From 378f79cab12b669928f3a4037f023837ead2ce0c Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sat, 30 Sep 2017 11:15:52 +0300 Subject: misc: pci_endpoint_test: Prevent some integer overflows "size + max" can have an arithmetic overflow when we're allocating: orig_src_addr = dma_alloc_coherent(dev, size + alignment, ... I've added a few checks to prevent that. Fixes: 13107c60681f ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/misc/pci_endpoint_test.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'drivers/misc') diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c index deb203026496..c0d323077ad0 100644 --- a/drivers/misc/pci_endpoint_test.c +++ b/drivers/misc/pci_endpoint_test.c @@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size) u32 src_crc32; u32 dst_crc32; + if (size > SIZE_MAX - alignment) + goto err; + orig_src_addr = dma_alloc_coherent(dev, size + alignment, &orig_src_phys_addr, GFP_KERNEL); if (!orig_src_addr) { @@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size) size_t alignment = test->alignment; u32 crc32; + if (size > SIZE_MAX - alignment) + goto err; + orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr, GFP_KERNEL); if (!orig_addr) { @@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size) size_t alignment = test->alignment; u32 crc32; + if (size > SIZE_MAX - alignment) + goto err; + orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr, GFP_KERNEL); if (!orig_addr) { -- cgit From 846df244ebefbc9f7b91e9ae7a5e5a2e69fb4772 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sat, 30 Sep 2017 11:16:51 +0300 Subject: misc: pci_endpoint_test: Avoid triggering a BUG() If you call ida_simple_remove(&pci_endpoint_test_ida, id) with a negative "id" then it triggers an immediate BUG_ON(). Let's not allow that. Fixes: 2c156ac71c6b ("misc: Add host side PCI driver for PCI test function device") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/misc/pci_endpoint_test.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/misc') diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c index c0d323077ad0..d40a34f594c7 100644 --- a/drivers/misc/pci_endpoint_test.c +++ b/drivers/misc/pci_endpoint_test.c @@ -597,6 +597,8 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) if (sscanf(misc_device->name, DRV_MODULE_NAME ".%d", &id) != 1) return; + if (id < 0) + return; misc_deregister(&test->miscdev); ida_simple_remove(&pci_endpoint_test_ida, id); -- cgit From 06b6f1c623122bcf28f5a75b89862a68b9c884eb Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 21 Sep 2017 16:26:29 -0700 Subject: misc: altera-stapl: drop Kconfig comment When I2C is enabled, the comment string for "Altera FPGA firmware download module" adds no new information or value. It is only useful and interesting when I2C is not enabled. In that case, have it show that I2C is needed for that module. Signed-off-by: Randy Dunlap Cc: Igor M. Liplianin Signed-off-by: Greg Kroah-Hartman --- drivers/misc/altera-stapl/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/misc') diff --git a/drivers/misc/altera-stapl/Kconfig b/drivers/misc/altera-stapl/Kconfig index 7f01d8e93992..8a828fe41fad 100644 --- a/drivers/misc/altera-stapl/Kconfig +++ b/drivers/misc/altera-stapl/Kconfig @@ -1,4 +1,5 @@ -comment "Altera FPGA firmware download module" +comment "Altera FPGA firmware download module (requires I2C)" + depends on !I2C config ALTERA_STAPL tristate "Altera FPGA firmware download module" -- cgit From 876a1b08d0f9d7df406f702a9aba0e058500efac Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Sun, 24 Sep 2017 11:16:18 -0700 Subject: misc: mic: move to its own menu in Misc devices Move the Intel MIC drivers into their own menu. This is due to the