From 48207d7595d2be604e21228e5a93aaff17e4b808 Mon Sep 17 00:00:00 2001 From: Uwe Kleine-König Date: Fri, 5 Oct 2018 21:42:06 +0200 Subject: gpio: drop devm_gpiochip_remove() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is hardly any reason to call devm_gpiochip_remove() because the driver core handles calling gpiochip_remove() automatically. To make it harder to introduce new (and probably unneeded) callers, drop the function. Signed-off-by: Uwe Kleine-König Signed-off-by: Linus Walleij --- include/linux/gpio/driver.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include/linux/gpio') diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h index 2db62b550b95..f70d976e1395 100644 --- a/include/linux/gpio/driver.h +++ b/include/linux/gpio/driver.h @@ -422,7 +422,6 @@ static inline int gpiochip_add(struct gpio_chip *chip) extern void gpiochip_remove(struct gpio_chip *chip); extern int devm_gpiochip_add_data(struct device *dev, struct gpio_chip *chip, void *data); -extern void devm_gpiochip_remove(struct device *dev, struct gpio_chip *chip); extern struct gpio_chip *gpiochip_find(void *data, int (*match)(struct gpio_chip *chip, void *data)); -- cgit v1.2.3-58-ga151 From 18534df419041e6c1f4b41af56ee7d41f757815c Mon Sep 17 00:00:00 2001 From: Muchun Song Date: Thu, 1 Nov 2018 21:12:50 +0800 Subject: gpiolib: Fix possible use after free on label gpiod_request_commit() copies the pointer to the label passed as an argument only to be used later. But there's a chance the caller could immediately free the passed string(e.g., local variable). This could trigger a use after free when we use gpio label(e.g., gpiochip_unlock_as_irq(), gpiochip_is_requested()). To be on the safe side: duplicate the string with kstrdup_const() so that if an unaware user passes an address to a stack-allocated buffer, we won't get the arbitrary label. Also fix gpiod_set_consumer_name(). Signed-off-by: Muchun Song Signed-off-by: Linus Walleij --- drivers/gpio/gpiolib.c | 25 +++++++++++++++++++++---- include/linux/gpio/consumer.h | 6 ++++-- 2 files changed, 25 insertions(+), 6 deletions(-) (limited to 'include/linux/gpio') diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 9ccc096a0df7..2a9d50678aa1 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2282,6 +2282,12 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) unsigned long flags; unsigned offset; + if (label) { + label = kstrdup_const(label, GFP_KERNEL); + if (!label) + return -ENOMEM; + } + spin_lock_irqsave(&gpio_lock, flags); /* NOTE: gpio_request() can be called in early boot, @@ -2292,6 +2298,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) desc_set_label(desc, label ? : "?"); status = 0; } else { + kfree_const(label); status = -EBUSY; goto done; } @@ -2308,6 +2315,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) if (status < 0) { desc_set_label(desc, NULL); + kfree_const(label); clear_bit(FLAG_REQUESTED, &desc->flags); goto done; } @@ -2403,6 +2411,7 @@ static bool gpiod_free_commit(struct gpio_desc *desc) chip->free(chip, gpio_chip_hwgpio(desc)); spin_lock_irqsave(&gpio_lock, flags); } + kfree_const(desc->label); desc_set_label(desc, NULL); clear_bit(FLAG_ACTIVE_LOW, &desc->flags); clear_bit(FLAG_REQUESTED, &desc->flags); @@ -3358,11 +3367,19 @@ EXPORT_SYMBOL_GPL(gpiod_cansleep); * @desc: gpio to set the consumer name on * @name: the new consumer name */ -void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name) +int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name) { - VALIDATE_DESC_VOID(desc); - /* Just overwrite whatever the previous name was */ - desc->label = name; + VALIDATE_DESC(desc); + if (name) { + name = kstrdup_const(name, GFP_KERNEL); + if (!name) + return -ENOMEM; + } + + kfree_const(desc->label); + desc_set_label(desc, name); + + return 0; } EXPORT_SYMBOL_GPL(gpiod_set_consumer_name); diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h index f2f887795d43..ed070512b40e 100644 --- a/include/linux/gpio/consumer.h +++ b/include/linux/gpio/consumer.h @@ -162,7 +162,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc); int gpiod_cansleep(const struct gpio_desc *desc); int gpiod_to_irq(const struct gpio_desc *desc); -void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name); +int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name); /* Convert between the old gpio_ and new gpiod_ interfaces */ struct gpio_desc *gpio_to_desc(unsigned gpio); @@ -495,10 +495,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc) return -EINVAL; } -static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name) +static inline int gpiod_set_consumer_name(struct gpio_desc *desc, + const char *name) { /* GPIO can never have been requested */ WARN_ON(1); + return -EINVAL; } static inline struct gpio_desc *gpio_to_desc(unsigned gpio) -- cgit v1.2.3-58-ga151 From eee3919c5f2949a8b7b1e9fa239d153be1538656 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Mon, 12 Nov 2018 15:10:28 +0100 Subject: gpio: drop broken to_gpio_irq_chip() helper Drop the broken to_gpio_irq_chip() container_of() helper, which would break the build for anyone who tries to use it. Specifically, struct gpio_irq_chip only holds a pointer to a struct irq_chip so using container_of() on an irq-chip pointer makes no sense. Fixes: da80ff81a8f5 ("gpio: Move irqchip into struct gpio_irq_chip") Cc: Thierry Reding Cc: Grygorii Strashko Signed-off-by: Johan Hovold Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij --- include/linux/gpio/driver.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include/linux/gpio') diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h index f70d976e1395..9c8d5d491680 100644 --- a/include/linux/gpio/driver.h +++ b/include/linux/gpio/driver.h @@ -166,11 +166,6 @@ struct gpio_irq_chip { */ void (*irq_disable)(struct irq_data *data); }; - -static inline struct gpio_irq_chip *to_gpio_irq_chip(struct irq_chip *chip) -{ - return container_of(chip, struct gpio_irq_chip, chip); -} #endif /** -- cgit v1.2.3-58-ga151 From 21abf103818a4735e80fb0ab03934bed8ae9a028 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Tue, 4 Sep 2018 13:31:45 +0200 Subject: gpio: Pass a flag to gpiochip_request_own_desc() Before things go out of hand, make it possible to pass flags when requesting "own" descriptors from a gpio_chip. This is necessary if the chip wants to request a GPIO with active low semantics, for example. Cc: Janusz Krzysztofik Cc: Thomas Petazzoni Cc: Jason Cooper Cc: Jiri Kosina Cc: Roger Quadros Reviewed-by: Gregory CLEMENT Signed-off-by: Linus Walleij --- Documentation/driver-api/gpio/driver.rst | 4 +++- arch/arm/mach-omap1/ams-delta-fiq.c | 2 +- arch/arm/mach-omap1/board-ams-delta.c | 2 +- drivers/gpio/gpio-mvebu.c | 2 +- drivers/gpio/gpiolib-acpi.c | 13 +++---------- drivers/gpio/gpiolib.c | 21 +++++++++++++++++++-- drivers/hid/hid-cp2112.c | 2 +- drivers/memory/omap-gpmc.c | 3 ++- include/linux/gpio/driver.h | 4 +++- 9 files changed, 34 insertions(+), 19 deletions(-) (limited to 'include/linux/gpio') diff --git a/Documentation/driver-api/gpio/driver.rst b/Documentation/driver-api/gpio/driver.rst index a6c14ff0c54f..a92d8837b62b 100644 --- a/Documentation/driver-api/gpio/driver.rst +++ b/Documentation/driver-api/gpio/driver.rst @@ -434,7 +434,9 @@ try_module_get()). A GPIO driver can use the following functions instead to request and free descriptors without being