[PATCH OLK-5.10 2/2] pps: Fix kabi in pps_device

7 Mar 2026

hulk inclusion
category: bugfix
bugzilla: https://atomgit.com/src-openeuler/kernel/issues/132
CVE: CVE-2024-57979

--------------------------------

Fix kabi broken in struct pps_device (cdev, device).

Fixes: 1a7735ab2cb9 ("pps: Fix a use-after-free")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
---
 drivers/pps/clients/pps-gpio.c    |  2 +-
 drivers/pps/clients/pps-ktimer.c  |  4 +--
 drivers/pps/clients/pps-ldisc.c   |  6 ++--
 drivers/pps/clients/pps_parport.c |  4 +--
 drivers/pps/kapi.c                | 10 +++---
 drivers/pps/kc.c                  | 10 +++---
 drivers/pps/pps.c                 | 55 ++++++++++++++++---------------
 include/linux/pps_kernel.h        |  3 +-
 8 files changed, 48 insertions(+), 46 deletions(-)

diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 541b03706808..c50b93f4c243 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -230,11 +230,11 @@ static int pps_gpio_probe(struct platform_device *pdev)
 		pps_unregister_source(data->pps);
 		dev_err(&pdev->dev, "failed to acquire IRQ %d\n", data->irq);
 		return -EINVAL;
 	}
 
-	dev_dbg(&data->pps->dev, "Registered IRQ %d as PPS source\n",
+	dev_dbg(data->pps->dev, "Registered IRQ %d as PPS source\n",
 		data->irq);
 
 	return 0;
 }
 
diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c
index 2f465549b843..bba9d9855f88 100644
--- a/drivers/pps/clients/pps-ktimer.c
+++ b/drivers/pps/clients/pps-ktimer.c
@@ -54,11 +54,11 @@ static struct pps_source_info pps_ktimer_info = {
  * Module staff
  */
 
 static void __exit pps_ktimer_exit(void)
 {
-	dev_dbg(&pps->dev, "ktimer PPS source unregistered\n");
+	dev_dbg(pps->dev, "ktimer PPS source unregistered\n");
 
 	del_timer_sync(&ktimer);
 	pps_unregister_source(pps);
 }
 
@@ -72,11 +72,11 @@ static int __init pps_ktimer_init(void)
 	}
 
 	timer_setup(&ktimer, pps_ktimer_event, 0);
 	mod_timer(&ktimer, jiffies + HZ);
 
-	dev_dbg(&pps->dev, "ktimer PPS source registered\n");
+	dev_dbg(pps->dev, "ktimer PPS source registered\n");
 
 	return 0;
 }
 
 module_init(pps_ktimer_init);
diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
index 3a21177c0d1a..faa3c619fa7a 100644
--- a/drivers/pps/clients/pps-ldisc.c
+++ b/drivers/pps/clients/pps-ldisc.c
@@ -32,11 +32,11 @@ static void pps_tty_dcd_change(struct tty_struct *tty, unsigned int status)
 
 	/* Now do the PPS event report */
 	pps_event(pps, &ts, status ? PPS_CAPTUREASSERT :
 			PPS_CAPTURECLEAR, NULL);
 
-	dev_dbg(&pps->dev, "PPS %s at %lu\n",
+	dev_dbg(pps->dev, "PPS %s at %lu\n",
 			status ? "assert" : "clear", jiffies);
 }
 
 static int (*alias_n_tty_open)(struct tty_struct *tty);
 
@@ -69,11 +69,11 @@ static int pps_tty_open(struct tty_struct *tty)
 	if (ret < 0) {
 		pr_err("cannot open tty ldisc \"%s\"\n", info.path);
 		goto err_unregister;
 	}
 
-	dev_dbg(&pps->dev, "source \"%s\" added\n", info.path);
+	dev_dbg(pps->dev, "source \"%s\" added\n", info.path);
 
 	return 0;
 
 err_unregister:
 	pps_unregister_source(pps);
@@ -89,11 +89,11 @@ static void pps_tty_close(struct tty_struct *tty)
 	alias_n_tty_close(tty);
 
 	if (WARN_ON(!pps))
 		return;
 
