kernel.git/drivers/pci/pcie, branch linux-3.14.y

PCI/AER: Flush workqueue on device remove to avoid use-after-free

2016-03-03T23:06:53Z

commit 4ae2182b1e3407de369f8c5d799543b7db74221b upstream. A Root Port's AER structure (rpc) contains a queue of events. aer_irq() enqueues AER status information and schedules aer_isr() to dequeue and process it. When we remove a device, aer_remove() waits for the queue to be empty, then frees the rpc struct. But aer_isr() references the rpc struct after dequeueing and possibly emptying the queue, which can cause a use-after-free error as in the following scenario with two threads, aer_isr() on the left and a concurrent aer_remove() on the right: Thread A Thread B -------- -------- aer_irq(): rpc->prod_idx++ aer_remove(): wait_event(rpc->prod_idx == rpc->cons_idx) # now blocked until queue becomes empty aer_isr(): # ... rpc->cons_idx++ # unblocked because queue is now empty ... kfree(rpc) mutex_unlock(&rpc->rpc_mutex) To prevent this problem, use flush_work() to wait until the last scheduled instance of aer_isr() has completed before freeing the rpc struct in aer_remove(). I reproduced this use-after-free by flashing a device FPGA and re-enumerating the bus to find the new device. With SLUB debug, this crashes with 0x6b bytes (POISON_FREE, the use-after-free magic number) in GPR25: pcieport 0000:00:00.0: AER: Multiple Corrected error received: id=0000 Unable to handle kernel paging request for data at address 0x27ef9e3e Workqueue: events aer_isr GPR24: dd6aa000 6b6b6b6b 605f8378 605f8360 d99b12c0 604fc674 606b1704 d99b12c0 NIP [602f5328] pci_walk_bus+0xd4/0x104 [bhelgaas: changelog, stable tag] Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Bjorn Helgaas Signed-off-by: Greg Kroah-Hartman

PCI/AER: Avoid info leak in __print_tlp_header()

2015-04-19T08:11:05Z

commit a1b7f2f6367944d445c6853035830a35c6343939 upstream. Commit fab4c256a58b ("PCI/AER: Add a TLP header print helper") introduced the helper function __print_tlp_header(), but contrary to the intention, the behaviour did change: Since we're taking the address of the parameter t, the first 4 or 8 bytes printed will be the value of the pointer t itself, and the remaining 12 or 8 bytes will be who-knows-what (something from the stack). We want to show the values of the four members of the struct aer_header_log_regs; that can be done without ugly and error-prone casts. On little-endian this should produce the same output as originally intended, and since no-one has complained about getting garbage output so far, I think big-endian should be ok too. Fixes: fab4c256a58b ("PCI/AER: Add a TLP header print helper") Signed-off-by: Rasmus Villemoes Signed-off-by: Bjorn Helgaas Acked-by: Borislav Petkov Signed-off-by: Greg Kroah-Hartman

Merge branch 'pci/dead-code' into next

2014-01-13T23:47:08Z

* pci/dead-code: PCI: Make local functions static PCI: Remove unused alloc_pci_dev() PCI: Remove unused pci_renumber_slot() PCI: Remove unused pcie_aspm_enabled() PCI: Remove unused pci_vpd_truncate() PCI: Remove unused ID-Based Ordering support PCI: Remove unused Optimized Buffer Flush/Fill support PCI: Remove unused Latency Tolerance Reporting support PCI: Removed unused parts of Page Request Interface support Conflicts: drivers/pci/pci.c include/linux/pci.h

Merge branch 'pci/aer' into next

2014-01-13T23:46:15Z

* pci/aer: PCI/AER: Support ACPI HEST AER error sources for PCI domains other than 0 ACPICA: Add helper macros to extract bus/segment numbers from HEST table.

PCI/AER: Support ACPI HEST AER error sources for PCI domains other than 0

2014-01-13T19:18:55Z

In the discussion for this set of patches [link below], Bjorn Helgaas pointed out that the ACPI HEST AER error sources do not have the PCIe segment number associated with the bus. I worked with the ACPI spec and got this change to definition of the "Bus" field into the recently released ACPI Spec 5.0a section 18.3.2.3-5: Identifies the PCI Bus and Segment of the device. The Bus is encoded in bits 0-7. For systems that expose multiple PCI segment groups, the segment number is encoded in bits 8-23 and bits 24-31 must be zero. For systems that do not expose multiple PCI segment groups, bits 8-31 must be zero. If the GLOBAL flag is specified, this field is ignored. This patch makes use of the new definition in the only place in the kernel that uses the acpi_hest_aer_common's bus field. This depends on 36f3615152c1 ("ACPICA: Add helper macros to extract bus/segment numbers from HEST table.") Link: http://lkml.kernel.org/r/1370542251-27387-1-git-send-email-betty.dall@hp.com Signed-off-by: Betty Dall Signed-off-by: Bjorn Helgaas

PCI: Remove unused pcie_aspm_enabled()

2014-01-13T18:14:44Z

My philosophy is unused code is dead code. And dead code is subject to bit rot and is a likely source of bugs. Use it or lose it. This reverts part of 3e1b16002af2 ("ACPI/PCI: PCIe ASPM _OSC support capabilities called when root bridge added"), removing this interface: pcie_aspm_enabled() [bhelgaas: split to separate patch] Signed-off-by: Stephen Hemminger Signed-off-by: Bjorn Helgaas CC: Andrew Patterson

Merge branch 'pci/msi' into next

2014-01-08T00:34:39Z

* pci/msi: PCI/MSI: Add pci_enable_msi_range() and pci_enable_msix_range() PCI/MSI: Add pci_msix_vec_count() PCI/MSI: Remove pci_enable_msi_block_auto() PCI/MSI: Add pci_msi_vec_count()

PCI/MSI: Add pci_msix_vec_count()

2014-01-04T00:17:55Z

This creates an MSI-X counterpart for pci_msi_vec_count(). Device drivers can use this function to obtain maximum number of MSI-X interrupts the device supports and use that number in a subsequent call to pci_enable_msix(). pci_msix_vec_count() supersedes pci_msix_table_size() and returns a negative errno if device does not support MSI-X interrupts. After this update, callers must always check the returned value. The only user of pci_msix_table_size() was the PCI-Express port driver, which is also updated by this change. Signed-off-by: Alexander Gordeev Signed-off-by: Bjorn Helgaas Reviewed-by: Tejun Heo

Merge branch 'pci/deletion' into next

2013-12-20T19:41:18Z

* pci/deletion: PCI/portdrv: Remove extra get_device()/put_device() for pcie_device PCI/portdrv: Add put_device() after device_register() failure PCI/portdrv: Cleanup error paths

PCI/portdrv: Remove extra get_device()/put_device() for pcie_device

2013-12-19T22:02:55Z

Previously pcie_device_init() called get_device() if device_register() for the new pcie_device succeeded, and remove_iter() called put_device() when removing before unregistering the device. But device_register() already increments the reference count in device_add(), so we don't need to do it again here. Signed-off-by: Bjorn Helgaas