Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'driver-core-5.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core fixes from Greg KH:
"Here are three tiny driver core and firmware loader fixes for
5.14-rc5. They are:
- driver core fix for when probing fails
- firmware loader fixes for reported problems.
All have been in linux-next for a while with no reported issues"
* tag 'driver-core-5.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
firmware_loader: fix use-after-free in firmware_fallback_sysfs
firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
drivers core: Fix oops when driver probe fails
+21
-9
+2
-2
drivers/base/dd.c
+2
-2
drivers/base/dd.c
···
653
653
else if (drv->remove)
654
654
drv->remove(dev);
655
655
probe_failed:
656
-
kfree(dev->dma_range_map);
657
-
dev->dma_range_map = NULL;
658
656
if (dev->bus)
659
657
blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
660
658
BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
···
660
662
device_links_no_driver(dev);
661
663
devres_release_all(dev);
662
664
arch_teardown_dma_ops(dev);
665
+
kfree(dev->dma_range_map);
666
+
dev->dma_range_map = NULL;
663
667
driver_sysfs_remove(dev);
664
668
dev->driver = NULL;
665
669
dev_set_drvdata(dev, NULL);
+8
-6
drivers/base/firmware_loader/fallback.c
+8
-6
drivers/base/firmware_loader/fallback.c
···
89
89
{
90
90
/*
91
91
* There is a small window in which user can write to 'loading'
92
-
* between loading done and disappearance of 'loading'
92
+
* between loading done/aborted and disappearance of 'loading'
93
93
*/
94
-
if (fw_sysfs_done(fw_priv))
94
+
if (fw_state_is_aborted(fw_priv) || fw_sysfs_done(fw_priv))
95
95
return;
96
96
97
-
list_del_init(&fw_priv->pending_list);
98
97
fw_state_aborted(fw_priv);
99
98
}
100
99
···
279
280
* Same logic as fw_load_abort, only the DONE bit
280
281
* is ignored and we set ABORT only on failure.
281
282
*/
282
-
list_del_init(&fw_priv->pending_list);
283
283
if (rc) {
284
284
fw_state_aborted(fw_priv);
285
285
written = rc;
···
511
513
}
512
514
513
515
mutex_lock(&fw_lock);
516
+
if (fw_state_is_aborted(fw_priv)) {
517
+
mutex_unlock(&fw_lock);
518
+
retval = -EINTR;
519
+
goto out;
520
+
}
514
521
list_add(&fw_priv->pending_list, &pending_fw_head);
515
522
mutex_unlock(&fw_lock);
516
523
···
538
535
if (fw_state_is_aborted(fw_priv)) {
539
536
if (retval == -ERESTARTSYS)
540
537
retval = -EINTR;
541
-
else
542
-
retval = -EAGAIN;
543
538
} else if (fw_priv->is_paged_buf && !fw_priv->data)
544
539
retval = -ENOMEM;
545
540
541
+
out:
546
542
device_del(f_dev);
547
543
err_put_dev:
548
544
put_device(f_dev);
+9
-1
drivers/base/firmware_loader/firmware.h
+9
-1
drivers/base/firmware_loader/firmware.h
···
117
117
118
118
WRITE_ONCE(fw_st->status, status);
119
119
120
-
if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
120
+
if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) {
121
+
#ifdef CONFIG_FW_LOADER_USER_HELPER
122
+
/*
123
+
* Doing this here ensures that the fw_priv is deleted from
124
+
* the pending list in all abort/done paths.
125
+
*/
126
+
list_del_init(&fw_priv->pending_list);
127
+
#endif
121
128
complete_all(&fw_st->completion);
129
+
}
122
130
}
123
131
124
132
static inline void fw_state_aborted(struct fw_priv *fw_priv)
+2
drivers/base/firmware_loader/main.c
+2
drivers/base/firmware_loader/main.c