kernel.git/drivers/atm/iphase.c, branch linux-4.4.y

atm: iphase: fix possible use-after-free in ia_module_exit()

2021-07-20T14:22:37Z

[ Upstream commit 1c72e6ab66b9598cac741ed397438a52065a8f1f ] This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot Signed-off-by: Zou Wei Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

atm: iphase: Fix Spectre v1 vulnerability

2019-08-11T10:20:44Z

[ Upstream commit ea443e5e98b5b74e317ef3d26bcaea54931ccdee ] board is controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/atm/iphase.c:2765 ia_ioctl() warn: potential spectre issue 'ia_dev' [r] (local cap) drivers/atm/iphase.c:2774 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2782 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2816 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2823 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2830 ia_ioctl() warn: potential spectre issue '_ia_dev' [r] (local cap) drivers/atm/iphase.c:2845 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2856 ia_ioctl() warn: possible spectre second half. 'iadev' Fix this by sanitizing board before using it to index ia_dev and _ia_dev Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

atm: iphase: fix misleading indention

2015-10-13T02:56:27Z

Fix a smatch warning: drivers/atm/iphase.c:1178 rx_pkt() warn: curly braces intended? The code is correct, the indention is misleading. In case the allocation of skb fails, we want to skip to the end. Signed-off-by: Tillmann Heidsieck Signed-off-by: David S. Miller

atm: iphase: return -ENOMEM instead of -1 in case of failed kmalloc()

2015-10-13T02:56:26Z

Smatch complains about returning hard coded error codes, silence this warning. drivers/atm/iphase.c:115 ia_enque_rtn_q() warn: returning -1 instead of -ENOMEM is sloppy Signed-off-by: Tillmann Heidsieck Signed-off-by: David S. Miller

atm: use msecs_to_jiffies for conversions

2015-06-08T22:48:45Z

API compliance scanning with coccinelle flagged: ./drivers/atm/iphase.c:2621:4-20: WARNING: timeout (50) seems HZ dependent Numeric constants passed to schedule_timeout() make the effective timeout HZ dependent which does not seem intended. Fixed up by converting the constant to jiffies with msecs_to_jiffies() As this driver was introduced in the early 2.3 series it is most likely assuming HZ=100 so the constant 50 is converted to 500ms. Signed-off-by: Nicholas Mc Guire Signed-off-by: David S. Miller

atm: remove deprecated use of pci api

2015-01-18T05:28:41Z

Signed-off-by: Chas Williams - CONTRACTOR Signed-off-by: David S. Miller

Drivers: atm: remove __dev* attributes.

2013-01-03T23:57:04Z

CONFIG_HOTPLUG is going away as an option. As a result, the __dev* markings need to be removed. This change removes the use of __devinit, __devexit_p, __devinitdata, __devinitconst, and __devexit from these drivers. Based on patches originally written by Bill Pemberton, but redone by me in order to handle some of the coding style issues better, by hand. Cc: Bill Pemberton Cc: Chas Williams Signed-off-by: Greg Kroah-Hartman

drivers/atm/iphase.c: fix error return code

2012-08-06T20:29:57Z

Convert a 0 error return code to a negative one, as returned elsewhere in the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier ret; expression e,e1,e2,e3,e4,x; @@ ( if (\(ret != 0\|ret < 0\) || ...) { ... return ...; } | ret = 0 ) ... when != ret = e1 *x = \(kmalloc\|kzalloc\|kcalloc\|devm_kzalloc\|ioremap\|ioremap_nocache\|devm_ioremap\|devm_ioremap_nocache\)(...); ... when != x = e2 when != ret = e3 *if (x == NULL || ...) { ... when != ret = e4 * return ret; } // Signed-off-by: Julia Lawall Signed-off-by: David S. Miller

Remove all #inclusions of asm/system.h

2012-03-28T17:30:03Z

Remove all #inclusions of asm/system.h preparatory to splitting and killing it. Performed with the following command: perl -p -i -e 's!^#\s*include\s*.*\n!!' `grep -Irl '^#\s*include\s*' *` Signed-off-by: David Howells

atm: eliminate atm_guess_pdu2truesize()

2011-11-26T21:40:30Z

Signed-off-by: Chas Williams - CONTRACTOR Signed-off-by: David S. Miller