number of drivers (Kconfig entries) here and it simplifies (cleans up) the "Misc devices" menu. Signed-off-by: Randy Dunlap Cc: Sudeep Dutt Cc: Ashutosh Dixit Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mic/Kconfig | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/misc') diff --git a/drivers/misc/mic/Kconfig b/drivers/misc/mic/Kconfig index 6fd9d367dea7..227cc7443671 100644 --- a/drivers/misc/mic/Kconfig +++ b/drivers/misc/mic/Kconfig @@ -1,3 +1,5 @@ +menu "Intel MIC & related support" + comment "Intel MIC Bus Driver" config INTEL_MIC_BUS @@ -150,3 +152,5 @@ config VOP if VOP source "drivers/vhost/Kconfig.vringh" endif + +endmenu -- cgit From 421eb12ead322d66b469b8bf658eca2213f409f5 Mon Sep 17 00:00:00 2001 From: "Steven Rostedt (VMware)" Date: Fri, 13 Oct 2017 09:58:11 -0400 Subject: tracing, mei: Remove unused trace event mei_pci_cfg_write Commit a96c548291 ("mei: trace pci configuration space io") added the trace event mei_pci_cfg_write but never used it. As trace events that are defined take up space for data structures and functions created for them, it is a waste of memory to have one defined but not used. Remove this trace event. Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/mei-trace.c | 1 - drivers/misc/mei/mei-trace.h | 19 ------------------- 2 files changed, 20 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/mei/mei-trace.c b/drivers/misc/mei/mei-trace.c index e19e6acb191b..374edde72a14 100644 --- a/drivers/misc/mei/mei-trace.c +++ b/drivers/misc/mei/mei-trace.c @@ -23,5 +23,4 @@ EXPORT_TRACEPOINT_SYMBOL(mei_reg_read); EXPORT_TRACEPOINT_SYMBOL(mei_reg_write); EXPORT_TRACEPOINT_SYMBOL(mei_pci_cfg_read); -EXPORT_TRACEPOINT_SYMBOL(mei_pci_cfg_write); #endif /* __CHECKER__ */ diff --git a/drivers/misc/mei/mei-trace.h b/drivers/misc/mei/mei-trace.h index 7d2d5d4a1624..b52e9b97a7c0 100644 --- a/drivers/misc/mei/mei-trace.h +++ b/drivers/misc/mei/mei-trace.h @@ -83,25 +83,6 @@ TRACE_EVENT(mei_pci_cfg_read, __get_str(dev), __entry->reg, __entry->offs, __entry->val) ); -TRACE_EVENT(mei_pci_cfg_write, - TP_PROTO(const struct device *dev, const char *reg, u32 offs, u32 val), - TP_ARGS(dev, reg, offs, val), - TP_STRUCT__entry( - __string(dev, dev_name(dev)) - __field(const char *, reg) - __field(u32, offs) - __field(u32, val) - ), - TP_fast_assign( - __assign_str(dev, dev_name(dev)) - __entry->reg = reg; - __entry->offs = offs; - __entry->val = val; - ), - TP_printk("[%s] pci cfg write %s[%#x] = %#x", - __get_str(dev), __entry->reg, __entry->offs, __entry->val) -); - #endif /* _MEI_TRACE_H_ */ /* This part must be outside protection */ -- cgit From 31c5c870a1120960ec4157e6a5ea34686c77f6b8 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Fri, 20 Oct 2017 06:31:27 -0700 Subject: lkdtm: Convert from jprobe to kprobe The jprobe subsystem is being removed, so convert to using kprobe instead. Cc: Masami Hiramatsu Signed-off-by: Kees Cook Signed-off-by: Greg Kroah-Hartman --- drivers/misc/lkdtm_core.c | 154 ++++++++++++++-------------------------------- 1 file changed, 45 insertions(+), 109 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index 981b3ef71e47..ed7f0c61c59a 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -56,122 +56,54 @@ static ssize_t direct_entry(struct file *f, const char __user *user_buf, size_t count, loff_t *off); #ifdef CONFIG_KPROBES -static void lkdtm_handler(void); +static int lkdtm_kprobe_handler(struct kprobe *kp, struct pt_regs *regs); static ssize_t lkdtm_debugfs_entry(struct file *f, const char __user *user_buf, size_t count, loff_t *off); - - -/* jprobe entry point handlers. */ -static unsigned int jp_do_irq(unsigned int irq) -{ - lkdtm_handler(); - jprobe_return(); - return 