aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2023-06-26thermal/drivers/mediatek/lvts_thermal: Remove redundant msg in lvts_ctrl_start()Yangtao Li1-2/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qcom: Remove redundant msg at probe timeYangtao Li3-9/+3
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/ti-soc: Remove redundant msg in ti_thermal_expose_sensor()Yangtao Li1-2/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Acked-by: Keerthy <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qoriq: Remove redundant msg in qoriq_tmu_register_tmu_zone()Yangtao Li1-3/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/tegra: Remove redundant msg in tegra_tsensor_register_channel()Yangtao Li1-2/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26drivers/thermal/k3: Remove redundant msg in k3_bandgap_probe()Yangtao Li1-2/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/imx: Remove redundant msg in imx8mm_tmu_probe() and ↵Yangtao Li2-4/+2
imx_sc_thermal_probe() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/amlogic: Remove redundant msg in amlogic_thermal_probe()Yangtao Li1-2/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Reviewed-by: Martin Blumenstingl <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/sun8i: Remove redundant msg in sun8i_ths_register()Yangtao Li1-3/+1
The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li <[email protected]> Acked-by: Jernej Skrabec <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/hwmon: Add error information printing for devm_thermal_add_hwmon_sysfs()Yangtao Li1-1/+4
Ensure that all error handling branches print error information. In this way, when this function fails, the upper-layer functions can directly return an error code without missing debugging information. Otherwise, the error message will be printed redundantly or missing. Signed-off-by: Yangtao Li <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/stm32: Convert to platform remove callback returning voidUwe Kleine-König3-7/+5
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. st_thermal_unregister() always returned zero, so convert it to return void without any loss and then just drop the return from st_mmap_remove(). Signed-off-by: Uwe Kleine-König <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26net/mlx5: Update the driver with the recent thermal changesDaniel Lezcano1-7/+8
The thermal framework is migrating to the generic trip points. The set of changes also implies a self-encapsulation of the thermal zone device structure where the internals are no longer directly accessible but with accessors. Use the new API instead, so the next changes can be pushed in the thermal framework without this driver failing to compile. No functional changes intended. Cc: Sandipan Patra <[email protected]> Cc: Gal Pressman <[email protected]> Cc: Saeed Mahameed <[email protected]> Cc: Jakub Kicinski <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Reviewed-by: Simon Horman <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/armada: Add support for AP807 thermal dataAlex Leibovich1-2/+30
Add support for the AP807 die thermal data. This is the same as AP806, except for the coefficients. ap807 values taken from TSENSE_ADC_16FFC spec, which says: T(in Celsius) = T(code)*TSENE_GAIN+TSENE_OFFSET where in default: TSENE_OFFSET = 128.9 TSENE_GAIN = 0.394 Signed-off-by: Alex Leibovich <[email protected]> Tested-by: sa_ip-sw-jenkins <[email protected]> Reviewed-by: Stefan Chulski <[email protected]> Signed-off-by: Russell King (Oracle) <[email protected]> Reviewed-by: Miquel Raynal <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: armada-thermal: Add armada-ap807-thermal compatibleAlex Leibovich1-0/+1
Add marvell,armada-ap807-thermal compatible for the AP807 die. Signed-off-by: Alex Leibovich <[email protected]> Reviewed-by: Stefan Chulski <[email protected]> Signed-off-by: Russell King (Oracle) <[email protected]> Acked-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qoriq: Support version 2.1Peng Fan1-4/+10
i.MX93 use TMU version 2.1, which supports: - TRITSR_TP5(When this field is 1, you must add 0.5 K to the temperature that TEMP reports. For example, if TEMP is 300 K and TP5=1, then the final temperature is 300.5 K.) - Has 16 TTRCR register: Temperature Range Control (TTRCR0 - TTRCR15) This patch is to add this support. Signed-off-by: Peng Fan <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qoriq: Only enable supported sensorsPeng Fan1-11/+19