-	dev_info(&pps->dev, "removed\n");
+	dev_info(pps->dev, "removed\n");
 	pps_unregister_source(pps);
 }
 
 static struct tty_ldisc_ops pps_ldisc_ops;
 
diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
index a4e11f5a97fe..7a41fb7b0dec 100644
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -81,11 +81,11 @@ static void parport_irq(void *handle)
 	 */
 	local_irq_save(flags);
 	/* check the signal (no signal means the pulse is lost this time) */
 	if (!signal_is_set(port)) {
 		local_irq_restore(flags);
-		dev_err(&dev->pps->dev, "lost the signal\n");
+		dev_err(dev->pps->dev, "lost the signal\n");
 		goto out_assert;
 	}
 
 	/* poll the port until the signal is unset */
 	for (i = dev->cw; i; i--)
@@ -98,11 +98,11 @@ static void parport_irq(void *handle)
 	local_irq_restore(flags);
 
 	/* timeout */
 	dev->cw_err++;
 	if (dev->cw_err >= CLEAR_WAIT_MAX_ERRORS) {
-		dev_err(&dev->pps->dev, "disabled clear edge capture after %d"
+		dev_err(dev->pps->dev, "disabled clear edge capture after %d"
 				" timeouts\n", dev->cw_err);
 		dev->cw = 0;
 		dev->cw_err = 0;
 	}
 
diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 92d1b62ea239..39be9d1ea3eb 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -39,11 +39,11 @@ static void pps_add_offset(struct pps_ktime *ts, struct pps_ktime *offset)
 }
 
 static void pps_echo_client_default(struct pps_device *pps, int event,
 		void *data)
 {
-	dev_info(&pps->dev, "echo %s %s\n",
+	dev_info(pps->dev, "echo %s %s\n",
 		event & PPS_CAPTUREASSERT ? "assert" : "",
 		event & PPS_CAPTURECLEAR ? "clear" : "");
 }
 
 /*
@@ -110,11 +110,11 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
 		pr_err("%s: unable to create char device\n",
 					info->name);
 		goto kfree_pps;
 	}
 
-	dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+	dev_dbg(pps->dev, "new PPS source %s\n", info->name);
 
 	return pps;
 
 kfree_pps:
 	kfree(pps);
@@ -164,11 +164,11 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,
 	struct pps_ktime ts_real = { .sec = 0, .nsec = 0, .flags = 0 };
 
 	/* check event type */
 	BUG_ON((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0);
 
-	dev_dbg(&pps->dev, "PPS event at %lld.%09ld\n",
+	dev_dbg(pps->dev, "PPS event at %lld.%09ld\n",
 			(s64)ts->ts_real.tv_sec, ts->ts_real.tv_nsec);
 
 	timespec_to_pps_ktime(&ts_real, ts->ts_real);
 
 	spin_lock_irqsave(&pps->lock, flags);
@@ -186,11 +186,11 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,
 					&pps->params.assert_off_tu);
 
 		/* Save the time stamp */
 		pps->assert_tu = ts_real;
 		pps->assert_sequence++;
-		dev_dbg(&pps->dev, "capture assert seq #%u\n",
+		dev_dbg(pps->dev, "capture assert seq #%u\n",
 			pps->assert_sequence);
 
 		captured = ~0;
 	}
 	if (event & pps->params.mode & PPS_CAPTURECLEAR) {
@@ -200,11 +200,11 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,
 					&pps->params.clear_off_tu);
 
 		/* Save the time stamp */
 		pps->clear_tu = ts_real;
 		pps->clear_sequence++;
-		dev_dbg(&pps->dev, "capture clear seq #%u\n",
+		dev_dbg(pps->dev, "capture clear seq #%u\n",
 			pps->clear_sequence);
 
