Commit 289ef7be authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'driver-core-5.14-rc5' of... 

Merge tag 'driver-core-5.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core fixes from Greg KH:
 "Here are three tiny driver core and firmware loader fixes for
  5.14-rc5. They are:

   - driver core fix for when probing fails

   - firmware loader fixes for reported problems.

  All have been in linux-next for a while with no reported issues"

* tag 'driver-core-5.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  firmware_loader: fix use-after-free in firmware_fallback_sysfs
  firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
  drivers core: Fix oops when driver probe fails
parents 911c3c5e 75d95e2e

drivers/base/dd.c

+2 −2
Original line number Diff line number Diff line
@@ -653,8 +653,6 @@ static int really_probe(struct device *dev, struct device_driver *drv) 
	else if (drv->remove)

		drv->remove(dev);

probe_failed:

	kfree(dev->dma_range_map);

	dev->dma_range_map = NULL;

	if (dev->bus)

		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,

					     BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
@@ -662,6 +660,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) 
	device_links_no_driver(dev);

	devres_release_all(dev);

	arch_teardown_dma_ops(dev);

	kfree(dev->dma_range_map);

	dev->dma_range_map = NULL;

	driver_sysfs_remove(dev);

	dev->driver = NULL;

	dev_set_drvdata(dev, NULL);

drivers/base/firmware_loader/fallback.c

+8 −6
Original line number Diff line number Diff line
@@ -89,12 +89,11 @@ static void __fw_load_abort(struct fw_priv *fw_priv) 
{

	/*

	 * There is a small window in which user can write to 'loading'

	 * between loading done and disappearance of 'loading'

	 * between loading done/aborted and disappearance of 'loading'

	 */

	if (fw_sysfs_done(fw_priv))

	if (fw_state_is_aborted(fw_priv) || fw_sysfs_done(fw_priv))

		return;



	list_del_init(&fw_priv->pending_list);

	fw_state_aborted(fw_priv);

}
@@ -280,7 +279,6 @@ static ssize_t firmware_loading_store(struct device *dev, 
			 * Same logic as fw_load_abort, only the DONE bit

			 * is ignored and we set ABORT only on failure.

			 */

			list_del_init(&fw_priv->pending_list);

			if (rc) {

				fw_state_aborted(fw_priv);

				written = rc;
@@ -513,6 +511,11 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout) 
	}



	mutex_lock(&fw_lock);

	if (fw_state_is_aborted(fw_priv)) {

		mutex_unlock(&fw_lock);

		retval = -EINTR;

		goto out;

	}

	list_add(&fw_priv->pending_list, &pending_fw_head);

	mutex_unlock(&fw_lock);
@@ -535,11 +538,10 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout) 
	if (fw_state_is_aborted(fw_priv)) {

		if (retval == -ERESTARTSYS)

			retval = -EINTR;

		else

			retval = -EAGAIN;

	} else if (fw_priv->is_paged_buf && !fw_priv->data)

		retval = -ENOMEM;



out:

	device_del(f_dev);

err_put_dev:

	put_device(f_dev);

drivers/base/firmware_loader/firmware.h

+9 −1
Original line number Diff line number Diff line
@@ -117,9 +117,17 @@ static inline void __fw_state_set(struct fw_priv *fw_priv, 


	WRITE_ONCE(fw_st->status, status);



	if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)

	if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) {

#ifdef CONFIG_FW_LOADER_USER_HELPER

		/*

		 * Doing this here ensures that the fw_priv is deleted from

		 * the pending list in all abort/done paths.

		 */

		list_del_init(&fw_priv->pending_list);

#endif

		complete_all(&fw_st->completion);

	}

}



static inline void fw_state_aborted(struct fw_priv *fw_priv)

{

drivers/base/firmware_loader/main.c

+2 −0
Original line number Diff line number Diff line
@@ -783,8 +783,10 @@ static void fw_abort_batch_reqs(struct firmware *fw) 
		return;



	fw_priv = fw->priv;

	mutex_lock(&fw_lock);

	if (!fw_state_is_aborted(fw_priv))

		fw_state_aborted(fw_priv);

	mutex_unlock(&fw_lock);

}



/* called from request_firmware() and request_firmware_work_func() */