From patchwork Mon Jun 1 13:39:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 209035 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD8A8C433E1 for ; Mon, 1 Jun 2020 13:40:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B63C32068D for ; Mon, 1 Jun 2020 13:40:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591018852; bh=CH8mGaZuzQ5m7qqlMmRJHYj9IYXYPPQsL/Bu0PcJM1A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jdv4q6fJ7refDq5xMePiiELg3QcNbAhNwSB22DEI5fTv00MgKcB/qZWaPtHmMplfK sMXSTZCu5O/XtT+eG6h/uGmNtsmC9N+lmm0141t5QASeTMbdHPXu81WbcQlIk9RZSN jiGqRLcZQ9IxjnaIa5YgOPOdOijMO0ll0nYEZmN0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727118AbgFANkr (ORCPT ); Mon, 1 Jun 2020 09:40:47 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:40825 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726201AbgFANk3 (ORCPT ); Mon, 1 Jun 2020 09:40:29 -0400 Received: by mail-lj1-f196.google.com with SMTP id z13so8163846ljn.7; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9WLwaacWxVJgJAQUy6rPeyp9VmCZjz1WJ6juENBmuJI=; b=L7DfhdlbTpPGL9COo0M27WG8/lt1F6mLb4/oVZ45DzZDxQyGFP2OxXPVpdDzQvBL5Y 4aE3T7+QwRBdsNnSPti8XzmhqU6PdsKGLPGhhJr3BBlRYrbHniPvlAFUC/yWRZDo+FCY uQr8EJA/CCtFcqIoPcbl5hzLpfbUvfPJDOAS5GizfV/TzqO9aE3v1X0TYISqdPMZfaT0 Q3J+m6KnwciYi6hJyDj8bzvSngH2VD0Fp15tFUis0C8lSPll1hi1SzkH5GTU/+0oYqHS YRrSLUxw2niB7knH/cYBDcMzDuptHK2ujlG8Rgn3I6AdWVIe/aFpDtM6VSXH9m4/KHJk Zzvw== X-Gm-Message-State: AOAM530vqS2N67sImi8i0dBts6V7u+n+Mg4zylInlqF8+tkDKMBxla20 UQX5I5JHQ6hwCkccQL+1Lr4= X-Google-Smtp-Source: ABdhPJxn833jupaamj8VbrnQIBjwbA4RDar5lOpXhyo1jksXZHcHMwIbMN6fnlhc5y6g4fEutsDj8g== X-Received: by 2002:a2e:8144:: with SMTP id t4mr9937763ljg.412.1591018825203; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) Received: from xi.terra (c-beaee455.07-184-6d6c6d4.bbcust.telenor.se. [85.228.174.190]) by smtp.gmail.com with ESMTPSA id 193sm2446783ljj.48.2020.06.01.06.40.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 06:40:23 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.93.0.4) (envelope-from ) id 1jfkfp-0003Fj-4a; Mon, 01 Jun 2020 15:40:17 +0200 From: Johan Hovold To: Jacek Anaszewski , Pavel Machek Cc: Dan Murphy , Amitoj Kaur Chawla , linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable Subject: [PATCH 2/6] leds: da903x: fix use-after-free on unbind Date: Mon, 1 Jun 2020 15:39:46 +0200 Message-Id: <20200601133950.12420-3-johan@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200601133950.12420-1-johan@kernel.org> References: <20200601133950.12420-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-leds-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-leds@vger.kernel.org Several MFD child drivers register their class devices directly under the parent device. This means you cannot blindly do devres conversions so that deregistration ends up being tied to the parent device, something which leads to use-after-free on driver unbind when the class device is released while still being registered. Fixes: eed16255d66b ("leds: da903x: Use devm_led_classdev_register") Cc: stable # 4.6 Cc: Amitoj Kaur Chawla Signed-off-by: Johan Hovold --- drivers/leds/leds-da903x.