Skip to contentSkip to conversation

nvmem: fixes for 7.1

PATCH New [email protected] 1 participant 3 messages May 30

Subsystems (3)
Stable branch NVMEM framework Onie tlv NVMEM layout driver
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

cover nvmem: fixes for 7.1

From: Srinivas Kandagatla <[email protected]>

Hi Greg,
Here are some fixes in nvmem which can go for 7.1 release Could you please queue these as 7.1 material.

Fixes include
- a use-after fix bug fix
- fix hang in onie-tlv

Thanks for all the help,
Srini

Andre Heider (1):
nvmem: layouts: onie-tlv: fix hang on unknown types

Bartosz Golaszewski (1):
nvmem: core: fix use-after-free bugs in error paths

 drivers/nvmem/core.c             | 12 +++++-------
 drivers/nvmem/layouts/onie-tlv.c |  3 ++-
 2 files changed, 7 insertions(+), 8 deletions(-)
Signature · 1 line
2.53.0
author maintainer
#1 lore raw

PATCH 1/2 nvmem: layouts: onie-tlv: fix hang on unknown types

From: Andre Heider <[email protected]>

The EEPROM on my board has a vendor specific entry of type 0x41. When stumbling upon that, this driver hangs in an endless loop.

Fix it by keep incrementing the offset on unknown entries, so the loop will eventually stop.

Fixes d3c0d12f6474 ("nvmem: layouts: onie-tlv: Add new layout driver")
Cc [email protected]
Signed-off-by Andre Heider <[email protected]>
Reviewed-by Miquel Raynal <[email protected]>
Signed-off-by Srinivas Kandagatla <[email protected]>
---
 drivers/nvmem/layouts/onie-tlv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvmem/layouts/onie-tlv.c +2 -1
index 0967a32319a2..8b0f3c1b8a0e 100644
@@ -119,7 +119,7 @@ static int onie_tlv_add_cells(struct device *dev, struct nvmem_device *nvmem,
 
 		cell.name = onie_tlv_cell_name(tlv.type);
 		if (!cell.name)
-			continue;
+			goto next;
 
 		cell.offset = hdr_len + offset + sizeof(tlv.type) + sizeof(tlv.len);
 		cell.bytes = tlv.len;

@@ -132,6 +132,7 @@ static int onie_tlv_add_cells(struct device *dev, struct nvmem_device *nvmem,
 			return ret;
 		}
 
+next:
 		offset += sizeof(tlv) + tlv.len;
 	}
Signature · 1 line
2.53.0
author maintainer
#2 lore raw

PATCH 2/2 nvmem: core: fix use-after-free bugs in error paths

In reply to [email protected]

From: Bartosz Golaszewski <[email protected]>

Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error code.

Cc [email protected]
Fixes 7ae6478b304b ("nvmem: core: rework nvmem cell instance creation")
Fixes e888d445ac33 ("nvmem: resolve cells from DT at registration time")
Signed-off-by Bartosz Golaszewski <[email protected]>
Signed-off-by Srinivas Kandagatla <[email protected]>
---
 drivers/nvmem/core.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/nvmem/core.c +5 -7
index 311cb2e5a5c0..e871181751f3 100644
@@ -1468,18 +1468,16 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
 	cell_entry = nvmem_find_cell_entry_by_node(nvmem, cell_np);
 	of_node_put(cell_np);
 	if (!cell_entry) {
-		__nvmem_device_put(nvmem);
 		nvmem_layout_module_put(nvmem);
-		if (nvmem->layout)
-			return ERR_PTR(-EPROBE_DEFER);
-		else
-			return ERR_PTR(-ENOENT);
+		ret = nvmem->layout ? -EPROBE_DEFER : -ENOENT;
+		__nvmem_device_put(nvmem);
+		return ERR_PTR(ret);
 	}
 
 	cell = nvmem_create_cell(cell_entry, id, cell_index);
 	if (IS_ERR(cell)) {
-		__nvmem_device_put(nvmem);
 		nvmem_layout_module_put(nvmem);
+		__nvmem_device_put(nvmem);
 	}
 
 	return cell;

@@ -1593,8 +1591,8 @@ void nvmem_cell_put(struct nvmem_cell *cell)
 		kfree_const(cell->id);
 
 	kfree(cell);
-	__nvmem_device_put(nvmem);
 	nvmem_layout_module_put(nvmem);
+	__nvmem_device_put(nvmem);
 }
 EXPORT_SYMBOL_GPL(nvmem_cell_put);
Signature · 1 line
2.53.0