1
linux/drivers/base
Christoph Hellwig e3a36eb6df driver code: clarify and fix platform device DMA mask allocation
This does three inter-related things to clarify the usage of the
platform device dma_mask field. In the process, fix the bug introduced
by cdfee56232 ("driver core: initialize a default DMA mask for
platform device") that caused Artem Tashkinov's laptop to not boot with
newer Fedora kernels.

This does:

 - First off, rename the field to "platform_dma_mask" to make it
   greppable.

   We have way too many different random fields called "dma_mask" in
   various data structures, where some of them are actual masks, and
   some of them are just pointers to the mask. And the structures all
   have pointers to each other, or embed each other inside themselves,
   and "pdev" sometimes means "platform device" and sometimes it means
   "PCI device".

   So to make it clear in the code when you actually use this new field,
   give it a unique name (it really should be something even more unique
   like "platform_device_dma_mask", since it's per platform device, not
   per platform, but that gets old really fast, and this is unique
   enough in context).

   To further clarify when the field gets used, initialize it when we
   actually start using it with the default value.

 - Then, use this field instead of the random one-off allocation in
   platform_device_register_full() that is now unnecessary since we now
   already have a perfectly fine allocation for it in the platform
   device structure.

 - The above then allows us to fix the actual bug, where the error path
   of platform_device_register_full() would unconditionally free the
   platform device DMA allocation with 'kfree()'.

   That kfree() was dont regardless of whether the allocation had been
   done earlier with the (now removed) kmalloc, or whether
   setup_pdev_dma_masks() had already been used and the dma_mask pointer
   pointed to the mask that was part of the platform device.

It seems most people never triggered the error path, or only triggered
it from a call chain that set an explicit pdevinfo->dma_mask value (and
thus caused the unnecessary allocation that was "cleaned up" in the
error path) before calling platform_device_register_full().

Robin Murphy points out that in Artem's case the wdat_wdt driver failed
in platform_device_add(), and that was the one that had called
platform_device_register_full() with pdevinfo.dma_mask = 0, and would
have caused that kfree() of pdev.dma_mask corrupting the heap.

A later unrelated kmalloc() then oopsed due to the heap corruption.

Fixes: cdfee56232 ("driver core: initialize a default DMA mask for platform device")
Reported-bisected-and-tested-by:  Artem S. Tashkinov <aros@gmx.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-03-11 09:30:27 -07:00
..
firmware_loader Driver core changes for 5.6-rc1 2020-01-29 10:18:20 -08:00
power ARM: SoC-related driver updates 2020-02-08 14:04:19 -08:00
regmap regmap: fix writes to non incrementing registers 2020-01-21 17:16:26 +00:00
test Driver core changes for 5.6-rc1 2020-01-29 10:18:20 -08:00
arch_topology.c cpu-topology: Don't error on more than CONFIG_NR_CPUS CPUs in device tree 2020-01-17 15:21:49 +01:00
attribute_container.c scsi: drivers: base: Support atomic version of attribute_container_device_trigger 2020-01-15 22:55:36 -05:00
base.h device.h: move devtmpfs prototypes out of the file 2019-12-16 10:10:18 +01:00
bus.c device.h: move 'struct bus' stuff out to device/bus.h 2019-12-16 10:11:12 +01:00
cacheinfo.c
class.c device.h: move 'struct class' stuff out to device/class.h 2019-12-16 10:11:14 +01:00
component.c component: do not dereference opaque pointer in debugfs 2020-01-14 16:10:14 +01:00
container.c
core.c driver core: Skip unnecessary work when device doesn't have sync_state() 2020-03-04 13:46:03 +01:00
cpu.c x86/bugs: Add ITLB_MULTIHIT bug infrastructure 2019-11-04 12:22:01 +01:00
dd.c driver core: Print device when resources present in really_probe() 2020-01-14 16:14:48 +01:00
devcon.c
devcoredump.c
devres.c
devtmpfs.c Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-02-08 13:26:41 -08:00
driver.c device.h: move 'struct driver' stuff out to device/driver.h 2019-12-16 10:11:16 +01:00
firmware.c
hypervisor.c
init.c
isa.c
Kconfig kunit: building kunit as a module breaks allmodconfig 2020-01-10 14:36:37 -07:00
Makefile
map.c
memory.c mm/memory_hotplug: drop valid_start/valid_end from test_pages_in_a_zone() 2020-02-04 03:05:23 +00:00
module.c
node.c mm/vmstat: add helpers to get vmstat item names for each enum type 2019-12-04 19:44:11 -08:00
pinctrl.c
platform-msi.c
platform.c driver code: clarify and fix platform device DMA mask allocation 2020-03-11 09:30:27 -07:00
property.c
soc.c
swnode.c Revert "software node: Simplify software_node_release() function" 2020-03-04 22:31:44 +01:00
syscore.c
topology.c
transport_class.c scsi: drivers: base: Propagate errors through the transport component 2020-01-15 22:55:37 -05:00