2B61AE4; Wed, 22 Dec 2021 14:20:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1B735C36AEC; Wed, 22 Dec 2021 14:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1640182852; bh=GH8ZhuVCZyxWDQtV2NsW9yVCJnRzBkxIGGv9E/ld4eQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pA0JFQIOx/0bkHM6KmThO17osjriKyZev8M4Z9JwbCfIHyup7y3DVHOeNwcotJNuo dtG1+h4yfhm3Vl3bzvskkmGkmEkl3ucrTzdAjHGaFhLws/WUHmPxoafnpzb95HHDHd 1nSjmt6WKQZExdF9xAbr2k9Rmru2wNNsAcVUhtf3cfUIfEd+vfGmSDW9znB1B4YaQs crPy24YcFjnma5NHn1LyHHr/vha9MxXUtKyDtxJBr3/OcZGXruAWlIUmlS9dQ/kd6q xXSYVN7tC25tUaqvEXDk+poZcMTCEN1bh+0TD6iBL3eXC+tzZq5rtiSEUNYyvnIsVx 80aB1yXzpV+mA== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1n02U0-0007uo-RF; Wed, 22 Dec 2021 15:20:44 +0100 From: Johan Hovold To: "Lad, Prabhakar" Cc: Mauro Carvalho Chehab , Hans Verkuil , Kevin Hilman , Greg Kroah-Hartman , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 3/4] media: davinci: vpif: fix use-after-free on driver unbind Date: Wed, 22 Dec 2021 15:20:24 +0100 Message-Id: <20211222142025.30364-4-johan@kernel.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211222142025.30364-1-johan@kernel.org> References: <20211222142025.30364-1-johan@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The driver allocates and registers two platform device structures during probe, but the devices were never deregistered on driver unbind. This results in a use-after-free on driver unbind as the device structures were allocated using devres and would be freed by driver core when remove() returns. Fix this by adding the missing deregistration calls to the remove() callback and failing probe on registration errors. Note that the platform device structures must be freed using a proper release callback to avoid leaking associated resources like device names. Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") Cc: stable@vger.kernel.org # 4.12 Cc: Kevin Hilman Signed-off-by: Johan Hovold Reviewed-by: Lad Prabhakar --- drivers/media/platform/davinci/vpif.c | 97 ++++++++++++++++++++------- 1 file changed, 71 insertions(+), 26 deletions(-) diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c index 1f5eacf48580..4a260f4ed236 100644 --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -41,6 +41,11 @@ MODULE_ALIAS("platform:" VPIF_DRIVER_NAME); #define VPIF_CH2_MAX_MODES 15 #define VPIF_CH3_MAX_MODES 2 +struct vpif_data { + struct platform_device *capture; + struct platform_device *display; +}; + DEFINE_SPINLOCK(vpif_lock); EXPORT_SYMBOL_GPL(vpif_lock); @@ -423,17 +428,31 @@ int vpif_channel_getfid(u8 channel_id) } EXPORT_SYMBOL(vpif_channel_getfid); +static void vpif_pdev_release(struct device *dev) +{ + struct platform_device *pdev = to_platform_device(dev); + + kfree(pdev); +} + static int vpif_probe(struct platform_device *pdev) { static struct resource *res_irq; struct platform_device *pdev_capture, *pdev_display; struct device_node *endpoint = NULL; + struct vpif_data *data; int ret; vpif_base = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(vpif_base)) return PTR_ERR(vpif_base); + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + platform_set_drvdata(pdev, data); + pm_runtime_enable(&pdev->dev); pm_runtime_get(&pdev->dev); @@ -461,49 +480,75 @@ static int vpif_probe(struct platform_device *pdev) goto err_put_rpm; } - pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), - GFP_KERNEL); - if (pdev_capture) { - pdev_capture->name = "vpif_capture"; - pdev_capture->id = -1; - pdev_capture->resource = res_irq; - pdev_capture->num_resources = 1; - pdev_capture->dev.dma_mask = pdev->dev.dma_mask; - pdev_capture->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; - pdev_capture->dev.parent = &pdev->dev; - platform_device_register(pdev_capture); - } else { - dev_warn(&pdev->dev, "Unable to allocate memory for pdev_capture.\n"); + pdev_capture = kzalloc(sizeof(*pdev_capture), GFP_KERNEL); + if (!pdev_capture) { + ret = -ENOMEM; + goto err_put_rpm; } - pdev_display = devm_kzalloc(&pdev->dev, sizeof(*pdev_display), - GFP_KERNEL); - if (pdev_display) { - pdev_display->name = "vpif_display"; - pdev_display->id = -1; - pdev_display->resource = res_irq; - pdev_display->num_resources = 1; - pdev_display->dev.dma_mask = pdev->dev.dma_mask; - pdev_display->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; - pdev_display->dev.parent = &pdev->dev; - platform_device_register(pdev_display); - } else { - dev_warn(&pdev->dev, "Unable to allocate memory for pdev_display.\n"); + pdev_capture->name = "vpif_capture"; + pdev_capture->id = -1; + pdev_capture->resource = res_irq; + pdev_capture->num_resources = 1; + pdev_capture->dev.dma_mask = pdev->dev.dma_mask; + pdev_capture->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; + pdev_capture->dev.parent = &pdev->dev; + pdev_capture->dev.release = vpif_pdev_release; + + ret = platform_device_register(pdev_capture); + if (ret) + goto err_put_pdev_capture; + + pdev_display = kzalloc(sizeof(*pdev_display), GFP_KERNEL); + if (!pdev_display) { + ret = -ENOMEM; + goto err_put_pdev_capture; } + pdev_display->name = "vpif_display"; + pdev_display->id = -1; + pdev_display->resource = res_irq; + pdev_display->num_resources = 1; + pdev_display->dev.dma_mask = pdev->dev.dma_mask; + pdev_display->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; + pdev_display->dev.parent = &pdev->dev; + pdev_display->dev.release = vpif_pdev_release; + + ret = platform_device_register(pdev_display); + if (ret) + goto err_put_pdev_display; + + data->capture = pdev_capture; + data->display = pdev_display; + return 0; +err_put_pdev_display: + platform_device_put(pdev_display); +err_put_pdev_capture: + platform_device_put(pdev_capture); err_put_rpm: pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); + kfree(data); return ret; } static int vpif_remove(struct platform_device *pdev) { + struct vpif_data *data = platform_get_drvdata(pdev); + + if (data->capture) + platform_device_unregister(data->capture); + if (data->display) + platform_device_unregister(data->display); + pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); + + kfree(data); + return 0; }