kernel/drivers/rpmsg/virtio_rpmsg_bus.c, branch linux-6.9.y

rpmsg: virtio: Free driver_override when rpmsg_remove()

2023-12-18T17:56:03Z

Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac Signed-off-by: Xiaolei Wang Fixes: b0b03b811963 ("rpmsg: Release rpmsg devices in backends") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20231215020049.78750-1-xiaolei.wang@windriver.com Signed-off-by: Mathieu Poirier

rpmsg: virtio: Replace deprecated strncpy with strscpy/_pad

2023-10-23T19:11:07Z

strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. This patch replaces 3 callsites of strncpy(). The first two populate the destination buffer `nsm.name` -- which we expect to be NUL-terminated based on their use with format strings. Firstly, as I understand it, virtio_rpmsg_announce_create() creates an rpmsg_ns_msg and sends via: virtio_rpmsg_bus.c: 336: err = rpmsg_sendto(rpdev->ept, &nsm, sizeof(nsm), RPMSG_NS_ADDR); ... which uses: virtio_rpmsg_sendto() -> rpmsg_send_offchannel_raw() ... which copies its data into an rpmsg_hdr `msg` in virtio_rpmsg_bus.c 618: memcpy(msg->data, data, len); This callback is invoked when a message is received from the remote processor: rpmsg_ns.c: 30: /* invoked when a name service announcement arrives */ 31: static int rpmsg_ns_cb(struct rpmsg_device *rpdev, void *data, int len, 32: void *priv, u32 src) 33: { 34: struct rpmsg_ns_msg *msg = data; ... 50: /* don't trust the remote processor for null terminating the name */ 51: msg->name[RPMSG_NAME_SIZE - 1] = '\0'; ... which leads into the use of `name` within a format string: rpmsg_ns.c: 57: dev_info(dev, "%sing channel %s addr 0x%x\n", 58: rpmsg32_to_cpu(rpdev, msg->flags) & RPMSG_NS_DESTROY ? 59: "destroy" : "creat", msg->name, chinfo.dst); We can also observe that `nsm` is not zero-initialized and as such we should maintain the NUL-padding behavior that strncpy() provides: virtio_rpmsg_bus.c: 330: struct rpmsg_ns_msg nsm; Considering the above, a suitable replacement is `strscpy_pad` due to the fact that it guarantees both NUL-termination and NUL-padding on the destination buffer. Now, for the third and final destination buffer rpdev->id.name we can just go for strscpy() (not _pad()) as rpdev points to &vch->rpdev: | rpdev = &vch->rpdev; ... and vch is zero-allocated: | vch = kzalloc(sizeof(*vch), GFP_KERNEL); ... this renders any additional NUL-byte assignments (like the ones strncpy() or strscpy_pad() does) redundant. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt Link: https://lore.kernel.org/r/20231023-strncpy-drivers-rpmsg-virtio_rpmsg_bus-c-v2-1-dc591c36f5ed@google.com Signed-off-by: Mathieu Poirier

rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

2022-04-26T15:27:15Z

Unregister the rpmsg_ctrl device instead of just freeing the the virtio_rpmsg_channel structure. This will properly unregister the device and call virtio_rpmsg_release_device() that frees the structure. Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device") Signed-off-by: Arnaud Pouliquen Reviewed-by: Hangyu Hua Link: https://lore.kernel.org/r/20220426060536.15594-4-hbh25y@gmail.com Signed-off-by: Mathieu Poirier

rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()

2022-04-26T15:25:11Z

vch will be free in virtio_rpmsg_release_device() when rpmsg_ctrldev_register_device() fails. There is no need to call kfree() again. Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device") Signed-off-by: Hangyu Hua Tested-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20220426060536.15594-3-hbh25y@gmail.com Signed-off-by: Mathieu Poirier

rpmsg: virtio: Fix possible double free in rpmsg_probe()

