public inbox for linux-iio@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] counter: Stop using dev_get_drvdata() to get the counter device
@ 2022-02-18  9:20 William Breathitt Gray
  2022-02-18 10:07 ` Uwe Kleine-König
  0 siblings, 1 reply; 9+ messages in thread
From: William Breathitt Gray @ 2022-02-18  9:20 UTC (permalink / raw)
  To: gregkh
  Cc: linux-iio, Uwe Kleine-König, Oleksij Rempel, Jarkko Nikula,
	William Breathitt Gray

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

dev_get_drvdata() returns NULL since commit b56346ddbd82 ("counter: Use
container_of instead of drvdata to track counter_device") which wrongly
claimed there were no users of drvdata. Convert to container_of() to
fix a null pointer dereference.

Reported-by: Oleksij Rempel <o.rempel@pengutronix.de>
Fixes: b56346ddbd82 ("counter: Use container_of instead of drvdata to track counter_device")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
---
 drivers/counter/counter-sysfs.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/counter/counter-sysfs.c b/drivers/counter/counter-sysfs.c
index 7cc4d1d523ea..04eac41dad33 100644
--- a/drivers/counter/counter-sysfs.c
+++ b/drivers/counter/counter-sysfs.c
@@ -19,6 +19,11 @@
 
 #include "counter-sysfs.h"
 
+static inline struct counter_device *counter_from_dev(struct device *dev)
+{
+	return container_of(dev, struct counter_device, dev);
+}
+
 /**
  * struct counter_attribute - Counter sysfs attribute
  * @dev_attr:	device attribute for sysfs
@@ -90,7 +95,7 @@ static ssize_t counter_comp_u8_show(struct device *dev,
 				    struct device_attribute *attr, char *buf)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	u8 data = 0;
 
@@ -122,7 +127,7 @@ static ssize_t counter_comp_u8_store(struct device *dev,
 				     const char *buf, size_t len)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	bool bool_data = 0;
 	u8 data = 0;
@@ -158,7 +163,7 @@ static ssize_t counter_comp_u32_show(struct device *dev,
 				     struct device_attribute *attr, char *buf)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	const struct counter_available *const avail = a->comp.priv;
 	int err;
 	u32 data = 0;
@@ -221,7 +226,7 @@ static ssize_t counter_comp_u32_store(struct device *dev,
 				      const char *buf, size_t len)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	struct counter_count *const count = a->parent;
 	struct counter_synapse *const synapse = a->comp.priv;
 	const struct counter_available *const avail = a->comp.priv;
@@ -281,7 +286,7 @@ static ssize_t counter_comp_u64_show(struct device *dev,
 				     struct device_attribute *attr, char *buf)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	u64 data = 0;
 
@@ -309,7 +314,7 @@ static ssize_t counter_comp_u64_store(struct device *dev,
 				      const char *buf, size_t len)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	u64 data = 0;
 

base-commit: e6cb9c167eeb8f90ab924666c573e69e85e700a0
-- 
2.35.1


^ permalink raw reply related	[flat|nested] 9+ messages in thread
* Re: [PATCH v1] counter: fix NULL pointer dereference on counter_comp_u8_store()
@ 2022-02-04  7:02 William Breathitt Gray
  2022-02-04  8:25 ` [PATCH] counter: Stop using dev_get_drvdata() to get the counter device Uwe Kleine-König
  0 siblings, 1 reply; 9+ messages in thread
From: William Breathitt Gray @ 2022-02-04  7:02 UTC (permalink / raw)
  To: Oleksij Rempel
  Cc: linux-kernel, Pengutronix Kernel Team, David Jander,
	Robin van der Gracht, linux-iio, Jonathan Cameron,
	u.kleine-koenig

[-- Attachment #1: Type: text/plain, Size: 1731 bytes --]

On Thu, Feb 03, 2022 at 02:54:18PM +0100, Oleksij Rempel wrote:
> Current kernel will report NULL pointer dereference with following
> back trace:
>   interrupt_cnt_enable_write from counter_comp_u8_store+0xc0/0xf4
>   counter_comp_u8_store from dev_attr_store+0x24/0x30
>   dev_attr_store from sysfs_kf_write+0x48/0x54
>   sysfs_kf_write from kernfs_fop_write_iter+0x128/0x1c8
>   kernfs_fop_write_iter from vfs_write+0x124/0x1b4
>   vfs_write from ksys_write+0x88/0xe0
>   ksys_write from sys_write+0x18/0x1c
>   sys_write from ret_fast_syscall+0x0/0x1c
> 
> Add missing dev_set_drvdata() to fix it.
> 
> Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>

Hi Oleksij,

This dev_set_drvdata() was removed in commit b56346ddbd82 ("counter: Use
container_of instead of drvdata to track counter_device"). It looks like
we overlooked the counter-sysfs.c file when we made that change.

Would you instead replace the dev_get_drvdata() calls in counter-sysfs.c
with respective container_of() calls? Add a Fixes tag referencing commit
b56346ddbd82 as well to your commit message.

Thanks,

William Breathitt Gray

> ---
>  drivers/counter/counter-core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/counter/counter-core.c b/drivers/counter/counter-core.c
> index 7e0957eea094..1de16d5e9fbc 100644
> --- a/drivers/counter/counter-core.c
> +++ b/drivers/counter/counter-core.c
> @@ -98,6 +98,8 @@ struct counter_device *counter_alloc(size_t sizeof_priv)
>  	counter = &ch->counter;
>  	dev = &counter->dev;
>  
> +	dev_set_drvdata(dev, counter);
> +
>  	/* Acquire unique ID */
>  	err = ida_alloc(&counter_ida, GFP_KERNEL);
>  	if (err < 0)
> -- 
> 2.30.2
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-02-18 10:07 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-02-18  9:20 [PATCH] counter: Stop using dev_get_drvdata() to get the counter device William Breathitt Gray
2022-02-18 10:07 ` Uwe Kleine-König
  -- strict thread matches above, loose matches on Subject: below --
2022-02-04  7:02 [PATCH v1] counter: fix NULL pointer dereference on counter_comp_u8_store() William Breathitt Gray
2022-02-04  8:25 ` [PATCH] counter: Stop using dev_get_drvdata() to get the counter device Uwe Kleine-König
2022-02-08  1:42   ` William Breathitt Gray
2022-02-17 14:48     ` Jarkko Nikula
2022-02-17 16:03       ` Uwe Kleine-König
2022-02-17 23:42         ` William Breathitt Gray
2022-02-18  7:47           ` Uwe Kleine-König
2022-02-18  9:11             ` William Breathitt Gray

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox