From patchwork Wed Nov 8 10:32:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kubalewski, Arkadiusz" X-Patchwork-Id: 13449694 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC9F97EF for ; Wed, 8 Nov 2023 10:35:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="kDopcxxk" Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CFD210D5 for ; Wed, 8 Nov 2023 02:35:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1699439731; x=1730975731; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=C55NGJMFSOPoojVxAshi+3XCIrD5QW5iFAdOspXeMLs=; b=kDopcxxktggSLlVec3+PhHd29UVcrro5G9tilsIknQEg0pEJa+md81HS F2+wTLqLmYl+oHncdll8k3YKOjEvNPockBxPzSof4SDbbVnysjs8QuT2g 6yLOSSjJTpHPl6lcVj2jK5gpFuBVz9Se2wzjDuGOAp0s7XuSCfm22qdDe +U6xEd2MMDzvId6Enzr9CD5vs1DTL6LJ71y5lEj4n6oohzLxfeC8J2NVK 8n899l9fZROcP/MEkteiSTaEsI1yeZDlSO2cUploovZtHDZTFy4bWsqa9 xQIZD0cfEWZmkvGNKH9SBkHGe8EuwDvF2EwvtY+I4cLgvk5rYwhpVp4bA Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10887"; a="393651313" X-IronPort-AV: E=Sophos;i="6.03,285,1694761200"; d="scan'208";a="393651313" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Nov 2023 02:35:31 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10887"; a="766606291" X-IronPort-AV: E=Sophos;i="6.03,285,1694761200"; d="scan'208";a="766606291" Received: from amlin-018-114.igk.intel.com ([10.102.18.114]) by fmsmga007.fm.intel.com with ESMTP; 08 Nov 2023 02:35:29 -0800 From: Arkadiusz Kubalewski To: netdev@vger.kernel.org Cc: vadim.fedorenko@linux.dev, jiri@resnulli.us, michal.michalik@intel.com, milena.olech@intel.com, pabeni@redhat.com, kuba@kernel.org, Arkadiusz Kubalewski Subject: [PATCH net 1/3] dpll: fix pin dump crash after module unbind Date: Wed, 8 Nov 2023 11:32:24 +0100 Message-Id: <20231108103226.1168500-2-arkadiusz.kubalewski@intel.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20231108103226.1168500-1-arkadiusz.kubalewski@intel.com> References: <20231108103226.1168500-1-arkadiusz.kubalewski@intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Disallow dump of unregistered parent pins, it is possible when parent pin and dpll device registerer kernel module instance unbinds, and other kernel module instances of the same dpll device have pins registered with the parent pin. The user can invoke a pin-dump but as the parent was unregistered, thus shall not be accessed by the userspace, prevent that by checking if parent pin is still registered. Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Arkadiusz Kubalewski --- drivers/dpll/dpll_netlink.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c index a6dc3997bf5c..93fc6c4b8a78 100644 --- a/drivers/dpll/dpll_netlink.c +++ b/drivers/dpll/dpll_netlink.c @@ -328,6 +328,13 @@ dpll_msg_add_pin_parents(struct sk_buff *msg, struct dpll_pin *pin, void *parent_priv; ppin = ref->pin; + /* + * dump parent only if it is registered, thus prevent crash on + * pin dump called when driver which registered the pin unbinds + * and different instance registered pin on that parent pin + */ + if (!xa_get_mark(&dpll_pin_xa, ppin->id, DPLL_REGISTERED)) + continue; parent_priv = dpll_pin_on_dpll_priv(dpll_ref->dpll, ppin); ret = ops->state_on_pin_get(pin, dpll_pin_on_pin_priv(ppin, pin), From patchwork Wed Nov 8 10:32:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kubalewski, Arkadiusz" X-Patchwork-Id: 13449695 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F03FD12E54 for ; Wed, 8 Nov 2023 10:35:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="BVN9ChF1" Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 726CB19E for ; Wed, 8 Nov 2023 02:35:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1699439733; x=1730975733; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4C3hVOY00tBUuaukniazpjI9sSNAdHpwdUSCv29+9b0=; b=BVN9ChF1bdTziG0wEahTjW1HVyx0NQzeysbrXD+rbTFtUEhZwk8zpg0o 84ltJAGdNxRHCBDOxexpqRuLJxro4MyfX/oivFkdoVjDNCwLicqcfi5e7 