kernel.git/drivers/misc/mic/vop, branch linux-4.9.y

misc: vop: add round_up(x,4) for vring_size to avoid kernel panic

2020-10-29T08:05:43Z

[ Upstream commit cc1a2679865a94b83804822996eed010a50a7c1d ] Since struct _mic_vring_info and vring are allocated together and follow vring, if the vring_size() is not four bytes aligned, which will cause the start address of struct _mic_vring_info is not four byte aligned. For example, when vring entries is 128, the vring_size() will be 5126 bytes. The _mic_vring_info struct layout in ddr looks like: 0x90002400: 00000000 00390000 EE010000 0000C0FF Here 0x39 is the avail_idx member, and 0xC0FFEE01 is the magic member. When EP use ioread32(magic) to reads the magic in RC's share memory, it will cause kernel panic on ARM64 platform due to the cross-byte io read. Here read magic in user space use le32toh(vr0->info->magic) will meet the same issue. So add round_up(x,4) for vring_size, then the struct _mic_vring_info will store in this way: 0x90002400: 00000000 00000000 00000039 C0FFEE01 Which will avoid kernel panic when read magic in struct _mic_vring_info. Signed-off-by: Sherry Sun Signed-off-by: Joakim Zhang Link: https://lore.kernel.org/r/20200929091106.24624-4-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

mic: vop: copy data to kernel space then write to io memory

2020-10-29T08:05:43Z

[ Upstream commit 675f0ad4046946e80412896436164d172cd92238 ] Read and write io memory should address align on ARCH ARM. Change to use memcpy_toio to avoid kernel panic caused by the address un-align issue. Signed-off-by: Sherry Sun Signed-off-by: Joakim Zhang Link: https://lore.kernel.org/r/20200929091106.24624-5-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

misc: mic: double free on ioctl error path

2017-06-24T05:11:16Z

commit 816c9311f1144a03da1fdc4feb2f6b0d3299fca0 upstream. This function only has one caller. Freeing "vdev" here leads to a use after free bug. There are several other error paths in this function but this is the only one which frees "vdev". It looks like the kfree() can be safely removed. Fixes: 61e9c905df78 ("misc: mic: Enable VOP host side functionality") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman

misc: mic: Fix for double fetch security bug in VOP driver

2016-04-27T22:30:58Z

The MIC VOP driver does two successive reads from user space to read a variable length data structure. Kernel memory corruption can result if the data structure changes between the two reads. This patch disallows the chance of this happening. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116651 Reported by: Pengfei Wang Reviewed-by: Sudeep Dutt Signed-off-by: Ashutosh Dixit Cc: stable Signed-off-by: Greg Kroah-Hartman

misc: mic: silence an overflow warning

2016-02-15T01:42:37Z

Static checkers complain that the this is a potential array overflow. We verify that it's not on the next line so this code is OK, but static checker warnings are annoying. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman

misc: mic: use after free printing error message

2016-02-15T01:42:37Z

Swap the printk and kfree() to avoid a use after free bug. Fixes: 61e9c905df78 ('misc: mic: Enable VOP host side functionality') Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman

misc: mic: Enable VOP debugfs and driver build

2016-02-10T01:32:37Z

This patch moves the virtio specific debugfs hooks previously in mic_debugfs.c in the MIC host driver into the VOP driver. The Kconfig/Makefile is also updated to allow building the VOP driver. Reviewed-by: Ashutosh Dixit Signed-off-by: Sudeep Dutt Signed-off-by: Greg Kroah-Hartman

misc: mic: Enable VOP card side functionality

2016-02-10T01:32:37Z

This patch moves virtio functionality from the MIC card driver into a separate hardware independent Virtio Over PCIe (VOP) driver. This functionality was introduced in commit 2141c7c5ee67 ("Intel MIC Card Driver Changes for Virtio Devices.") in drivers/misc/mic/card/mic_virtio.c. Apart from being moved into a separate driver the functionality is essentially unchanged. See the above mentioned commit for a description of this functionality. Signed-off-by: Sudeep Dutt Signed-off-by: Ashutosh Dixit Signed-off-by: Greg Kroah-Hartman

misc: mic: Enable VOP host side functionality

2016-02-10T01:32:37Z

This patch moves virtio functionality from the MIC host driver into a separate hardware independent Virtio Over PCIe (VOP) driver. This functionality was introduced in commit f69bcbf3b4c4 ("Intel MIC Host Driver Changes for Virtio Devices.") in drivers/misc/mic/host/mic_virtio.c. Apart from being moved into a separate driver the functionality is essentially unchanged. See the above mentioned commit for a description of this functionality. Signed-off-by: Ashutosh Dixit Signed-off-by: Sudeep Dutt Signed-off-by: Greg Kroah-Hartman

misc: mic: Add data structures for the VOP driver

2016-02-10T01:32:37Z

This patch adds VOP driver data structures used in subsequent patches. These data structures are refactored from similar data structures used in the virtio parts of previous MIC host and card drivers. Signed-off-by: Ashutosh Dixit Signed-off-by: Sudeep Dutt Signed-off-by: Greg Kroah-Hartman