Re: [PATCH 5.10.y] pps: Fix a use-after-free

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

Found matching upstream commit: c79a39dc8d060b9e64e8b0fa9d245d44befeefbe


Status in newer kernel trees:
6.13.y | Present (different SHA1: d487d68916ad)
6.12.y | Present (different SHA1: 2423d77f7ee9)
6.6.y | Present (different SHA1: 73f8d5a93c8f)
6.1.y | Not found
5.15.y | Not found
5.10.y | Not found

Note: The patch differs from the upstream commit:
---
1:  c79a39dc8d060 ! 1:  4ded4bb10e446 pps: Fix a use-after-free
    @@ Commit message
         Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
         Link: https://lore.kernel.org/r/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org
         Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    +    (cherry picked from commit c79a39dc8d060b9e64e8b0fa9d245d44befeefbe)
    +    Signed-off-by: Calvin Owens <calvin@wbinvd.org>
     
      ## drivers/pps/clients/pps-gpio.c ##
     @@ drivers/pps/clients/pps-gpio.c: static int pps_gpio_probe(struct platform_device *pdev)
    @@ drivers/pps/clients/pps-ktimer.c: static int __init pps_ktimer_init(void)
      }
     
      ## drivers/pps/clients/pps-ldisc.c ##
    -@@ drivers/pps/clients/pps-ldisc.c: static void pps_tty_dcd_change(struct tty_struct *tty, bool active)
    - 	pps_event(pps, &ts, active ? PPS_CAPTUREASSERT :
    +@@ drivers/pps/clients/pps-ldisc.c: static void pps_tty_dcd_change(struct tty_struct *tty, unsigned int status)
    + 	pps_event(pps, &ts, status ? PPS_CAPTUREASSERT :
      			PPS_CAPTURECLEAR, NULL);
      
     -	dev_dbg(pps->dev, "PPS %s at %lu\n",
     +	dev_dbg(&pps->dev, "PPS %s at %lu\n",
    - 			active ? "assert" : "clear", jiffies);
    + 			status ? "assert" : "clear", jiffies);
      }
      
     @@ drivers/pps/clients/pps-ldisc.c: static int pps_tty_open(struct tty_struct *tty)
    @@ drivers/pps/pps.c: EXPORT_SYMBOL(pps_lookup_dev);
      {
     -	int err;
     -
    - 	pps_class = class_create("pps");
    + 	pps_class = class_create(THIS_MODULE, "pps");
      	if (IS_ERR(pps_class)) {
      		pr_err("failed to allocate class\n");
     @@ drivers/pps/pps.c: static int __init pps_init(void)
    @@ drivers/pps/pps.c: static int __init pps_init(void)
      
      subsys_initcall(pps_init);
     
    - ## drivers/ptp/ptp_ocp.c ##
    -@@ drivers/ptp/ptp_ocp.c: ptp_ocp_complete(struct ptp_ocp *bp)
    - 
    - 	pps = pps_lookup_dev(bp->ptp);
    - 	if (pps)
    --		ptp_ocp_symlink(bp, pps->dev, "pps");
    -+		ptp_ocp_symlink(bp, &pps->dev, "pps");
    - 
    - 	ptp_ocp_debugfs_add_device(bp);
    - 
    -
      ## include/linux/pps_kernel.h ##
     @@ include/linux/pps_kernel.h: struct pps_device {
      
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y       |  Success    |  Failed    |

Build Errors:
Build error for stable/linux-5.10.y:
    In file included from ./include/linux/kernel.h:15,
                     from ./include/linux/list.h:9,
                     from ./include/linux/kobject.h:19,
                     from ./include/linux/of.h:17,
                     from ./include/linux/clk-provider.h:9,
                     from drivers/clk/qcom/clk-rpmh.c:6:
    drivers/clk/qcom/clk-rpmh.c: In function 'clk_rpmh_bcm_send_cmd':
    ./include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types]
       20 |         (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
          |                                   ^~
    ./include/linux/minmax.h:26:18: note: in expansion of macro '__typecheck'
       26 |                 (__typecheck(x, y) && __no_side_effects(x, y))
          |                  ^~~~~~~~~~~
    ./include/linux/minmax.h:36:31: note: in expansion of macro '__safe_cmp'
       36 |         __builtin_choose_expr(__safe_cmp(x, y), \
          |                               ^~~~~~~~~~
    ./include/linux/minmax.h:45:25: note: in expansion of macro '__careful_cmp'
       45 | #define min(x, y)       __careful_cmp(x, y, <)
          |                         ^~~~~~~~~~~~~
    drivers/clk/qcom/clk-rpmh.c:273:21: note: in expansion of macro 'min'
      273 |         cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK);
          |                     ^~~
    In file included from ./include/linux/mm.h:30,
                     from ./include/linux/pagemap.h:8,
                     from ./include/linux/buffer_head.h:14,
                     from fs/udf/udfdecl.h:12,
                     from fs/udf/super.c:41:
    fs/udf/super.c: In function 'udf_fill_partdesc_info':
    ./include/linux/overflow.h:70:22: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types]
       70 |         (void) (&__a == &__b);                  \
          |                      ^~
    fs/udf/super.c:1155:21: note: in expansion of macro 'check_add_overflow'
     1155 |                 if (check_add_overflow(map->s_partition_len,
          |                     ^~~~~~~~~~~~~~~~~~
    Segmentation fault
    make: *** [Makefile:1207: vmlinux] Error 139
    make: Target '__all' not remade because of errors.