user/sven/linux.git/drivers/of/device.c, branch v5.15.185

of: module: add buffer overflow check in of_modalias()

2025-05-09T07:39:41Z

commit cf7385cb26ac4f0ee6c7385960525ad534323252 upstream. In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str parameter (if not NULL initially) will point beyond the buffer's end. Add the buffer overflow check after the 1st snprintf() call and fix such check after the strlen() call (accounting for the terminating NUL char). Fixes: bc575064d688 ("of/device: use of_property_for_each_string to parse compatible strings") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/bbfc6be0-c687-62b6-d015-5141b93f313e@omp.ru Signed-off-by: Rob Herring Signed-off-by: "Uwe Kleine-König" Signed-off-by: Greg Kroah-Hartman

of: Fix modalias string generation

2023-05-11T14:00:32Z

[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ] The helper generating an OF based modalias (of_device_get_modalias()) works fine, but due to the use of snprintf() internally it needs a buffer one byte longer than what should be needed just for the entire string (excluding the '\0'). Most users of this helper are sysfs hooks providing the modalias string to users. They all provide a PAGE_SIZE buffer which is way above the number of bytes required to fit the modalias string and hence do not suffer from this issue. There is another user though, of_device_request_module(), which is only called by drivers/usb/common/ulpi.c. This request module function is faulty, but maybe because in most cases there is an alternative, ULPI driver users have not noticed it. In this function, of_device_get_modalias() is called twice. The first time without buffer just to get the number of bytes required by the modalias string (excluding the null byte), and a second time, after buffer allocation, to fill the buffer. The allocation asks for an additional byte, in order to store the trailing '\0'. However, the buffer *length* provided to of_device_get_modalias() excludes this extra byte. The internal use of snprintf() with a length that is exactly the number of bytes to be written has the effect of using the last available byte to store a '\0', which then smashes the last character of the modalias string. Provide the actual size of the buffer to of_device_get_modalias() to fix this issue. Note: the "str[size - 1] = '\0';" line is not really needed as snprintf will anyway end the string with a null byte, but there is a possibility that this function might be called on a struct device_node without compatible, in this case snprintf() would not be executed. So we keep it just to avoid possible unbounded strings. Cc: Stephen Boyd Cc: Peter Chen Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer

2022-08-17T12:23:51Z

[ Upstream commit d17e37c41b7ed38459957a5d2968ba61516fd5c2 ] We should use of_node_put() for the reference 'node' returned by of_parse_phandle() which will increase the refcount. Fixes: fec9b625095f ("of: Add plumbing for restricted DMA pool") Co-authored-by: Miaoqian Lin Signed-off-by: Liang He Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220702014449.263772-1-windhl@126.com Signed-off-by: Sasha Levin

of: restricted dma: Fix condition for rmem init

2021-09-17T20:58:09Z

of_dma_set_restricted_buffer fails to handle negative return values from of_property_count_elems_of_size, e.g. when the property does not exist. This results in an attempt to assign a non-existent reserved memory region to the device and a warning being printed. Fix the condition to take negative values into account. Fixes: f3cfd136aef0 ("of: restricted dma: Don't fail device probe on rmem init failure") Cc: Will Deacon Signed-off-by: David Brazdil Acked-by: Will Deacon Link: https://lore.kernel.org/r/20210917131423.2760155-1-dbrazdil@google.com Signed-off-by: Rob Herring

of: restricted dma: Don't fail device probe on rmem init failure

2021-08-23T10:32:04Z

If CONFIG_DMA_RESTRICTED_POOL=n then probing a device with a reference to a "restricted-dma-pool" will fail with a reasonably cryptic error: | pci-host-generic: probe of 10000.pci failed with error -22 Rework of_dma_set_restricted_buffer() so that it does not cause probing failure and instead either returns early if CONFIG_DMA_RESTRICTED_POOL=n or emits a diagnostic if the reserved DMA pool fails to initialise. Cc: Claire Chang Cc: Konrad Rzeszutek Wilk Cc: Christoph Hellwig Cc: Rob Herring Cc: Robin Murphy Signed-off-by: Will Deacon Signed-off-by: Konrad Rzeszutek Wilk

