Skip to content

Commit ae39b57

Browse files
jarodwilsonjarodwilson
committed
Merge: CVE-2025-21739 kernel: scsi: ufs: core: Fix use-after free in init error and remove paths
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6575 Backport upstream commit `f8fb2403ddeb` ("scsi: ufs: core: Fix use-after free in init error and remove paths") to fix CVE-2025-21739, pulling in [this](https://lore.kernel.org/all/20241111-ufs_bug_fix-v1-0-45ad8b62f02e@linaro.org/) series, as well as [this](https://lore.kernel.org/r/20230917145722.1131557-1-u.kleine-koenig@pengutronix.de) patch to minimize conflicts. JIRA: https://issues.redhat.com/browse/RHEL-84800 CVE: CVE-2025-21739 Signed-off-by: Jared Kangas <jkangas@redhat.com> Approved-by: Radu Rendec <rrendec@redhat.com> Approved-by: Eric Chanudet <echanude@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Jarod Wilson <jarod@redhat.com>
2 parents ff296bf + 1db8d08 commit ae39b57

File tree

14 files changed

+75
-88
lines changed

14 files changed

+75
-88
lines changed

‎drivers/ufs/core/ufshcd.c‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10293,16 +10293,6 @@ int ufshcd_system_thaw(struct device *dev)
1029310293
EXPORT_SYMBOL_GPL(ufshcd_system_thaw);
1029410294
#endif /* CONFIG_PM_SLEEP */
1029510295

10296-
/**
10297-
* ufshcd_dealloc_host - deallocate Host Bus Adapter (HBA)
10298-
* @hba: pointer to Host Bus Adapter (HBA)
10299-
*/
10300-
void ufshcd_dealloc_host(struct ufs_hba *hba)
10301-
{
10302-
scsi_host_put(hba->host);
10303-
}
10304-
EXPORT_SYMBOL_GPL(ufshcd_dealloc_host);
10305-
1030610296
/**
1030710297
* ufshcd_set_dma_mask - Set dma mask based on the controller
1030810298
* addressing capability
@@ -10319,12 +10309,26 @@ static int ufshcd_set_dma_mask(struct ufs_hba *hba)
1031910309
return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32));
1032010310
}
1032110311

10312+
/**
10313+
* ufshcd_devres_release - devres cleanup handler, invoked during release of
10314+
* hba->dev
10315+
* @host: pointer to SCSI host
10316+
*/
10317+
static void ufshcd_devres_release(void *host)
10318+
{
10319+
scsi_host_put(host);
10320+
}
10321+
1032210322
/**
1032310323
* ufshcd_alloc_host - allocate Host Bus Adapter (HBA)
1032410324
* @dev: pointer to device handle
1032510325
* @hba_handle: driver private handle
1032610326
*
1032710327
* Return: 0 on success, non-zero value on failure.
10328+
*
10329+
* NOTE: There is no corresponding ufshcd_dealloc_host() because this function
10330+
* keeps track of its allocations using devres and deallocates everything on
10331+
* device removal automatically.
1032810332
*/
1032910333
int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
1033010334
{
@@ -10346,6 +10350,13 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
1034610350
err = -ENOMEM;
1034710351
goto out_error;
1034810352
}
10353+
10354+
err = devm_add_action_or_reset(dev, ufshcd_devres_release,
10355+
host);
10356+
if (err)
10357+
return dev_err_probe(dev, err,
10358+
"failed to add ufshcd dealloc action\n");
10359+
1034910360
host->nr_maps = HCTX_TYPE_POLL + 1;
1035010361
hba = shost_priv(host);
1035110362
hba->host = host;

‎drivers/ufs/host/cdns-pltfrm.c‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -305,12 +305,9 @@ static int cdns_ufs_pltfrm_probe(struct platform_device *pdev)
305305
*
306306
* Return: 0 (success).
307307
*/
308-
static int cdns_ufs_pltfrm_remove(struct platform_device *pdev)
308+
static void cdns_ufs_pltfrm_remove(struct platform_device *pdev)
309309
{
310-
struct ufs_hba *hba = platform_get_drvdata(pdev);
311-
312-
ufshcd_remove(hba);
313-
return 0;
310+
ufshcd_pltfrm_remove(pdev);
314311
}
315312

316313
static const struct dev_pm_ops cdns_ufs_dev_pm_ops = {
@@ -322,7 +319,7 @@ static const struct dev_pm_ops cdns_ufs_dev_pm_ops = {
322319

323320
static struct platform_driver cdns_ufs_pltfrm_driver = {
324321
.probe = cdns_ufs_pltfrm_probe,
325-
.remove = cdns_ufs_pltfrm_remove,
322+
.remove_new = cdns_ufs_pltfrm_remove,
326323
.driver = {
327324
.name = "cdns-ufshcd",
328325
.pm = &cdns_ufs_dev_pm_ops,