EywS2so2JVVOULn+RuJUqYPjgYM78HMvvMChmiHDzlmX0Bpu/2Yh/JP8n ddNPQfd4+KfzTNgEZI2Yf05bDChEqaeZfhgKJEW+ouAoFHOs/u0bdoqZ5 yM7pKY993z9CGweHivOM1TYd1ZK4H281FJX4zKhk1PwXARwmJtQNEEtdU JNAJ/zvimsZharJmRO6a8lbSGq5KaR+isWI+0fbekrgvkggMIgmpfyOZy w==; X-IronPort-AV: E=McAfee;i="6600,9927,10887"; a="393651327" X-IronPort-AV: E=Sophos;i="6.03,285,1694761200"; d="scan'208";a="393651327" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Nov 2023 02:35:33 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10887"; a="766606294" X-IronPort-AV: E=Sophos;i="6.03,285,1694761200"; d="scan'208";a="766606294" Received: from amlin-018-114.igk.intel.com ([10.102.18.114]) by fmsmga007.fm.intel.com with ESMTP; 08 Nov 2023 02:35:31 -0800 From: Arkadiusz Kubalewski To: netdev@vger.kernel.org Cc: vadim.fedorenko@linux.dev, jiri@resnulli.us, michal.michalik@intel.com, milena.olech@intel.com, pabeni@redhat.com, kuba@kernel.org, Arkadiusz Kubalewski Subject: [PATCH net 2/3] dpll: fix pin dump crash for rebound module Date: Wed, 8 Nov 2023 11:32:25 +0100 Message-Id: <20231108103226.1168500-3-arkadiusz.kubalewski@intel.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20231108103226.1168500-1-arkadiusz.kubalewski@intel.com> References: <20231108103226.1168500-1-arkadiusz.kubalewski@intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org When a kernel module is unbound but the pin resources were not entirely freed (other kernel module instance have had kept the reference to that pin), and kernel module is again bound, the pin properties would not be updated (the properties are only assigned when memory for the pin is allocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbind. If the pin dump is invoked in this state, the result is a kernel crash. Prevent the crash by storing persistent pin properties in dpll subsystem, copy the content from the kernel module when pin is allocated, instead of using memory of the kernel module. Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Arkadiusz Kubalewski --- drivers/dpll/dpll_core.c | 4 ++-- drivers/dpll/dpll_core.h | 4 ++-- drivers/dpll/dpll_netlink.c | 28 ++++++++++++++-------------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c index 3568149b9562..4077b562ba3b 100644 --- a/drivers/dpll/dpll_core.c +++ b/drivers/dpll/dpll_core.c @@ -442,7 +442,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, ret = -EINVAL; goto err; } - pin->prop = prop; + memcpy(&pin->prop, prop, sizeof(pin->prop)); refcount_set(&pin->refcount, 1); xa_init_flags(&pin->dpll_refs, XA_FLAGS_ALLOC); xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); @@ -634,7 +634,7 @@ int dpll_pin_on_pin_register(struct dpll_pin *parent, struct dpll_pin *pin, unsigned long i, stop; int ret; - if (WARN_ON(parent->prop->type != DPLL_PIN_TYPE_MUX)) + if (WARN_ON(parent->prop.type != DPLL_PIN_TYPE_MUX)) return -EINVAL; if (WARN_ON(!ops) || diff --git a/drivers/dpll/dpll_core.h b/drivers/dpll/dpll_core.h index 5585873c5c1b..717f715015c7 100644 --- a/drivers/dpll/dpll_core.h +++ b/drivers/dpll/dpll_core.h @@ -44,7 +44,7 @@ struct dpll_device { * @module: module of creator * @dpll_refs: hold referencees to dplls pin was registered with * @parent_refs: hold references to parent pins pin was registered with - * @prop: pointer to pin properties given by registerer + * @prop: pin properties copied from the registerer * @rclk_dev_name: holds name of device when pin can recover clock from it * @refcount: refcount **/ @@ -55,7 +55,7 @@ struct dpll_pin { struct module *module; struct xarray dpll_refs; struct xarray parent_refs; - const struct dpll_pin_properties *prop; + struct dpll_pin_properties prop; refcount_t refcount; }; diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c index 93fc6c4b8a78..963bbbbe6660 100644 --- a/drivers/dpll/dpll_netlink.c +++ b/drivers/dpll/dpll_netlink.c @@ -278,17 +278,17 @@ dpll_msg_add_pin_freq(struct