github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 05:27:07 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
391cceee6d
linux/drivers
History
Chen Zhongjin bfd5e62f9a i2c: piix4: Fix adapter not be removed in piix4_remove() 
[ Upstream commit 569bea74c9 ]

In piix4_probe(), the piix4 adapter will be registered in:

   piix4_probe()
     piix4_add_adapters_sb800() / piix4_add_adapter()
       i2c_add_adapter()

Based on the probed device type, piix4_add_adapters_sb800() or single
piix4_add_adapter() will be called.
For the former case, piix4_adapter_count is set as the number of adapters,
while for antoher case it is not set and kept default *zero*.

When piix4 is removed, piix4_remove() removes the adapters added in
piix4_probe(), basing on the piix4_adapter_count value.
Because the count is zero for the single adapter case, the adapter won't
be removed and makes the sources allocated for adapter leaked, such as
the i2c client and device.

These sources can still be accessed by i2c or bus and cause problems.
An easily reproduced case is that if a new adapter is registered, i2c
will get the leaked adapter and try to call smbus_algorithm, which was
already freed:

Triggered by: rmmod i2c_piix4 && modprobe max31730

 BUG: unable to handle page fault for address: ffffffffc053d860
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 Oops: 0000 [#1] PREEMPT SMP KASAN
 CPU: 0 PID: 3752 Comm: modprobe Tainted: G
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core
 RSP: 0018:ffff888107477710 EFLAGS: 00000246
 ...
 <TASK>
  i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
  __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core
  bus_for_each_dev (drivers/base/bus.c:301)
  i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core
  i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core
  do_one_initcall (init/main.c:1296)
  do_init_module (kernel/module/main.c:2455)
  ...
 </TASK>
 ---[ end trace 0000000000000000 ]---

Fix this problem by correctly set piix4_adapter_count as 1 for the
single adapter so it can be normally removed.

