[5.10,096/563] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove

From: George G. Davis <davis.george@siemens.com>

From: George G. Davis <davis.george@siemens.com>

[ Upstream commit baaf965f94308301d2dc554d72a87d7432cd5ce6 ]

The following KASAN BUG is observed when testing the rpc-if driver on
rcar-gen3:

root@rcar-gen3:~# modprobe -r rpc-if
[  101.930146] ==================================================================
[  101.937408] BUG: KASAN: slab-out-of-bounds in __lock_acquire+0x518/0x25d0
[  101.944240] Read of size 8 at addr ffff0004c5be2750 by task modprobe/664
[  101.950959]
[  101.952466] CPU: 2 PID: 664 Comm: modprobe Not tainted 5.14.0-rc1-00342-g1a1464d7aa31 #1
[  101.960578] Hardware name: Renesas H3ULCB board based on r8a77951 (DT)
[  101.967120] Call trace:
[  101.969580]  dump_backtrace+0x0/0x2c0
[  101.973275]  show_stack+0x1c/0x30
[  101.976616]  dump_stack_lvl+0x9c/0xd8
[  101.980301]  print_address_description.constprop.0+0x74/0x2b8
[  101.986071]  kasan_report+0x1f4/0x26c
[  101.989757]  __asan_load8+0x98/0xd4
[  101.993266]  __lock_acquire+0x518/0x25d0
[  101.997215]  lock_acquire.part.0+0x18c/0x360
[  102.001506]  lock_acquire+0x74/0x90
[  102.005013]  _raw_spin_lock_irq+0x98/0x130
[  102.009131]  __pm_runtime_disable+0x30/0x210
[  102.013427]  rpcif_hb_remove+0x5c/0x70 [rpc_if]
[  102.018001]  platform_remove+0x40/0x80
[  102.021771]  __device_release_driver+0x234/0x350
[  102.026412]  driver_detach+0x158/0x20c
[  102.030179]  bus_remove_driver+0xa0/0x140
[  102.034212]  driver_unregister+0x48/0x80
[  102.038153]  platform_driver_unregister+0x18/0x24
[  102.042879]  rpcif_platform_driver_exit+0x1c/0x34 [rpc_if]
[  102.048400]  __arm64_sys_delete_module+0x210/0x310
[  102.053212]  invoke_syscall+0x60/0x190
[  102.056986]  el0_svc_common+0x12c/0x144
[  102.060844]  do_el0_svc+0x88/0xac
[  102.064181]  el0_svc+0x24/0x3c
[  102.067257]  el0t_64_sync_handler+0x1a8/0x1b0
[  102.071634]  el0t_64_sync+0x198/0x19c
[  102.075315]
[  102.076815] Allocated by task 628:
[  102.080781]
[  102.082280] Last potentially related work creation:
[  102.087524]
[  102.089022] The buggy address belongs to the object at ffff0004c5be2000
[  102.089022]  which belongs to the cache kmalloc-2k of size 2048
[  102.101555] The buggy address is located 1872 bytes inside of
[  102.101555]  2048-byte region [ffff0004c5be2000, ffff0004c5be2800)
[  102.113486] The buggy address belongs to the page:
[  102.118409]
[  102.119908] Memory state around the buggy address:
[  102.124711]  ffff0004c5be2600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  102.131947]  ffff0004c5be2680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  102.139181] >ffff0004c5be2700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  102.146412]                                                  ^
[  102.152257]  ffff0004c5be2780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  102.159491]  ffff0004c5be2800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  102.166723] ==================================================================

The above bug is caused by use of the wrong pointer in the
rpcif_disable_rpm() call. Fix the bug by using the correct pointer.

Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
Signed-off-by: George G. Davis <davis.george@siemens.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20210716204935.25859-1-george_davis@mentor.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/hyperbus/rpc-if.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Message ID	20220124184027.714831597@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, "George G. Davis" <davis.george@siemens.com>, Vignesh Raghavendra <vigneshr@ti.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 096/563] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove Date: Mon, 24 Jan 2022 19:37:41 +0100 Message-Id: <20220124184027.714831597@linuxfoundation.org> In-Reply-To: <20220124184024.407936072@linuxfoundation.org> References: <20220124184024.407936072@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,006/563] f2fs: fix to do sanity check in is_alive() [5.10,011/563] mtd: rawnand: davinci: Dont calculate ECC when reading page [5.10,016/563] tools/nolibc: i386: fix initial stack alignment [5.10,020/563] media: flexcop-usb: fix control-message timeouts [5.10,024/563] media: s2255: fix control-message timeouts [5.10,025/563] media: dib0700: fix undefined behavior in tuner shutdown [5.10,026/563] media: redrat3: fix control-message timeouts [5.10,027/563] media: pvrusb2: fix control-message timeouts [5.10,032/563] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() [5.10,036/563] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller [5.10,042/563] Bluetooth: L2CAP: Fix not initializing sk_peer_pid [5.10,045/563] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure [5.10,046/563] drm/panel: innolux-p079zca: Delete panel on attach() failure [5.10,048/563] drm/rockchip: dsi: Hold pm-runtime across bind/unbind [5.10,051/563] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails [5.10,054/563] drm/vc4: hdmi: Set a default HSM rate [5.10,055/563] wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan [5.10,060/563] wcn36xx: populate band before determining rate on RX [5.10,064/563] media: videobuf2: Fix the size printk format [5.10,067/563] media: atomisp: fix inverted logic in buffers_needed() [5.10,068/563] media: atomisp: do not use err var when checking port validity for ISP2400 [5.10,069/563] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() [5.10,071/563] media: staging: media: atomisp: pci: Balance braces around conditional statements ... [5.10,077/563] media: aspeed: Update signal status immediately to ensure sane hw state [5.10,078/563] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name [5.10,082/563] fs: dlm: use sk->sk_socket instead of con->sock [5.10,085/563] Bluetooth: stop proccessing malicious adv data [5.10,089/563] tee: fix put order in teedev_close_context() [5.10,091/563] drm/vboxvideo: fix a NULL vs IS_ERR() check [5.10,094/563] crypto: qce - fix uaf on qce_ahash_register_one [5.10,096/563] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove [5.10,097/563] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco [5.10,098/563] crypto: qat - fix spelling mistake: "messge" -> "message" [5.10,100/563] crypto: qat - make pfvf send message direction agnostic [5.10,101/563] crypto: qat - fix undetected PFVF timeout in ACK loop [5.10,102/563] ath11k: Use host CE parameters for CE interrupts configuration [5.10,104/563] tty: serial: atmel: Check return code of dmaengine_submit() [5.10,105/563] tty: serial: atmel: Call dma_async_issue_pending() [5.10,106/563] mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP [5.10,108/563] media: rcar-csi2: Correct the selection of hsfreqrange [5.10,109/563] media: imx-pxp: Initialize the spinlock prior to using it [5.10,113/563] media: venus: pm_helpers: Control core power domain manually [5.10,115/563] media: venus: core: Fix a potential NULL pointer dereference in an error handling ... [5.10,119/563] arm64: dts: qcom: msm8916: fix MMC controller aliases [5.10,121/563] ACPI: EC: Rework flushing of EC work while suspended to idle [5.10,122/563] thermal/drivers/imx8mm: Enable ADC when enabling monitor [5.10,124/563] drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() [5.10,127/563] arm64: dts: ti: k3-j7200: Correct the d-cache-sets info [5.10,129/563] serial: amba-pl011: do not request memory region twice [5.10,130/563] floppy: Fix hang in watchdog when disk is ejected [5.10,132/563] staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() [5.10,137/563] bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) [5.10,138/563] bpf: Remove config check to enable bpf support for branch records [5.10,141/563] media: dib8000: Fix a memleak in dib8000_init() [5.10,142/563] media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() [5.10,147/563] rcu/exp: Mark current CPU as exp-QS in IPI loop second pass [5.10,148/563] mwifiex: Fix possible ABBA deadlock [5.10,149/563] xfrm: fix a small bug in xfrm_sa_len() [5.10,153/563] crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter [5.10,163/563] media: dw2102: Fix use after free [5.10,166/563] ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() [5.10,169/563] drm/msm/dpu: fix safe status debugfs file [5.10,171/563] drm/tegra: vic: Fix DMA API misuse [5.10,176/563] usb: ftdi-elan: fix memory leak on device disconnect [5.10,180/563] iwlwifi: mvm: fix 32-bit build in FTM [5.10,185/563] um: fix ndelay/udelay defines [5.10,190/563] backlight: qcom-wled: Pass number of elements to read to read_u32_array [5.10,191/563] backlight: qcom-wled: Fix off-by-one maximum with default