Centos-kernel-stream-9/include/linux/pps_kernel.h

120 lines
2.9 KiB
C
Raw Normal View History

/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
* PPS API kernel header
*
* Copyright (C) 2009 Rodolfo Giometti <giometti@linux.it>
*/
#ifndef LINUX_PPS_KERNEL_H
#define LINUX_PPS_KERNEL_H
#include <linux/pps.h>
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/time.h>
/*
* Global defines
*/
struct pps_device;
/* The specific PPS source info */
struct pps_source_info {
char name[PPS_MAX_NAME_LEN]; /* symbolic name */
char path[PPS_MAX_NAME_LEN]; /* path of connected device */
int mode; /* PPS allowed mode */
void (*echo)(struct pps_device *pps,
int event, void *data); /* PPS echo function */
struct module *owner;
struct device *dev; /* Parent device for device_create */
};
struct pps_event_time {
#ifdef CONFIG_NTP_PPS
struct timespec64 ts_raw;
#endif /* CONFIG_NTP_PPS */
struct timespec64 ts_real;
};
/* The main struct */
struct pps_device {
struct pps_source_info info; /* PSS source info */
struct pps_kparams params; /* PPS current params */
__u32 assert_sequence; /* PPS assert event seq # */
__u32 clear_sequence; /* PPS clear event seq # */
struct pps_ktime assert_tu;
struct pps_ktime clear_tu;
int current_mode; /* PPS mode at event time */
unsigned int last_ev; /* last PPS event id */
wait_queue_head_t queue; /* PPS event queue */
unsigned int id; /* PPS source unique ID */
void const *lookup_cookie; /* For pps_lookup_dev() only */
pps: Fix a use-after-free JIRA: https://issues.redhat.com/browse/RHEL-9309 Conflicts: drivers/ptp/ptp_ocp.c - Driver disabled in RHEL 9. Hunk dropped. commit c79a39dc8d060b9e64e8b0fa9d245d44befeefbe Author: Calvin Owens <calvin@wbinvd.org> Date: Mon Nov 11 20:13:29 2024 -0800 pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]------------ kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called. WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150 CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1 Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : kobject_put+0x120/0x150 lr : kobject_put+0x120/0x150 sp : ffffffc0803d3ae0 x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001 x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440 x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600 x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20 x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: kobject_put+0x120/0x150 cdev_put+0x20/0x3c __fput+0x2c4/0x2d8 ____fput+0x1c/0x38 task_work_run+0x70/0xfc do_exit+0x2a0/0x924 do_group_exit+0x34/0x90 get_signal+0x7fc/0x8c0 do_signal+0x128/0x13b4 do_notify_resume+0xdc/0x160 el0_svc+0xd4/0xf8 el0t_64_sync_handler+0x140/0x14c el0t_64_sync+0x190/0x194 ---[ end trace 0000000000000000 ]--- ...followed by more symptoms of corruption, with similar stacks: refcount_t: underflow; use-after-free. kernel BUG at lib/list_debug.c:62! Kernel panic - not syncing: Oops - BUG: Fatal exception This happens because pps_device_destruct() frees the pps_device with the embedded cdev immediately after calling cdev_del(), but, as the comment above cdev_del() notes, fops for previously opened cdevs are still callable even after cdev_del() returns. I think this bug has always been there: I can't explain why it suddenly started happening every time I reboot this particular board. In commit d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source."), George Spelvin suggested removing the embedded cdev. That seems like the simplest way to fix this, so I've implemented his suggestion, using __register_chrdev() with pps_idr becoming the source of truth for which minor corresponds to which device. But now that pps_idr defines userspace visibility instead of cdev_add(), we need to be sure the pps->dev refcount can't reach zero while userspace can still find it again. So, the idr_remove() call moves to pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev. pps_core: source serial1 got cdev (251:1) <...> pps pps1: removed pps_core: unregistering pps1 pps_core: deallocating pps1 Fixes: d953e0e837e6 ("pps: Fix a use-after free bug when unregistering a source.") Cc: stable@vger.kernel.org Signed-off-by: Calvin Owens <calvin@wbinvd.org> Reviewed-by: Michal Schmidt <mschmidt@redhat.com> Link: https://lore.kernel.org/r/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
2025-01-31 21:29:46 +00:00
struct device dev;
struct fasync_struct *async_queue; /* fasync method */
spinlock_t lock;
};
/*
* Global variables
*/
extern const struct attribute_group *pps_groups[];
/*
* Internal functions.
*
* These are not actually part of the exported API, but this is a
* convenient header file to put them in.
*/
extern int pps_register_cdev(struct pps_device *pps);
extern void pps_unregister_cdev(struct pps_device *pps);
/*
* Exported functions
*/
extern struct pps_device *pps_register_source(
struct pps_source_info *info, int default_params);
extern void pps_unregister_source(struct pps_device *pps);
extern void pps_event(struct pps_device *pps,
struct pps_event_time *ts, int event, void *data);
/* Look up a pps_device by magic cookie */
struct pps_device *pps_lookup_dev(void const *cookie);
static inline void timespec_to_pps_ktime(struct pps_ktime *kt,
struct timespec64 ts)
{
kt->sec = ts.tv_sec;
kt->nsec = ts.tv_nsec;
}
static inline void pps_get_ts(struct pps_event_time *ts)
{
struct system_time_snapshot snap;
ktime_get_snapshot(&snap);
ts->ts_real = ktime_to_timespec64(snap.real);
#ifdef CONFIG_NTP_PPS
ts->ts_raw = ktime_to_timespec64(snap.raw);
#endif
}
/* Subtract known time delay from PPS event time(s) */
static inline void pps_sub_ts(struct pps_event_time *ts, struct timespec64 delta)
{
ts->ts_real = timespec64_sub(ts->ts_real, delta);
#ifdef CONFIG_NTP_PPS
ts->ts_raw = timespec64_sub(ts->ts_raw, delta);
#endif
}
#endif /* LINUX_PPS_KERNEL_H */