[PATCH OLK-6.6 2/2] pps: Fix a use-after-free - fix kabi

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/132 CVE: CVE-2024-57979 -------------------------------- Fix kabi broken in struct pps_device (cdev, device). Fixes: c79a39dc8d06 ("pps: Fix a use-after-free") Signed-off-by: Wang Hai <wanghai38@huawei.com> --- drivers/pps/clients/pps-gpio.c | 2 +- drivers/pps/clients/pps-ktimer.c | 4 +-- drivers/pps/clients/pps-ldisc.c | 6 ++-- drivers/pps/clients/pps_parport.c | 4 +-- drivers/pps/kapi.c | 10 +++--- drivers/pps/kc.c | 10 +++--- drivers/pps/pps.c | 55 ++++++++++++++++--------------- drivers/ptp/ptp_ocp.c | 2 +- include/linux/pps_kernel.h | 3 +- 9 files changed, 49 insertions(+), 47 deletions(-) diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c index 41e1fdbcda16..ece35e237b37 100644 --- a/drivers/pps/clients/pps-gpio.c +++ b/drivers/pps/clients/pps-gpio.c @@ -212,11 +212,11 @@ static int pps_gpio_probe(struct platform_device *pdev) pps_unregister_source(data->pps); dev_err(dev, "failed to acquire IRQ %d\n", data->irq); return -EINVAL; } - dev_dbg(&data->pps->dev, "Registered IRQ %d as PPS source\n", + dev_dbg(data->pps->dev, "Registered IRQ %d as PPS source\n", data->irq); return 0; } diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c index 2f465549b843..bba9d9855f88 100644 --- a/drivers/pps/clients/pps-ktimer.c +++ b/drivers/pps/clients/pps-ktimer.c @@ -54,11 +54,11 @@ static struct pps_source_info pps_ktimer_info = { * Module staff */ static void __exit pps_ktimer_exit(void) { - dev_dbg(&pps->dev, "ktimer PPS source unregistered\n"); + dev_dbg(pps->dev, "ktimer PPS source unregistered\n"); del_timer_sync(&ktimer); pps_unregister_source(pps); } @@ -72,11 +72,11 @@ static int __init pps_ktimer_init(void) } timer_setup(&ktimer, pps_ktimer_event, 0); mod_timer(&ktimer, jiffies + HZ); - dev_dbg(&pps->dev, "ktimer PPS source registered\n"); + dev_dbg(pps->dev, "ktimer PPS source registered\n"); return 0; } module_init(pps_ktimer_init); diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c index fa5660f3c4b7..a6253e3a95da 100644 --- a/drivers/pps/clients/pps-ldisc.c +++ b/drivers/pps/clients/pps-ldisc.c @@ -30,11 +30,11 @@ static void pps_tty_dcd_change(struct tty_struct *tty, bool active) /* Now do the PPS event report */ pps_event(pps, &ts, active ? PPS_CAPTUREASSERT : PPS_CAPTURECLEAR, NULL); - dev_dbg(&pps->dev, "PPS %s at %lu\n", + dev_dbg(pps->dev, "PPS %s at %lu\n", active ? "assert" : "clear", jiffies); } static int (*alias_n_tty_open)(struct tty_struct *tty); @@ -67,11 +67,11 @@ static int pps_tty_open(struct tty_struct *tty) if (ret < 0) { pr_err("cannot open tty ldisc \"%s\"\n", info.path); goto err_unregister; } - dev_dbg(&pps->dev, "source \"%s\" added\n", info.path); + dev_dbg(pps->dev, "source \"%s\" added\n", info.path); return 0; err_unregister: pps_unregister_source(pps); @@ -87,11 +87,11 @@ static void pps_tty_close(struct tty_struct *tty) alias_n_tty_close(tty); if (WARN_ON(!pps)) return; - dev_info(&pps->dev, "removed\n"); + dev_info(pps->dev, "removed\n"); pps_unregister_source(pps); } static