github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-22 22:22:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bug fixes for intel ntb driver debugfs, use after free in switchtec

Browse Source 
driver, ntb transport rx ring buffers.  Also, cleanups in printks,
 kernel-docs, and idt driver comment.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoE9b9c3U2JxX98mqbmZLrHqL0iMFAmbtj00ACgkQbmZLrHqL
 0iNH6A/+JzxP8uH8FK4yUM6EFtT03gFZvuhYZ80JnjHWk19mu/zxzdm3uwZ5DZ5h
 utOz7lHn2mljkq2y+rLTDyZqcpkRQgS1jsGSOdv/NnR6kZ6+siGl01sjYXUbv2+9
 eUyyLcq1CksLCqjCEc5WYARo84JIxugDxkEpAS0JZRZSU7DvrvGz0bmuEyLnaFY/
 HVi4bwmCS+/m13tJeh2f+OpNZkw8yt/pE8miYsmyJM/YUhFVr7hflOGo0ObtuG15
 csvyIx7sPVuRr7ecA6kfcAR6cRf5lMuaW7twuGywU2bnJ5UvQtn2lolB4qR6yg04
 L3QYnx/PMUpUe7RhuEmEylib4TistsIRH0+N+YLBnCaeqVF/UM372fo8g6U4iytV
 AnqAo+YfKNb92i1I+XdlqfT/u/HD+o6bXpbj1H+dxgKHrwqiqLT05TFn9kYCQdz+
 sNsE2S8JivqL3MmLlnk57v93CVW3/b5kewsjRwF/NsW2Eb75WCuEbmGi3aDRU20F
 DRBUxYDR2o15f4aK1jDYA6R7hDO7b6233VNWssNudypKPTCP6L8GRaMiwyiLaz8m
 7g2I0f2lmcYPR0FGoLaM+DA3z9a7fM8I5ynkWkbrmOsyZM1aaXMVEj/uvmSkeSHa
 bpZYQYNrL4g4mwofGH+dGeGtQNkCyLZL1lGhVWDjsoiWl+qWClk=
 =lFRT
 -----END PGP SIGNATURE-----

Merge tag 'ntb-6.12' of https://github.com/jonmason/ntb

Pull PCIe non-transparent bridge updates from Jon Mason:
 "Bug fixes for intel ntb driver debugfs, use after free in switchtec
  driver, ntb transport rx ring buffers. Also, cleanups in printks,
  kernel-docs, and idt driver comment"

* tag 'ntb-6.12' of https://github.com/jonmason/ntb:
  ntb: Force physically contiguous allocation of rx ring buffers
  ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  ntb: idt: Fix the cacography in ntb_hw_idt.c
  NTB: epf: don't misuse kernel-doc marker
  NTB: ntb_transport: fix all kernel-doc warnings
  ntb: Constify struct bus_type
  ntb_perf: Fix printk format
  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
This commit is contained in:
Linus Torvalds 2024-09-23 13:10:49 -07:00
commit 5f153b6330
7 changed files with 31 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/ntb/core.c
View File

@ -72,7 +72,7 @@ MODULE_VERSION(DRIVER_VERSION);
MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(DRIVER_DESCRIPTION);
static struct bus_type ntb_bus;
static const struct bus_type ntb_bus;
static void ntb_dev_release(struct device *dev);
int __ntb_register_client(struct ntb_client *client, struct module *mod,
@ -298,7 +298,7 @@ static void ntb_dev_release(struct device *dev)
complete(&ntb->released);
}
static struct bus_type ntb_bus = {
static const struct bus_type ntb_bus = {
.name = "ntb",
.probe = ntb_probe,
.remove = ntb_remove,

2
drivers/ntb/hw/epf/ntb_hw_epf.c
View File

@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0
/**
/*
* Host side endpoint driver to implement Non-Transparent Bridge functionality
*
* Copyright (C) 2020 Texas Instruments

2
drivers/ntb/hw/idt/ntb_hw_idt.c
View File

@ -2547,7 +2547,7 @@ static void idt_deinit_dbgfs(struct idt_ntb_dev *ndev)
*/
/*
* idt_check_setup() - Check whether the IDT PCIe-swtich is properly
* idt_check_setup() - Check whether the IDT PCIe-switch is properly
* pre-initialized
* @pdev: Pointer to the PCI device descriptor
*