‎drivers/ufs/host/tc-dwc-g210-pltfrm.c‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -74,14 +74,9 @@ static int tc_dwc_g210_pltfm_probe(struct platform_device *pdev)
7474
* @pdev: pointer to platform device structure
7575
*
7676
*/
77-
static int tc_dwc_g210_pltfm_remove(struct platform_device *pdev)
77+
static void tc_dwc_g210_pltfm_remove(struct platform_device *pdev)
7878
{
79-
struct ufs_hba *hba = platform_get_drvdata(pdev);
80-
81-
pm_runtime_get_sync(&(pdev)->dev);
82-
ufshcd_remove(hba);
83-
84-
return 0;
79+
ufshcd_pltfrm_remove(pdev);
8580
}
8681

8782
static const struct dev_pm_ops tc_dwc_g210_pltfm_pm_ops = {
@@ -91,7 +86,7 @@ static const struct dev_pm_ops tc_dwc_g210_pltfm_pm_ops = {
9186

9287
static struct platform_driver tc_dwc_g210_pltfm_driver = {
9388
.probe = tc_dwc_g210_pltfm_probe,
94-
.remove = tc_dwc_g210_pltfm_remove,
89+
.remove_new = tc_dwc_g210_pltfm_remove,
9590
.driver = {
9691
.name = "tc-dwc-g210-pltfm",
9792
.pm = &tc_dwc_g210_pltfm_pm_ops,

‎drivers/ufs/host/ti-j721e-ufs.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,11 @@ static int ti_j721e_ufs_probe(struct platform_device *pdev)
6565
return ret;
6666
}
6767

68-
static int ti_j721e_ufs_remove(struct platform_device *pdev)
68+
static void ti_j721e_ufs_remove(struct platform_device *pdev)
6969
{
7070
of_platform_depopulate(&pdev->dev);
7171
pm_runtime_put_sync(&pdev->dev);
7272
pm_runtime_disable(&pdev->dev);
73-
74-
return 0;
7573
}
7674

7775
static const struct of_device_id ti_j721e_ufs_of_match[] = {
@@ -85,7 +83,7 @@ MODULE_DEVICE_TABLE(of, ti_j721e_ufs_of_match);
8583

8684
static struct platform_driver ti_j721e_ufs_driver = {
8785
.probe = ti_j721e_ufs_probe,
88-
.remove = ti_j721e_ufs_remove,
86+
.remove_new = ti_j721e_ufs_remove,
8987
.driver = {
9088
.name = "ti-j721e-ufs",
9189
.of_match_table = ti_j721e_ufs_of_match,

‎drivers/ufs/host/ufs-exynos.c‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1606,18 +1606,15 @@ static int exynos_ufs_probe(struct platform_device *pdev)
16061606
return err;
16071607
}
16081608

1609-
static int exynos_ufs_remove(struct platform_device *pdev)
1609+
static void exynos_ufs_remove(struct platform_device *pdev)
16101610
{
16111611
struct ufs_hba *hba = platform_get_drvdata(pdev);
16121612
struct exynos_ufs *ufs = ufshcd_get_variant(hba);
16131613

1614-
pm_runtime_get_sync(&(pdev)->dev);
1615-
ufshcd_remove(hba);
1614+
ufshcd_pltfrm_remove(pdev);
16161615

16171616
phy_power_off(ufs->phy);
16181617
phy_exit(ufs->phy);
1619-
1620-
return 0;
16211618
}
16221619

16231620
static struct exynos_ufs_uic_attr exynos7_uic_attr = {
@@ -1756,7 +1753,7 @@ static const struct dev_pm_ops exynos_ufs_pm_ops = {
17561753

17571754
static struct platform_driver exynos_ufs_pltform = {
17581755
.probe = exynos_ufs_probe,
1759-
.remove = exynos_ufs_remove,
1756+
.remove_new = exynos_ufs_remove,
17601757
.driver = {
17611758
.name = "exynos-ufshc",
17621759
.pm = &exynos_ufs_pm_ops,

‎drivers/ufs/host/ufs-hisi.c‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -574,12 +574,9 @@ static int ufs_hisi_probe(struct platform_device *pdev)
574574
return ufshcd_pltfrm_init(pdev, of_id->data);
575575
}
576576

577-
static int ufs_hisi_remove(struct platform_device *pdev)
577+
static void ufs_hisi_remove(struct platform_device *pdev)
578578
{
579-
struct ufs_hba *hba = platform_get_drvdata(pdev);
580-
581-
ufshcd_remove(hba);
582-
return 0;
579+
ufshcd_pltfrm_remove(pdev);
583580
}
584581

585582
static const struct dev_pm_ops ufs_hisi_pm_ops = {
@@ -591,7 +588,7 @@ static const struct dev_pm_ops ufs_hisi_pm_ops = {
591588

592589
static struct platform_driver ufs_hisi_pltform = {
593590
.probe = ufs_hisi_probe,
594-
.remove = ufs_hisi_remove,
591+
.remove_new = ufs_hisi_remove,
595592
.driver = {
596593
.name = "ufshcd-hisi",
597594
.pm = &ufs_hisi_pm_ops,