struct tty_ldisc_ops pps_ldisc_ops; diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c index c3f46efd64c3..53e9c304ae0a 100644 --- a/drivers/pps/clients/pps_parport.c +++ b/drivers/pps/clients/pps_parport.c @@ -79,11 +79,11 @@ static void parport_irq(void *handle) */ local_irq_save(flags); /* check the signal (no signal means the pulse is lost this time) */ if (!signal_is_set(port)) { local_irq_restore(flags); - dev_err(&dev->pps->dev, "lost the signal\n"); + dev_err(dev->pps->dev, "lost the signal\n"); goto out_assert; } /* poll the port until the signal is unset */ for (i = dev->cw; i; i--) @@ -96,11 +96,11 @@ static void parport_irq(void *handle) local_irq_restore(flags); /* timeout */ dev->cw_err++; if (dev->cw_err >= CLEAR_WAIT_MAX_ERRORS) { - dev_err(&dev->pps->dev, "disabled clear edge capture after %d" + dev_err(dev->pps->dev, "disabled clear edge capture after %d" " timeouts\n", dev->cw_err); dev->cw = 0; dev->cw_err = 0; } diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c index 92d1b62ea239..39be9d1ea3eb 100644 --- a/drivers/pps/kapi.c +++ b/drivers/pps/kapi.c @@ -39,11 +39,11 @@ static void pps_add_offset(struct pps_ktime *ts, struct pps_ktime *offset) } static void pps_echo_client_default(struct pps_device *pps, int event, void *data) { - dev_info(&pps->dev, "echo %s %s\n", + dev_info(pps->dev, "echo %s %s\n", event & PPS_CAPTUREASSERT ? "assert" : "", event & PPS_CAPTURECLEAR ? "clear" : ""); } /* @@ -110,11 +110,11 @@ struct pps_device *pps_register_source(struct pps_source_info *info, pr_err("%s: unable to create char device\n", info->name); goto kfree_pps; } - dev_dbg(&pps->dev, "new PPS source %s\n", info->name); + dev_dbg(pps->dev, "new PPS source %s\n", info->name); return pps; kfree_pps: kfree(pps); @@ -164,11 +164,11 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event, struct pps_ktime ts_real = { .sec = 0, .nsec = 0, .flags = 0 }; /* check event type */ BUG_ON((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0); - dev_dbg(&pps->dev, "PPS event at %lld.%09ld\n", + dev_dbg(pps->dev, "PPS event at %lld.%09ld\n", (s64)ts->ts_real.tv_sec, ts->ts_real.tv_nsec); timespec_to_pps_ktime(&ts_real, ts->ts_real); spin_lock_irqsave(&pps->lock, flags); @@ -186,11 +186,11 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event, &pps->params.assert_off_tu); /* Save the time stamp */ pps->assert_tu = ts_real; pps->assert_sequence++; - dev_dbg(&pps->dev, "capture assert seq #%u\n", + dev_dbg(pps->dev, "capture assert seq #%u\n", pps->assert_sequence); captured = ~0; } if (event & pps->params.mode & PPS_CAPTURECLEAR) { @@ -200,11 +200,11 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event, &pps->params.clear_off_tu); /* Save the time stamp */ pps->clear_tu = ts_real; pps->clear_sequence++; - dev_dbg(&pps->dev, "capture clear seq #%u\n", + dev_dbg(pps->dev, "capture clear seq #%u\n", pps->clear_sequence); captured = ~0; } diff --git a/drivers/pps/kc.c b/drivers/pps/kc.c index fbd23295afd7..50dc59af45be 100644 --- a/drivers/pps/kc.c +++ b/drivers/pps/kc.c @@ -41,29 +41,29 @@ int pps_kc_bind(struct pps_device *pps, struct pps_bind_args *bind_args) if (bind_args->edge == 0) if (pps_kc_hardpps_dev == pps) { pps_kc_hardpps_mode = 0; pps_kc_hardpps_dev = NULL; spin_unlock_irq(&pps_kc_hardpps_lock); - dev_info(&pps->dev, "unbound kernel" + dev_info(pps->dev, "unbound kernel" " consumer\n"); } else { spin_unlock_irq(&pps_kc_hardpps_lock); - dev_err(&pps->dev, "selected kernel consumer" + dev_err(pps->dev, "selected kernel consumer" " is not bound\n"); return -EINVAL; } else if (pps_kc_hardpps_dev == NULL || pps_kc_hardpps_dev == pps) { pps_kc_hardpps_mode = bind_args->edge; pps_kc_hardpps_dev = pps; spin_unlock_irq(&pps_kc_hardpps_lock); - dev_info(&pps->dev, "bound kernel consumer: " + dev_info(pps->dev, "bound kernel consumer: " "edge=0x%x\n", bind_args->edge); } else { spin_unlock_irq(&pps_kc_hardpps_lock); - dev_err(&pps->dev, "another kernel consumer" + dev_err(pps->dev, "another kernel consumer" " is already bound\n"); return -EINVAL; } return 0; @@ -81,11 +81,11 @@ void pps_kc_remove(struct pps_device *pps) spin_lock_irq(&pps_kc_hardpps_lock); if (pps == pps_kc_hardpps_dev) { pps_kc_hardpps_mode = 0; pps_kc_hardpps_dev = NULL; spin_unlock_irq(&pps_kc_hardpps_lock); - dev_info(&pps->dev, "unbound kernel consumer" + dev_info(pps->dev, "unbound kernel consumer" " on device removal\n"); } else spin_unlock_irq(&pps_kc_hardpps_lock); } diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c index e1689957736d..7c597de601b7 100644 --- a/drivers/pps/pps.c +++ b/drivers/pps/pps.c @@ -63,11 +63,11 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata) err = wait_event_interruptible(pps->queue, ev != pps->last_ev); else { unsigned long ticks; - dev_dbg(&pps->dev, "timeout %lld.%09d\n", + dev_dbg(pps->dev, "timeout %lld.%09d\n", (long long) fdata->timeout.sec, fdata->timeout.nsec); ticks = fdata->timeout.sec * HZ; ticks += fdata->timeout.nsec / (NSEC_PER_SEC / HZ); @@ -81,11 +81,11 @@ static int pps_cdev_pps_fetch(struct pps_device *pps, struct pps_fdata *fdata) } } /* Check for pending signals */ if (err == -ERESTARTSYS) { - dev_dbg(&pps->dev, "pending signal caught\n"); + dev_dbg(pps->dev, "pending signal caught\n"); return -EINTR; } return 0; } @@ -99,11 +99,11 @@ static long pps_cdev_ioctl(struct file *file, int __user *iuarg = (int __user *) arg; int err; switch (cmd) { case PPS_GETPARAMS: - dev_dbg(&pps->dev, "PPS_GETPARAMS\n"); + dev_dbg(pps->dev, "PPS_GETPARAMS\n"); spin_lock_irq(&pps->lock); /* Get the current parameters */ params = pps->params; @@ -115,28 +115,28 @@ static long pps_cdev_ioctl(struct file *file, return -EFAULT; break; case PPS_SETPARAMS: - dev_dbg(&pps->dev, "PPS_SETPARAMS\n"); + dev_dbg(pps->dev, "PPS_SETPARAMS\n"); /* Check the capabilities */ if (!capable(CAP_SYS_TIME)) return -EPERM; err = copy_from_user(¶ms, uarg, sizeof(struct pps_kparams)); if (err) return -EFAULT; if (!