There are MAX 16 sensors, but not all of them supported. Such as i.MX8MQ, there are only 3 sensors. Enabling all 16 sensors will touch reserved bits from i.MX8MQ reference mannual, and TMU will stuck, temperature will not update anymore. Fixes: 45038e03d633 ("thermal: qoriq: Enable all sensors before registering them") Signed-off-by: Peng Fan <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qoriq: No need to program site adjustment registerPankit Garg1-4/+0
No need to program site adjustment register, as programming these registers do not give accurate value and also these registers are not mentioned in Reference Manual. Signed-off-by: Pankit Garg <[email protected]> Signed-off-by: Peng Fan <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/mediatek/lvts_thermal: Register thermal zones as hwmon sensorsChen-Yu Tsai1-0/+5
Register thermal zones as hwmon sensors to let userspace read temperatures using standard hwmon interface. Signed-off-by: Chen-Yu Tsai <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()Christophe JAILLET1-37/+18
Should an error occur after calling sun8i_ths_resource_init() in the probe function, some resources need to be released, as already done in the .remove() function. Switch to the devm_clk_get_enabled() helper and add a new devm_action to turn sun8i_ths_resource_init() into a fully managed function. Move the place where reset_control_deassert() is called so that the recommended order of reset release/clock enable steps is kept. A64 manual states that: 3.3.6.4. Gating and reset Make sure that the reset signal has been released before the release of module clock gating; This fixes the issue and removes some LoC at the same time. Fixes: dccc5c3b6f30 ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40") Signed-off-by: Christophe JAILLET <[email protected]> Acked-by: Maxime Ripard <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/a8ae84bd2dc4b55fe428f8e20f31438bf8bb6762.1684089931.git.christophe.jaillet@wanadoo.fr
2023-06-26Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak ↵Ricardo Cañuelo1-12/+2
in mtk_thermal_probe" This reverts commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26. That change was causing a regression in the generic-adc-thermal-probed bootrr test as reported in the kernelci-results list [1]. A proper rework will take longer, so revert it for now. [1] https://groups.io/g/kernelci-results/message/42660 Fixes: f05c7b7d9ea9 ("thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe") Signed-off-by: Ricardo Cañuelo <[email protected]> Suggested-by: AngeloGioacchino Del Regno <[email protected]> Reviewed-by: AngeloGioacchino Del Regno <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qcom/tsens-v0_1: Add MSM8909 dataStephan Gerhold3-2/+39
The MSM8909 SoC has 5 thermal sensors in a TSENS v0.1 block. Like MDM9607 it uses a non-standard default slope value of 3000 [1] and needs per-sensor "correction factors" to workaround issues with the factory calibration [2]. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/blob/LA.UM.7.7.c26-09100-8x09.0/arch/arm/boot/dts/qcom/msm8909.dtsi#L476 [2]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/commit/6df022c6d0c2c1b4a5a6c2124dba4d57910c0911 Reviewed-by: Konrad Dybcio <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Signed-off-by: Stephan Gerhold <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: thermal: qcom-tsens: Add MSM8909 compatibleStephan Gerhold1-0/+1
MSM8909 uses the TSENS v0.1 block similar to other SoCs like MDM9607. Document the "qcom,msm8909-tsens" compatible in the existing schema. Acked-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Stephan Gerhold <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: thermal: qcom-tsens: Drop redundant compatiblesStephan Gerhold1-21/+1
Since the SoC compatibles must be followed by the IP version compatible (e.g. compatible = "qcom,msm8916-tsens", "qcom,tsens-v0_1";) it is redundant to list all the SoC compatibles again in the if statement. It will already match the IP-version compatible. The list has already become inconsistent since for example "qcom,msm8939-tsens" is covered by the if statement but is not listed there explicitly like the other SoCs. Simplify this by dropping the redundant SoC compatibles. ipq8064 and msm8960 are still needed because they do not have an IP-version compatible. Reviewed-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Stephan Gerhold <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qcom/tsens-v0_1: Add mdm9607 correction offsetsStephan Gerhold3-1/+30
