mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path.

mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path. If a failure
occurs then the "req" struct is freed but it's still on the list,
leading to a use after free.

Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

show more ...

mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]

The "req" struct is always added to the "wm831x->auxadc_pending"

mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]

The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path. If a failure
occurs then the "req" struct is freed but it's still on the list,
leading to a use after free.

Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of th

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 3029 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mfd: wm831x-auxadc: Pass the IRQF_ONESHOT flag

Since commit 1c6c69525b40eb76de8adf039409722015927dc3 ("genirq: Reject
bogus threaded irq requests") threaded IRQs without a primary handler
need to be

mfd: wm831x-auxadc: Pass the IRQF_ONESHOT flag

Since commit 1c6c69525b40eb76de8adf039409722015927dc3 ("genirq: Reject
bogus threaded irq requests") threaded IRQs without a primary handler
need to be requested with IRQF_ONESHOT, otherwise the request will fail.

So pass the IRQF_ONESHOT flag in this case.

The semantic patch that makes this change is available
in scripts/coccinelle/misc/irqf_oneshot.cocci.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

show more ...

mfd: Convert wm831x to irq_domain

The modern idiom is to use irq_domain to allocate interrupts. This is
useful partly to allow further infrastructure to be based on the domains
and partly because it

mfd: Convert wm831x to irq_domain

The modern idiom is to use irq_domain to allocate interrupts. This is
useful partly to allow further infrastructure to be based on the domains
and partly because it makes it much easier to allocate virtual interrupts
to devices as we don't need to allocate a contiguous range of interrupt
numbers.

Convert the wm831x driver over to this infrastructure, using a legacy
IRQ mapping if an irq_base is specified in platform data and otherwise
using a linear mapping, always registering the interrupts even if they
won't ever be used. Only boards which need to use the GPIOs as
interrupts should need to use an irq_base.

This means that we can't use the MFD irq_base management since the
unless we're using an explicit irq_base from platform data we can't rely
on a linear mapping of interrupts. Instead we need to map things via
the irq_domain - provide a conveniencem function wm831x_irq() to save a
small amount of typing when doing so. Looking at this I couldn't clearly
see anything the MFD core could do to make this nicer.

Since we're not supporting device tree yet there's no meaningful
advantage if we don't do this conversion in one, the fact that the
interrupt resources are used for repeated IP blocks makes accessor
functions for the irq_domain more trouble to do than they're worth.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

show more ...

mfd: Support multiple active WM831x AUXADC conversions

The WM831x AUXADC hardware can schedule multiple conversions at once,
allowing higher performance when more than one source is in use as we
can

mfd: Support multiple active WM831x AUXADC conversions

The WM831x AUXADC hardware can schedule multiple conversions at once,
allowing higher performance when more than one source is in use as we
can have the hardware start new conversions without having to wait for
a register write.

Take advantage of this in the interrupt driven case, maintaining a list of
callers that are waiting for AUXADC conversions and completing them all
simultaneously. The external interface of the AUXADC is not changed so
there will be limited use of the feature immediately.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

show more ...

mfd: Refactor wm831x AUXADC handling into a separate file

In preparation for some additional work on the wm831x AUXADC code move the
support into a separate file. This is a simple code motion patch,

mfd: Refactor wm831x AUXADC handling into a separate file

In preparation for some additional work on the wm831x AUXADC code move the
support into a separate file. This is a simple code motion patch, there
should be no functional changes.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

show more ...

mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]

The "req" struct is always added to the "wm831x->

mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()

[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]

The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path. If a failure
occurs then the "req" struct is freed but it's still on the list,
leading to a use after free.

Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it u

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 3029 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mfd: wm831x-auxadc: Pass the IRQF_ONESHOT flag

Since commit 1c6c69525b40eb76de8adf039409722015927dc3 ("genirq: Reject
bogus threaded irq requests") threaded IRQs without a primary handle

mfd: wm831x-auxadc: Pass the IRQF_ONESHOT flag

Since commit 1c6c69525b40eb76de8adf039409722015927dc3 ("genirq: Reject
bogus threaded irq requests") threaded IRQs without a primary handler
need to be requested with IRQF_ONESHOT, otherwise the request will fail.

So pass the IRQF_ONESHOT flag in this case.

The semantic patch that makes this change is available
in scripts/coccinelle/misc/irqf_oneshot.cocci.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

show more ...

mfd: Convert wm831x to irq_domain

The modern idiom is to use irq_domain to allocate interrupts. This is
useful partly to allow further infrastructure to be based on the domains
and p

mfd: Convert wm831x to irq_domain

The modern idiom is to use irq_domain to allocate interrupts. This is
useful partly to allow further infrastructure to be based on the domains
and partly because it makes it much easier to allocate virtual interrupts
to devices as we don't need to allocate a contiguous range of interrupt
numbers.

Convert the wm831x driver over to this infrastructure, using a legacy
IRQ mapping if an irq_base is specified in platform data and otherwise
using a linear mapping, always registering the interrupts even if they
won't ever be used. Only boards which need to use the GPIOs as
interrupts should need to use an irq_base.

This means that we can't use the MFD irq_base management since the
unless we're using an explicit irq_base from platform data we can't rely
on a linear mapping of interrupts. Instead we need to map things via
the irq_domain - provide a conveniencem function wm831x_irq() to save a
small amount of typing when doing so. Looking at this I couldn't clearly
see anything the MFD core could do to make this nicer.

Since we're not supporting device tree yet there's no meaningful
advantage if we don't do this conversion in one, the fact that the
interrupt resources are used for repeated IP blocks makes accessor
functions for the irq_domain more trouble to do than they're worth.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

show more ...

mfd: Support multiple active WM831x AUXADC conversions

The WM831x AUXADC hardware can schedule multiple conversions at once,
allowing higher performance when more than one source is in u

mfd: Support multiple active WM831x AUXADC conversions

The WM831x AUXADC hardware can schedule multiple conversions at once,
allowing higher performance when more than one source is in use as we
can have the hardware start new conversions without having to wait for
a register write.

Take advantage of this in the interrupt driven case, maintaining a list of
callers that are waiting for AUXADC conversions and completing them all
simultaneously. The external interface of the AUXADC is not changed so
there will be limited use of the feature immediately.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

show more ...

mfd: Refactor wm831x AUXADC handling into a separate file

In preparation for some additional work on the wm831x AUXADC code move the
support into a separate file. This is a simple code m

mfd: Refactor wm831x AUXADC handling into a separate file

In preparation for some additional work on the wm831x AUXADC code move the
support into a separate file. This is a simple code motion patch, there
should be no functional changes.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

show more ...