(params.mode & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR))) { - dev_dbg(&pps->dev, "capture mode unspecified (%x)\n", + dev_dbg(pps->dev, "capture mode unspecified (%x)\n", params.mode); return -EINVAL; } /* Check for supported capabilities */ if ((params.mode & ~pps->info.mode) != 0) { - dev_dbg(&pps->dev, "unsupported capabilities (%x)\n", + dev_dbg(pps->dev, "unsupported capabilities (%x)\n", params.mode); return -EINVAL; } spin_lock_irq(&pps->lock); @@ -145,11 +145,11 @@ static long pps_cdev_ioctl(struct file *file, pps->params = params; /* Restore the read only parameters */ if ((params.mode & (PPS_TSFMT_TSPEC | PPS_TSFMT_NTPFP)) == 0) { /* section 3.3 of RFC 2783 interpreted */ - dev_dbg(&pps->dev, "time format unspecified (%x)\n", + dev_dbg(pps->dev, "time format unspecified (%x)\n", params.mode); pps->params.mode |= PPS_TSFMT_TSPEC; } if (pps->info.mode & PPS_CANWAIT) pps->params.mode |= PPS_CANWAIT; @@ -166,22 +166,22 @@ static long pps_cdev_ioctl(struct file *file, spin_unlock_irq(&pps->lock); break; case PPS_GETCAP: - dev_dbg(&pps->dev, "PPS_GETCAP\n"); + dev_dbg(pps->dev, "PPS_GETCAP\n"); err = put_user(pps->info.mode, iuarg); if (err) return -EFAULT; break; case PPS_FETCH: { struct pps_fdata fdata; - dev_dbg(&pps->dev, "PPS_FETCH\n"); + dev_dbg(pps->dev, "PPS_FETCH\n"); err = copy_from_user(&fdata, uarg, sizeof(struct pps_fdata)); if (err) return -EFAULT; @@ -209,11 +209,11 @@ static long pps_cdev_ioctl(struct file *file, break; } case PPS_KC_BIND: { struct pps_bind_args bind_args; - dev_dbg(&pps->dev, "PPS_KC_BIND\n"); + dev_dbg(pps->dev, "PPS_KC_BIND\n"); /* Check the capabilities */ if (!capable(CAP_SYS_TIME)) return -EPERM; @@ -221,20 +221,20 @@ static long pps_cdev_ioctl(struct file *file, sizeof(struct pps_bind_args))) return -EFAULT; /* Check for supported capabilities */ if ((bind_args.edge & ~pps->info.mode) != 0) { - dev_err(&pps->dev, "unsupported capabilities (%x)\n", + dev_err(pps->dev, "unsupported capabilities (%x)\n", bind_args.edge); return -EINVAL; } /* Validate parameters roughly */ if (bind_args.tsformat != PPS_TSFMT_TSPEC || (bind_args.edge & ~PPS_CAPTUREBOTH) != 0 || bind_args.consumer != PPS_KC_HARDPPS) { - dev_err(&pps->dev, "invalid kernel consumer bind" + dev_err(pps->dev, "invalid kernel consumer bind" " parameters (%x)\n", bind_args.edge); return -EINVAL; } err = pps_kc_bind(pps, &bind_args); @@ -262,11 +262,11 @@ static long pps_cdev_compat_ioctl(struct file *file, if (cmd == PPS_FETCH) { struct pps_fdata_compat compat; struct pps_fdata fdata; int err; - dev_dbg(&pps->dev, "PPS_FETCH\n"); + dev_dbg(pps->dev, "PPS_FETCH\n"); err = copy_from_user(&compat, uarg, sizeof(struct pps_fdata_compat)); if (err) return -EFAULT; @@ -308,11 +308,11 @@ static struct pps_device *pps_idr_get(unsigned long id) struct pps_device *pps; mutex_lock(&pps_idr_lock); pps = idr_find(&pps_idr, id); if (pps) - get_device(&pps->dev); + get_device(pps->dev); mutex_unlock(&pps_idr_lock); return pps; } @@ -330,11 +330,11 @@ static int pps_cdev_open(struct inode *inode, struct file *file) static int pps_cdev_release(struct inode *inode, struct file *file) { struct pps_device *pps = file->private_data; WARN_ON(pps->id != iminor(inode)); - put_device(&pps->dev); + put_device(pps->dev); return 0; } /* * Char device stuff @@ -354,16 +354,18 @@ static const struct file_operations pps_cdev_fops = { static void pps_device_destruct(struct device *dev) { struct pps_device *pps = dev_get_drvdata(dev); pr_debug("deallocating pps%d\n", pps->id); + kfree(dev); kfree(pps); } int pps_register_cdev(struct pps_device *pps) { int err; + dev_t devt; mutex_lock(&pps_idr_lock); /* * Get new ID for the new PPS source. After idr_alloc() calling * the new source will be freely available into the kernel. @@ -377,47 +379,46 @@ int pps_register_cdev(struct pps_device *pps) } goto out_unlock; } pps->id = err; - pps->dev.class = pps_class; - pps->dev.parent = pps->info.dev; - pps->dev.devt = MKDEV(pps_major, pps->id); - dev_set_drvdata(&pps->dev, pps); - dev_set_name(&pps->dev, "pps%d", pps->id); - err = device_register(&pps->dev); - if (err) + devt = MKDEV(pps_major, pps->id); + + pps->dev = device_create(pps_class, pps->info.dev, devt, pps, + "pps%d", pps->id); + if (IS_ERR(pps->dev)) { + err = PTR_ERR(pps->dev); goto free_idr; + } /* Override the release function with our own */ - pps->dev.release = pps_device_destruct; + pps->dev->release = pps_device_destruct; pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major, pps->id); - get_device(&pps->dev); + get_device(pps->dev); mutex_unlock(&pps_idr_lock); return 0; free_idr: idr_remove(&pps_idr, pps->id); - put_device(&pps->dev); out_unlock: mutex_unlock(&pps_idr_lock); return err; } void pps_unregister_cdev(struct pps_device *pps) { pr_debug("unregistering pps%d\n", pps->id); pps->lookup_cookie = NULL; - device_destroy(pps_class, pps->dev.devt); + device_destroy(pps_class, pps->dev->devt); /* Now we can release the ID for re-use */ mutex_lock(&pps_idr_lock); idr_remove(&pps_idr, pps->id); - put_device(&pps->dev); + put_device(pps->dev); mutex_unlock(&pps_idr_lock); } /* * Look up a pps device by magic cookie. diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c index 4899fdf9bdf7..79afcce15847 100644 --- a/drivers/ptp/ptp_ocp.c +++ b/drivers/ptp/ptp_ocp.c @@ -4054,11 +4054,11 @@ ptp_ocp_complete(struct ptp_ocp *bp) sprintf(buf, "ptp%d", ptp_clock_index(bp->ptp)); ptp_ocp_link_child(bp, buf, "ptp"); pps = pps_lookup_dev(bp->ptp); if (pps) - ptp_ocp_symlink(bp, &pps->dev, "pps"); + ptp_ocp_symlink(bp, pps->dev, "pps"); ptp_ocp_debugfs_add_device(bp); return 0; } diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h index 4f41fe845589..36db7acf43d6 100644 --- a/include/linux/pps_kernel.h +++ b/include/linux/pps_kernel.h @@ -55,11 +55,12 @@ struct pps_device { wait_queue_head_t queue; /* PPS event queue */ unsigned int id; /* PPS source unique ID */ KABI_FILL_HOLE(unsigned int last_fetched_ev) /* last fetched PPS event id */ void const *lookup_cookie; /* For pps_lookup_dev() only */ - struct device dev; + struct cdev cdev; + struct device *dev; struct fasync_struct *async_queue; /* fasync method */ spinlock_t lock; }; /* -- 2.17.1