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/leds/leds-da903x.c b/drivers/leds/leds-da903x.c index ed1b303f699f..2b5fb00438a2 100644 --- a/drivers/leds/leds-da903x.c +++ b/drivers/leds/leds-da903x.c @@ -110,12 +110,23 @@ static int da903x_led_probe(struct platform_device *pdev) led->flags = pdata->flags; led->master = pdev->dev.parent; - ret = devm_led_classdev_register(led->master, &led->cdev); + ret = led_classdev_register(led->master, &led->cdev); if (ret) { dev_err(&pdev->dev, "failed to register LED %d\n", id); return ret; } + platform_set_drvdata(pdev, led); + + return 0; +} + +static int da903x_led_remove(struct platform_device *pdev) +{ + struct da903x_led *led = platform_get_drvdata(pdev); + + led_classdev_unregister(&led->cdev); + return 0; } @@ -124,6 +135,7 @@ static struct platform_driver da903x_led_driver = { .name = "da903x-led", }, .probe = da903x_led_probe, + .remove = da903x_led_remove, }; module_platform_driver(da903x_led_driver); From patchwork Mon Jun 1 13:39:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 209037 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FB88C433E0 for ; Mon, 1 Jun 2020 13:40:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 810472068D for ; Mon, 1 Jun 2020 13:40:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591018830; bh=m5uzrznEMZNG4B91i6w2F2fRa1lCaAG0mKUFqktmnXU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=HFj+KqHgrs2OuH1hR/SKC5NXFE75gfyNUu7y/nzJc4N5+AvQxYVg1dhSeFMReEf7n bhRRuGsNcUGoBtNOcsiKctf6COqe9ZoEQIsGgXpnPy7sUarXW2cjXJ08R4ejCagvbr 3Jdl6bwFeCEpOdapXuF6SVzA2pdSAfe5qJ/yo1r0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727063AbgFANk3 (ORCPT ); Mon, 1 Jun 2020 09:40:29 -0400 Received: from mail-lf1-f67.google.com ([209.85.167.67]:33897 "EHLO mail-lf1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726152AbgFANk2 (ORCPT ); Mon, 1 Jun 2020 09:40:28 -0400 Received: by mail-lf1-f67.google.com with SMTP id e125so3959545lfd.1; Mon, 01 Jun 2020 06:40:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=fdhJ6VWEx4je3P4tdqEsJkjBh1tquQqmuINBpODTZ4E=; b=ffVbXVURiNGbE3ttohHBaVGQ1GYWKgz+vL3tqb7g+dCspCA4bfpoNZWcBcuy5mAaLd EjITtDVFHkwzreoYygLI69LMSVP2LuBrNVLa8WZXnjCM+IDlH2G/b70QkuZNOlrxjwSH Y688RjNe5pLEJQr1FmLck6auPb3iYqAg+T4oeHoL5LP/kLyEC6RIfRHXFfaiJole/u6I IWOxckMu1B79e3SYVTdA6F/GwpWSs+wQSzv2sF+BkDEdvgL7LX5yj9ISd21+5k+Z6FH5 I33KMmsx9ZXZssYKvm6kjpLZoxqcguD9iOPNYuQcSujf5hqVdmke+HEBRu60fwAfssTI jxfw== X-Gm-Message-State: AOAM531XCOI3mAF79lAhyOgt5n89XonLBDH666tcJczRt3so6rZbxPg6 BjtUdyewlbkdYwOUtnoSA+A= X-Google-Smtp-Source: ABdhPJwAHvBtxCfTE/8M+bI1GpMJD4Vh3qudybO7U/9zvPSI45Xek4v88iHANywVIeJml8lvPIkbIg== X-Received: by 2002:ac2:5df2:: with SMTP id z18mr11205121lfq.151.1591018825922; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) Received: from xi.terra (c-beaee455.07-184-6d6c6d4.bbcust.telenor.se. [85.228.174.190]) by smtp.gmail.com with ESMTPSA id k22sm407124ljk.122.2020.06.01.06.40.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 06:40:23 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.93.0.4) (envelope-from ) id 1jfkfp-0003Fp-7p; Mon, 01 Jun 2020 15:40:17 +0200 From: Johan Hovold To: Jacek Anaszewski , Pavel Machek Cc: Dan Murphy , Amitoj Kaur Chawla , linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable Subject: [PATCH 3/6] leds: lm3533: fix use-after-free on unbind Date: Mon, 1 Jun 2020 15:39:47 +0200 Message-Id: <20200601133950.12420-4-johan@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200601133950.12420-1-johan@kernel.org> References: <20200601133950.12420-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-leds-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-leds@vger.kernel.org Several MFD child drivers register their class devices directly under the parent device. This means you cannot blindly do devres conversions so that deregistration ends up being tied to the parent device, something which leads to use-after-free on driver unbind when the class device is released while still being registered. Fixes: 50154e29e5cc ("leds: lm3533: Use devm_led_classdev_register") Cc: stable # 4.6 Cc: Amitoj Kaur Chawla Signed-off-by: Johan Hovold --- drivers/leds/leds-lm3533.