 		captured = ~0;
 	}
 
diff --git a/drivers/pps/kc.c b/drivers/pps/kc.c
index fbd23295afd7..50dc59af45be 100644
--- a/drivers/pps/kc.c
+++ b/drivers/pps/kc.c
@@ -41,29 +41,29 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args)
 	if (bind_args->edge == 0)
 		if (pps_kc_hardpps_dev == pps) {
 			pps_kc_hardpps_mode = 0;
 			pps_kc_hardpps_dev = NULL;
 			spin_unlock_irq(&pps_kc_hardpps_lock);
-			dev_info(&pps->dev, "unbound kernel"
+			dev_info(pps->dev, "unbound kernel"
 					" consumer\n");
 		} else {
 			spin_unlock_irq(&pps_kc_hardpps_lock);
-			dev_err(&pps->dev, "selected kernel consumer"
+			dev_err(pps->dev, "selected kernel consumer"
 					" is not bound\n");
 			return -EINVAL;
 		}
 	else
 		if (pps_kc_hardpps_dev == NULL ||
 				pps_kc_hardpps_dev == pps) {
 			pps_kc_hardpps_mode = bind_args->edge;
 			pps_kc_hardpps_dev = pps;
 			spin_unlock_irq(&pps_kc_hardpps_lock);
-			dev_info(&pps->dev, "bound kernel consumer: "
+			dev_info(pps->dev, "bound kernel consumer: "
 				"edge=0x%x\n", bind_args->edge);
 		} else {
 			spin_unlock_irq(&pps_kc_hardpps_lock);
-			dev_err(&pps->dev, "another kernel consumer"
+			dev_err(pps->dev, "another kernel consumer"
 					" is already bound\n");
 			return -EINVAL;
 		}
 
 	return 0;
@@ -81,11 +81,11 @@ void pps_kc_remove(struct pps_device *pps)
 	spin_lock_irq(&pps_kc_hardpps_lock);
 	if (pps == pps_kc_hardpps_dev) {
 		pps_kc_hardpps_mode = 0;
 		pps_kc_hardpps_dev = NULL;
 		spin_unlock_irq(&pps_kc_hardpps_lock);
-		dev_info(&pps->dev, "unbound kernel consumer"
+		dev_info(pps->dev, "unbound kernel consumer"
 				" on device removal\n");
 	} else
 		spin_unlock_irq(&pps_kc_hardpps_lock);
 }
 
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 2d008e0d116a..0582b5bb861b 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -60,11 +60,11 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata)
 		err = wait_event_interruptible(pps->queue,
 				ev != pps->last_ev);
 	else {
 		unsigned long ticks;
 
-		dev_dbg(&pps->dev, "timeout %lld.%09d\n",
+		dev_dbg(pps->dev, "timeout %lld.%09d\n",
 				(long long) fdata->timeout.sec,
 				fdata->timeout.nsec);
 		ticks = fdata->timeout.sec * HZ;
 		ticks += fdata->timeout.nsec / (NSEC_PER_SEC / HZ);
 
@@ -78,11 +78,11 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata)
 		}
 	}
 
 	/* Check for pending signals */
 	if (err == -ERESTARTSYS) {
-		dev_dbg(&pps->dev, "pending signal caught\n");
+		dev_dbg(pps->dev, "pending signal caught\n");
 		return -EINTR;
 	}
 
 	return 0;
 }
@@ -96,11 +96,11 @@ static long pps_cdev_ioctl(struct file *file,
 	int __user *iuarg = (int __user *) arg;
 	int err;
 
 	switch (cmd) {
 	case PPS_GETPARAMS:
-		dev_dbg(&pps->dev, "PPS_GETPARAMS\n");
+		dev_dbg(pps->dev, "PPS_GETPARAMS\n");
 
 		spin_lock_irq(&pps->lock);
 
 		/* Get the current parameters */
 		params = pps->params;
@@ -112,28 +112,28 @@ static long pps_cdev_ioctl(struct file *file,
 			return -EFAULT;
 
 		break;
 
 	case PPS_SETPARAMS:
-		dev_dbg(&pps->dev, "PPS_SETPARAMS\n");
+		dev_dbg(pps->dev, "PPS_SETPARAMS\n");
 
 		/* Check the capabilities */
 		if (!capable(CAP_SYS_TIME))
 			return -EPERM;
 
 		err = copy_from_user(¶ms, uarg, sizeof(struct pps_kparams));
 		if (err)
 			return -EFAULT;
 		if (!(params.mode & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR))) {
-			dev_dbg(&pps->dev, "capture mode unspecified (%x)\n",
+			dev_dbg(pps->dev, "capture mode unspecified (%x)\n",
 								params.mode);
 			return -EINVAL;
 		}
 