2022-04-26T15:23:41Z

vch will be free in virtio_rpmsg_release_device() when rpmsg_ns_register_device() fails. There is no need to call kfree() again. Fix this by changing error path from free_vch to free_ctrldev. Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device") Signed-off-by: Hangyu Hua Tested-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20220426060536.15594-2-hbh25y@gmail.com Signed-off-by: Mathieu Poirier

rpmsg: Update rpmsg_chrdev_register_device function

2022-03-13T16:49:53Z

The rpmsg_chrdev driver has been replaced by the rpmsg_ctrl driver for the /dev/rpmsg_ctrlX devices management. The reference for the driver override is now the rpmsg_ctrl. Update the rpmsg_chrdev_register_device function to reflect the update, and rename the function to use the rpmsg_ctrldev prefix. The platform drivers are updated accordingly. Signed-off-by: Arnaud Pouliquen Reviewed-by: Mathieu Poirier Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220124102524.295783-8-arnaud.pouliquen@foss.st.com

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

2022-01-18T08:05:48Z

Pull virtio updates from Michael Tsirkin: "virtio,vdpa,qemu_fw_cfg: features, cleanups, and fixes. - partial support for < MAX_ORDER - 1 granularity for virtio-mem - driver_override for vdpa - sysfs ABI documentation for vdpa - multiqueue config support for mlx5 vdpa - and misc fixes, cleanups" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (42 commits) vdpa/mlx5: Fix tracking of current number of VQs vdpa/mlx5: Fix is_index_valid() to refer to features vdpa: Protect vdpa reset with cf_mutex vdpa: Avoid taking cf_mutex lock on get status vdpa/vdpa_sim_net: Report max device capabilities vdpa: Use BIT_ULL for bit operations vdpa/vdpa_sim: Configure max supported virtqueues vdpa/mlx5: Report max device capabilities vdpa: Support reporting max device capabilities vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps() vdpa: Add support for returning device configuration information vdpa/mlx5: Support configuring max data virtqueue vdpa/mlx5: Fix config_attr_mask assignment vdpa: Allow to configure max data virtqueues vdpa: Read device configuration only if FEATURES_OK vdpa: Sync calls set/get config/status with cf_mutex vdpa/mlx5: Distribute RX virtqueues in RQT object vdpa: Provide interface to read driver features vdpa: clean up get_config_size ret value handling virtio_ring: mark ring unused on error ...

virtio: wrap config->reset calls

2022-01-14T23:50:52Z

This will enable cleanups down the road. The idea is to disable cbs, then add "flush_queued_cbs" callback as a parameter, this way drivers can flush any work queued after callbacks have been disabled. Signed-off-by: Michael S. Tsirkin Link: https://lore.kernel.org/r/20211013105226.20225-1-mst@redhat.com Signed-off-by: Michael S. Tsirkin

rpmsg: Fix documentation return formatting

2021-11-18T17:36:05Z

kernel documentation specification: "The return value, if any, should be described in a dedicated section named Return." Signed-off-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20211108140126.3530-1-arnaud.pouliquen@foss.st.com Signed-off-by: Mathieu Poirier

Merge tag 'rpmsg-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

2021-11-10T17:05:11Z

Pull rpmsg updates from Bjorn Andersson: "For the GLINK implementation this adds support for splitting outgoing messages that are too large to fit in the fifo, it introduces the use of "read notifications", to avoid polling in the case where the outgoing fifo is full and a few bugs are squashed. The return value of rpmsg_create_ept() for when RPMSG is disabled is corrected to return a valid error, the Mediatek rpmsg driver is updated to match the DT binding and a couple of cleanups are done in the virtio rpmsg driver" * tag 'rpmsg-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: glink: Send READ_NOTIFY command in FIFO full case rpmsg: glink: Remove channel decouple from rpdev release rpmsg: glink: Remove the rpmsg dev in close_ack rpmsg: glink: Add TX_DATA_CONT command while sending rpmsg: virtio_rpmsg_bus: use dev_warn_ratelimited for msg with no recipient rpmsg: virtio: Remove unused including rpmsg: Change naming of mediatek rpmsg property rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined rpmsg: glink: Replace strncpy() with strscpy_pad()