Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

w1-gpio,bcm2708: Disable 1-wire pull-up by default and expose parameters to modules #602

Merged
merged 2 commits into from
May 26, 2014
Merged

w1-gpio,bcm2708: Disable 1-wire pull-up by default and expose parameters to modules #602

merged 2 commits into from
May 26, 2014

Conversation

ajlennon
Copy link

No description provided.

ajlennon added 2 commits May 24, 2014 20:52
@ajlennon
bcm2708: Ensure 1-wire pullup is disabled by default, and expose as m…
7a9c740 
…odule parameter

Signed-off-by: Alex J Lennon <ajlennon@dynamicdevices.co.uk>
@ajlennon
w1-gpio: Add gpiopin module parameter and correctly free up gpio pull…
4aaaa8d 
…-up pin, if set

Signed-off-by: Alex J Lennon <ajlennon@dynamicdevices.co.uk>
@ajlennon
Copy link
Author

For details see #601

@ajlennon ajlennon mentioned this pull request May 26, 2014
Closed
popcornmix added a commit that referenced this pull request May 26, 2014
@popcornmix
Merge pull request #602 from DynamicDevices/rpi-3.12.y
a57d4fd 
w1-gpio,bcm2708:  Disable 1-wire pull-up by default and expose parameters to modules
@popcornmix popcornmix merged commit a57d4fd into raspberrypi:rpi-3.12.y May 26, 2014
@popcornmix
Copy link
Collaborator

Thanks!

popcornmix pushed a commit to Hexxeh/rpi-firmware that referenced this pull request May 27, 2014
kernel: Enable PCF2127 RTC module
8135545 
See: #51

kernel: V4L2: Fix regression, and gstreamer workaround
See: raspberrypi/linux#604

kernel: dwc_otg: fix interrupt registration for fiq_enable=0
See: raspberrypi/linux@33d28d4

kernel: w1-gpio,bcm2708: Disable 1-wire pull-up by default and expose parameters to modules
See: raspberrypi/linux#602

kernel: i2c: Make combined transactions optional and disabled by default
See: raspberrypi/linux#318

firmware: video_decode: Remove the minumum of 7 buffers requirement when extra_buffers=0
Allows memory reduction when video_decode is non-tunnelled
@popcornmix
Copy link
Collaborator

I merged this into 3.14.y kernel, but it seems things have changed with this upstream commit using devm_ functions:
d27f25c

Can you check if this still looks (and works) okay?
e095b2b

@ajlennon
Copy link
Author

Ah, yes - I had a quick chat with Evgeniy and Ville about some of the questions (e.g. querying the missing GPIO free in there) and they did mention something about use of devm in the newer kernels meaning this was no longer a concern.

What about I have a look at regenerating a patch for 3.14.y and check it builds here.

@popcornmix
Copy link
Collaborator

Okay.

@ajlennon
Copy link
Author

Sorry - bit slow here today. You just took out the additional gpio_free() from the patch for 3.14.y?

Yes that's what I would have done. I'll give it a quick run up with a 1-wire sensor with insmod/rmmod but within my understanding of devm (non-existent) if devm now handles freeing resources then that looks fine to me.

@popcornmix
Copy link
Collaborator

There were a couple of conflicts, and it appeared that removing the free was the correct solution (by looking at the upstream commit that added devm_).

But I was only 80% sure, and it's untested, so would be good if you can confirm it looks okay and still works.

@ajlennon
Copy link
Author

I wouldn't disagree with that point of view. I too tend to feel if I've not seen it work then it can be assumed not to, and if I have... well it probably still doesn't, but in a more ambiguous way.

I've now built a0e9f88 off rpi-3.14.y and all seems to work on the RPi here.

