github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

soundwire: debugfs: replace writable string helper

Browse Source 
debugfs_create_str() is being made read-only because its generic write
path is hard to make safe without adding more locking to the helper.

Convert the SoundWire firmware_file entry to a local write-only file
operation before removing writable string support from
debugfs_create_str().

Copy the firmware name before request_firmware() so later debugfs writes
cannot replace the string while it is being used.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20260807100053.1089834-3-chenyichong@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yichong Chen 2026-08-07 18:00:52 +08:00 committed by Greg Kroah-Hartman
parent 493daf5bf2
commit 98421ba592
1 changed files with 55 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
drivers/soundwire/debugfs.c
View File

@ -145,6 +145,38 @@ static u32 start_addr;
static size_t num_bytes;
static u8 read_buffer[MAX_CMD_BYTES];
static char *firmware_file;
static DEFINE_MUTEX(firmware_file_lock);
static ssize_t firmware_file_write(struct file *file,
const char __user *user_buf,
size_t count, loff_t *ppos)
{
char *old, *new;
if (*ppos)
return -EINVAL;
if (count + 1 > PAGE_SIZE)
return -E2BIG;
new = memdup_user_nul(user_buf, count);
if (IS_ERR(new))
return PTR_ERR(new);
strim(new);
scoped_guard(mutex, &firmware_file_lock) {
old = firmware_file;
firmware_file = new;
}
kfree(old);
return count;
}
static const struct file_operations firmware_file_fops = {
.open = simple_open,
.write = firmware_file_write,
.llseek = default_llseek,
};
static int set_command(void *data, u64 value)
{
@ -246,6 +278,7 @@ static int cmd_go(void *data, u64 value)
{
const struct firmware *fw = NULL;
struct sdw_slave *slave = data;
char *fw_name = NULL;
ktime_t start_t;
ktime_t finish_t;
int ret;
@ -265,15 +298,24 @@ static int cmd_go(void *data, u64 value)
}
if (cmd == 0) {
ret = request_firmware(&fw, firmware_file, &slave->dev);
scoped_guard(mutex, &firmware_file_lock) {
if (firmware_file)
fw_name = kstrdup(firmware_file, GFP_KERNEL);
}
if (!fw_name) {
ret = -ENOMEM;
goto out;
}
ret = request_firmware(&fw, fw_name, &slave->dev);
if (ret < 0) {
dev_err(&slave->dev, "firmware %s not found\n", firmware_file);
dev_err(&slave->dev, "firmware %s not found\n", fw_name);
goto out;
}
if (fw->size < num_bytes) {
dev_err(&slave->dev,
"firmware %s: firmware size %zd, desired %zd\n",
firmware_file, fw->size, num_bytes);
fw_name, fw->size, num_bytes);
goto out;
}
}
@ -306,6 +348,7 @@ static int cmd_go(void *data, u64 value)
out:
if (fw)
release_firmware(fw);
kfree(fw_name);
pm_runtime_mark_last_busy(&slave->dev);
pm_runtime_put(&slave->dev);
@ -358,7 +401,8 @@ void sdw_slave_debugfs_init(struct sdw_slave *slave)
debugfs_create_file("read_buffer", 0400, d, slave, &read_buffer_fops);
if (firmware_file)
debugfs_create_str("firmware_file", 0200, d, &firmware_file);
debugfs_create_file("firmware_file", 0200, d, NULL,
&firmware_file_fops);
slave->debugfs = d;
}
@ -370,8 +414,10 @@ void sdw_slave_debugfs_exit(struct sdw_slave *slave)
void sdw_debugfs_init(void)
{
if (!firmware_file)
firmware_file = kstrdup("", GFP_KERNEL);
scoped_guard(mutex, &firmware_file_lock) {
if (!firmware_file)
firmware_file = kstrdup("", GFP_KERNEL);
}
sdw_debugfs_root = debugfs_create_dir("soundwire", NULL);
}
@ -379,6 +425,7 @@ void sdw_debugfs_init(void)
void sdw_debugfs_exit(void)
{
debugfs_remove_recursive(sdw_debugfs_root);
kfree(firmware_file);
firmware_file = NULL;
scoped_guard(mutex, &firmware_file_lock) {
kfree(firmware_file);
}
}