kernel/drivers/uio, branch linux-5.1.y

driver: uio: fix possible use-after-free in __uio_register_device

2019-01-31T15:36:52Z

In uio_dev_add_attributes() error handing case, idev is used after device_unregister(), in which 'idev' has been released, touch idev cause use-after-free. Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") Signed-off-by: Liu Jian Reviewed-by: Hamish Martin Signed-off-by: Greg Kroah-Hartman

driver: uio: fix possible memory leak in __uio_register_device

2019-01-31T15:36:36Z

'idev' is malloced in __uio_register_device() and leak free it before leaving from the uio_get_minor() error handing case, it will cause memory leak. Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") Signed-off-by: Liu Jian Reviewed-by: Hamish Martin Signed-off-by: Greg Kroah-Hartman

uio/uio_pci_generic: Disable bus-mastering on release

2019-01-31T15:22:51Z

Userspace code using uio_pci_generic may enable bus-mastering by directly manipulating a PCI device's command register. If a userspace program enables bus-mastering but exits/crashes uncleanly, bus- mastering will still be enabled and stale DMA addresses may be programmed and live in the device. Disable bus-mastering unconditionally on last close of a UIO PCI fd to avoid this. If the device did not have bus-mastering enabled, pci_clear_master() is a no-op. Signed-off-by: Venkatesh Srinivas Reviewed-by: Bjorn Helgaas Reviewed-by: Catherine Sullivan Acked-by: Michael S. Tsirkin Signed-off-by: Greg Kroah-Hartman

uio: remove redundant check

2019-01-22T11:03:16Z

It is not necessary to check idev->info several times under mutex lock, so just remove redundant check. Signed-off-by: Chengguang Xu Signed-off-by: Greg Kroah-Hartman

uio: fix potential memory leak in error case

2019-01-22T11:03:16Z

Should jump to lable err_infoopen when idev->info is NULL in uio_open(). Signed-off-by: Chengguang Xu Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2018-12-29T04:54:57Z

Pull char/misc driver updates from Greg KH: "Here is the big set of char and misc driver patches for 4.21-rc1. Lots of different types of driver things in here, as this tree seems to be the "collection of various driver subsystems not big enough to have their own git tree" lately. Anyway, some highlights of the changes in here: - binderfs: is it a rule that all driver subsystems will eventually grow to have their own filesystem? Binder now has one to handle the use of it in containerized systems. This was discussed at the Plumbers conference a few months ago and knocked into mergable shape very fast by Christian Brauner. Who also has signed up to be another binder maintainer, showing a distinct lack of good judgement :) - binder updates and fixes - mei driver updates - fpga driver updates and additions - thunderbolt driver updates - soundwire driver updates - extcon driver updates - nvmem driver updates - hyper-v driver updates - coresight driver updates - pvpanic driver additions and reworking for more device support - lp driver updates. Yes really, it's _finally_ moved to the proper parallal port driver model, something I never thought I would see happen. Good stuff. - other tiny driver updates and fixes. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (116 commits) MAINTAINERS: add another Android binder maintainer intel_th: msu: Fix an off-by-one in attribute store stm class: Add a reference to the SyS-T document stm class: Fix a module refcount leak in policy creation error path char: lp: use new parport device model char: lp: properly count the lp devices char: lp: use first unused lp number while registering char: lp: detach the device when parallel port is removed char: lp: introduce list to save port number bus: qcom: remove duplicated include from qcom-ebi2.c VMCI: Use memdup_user() rather than duplicating its implementation char/rtc: Use of_node_name_eq for node name comparisons misc: mic: fix a DMA pool free failure ptp: fix an IS_ERR() vs NULL check genwqe: Fix size check binder: implement binderfs binder: fix use-after-free due to ksys_close() during fdget() bus: fsl-mc: remove duplicated include files bus: fsl-mc: explicitly define the fsl_mc_command endianness misc: ti-st: make array read_ver_cmd static, shrinks object size ...

uio_hv_generic: set callbacks on open

2018-12-11T13:23:17Z

This fixes the problem where uio application was unable to use multple queues on restart. The root cause is that the callbacks are cleared on disconnect. Change to setting up callbacks everytime in open. Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") Reported-by: Mohammed Gamal Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman

uio: dismiss waiters on device unregistration

2018-11-27T10:19:10Z

When the device is unregistered, it should wake up the blocking waiters. Otherwise, they will sleep forever. Signed-off-by: Zhaolong Zhang Signed-off-by: Greg Kroah-Hartman

Merge 4.20-rc4 into char-misc-next

2018-11-26T06:50:56Z

We want the char/misc fixes in here as well. Signed-off-by: Greg Kroah-Hartman

uio: uio_fsl_elbc_gpcm: simplify getting .driver_data

2018-11-11T20:58:27Z

We should get 'driver_data' from 'struct device' directly. Going via platform_device is an unneeded step back and forth. Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman