[PATCH v2 0/2] gpio: regression fixes

[PATCH v2 0/2] gpio: regression fixes

[Johan Hovold]

Here's a fix for a regression in 5.12 due to the new stub-driver hack,
and a fix for potential list corruption due to missing locking which has
been there since the introduction of the character-device interface in
4.6.

Johan

Changes in v2
 - drop the corresponding drv_set_drvdata() which is no longer needed
   after patch 1/2
 - add Saravanas's reviewed-by tag to patch 2/2


Johan Hovold (2):
  gpio: fix NULL-deref-on-deregistration regression
  gpio: fix gpio-device list corruption

 drivers/gpio/gpiolib.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

-- 
2.26.2

[PATCH v2 1/2] gpio: fix NULL-deref-on-deregistration regression

[Johan Hovold]

Fix a NULL-pointer deference when deregistering the gpio character
device that was introduced by the recent stub-driver hack. When the new
"driver" is unbound as part of deregistration, driver core clears the
driver-data pointer which is used to retrieve the struct gpio_device in
its release callback.

Fix this by using container_of() in the release callback as should have
been done all along.

Fixes: 4731210c09f5 ("gpiolib: Bind gpio_device to a driver to enable fw_devlink=on by default")
Cc: Saravana Kannan <saravanak@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reported-by: syzbot+d27b4c8adbbff70fbfde@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/gpio/gpiolib.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index adf55db080d8..6e0572515d02 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -474,7 +474,7 @@ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid);
 
 static void gpiodevice_release(struct device *dev)
 {
-	struct gpio_device *gdev = dev_get_drvdata(dev);
+	struct gpio_device *gdev = container_of(dev, struct gpio_device, dev);
 
 	list_del(&gdev->list);
 	ida_free(&gpio_ida, gdev->id);
@@ -605,7 +605,6 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
 		goto err_free_ida;
 
 	device_initialize(&gdev->dev);
-	dev_set_drvdata(&gdev->dev, gdev);
 	if (gc->parent && gc->parent->driver)
 		gdev->owner = gc->parent->driver->owner;
 	else if (gc->owner)
-- 
2.26.2

[PATCH v2 2/2] gpio: fix gpio-device list corruption

[Johan Hovold]

Make sure to hold the gpio_lock when removing the gpio device from the
gpio_devices list (when dropping the last reference) to avoid corrupting
the list when there are concurrent accesses.

Fixes: ff2b13592299 ("gpio: make the gpiochip a real device")
Cc: stable@vger.kernel.org      # 4.6
Reviewed-by: Saravana Kannan <saravanak@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/gpio/gpiolib.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 6e0572515d02..4253837f870b 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -475,8 +475,12 @@ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid);
 static void gpiodevice_release(struct device *dev)
 {
 	struct gpio_device *gdev = container_of(dev, struct gpio_device, dev);
+	unsigned long flags;
 
+	spin_lock_irqsave(&gpio_lock, flags);
 	list_del(&gdev->list);
+	spin_unlock_irqrestore(&gpio_lock, flags);
+
 	ida_free(&gpio_ida, gdev->id);
 	kfree_const(gdev->label);
 	kfree(gdev->descs);
-- 
2.26.2

Re: [PATCH v2 0/2] gpio: regression fixes

[Bartosz Golaszewski]

On Mon, Mar 1, 2021 at 10:05 AM Johan Hovold <johan@kernel.org> wrote:
>
> Here's a fix for a regression in 5.12 due to the new stub-driver hack,
> and a fix for potential list corruption due to missing locking which has
> been there since the introduction of the character-device interface in
> 4.6.
>
> Johan
>
> Changes in v2
>  - drop the corresponding drv_set_drvdata() which is no longer needed
>    after patch 1/2
>  - add Saravanas's reviewed-by tag to patch 2/2
>
>
> Johan Hovold (2):
>   gpio: fix NULL-deref-on-deregistration regression
>   gpio: fix gpio-device list corruption
>
>  drivers/gpio/gpiolib.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> --
> 2.26.2
>

Patches applied, thanks!

Bartosz

Re: [PATCH v2 0/2] gpio: regression fixes

[Andy Shevchenko]

On Mon, Mar 1, 2021 at 11:13 AM Bartosz Golaszewski
<bgolaszewski@baylibre.com> wrote:
> On Mon, Mar 1, 2021 at 10:05 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > Here's a fix for a regression in 5.12 due to the new stub-driver hack,
> > and a fix for potential list corruption due to missing locking which has
> > been there since the introduction of the character-device interface in
> > 4.6.
> >
> > Johan
> >
> > Changes in v2
> >  - drop the corresponding drv_set_drvdata() which is no longer needed
> >    after patch 1/2
> >  - add Saravanas's reviewed-by tag to patch 2/2
> >
> >
> > Johan Hovold (2):
> >   gpio: fix NULL-deref-on-deregistration regression
> >   gpio: fix gpio-device list corruption
> >
> >  drivers/gpio/gpiolib.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)

> Patches applied, thanks!

