Linux Kernel https://git.stealer.net/cgit.cgi/user/sven/linux.git/atom?h=v5.16 2021-12-31T13:28:22Z 2021-12-31T13:28:22Z Pavel Skripkin paskripkin@gmail.com 2021-12-30T22:47:50Z urn:sha1:bb436283e25aaf1533ce061605d23a9564447bdf Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings Reported-and-tested-by: syzbot+e417648b303855b91d8a@syzkaller.appspotmail.com Fixes: 7d5cb45655f2 ("i2c compat ioctls: move to ->compat_ioctl()") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2021-08-31T21:34:01Z Linus Torvalds torvalds@linux-foundation.org 2021-08-31T21:34:01Z urn:sha1:871dda463c6f2c2a4a660937e2f57616146f42de Pull i2c updates from Wolfram Sang: "I2C has a smaller pull reuest this time: - new driver for I2C virtio - removal of PMC SMP driver because platform is already gone - IRQ probing and DMAENGINE API cleanups - add SI metric prefix definitions to units.h - beginning of i801 refactorization - a few driver improvements" * 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (28 commits) i2c: cadence: Implement save restore i2c: xlp9xx: fix main IRQ check i2c: mt65xx: fix IRQ check i2c: virtio: add a virtio i2c frontend driver i2c: hix5hd2: fix IRQ check i2c: s3c2410: fix IRQ check i2c: iop3xx: fix deferred probing i2c: synquacer: fix deferred probing i2c: sun6i-pw2i: Prefer strscpy over strlcpy i2c: remove dead PMC MSP TWI/SMBus/I2C driver i2c: dev: Use sysfs_emit() in "show" functions i2c: dev: Define pr_fmt() and drop duplication substrings i2c: designware: Fix indentation in the header i2c: designware: Use DIV_ROUND_CLOSEST() macro units: Add SI metric prefix definitions i2c: at91: mark PM ops as __maybe unused i2c: sh_mobile: : use proper DMAENGINE API for termination i2c: qup: : use proper DMAENGINE API for termination i2c: mxs: : use proper DMAENGINE API for termination i2c: imx: : use proper DMAENGINE API for termination ... 2021-08-11T14:48:51Z Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-07-12T14:23:23Z urn:sha1:b18f32d9874ec23f12416c08764d65a318aeb9f6 The sysfs_emit() function was introduced to make it less ambiguous which function is preferred when writing to the output buffer in a "show" callback [1]. Convert the I²C device sysfs interface from sprintf() to sysfs_emit() accordingly, as the latter is aware of the PAGE_SIZE buffer and correctly returns the number of bytes written into the buffer. No functional change intended. [1] Documentation/filesystems/sysfs.rst Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2021-08-11T14:46:41Z Andy Shevchenko andriy.shevchenko@linux.intel.com 2021-07-12T14:23:22Z urn:sha1:295e0e7be753e4e329858482236088e41a118487 Define pr_fmt() to print module name as prefix and at the same time drop duplication substrings in the messages. While at it, convert printk(<LEVEL>) to pr_<level>(). Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2021-08-10T20:54:10Z Greg Kroah-Hartman gregkh@linuxfoundation.org 2021-07-29T14:35:32Z urn:sha1:86ff25ed6cd8240d18df58930bd8848b19fce308 If an i2c driver happens to not provide the full amount of data that a user asks for, it is possible that some uninitialized data could be sent to userspace. While all in-kernel drivers look to be safe, just be sure by initializing the buffer to zero before it is passed to the i2c driver so that any future drivers will not have this issue. Also properly copy the amount of data recvieved to the userspace buffer, as pointed out by Dan Carpenter. Reported-by: Eric Dumazet <edumazet@google.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2021-06-24T19:47:43Z Andreas Hecht andreas.e.hecht@gmail.com 2021-06-24T15:25:35Z urn:sha1:3265a7e6b41bae8608e7e91ac6798de5e5564164 Fix Sparse warnings: drivers/i2c/i2c-dev.c:546:19: warning: incorrect type in assignment (different address spaces) drivers/i2c/i2c-dev.c:549:53: warning: incorrect type in argument 2 (different address spaces) compat_ptr() returns a pointer tagged __user which gets assigned to a pointer missing the __user annotation. The same pointer is passed to copy_from_user() as an argument where it is expected to have the __user annotation. Fix both by adding the __user annotation to the pointer. Fixes: 7d5cb45655f2 ("i2c compat ioctls: move to ->compat_ioctl()") Signed-off-by: Andreas Hecht <andreas.e.hecht@gmail.