From patchwork Mon Jun 1 13:39:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 225143 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2713BC433E2 for ; Mon, 1 Jun 2020 13:40:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 037C82068D for ; Mon, 1 Jun 2020 13:40:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591018853; bh=CH8mGaZuzQ5m7qqlMmRJHYj9IYXYPPQsL/Bu0PcJM1A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uJIrNAprKl0YZcR6BOCPiRL25K++TUmBxnrpiMCE4fgH8/iBqqkLfTqW7vtvsSeh3 VC+TI7i24d9mSZrPCmmIqAGtYfyjhDAOQAUgRbNGAXzcLg3umiyPCKNnAdH4lsSMJw Uxag+WND2n+p0+3C09tAuGK6E1pU6UAnJFIqIQKM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726340AbgFANkr (ORCPT ); Mon, 1 Jun 2020 09:40:47 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:40825 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726201AbgFANk3 (ORCPT ); Mon, 1 Jun 2020 09:40:29 -0400 Received: by mail-lj1-f196.google.com with SMTP id z13so8163846ljn.7; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9WLwaacWxVJgJAQUy6rPeyp9VmCZjz1WJ6juENBmuJI=; b=L7DfhdlbTpPGL9COo0M27WG8/lt1F6mLb4/oVZ45DzZDxQyGFP2OxXPVpdDzQvBL5Y 4aE3T7+QwRBdsNnSPti8XzmhqU6PdsKGLPGhhJr3BBlRYrbHniPvlAFUC/yWRZDo+FCY uQr8EJA/CCtFcqIoPcbl5hzLpfbUvfPJDOAS5GizfV/TzqO9aE3v1X0TYISqdPMZfaT0 Q3J+m6KnwciYi6hJyDj8bzvSngH2VD0Fp15tFUis0C8lSPll1hi1SzkH5GTU/+0oYqHS YRrSLUxw2niB7knH/cYBDcMzDuptHK2ujlG8Rgn3I6AdWVIe/aFpDtM6VSXH9m4/KHJk Zzvw== X-Gm-Message-State: AOAM530vqS2N67sImi8i0dBts6V7u+n+Mg4zylInlqF8+tkDKMBxla20 UQX5I5JHQ6hwCkccQL+1Lr4= X-Google-Smtp-Source: ABdhPJxn833jupaamj8VbrnQIBjwbA4RDar5lOpXhyo1jksXZHcHMwIbMN6fnlhc5y6g4fEutsDj8g== X-Received: by 2002:a2e:8144:: with SMTP id t4mr9937763ljg.412.1591018825203; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) Received: from xi.terra (c-beaee455.07-184-6d6c6d4.bbcust.telenor.se. [85.228.174.190]) by smtp.gmail.com with ESMTPSA id 193sm2446783ljj.48.2020.06.01.06.40.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 06:40:23 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.93.0.4) (envelope-from ) id 1jfkfp-0003Fj-4a; Mon, 01 Jun 2020 15:40:17 +0200 From: Johan Hovold To: Jacek Anaszewski , Pavel Machek Cc: Dan Murphy , Amitoj Kaur Chawla , linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable Subject: [PATCH 2/6] leds: da903x: fix use-after-free on unbind Date: Mon, 1 Jun 2020 15:39:46 +0200 Message-Id: <20200601133950.12420-3-johan@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200601133950.12420-1-johan@kernel.org> References: <20200601133950.12420-1-johan@kernel.org> MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Several MFD child drivers register their class devices directly under the parent device. This means you cannot blindly do devres conversions so that deregistration ends up being tied to the parent device, something which leads to use-after-free on driver unbind when the class device is released while still being registered. Fixes: eed16255d66b ("leds: da903x: Use devm_led_classdev_register") Cc: stable # 4.6 Cc: Amitoj Kaur Chawla Signed-off-by: Johan Hovold --- drivers/leds/leds-da903x.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/leds/leds-da903x.c b/drivers/leds/leds-da903x.c index ed1b303f699f..2b5fb00438a2 100644 --- a/drivers/leds/leds-da903x.c +++ b/drivers/leds/leds-da903x.c @@ -110,12 +110,23 @@ static int da903x_led_probe(struct platform_device *pdev) led->flags = pdata->flags; led->master = pdev->dev.parent; - ret = devm_led_classdev_register(led->master, &led->cdev); + ret = led_classdev_register(led->master, &led->cdev); if (ret) { dev_err(&pdev->dev, "failed to register LED %d\n", id); return ret; } + platform_set_drvdata(pdev, led); + + return 0; +} + +static int da903x_led_remove(struct platform_device *pdev) +{ + struct da903x_led *led = platform_get_drvdata(pdev); + + led_classdev_unregister(&led->cdev); + return 0; } @@ -124,6 +135,7 @@ static struct platform_driver da903x_led_driver = { .name = "da903x-led", }, .probe = da903x_led_probe, + .remove = da903x_led_remove, }; module_platform_driver(da903x_led_driver); From patchwork Mon Jun 1 