According to the msm-3.18 vendor kernel from Qualcomm, mdm9607 needs "correction factors" to adjust for additional offsets observed after the factory calibration values in the fuses [1, 2]. The fixed offsets should be applied unless there is a special calibration mode value that indicates that no offsets are needed [3]. Note that the new calibration mode values are called differently in this patch compared to the vendor kernel: - TSENS_TWO_POINT_CALIB_N_WA -> ONE_PT_CALIB2_NO_OFFSET - TSENS_TWO_POINT_CALIB_N_OFFSET_WA -> TWO_PT_CALIB_NO_OFFSET This is because close inspection of the calibration function [3] reveals that TSENS_TWO_POINT_CALIB_N_WA is actually a "one point" calibration because the if statements skip all "point2" related code for it. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/commit/d9d2db1b82bf3f72f5de0803d55e6849eb5b671e [2]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/commit/d75aef53a760e8ff7bac54049d00c8b2ee1b193e [3]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/blob/LE.UM.4.3.2.r1-04200-9x07/drivers/thermal/msm-tsens.c#L2987-3136 Fixes: a2149ab815fc ("thermal/drivers/qcom/tsens-v0_1: Add support for MDM9607") Reviewed-by: Konrad Dybcio <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Signed-off-by: Stephan Gerhold <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qcom/tsens-v0_1: Fix mdm9607 slope valuesStephan Gerhold1-1/+17
According to the msm-3.18 vendor kernel from Qualcomm [1], mdm9607 uses a non-standard slope value of 3000 (instead of 3200) for all sensors. Fill it properly similar to the 8939 code added recently. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/blob/LE.UM.4.3.2.r1-04200-9x07/arch/arm/boot/dts/qcom/mdm9607.dtsi#L875 Fixes: a2149ab815fc ("thermal/drivers/qcom/tsens-v0_1: Add support for MDM9607") Reviewed-by: Konrad Dybcio <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Signed-off-by: Stephan Gerhold <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal/drivers/qcom/tsens: Drop unused legacy structsStephan Gerhold2-58/+0
The old single-cell parsing code was removed for MSM8939, MDM9607 and MSM8976 but for some reason the structs defining the bit positions etc were kept around (unused). Drop them now. Cc: Dmitry Baryshkov <[email protected]> Fixes: 51d78b8b1beb ("thermal/drivers/tsens: Drop single-cell code for mdm9607") Fixes: dfadb4599ab0 ("thermal/drivers/tsens: Drop single-cell code for msm8939") Fixes: 3a908971f7cb ("thermal/drivers/tsens: Drop single-cell code for msm8976/msm8956") Reviewed-by: Konrad Dybcio <[email protected]> Signed-off-by: Stephan Gerhold <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: thermal: tsens: Add ipq9574 compatiblePraveenkumar I1-0/+6
Qualcomm IPQ9574 has tsens v2.3.1 block, which is similar to IPQ8074 tsens. Reviewed-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Praveenkumar I <[email protected]> Signed-off-by: Varadarajan Narayanan <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/ec9799504fe5a141e107bb78955d8d427f00553f.1686125196.git.quic_varada@quicinc.com
2023-06-26dt-bindings: thermal: convert bcm2835-thermal bindings to YAMLStefan Wahren2-41/+48
Convert the DT binding document for bcm2835-thermal from .txt to YAML. Signed-off-by: Stefan Wahren <[email protected]> Reviewed-by: Rob Herring <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26thermal: Allow selecting the bang-bang governor as defaultThierry Reding2-0/+10
For many setups the bang-bang governor is exactly what we want. Many ARM SoC-based devices use fans to cool down the entire SoC and that works well only with the bang-bang governor because it uses the hysteresis in order to let the fan run for a while to cool the SoC down below the trip point before switching it off again. The step-wise governor will behave strangely in these situations. It doesn't use the hysteresis, so it can lead to situations where the fan is turned on for only a very brief period and then is switched back off, only to get switched back on again very quickly because the SoC hasn't cooled down very much. Signed-off-by: Thierry Reding <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Daniel Lezcano <[email protected]>
2023-06-26thermal/drivers/qcom/tsens-v0_1: Add support for MSM8226Matti Lehtimäki3-2/+30
The MSM8226 TSENS IP has 6 thermal sensors in a TSENS v0.1 block. The thermal sensors use non-standard slope values. Signed-off-by: Matti Lehtimäki <[email protected]> Reviewed-by: Dmitry Baryshkov <[email protected]> Reviewed-by: Luca Weiss <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: thermal: tsens: Add compatible for MSM8226Matti Lehtimäki1-0/+1
Qualcomm MSM8226 has tsens v0.1 block. Signed-off-by: Matti Lehtimäki <[email protected]> Reviewed-by: Krzysztof Kozlowski <[email protected]> Reviewed-by: Luca Weiss <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26drivers/thermal/rcar_gen3_thermal: add reading fuses for Gen4Wolfram Sang1-2/+42
