From patchwork Sun Mar 10 18:58:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Van Asbroeck X-Patchwork-Id: 10846423 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 02C13922 for ; Sun, 10 Mar 2019 18:58:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D36B928F60 for ; Sun, 10 Mar 2019 18:58:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C13B328E8E; Sun, 10 Mar 2019 18:58:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 70CBD28E8E for ; Sun, 10 Mar 2019 18:58:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726617AbfCJS6f (ORCPT ); Sun, 10 Mar 2019 14:58:35 -0400 Received: from mail-io1-f68.google.com ([209.85.166.68]:34380 "EHLO mail-io1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725816AbfCJS6f (ORCPT ); Sun, 10 Mar 2019 14:58:35 -0400 Received: by mail-io1-f68.google.com with SMTP id n11so1061987ioh.1; Sun, 10 Mar 2019 11:58:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=yqC4zt3nEa3xfmEsElEgoM7DbcmfILE263nXYl1T67A=; b=HPiHBiOxqn5IGYqU7rMfGrZNDUDLK2g5yq67pEwgan135b0L8aTkEwaojqxNdF+OUz WvOG+2SdKbklBN9g/5WO+rHtxg7dbb2m+CZyciIWfXokjvpFKuube2AC3bqRyZJRUpoZ kXUi+IpHEZhli64iJqVdeH8oCxhyT/IAOb6wO8yfnrbJctkyTQlxAE0Xi2NcVXIe6wdo RbM7iqsbLzp5ODWLJVdn2FPkxYmDD4lknJrRj73iORFLbtyHPwQT5l+908SbcM1Uxyun jlrAhxVO0eXDvrIc94YiCGI8UAhw/pKvDAqbQb5Hcxy0R/FzB3iCbJ5HAhQ9Vm652EYP irHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=yqC4zt3nEa3xfmEsElEgoM7DbcmfILE263nXYl1T67A=; b=fQ+YvLdtahs9pxlMKKgQ6CsgQNNK81oZFl/Oi/f4joDtGOLkhhmKY7oY2DkydUbbE2 NxAVZUmPab17RzfMZAuhgeV6xExinT/DqIesAjmewhNCK15KBNtc6clt5sks0C7X4RYj P/TRrW18mgNXThMcEyXtPDvEFamXq8k2FQ0a6Md4aYQ2s3CKc3A2MCZ+h9DJVNLhao3T jOyUJFYh92VyG1nP2klsqpIIHl/QJb+GtoioGK/gi0umdEMf+EUNZmiYluOfrJXlJwaI FkI+fzsPfuZef8XJVTQ3RMSaHTF54IkG7aG0FWl3NmzCTzmw8ZhF4gckQy0yQftE8JnY 0c5w== X-Gm-Message-State: APjAAAXD0WUVEIRzJdosdejIObe9/xZgft7BeTGfN+IkXWivkT6GI6fq PfeY8lgeGCVWO/8AdJ3zZOQ= X-Google-Smtp-Source: APXvYqw24O91l34LCLCNpO32ZisLz+346P+TCpOrrUXbLgtobmlaeJQ4n2Pj1hviFvnJvAhox6e5IQ== X-Received: by 2002:a6b:7847:: with SMTP id h7mr14509934iop.83.1552244314370; Sun, 10 Mar 2019 11:58:34 -0700 (PDT) Received: from localhost.localdomain ([198.52.185.227]) by smtp.gmail.com with ESMTPSA id y18sm1359270ioa.56.2019.03.10.11.58.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 10 Mar 2019 11:58:33 -0700 (PDT) From: Sven Van Asbroeck X-Google-Original-From: Sven Van Asbroeck To: Jonathan Cameron Cc: Hartmut Knaack , Lars-Peter Clausen , Peter Meerwald-Stadler , Michal Simek , Manish Narani , linux-iio@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/3] iio: adc: xilinx: fix potential use-after-free on remove Date: Sun, 10 Mar 2019 14:58:24 -0400 Message-Id: <20190310185826.25916-1-TheSven73@gmail.com> X-Mailer: git-send-email 2.17.1 Sender: linux-iio-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When cancel_delayed_work() returns, the delayed work may still be running. This means that the core could potentially free the private structure (struct xadc) while the delayed work is still using it. This is a potential use-after-free. Fix by calling cancel_delayed_work_sync(), which waits for any residual work to finish before returning. Signed-off-by: Sven Van Asbroeck --- drivers/iio/adc/xilinx-xadc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 3f6be5ac049a..1960694e8007 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1320,7 +1320,7 @@ static int xadc_remove(struct platform_device *pdev) } free_irq(xadc->irq, indio_dev); clk_disable_unprepare(xadc->clk); - cancel_delayed_work(&xadc->zynq_unmask_work); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); kfree(xadc->data); kfree(indio_dev->channels); From patchwork Sun Mar 10 