of: Move of_dma_set_restricted_buffer() into device.c

2021-08-23T10:32:02Z

Rob observes that: | of_dma_set_restricted_buffer() [...] should also be moved to | of/device.c. There's no reason for it to be in of/address.c. It has | nothing to do with address parsing. Move it to of/device.c, as he suggests. Cc: Claire Chang Cc: Konrad Rzeszutek Wilk Cc: Christoph Hellwig Cc: Robin Murphy Suggested-by: Rob Herring Link: https://lore.kernel.org/r/CAL_JsqJ7ROWWJX84x2kEex9NQ8G+2=ybRuNOobX+j8bjZzSemQ@mail.gmail.com Signed-off-by: Will Deacon Signed-off-by: Konrad Rzeszutek Wilk

of: Add plumbing for restricted DMA pool

2021-07-14T00:04:53Z

If a device is not behind an IOMMU, we look up the device node and set up the restricted DMA when the restricted-dma-pool is presented. Signed-off-by: Claire Chang Tested-by: Stefano Stabellini Tested-by: Will Deacon Signed-off-by: Konrad Rzeszutek Wilk

of: device: Fix function name in header and provide missing descriptions

2021-03-23T21:27:52Z

Fixes the following W=1 kernel build warning(s): drivers/of/device.c:72: warning: expecting prototype for of_dma_configure(). Prototype was for of_dma_configure_id() instead drivers/of/device.c:263: warning: Function parameter or member 'dev' not described in 'of_device_modalias' drivers/of/device.c:263: warning: Function parameter or member 'str' not described in 'of_device_modalias' drivers/of/device.c:263: warning: Function parameter or member 'len' not described in 'of_device_modalias' drivers/of/device.c:280: warning: Function parameter or member 'dev' not described in 'of_device_uevent' drivers/of/device.c:280: warning: Function parameter or member 'env' not described in 'of_device_uevent' Cc: Rob Herring Cc: Frank Rowand Cc: devicetree@vger.kernel.org Signed-off-by: Lee Jones Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20210318104036.3175910-2-lee.jones@linaro.org

Merge tag 'devicetree-for-5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2021-02-22T18:05:12Z

Pull devicetree updates from Rob Herring: - Sync dtc to upstream version v1.6.0-51-g183df9e9c2b9 and build host fdtoverlay - Add kbuild support to build DT overlays (%.dtbo) - Drop NULLifying match table in of_match_device(). In preparation for this, there are several driver cleanups to use (of_)?device_get_match_data(). - Drop pointless wrappers from DT struct device API - Convert USB binding schemas to use graph schema and remove old plain text graph binding doc - Convert spi-nor and v3d GPU bindings to DT schema - Tree wide schema fixes for if/then schemas, array size constraints, and undocumented compatible strings in examples - Handle 'no-map' correctly for already reserved memblock regions * tag 'devicetree-for-5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (35 commits) driver core: platform: Drop of_device_node_put() wrapper of: Remove of_dev_{get,put}() dt-bindings: usb: Change descibe to describe in usbmisc-imx.txt dt-bindings: can: rcar_canfd: Group tuples in pin control properties dt-bindings: power: renesas,apmu: Group tuples in cpus properties dt-bindings: mtd: spi-nor: Convert to DT schema format dt-bindings: Use portable sort for version cmp dt-bindings: ethernet-controller: fix fixed-link specification dt-bindings: irqchip: Add node name to PRUSS INTC dt-bindings: interconnect: Fix the expected number of cells dt-bindings: Fix errors in 'if' schemas dt-bindings: iommu: renesas,ipmmu-vmsa: Make 'power-domains' conditionally required dt-bindings: Fix undocumented compatible strings in examples kbuild: Add support to build overlays (%.dtbo) scripts: dtc: Remove the unused fdtdump.c file scripts: dtc: Build fdtoverlay tool scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9 scripts: dtc: Fetch fdtoverlay.c from external DTC project dt-bindings: thermal: sun8i: Fix misplaced schema keyword in compatible strings dt-bindings: iio: dac: Fix AD5686 references ...

of: Remove of_dev_{get,put}()

2021-02-13T01:23:39Z

of_dev_get() and of_dev_put are just wrappers for get_device()/put_device() on a platform_device. There's also already platform_device_{get,put}() wrappers for this purpose. Let's update the few users and remove of_dev_{get,put}(). Cc: Michael Ellerman Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Frank Rowand Cc: Patrice Chotard Cc: Felipe Balbi Cc: Julia Lawall Cc: Gilles Muller Cc: Nicolas Palix Cc: Michal Marek Cc: linuxppc-dev@lists.ozlabs.org Cc: netdev@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-usb@vger.kernel.org Cc: cocci@systeme.lip6.fr Signed-off-by: Rob Herring Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20210211232745.1498137-2-robh@kernel.org