The registers are differently named and at different offsets, but their functionality is the same as for Gen3. Signed-off-by: Wolfram Sang <[email protected]> Reviewed-by: Niklas Söderlund <[email protected]> Reviewed-by: Yoshihiro Shimoda <[email protected]> Tested-by: Yoshihiro Shimoda <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26drivers/thermal/rcar_gen3_thermal: refactor reading fuses into seprarate ↵Wolfram Sang1-24/+36
function Gen4 will be very different, so refactor Gen3 access into separate call first. Signed-off-by: Wolfram Sang <[email protected]> Reviewed-by: Niklas Söderlund <[email protected]> Reviewed-by: Yoshihiro Shimoda <[email protected]> Tested-by: Yoshihiro Shimoda <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26drivers/thermal/rcar_gen3_thermal: introduce 'info' structureWolfram Sang1-15/+26
More items to describe the TSCs are needed soon, so encapsulate the current 'ths_tj_1' item into a struct. Signed-off-by: Wolfram Sang <[email protected]> Reviewed-by: Niklas Söderlund <[email protected]> Reviewed-by: Yoshihiro Shimoda <[email protected]> Tested-by: Yoshihiro Shimoda <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: thermal: tsens: Add compatible for SM6375Konrad Dybcio1-0/+1
The Qualcomm SM6375 platform has two instances of the tsens v2.8.0 block, add a compatible for these instances. Acked-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Konrad Dybcio <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26dt-bindings: thermal: tsens: Add QCM2290Konrad Dybcio1-0/+1
Add the TSENS v2.x controller found on QCM2290. Acked-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Konrad Dybcio <[email protected]> Signed-off-by: Daniel Lezcano <[email protected]> Link: https://lore.kernel.org/r/[email protected]
2023-06-26net: nfc: Fix use-after-free caused by nfc_llcp_find_localLin Ma6-24/+77
This commit fixes several use-after-free that caused by function nfc_llcp_find_local(). For example, one UAF can happen when below buggy time window occurs. // nfc_genl_llc_get_params | // nfc_unregister_device | dev = nfc_get_device(idx); | device_lock(...) if (!dev) | dev->shutting_down = true; return -ENODEV; | device_unlock(...); | device_lock(...); | // nfc_llcp_unregister_device | nfc_llcp_find_local() nfc_llcp_find_local(...); | | local_cleanup() if (!local) { | rc = -ENODEV; | // nfc_llcp_local_put goto exit; | kref_put(.., local_release) } | | // local_release | list_del(&local->list) // nfc_genl_send_params | kfree() local->dev->idx !!!UAF!!! | | and the crash trace for the one of the discussed UAF like: BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 Read of size 8 at addr ffff888105b0e410 by task 20114 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:319 [inline] print_report+0xcc/0x620 mm/kasan/report.c:430 kasan_report+0xb2/0xe0 mm/kasan/report.c:536 nfc_genl_send_params net/nfc/netlink.c:999 [inline] nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968 genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b6/0x200 net/socket.c:747 ____sys_sendmsg+0x6e9/0x890 net/socket.c:2501 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555 __sys_sendmsg+0xf7/0x1d0 net/socket.c:2584 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f34640a2389 RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006 RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000 </TASK> Allocated by task 20116: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567 nfc_register_device+0x61/0x260 net/nfc/core.c:1124 nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257 virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148 misc_open+0x379/0x4a0 drivers/char/misc.c:165 chrdev_open+0x26c/0x780 fs/char_dev.c:414 do_dentry_open+0x6c4/0x12a0 fs/open.c:920 do_open fs/namei.c:3560 [inline] path_openat+0x24fe/0x37e0 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x171/0x4c0 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x143/0x200 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 20115: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free mm/kasan/common.c:200 [inline] __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x7a/0x190 mm/slub.c:3800 local_release net/nfc/llcp_core.c:174 [inline] kref_put include/linux/kref.h:65 [inline] nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline] nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline] nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620 nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179 virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163 __fput+0x252/0xa20 fs/file_table.c:321 task_work_run+0x174/0x270 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc Last potentially related work creation: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 __kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491 kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328 drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735 unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773 unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753 neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895 addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684 notifier_call_chain+0xbe/0x210 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937 call_netdevice_notifiers_extack net/core/dev.c:1975 [inline] call_netdevice_notifiers net/core/dev.c:1989 [inline] dev_change_name+0x3c3/0x870 net/core/dev.c:1211 dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376 dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542 sock_do_ioctl+0x160/0x260 net/socket.c:1213 sock_ioctl+0x3f9/0x670 net/socket.c:1316 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff888105b0e400 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff888105b0e400, ffff888105b0e800) The buggy address belongs to the physical page: head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10 raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb In summary, this patch solves those use-after-free by 1. Re-implement the nfc_llcp_find_local(). The current version does not grab the reference when getting the local from the linked list. For example, the llcp_sock_bind() gets the reference like below: // llcp_sock_bind() local = nfc_llcp_find_local(dev); // A ..... \ | raceable ..... / llcp_sock->local = nfc_llcp_local_get(local); // B There is an apparent race window that one can drop the reference and free the local object fetched in (A) before (B) gets the reference. 2. Some callers of the nfc_llcp_find_local() do not grab the reference at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions. We add the nfc_llcp_local_put() for them. Moreover, we add the necessary error handling function to put the reference. 3. Add the nfc_llcp_remove_local() helper. The local object is removed from the linked list in local_release() when all reference is gone. This patch removes it when nfc_llcp_unregister_device() is called. Therefore, every caller of nfc_llcp_find_local() will get a reference even when the nfc_llcp_unregister_device() is called. This promises no use-after-free for the local object is ever possible. Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support") Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket") Signed-off-by: Lin Ma <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-06-26Merge branch 'sfc-next'David S. Miller3-57/+84
Edward Cree says: ==================== sfc: fix unaligned access in loopback selftests Arnd reported that the sfc drivers each define a packed loopback_payload structure with an ethernet header followed by an IP header, whereas the kernel definition of iphdr specifies that this is 4-byte aligned, causing a W=1 warning. Fix this in each case by adding two bytes of leading padding to the struct, taking care that these are not sent on the wire. Tested on EF10; build-tested on Siena and Falcon. Changed in v2: * added __aligned(4) to payload struct definitions (Arnd) * fixed dodgy whitespace (checkpatch) ==================== Signed-off-by: David S. Miller <[email protected]>
2023-06-26sfc: falcon: use padding to fix alignment in loopback testEdward Cree1-19/+28
Add two bytes of padding to the start of struct ef4_loopback_payload, which are not sent on the wire. This ensures the 'ip' member is 4-byte aligned, preventing the following W=1 warning: net/ethernet/sfc/falcon/selftest.c:43:15: error: field ip within 'struct ef4_loopback_payload' is less aligned than 'struct iphdr' and is usually due to 'struct ef4_loopback_payload' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct iphdr ip; Reported-by: Arnd Bergmann <[email protected]> Signed-off-by: Edward Cree <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-06-26sfc: siena: use padding to fix alignment in loopback testEdward Cree1-19/+28
Add two bytes of padding to the start of struct efx_loopback_payload, which are not sent on the wire. This ensures the 'ip' member is 4-byte aligned, preventing the following W=1 warning: net/ethernet/sfc/siena/selftest.c:46:15: error: field ip within 'struct efx_loopback_payload' is less aligned than 'struct iphdr' and is usually due to 'struct efx_loopback_payload' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct iphdr ip; Reported-by: Arnd Bergmann <[email protected]> Signed-off-by: Edward Cree <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-06-26sfc: use padding to fix alignment in loopback testEdward Cree1-19/+28
