colin
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sh updates for v6.6 

- sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
 - sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEYv+KdYTgKVaVRgAGdCY7N/W1+RMFAmT8zzIACgkQdCY7N/W1
 +RNmHhAAxp8Hme2NiDlhoZkYj7I2WOzKcHmAxD2Ss+pLWwwoo9g1DgD/7aOuQu2m
 lkeI3+b1xaRQY1quSVvEzbuIzeKvBnzBT1utceITaH9AKJ8ffha4OHgO4LMBCH3A
 UGWPK/Yp+KuAPjFvmvY6jZvEluLWQWLAFc0Gxs8thxR09TjEhAhMCvK+YAYe6GVe
 uFhFklBNkCbcR/TelhFXPscrTUfQQtM1VjLNuj6Uh1G5gMDBPSiCJVGobnAtJOdq
 cVZG8oUAT6UUl6d6hDSucv0APS5bpWYJBfXBlwopOokA+uKZOAT75mf3WwOLperT
 l2HQzvFamP3p1thqrUyqsLq6i0DtP0Aaa+M5lHqM6yX+H0mEmBD6JXhCL/Ka7g2/
 ezA5LZTmfOlcXb4zAmORZA7jp8/KH7q1bfGARV79jHOZ+unUQ4aHufo7+hw+WMO3
 nwELWLBGuCn/Gd8bNTHSPHCY2hiWep4eFSqpevI+JQGJ8/Jvpo7WdllZ1BqZ9bpB
 yhABvKt+bBLfXElG7kH1ctBVaAubWai7bBvF/ASIC08dceP2SbYojj/msZOz0SsM
 gGUMrXM7jZ/jEsWuDd5uOFs+QupA1HhDtcF1KRFx6o4//EDOn2g/0rB+GVaSCcI0
 mddhtvRWjYRO9po8IAnprH+qU67ZWy5ouZ6U0/i2FL8E/rNoHfk=
 =sNwf
 -----END PGP SIGNATURE-----

Merge tag 'sh-for-v6.6-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux

Pull sh updates from Adrian Glaubitz:

 - Fix a use-after-free bug in the push-switch driver (Duoming Zhou)

 - Fix calls to dma_declare_coherent_memory() that incorrectly passed
   the buffer end address instead of the buffer size as the size
   parameter

* tag 'sh-for-v6.6-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux:
  sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
  sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
This commit is contained in:
Linus Torvalds 2023-09-09 14:46:57 -07:00
parent 1b37a0a2d4 246f80a0b1
commit 6b8bb5b8d9
6 changed files with 8 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
arch/sh/boards/mach-ap325rxa/setup.c
View File

@ -531,7 +531,7 @@ static int __init ap325rxa_devices_setup(void)
device_initialize(&ap325rxa_ceu_device.dev);
dma_declare_coherent_memory(&ap325rxa_ceu_device.dev,
ceu_dma_membase, ceu_dma_membase,
ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(&ap325rxa_ceu_device);

6
arch/sh/boards/mach-ecovec24/setup.c
View File

@ -1454,15 +1454,13 @@ static int __init arch_setup(void)
device_initialize(&ecovec_ceu_devices[0]->dev);
dma_declare_coherent_memory(&ecovec_ceu_devices[0]->dev,
ceu0_dma_membase, ceu0_dma_membase,
ceu0_dma_membase +
CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ecovec_ceu_devices[0]);
device_initialize(&ecovec_ceu_devices[1]->dev);
dma_declare_coherent_memory(&ecovec_ceu_devices[1]->dev,
ceu1_dma_membase, ceu1_dma_membase,
ceu1_dma_membase +
CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ecovec_ceu_devices[1]);
gpiod_add_lookup_table(&cn12_power_gpiod_table);

2
arch/sh/boards/mach-kfr2r09/setup.c
View File

@ -603,7 +603,7 @@ static int __init kfr2r09_devices_setup(void)
device_initialize(&kfr2r09_ceu_device.dev);
dma_declare_coherent_memory(&kfr2r09_ceu_device.dev,
ceu_dma_membase, ceu_dma_membase,
ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(&kfr2r09_ceu_device);

2
arch/sh/boards/mach-migor/setup.c
View File

@ -604,7 +604,7 @@ static int __init migor_devices_setup(void)
device_initialize(&migor_ceu_device.dev);
dma_declare_coherent_memory(&migor_ceu_device.dev,
ceu_dma_membase, ceu_dma_membase,
ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(&migor_ceu_device);

6
arch/sh/boards/mach-se/7724/setup.c
View File

@ -940,15 +940,13 @@ static int __init devices_setup(void)
device_initialize(&ms7724se_ceu_devices[0]->dev);
dma_declare_coherent_memory(&ms7724se_ceu_devices[0]->dev,
ceu0_dma_membase, ceu0_dma_membase,
ceu0_dma_membase +
CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ms7724se_ceu_devices[0]);
device_initialize(&ms7724se_ceu_devices[1]->dev);
dma_declare_coherent_memory(&ms7724se_ceu_devices[1]->dev,
ceu1_dma_membase, ceu1_dma_membase,
ceu1_dma_membase +
CEU_BUFFER_MEMORY_SIZE - 1);
CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ms7724se_ceu_devices[1]);
return platform_add_devices(ms7724se_devices,

2
arch/sh/drivers/push-switch.c
View File

@ -101,8 +101,8 @@ static int switch_drv_remove(struct platform_device *pdev)
device_remove_file(&pdev->dev, &dev_attr_switch);
platform_set_drvdata(pdev, NULL);
flush_work(&psw->work);
timer_shutdown_sync(&psw->debounce);
flush_work(&psw->work);
free_irq(irq, pdev);
kfree(psw);