sk_buff *msg, struct dpll_pin *pin, if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY, sizeof(freq), &freq, DPLL_A_PIN_PAD)) return -EMSGSIZE; - for (fs = 0; fs < pin->prop->freq_supported_num; fs++) { + for (fs = 0; fs < pin->prop.freq_supported_num; fs++) { nest = nla_nest_start(msg, DPLL_A_PIN_FREQUENCY_SUPPORTED); if (!nest) return -EMSGSIZE; - freq = pin->prop->freq_supported[fs].min; + freq = pin->prop.freq_supported[fs].min; if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY_MIN, sizeof(freq), &freq, DPLL_A_PIN_PAD)) { nla_nest_cancel(msg, nest); return -EMSGSIZE; } - freq = pin->prop->freq_supported[fs].max; + freq = pin->prop.freq_supported[fs].max; if (nla_put_64bit(msg, DPLL_A_PIN_FREQUENCY_MAX, sizeof(freq), &freq, DPLL_A_PIN_PAD)) { nla_nest_cancel(msg, nest); @@ -304,9 +304,9 @@ static bool dpll_pin_is_freq_supported(struct dpll_pin *pin, u32 freq) { int fs; - for (fs = 0; fs < pin->prop->freq_supported_num; fs++) - if (freq >= pin->prop->freq_supported[fs].min && - freq <= pin->prop->freq_supported[fs].max) + for (fs = 0; fs < pin->prop.freq_supported_num; fs++) + if (freq >= pin->prop.freq_supported[fs].min && + freq <= pin->prop.freq_supported[fs].max) return true; return false; } @@ -403,7 +403,7 @@ static int dpll_cmd_pin_get_one(struct sk_buff *msg, struct dpll_pin *pin, struct netlink_ext_ack *extack) { - const struct dpll_pin_properties *prop = pin->prop; + const struct dpll_pin_properties *prop = &pin->prop; struct dpll_pin_ref *ref; int ret; @@ -696,7 +696,7 @@ dpll_pin_on_pin_state_set(struct dpll_pin *pin, u32 parent_idx, int ret; if (!(DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE & - pin->prop->capabilities)) { + pin->prop.capabilities)) { NL_SET_ERR_MSG(extack, "state changing is not allowed"); return -EOPNOTSUPP; } @@ -732,7 +732,7 @@ dpll_pin_state_set(struct dpll_device *dpll, struct dpll_pin *pin, int ret; if (!(DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE & - pin->prop->capabilities)) { + pin->prop.capabilities)) { NL_SET_ERR_MSG(extack, "state changing is not allowed"); return -EOPNOTSUPP; } @@ -759,7 +759,7 @@ dpll_pin_prio_set(struct dpll_device *dpll, struct dpll_pin *pin, int ret; if (!(DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE & - pin->prop->capabilities)) { + pin->prop.capabilities)) { NL_SET_ERR_MSG(extack, "prio changing is not allowed"); return -EOPNOTSUPP; } @@ -787,7 +787,7 @@ dpll_pin_direction_set(struct dpll_pin *pin, struct dpll_device *dpll, int ret; if (!(DPLL_PIN_CAPABILITIES_DIRECTION_CAN_CHANGE & - pin->prop->capabilities)) { + pin->prop.capabilities)) { NL_SET_ERR_MSG(extack, "direction changing is not allowed"); return -EOPNOTSUPP; } @@ -817,8 +817,8 @@ dpll_pin_phase_adj_set(struct dpll_pin *pin, struct nlattr *phase_adj_attr, int ret; phase_adj = nla_get_s32(phase_adj_attr); - if (phase_adj > pin->prop->phase_range.max || - phase_adj < pin->prop->phase_range.min) { + if (phase_adj > pin->prop.phase_range.max || + phase_adj < pin->prop.phase_range.min) { NL_SET_ERR_MSG_ATTR(extack, phase_adj_attr, "phase adjust value not supported"); return -EINVAL; @@ -999,7 +999,7 @@ dpll_pin_find(u64 clock_id, struct nlattr *mod_name_attr, unsigned long i; xa_for_each_marked(&dpll_pin_xa, i, pin, DPLL_REGISTERED) { - prop = pin->prop; + prop = &pin->prop; cid_match = clock_id ? pin->clock_id == clock_id : true; mod_match = mod_name_attr && module_name(pin->module) ? !nla_strcmp(mod_name_attr, From patchwork Wed Nov 8 10:32:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kubalewski, Arkadiusz" X-Patchwork-Id: 13449696 X-Patchwork-Delegate: kuba@kernel.