  • modprobe'd w1-gpio
  • rmmod'd it
  • modprobed it again with a gpiopin=10 (default being 4)
  • can see my dallas temp. sensor popping up on gpio10 and can get data from it

@popcornmix
Copy link
Collaborator

Thanks.

popcornmix pushed a commit to raspberrypi/firmware that referenced this pull request May 30, 2014
kernel: Enable PCF2127 RTC module
0a376ae 
See: Hexxeh/rpi-firmware#51

kernel: V4L2: Fix regression, and gstreamer workaround
See: raspberrypi/linux#604

kernel: dwc_otg: fix interrupt registration for fiq_enable=0
See: raspberrypi/linux@33d28d4

kernel: w1-gpio,bcm2708: Disable 1-wire pull-up by default and expose parameters to modules
See: raspberrypi/linux#602

kernel: i2c: Make combined transactions optional and disabled by default
See: raspberrypi/linux#318

firmware: video_decode: Remove the minumum of 7 buffers requirement when extra_buffers=0
Allows memory reduction when video_decode is non-tunnelled
@popcornmix popcornmix mentioned this pull request Jun 29, 2014
Closed
@alevikpes
Copy link

Hello!

I did not understand from this conversation if it is possible to fix the camera problem. Could you please explain in simple how to do this then? Or is the camera dead already?

neuschaefer pushed a commit to neuschaefer/raspi-binary-firmware that referenced this pull request Feb 27, 2017
kernel: Enable PCF2127 RTC module
8fd9c43 
See: Hexxeh/rpi-firmware#51

kernel: V4L2: Fix regression, and gstreamer workaround
See: raspberrypi/linux#604

kernel: dwc_otg: fix interrupt registration for fiq_enable=0
See: raspberrypi/linux@33d28d4

kernel: w1-gpio,bcm2708: Disable 1-wire pull-up by default and expose parameters to modules
See: raspberrypi/linux#602

kernel: i2c: Make combined transactions optional and disabled by default
See: raspberrypi/linux#318

firmware: video_decode: Remove the minumum of 7 buffers requirement when extra_buffers=0
Allows memory reduction when video_decode is non-tunnelled
popcornmix pushed a commit that referenced this pull request Jul 1, 2020
@TaeheeYoo
ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
568c5aa 
[ Upstream commit dafabb6 ]

In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses
fallback tunnel device pointer, which is fb_tunnel_dev.
This pointer variable should be set to NULL when a fb interface is deleted.
But there is no routine to set fb_tunnel_dev pointer to NULL.
So, this pointer will be still used after interface is deleted and
it eventually results in the use-after-free problem.

Test commands:
    ip netns add A
    ip netns add B
    ip link add eth0 type veth peer name eth1
    ip link set eth0 netns A
    ip link set eth1 netns B

    ip netns exec A ip link set lo up
    ip netns exec A ip link set eth0 up
    ip netns exec A ip link add ip6gre1 type ip6gre local fc:0::1 \
	    remote fc:0::2
    ip netns exec A ip -6 a a fc:100::1/64 dev ip6gre1
    ip netns exec A ip link set ip6gre1 up
    ip netns exec A ip -6 a a fc:0::1/64 dev eth0
    ip netns exec A ip link set ip6gre0 up

    ip netns exec B ip link set lo up
    ip netns exec B ip link set eth1 up
    ip netns exec B ip link add ip6gre1 type ip6gre local fc:0::2 \
	    remote fc:0::1
    ip netns exec B ip -6 a a fc:100::2/64 dev ip6gre1
    ip netns exec B ip link set ip6gre1 up
    ip netns exec B ip -6 a a fc:0::2/64 dev eth1
    ip netns exec B ip link set ip6gre0 up
    ip netns exec A ping fc:100::2 -s 60000 &
    ip netns del B

Splat looks like:
[   73.087285][    C1] BUG: KASAN: use-after-free in ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.088361][    C1] Read of size 4 at addr ffff888040559218 by task ping/1429
[   73.089317][    C1]
[   73.089638][    C1] CPU: 1 PID: 1429 Comm: ping Not tainted 5.7.0+ #602
[   73.090531][    C1] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   73.091725][    C1] Call Trace:
[   73.092160][    C1]  <IRQ>
[   73.092556][    C1]  dump_stack+0x96/0xdb
[   73.093122][    C1]  print_address_description.constprop.6+0x2cc/0x450
[   73.094016][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.094894][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.095767][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.096619][    C1]  kasan_report+0x154/0x190
[   73.097209][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.097989][    C1]  ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.098750][    C1]  ? gre_del_protocol+0x60/0x60 [gre]
[   73.099500][    C1]  gre_rcv+0x1c5/0x1450 [ip6_gre]
[   73.100199][    C1]  ? ip6gre_header+0xf00/0xf00 [ip6_gre]
[   73.100985][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.101830][    C1]  ? ip6_input_finish+0x5/0xf0
[   73.102483][    C1]  ip6_protocol_deliver_rcu+0xcbb/0x1510
[   73.103296][    C1]  ip6_input_finish+0x5b/0xf0
[   73.103920][    C1]  ip6_input+0xcd/0x2c0
[   73.104473][    C1]  ? ip6_input_finish+0xf0/0xf0
[   73.105115][    C1]  ? rcu_read_lock_held+0x90/0xa0
[   73.105783][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.106548][    C1]  ipv6_rcv+0x1f1/0x300
[ ... ]