pinned to the kernel forever:: struct gpio_desc *gpiochip_request_own_desc(struct gpio_desc *desc, - const char *label) + u16 hwnum, + const char *label, + enum gpiod_flags flags) void gpiochip_free_own_desc(struct gpio_desc *desc) diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c index b0dc7ddf5877..0324d0f209ea 100644 --- a/arch/arm/mach-omap1/ams-delta-fiq.c +++ b/arch/arm/mach-omap1/ams-delta-fiq.c @@ -103,7 +103,7 @@ void __init ams_delta_init_fiq(struct gpio_chip *chip, } for (i = 0; i < ARRAY_SIZE(irq_data); i++) { - gpiod = gpiochip_request_own_desc(chip, i, pin_name[i]); + gpiod = gpiochip_request_own_desc(chip, i, pin_name[i], 0); if (IS_ERR(gpiod)) { pr_err("%s: failed to get GPIO pin %d (%ld)\n", __func__, i, PTR_ERR(gpiod)); diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c index 3d191fd52910..6719e139eb62 100644 --- a/arch/arm/mach-omap1/board-ams-delta.c +++ b/arch/arm/mach-omap1/board-ams-delta.c @@ -808,7 +808,7 @@ static void __init ams_delta_led_init(struct gpio_chip *chip) int i; for (i = LATCH1_PIN_LED_CAMERA; i < LATCH1_PIN_DOCKIT1; i++) { - gpiod = gpiochip_request_own_desc(chip, i, NULL); + gpiod = gpiochip_request_own_desc(chip, i, "camera-led", 0); if (IS_ERR(gpiod)) { pr_warn("%s: %s GPIO %d request failed (%ld)\n", __func__, LATCH1_LABEL, i, PTR_ERR(gpiod)); diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c index 6e02148c208b..6c675c5accba 100644 --- a/drivers/gpio/gpio-mvebu.c +++ b/drivers/gpio/gpio-mvebu.c @@ -608,7 +608,7 @@ static int mvebu_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) ret = -EBUSY; } else { desc = gpiochip_request_own_desc(&mvchip->chip, - pwm->hwpwm, "mvebu-pwm"); + pwm->hwpwm, "mvebu-pwm", 0); if (IS_ERR(desc)) { ret = PTR_ERR(desc); goto out; diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c index 55b72fbe1631..722a9befa8a9 100644 --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -167,7 +167,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares, if (!handler) return AE_OK; - desc = gpiochip_request_own_desc(chip, pin, "ACPI:Event"); + desc = gpiochip_request_own_desc(chip, pin, "ACPI:Event", 0); if (IS_ERR(desc)) { dev_err(chip->parent, "Failed to request GPIO\n"); return AE_ERROR; @@ -884,21 +884,14 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address, const char *label = "ACPI:OpRegion"; int err; - desc = gpiochip_request_own_desc(chip, pin, label); + desc = gpiochip_request_own_desc(chip, pin, label, + flags); if (IS_ERR(desc)) { status = AE_ERROR; mutex_unlock(&achip->conn_lock); goto out; } - err = gpiod_configure_flags(desc, label, 0, flags); - if (err < 0) { - status = AE_NOT_CONFIGURED; - gpiochip_free_own_desc(desc); - mutex_unlock(&achip->conn_lock); - goto out; - } - conn = kzalloc(sizeof(*conn), GFP_KERNEL); if (!conn) { status = AE_NO_MEMORY; diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index d61fdcb26fbd..2ec8b0d2096a 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2454,6 +2454,7 @@ EXPORT_SYMBOL_GPL(gpiochip_is_requested); * @chip: GPIO chip * @hwnum: hardware number of the GPIO for which to request the descriptor * @label: label for the GPIO + * @flags: flags for this GPIO or 0 if default * * Function allows GPIO chip drivers to request and use their own GPIO * descriptors via gpiolib API. Difference to gpiod_request() is that this @@ -2466,7 +2467,8 @@ EXPORT_SYMBOL_GPL(gpiochip_is_requested); * code on failure. */ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *chip, u16 hwnum, - const char *label) + const char *label, + enum gpiod_flags flags) { struct gpio_desc *desc = gpiochip_get_desc(chip, hwnum); int err; @@ -2480,6 +2482,13 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *chip, u16 