0; -} - -static irqreturn_t jp_handle_irq_event(unsigned int irq, - struct irqaction *action) -{ - lkdtm_handler(); - jprobe_return(); - return 0; -} - -static void jp_tasklet_action(struct softirq_action *a) -{ - lkdtm_handler(); - jprobe_return(); -} - -static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[]) -{ - lkdtm_handler(); - jprobe_return(); -} - -struct scan_control; - -static unsigned long jp_shrink_inactive_list(unsigned long max_scan, - struct zone *zone, - struct scan_control *sc) -{ - lkdtm_handler(); - jprobe_return(); - return 0; -} - -static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim, - const enum hrtimer_mode mode) -{ - lkdtm_handler(); - jprobe_return(); - return 0; -} - -static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd) -{ - lkdtm_handler(); - jprobe_return(); - return 0; -} - -# ifdef CONFIG_IDE -static int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file, - struct block_device *bdev, unsigned int cmd, - unsigned long arg) -{ - lkdtm_handler(); - jprobe_return(); - return 0; -} -# endif +# define CRASHPOINT_KPROBE(_symbol) \ + .kprobe = { \ + .symbol_name = (_symbol), \ + .pre_handler = lkdtm_kprobe_handler, \ + }, +# define CRASHPOINT_WRITE(_symbol) \ + (_symbol) ? lkdtm_debugfs_entry : direct_entry +#else +# define CRASHPOINT_KPROBE(_symbol) +# define CRASHPOINT_WRITE(_symbol) direct_entry #endif /* Crash points */ struct crashpoint { const char *name; const struct file_operations fops; - struct jprobe jprobe; + struct kprobe kprobe; }; -#define CRASHPOINT(_name, _write, _symbol, _entry) \ +#define CRASHPOINT(_name, _symbol) \ { \ .name = _name, \ .fops = { \ .read = lkdtm_debugfs_read, \ .llseek = generic_file_llseek, \ .open = lkdtm_debugfs_open, \ - .write = _write, \ - }, \ - .jprobe = { \ - .kp.symbol_name = _symbol, \ - .entry = (kprobe_opcode_t *)_entry, \ + .write = CRASHPOINT_WRITE(_symbol) \ }, \ + CRASHPOINT_KPROBE(_symbol) \ } /* Define the possible places where we can trigger a crash point. */ -struct crashpoint crashpoints[] = { - CRASHPOINT("DIRECT", direct_entry, - NULL, NULL), +static struct crashpoint crashpoints[] = { + CRASHPOINT("DIRECT", NULL), #ifdef CONFIG_KPROBES - CRASHPOINT("INT_HARDWARE_ENTRY", lkdtm_debugfs_entry, - "do_IRQ", jp_do_irq), - CRASHPOINT("INT_HW_IRQ_EN", lkdtm_debugfs_entry, - "handle_IRQ_event", jp_handle_irq_event), - CRASHPOINT("INT_TASKLET_ENTRY", lkdtm_debugfs_entry, - "tasklet_action", jp_tasklet_action), - CRASHPOINT("FS_DEVRW", lkdtm_debugfs_entry, - "ll_rw_block", jp_ll_rw_block), - CRASHPOINT("MEM_SWAPOUT", lkdtm_debugfs_entry, - "shrink_inactive_list", jp_shrink_inactive_list), - CRASHPOINT("TIMERADD", lkdtm_debugfs_entry, - "hrtimer_start", jp_hrtimer_start), - CRASHPOINT("SCSI_DISPATCH_CMD", lkdtm_debugfs_entry, - "scsi_dispatch_cmd", jp_scsi_dispatch_cmd), + CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"), + CRASHPOINT("INT_HW_IRQ_EN", "handle_IRQ_event"), + CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"), + CRASHPOINT("FS_DEVRW", "ll_rw_block"), + CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"), + CRASHPOINT("TIMERADD", "hrtimer_start"), + CRASHPOINT("SCSI_DISPATCH_CMD", "scsi_dispatch_cmd"), # ifdef CONFIG_IDE - CRASHPOINT("IDE_CORE_CP", lkdtm_debugfs_entry, - "generic_ide_ioctl", jp_generic_ide_ioctl), + CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"), # endif #endif }; @@ -254,8 +186,8 @@ struct crashtype crashtypes[] = { }; -/* Global jprobe entry and crashtype. */ -static struct jprobe *lkdtm_jprobe; +/* Global kprobe entry and crashtype. */ +static struct kprobe *lkdtm_kprobe; struct crashpoint *lkdtm_crashpoint; struct crashtype *lkdtm_crashtype; @@ -298,7 +230,8 @@ static struct crashtype *find_crashtype(const char *name) */ static noinline void lkdtm_do_action(struct crashtype *crashtype) { - BUG_ON(!crashtype || !crashtype->func); + if (WARN_ON(!crashtype || !crashtype->func)) + return; crashtype->func(); } @@ -308,22 +241,22 @@ static int lkdtm_register_cpoint(struct crashpoint *crashpoint, int ret; /* If this doesn't have a symbol, just call immediately. */ - if (!crashpoint->jprobe.kp.symbol_name) { + if (!crashpoint->kprobe.symbol_name) { lkdtm_do_action(crashtype); return 0; } - if (lkdtm_jprobe != NULL) - unregister_jprobe(lkdtm_jprobe); + if (lkdtm_kprobe != NULL) + unregister_kprobe(lkdtm_kprobe); lkdtm_crashpoint = crashpoint; lkdtm_crashtype = crashtype; - lkdtm_jprobe = &crashpoint->jprobe; - ret = register_jprobe(lkdtm_jprobe); + lkdtm_kprobe = &crashpoint->kprobe; + ret = register_kprobe(lkdtm_kprobe); if (ret < 0) { - pr_info("Couldn't register jprobe %s\n", - crashpoint->jprobe.kp.symbol_name); - lkdtm_jprobe = NULL; + pr_info("Couldn't register kprobe %s\n", + crashpoint->kprobe.symbol_name); + lkdtm_kprobe = NULL; lkdtm_crashpoint = NULL; lkdtm_crashtype = NULL; } @@ -336,13 +269,14 @@ static int lkdtm_register_cpoint(struct crashpoint *crashpoint, static int crash_count = DEFAULT_COUNT; static DEFINE_SPINLOCK(crash_count_lock); -/* Called by jprobe entry points. */ -static void lkdtm_handler(void) +/* Called by kprobe entry points. */ +static int lkdtm_kprobe_handler(struct kprobe *kp, struct pt_regs *regs) { unsigned long flags; bool do_it = false; - BUG_ON(!lkdtm_crashpoint || !lkdtm_crashtype); + if (WARN_ON(!lkdtm_crashpoint || !lkdtm_crashtype)) + return 0; spin_lock_irqsave(&crash_count_lock, flags); crash_count--; @@ -357,6 +291,8 @@ static void lkdtm_handler(void) if (do_it) lkdtm_do_action(lkdtm_crashtype); + + return 0; } static ssize_t lkdtm_debugfs_entry(struct file *f, @@ -556,8 +492,8 @@ static void __exit lkdtm_module_exit(void) /* Handle test-specific clean-up. */ lkdtm_usercopy_exit(); - if (lkdtm_jprobe != NULL) - unregister_jprobe(lkdtm_jprobe); + if (lkdtm_kprobe != NULL) + unregister_kprobe(lkdtm_kprobe); pr_info("Crash point unregistered\n"); } -- cgit From 75f98b7ab748a6f604d667d84ec46acc452fdfc1 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Fri, 20 Oct 2017 06:31:49 -0700 Subject: lkdtm: Constify the crashtypes table Since nothing in the crashtypes table ever changes, mark it const. Adds some missing "static" markings as well. Signed-off-by: Kees Cook Signed-off-by: Greg Kroah-Hartman --- drivers/misc/lkdtm_core.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index ed7f0c61c59a..ba92291508dc 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -122,7 +122,7 @@ struct crashtype { } /* Define the possible types of crashes that can be triggered. */ -struct crashtype crashtypes[] = { +static const struct crashtype crashtypes[] = { CRASHTYPE(PANIC), CRASHTYPE(BUG), CRASHTYPE(WARNING), @@ -188,8 +188,8 @@ struct crashtype crashtypes[] = { /* Global kprobe entry and crashtype. */ static struct kprobe *lkdtm_kprobe; -struct crashpoint *lkdtm_crashpoint; -struct crashtype *lkdtm_crashtype; +static struct crashpoint *lkdtm_crashpoint; +static const struct crashtype *lkdtm_crashtype; /* Module parameters */ static int recur_count = -1; @@ -212,7 +212,7 @@ MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\ /* Return the crashtype number or NULL if the name is invalid */ -static struct crashtype *find_crashtype(const char *name) +static const struct crashtype *find_crashtype(const char *name) { int i; @@ -228,7 +228,7 @@ static struct crashtype *find_crashtype(const char *name) * This is forced noinline just so it distinctly shows up in the stackdump * which makes validation of