13:39:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 225144 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12CAFC433E0 for ; Mon, 1 Jun 2020 13:40:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E4BFD20772 for ; Mon, 1 Jun 2020 13:40:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591018842; bh=2u/87NLR8lLwYxTCzrW2tCpWFu3/l3gitVjxyl3BhBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wgu1nj91cHfO5PljhTf4yTbdgZFJCs7jjhHxJfFoLO2mZT0fkRTRmUeJAyeIdq1N4 aEn2G7bIRA/+MtRzFO0HYZNaJlivsBrCQVPe7qjEutpjT8PaaUwgJkfIXFMi0Vy8Kd AA0uc7CR2X2qUXkDdElix6NXJQuGvnp0iIderefA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727847AbgFANkm (ORCPT ); Mon, 1 Jun 2020 09:40:42 -0400 Received: from mail-lj1-f195.google.com ([209.85.208.195]:42587 "EHLO mail-lj1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726340AbgFANk3 (ORCPT ); Mon, 1 Jun 2020 09:40:29 -0400 Received: by mail-lj1-f195.google.com with SMTP id u10so6932487ljj.9; Mon, 01 Jun 2020 06:40:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0DAbBQDRNyPwe9sfmFlSyawhkSS6P8nN029qVNCibc8=; b=Bo5cNG1t2d4wuY5d96RjMAs5Bs/gSg8dy2Q/XRY1Add6MV34ukk9vEJXjCcg39/aKJ 6tug8jCx77S+u2JX1+HsDiEZ+gndjzO8cwF83GK1Ipu4MLJoXciUe2R8tMr/zdTrnSkn bpxSinFwjiOKnOZx/6XTzgfz9NN6mJVlZd3HFrP6wIEQ3MwquvKhNRsqxQ0OO9Fbzh+H bhqh2SNIgqWhg2hPBV8xUIXDj3zV4wDDnBIUssXv+U3/PFFTSd/c8hvBsXownr+/Hh6N IFE5i/bX/4hoFyO67m2MHF/8Ei4Ncp4yiwlqDxvPtDXbXcwf19RLVu3zNOtSzIedGjWI FE0Q== X-Gm-Message-State: AOAM532TPIUy+5YYFIGW4MtdlRIeP6UgE32394sqMfaudW8zvOC9X+RI YbTFyqj4Rrb4Vs6kDchegmuSrQSh X-Google-Smtp-Source: ABdhPJwKb6SZD3vuagiFT8tzEjSKsYXbndNniCfCAL5OD59Wxa40/IGR0iwEcX/VQ0EfhCh/0jEwzg== X-Received: by 2002:a2e:a488:: with SMTP id h8mr7627530lji.359.1591018826919; Mon, 01 Jun 2020 06:40:26 -0700 (PDT) Received: from xi.terra (c-beaee455.07-184-6d6c6d4.bbcust.telenor.se. [85.228.174.190]) by smtp.gmail.com with ESMTPSA id x5sm3370363ljd.123.2020.06.01.06.40.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 06:40:25 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.93.0.4) (envelope-from ) id 1jfkfp-0003Fy-ED; Mon, 01 Jun 2020 15:40:17 +0200 From: Johan Hovold To: Jacek Anaszewski , Pavel Machek Cc: Dan Murphy , Amitoj Kaur Chawla , linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable Subject: [PATCH 5/6] leds: wm831x-status: fix use-after-free on unbind Date: Mon, 1 Jun 2020 15:39:49 +0200 Message-Id: <20200601133950.12420-6-johan@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200601133950.12420-1-johan@kernel.org> References: <20200601133950.12420-1-johan@kernel.org> MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Several MFD child drivers register their class devices directly under the parent device. This means you cannot blindly do devres conversions so that deregistration ends up being tied to the parent device, something which leads to use-after-free on driver unbind when the class device is released while still being registered. Fixes: 8d3b6a4001ce ("leds: wm831x-status: Use devm_led_classdev_register") Cc: stable # 4.6 Cc: Amitoj Kaur Chawla Signed-off-by: Johan Hovold --- drivers/leds/leds-wm831x-status.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c index 082df7f1dd90..67f4235cb28a 100644 --- a/drivers/leds/leds-wm831x-status.c +++ b/drivers/leds/leds-wm831x-status.c @@ -269,12 +269,23 @@ static int wm831x_status_probe(struct platform_device *pdev) drvdata->cdev.blink_set = wm831x_status_blink_set; drvdata->cdev.groups = wm831x_status_groups; - ret = devm_led_classdev_register(wm831x->dev, &drvdata->cdev); + ret = led_classdev_register(wm831x->dev, &drvdata->cdev); if (ret < 0) { dev_err(&pdev->dev, "Failed to register LED: %d\n", ret); return ret; } + platform_set_drvdata(pdev, drvdata); + + return 0; +} + +static int wm831x_status_remove(struct platform_device *pdev) +{ + struct wm831x_status *drvdata = platform_get_drvdata(pdev); + + led_classdev_unregister(&drvdata->cdev); + return 0; } @@ -283,6 +294,7 @@ static struct platform_driver wm831x_status_driver = { .name = "wm831x-status", }, .probe = wm831x_status_probe, + .remove = wm831x_status_remove, }; module_platform_driver(wm831x_status_driver);