hwnum, if (err < 0) return ERR_PTR(err); + err = gpiod_configure_flags(desc, label, 0, flags); + if (err) { + chip_err(chip, "setup of own GPIO %s failed\n", label); + gpiod_free_commit(desc); + return ERR_PTR(err); + } + return desc; } EXPORT_SYMBOL_GPL(gpiochip_request_own_desc); @@ -4332,7 +4341,15 @@ int gpiod_hog(struct gpio_desc *desc, const char *name, chip = gpiod_to_chip(desc); hwnum = gpio_chip_hwgpio(desc); - local_desc = gpiochip_request_own_desc(chip, hwnum, name); + /* + * FIXME: not very elegant that we call gpiod_configure_flags() + * twice here (once inside gpiochip_request_own_desc() and + * again here), but the gpiochip_request_own_desc() is external + * and cannot really pass the lflags so this is the lesser evil + * at the moment. Pass zero as dflags on this first call so we + * don't screw anything up. + */ + local_desc = gpiochip_request_own_desc(chip, hwnum, name, 0); if (IS_ERR(local_desc)) { status = PTR_ERR(local_desc); pr_err("requesting hog GPIO %s (chip %s, offset %d) failed, %d\n", diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c index 271f31461da4..47f65857408d 100644 --- a/drivers/hid/hid-cp2112.c +++ b/drivers/hid/hid-cp2112.c @@ -1203,7 +1203,7 @@ static int __maybe_unused cp2112_allocate_irq(struct cp2112_device *dev, return -EINVAL; dev->desc[pin] = gpiochip_request_own_desc(&dev->gc, pin, - "HID/I2C:Event"); + "HID/I2C:Event", 0); if (IS_ERR(dev->desc[pin])) { dev_err(dev->gc.parent, "Failed to request GPIO\n"); return PTR_ERR(dev->desc[pin]); diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c index c215287e80cf..b9b4f7058b05 100644 --- a/drivers/memory/omap-gpmc.c +++ b/drivers/memory/omap-gpmc.c @@ -2170,7 +2170,8 @@ static int gpmc_probe_generic_child(struct platform_device *pdev, unsigned int wait_pin = gpmc_s.wait_pin; waitpin_desc = gpiochip_request_own_desc(&gpmc->gpio_chip, - wait_pin, "WAITPIN"); + wait_pin, "WAITPIN", + 0); if (IS_ERR(waitpin_desc)) { dev_err(&pdev->dev, "invalid wait-pin: %d\n", wait_pin); ret = PTR_ERR(waitpin_desc); diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h index 9c8d5d491680..07cddbf45186 100644 --- a/include/linux/gpio/driver.h +++ b/include/linux/gpio/driver.h @@ -17,6 +17,7 @@ struct device_node; struct seq_file; struct gpio_device; struct module; +enum gpiod_flags; #ifdef CONFIG_GPIOLIB @@ -604,7 +605,8 @@ gpiochip_remove_pin_ranges(struct gpio_chip *chip) #endif /* CONFIG_PINCTRL */ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *chip, u16 hwnum, - const char *label); + const char *label, + enum gpiod_flags flags); void gpiochip_free_own_desc(struct gpio_desc *desc); #else /* CONFIG_GPIOLIB */ -- cgit v1.2.3-58-ga151 From c5510b8dafce5f3f5a039c9b262ebcae0092c462 Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Thu, 6 Dec 2018 10:45:49 +0100 Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return the same type of error as regular version: NULL. All the callers compare the return value of gpio_to_desc() against NULL, so returned ERR_PTR would be treated as non-error case leading to dereferencing of error value. Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij --- include/linux/gpio/consumer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/linux/gpio') diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h index ed070512b40e..3b01fbcafc94 100644 --- a/include/linux/gpio/consumer.h +++ b/include/linux/gpio/consumer.h @@ -505,7 +505,7 @@ static inline int gpiod_set_consumer_name(struct gpio_desc *desc, static inline struct gpio_desc *gpio_to_desc(unsigned gpio) { - return ERR_PTR(-EINVAL); + return NULL; } static inline int desc_to_gpio(const struct gpio_desc *desc) -- cgit v1.2.3-58-ga151