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/leds/leds-lm3533.c b/drivers/leds/leds-lm3533.c index 9504ad405aef..b3edee703193 100644 --- a/drivers/leds/leds-lm3533.c +++ b/drivers/leds/leds-lm3533.c @@ -694,7 +694,7 @@ static int lm3533_led_probe(struct platform_device *pdev) platform_set_drvdata(pdev, led); - ret = devm_led_classdev_register(pdev->dev.parent, &led->cdev); + ret = led_classdev_register(pdev->dev.parent, &led->cdev); if (ret) { dev_err(&pdev->dev, "failed to register LED %d\n", pdev->id); return ret; @@ -704,13 +704,18 @@ static int lm3533_led_probe(struct platform_device *pdev) ret = lm3533_led_setup(led, pdata); if (ret) - return ret; + goto err_deregister; ret = lm3533_ctrlbank_enable(&led->cb); if (ret) - return ret; + goto err_deregister; return 0; + +err_deregister: + led_classdev_unregister(&led->cdev); + + return ret; } static int lm3533_led_remove(struct platform_device *pdev) @@ -720,6 +725,7 @@ static int lm3533_led_remove(struct platform_device *pdev) dev_dbg(&pdev->dev, "%s\n", __func__); lm3533_ctrlbank_disable(&led->cb); + led_classdev_unregister(&led->cdev); return 0; } From patchwork Mon Jun 1 13:39:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 209036 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C23DC433DF for ; Mon, 1 Jun 2020 13:40:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E9C092068D for ; Mon, 1 Jun 2020 13:40:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591018842; bh=WFZe0U1Q01WAaVAqR1kaht6EhrMiHOzB0KEpFkTRK4c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=gby5TNaVDw5Q+74hV7lIdeL8q5GEEL9mGaLpj8GHYYVROeRH1Rvkzo1VjZpW66wL+ 2W8zodqRmi/bZP1mP1qxDfKF7gaJ8OUBjJrR5qn0sKIPx5SgYtTwB6TeTHS5+QDexG 5jEgiG9ViCob+odcDNBd7RuwxIzoIlB11HQTj/Mg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726218AbgFANkh (ORCPT ); Mon, 1 Jun 2020 09:40:37 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:37226 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727000AbgFANka (ORCPT ); Mon, 1 Jun 2020 09:40:30 -0400 Received: by mail-lf1-f68.google.com with SMTP id x22so3948401lfd.4; Mon, 01 Jun 2020 06:40:28 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=XXr2KRE+Dnzze8XZks0Gj4qAjbaI/MHBmKKUHBBJn5M=; b=OwWqE9i0Xg0Nn5+PKXk+i/MW49F7ruVdUbsA5y+nBJrspVe4JDOliM8WxoMryOY43n Ow/1yddRqr3GiEZ3D2uGQYyT09qGKiYjPJrzAnm/ok+CpsDQGTYQ50sCWm3zMGroMGVo Mim2oGQH5qGIiGmO0vhZHzohNNcSDoZQy4+QBt6JBnK3oalT3VG2XHqZDr4ypCOVx0Y0 s3P8W/Xz+U4fdghvDqVRtBfFbsLtwWZzEA0dcboPXEu0emtOs+TBPpQoJOgOTx29KQ4S 6bv11PuQ3X6jjLxDt+yqaTzGlDbwhoLFbILJvHXja7W9FJjs0it4NGUM9dmi+FXpBQGX ctMQ== X-Gm-Message-State: AOAM5315ny7arMkTiPtV0yqjuDA5dnrfE8SOJaFy0KXLk3C5+6r9LKHG axtgrPW673GJAGtxkilBGek= X-Google-Smtp-Source: ABdhPJwDPr96Ap3HzoIE25YN2bfCtabka+qXKDmUD01Vx75YFQ8IFMIwXwFdpcfVgcZioQhkK8v1+g== X-Received: by 2002:a19:500e:: with SMTP id e14mr11199694lfb.88.1591018827510; Mon, 01 Jun 2020 06:40:27 -0700 (PDT) Received: from xi.terra (c-beaee455.07-184-6d6c6d4.bbcust.telenor.se. [85.228.174.190]) by smtp.gmail.com with ESMTPSA id v2sm4079883ljj.96.2020.06.01.06.40.