Fixes: 528d53a159 ("i2c: piix4: Fix probing of reserved ports on AMD Family 16h Model 30h")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-11-10 18:14:24 +01:00
..
accessibility tty: the rest, stop using tty_schedule_flip() 2022-07-29 17:19:28 +02:00
acpi ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() 2022-11-10 18:14:22 +01:00
amba amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
android binder: fix UAF of ref->proc caused by race condition 2022-09-08 11:11:38 +02:00
ata ata: pata_legacy: fix pdc20230_set_piomode() 2022-11-10 18:14:18 +01:00
atm atm: idt77252: fix use-after-free bugs caused by tst_timer 2022-08-25 11:38:02 +02:00
auxdisplay
base PM: domains: Fix handling of unavailable/disabled idle states 2022-11-03 23:57:53 +09:00
bcma
block nbd: Fix hung when signal interrupts nbd_start_device_ioctl() 2022-10-26 13:25:52 +02:00
bluetooth Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure 2022-10-26 13:25:21 +02:00
bus bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() 2022-08-21 15:15:35 +02:00
cdrom
char hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() 2022-10-26 13:25:41 +02:00
clk clk: bcm2835: Make peripheral PLLC critical 2022-10-26 13:25:54 +02:00
clocksource clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup() 2022-07-07 17:52:23 +02:00
connector
counter counter: microchip-tcb-capture: Handle Signal1 read and Synapse 2022-11-03 23:57:50 +09:00
cpufreq cpufreq: qcom: fix memory leak in error path 2022-10-30 09:41:15 +01:00
cpuidle
crypto crypto: cavium - prevent integer overflow loading firmware 2022-10-26 13:25:43 +02:00
dax devdax: Fix soft-reservation memory description 2022-09-28 11:10:41 +02:00
dca
devfreq PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events 2022-07-07 17:52:18 +02:00
dio
dma dmaengine: mxs: use platform_driver_register 2022-10-30 09:41:18 +01:00
dma-buf udmabuf: Set ubuf->sg = NULL if the creation of sg table fails 2022-10-26 13:25:48 +02:00
edac EDAC/ghes: Set the DIMM label unconditionally 2022-08-03 12:00:50 +02:00
eisa
extcon extcon: Modify extcon device to be created after driver data is set 2022-06-14 18:32:43 +02:00
firewire firewire: core: extend card->lock in fw_core_handle_bus_reset 2022-05-12 12:25:32 +02:00
firmware firmware: arm_scmi: Make Rx chan_setup fail on memory errors 2022-11-10 18:14:23 +01:00
fpga fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() 2022-10-26 13:25:33 +02:00
fsi fsi: core: Check error number after calling ida_simple_get 2022-10-26 13:25:38 +02:00
gnss
gpio gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully 2022-09-28 11:10:27 +02:00
gpu drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case 2022-11-10 18:14:23 +01:00
greybus greybus: svc: fix an error handling bug in gb_svc_hello() 2022-04-08 14:39:50 +02:00
hid HID: saitek: add madcatz variant of MMO7 mouse device ID 2022-11-10 18:14:23 +01:00
hsi HSI: omap_ssi_port: Fix dma_map_sg error check 2022-10-26 13:25:32 +02:00
hv Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region 2022-09-28 11:10:39 +02:00
hwmon hwmon/coretemp: Handle large core ID value 2022-10-30 09:41:15 +01:00
hwspinlock
hwtracing intel_th: pci: Add Raptor Lake-S CPU support 2022-08-21 15:16:17 +02:00
i2c i2c: piix4: Fix adapter not be removed in piix4_remove() 2022-11-10 18:14:24 +01:00
i3c
ide
idle intel_idle: Disable IBRS during long idle 2022-07-25 11:26:43 +02:00
iio iio: temperature: ltc2983: allocate iio channels once 2022-11-03 23:57:49 +09:00
infiniband RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() 2022-11-10 18:14:17 +01:00
input Input: xpad - fix wireless 360 controller breaking after suspend 2022-10-15 07:55:56 +02:00
interconnect interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate 2022-09-28 11:10:28 +02:00
iommu iommu/vt-d: Clean up si_domain in the init_dmars() error path 2022-10-30 09:41:18 +01:00
ipack
irqchip irqchip/tegra: Fix overflow implicit truncation warnings 2022-08-25 11:38:12 +02:00
isdn isdn: mISDN: netjet: fix wrong check of device registration 2022-11-10 18:14:19 +01:00
leds leds: lm3601x: Don't use mutex after it was destroyed 2022-10-26 13:25:18 +02:00
lightnvm lightnvm: disable the subsystem 2022-05-09 09:04:56 +02:00
macintosh macintosh/adb: fix oob read in do_adb_query() function 2022-08-11 13:06:47 +02:00
mailbox mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg 2022-10-26 13:25:40 +02:00
mcb
md md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d 2022-10-26 13:25:53 +02:00
media media: dvb-frontends/drxk: initialize err to 0 2022-11-10 18:14:22 +01:00
memory memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() 2022-10-26 13:25:28 +02:00