 		/* Check for supported capabilities */
 		if ((params.mode & ~pps->info.mode) != 0) {
-			dev_dbg(&pps->dev, "unsupported capabilities (%x)\n",
+			dev_dbg(pps->dev, "unsupported capabilities (%x)\n",
 								params.mode);
 			return -EINVAL;
 		}
 
 		spin_lock_irq(&pps->lock);
@@ -142,11 +142,11 @@ static long pps_cdev_ioctl(struct file *file,
 		pps->params = params;
 
 		/* Restore the read only parameters */
 		if ((params.mode & (PPS_TSFMT_TSPEC | PPS_TSFMT_NTPFP)) == 0) {
 			/* section 3.3 of RFC 2783 interpreted */
-			dev_dbg(&pps->dev, "time format unspecified (%x)\n",
+			dev_dbg(pps->dev, "time format unspecified (%x)\n",
 								params.mode);
 			pps->params.mode |= PPS_TSFMT_TSPEC;
 		}
 		if (pps->info.mode & PPS_CANWAIT)
 			pps->params.mode |= PPS_CANWAIT;
@@ -163,22 +163,22 @@ static long pps_cdev_ioctl(struct file *file,
 		spin_unlock_irq(&pps->lock);
 
 		break;
 
 	case PPS_GETCAP:
-		dev_dbg(&pps->dev, "PPS_GETCAP\n");
+		dev_dbg(pps->dev, "PPS_GETCAP\n");
 
 		err = put_user(pps->info.mode, iuarg);
 		if (err)
 			return -EFAULT;
 
 		break;
 
 	case PPS_FETCH: {
 		struct pps_fdata fdata;
 
-		dev_dbg(&pps->dev, "PPS_FETCH\n");
+		dev_dbg(pps->dev, "PPS_FETCH\n");
 
 		err = copy_from_user(&fdata, uarg, sizeof(struct pps_fdata));
 		if (err)
 			return -EFAULT;
 
@@ -204,11 +204,11 @@ static long pps_cdev_ioctl(struct file *file,
 		break;
 	}
 	case PPS_KC_BIND: {
 		struct pps_bind_args bind_args;
 
-		dev_dbg(&pps->dev, "PPS_KC_BIND\n");
+		dev_dbg(pps->dev, "PPS_KC_BIND\n");
 
 		/* Check the capabilities */
 		if (!capable(CAP_SYS_TIME))
 			return -EPERM;
 
@@ -216,20 +216,20 @@ static long pps_cdev_ioctl(struct file *file,
 					sizeof(struct pps_bind_args)))
 			return -EFAULT;
 
 		/* Check for supported capabilities */
 		if ((bind_args.edge & ~pps->info.mode) != 0) {
-			dev_err(&pps->dev, "unsupported capabilities (%x)\n",
+			dev_err(pps->dev, "unsupported capabilities (%x)\n",
 					bind_args.edge);
 			return -EINVAL;
 		}
 
 		/* Validate parameters roughly */
 		if (bind_args.tsformat != PPS_TSFMT_TSPEC ||
 				(bind_args.edge & ~PPS_CAPTUREBOTH) != 0 ||
 				bind_args.consumer != PPS_KC_HARDPPS) {
-			dev_err(&pps->dev, "invalid kernel consumer bind"
+			dev_err(pps->dev, "invalid kernel consumer bind"
 					" parameters (%x)\n", bind_args.edge);
 			return -EINVAL;
 		}
 
 		err = pps_kc_bind(pps, &bind_args);
@@ -257,11 +257,11 @@ static long pps_cdev_compat_ioctl(struct file *file,
 	if (cmd == PPS_FETCH) {
 		struct pps_fdata_compat compat;
 		struct pps_fdata fdata;
 		int err;
 
-		dev_dbg(&pps->dev, "PPS_FETCH\n");
+		dev_dbg(pps->dev, "PPS_FETCH\n");
 
 		err = copy_from_user(&compat, uarg, sizeof(struct pps_fdata_compat));
 		if (err)
 			return -EFAULT;
 