expected lkdtm crashes easier. */ -static noinline void lkdtm_do_action(struct crashtype *crashtype) +static noinline void lkdtm_do_action(const struct crashtype *crashtype) { if (WARN_ON(!crashtype || !crashtype->func)) return; @@ -236,7 +236,7 @@ static noinline void lkdtm_do_action(struct crashtype *crashtype) } static int lkdtm_register_cpoint(struct crashpoint *crashpoint, - struct crashtype *crashtype) + const struct crashtype *crashtype) { int ret; @@ -300,7 +300,7 @@ static ssize_t lkdtm_debugfs_entry(struct file *f, size_t count, loff_t *off) { struct crashpoint *crashpoint = file_inode(f)->i_private; - struct crashtype *crashtype = NULL; + const struct crashtype *crashtype = NULL; char *buf; int err; @@ -368,7 +368,7 @@ static int lkdtm_debugfs_open(struct inode *inode, struct file *file) static ssize_t direct_entry(struct file *f, const char __user *user_buf, size_t count, loff_t *off) { - struct crashtype *crashtype; + const struct crashtype *crashtype; char *buf; if (count >= PAGE_SIZE) @@ -404,7 +404,7 @@ static struct dentry *lkdtm_debugfs_root; static int __init lkdtm_module_init(void) { struct crashpoint *crashpoint = NULL; - struct crashtype *crashtype = NULL; + const struct crashtype *crashtype = NULL; int ret = -EINVAL; int i; -- cgit From de4ce2d1ad1bb3304d4107160c9551b7fd8d8ec5 Mon Sep 17 00:00:00 2001 From: "Guilherme G. Piccoli" Date: Fri, 20 Oct 2017 17:27:49 -0200 Subject: genwqe: Take R/W permissions into account when dealing with memory pages Currently we assume userspace pages are always writable when doing memory pinning. This is not true, specially since userspace applications may allocate their memory the way they want, we have no control over it. If a read-only page is set for pinning, currently the driver fails due to get_user_pages_fast() refusing to map read-only pages as writable. This patch changes this behavior, by taking the permission flags of the pages into account in both pinning/unpinning process, as well as in the DMA data copy-back to userpace (which we shouldn't try to do blindly, since it will fail in case of read-only-pages). Signed-off-by: Frank Haverkamp Signed-off-by: Guilherme G. Piccoli Signed-off-by: Greg Kroah-Hartman --- drivers/misc/genwqe/card_base.h | 7 ++++++- drivers/misc/genwqe/card_dev.c | 6 +++++- drivers/misc/genwqe/card_utils.c | 43 +++++++++++++++++++++++++--------------- 3 files changed, 38 insertions(+), 18 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h index 5813b5f25006..3743c87f8ab9 100644 --- a/drivers/misc/genwqe/card_base.h +++ b/drivers/misc/genwqe/card_base.h @@ -182,6 +182,7 @@ struct dma_mapping { struct list_head card_list; /* list of usr_maps for card */ struct list_head pin_list; /* list of pinned memory for dev */ + int write; /* writable map? useful in unmapping */ }; static inline void genwqe_mapping_init(struct dma_mapping *m, @@ -189,6 +190,7 @@ static inline void genwqe_mapping_init(struct dma_mapping *m, { memset(m, 0, sizeof(*m)); m->type = type; + m->write = 1; /* Assume the maps we create are R/W */ } /** @@ -347,6 +349,7 @@ enum genwqe_requ_state { * @user_size: size of user-space memory area * @page: buffer for partial pages if needed * @page_dma_addr: dma address partial pages + * @write: should we write it back to userspace? */ struct genwqe_sgl { dma_addr_t sgl_dma_addr; @@ -356,6 +359,8 @@ struct genwqe_sgl { void __user *user_addr; /* user-space base-address */ size_t user_size; /* size of memory area */ + int write; + unsigned long nr_pages; unsigned long fpage_offs; size_t fpage_size; @@ -369,7 +374,7 @@ struct genwqe_sgl { }; int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - void __user *user_addr, size_t user_size); + void __user *user_addr, size_t user_size, int write); int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, dma_addr_t *dma_list); diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c index dd4617764f14..3ecfa35457e0 100644 --- a/drivers/misc/genwqe/card_dev.c +++ b/drivers/misc/genwqe/card_dev.c @@ -942,6 +942,10 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req) genwqe_mapping_init(m, GENWQE_MAPPING_SGL_TEMP); + + if (ats_flags == ATS_TYPE_SGL_RD) + m->write = 0; + rc = genwqe_user_vmap(cd, m, (void *)u_addr, u_size, req); if (rc != 0) @@ -954,7 +958,7 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req) /* create genwqe style scatter gather list */ rc = genwqe_alloc_sync_sgl(cd, &req->sgls[i], (void __user *)u_addr, - u_size); + u_size, m->write); if (rc != 0) goto err_out; diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c index 147b83011b58..5c0d917636f7 100644 --- a/drivers/misc/genwqe/card_utils.c +++ b/drivers/misc/genwqe/card_utils.c @@ -296,7 +296,7 @@ static int genwqe_sgl_size(int num_pages) * from user-space into the cached pages. */ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - void __user *user_addr, size_t user_size) + void __user *user_addr, size_t user_size, int write) { int rc; struct pci_dev *pci_dev = cd->pci_dev; @@ -312,6 +312,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, sgl->user_addr = user_addr; sgl->user_size = user_size; + sgl->write = write; sgl->sgl_size = genwqe_sgl_size(sgl->nr_pages); if (get_order(sgl->sgl_size) > MAX_ORDER) { @@ -476,14 +477,20 @@ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, int genwqe_free_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl) { int rc = 0; + size_t offset; + unsigned long res; struct pci_dev *pci_dev = cd->pci_dev; if (sgl->fpage) { - if (copy_to_user(sgl->user_addr, sgl->fpage + sgl->fpage_offs, - sgl->fpage_size)) { - dev_err(&pci_dev->dev, "[%s] err: copying fpage!\n", - __func__); - rc = -EFAULT; + if (sgl->write) { + res = copy_to_user(sgl->user_addr, + sgl->fpage + sgl->fpage_offs, sgl->fpage_size); + if (res) { + dev_err(&pci_dev->dev, + "[%s] err: copying fpage! (res=%lu)\n", + __func__, res); + rc = -EFAULT; + } } __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage, sgl->fpage_dma_addr); @@ -491,12 +498,16 @@ int genwqe_free_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl) sgl->fpage_dma_addr = 0; } if (sgl->lpage) { - if (copy_to_user(sgl->user_addr + sgl->user_size - - sgl->lpage_size, sgl->lpage, - sgl->lpage_size)) { - dev_err(&pci_dev->dev, "[%s] err: copying lpage!\n", - __func__); - rc = -EFAULT; + if (sgl->write) { + offset = sgl->user_size - sgl->lpage_size; + res = copy_to_user(sgl->user_addr + offset, sgl->lpage, + sgl->lpage_size); + if (res) { + dev_err(&pci_dev->dev, + "[%s] err: copying lpage! (res=%lu)\n", + __func__, res); + rc = -EFAULT; + } } __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage, sgl->lpage_dma_addr); @@ -599,14 +610,14 @@ int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr, /* pin user pages in memory */ rc = get_user_pages_fast(data & PAGE_MASK, /* page aligned addr */ m->nr_pages, - 1, /* write by caller */ + m->write, /* readable/writable */ m->page_list); /* ptrs to pages */ if (rc < 0) goto fail_get_user_pages; /* assumption: get_user_pages can be killed by signals. */ if (rc < m->nr_pages) { - free_user_pages(m->page_list, rc, 0); + free_user_pages(m->page_list, rc, m->write); rc = -EFAULT; goto fail_get_user_pages; } @@ -618,7 +629,7 @@ int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr, return 0; fail_free_user_pages: - free_user_pages(m->page_list, m->nr_pages, 0); + free_user_pages(m->page_list, m->nr_pages, m->write); fail_get_user_pages: kfree(m->page_list); @@ -651,7 +662,7 @@ int genwqe_user_vunmap(struct genwqe_dev *cd, struct dma_mapping *m, genwqe_unmap_pages(cd, m->dma_list, m->nr_pages); if (m->page_list) { - free_user_pages(m->page_list, m->nr_pages, 1); + free_user_pages(m->page_list, m->nr_pages, m->write); kfree(m->page_list); m->page_list = NULL; -- cgit From 4e826adcaafa4b599811ddf39b6b814b8e1b4f5e Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Tue, 24 Oct 2017 03:23:39 -0700 Subject: drivers/sgi-xp: Convert timers to use timer_setup() In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Cliff Whickman Signed-off-by: Kees Cook Acked-by: Robin Holt Signed-off-by: Greg Kroah-Hartman --- drivers/misc/sgi-xp/xpc_main.c | 15 ++++++--------- drivers/misc/sgi-xp/xpc_sn2.c | 15 ++++++--------- 2 files changed, 12 insertions(+), 18 deletions(-) (limited to 'drivers/misc') diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c index 7f327121e6d7..0c775d6fcf59 100644 --- a/drivers/misc/sgi-xp/xpc_main.c +++ b/drivers/misc/sgi-xp/xpc_main.c @@ -172,9 +172,9 @@ struct xpc_arch_operations xpc_arch_ops; * Timer function to enforce the timelimit on the partition disengage. */ static void -xpc_timeout_partition_disengage(unsigned long data) +xpc_timeout_partition_disengage(struct timer_list *t) { - struct xpc_partition *part = (struct xpc_partition *)data; + struct xpc_partition *part = from_timer(part, t, disengage_timer); DBUG_ON(time_is_after_jiffies(part->disengage_timeout)); @@ -190,7 +190,7 @@ xpc_timeout_partition_disengage(unsigned long data) * specify when the next timeout should occur. */ static void -xpc_hb_beater(unsigned long dummy) +xpc_hb_beater(struct timer_list *unused) { xpc_arch_ops.increment_heartbeat(); @@ -205,8 +205,7 @@ static void xpc_start_hb_beater(void) { xpc_arch_ops.heartbeat_init(); - init_timer(&xpc_hb_timer); - xpc_hb_timer.function = xpc_hb_beater; + timer_setup(&xpc_hb_timer, xpc_hb_beater, 0); xpc_hb_beater(0); } @@ -931,10 +930,8 @@ xpc_setup_partitions(void) part->act_state = XPC_P_AS_INACTIVE; XPC_SET_REASON(part, 0, 0); - init_timer(&part->disengage_timer); - part->disengage_timer.function = - xpc_timeout_partition_disengage; - part->disengage_timer.data = (unsigned long)part; + timer_setup(&part->disengage_timer, + xpc_timeout_partition_disengage, 0); part->setup_state = XPC_P_SS_UNSET; init_waitqueue_head(&part->teardown_wq); diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c index 7d71c04fc938..5a12d2a54049 100644 --- a/drivers/misc/sgi-xp/xpc_sn2.c +++ b/drivers/misc/sgi-xp/xpc_sn2.c @@ -323,16 +323,16 @@ xpc_handle_notify_IRQ_sn2(int irq, void *dev_id) * was received. */ static void -xpc_check_for_dropped_notify_IRQ_sn2(struct xpc_partition *part) +xpc_check_for_dropped_notify_IRQ_sn2(struct timer_list *t) { - struct xpc_partition_sn2 *part_sn2 = &part->sn.sn2; + struct xpc_partition *part = + from_timer(part, t, sn.sn2.dropped_notify_IRQ_timer); if (xpc_part_ref(part)) { xpc_check_for_sent_chctl_flags_sn2(part); - part_sn2->dropped_notify_IRQ_timer.expires = jiffies + - XPC_DROPPED_NOTIFY_IRQ_WAIT_INTERVAL; - add_timer(&part_sn2->dropped_notify_IRQ_timer); + t->expires = jiffies + XPC_DROPPED_NOTIFY_IRQ_WAIT_INTERVAL; + add_timer(t); xpc_part_deref(part); } } @@ -1232,10 +1232,7 @@ xpc_setup_ch_structures_sn2(struct xpc_partition *part) /* Setup a timer to check for dropped notify IRQs */ timer = &part_sn2->dropped_notify_IRQ_timer; - init_timer(timer); - timer->function = - (void (*)(unsigned long))xpc_check_for_dropped_notify_IRQ_sn2; - timer->data = (unsigned long)part; + timer_setup(timer, xpc_check_for_dropped_notify_IRQ_sn2, 0); timer->expires = jiffies + XPC_DROPPED_NOTIFY_IRQ_WAIT_INTERVAL; add_timer(timer); -- cgit