memstick memstick/ms_block: Fix a memory leak 2022-08-21 15:15:58 +02:00
message
mfd mfd: sm501: Add check for platform_driver_register() 2022-10-26 13:25:38 +02:00
misc misc: ocxl: fix possible refcount leak in afu_ioctl() 2022-10-26 13:25:33 +02:00
mmc mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake 2022-11-10 18:14:20 +01:00
most
mtd mtd: parsers: bcm47xxpart: Fix halfblock reads 2022-11-10 18:14:21 +01:00
mux
net net: mdio: fix undefined behavior in bit shift for __mdiobus_register 2022-11-10 18:14:20 +01:00
nfc nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() 2022-11-10 18:14:17 +01:00
ntb NTB: ntb_tool: uninitialized heap data in tool_fn_write() 2022-08-25 11:38:01 +02:00
nubus
nvdimm nvdimm: Fix badblocks clear off-by-one error 2022-07-07 17:52:15 +02:00
nvme nvme-hwmon: kmalloc the NVME SMART log buffer 2022-10-30 09:41:17 +01:00
nvmem nvmem: core: set size for sysfs bin file 2022-01-27 10:54:22 +01:00
of of: fdt: fix off-by-one error in unflatten_dt_nodes() 2022-09-23 14:16:57 +02:00
opp opp: Fix error check in dev_pm_opp_attach_genpd() 2022-08-21 15:16:04 +02:00
oprofile
parisc parisc: ccio-dma: Add missing iounmap in error path in ccio_probe() 2022-09-23 14:16:58 +02:00
parport
pci PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge 2022-10-26 13:25:11 +02:00
pcmcia pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards 2022-06-14 18:32:30 +02:00
perf perf/arm_pmu_platform: fix tests for platform_get_irq() failure 2022-09-20 12:38:32 +02:00
phy phy: qualcomm: call clk_disable_unprepare in the error handling 2022-10-26 13:25:37 +02:00
pinctrl pinctrl: sunxi: Fix name for A100 R_PIO 2022-09-23 14:16:57 +02:00
platform platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading 2022-10-26 13:25:49 +02:00
pnp
power power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() 2022-10-26 13:25:52 +02:00
powercap powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue 2022-10-26 13:25:44 +02:00
pps
ps3
ptp ptp: replace snprintf with sysfs_emit 2022-04-13 21:00:55 +02:00
pwm pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource() 2022-08-21 15:15:37 +02:00
rapidio
ras
regulator regulator: core: Prevent integer underflow 2022-10-26 13:25:46 +02:00
remoteproc remoteproc: sysmon: Wait for SSCTL service to come up 2022-08-21 15:16:08 +02:00
reset reset: imx7: Fix the iMX8MP PCIe PHY PERST support 2022-10-05 10:38:40 +02:00
rpmsg rpmsg: qcom: glink: replace strncpy() with strscpy_pad() 2022-10-15 07:55:54 +02:00
rtc rtc: mt6397: check return value after calling platform_get_resource() 2022-06-14 18:32:33 +02:00
s390 s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup 2022-09-28 11:10:38 +02:00
sbus
scsi scsi: core: Restrict legal sdev_state transitions via sysfs 2022-11-10 18:14:22 +01:00
sfi
sh
siox
slimbus slimbus: qcom: Fix IRQ check in qcom_slim_probe 2022-05-18 10:23:47 +02:00
soc soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA 2022-10-26 13:25:29 +02:00
soundwire soundwire: intel: fix error handling on dai registration issues 2022-10-26 13:25:53 +02:00
spi spi: Ensure that sg_table won't be used after being freed 2022-10-26 13:25:23 +02:00
spmi spmi: pmic-arb: correct duplicate APID to PPID mapping logic 2022-10-26 13:25:39 +02:00
ssb
staging media: meson: vdec: fix possible refcount leak in vdec_probe() 2022-11-10 18:14:22 +01:00
target target: remove an incorrect unmap zeroes data deduction 2022-06-09 10:21:01 +02:00
tc
tee tee: fix compiler warning in tee_shm_register() 2022-09-15 11:32:04 +02:00
thermal thermal: intel_powerclamp: Use first online CPU as control_cpu 2022-10-26 13:25:56 +02:00
thunderbolt thunderbolt: Explicitly enable lane adapter hotplug events at startup 2022-10-26 13:25:16 +02:00
tty serial: ar933x: Deassert Transmit Enable on ->rs485_config() 2022-11-10 18:14:14 +01:00
uio
usb xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices 2022-11-10 18:14:21 +01:00
vdpa vdpasim: allow to enable a vq repeatedly 2022-06-09 10:21:29 +02:00
vfio vfio/type1: fix vaddr_get_pfns() return in vfio_pin_page_external() 2022-09-28 11:10:38 +02:00
vhost vhost/vsock: Use kvmalloc/kvfree for larger packets. 2022-10-26 13:25:22 +02:00
video fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards 2022-11-10 18:14:21 +01:00
virt vboxguest: Do not use devm for irq 2022-08-25 11:38:14 +02:00
virtio virtio_mmio: Restore guest page size on resume 2022-07-21 21:20:13 +02:00
visorbus
vlynq
vme
w1 w1: w1_therm: fixes w1_seq for ds28ea00 sensors 2022-04-13 21:01:01 +02:00
watchdog watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() 2022-08-21 15:16:10 +02:00
xen xen/gntdev: Prevent leaking grants 2022-11-03 23:57:50 +09:00
zorro
Kconfig
Makefile