@@ -301,11 +301,11 @@ static struct pps_device *pps_idr_get(unsigned long id)
 	struct pps_device *pps;
 
 	mutex_lock(&pps_idr_lock);
 	pps = idr_find(&pps_idr, id);
 	if (pps)
-		get_device(&pps->dev);
+		get_device(pps->dev);
 
 	mutex_unlock(&pps_idr_lock);
 	return pps;
 }
 
@@ -323,11 +323,11 @@ static int pps_cdev_open(struct inode *inode, struct file *file)
 static int pps_cdev_release(struct inode *inode, struct file *file)
 {
 	struct pps_device *pps = file->private_data;
 
 	WARN_ON(pps->id != iminor(inode));
-	put_device(&pps->dev);
+	put_device(pps->dev);
 	return 0;
 }
 
 /*
  * Char device stuff
@@ -347,16 +347,18 @@ static const struct file_operations pps_cdev_fops = {
 static void pps_device_destruct(struct device *dev)
 {
 	struct pps_device *pps = dev_get_drvdata(dev);
 
 	pr_debug("deallocating pps%d\n", pps->id);
+	kfree(dev);
 	kfree(pps);
 }
 
 int pps_register_cdev(struct pps_device *pps)
 {
 	int err;
+	dev_t devt;
 
 	mutex_lock(&pps_idr_lock);
 	/*
 	 * Get new ID for the new PPS source.  After idr_alloc() calling
 	 * the new source will be freely available into the kernel.
@@ -370,47 +372,46 @@ int pps_register_cdev(struct pps_device *pps)
 		}
 		goto out_unlock;
 	}
 	pps->id = err;
 
-	pps->dev.class = pps_class;
-	pps->dev.parent = pps->info.dev;
-	pps->dev.devt = MKDEV(pps_major, pps->id);
-	dev_set_drvdata(&pps->dev, pps);
-	dev_set_name(&pps->dev, "pps%d", pps->id);
-	err = device_register(&pps->dev);
-	if (err)
+	devt = MKDEV(pps_major, pps->id);
+
+	pps->dev = device_create(pps_class, pps->info.dev, devt, pps,
+							"pps%d", pps->id);
+	if (IS_ERR(pps->dev)) {
+		err = PTR_ERR(pps->dev);
 		goto free_idr;
+	}
 
 	/* Override the release function with our own */
-	pps->dev.release = pps_device_destruct;
+	pps->dev->release = pps_device_destruct;
 
 	pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
 		 pps->id);
 
-	get_device(&pps->dev);
+	get_device(pps->dev);
 	mutex_unlock(&pps_idr_lock);
 	return 0;
 
 free_idr:
 	idr_remove(&pps_idr, pps->id);
-	put_device(&pps->dev);
 out_unlock:
 	mutex_unlock(&pps_idr_lock);
 	return err;
 }
 
 void pps_unregister_cdev(struct pps_device *pps)
 {
 	pr_debug("unregistering pps%d\n", pps->id);
 	pps->lookup_cookie = NULL;
-	device_destroy(pps_class, pps->dev.devt);
+	device_destroy(pps_class, pps->dev->devt);
 
 	/* Now we can release the ID for re-use */
 	mutex_lock(&pps_idr_lock);
 	idr_remove(&pps_idr, pps->id);
-	put_device(&pps->dev);
+	put_device(pps->dev);
 	mutex_unlock(&pps_idr_lock);
 }
 
 /*
  * Look up a pps device by magic cookie.
diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h
index c7abce28ed29..78c8ac4951b5 100644
--- a/include/linux/pps_kernel.h
+++ b/include/linux/pps_kernel.h
@@ -54,11 +54,12 @@ struct pps_device {
 	unsigned int last_ev;			/* last PPS event id */
 	wait_queue_head_t queue;		/* PPS event queue */
 
 	unsigned int id;			/* PPS source unique ID */
 	void const *lookup_cookie;		/* For pps_lookup_dev() only */
-	struct device dev;
+	struct cdev cdev;
+	struct device *dev;
 	struct fasync_struct *async_queue;	/* fasync method */
 	spinlock_t lock;
 };
 
 /*
-- 
2.17.1

    