num_strings [5.10,195/563] software node: fix wrong node passed to find nargs_prop [5.10,198/563] hwmon: (mr75203) fix wrong power-up delay value [5.10,201/563] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_regi... [5.10,202/563] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() [5.10,205/563] bpf: Dont promote bogus looking registers after null check. [5.10,206/563] bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). [5.10,208/563] ppp: ensure minimum packet size in ppp_write() [5.10,209/563] rocker: fix a sleeping in atomic bug [5.10,210/563] staging: greybus: audio: Check null pointer [5.10,213/563] Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe [5.10,215/563] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init [5.10,216/563] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc [5.10,220/563] net/mlx5e: Fix page DMA map/unmap attributes [5.10,222/563] Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" [5.10,224/563] lib/mpi: Add the return value check of kcalloc() [5.10,226/563] spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe [5.10,227/563] ax25: uninitialized variable in ax25_setsockopt() [5.10,229/563] regmap: Call regmap_debugfs_exit() prior to _init() [5.10,235/563] pcmcia: fix setting of kthread task states [5.10,237/563] net: mcs7830: handle usb read errors properly [5.10,238/563] ext4: avoid trim error on fs with small groups [5.10,239/563] ALSA: jack: Add missing rwsem around snd_ctl_remove() calls [5.10,242/563] RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending ... [5.10,246/563] powerpc/prom_init: Fix improper check of prom_getprop() [5.10,248/563] dt-bindings: thermal: Fix definition of cooling-maps contribution property [5.10,249/563] powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C [5.10,250/563] powerpc/perf: MMCR0 control for PMU registers under PMCC=00 [5.10,252/563] powerpc/irq: Add helper to set regs->softe [5.10,257/563] ALSA: oss: fix compile error when OSS_DEBUG is enabled [5.10,258/563] ALSA: usb-audio: Drop superfluous 0 in Presonus Studio 1810cs ID [5.10,260/563] binder: fix handling of error during copy [5.10,262/563] uio: uio_dmem_genirq: Catch the Exception [5.10,264/563] scsi: ufs: Fix race conditions related to driver data [5.10,265/563] RDMA/qedr: Fix reporting max_{send/recv}_wr attrs [5.10,266/563] PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() [5.10,269/563] RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry [5.10,271/563] of: unittest: fix warning on PowerPC frame size warning [5.10,272/563] of: unittest: 64 bit dma address test requires arch support [5.10,276/563] dmaengine: pxa/mmp: stop referencing config->slave_id [5.10,279/563] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on [5.10,281/563] scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() [5.10,285/563] misc: lattice-ecp3-config: Fix task hung when firmware load failed [5.10,289/563] mips: lantiq: add support for clk_set_parent() [5.10,291/563] powerpc/xive: Add missing null check after calling kmalloc [5.10,292/563] ASoC: fsl_mqs: fix MODULE_ALIAS [5.10,293/563] RDMA/cxgb4: Set queue pair state when being queried [5.10,294/563] ASoC: fsl_asrc: refine the check of available clock divider [5.10,296/563] of: base: Fix phandle argument length mismatch error message [5.10,299/563] fs: dlm: filter user dlm messages for kernel locks [5.10,300/563] libbpf: Validate that .BTF and .BTF.ext sections contain data [5.10,301/563] drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y [5.10,302/563] selftests/bpf: Fix bpf_object leak in skb_ctx selftest [5.10,304/563] drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR [5.10,307/563] media: atomisp: set per-devices default mode [5.10,309/563] ARM: shmobile: rcar-gen2: Add missing of_node_put() [5.10,312/563] ath11k: Fix crash caused by uninitialized TX ring [5.10,314/563] drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L [5.10,319/563] drm/amd/display: check top_pipe_to_program pointer [5.10,321/563] soc: ti: pruss: fix referenced node in error message [5.10,325/563] gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use [5.10,326/563] HSI: core: Fix return freed object in hsi_new_client [5.10,327/563] crypto: jitter - consider 32 LSB for APT [5.10,332/563] media: venus: avoid calling core_clk_setrate() concurrently during concurrent vide... [5.10,333/563] ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table [5.10,335/563] ACPI / x86: Allow specifying acpi_device_override_status() quirks by path [5.10,336/563] ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win [5.10,338/563] usb: uhci: add aspeed ast2600 uhci support [5.10,339/563] floppy: Add max size check for user space request [5.10,343/563] media: rcar-vin: Update format alignment constraints [5.10,345/563] media: m920x: dont use stack on USB reads [5.10,347/563] iwlwifi: mvm: synchronize with FW after multicast commands [5.10,348/563] iwlwifi: mvm: avoid clearing a just saved session protection id [5.10,349/563] ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work [5.10,350/563] ath10k: Fix tx hanging [5.10,353/563] gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock [5.10,354/563] selftests/ftrace: make kprobe profile testcase description unique [5.10,356/563] x86/mce: Allow instrumentation during task work queueing [5.10,357/563] x86/mce: Mark mce_panic() noinstr [5.10,358/563] x86/mce: Mark mce_end() noinstr [5.10,359/563] x86/mce: Mark mce_read_aux() noinstr [5.10,360/563] net: bonding: debug: avoid printing debug logs when