From: Thomas Weißschuh linux@weissschuh.net
[ Upstream commit 95cdd538e0e5677efbdf8aade04ec098ab98f457 ]
The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup.
Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct was freed.
Signed-off-by: Thomas Weißschuh linux@weissschuh.net Signed-off-by: Helge Deller deller@gmx.de Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com --- drivers/video/fbdev/efifb.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c index 16c1aaae9afa..53944bcc990c 100644 --- a/drivers/video/fbdev/efifb.c +++ b/drivers/video/fbdev/efifb.c @@ -570,15 +570,10 @@ static int efifb_probe(struct platform_device *dev) break; }
- err = sysfs_create_groups(&dev->dev.kobj, efifb_groups); - if (err) { - pr_err("efifb: cannot add sysfs attrs\n"); - goto err_unmap; - } err = fb_alloc_cmap(&info->cmap, 256, 0); if (err < 0) { pr_err("efifb: cannot allocate colormap\n"); - goto err_groups; + goto err_unmap; }
if (efifb_pci_dev) @@ -597,8 +592,6 @@ static int efifb_probe(struct platform_device *dev) pm_runtime_put(&efifb_pci_dev->dev);
fb_dealloc_cmap(&info->cmap); -err_groups: - sysfs_remove_groups(&dev->dev.kobj, efifb_groups); err_unmap: if (mem_flags & (EFI_MEMORY_UC | EFI_MEMORY_WC)) iounmap(info->screen_base); @@ -618,7 +611,6 @@ static int efifb_remove(struct platform_device *pdev)
/* efifb_destroy takes care of info cleanup */ unregister_framebuffer(info); - sysfs_remove_groups(&pdev->dev.kobj, efifb_groups);
return 0; } @@ -626,6 +618,7 @@ static int efifb_remove(struct platform_device *pdev) static struct platform_driver efifb_driver = { .driver = { .name = "efi-framebuffer", + .dev_groups = efifb_groups, }, .probe = efifb_probe, .remove = efifb_remove,
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 95cdd538e0e5677efbdf8aade04ec098ab98f457
WARNING: Author mismatch between patch and upstream commit: Backport author: Xiangyu Chen xiangyu.chen@eng.windriver.com Commit author: Thomas Weißschuh linux@weissschuh.net
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.11.y | Present (different SHA1: 4684d69b9670) 6.6.y | Present (different SHA1: 36bfefb6baaa) 6.1.y | Not found
Note: The patch differs from the upstream commit: --- --- - 2024-11-25 21:40:25.872982840 -0500 +++ /tmp/tmp.oieDEbdQgp 2024-11-25 21:40:25.860889130 -0500 @@ -1,3 +1,5 @@ +[ Upstream commit 95cdd538e0e5677efbdf8aade04ec098ab98f457 ] + The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup. @@ -7,15 +9,17 @@
Signed-off-by: Thomas Weißschuh linux@weissschuh.net Signed-off-by: Helge Deller deller@gmx.de +Signed-off-by: Sasha Levin sashal@kernel.org +Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com --- drivers/video/fbdev/efifb.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c -index 8dd82afb3452b..595b8e27bea66 100644 +index 16c1aaae9afa..53944bcc990c 100644 --- a/drivers/video/fbdev/efifb.c +++ b/drivers/video/fbdev/efifb.c -@@ -561,15 +561,10 @@ static int efifb_probe(struct platform_device *dev) +@@ -570,15 +570,10 @@ static int efifb_probe(struct platform_device *dev) break; }
@@ -31,27 +35,32 @@ + goto err_unmap; }
- err = devm_aperture_acquire_for_platform_device(dev, par->base, par->size); -@@ -587,8 +582,6 @@ static int efifb_probe(struct platform_device *dev) + if (efifb_pci_dev) +@@ -597,8 +592,6 @@ static int efifb_probe(struct platform_device *dev) + pm_runtime_put(&efifb_pci_dev->dev);
- err_fb_dealloc_cmap: fb_dealloc_cmap(&info->cmap); -err_groups: - sysfs_remove_groups(&dev->dev.kobj, efifb_groups); err_unmap: if (mem_flags & (EFI_MEMORY_UC | EFI_MEMORY_WC)) iounmap(info->screen_base); -@@ -608,12 +601,12 @@ static void efifb_remove(struct platform_device *pdev) +@@ -618,7 +611,6 @@ static int efifb_remove(struct platform_device *pdev)
/* efifb_destroy takes care of info cleanup */ unregister_framebuffer(info); - sysfs_remove_groups(&pdev->dev.kobj, efifb_groups); - }
+ return 0; + } +@@ -626,6 +618,7 @@ static int efifb_remove(struct platform_device *pdev) static struct platform_driver efifb_driver = { .driver = { .name = "efi-framebuffer", + .dev_groups = efifb_groups, }, .probe = efifb_probe, - .remove_new = efifb_remove, + .remove = efifb_remove, +-- +2.43.0 + ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Sasha Levin -
Xiangyu Chen