2
drivers/ntb/hw/intel/ntb_hw_gen1.c
View File

@ -778,7 +778,7 @@ static void ndev_init_debugfs(struct intel_ntb_dev *ndev)
ndev->debugfs_dir =
debugfs_create_dir(pci_name(ndev->ntb.pdev),
debugfs_dir);
if (!ndev->debugfs_dir)
if (IS_ERR(ndev->debugfs_dir))
ndev->debugfs_info = NULL;
else
ndev->debugfs_info =

1
drivers/ntb/hw/mscc/ntb_hw_switchtec.c
View File

@ -1554,6 +1554,7 @@ static void switchtec_ntb_remove(struct device *dev)
switchtec_ntb_deinit_db_msg_irq(sndev);
switchtec_ntb_deinit_shared_mw(sndev);
switchtec_ntb_deinit_crosslink(sndev);
cancel_work_sync(&sndev->check_link_status_work);
kfree(sndev);
dev_info(dev, "ntb device unregistered\n");
}

33
drivers/ntb/ntb_transport.c
View File

@ -314,7 +314,7 @@ static void ntb_transport_bus_remove(struct device *dev)
put_device(dev);
}
static struct bus_type ntb_transport_bus = {
static const struct bus_type ntb_transport_bus = {
.name = "ntb_transport",
.match = ntb_transport_bus_match,
.probe = ntb_transport_bus_probe,
@ -377,6 +377,8 @@ EXPORT_SYMBOL_GPL(ntb_transport_unregister_client_dev);
* @device_name: Name of NTB client device
*
* Register an NTB client device with the NTB transport layer
*
* Returns: %0 on success or -errno code on error
*/
int ntb_transport_register_client_dev(char *device_name)
{
@ -807,16 +809,29 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw)
}
static int ntb_alloc_mw_buffer(struct ntb_transport_mw *mw,
struct device *dma_dev, size_t align)
struct device *ntb_dev, size_t align)
{
dma_addr_t dma_addr;
void *alloc_addr, *virt_addr;
int rc;
alloc_addr = dma_alloc_coherent(dma_dev, mw->alloc_size,
&dma_addr, GFP_KERNEL);
/*
* The buffer here is allocated against the NTB device. The reason to
* use dma_alloc_*() call is to allocate a large IOVA contiguous buffer
* backing the NTB BAR for the remote host to write to. During receive
* processing, the data is being copied out of the receive buffer to
* the kernel skbuff. When a DMA device is being used, dma_map_page()
* is called on the kvaddr of the receive buffer (from dma_alloc_*())
* and remapped against the DMA device. It appears to be a double
* DMA mapping of buffers, but first is mapped to the NTB device and
* second is to the DMA device. DMA_ATTR_FORCE_CONTIGUOUS is necessary
* in order for the later dma_map_page() to not fail.
*/
alloc_addr = dma_alloc_attrs(ntb_dev, mw->alloc_size,
&dma_addr, GFP_KERNEL,
DMA_ATTR_FORCE_CONTIGUOUS);
if (!alloc_addr) {
dev_err(dma_dev, "Unable to alloc MW buff of size %zu\n",
dev_err(ntb_dev, "Unable to alloc MW buff of size %zu\n",
mw->alloc_size);
return -ENOMEM;
}
@ -845,7 +860,7 @@ static int ntb_alloc_mw_buffer(struct ntb_transport_mw *mw,
return 0;
err:
dma_free_coherent(dma_dev, mw->alloc_size, alloc_addr, dma_addr);
dma_free_coherent(ntb_dev, mw->alloc_size, alloc_addr, dma_addr);
return rc;
}
@ -1966,9 +1981,9 @@ static bool ntb_dma_filter_fn(struct dma_chan *chan, void *node)
/**
* ntb_transport_create_queue - Create a new NTB transport layer queue
* @rx_handler: receive callback function
* @tx_handler: transmit callback function
* @event_handler: event callback function
* @data: pointer for callback data
* @client_dev: &struct device pointer
* @handlers: pointer to various ntb queue (callback) handlers
*
* Create a new NTB transport layer queue and provide the queue with a callback
* routine for both transmit and receive. The receive callback routine will be

2
drivers/ntb/test/ntb_perf.c
View File

@ -1227,7 +1227,7 @@ static ssize_t perf_dbgfs_read_info(struct file *filep, char __user *ubuf,
"\tOut buffer addr 0x%pK\n", peer->outbuf);
pos += scnprintf(buf + pos, buf_size - pos,
"\tOut buff phys addr %pa[p]\n", &peer->out_phys_addr);
"\tOut buff phys addr %pap\n", &peer->out_phys_addr);
pos += scnprintf(buf + pos, buf_size - pos,
"\tOut buffer size %pa\n", &peer->outbuf_size);