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c12b395 ("gre: Support GRE over IPv6")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
popcornmix pushed a commit that referenced this pull request Jul 1, 2020
@TaeheeYoo
ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
1ea4909 
[ Upstream commit dafabb6 ]

In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses
fallback tunnel device pointer, which is fb_tunnel_dev.
This pointer variable should be set to NULL when a fb interface is deleted.
But there is no routine to set fb_tunnel_dev pointer to NULL.
So, this pointer will be still used after interface is deleted and
it eventually results in the use-after-free problem.

Test commands:
    ip netns add A
    ip netns add B
    ip link add eth0 type veth peer name eth1
    ip link set eth0 netns A
    ip link set eth1 netns B

    ip netns exec A ip link set lo up
    ip netns exec A ip link set eth0 up
    ip netns exec A ip link add ip6gre1 type ip6gre local fc:0::1 \
	    remote fc:0::2
    ip netns exec A ip -6 a a fc:100::1/64 dev ip6gre1
    ip netns exec A ip link set ip6gre1 up
    ip netns exec A ip -6 a a fc:0::1/64 dev eth0
    ip netns exec A ip link set ip6gre0 up

    ip netns exec B ip link set lo up
    ip netns exec B ip link set eth1 up
    ip netns exec B ip link add ip6gre1 type ip6gre local fc:0::2 \
	    remote fc:0::1
    ip netns exec B ip -6 a a fc:100::2/64 dev ip6gre1
    ip netns exec B ip link set ip6gre1 up
    ip netns exec B ip -6 a a fc:0::2/64 dev eth1
    ip netns exec B ip link set ip6gre0 up
    ip netns exec A ping fc:100::2 -s 60000 &
    ip netns del B

Splat looks like:
[   73.087285][    C1] BUG: KASAN: use-after-free in ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.088361][    C1] Read of size 4 at addr ffff888040559218 by task ping/1429
[   73.089317][    C1]
[   73.089638][    C1] CPU: 1 PID: 1429 Comm: ping Not tainted 5.7.0+ #602
[   73.090531][    C1] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   73.091725][    C1] Call Trace:
[   73.092160][    C1]  <IRQ>
[   73.092556][    C1]  dump_stack+0x96/0xdb
[   73.093122][    C1]  print_address_description.constprop.6+0x2cc/0x450
[   73.094016][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.094894][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.095767][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.096619][    C1]  kasan_report+0x154/0x190
[   73.097209][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.097989][    C1]  ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.098750][    C1]  ? gre_del_protocol+0x60/0x60 [gre]
[   73.099500][    C1]  gre_rcv+0x1c5/0x1450 [ip6_gre]
[   73.100199][    C1]  ? ip6gre_header+0xf00/0xf00 [ip6_gre]
[   73.100985][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.101830][    C1]  ? ip6_input_finish+0x5/0xf0
[   73.102483][    C1]  ip6_protocol_deliver_rcu+0xcbb/0x1510
[   73.103296][    C1]  ip6_input_finish+0x5b/0xf0
[   73.103920][    C1]  ip6_input+0xcd/0x2c0
[   73.104473][    C1]  ? ip6_input_finish+0xf0/0xf0
[   73.105115][    C1]  ? rcu_read_lock_held+0x90/0xa0
[   73.105783][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.106548][    C1]  ipv6_rcv+0x1f1/0x300
[ ... ]

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c12b395 ("gre: Support GRE over IPv6")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@ajlennon @popcornmix @alevikpes