Add two bytes of padding to the start of struct efx_loopback_payload, which are not sent on the wire. This ensures the 'ip' member is 4-byte aligned, preventing the following W=1 warning: net/ethernet/sfc/selftest.c:46:15: error: field ip within 'struct efx_loopback_payload' is less aligned than 'struct iphdr' and is usually due to 'struct efx_loopback_payload' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct iphdr ip; Reported-by: Arnd Bergmann <[email protected]> Signed-off-by: Edward Cree <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-06-26Merge tag 'irqchip-6.5' of ↵Thomas Gleixner1039-5611/+9989
git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - A number of Loogson/Loogarch fixes - Allow the core code to retrigger an interrupt that has fired while the same interrupt is being handled on another CPU, papering over a GICv3 architecture issue - Work around an integration problem on ASR8601, where the CPU numbering isn't representable in the GIC implementation... - Add some missing interrupt to the STM32 irqchip - A bunch of warning squashing triggered by W=1 builds Link: https://lore.kernel.org/r/[email protected]
2023-06-26Merge tag 'timers-v6.5-rc1' of ↵Thomas Gleixner20-374/+442
https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clockevent/source updates from Daniel Lezcano: - Fix memory leak on Cadence TTC at probe time (Feng Mingxi) - Use the pm_sleep_ptr macro for the Ingenic driver (Paul Cercueil) - Relocate the PMW timer Loongson from the mips arch directory to the drivers/clocksource (Keguang Zhang) - Use the same function names instead of using aliases and move data defined in the header to the driver directly as this one is the only user of the header file and remove this one on i.MX GPT (Uwe Kleine-König) - Convert Broadcom Kona family timer bindings to DT schema (Michael Kelley) - Add DT bindings for Ralink SoCs timer (Sergio Paracuellos)
2023-06-26sfc: fix crash when reading stats while NIC is resettingEdward Cree1-3/+10
efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC has been fini'd. In this case do not attempt to fetch the latest stats from the hardware, else we will crash on a NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP efx_nic_update_stats abridged calltrace: efx_ef10_update_stats_pf efx_net_stats dev_get_stats dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the efx->stats_lock in fini_nic (it is already held across update_stats). Fixes: d3142c193dca ("sfc: refactor EF10 stats handling") Reviewed-by: Pieter Jansen van Vuuren <[email protected]> Signed-off-by: Edward Cree <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-06-26netfilter: nf_tables: limit allowed range via nla_policyFlorian Westphal15-21/+21
These NLA_U32 types get stored in u8 fields, reject invalid values instead of silently casting to u8. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2023-06-26netfilter: nf_tables: Introduce NFT_MSG_GETSETELEM_RESETPhil Sutter2-20/+50
Analogous to NFT_MSG_GETOBJ_RESET, but for set elements with a timeout or attached stateful expressions like counters or quotas - reset them all at once. Respect a per element timeout value if present to reset the 'expires' value to. Signed-off-by: Phil Sutter <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2023-06-26netfilter: snat: evict closing tcp entries on reply tuple collisionFlorian Westphal1-4/+88
When all tried source tuples are in use, the connection request (skb) and the new conntrack will be dropped in nf_confirm() due to the non-recoverable clash. Make it so that the last 32 attempts are allowed to evict a colliding entry if this connection is already closing and the new sequence number has advanced past the old one. Such "all tuples taken" secenario can happen with tcp-rpc workloads where same dst:dport gets queried repeatedly. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2023-06-26netfilter: nf_tables: permit update of set sizeFlorian Westphal2-0/+7
Now that set->nelems is always updated permit update of the sets max size. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2023-06-26netfilter: ipset: remove rcu_read_lock_bh pair from ip_set_testFlorian Westphal1-2/+0
Callers already hold rcu_read_lock. Prior to RCU conversion this used to be a read_lock_bh(), but now the bh-disable isn't needed anymore. Cc: Jozsef Kadlecsik <[email protected]> Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
2023-06-26netfilter: nft_payload: rebuild vlan header when neededPablo Neira Ayuso1-1/+2
Skip rebuilding the vlan header when accessing destination and source mac address. Signed-off-by: Pablo Neira Ayuso <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.