Ooops, you are fast!
Anyway, I have tested with gpio-aggregator (w/o this series it
sparkles with all possible bugs).
Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 0/2] gpio: regression fixes

[Saravana Kannan]

On Mon, Mar 1, 2021 at 1:12 AM Bartosz Golaszewski
<bgolaszewski@baylibre.com> wrote:
>
> On Mon, Mar 1, 2021 at 10:05 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > Here's a fix for a regression in 5.12 due to the new stub-driver hack,
> > and a fix for potential list corruption due to missing locking which has
> > been there since the introduction of the character-device interface in
> > 4.6.
> >
> > Johan
> >
> > Changes in v2
> >  - drop the corresponding drv_set_drvdata() which is no longer needed
> >    after patch 1/2
> >  - add Saravanas's reviewed-by tag to patch 2/2
> >
> >
> > Johan Hovold (2):
> >   gpio: fix NULL-deref-on-deregistration regression
> >   gpio: fix gpio-device list corruption
> >
> >  drivers/gpio/gpiolib.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > --
> > 2.26.2
> >
>
> Patches applied, thanks!

Thanks Johan and Bartosz!

-Saravana

Re: [PATCH v2 0/2] gpio: regression fixes

[Bartosz Golaszewski]

On Mon, Mar 1, 2021 at 5:57 PM Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
>
> On Mon, Mar 1, 2021 at 11:13 AM Bartosz Golaszewski
> <bgolaszewski@baylibre.com> wrote:
> > On Mon, Mar 1, 2021 at 10:05 AM Johan Hovold <johan@kernel.org> wrote:
> > >
> > > Here's a fix for a regression in 5.12 due to the new stub-driver hack,
> > > and a fix for potential list corruption due to missing locking which has
> > > been there since the introduction of the character-device interface in
> > > 4.6.
> > >
> > > Johan
> > >
> > > Changes in v2
> > >  - drop the corresponding drv_set_drvdata() which is no longer needed
> > >    after patch 1/2
> > >  - add Saravanas's reviewed-by tag to patch 2/2
> > >
> > >
> > > Johan Hovold (2):
> > >   gpio: fix NULL-deref-on-deregistration regression
> > >   gpio: fix gpio-device list corruption
> > >
> > >  drivers/gpio/gpiolib.c | 7 +++++--
> > >  1 file changed, 5 insertions(+), 2 deletions(-)
>
> > Patches applied, thanks!
>
> Ooops, you are fast!

The regression broke my gpip-sim I'm working on right now so I tested it too.

Bartosz

Re: [PATCH v2 1/2] gpio: fix NULL-deref-on-deregistration regression

[Linus Walleij]

On Mon, Mar 1, 2021 at 10:05 AM Johan Hovold <johan@kernel.org> wrote:

> Fix a NULL-pointer deference when deregistering the gpio character
> device that was introduced by the recent stub-driver hack. When the new
> "driver" is unbound as part of deregistration, driver core clears the
> driver-data pointer which is used to retrieve the struct gpio_device in
> its release callback.
>
> Fix this by using container_of() in the release callback as should have
> been done all along.
>
> Fixes: 4731210c09f5 ("gpiolib: Bind gpio_device to a driver to enable fw_devlink=on by default")
> Cc: Saravana Kannan <saravanak@google.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Reported-by: syzbot+d27b4c8adbbff70fbfde@syzkaller.appspotmail.com
> Signed-off-by: Johan Hovold <johan@kernel.org>

Oh nice catch!
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

Yours,
Linus Walleij

Re: [PATCH v2 2/2] gpio: fix gpio-device list corruption

[Linus Walleij]

On Mon, Mar 1, 2021 at 10:05 AM Johan Hovold <johan@kernel.org> wrote:

> Make sure to hold the gpio_lock when removing the gpio device from the
> gpio_devices list (when dropping the last reference) to avoid corrupting
> the list when there are concurrent accesses.
>
> Fixes: ff2b13592299 ("gpio: make the gpiochip a real device")
> Cc: stable@vger.kernel.org      # 4.6
> Reviewed-by: Saravana Kannan <saravanak@google.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>

Excellent fix as well,
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

Yours,
Linus Walleij