Skip to content

Commit

Permalink
Merge tag 'char-misc-6.11-rc4' of git://git.kernel.org/pub/scm/linux/…
Browse files Browse the repository at this point in the history 
…kernel/git/gregkh/char-misc

Pull char / misc fixes from Greg KH:
 "Here are some small char/misc fixes for 6.11-rc4 to resolve reported
  problems. Included in here are:

   - fastrpc revert of a change that broke userspace

   - xillybus fixes for reported issues

  Half of these have been in linux-next this week with no reported
  problems, I don't know if the last bit of xillybus driver changes made
  it in, but they are 'obviously correct' so will be safe :)"

* tag 'char-misc-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  char: xillybus: Check USB endpoints when probing device
  char: xillybus: Refine workqueue handling
  Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
  char: xillybus: Don't destroy workqueue from work item running on it
  • Loading branch information
@torvalds
torvalds committed Aug 18, 2024
2 parents 394f33f + 2374bf7 commit e1bc113
Show file tree
Hide file tree
Showing 3 changed files with 37 additions and 30 deletions.
42 changes: 34 additions & 8 deletions drivers/char/xillybus/xillyusb.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ MODULE_LICENSE("GPL v2");
static const char xillyname[] = "xillyusb";

static unsigned int fifo_buf_order;
static struct workqueue_struct *wakeup_wq;

#define USB_VENDOR_ID_XILINX 0x03fd
#define USB_VENDOR_ID_ALTERA 0x09fb
Expand Down Expand Up @@ -569,10 +570,6 @@ static void cleanup_dev(struct kref *kref)
* errors if executed. The mechanism relies on that xdev->error is assigned
* a non-zero value by report_io_error() prior to queueing wakeup_all(),
* which prevents bulk_in_work() from calling process_bulk_in().
*
* The fact that wakeup_all() and bulk_in_work() are queued on the same
* workqueue makes their concurrent execution very unlikely, however the
* kernel's API doesn't seem to ensure this strictly.
*/

static void wakeup_all(struct work_struct *work)
Expand Down Expand Up @@ -627,7 +624,7 @@ static void report_io_error(struct xillyusb_dev *xdev,

if (do_once) {
kref_get(&xdev->kref); /* xdev is used by work item */
queue_work(xdev->workq, &xdev->wakeup_workitem);
queue_work(wakeup_wq, &xdev->wakeup_workitem);
}
}

Expand Down Expand Up @@ -1906,6 +1903,13 @@ static const struct file_operations xillyusb_fops = {

static int xillyusb_setup_base_eps(struct xillyusb_dev *xdev)
{
struct usb_device *udev = xdev->udev;

/* Verify that device has the two fundamental bulk in/out endpoints */
if (usb_pipe_type_check(udev, usb_sndbulkpipe(udev, MSG_EP_NUM)) ||
usb_pipe_type_check(udev, usb_rcvbulkpipe(udev, IN_EP_NUM)))
return -ENODEV;

xdev->msg_ep = endpoint_alloc(xdev, MSG_EP_NUM | USB_DIR_OUT,
bulk_out_work, 1, 2);
if (!xdev->msg_ep)
Expand Down Expand Up @@ -1935,14 +1939,15 @@ static int setup_channels(struct xillyusb_dev *xdev,
__le16 *chandesc,
int num_channels)
{
struct xillyusb_channel *chan;
struct usb_device *udev = xdev->udev;
struct xillyusb_channel *chan, *new_channels;
int i;

chan = kcalloc(num_channels, sizeof(*chan), GFP_KERNEL);
if (!chan)
return -ENOMEM;

xdev->channels = chan;
new_channels = chan;

for (i = 0; i < num_channels; i++, chan++) {
unsigned int in_desc = le16_to_cpu(*chandesc++);
Expand Down Expand Up @@ -1971,6 +1976,15 @@ static int setup_channels(struct xillyusb_dev *xdev,
*/

if ((out_desc & 0x80) && i < 14) { /* Entry is valid */
if (usb_pipe_type_check(udev,
usb_sndbulkpipe(udev, i + 2))) {
dev_err(xdev->dev,
"Missing BULK OUT endpoint %d\n",
i + 2);
kfree(new_channels);
return -ENODEV;
}

chan->writable = 1;
chan->out_synchronous = !!(out_desc & 0x40);
chan->out_seekable = !!(out_desc & 0x20);
Expand All @@ -1980,6 +1994,7 @@ static int setup_channels(struct xillyusb_dev *xdev,
}
}

xdev->channels = new_channels;
return 0;
}

Expand Down Expand Up @@ -2096,9 +2111,11 @@ static int xillyusb_discovery(struct usb_interface *interface)
* just after responding with the IDT, there is no reason for any
* work item to be running now. To be sure that xdev->channels
* is updated on anything that might run in parallel, flush the
* workqueue, which rarely does anything.
* device's workqueue and the wakeup work item. This rarely
* does anything.
*/
flush_workqueue(xdev->workq);
flush_work(&xdev->wakeup_workitem);

xdev->num_channels = num_channels;

Expand Down Expand Up @@ -2258,19 +2275,28 @@ static int __init xillyusb_init(void)
{
int rc = 0;

wakeup_wq = alloc_workqueue(xillyname, 0, 0);
if (!wakeup_wq)
return -ENOMEM;

if (LOG2_INITIAL_FIFO_BUF_SIZE > PAGE_SHIFT)
fifo_buf_order = LOG2_INITIAL_FIFO_BUF_SIZE - PAGE_SHIFT;
else
fifo_buf_order = 0;

rc = usb_register(&xillyusb_driver);

if (rc)
destroy_workqueue(wakeup_wq);

return rc;
}

static void __exit xillyusb_exit(void)
{
usb_deregister(&xillyusb_driver);

destroy_workqueue(wakeup_wq);
}

module_init(xillyusb_init);
Expand Down
22 changes: 3 additions & 19 deletions drivers/misc/fastrpc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2085,16 +2085,6 @@ static int fastrpc_req_mem_map(struct fastrpc_user *fl, char __user *argp)
return err;
}

static int is_attach_rejected(struct fastrpc_user *fl)
{
/* Check if the device node is non-secure */
if (!fl->is_secure_dev) {
dev_dbg(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n");
return -EACCES;
}
return 0;
}

static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
{
Expand All @@ -2107,19 +2097,13 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
err = fastrpc_invoke(fl, argp);
break;
case FASTRPC_IOCTL_INIT_ATTACH:
err = is_attach_rejected(fl);
if (!err)
err = fastrpc_init_attach(fl, ROOT_PD);
err = fastrpc_init_attach(fl, ROOT_PD);
break;
case FASTRPC_IOCTL_INIT_ATTACH_SNS:
err = is_attach_rejected(fl);
if (!err)
err = fastrpc_init_attach(fl, SENSORS_PD);
err = fastrpc_init_attach(fl, SENSORS_PD);
break;
case FASTRPC_IOCTL_INIT_CREATE_STATIC:
err = is_attach_rejected(fl);
if (!err)
err = fastrpc_init_create_static_process(fl, argp);
err = fastrpc_init_create_static_process(fl, argp);
break;
case FASTRPC_IOCTL_INIT_CREATE:
err = fastrpc_init_create_process(fl, argp);
Expand Down
3 changes: 0 additions & 3 deletions include/uapi/misc/fastrpc.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,11 @@
#define FASTRPC_IOCTL_ALLOC_DMA_BUFF _IOWR('R', 1, struct fastrpc_alloc_dma_buf)
#define FASTRPC_IOCTL_FREE_DMA_BUFF _IOWR('R', 2, __u32)
#define FASTRPC_IOCTL_INVOKE _IOWR('R', 3, struct fastrpc_invoke)
/* This ioctl is only supported with secure device nodes */
#define FASTRPC_IOCTL_INIT_ATTACH _IO('R', 4)
#define FASTRPC_IOCTL_INIT_CREATE _IOWR('R', 5, struct fastrpc_init_create)
#define FASTRPC_IOCTL_MMAP _IOWR('R', 6, struct fastrpc_req_mmap)
#define FASTRPC_IOCTL_MUNMAP _IOWR('R', 7, struct fastrpc_req_munmap)
/* This ioctl is only supported with secure device nodes */
#define FASTRPC_IOCTL_INIT_ATTACH_SNS _IO('R', 8)
/* This ioctl is only supported with secure device nodes */
#define FASTRPC_IOCTL_INIT_CREATE_STATIC _IOWR('R', 9, struct fastrpc_init_create_static)
#define FASTRPC_IOCTL_MEM_MAP _IOWR('R', 10, struct fastrpc_mem_map)
#define FASTRPC_IOCTL_MEM_UNMAP _IOWR('R', 11, struct fastrpc_mem_unmap)
Expand Down

0 comments on commit e1bc113

Please sign in to comment.