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2021-03-18T11:15:29Z Wolfram Sang wsa+renesas@sang-engineering.com 2021-03-12T11:57:34Z urn:sha1:71581562ee36032d2d574a9b23ad4af6d6a64cf7 The buggy parameters currently get caught later, but emit a noisy WARN. Userspace should not be able to trigger this, so add similar checks much earlier. Also avoids some unneeded code paths, of course. Apply kernel coding stlye to a comment while here. Reported-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Tested-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2020-07-04T06:25:13Z Jarkko Nikula jarkko.nikula@linux.intel.com 2020-06-11T11:05:34Z urn:sha1:f80531c8217c5b348058a0280f3be05835abd737 Modules with multiple authors should use multiple MODULE_AUTHOR() statements according to comment in include/linux/module.h. Split the i2c modules with multiple authors to use multiple MODULE_AUTHOR() statements. Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wolfram Sang <wsa@kernel.org> 2020-03-20T17:34:29Z Kevin Hao haokexin@gmail.com 2019-10-11T15:00:14Z urn:sha1:1413ef638abae4ab5621901cf4d8ef08a4a48ba6 The struct cdev is embedded in the struct i2c_dev. In the current code, we would free the i2c_dev struct directly in put_i2c_dev(), but the cdev is manged by a kobject, and the release of it is not predictable. So it is very possible that the i2c_dev is freed before the cdev is entirely released. We can easily get the following call trace with CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled. ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38 WARNING: CPU: 19 PID: 1 at lib/debugobjects.c:325 debug_print_object+0xb0/0xf0 Modules linked in: CPU: 19 PID: 1 Comm: swapper/0 Tainted: G W 5.2.20-yocto-standard+ #120 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 80c00089 (Nzcv daIf +PAN +UAO) pc : debug_print_object+0xb0/0xf0 lr : debug_print_object+0xb0/0xf0 sp : ffff00001292f7d0 x29: ffff00001292f7d0 x28: ffff800b82151788 x27: 0000000000000001 x26: ffff800b892c0000 x25: ffff0000124a2558 x24: 0000000000000000 x23: ffff00001107a1d8 x22: ffff0000116b5088 x21: ffff800bdc6afca8 x20: ffff000012471ae8 x19: ffff00001168f2c8 x18: 0000000000000010 x17: 00000000fd6f304b x16: 00000000ee79de43 x15: ffff800bc0e80568 x14: 79616c6564203a74 x13: 6e6968207473696c x12: 5f72656d6974203a x11: ffff0000113f0018 x10: 0000000000000000 x9 : 000000000000001f x8 : 0000000000000000 x7 : ffff0000101294cc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 00000000ffffffff x2 : 0000000000000000 x1 : 387fc15c8ec0f200 x0 : 0000000000000000 Call trace: debug_print_object+0xb0/0xf0 __debug_check_no_obj_freed+0x19c/0x228 debug_check_no_obj_freed+0x1c/0x28 kfree+0x250/0x440 put_i2c_dev+0x68/0x78 i2cdev_detach_adapter+0x60/0xc8 i2cdev_notifier_call+0x3c/0x70 notifier_call_chain+0x8c/0xe8 blocking_notifier_call_chain+0x64/0x88 device_del+0x74/0x380 device_unregister+0x54/0x78 i2c_del_adapter+0x278/0x2d0 unittest_i2c_bus_remove+0x3c/0x80 platform_drv_remove+0x30/0x50 device_release_driver_internal+0xf4/0x1c0 driver_detach+0x58/0xa0 bus_remove_driver+0x84/0xd8 driver_unregister+0x34/0x60 platform_driver_unregister+0x20/0x30 of_unittest_overlay+0x8d4/0xbe0 of_unittest+0xae8/0xb3c do_one_initcall+0xac/0x450 do_initcall_level+0x208/0x224 kernel_init_freeable+0x2d8/0x36c kernel_init+0x18/0x108 ret_from_fork+0x10/0x1c irq event stamp: 3934661 hardirqs last enabled at (3934661): [<ffff00001009fa04>] debug_exception_exit+0x4c/0x58 hardirqs last disabled at (3934660): [<ffff00001009fb14>] debug_exception_enter+0xa4/0xe0 softirqs last enabled at (3934654): [<ffff000010081d94>] __do_softirq+0x46c/0x628 softirqs last disabled at (3934649): [<ffff0000100b4a1c>] irq_exit+0x104/0x118 This is a common issue when using cdev embedded in a struct. Fortunately, we already have a mechanism to solve this kind of issue. Please see commit 233ed09d7fda ("chardev: add helper function to register char devs with a struct device") for more detail. In this patch, we choose to embed the struct device into the i2c_dev, and use the API provided by the commit 233ed09d7fda to make sure that the release of i2c_dev and cdev are in sequence. Signed-off-by: Kevin Hao <haokexin@gmail.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de> 2020-02-26T10:06:43Z Wolfram Sang wsa@the-dreams.de 2020-01-30T20:23:12Z urn:sha1:f01adfabbfc4a62a9750cae3abcdf848029ee300 Signed-off-by: Wolfram Sang <wsa@the-dreams.de>