Revision 4e43e64d0f1332fcc503babad4dc31aead7131ca authored by Eric Dumazet on 28 June 2022, 12:12:48 UTC, committed by Jakub Kicinski on 30 June 2022, 03:41:09 UTC
As reported by syzbot, we should not use rcu_dereference() when rcu_read_lock() is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller #0 Not tainted net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor326/3617: #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223 stack backtrace: CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175 inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300 netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380 netlink_dump_start include/linux/netlink.h:245 [inline] rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Taehee Yoo <ap420073@gmail.com> Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent fa152f6
gpio-raspberrypi-exp.c
// SPDX-License-Identifier: GPL-2.0+
/*
* Raspberry Pi 3 expander GPIO driver
*
* Uses the firmware mailbox service to communicate with the
* GPIO expander on the VPU.
*
* Copyright (C) 2017 Raspberry Pi Trading Ltd.
*/
#include <linux/err.h>
#include <linux/gpio/driver.h>
#include <linux/module.h>
#include <linux/platform_device.h>
#include <soc/bcm2835/raspberrypi-firmware.h>
#define MODULE_NAME "raspberrypi-exp-gpio"
#define NUM_GPIO 8
#define RPI_EXP_GPIO_BASE 128
#define RPI_EXP_GPIO_DIR_IN 0
#define RPI_EXP_GPIO_DIR_OUT 1
struct rpi_exp_gpio {
struct gpio_chip gc;
struct rpi_firmware *fw;
};
/* VC4 firmware mailbox interface data structures */
struct gpio_set_config {
u32 gpio;
u32 direction;
u32 polarity;
u32 term_en;
u32 term_pull_up;
u32 state;
};
struct gpio_get_config {
u32 gpio;
u32 direction;
u32 polarity;
u32 term_en;
u32 term_pull_up;
};
struct gpio_get_set_state {
u32 gpio;
u32 state;
};
static int rpi_exp_gpio_get_polarity(struct gpio_chip *gc, unsigned int off)
{
struct rpi_exp_gpio *gpio;
struct gpio_get_config get;
int ret;
gpio = gpiochip_get_data(gc);
get.gpio = off + RPI_EXP_GPIO_BASE; /* GPIO to update */
ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_CONFIG,
&get, sizeof(get));
if (ret || get.gpio != 0) {
dev_err(gc->parent, "Failed to get GPIO %u config (%d %x)\n",
off, ret, get.gpio);
return ret ? ret : -EIO;
}
return get.polarity;
}
static int rpi_exp_gpio_dir_in(struct gpio_chip *gc, unsigned int off)
{
struct rpi_exp_gpio *gpio;
struct gpio_set_config set_in;
int ret;
gpio = gpiochip_get_data(gc);
set_in.gpio = off + RPI_EXP_GPIO_BASE; /* GPIO to update */
set_in.direction = RPI_EXP_GPIO_DIR_IN;
set_in.term_en = 0; /* termination disabled */
set_in.term_pull_up = 0; /* n/a as termination disabled */
set_in.state = 0; /* n/a as configured as an input */
ret = rpi_exp_gpio_get_polarity(gc, off);
if (ret < 0)
return ret;
set_in.polarity = ret; /* Retain existing setting */
ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_CONFIG,
&set_in, sizeof(set_in));
if (ret || set_in.gpio != 0) {
dev_err(gc->parent, "Failed to set GPIO %u to input (%d %x)\n",
off, ret, set_in.gpio);
return ret ? ret : -EIO;
}
return 0;
}
static int rpi_exp_gpio_dir_out(struct gpio_chip *gc, unsigned int off, int val)
{
struct rpi_exp_gpio *gpio;
struct gpio_set_config set_out;
int ret;
gpio = gpiochip_get_data(gc);
set_out.gpio = off + RPI_EXP_GPIO_BASE; /* GPIO to update */
set_out.direction = RPI_EXP_GPIO_DIR_OUT;
set_out.term_en = 0; /* n/a as an output */
set_out.term_pull_up = 0; /* n/a as termination disabled */
set_out.state = val; /* Output state */