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 06:40:25 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.93.0.4) (envelope-from ) id 1jfkfp-0003G3-HS; Mon, 01 Jun 2020 15:40:17 +0200 From: Johan Hovold To: Jacek Anaszewski , Pavel Machek Cc: Dan Murphy , Amitoj Kaur Chawla , linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH 6/6] leds: drop redundant struct-device pointer casts Date: Mon, 1 Jun 2020 15:39:50 +0200 Message-Id: <20200601133950.12420-7-johan@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200601133950.12420-1-johan@kernel.org> References: <20200601133950.12420-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-leds-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-leds@vger.kernel.org Drop the pointless and needlessly confusing casts of struct-device pointers. Signed-off-by: Johan Hovold --- drivers/leds/leds-lm355x.c | 9 +++------ drivers/leds/leds-lm3642.c | 9 +++------ 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c index a5abb499574b..c690eafe2746 100644 --- a/drivers/leds/leds-lm355x.c +++ b/drivers/leds/leds-lm355x.c @@ -453,8 +453,7 @@ static int lm355x_probe(struct i2c_client *client, chip->cdev_flash.max_brightness = 16; chip->cdev_flash.brightness_set_blocking = lm355x_strobe_brightness_set; chip->cdev_flash.default_trigger = "flash"; - err = led_classdev_register((struct device *) - &client->dev, &chip->cdev_flash); + err = led_classdev_register(&client->dev, &chip->cdev_flash); if (err < 0) goto err_out; /* torch */ @@ -462,8 +461,7 @@ static int lm355x_probe(struct i2c_client *client, chip->cdev_torch.max_brightness = 8; chip->cdev_torch.brightness_set_blocking = lm355x_torch_brightness_set; chip->cdev_torch.default_trigger = "torch"; - err = led_classdev_register((struct device *) - &client->dev, &chip->cdev_torch); + err = led_classdev_register(&client->dev, &chip->cdev_torch); if (err < 0) goto err_create_torch_file; /* indicator */ @@ -477,8 +475,7 @@ static int lm355x_probe(struct i2c_client *client, /* indicator pattern control only for LM3556 */ if (id->driver_data == CHIP_LM3556) chip->cdev_indicator.groups = lm355x_indicator_groups; - err = led_classdev_register((struct device *) - &client->dev, &chip->cdev_indicator); + err = led_classdev_register(&client->dev, &chip->cdev_indicator); if (err < 0) goto err_create_indicator_file; diff --git a/drivers/leds/leds-lm3642.c b/drivers/leds/leds-lm3642.c index 4232906fcb75..62c14872caf7 100644 --- a/drivers/leds/leds-lm3642.c +++ b/drivers/leds/leds-lm3642.c @@ -340,8 +340,7 @@ static int lm3642_probe(struct i2c_client *client, chip->cdev_flash.brightness_set_blocking = lm3642_strobe_brightness_set; chip->cdev_flash.default_trigger = "flash"; chip->cdev_flash.groups = lm3642_flash_groups, - err = led_classdev_register((struct device *) - &client->dev, &chip->cdev_flash); + err = led_classdev_register(&client->dev, &chip->cdev_flash); if (err < 0) { dev_err(chip->dev, "failed to register flash\n"); goto err_out; @@ -353,8 +352,7 @@ static int lm3642_probe(struct i2c_client *client, chip->cdev_torch.brightness_set_blocking = lm3642_torch_brightness_set; chip->cdev_torch.default_trigger = "torch"; chip->cdev_torch.groups = lm3642_torch_groups, - err = led_classdev_register((struct device *) - &client->dev, &chip->cdev_torch); + err = led_classdev_register(&client->dev, &chip->cdev_torch); if (err < 0) { dev_err(chip->dev, "failed to register torch\n"); goto err_create_torch_file; @@ -365,8 +363,7 @@ static int lm3642_probe(struct i2c_client *client, chip->cdev_indicator.max_brightness = 8; chip->cdev_indicator.brightness_set_blocking = lm3642_indicator_brightness_set; - err = led_classdev_register((struct device *) - &client->dev, &chip->cdev_indicator); + err = led_classdev_register(&client->dev, &chip->cdev_indicator); if (err < 0) { dev_err(chip->dev, "failed to register indicator\n"); goto err_create_indicator_file;