github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

serial: 8250_exar: store the GPIO platform device in struct exar8250

Browse Source 
The GPIO platform device is registered via platform->register_gpio()
when port 0 is being set up. It is stored to port->port.private_data of
the on-stack uart template (and from there it is copied into every
registered port). pci_xr17v35x_exit() then fetches it back by
serial8250_get_port(priv->line[0]).

But port 0 does not have to exist at that point. If
serial8250_register_8250_port() fails for port 0, priv->line[0] holds a
negative error code. The probe still succeeds (it only breaks the loop),
so on unbind, priv->line[0] (a negative value) is passed to
serial8250_get_port(). The GPIO device is never unregistered and a
bogus port is accessed.

The same problem would also occur after the planned conversion of
serial8250_register_8250_port() to return a uart port instead of a
line. As Sashiko pointed out in that case:
  If board->setup() fails for the first port (i=0) in exar_pci_probe(),
  priv->uport[0] remains NULL. If serial8250_register_8250_port() fails,
  it returns an ERR_PTR. In either case, the loop breaks and probe
  returns success. When the device is later unbound,
  pci_xr17v35x_exit() unconditionally passes priv->uport[0] to
  platform->unregister_gpio(), which will dereference it without
  checking for validity.

The GPIO device belongs to the PCI device, not to any particular port.
So store it in a new struct exar8250::gpio member. Pass priv to both
->register_gpio() and ->unregister_gpio(), so that pci_xr17v35x_exit()
does not need to look up any port at all.

Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Fixes: d0aeaa83f0 ("serial: exar: split out the exar code from 8250_pci")
Link: https://lore.kernel.org/all/sashiko-outbox-166269@kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/03a8b5c71614fc672fef1e55c083bda6c73b5bf3.1791873876.git.jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jiri Slaby (SUSE) 2026-10-13 08:48:48 +02:00 committed by Greg Kroah-Hartman
parent 4f28e10f18
commit 33d337816e
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
drivers/tty/serial/8250/8250_exar.c
View File

@ -231,8 +231,9 @@ struct exar8250_platform {
int (*rs485_config)(struct uart_port *port, struct ktermios *termios,
struct serial_rs485 *rs485);
const struct serial_rs485 *rs485_supported;
int (*register_gpio)(struct pci_dev *pcidev, struct uart_8250_port *port);
void (*unregister_gpio)(struct uart_8250_port *port);
int (*register_gpio)(struct exar8250 *priv, struct pci_dev *pcidev,
struct uart_8250_port *port);
void (*unregister_gpio)(struct exar8250 *priv);
};
/**
@ -256,6 +257,7 @@ struct exar8250 {
struct exar8250_board *board;
struct eeprom_93cx6 eeprom;
void __iomem *virt;
struct platform_device *gpio;
int line[];
};
@ -1167,22 +1169,21 @@ static const struct software_node exar_gpio_node = {
.properties = exar_gpio_properties,
};
static int xr17v35x_register_gpio(struct pci_dev *pcidev, struct uart_8250_port *port)
static int xr17v35x_register_gpio(struct exar8250 *priv, struct pci_dev *pcidev,
struct uart_8250_port *port)
{
if (pcidev->vendor == PCI_VENDOR_ID_EXAR)
port->port.private_data =
__xr17v35x_register_gpio(pcidev, &exar_gpio_node);
priv->gpio = __xr17v35x_register_gpio(pcidev, &exar_gpio_node);
return 0;
}
static void xr17v35x_unregister_gpio(struct uart_8250_port *port)
static void xr17v35x_unregister_gpio(struct exar8250 *priv)
{
if (!port->port.private_data)
return;
__xr17v35x_unregister_gpio(port->port.private_data);
port->port.private_data = NULL;
if (priv->gpio) {
__xr17v35x_unregister_gpio(priv->gpio);
priv->gpio = NULL;
}
}
static int sealevel_rs485_config(struct uart_port *port, struct ktermios *termios,
@ -1279,8 +1280,9 @@ static const struct software_node iot2040_gpio_node = {
.properties = iot2040_gpio_properties,
};
static int iot2040_register_gpio(struct pci_dev *pcidev,
struct uart_8250_port *port)
static int iot2040_register_gpio(struct exar8250 *priv,
struct pci_dev *pcidev,
struct uart_8250_port *port)
{
u8 __iomem *p = port->port.membase;
@ -1289,8 +1291,7 @@ static int iot2040_register_gpio(struct pci_dev *pcidev,
writeb(IOT2040_UARTS_ENABLE, p + UART_EXAR_MPIOLVL_15_8);
writeb(IOT2040_UARTS_GPIO_HI_MODE, p + UART_EXAR_MPIOSEL_15_8);
port->port.private_data =
__xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
priv->gpio = __xr17v35x_register_gpio(pcidev, &iot2040_gpio_node);
return 0;
}
@ -1367,7 +1368,7 @@ pci_xr17v35x_setup(struct exar8250 *priv, struct pci_dev *pcidev,
/* Setup Multipurpose Input/Output pins. */
setup_gpio(pcidev, p);
ret = platform->register_gpio(pcidev, port);
ret = platform->register_gpio(priv, pcidev, port);
}
return ret;
@ -1377,9 +1378,8 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev)
{
const struct exar8250_platform *platform = exar_get_platform();
struct exar8250 *priv = pci_get_drvdata(pcidev);
struct uart_8250_port *port = serial8250_get_port(priv->line[0]);
platform->unregister_gpio(port);
platform->unregister_gpio(priv);
}
static inline void exar_misc_clear(struct exar8250 *priv)