ret = rpi_exp_gpio_get_polarity(gc, off);
if (ret < 0)
return ret;
set_out.polarity = ret; /* Retain existing setting */
ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_CONFIG,
&set_out, sizeof(set_out));
if (ret || set_out.gpio != 0) {
dev_err(gc->parent, "Failed to set GPIO %u to output (%d %x)\n",
off, ret, set_out.gpio);
return ret ? ret : -EIO;
}
return 0;
}
static int rpi_exp_gpio_get_direction(struct gpio_chip *gc, unsigned int off)
{
struct rpi_exp_gpio *gpio;
struct gpio_get_config get;
int ret;
gpio = gpiochip_get_data(gc);
get.gpio = off + RPI_EXP_GPIO_BASE; /* GPIO to update */
ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_CONFIG,
&get, sizeof(get));
if (ret || get.gpio != 0) {
dev_err(gc->parent,
"Failed to get GPIO %u config (%d %x)\n", off, ret,
get.gpio);
return ret ? ret : -EIO;
}
if (get.direction)
return GPIO_LINE_DIRECTION_OUT;
return GPIO_LINE_DIRECTION_IN;
}
static int rpi_exp_gpio_get(struct gpio_chip *gc, unsigned int off)
{
struct rpi_exp_gpio *gpio;
struct gpio_get_set_state get;
int ret;
gpio = gpiochip_get_data(gc);
get.gpio = off + RPI_EXP_GPIO_BASE; /* GPIO to update */
get.state = 0; /* storage for returned value */
ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_STATE,
&get, sizeof(get));
if (ret || get.gpio != 0) {
dev_err(gc->parent,
"Failed to get GPIO %u state (%d %x)\n", off, ret,
get.gpio);
return ret ? ret : -EIO;
}
return !!get.state;
}
static void rpi_exp_gpio_set(struct gpio_chip *gc, unsigned int off, int val)
{
struct rpi_exp_gpio *gpio;
struct gpio_get_set_state set;
int ret;
gpio = gpiochip_get_data(gc);
set.gpio = off + RPI_EXP_GPIO_BASE; /* GPIO to update */
set.state = val; /* Output state */
ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_STATE,
&set, sizeof(set));
if (ret || set.gpio != 0)
dev_err(gc->parent,
"Failed to set GPIO %u state (%d %x)\n", off, ret,
set.gpio);
}
static int rpi_exp_gpio_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct device_node *np = dev->of_node;
struct device_node *fw_node;
struct rpi_firmware *fw;
struct rpi_exp_gpio *rpi_gpio;
fw_node = of_get_parent(np);
if (!fw_node) {
dev_err(dev, "Missing firmware node\n");
return -ENOENT;
}
fw = devm_rpi_firmware_get(&pdev->dev, fw_node);
of_node_put(fw_node);
if (!fw)
return -EPROBE_DEFER;
rpi_gpio = devm_kzalloc(dev, sizeof(*rpi_gpio), GFP_KERNEL);
if (!rpi_gpio)
return -ENOMEM;
rpi_gpio->fw = fw;
rpi_gpio->gc.parent = dev;
rpi_gpio->gc.label = MODULE_NAME;
rpi_gpio->gc.owner = THIS_MODULE;
rpi_gpio->gc.base = -1;
rpi_gpio->gc.ngpio = NUM_GPIO;
rpi_gpio->gc.direction_input = rpi_exp_gpio_dir_in;
rpi_gpio->gc.direction_output = rpi_exp_gpio_dir_out;
rpi_gpio->gc.get_direction = rpi_exp_gpio_get_direction;
rpi_gpio->gc.get = rpi_exp_gpio_get;
rpi_gpio->gc.set = rpi_exp_gpio_set;
rpi_gpio->gc.can_sleep = true;
return devm_gpiochip_add_data(dev, &rpi_gpio->gc, rpi_gpio);
}
static const struct of_device_id rpi_exp_gpio_ids[] = {
{ .compatible = "raspberrypi,firmware-gpio" },
{ }
};
MODULE_DEVICE_TABLE(of, rpi_exp_gpio_ids);
static struct platform_driver rpi_exp_gpio_driver = {
.driver = {
.name = MODULE_NAME,
.of_match_table = of_match_ptr(rpi_exp_gpio_ids),
},
.probe = rpi_exp_gpio_probe,
};
module_platform_driver(rpi_exp_gpio_driver);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.org>");
MODULE_DESCRIPTION("Raspberry Pi 3 expander GPIO driver");
MODULE_ALIAS("platform:rpi-exp-gpio");
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...