18:58:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Van Asbroeck X-Patchwork-Id: 10846429 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 42CDF1390 for ; Sun, 10 Mar 2019 18:58:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2F23628E8E for ; Sun, 10 Mar 2019 18:58:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 22AF628F63; Sun, 10 Mar 2019 18:58:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BECBA28E8E for ; Sun, 10 Mar 2019 18:58:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726950AbfCJS6p (ORCPT ); Sun, 10 Mar 2019 14:58:45 -0400 Received: from mail-it1-f195.google.com ([209.85.166.195]:40951 "EHLO mail-it1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726721AbfCJS6g (ORCPT ); Sun, 10 Mar 2019 14:58:36 -0400 Received: by mail-it1-f195.google.com with SMTP id l139so3931834ita.5; Sun, 10 Mar 2019 11:58:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=fxgFiCRKgpoCxt3b7qAJzupwn0XavxwiX5uUbpM/OII=; b=a9fshGZZ7i/tLOZepomjCBDfixyvFGzizvaDmgosBgbXN7+q1UJ/ZsN5OMR7TXZO3s OZsLl6fn5MRTxgtWXvRFdonnegXiOaRpFUqi+BHCHk4QjwpF+oxN+I5uNuEo4aOxZ7bZ r3fpKQHgmXCmSfjPDLwXnbs4/ueXM4Q9UrvmuK57Ao1e8UzEoS6wTrrZRp7cJJfs+zJq KtTwS33zSuk6UDDDspaMdOJHuUwGaDrS1JU04+N5oLT71uISpVnTdm0I4ZRxnBW7Qa4q bc2JXN+ybhDqk23+9lFgSLQBqaT+oyXxRhLcNPTVLQlQWMtEy1zu1v6pAlY60w5GoBuV a6xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=fxgFiCRKgpoCxt3b7qAJzupwn0XavxwiX5uUbpM/OII=; b=DgPWsdN8enq2zyHdghRBATd7/CMSLa+akuRkozoClIr1xMi3m/qbNVvc8ZUe3tEHGc /VznLSeGbf1n1YgPPVwoQdc3po4s34BUVzWNPHg+zaR8bxl7j9DL/WEDPmE9iaai1hUR NW+ILDj/jPMHIdZ8CwJz1ZXLiD1bXhcCefZ47yIPg4Umr+VsdRvaIKAmU1tvpwOesvOU w14jSLS0qDy+dZuT34ArOO74SlNBWvOOusWxNoNixpCFUHC6FOgLBO0u23Ce1gQVZAJl ATA1eVOCcI/X/KOjTLIILtVsKzcuM9cUOLbGIAssbqUMEFnQTDEir4FwGT24VDlorosf fBiw== X-Gm-Message-State: APjAAAUyAJp3ywVIwh+8gOduqA/fGtnZHItTZvey4TXSZXYa8xgTjCLE 15HG41w9fn5tFs2JYMP/tT0= X-Google-Smtp-Source: APXvYqyGASuFsKMDYrVtGpg9O7HRaj1RL78fLP+QSyIZRt5Ha5mt6iBOlsy3QMRJjIlQs682yv+8YA== X-Received: by 2002:a24:1cc6:: with SMTP id c189mr12881577itc.74.1552244315449; Sun, 10 Mar 2019 11:58:35 -0700 (PDT) Received: from localhost.localdomain ([198.52.185.227]) by smtp.gmail.com with ESMTPSA id y18sm1359270ioa.56.2019.03.10.11.58.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 10 Mar 2019 11:58:35 -0700 (PDT) From: Sven Van Asbroeck X-Google-Original-From: Sven Van Asbroeck To: Jonathan Cameron Cc: Hartmut Knaack , Lars-Peter Clausen , Peter Meerwald-Stadler , Michal Simek , Manish Narani , linux-iio@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/3] iio: adc: xilinx: fix potential use-after-free on probe Date: Sun, 10 Mar 2019 14:58:25 -0400 Message-Id: <20190310185826.25916-2-TheSven73@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190310185826.25916-1-TheSven73@gmail.com> References: <20190310185826.25916-1-TheSven73@gmail.com> Sender: linux-iio-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If probe errors out after request_irq(), its error path does not explicitly cancel the delayed work, which may have been scheduled by the interrupt handler. This means the delayed work may still be running when the core frees the private structure (struct xadc). This is a potential use-after-free. Fix by inserting cancel_delayed_work_sync() in the probe error path. Signed-off-by: Sven Van Asbroeck --- drivers/iio/adc/xilinx-xadc-core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 1960694e8007..15e1a103f37d 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev) err_free_irq: free_irq(xadc->irq, indio_dev); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); err_clk_disable_unprepare: clk_disable_unprepare(xadc->clk); err_free_samplerate_trigger: From patchwork Sun