| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250720183833.3570345-1-ovidiu.panait.oss@gmail.com>
Date: Sun, 20 Jul 2025 21:38:32 +0300
From: Ovidiu Panait <ovidiu.panait.oss@...il.com>
To: gregkh@...uxfoundation.org
Cc: linux-staging@...ts.linux.dev,
linux-kernel@...r.kernel.org,
Ovidiu Panait <ovidiu.panait.oss@...il.com>
Subject: [PATCH 1/2] staging: axis-fifo: remove sysfs interface
Firstly, the existing sysfs implementation is broken: a r/w operation
produces bogus results, as the store/show functions incorrectly try to
retrieve a 'struct axis_fifo' pointer from dev_get_drvdata(dev).
The pointer is actually stashed as drvdata in dev->parent.
Even if this issue is fixed, it is not safe to expose all fifo registers
to userspace. Poking around fifo registers can easily put the fifo in a
bad state or generate external aborts. For example, when the RLR (Receive
Length Register) is read when there is no data present in the fifo, the
following external abort is triggered:
$ cat ip_registers/rlr
axis_fifo 43c00000.axi_fifo_mm_s: receive under-read interrupt
8<--- cut here ---
Unhandled fault: imprecise external abort (0x1406) at 0xaec8d000
[aec8d000] *pgd=03f74831, *pte=0525c75f, *ppte=0525cc7f
Internal error: Oops - BUG: 1406 [#1] SMP ARM
Hardware name: Xilinx Zynq Platform
PC is at sysfs_read+0xc4/0xd8
LR is at dev_attr_show+0x6c/0xc0
pc : [<c0ff9298>] lr : [<c0adad38>] psr: 60070013
sp : e09abd18 ip : c3193000 fp : c0adaccc
r10: 00000000 r9 : c3192000 r8 : 183abab5
r7 : c1d5d5a8 r6 : c2d71440 r5 : 00000024 r4 : c3192000
r3 : e0a60024 r2 : 00000000 r1 : c3192000 r0 : c2d71444
...
Call trace:
sysfs_read from dev_attr_show+0x6c/0xc0
dev_attr_show from sysfs_kf_seq_show+0x270/0x360
sysfs_kf_seq_show from seq_read_iter+0x7f4/0x10bc
seq_read_iter from vfs_read+0x350/0x3d0
vfs_read from ksys_read+0x104/0x194
ksys_read from ret_fast_syscall+0x0/0x54
The same abort is triggered if a read is attempted on RDFD register when
the fifo is empty.
Therefore, remove the sysfs interface and only let read()/write() modify
the fifo registers. For debugging purposes, a simple read-only debugfs
interface is added in the next patch.
Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core")
Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@...il.com>
---
drivers/staging/axis-fifo/axis-fifo.c | 175 --------------------------
1 file changed, 175 deletions(-)
diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 351f983ef914..7897434f2441 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -139,180 +139,6 @@ struct axis_fifo {
struct miscdevice miscdev;
};
-/* ----------------------------
- * sysfs entries
- * ----------------------------
- */
-
-static ssize_t sysfs_write(struct device *dev, const char *buf,
- size_t count, unsigned int addr_offset)
-{
- struct axis_fifo *fifo = dev_get_drvdata(dev);
- unsigned long tmp;
- int rc;
-
- rc = kstrtoul(buf, 0, &tmp);
- if (rc < 0)
- return rc;
-
- iowrite32(tmp, fifo->base_addr + addr_offset);
-
- return count;
-}
-
-static ssize_t sysfs_read(struct device *dev, char *buf,
- unsigned int addr_offset)
-{
- struct axis_fifo *fifo = dev_get_drvdata(dev);
- unsigned int read_val;
-
- read_val = ioread32(fifo->base_addr + addr_offset);
- return sysfs_emit(buf, "0x%x\n", read_val);
-}
-
-static ssize_t isr_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_ISR_OFFSET);
-}
-
-static ssize_t isr_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_ISR_OFFSET);
-}
-
-static DEVICE_ATTR_RW(isr);
-
-static ssize_t ier_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_IER_OFFSET);
-}
-
-static ssize_t ier_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_IER_OFFSET);
-}
-
-static DEVICE_ATTR_RW(ier);
-
-static ssize_t tdfr_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_TDFR_OFFSET);
-}
-
-static DEVICE_ATTR_WO(tdfr);
-
-static ssize_t tdfv_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_TDFV_OFFSET);
-}
-
-static DEVICE_ATTR_RO(tdfv);
-
-static ssize_t tdfd_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_TDFD_OFFSET);
-}
-
-static DEVICE_ATTR_WO(tdfd);
-
-static ssize_t tlr_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_TLR_OFFSET);
-}
-
-static DEVICE_ATTR_WO(tlr);
-
-static ssize_t rdfr_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_RDFR_OFFSET);
-}
-
-static DEVICE_ATTR_WO(rdfr);
-
-static ssize_t rdfo_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_RDFO_OFFSET);
-}
-
-static DEVICE_ATTR_RO(rdfo);
-
-static ssize_t rdfd_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_RDFD_OFFSET);
-}
-
-static DEVICE_ATTR_RO(rdfd);
-
-static ssize_t rlr_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_RLR_OFFSET);
-}
-
-static DEVICE_ATTR_RO(rlr);
-
-static ssize_t srr_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_SRR_OFFSET);
-}
-
-static DEVICE_ATTR_WO(srr);
-
-static ssize_t tdr_store(struct device *dev, struct device_attribute *attr,
- const char *buf, size_t count)
-{
- return sysfs_write(dev, buf, count, XLLF_TDR_OFFSET);
-}
-
-static DEVICE_ATTR_WO(tdr);
-
-static ssize_t rdr_show(struct device *dev,
- struct device_attribute *attr, char *buf)
-{
- return sysfs_read(dev, buf, XLLF_RDR_OFFSET);
-}
-
-static DEVICE_ATTR_RO(rdr);
-
-static struct attribute *axis_fifo_attrs[] = {
- &dev_attr_isr.attr,
- &dev_attr_ier.attr,
- &dev_attr_tdfr.attr,
- &dev_attr_tdfv.attr,
- &dev_attr_tdfd.attr,
- &dev_attr_tlr.attr,
- &dev_attr_rdfr.attr,
- &dev_attr_rdfo.attr,
- &dev_attr_rdfd.attr,
- &dev_attr_rlr.attr,
- &dev_attr_srr.attr,
- &dev_attr_tdr.attr,
- &dev_attr_rdr.attr,
- NULL,
-};
-
-static const struct attribute_group axis_fifo_attrs_group = {
- .name = "ip_registers",
- .attrs = axis_fifo_attrs,
-};
-
-static const struct attribute_group *axis_fifo_attrs_groups[] = {
- &axis_fifo_attrs_group,
- NULL,
-};
-
/* ----------------------------
* implementation
* ----------------------------
@@ -877,7 +703,6 @@ static int axis_fifo_probe(struct platform_device *pdev)
fifo->miscdev.fops = &fops;
fifo->miscdev.minor = MISC_DYNAMIC_MINOR;
fifo->miscdev.name = device_name;
- fifo->miscdev.groups = axis_fifo_attrs_groups;
fifo->miscdev.parent = dev;
rc = misc_register(&fifo->miscdev);
if (rc < 0)
--
2.50.0
Powered by blists - more mailing lists