bond is not notifying peers [5.10,362/563] HID: quirks: Allow inverting the absolute X/Y values [5.10,364/563] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() [5.10,365/563] mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO [5.10,368/563] arm64: tegra: Adjust length of CCPLEX cluster MMIO region [5.10,370/563] cpufreq: Fix initialization of min and max frequency QoS requests [5.10,371/563] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 [5.10,373/563] rtw88: 8822c: update rx settings to prevent potential hw deadlock [5.10,375/563] iwlwifi: fix leaks/bad data after failed firmware load [5.10,376/563] iwlwifi: remove module loading failure message [5.10,378/563] iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ [5.10,379/563] um: registers: Rename function names to avoid conflicts and build problems [5.10,383/563] drm/etnaviv: consider completed fence seqno in hang check [5.10,386/563] ACPICA: Utilities: Avoid deleting the same object twice in a row [5.10,387/563] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() [5.10,390/563] drm/amdgpu: fixup bad vram size on gmc v8 [5.10,391/563] amdgpu/pm: Make sysfs pm attributes as read-only for VFs [5.10,392/563] ACPI: battery: Add the ThinkPad "Not Charging" quirk [5.10,396/563] mac80211: allow non-standard VHT MCS-10/11 [5.10,398/563] dm space map common: add bounds check to sm_ll_lookup_bitmap() [5.10,400/563] net: phy: marvell: configure RGMII delays for 88E1118 [5.10,402/563] regulator: qcom_smd: Align probe function with rpmh-regulator [5.10,404/563] serial: core: Keep mctrl register state and cached copy in sync [5.10,405/563] random: do not throw away excess input to crng_fast_load [5.10,413/563] powerpc/watchdog: Fix missed watchdog reset due to memory ordering race [5.10,414/563] i2c: i801: Dont silently correct invalid transfer size [5.10,417/563] clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB [5.10,423/563] dm: fix alloc_dax error handling in alloc_dev [5.10,424/563] scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup [5.10,427/563] powerpc/40x: Map 32Mbytes of memory at startup [5.10,428/563] selftests/powerpc/spectre_v2: Return skip code when miss_percent is high [5.10,430/563] powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic [5.10,435/563] MIPS: Octeon: Fix build errors using clang [5.10,437/563] ASoC: mediatek: mt8173: fix device_node leak [5.10,440/563] rpmsg: core: Clean up resources on announce_create failure. [5.10,444/563] ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers [5.10,445/563] tpm: fix NPE on probe for missing device [5.10,448/563] fuse: Pass correct lend value to filemap_write_and_wait_range() [5.10,453/563] s390/mm: fix 2KB pgtable release race [5.10,456/563] drm/nouveau/kms/nv04: use vzalloc for nv04_display [5.10,459/563] powerpc/64s/radix: Fix huge vmap false positive [5.10,464/563] PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space [5.10,469/563] btrfs: fix deadlock between quota enable and other quota operations [5.10,474/563] ext4: fix a possible ABBA deadlock due to busy PA [5.10,478/563] ext4: Fix BUG_ON in ext4_bread when write quota data [5.10,479/563] ext4: use ext4_ext_remove_space() for fast commit replay delete range [5.10,483/563] ext4: dont use the orphan list when migrating an inode [5.10,487/563] can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message [5.10,488/563] media: rcar-csi2: Optimize the selection PHTW register [5.10,492/563] Documentation: ACPI: Fix data node reference documentation [5.10,494/563] Documentation: fix firewire.rst ABI file path error [5.10,495/563] Bluetooth: hci_sync: Fix not setting adv set duration [5.10,506/563] bpftool: Remove inclusion of utilities.mak from Makefiles [5.10,514/563] f2fs: compress: fix potential deadlock of compress file [5.10,524/563] net: axienet: limit minimum TX ring size [5.10,525/563] net: axienet: Fix TX ring slot available check [5.10,526/563] net: axienet: fix number of TX ring slots for available check [5.10,529/563] HID: vivaldi: fix handling devices not using numbered reports [5.10,531/563] vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 [5.10,533/563] taskstats: Cleanup the use of task->exit_code [5.10,535/563] netns: add schedule point in ops_exit_list() [5.10,536/563] xfrm: Dont accidentally set RTO_ONLINK in decode_session4() [5.10,537/563] gre: Dont accidentally set RTO_ONLINK in gre_fill_metadata_dst() [5.10,538/563] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() [5.10,541/563] dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending [5.10,542/563] dmaengine: at_xdmac: Print debug message after realeasing the lock [5.10,544/563] dmaengine: at_xdmac: Fix lld view setting [5.10,545/563] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition [5.10,548/563] arm64: dts: qcom: msm8996: drop not documented adreno properties [5.10,549/563] net: bonding: fix bond_xmit_broadcast return value error bug [5.10,553/563] net: sfp: fix high power modules without diagnostic monitoring [5.10,555/563] dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property [5.10,556/563] dt-bindings: display: meson-vpu: Add missing amlogic,canvas property [5.10,557/563] dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7 [5.10,559/563] lib82596: Fix IRQ check in sni_82596_probe [5.10,561/563] lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test [5.10,562/563] mtd: nand: bbt: Fix corner case in bad block table handling

[5.10,096/563] mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove

Commit Message

Patch