Mar 10 18:58:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Van Asbroeck X-Patchwork-Id: 10846427 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 66F89922 for ; Sun, 10 Mar 2019 18:58:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 547C428E8E for ; Sun, 10 Mar 2019 18:58:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4891428F63; Sun, 10 Mar 2019 18:58:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F1C3D28E8E for ; Sun, 10 Mar 2019 18:58:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725816AbfCJS6i (ORCPT ); Sun, 10 Mar 2019 14:58:38 -0400 Received: from mail-io1-f67.google.com ([209.85.166.67]:40009 "EHLO mail-io1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726897AbfCJS6h (ORCPT ); Sun, 10 Mar 2019 14:58:37 -0400 Received: by mail-io1-f67.google.com with SMTP id p17so2127174iol.7; Sun, 10 Mar 2019 11:58:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=AKnYvAqiueyTkKUcdTkd4DRK5HdxIHd2jyBD4bgdo24=; b=LEcm4H+N5lKvwRTSirKOLAz0B20Ev2XEim3/Zz8A/npstz0aaynTtwhYqEsMzXVPF2 u0Wd0Av59wTMsOaJx9LLvq6J7NyGgpEwY7vNrws6dNwm/tp8GtsJ1PBxDMs7S8PdRmpd k64uvCARYN6yYomorJRuume0v5a2hjcr3SK4CvW7auUnIXnhGDDAHHcDVtQJzQngf7SC s5v0EKAXNQfSxOz2G1f76W/5NJxoN25YHbA9z7PzoyvFYikMJvRr57vqyMMeI0BzIvSF pTdMd5ZuAP0pn8d1TY9D3Us08vCRYytQQZJI8NnHkhUpXa7jjdWPoQs6zz8FEAg01Dhv zRuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=AKnYvAqiueyTkKUcdTkd4DRK5HdxIHd2jyBD4bgdo24=; b=YCk2gF0pQl76UftKB7BwHUj1OpaohcejicMgl3IrwYAuoxorf3Qp2K0fpmQyJW+JpC /ArPIFkIt8Mu4zkYeNY4cO1wcnFNuEh9sPLLtzo2ts0blBI9gYvRhd2mzO5V1ApmNofE k988pMzSvJQIOEnMP38nEtiUWZwJ1ow9hR6HY1oyaF8auD8TZTWMKHlywt1x1suvgzDR KqG5l5zSlVf+UvwPzgFsnFIm9pgvOvNFyzSKI0hgad/yLBHjm3ClwWeHdAXLDuZOujAc k8F3kCPr4Dr0VAIB8Mt3S1p8kDyecXL4Tpx8whVkK8eO1wnL6m9VQalJTJND6RdRFv5+ mTiQ== X-Gm-Message-State: APjAAAUQEha+lXA5gzE+4EXDdVRnragnhIrWT4XV9TkuhCMSigPNo/+P FSJVjp9ab22xycZhUw/ngpk= X-Google-Smtp-Source: APXvYqy9VrS0bd+iQ9v7QZ4H98ZpTtpJnlQx6I9TmGD6jxLSQ+Fbofc/4zoq4KxCxZfTr4halfn6ag== X-Received: by 2002:a5e:d819:: with SMTP id l25mr13651049iok.27.1552244316537; Sun, 10 Mar 2019 11:58:36 -0700 (PDT) Received: from localhost.localdomain ([198.52.185.227]) by smtp.gmail.com with ESMTPSA id y18sm1359270ioa.56.2019.03.10.11.58.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 10 Mar 2019 11:58:36 -0700 (PDT) From: Sven Van Asbroeck X-Google-Original-From: Sven Van Asbroeck To: Jonathan Cameron Cc: Hartmut Knaack , Lars-Peter Clausen , Peter Meerwald-Stadler , Michal Simek , Manish Narani , linux-iio@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/3] iio: adc: xilinx: prevent touching unclocked h/w on remove Date: Sun, 10 Mar 2019 14:58:26 -0400 Message-Id: <20190310185826.25916-3-TheSven73@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190310185826.25916-1-TheSven73@gmail.com> References: <20190310185826.25916-1-TheSven73@gmail.com> Sender: linux-iio-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In remove, the clock is disabled before canceling the delayed work. This means that the delayed work may be touching unclocked hardware. Fix by disabling the clock after the delayed work is fully canceled. This is consistent with the probe error path order. Signed-off-by: Sven Van Asbroeck --- drivers/iio/adc/xilinx-xadc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 15e1a103f37d..1ae86e7359f7 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1320,8 +1320,8 @@ static int xadc_remove(struct platform_device *pdev) iio_triggered_buffer_cleanup(indio_dev); } free_irq(xadc->irq, indio_dev); - clk_disable_unprepare(xadc->clk); cancel_delayed_work_sync(&xadc->zynq_unmask_work); + clk_disable_unprepare(xadc->clk); kfree(xadc->data); kfree(indio_dev->channels);