‎drivers/ufs/host/ufs-mediatek.c‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1731,13 +1731,9 @@ static int ufs_mtk_probe(struct platform_device *pdev)
17311731
*
17321732
* Always return 0
17331733
*/
1734-
static int ufs_mtk_remove(struct platform_device *pdev)
1734+
static void ufs_mtk_remove(struct platform_device *pdev)
17351735
{
1736-
struct ufs_hba *hba = platform_get_drvdata(pdev);
1737-
1738-
pm_runtime_get_sync(&(pdev)->dev);
1739-
ufshcd_remove(hba);
1740-
return 0;
1736+
ufshcd_pltfrm_remove(pdev);
17411737
}
17421738

17431739
#ifdef CONFIG_PM_SLEEP
@@ -1801,7 +1797,7 @@ static const struct dev_pm_ops ufs_mtk_pm_ops = {
18011797

18021798
static struct platform_driver ufs_mtk_pltform = {
18031799
.probe = ufs_mtk_probe,
1804-
.remove = ufs_mtk_remove,
1800+
.remove_new = ufs_mtk_remove,
18051801
.driver = {
18061802
.name = "ufshcd-mtk",
18071803
.pm = &ufs_mtk_pm_ops,

‎drivers/ufs/host/ufs-qcom.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2090,14 +2090,14 @@ static int ufs_qcom_probe(struct platform_device *pdev)
20902090
*
20912091
* Always returns 0
20922092
*/
2093-
static int ufs_qcom_remove(struct platform_device *pdev)
2093+
static void ufs_qcom_remove(struct platform_device *pdev)
20942094
{
20952095
struct ufs_hba *hba = platform_get_drvdata(pdev);
2096+
struct ufs_qcom_host *host = ufshcd_get_variant(hba);
20962097

2097-
pm_runtime_get_sync(&(pdev)->dev);
2098-
ufshcd_remove(hba);
2099-
platform_msi_domain_free_irqs(hba->dev);
2100-
return 0;
2098+
ufshcd_pltfrm_remove(pdev);
2099+
if (host->esi_enabled)
2100+
platform_msi_domain_free_irqs(hba->dev);
21012101
}
21022102

21032103
static const struct of_device_id ufs_qcom_of_match[] = {
@@ -2129,7 +2129,7 @@ static const struct dev_pm_ops ufs_qcom_pm_ops = {
21292129

21302130
static struct platform_driver ufs_qcom_pltform = {
21312131
.probe = ufs_qcom_probe,
2132-
.remove = ufs_qcom_remove,
2132+
.remove_new = ufs_qcom_remove,
21332133
.driver = {
21342134
.name = "ufshcd-qcom",
21352135
.pm = &ufs_qcom_pm_ops,

‎drivers/ufs/host/ufs-renesas.c‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -388,18 +388,14 @@ static int ufs_renesas_probe(struct platform_device *pdev)
388388
return ufshcd_pltfrm_init(pdev, &ufs_renesas_vops);
389389
}
390390

391-
static int ufs_renesas_remove(struct platform_device *pdev)
391+
static void ufs_renesas_remove(struct platform_device *pdev)
392392
{
393-
struct ufs_hba *hba = platform_get_drvdata(pdev);
394-
395-
ufshcd_remove(hba);
396-
397-
return 0;
393+
ufshcd_pltfrm_remove(pdev);
398394
}
399395

400396
static struct platform_driver ufs_renesas_platform = {
401397
.probe = ufs_renesas_probe,
402-
.remove = ufs_renesas_remove,
398+
.remove_new = ufs_renesas_remove,
403399
.driver = {
404400
.name = "ufshcd-renesas",
405401
.of_match_table = of_match_ptr(ufs_renesas_of_match),

‎drivers/ufs/host/ufs-sprd.c‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -425,13 +425,9 @@ static int ufs_sprd_probe(struct platform_device *pdev)
425425
return err;
426426
}
427427

428-
static int ufs_sprd_remove(struct platform_device *pdev)
428+
static void ufs_sprd_remove(struct platform_device *pdev)
429429
{
430-
struct ufs_hba *hba = platform_get_drvdata(pdev);
431-
432-
pm_runtime_get_sync(&(pdev)->dev);
433-
ufshcd_remove(hba);
434-
return 0;
430+
ufshcd_pltfrm_remove(pdev);
435431
}
436432

437433
static const struct dev_pm_ops ufs_sprd_pm_ops = {
@@ -443,7 +439,7 @@ static const struct dev_pm_ops ufs_sprd_pm_ops = {
443439

444440
static struct platform_driver ufs_sprd_pltform = {
445441
.probe = ufs_sprd_probe,
446-
.remove = ufs_sprd_remove,
442+
.remove_new = ufs_sprd_remove,
447443
.driver = {
448444
.name = "ufshcd-sprd",
449445
.pm = &ufs_sprd_pm_ops,

0 commit comments

Comments
 (0)