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEE8F12E61 for ; Wed, 8 Nov 2023 10:35:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="GL44jeZC" Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.65]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 76BD41BD8 for ; Wed, 8 Nov 2023 02:35:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1699439735; x=1730975735; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=XIppCVEeLiBLhMQpiA3CCiRkRNPlWTBt/lF8giGktao=; b=GL44jeZC7T4M4uqiVJOG/nU6TQtCzaquDC6Qa8IJWrP8aQVG7n4Byvlg 4qS5VGK60gAqywU0hhSZz6wME4lLiLajtXtN4TT12xv8LvQTzI+50Qvxz UQ525zL9uNA5+tNcE6kkE3uFNOiaYBkwWpSu6UkkraH4e7HdZ87rxDB9s gx8fbhXdbbimNLsOf1AgJwUuYlP6mvc+V8fjroD19YnRmykozOqxkC/6G AraJ/A93dLKiZ/46C5chrrR3oJonzwaCDF0WacijuguN2gHReJlaz4+hf K3XMw/pjhXjR91tSAQP9EQjM/W4uDpFW+qkmi/YzoCn/m5eM4LJtMbuky g==; X-IronPort-AV: E=McAfee;i="6600,9927,10887"; a="393651346" X-IronPort-AV: E=Sophos;i="6.03,285,1694761200"; d="scan'208";a="393651346" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Nov 2023 02:35:35 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10887"; a="766606301" X-IronPort-AV: E=Sophos;i="6.03,285,1694761200"; d="scan'208";a="766606301" Received: from amlin-018-114.igk.intel.com ([10.102.18.114]) by fmsmga007.fm.intel.com with ESMTP; 08 Nov 2023 02:35:33 -0800 From: Arkadiusz Kubalewski To: netdev@vger.kernel.org Cc: vadim.fedorenko@linux.dev, jiri@resnulli.us, michal.michalik@intel.com, milena.olech@intel.com, pabeni@redhat.com, kuba@kernel.org, Arkadiusz Kubalewski Subject: [PATCH net 3/3] dpll: fix register pin with unregistered parent pin Date: Wed, 8 Nov 2023 11:32:26 +0100 Message-Id: <20231108103226.1168500-4-arkadiusz.kubalewski@intel.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20231108103226.1168500-1-arkadiusz.kubalewski@intel.com> References: <20231108103226.1168500-1-arkadiusz.kubalewski@intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org In case of multiple kernel module instances using the same dpll device: if only one registers dpll device, then only that one can register directly connected pins with a dpll device. If unregistered parent determines if the muxed pin can be register with it or not, it forces serialized driver load order - first the driver instance which registers the direct pins needs to be loaded, then the other instances could register muxed type pins. Allow registration of a pin with a parent even if the parent was not yet registered, thus allow ability for unserialized driver instance load order. Do not WARN_ON notification for unregistered pin, which can be invoked for described case, instead just return error. Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Arkadiusz Kubalewski --- drivers/dpll/dpll_core.c | 4 ---- drivers/dpll/dpll_netlink.c | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c index 4077b562ba3b..ae884b92d68c 100644 --- a/drivers/dpll/dpll_core.c +++ b/drivers/dpll/dpll_core.c @@ -28,8 +28,6 @@ static u32 dpll_xa_id; WARN_ON_ONCE(!xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED)) #define ASSERT_DPLL_NOT_REGISTERED(d) \ WARN_ON_ONCE(xa_get_mark(&dpll_device_xa, (d)->id, DPLL_REGISTERED)) -#define ASSERT_PIN_REGISTERED(p) \ - WARN_ON_ONCE(!xa_get_mark(&dpll_pin_xa, (p)->id, DPLL_REGISTERED)) struct dpll_device_registration { struct list_head list; @@ -641,8 +639,6 @@ int dpll_pin_on_pin_register(struct dpll_pin *parent, struct dpll_pin *pin, WARN_ON(!ops->state_on_pin_get) || WARN_ON(!ops->direction_get)) return -EINVAL; - if (ASSERT_PIN_REGISTERED(parent)) - return -EINVAL; mutex_lock(&dpll_lock); ret = dpll_xa_ref_pin_add(&pin->parent_refs, parent, ops, priv); diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c index 963bbbbe6660..ff430f43304f 100644 --- a/drivers/dpll/dpll_netlink.c +++ b/drivers/dpll/dpll_netlink.c @@ -558,7 +558,7 @@ dpll_pin_event_send(enum dpll_cmd event, struct dpll_pin *pin) int ret = -ENOMEM; void *hdr; - if (WARN_ON(!xa_get_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED))) + if (!xa_get_mark(&dpll_pin_xa, pin->id, DPLL_REGISTERED)) return -ENODEV; msg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);