The memory for "llcc_driv_data" is allocated by the LLCC driver. But when
it is passed as "pvt_info" to the EDAC core, it will get freed during the
qcom_edac driver release. So when the qcom_edac driver gets probed again,
it will try to use the freed data leading to the use-after-free bug.
Fix this by not passing "llcc_driv_data" as pvt_info but rather reference
it using the "platform_data" in the qcom_edac driver.
Cc: <stable(a)vger.kernel.org> # 4.20
Fixes: 27450653f1db ("drivers: edac: Add EDAC driver support for QCOM SoCs")
Tested-by: Steev Klimaszewski <steev(a)kali.org> # Thinkpad X13s
Tested-by: Andrew Halaney <ahalaney(a)redhat.com> # sa8540p-ride
Reported-by: Steev Klimaszewski <steev(a)kali.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org>
---
drivers/edac/qcom_edac.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c
index 9e77fa84e84f..3256254c3722 100644
--- a/drivers/edac/qcom_edac.c
+++ b/drivers/edac/qcom_edac.c
@@ -252,7 +252,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type)
static int
dump_syn_reg(struct edac_device_ctl_info *edev_ctl, int err_type, u32 bank)
{
- struct llcc_drv_data *drv = edev_ctl->pvt_info;
+ struct llcc_drv_data *drv = edev_ctl->dev->platform_data;
int ret;
ret = dump_syn_reg_values(drv, bank, err_type);
@@ -289,7 +289,7 @@ static irqreturn_t
llcc_ecc_irq_handler(int irq, void *edev_ctl)
{
struct edac_device_ctl_info *edac_dev_ctl = edev_ctl;
- struct llcc_drv_data *drv = edac_dev_ctl->pvt_info;
+ struct llcc_drv_data *drv = edac_dev_ctl->dev->platform_data;
irqreturn_t irq_rc = IRQ_NONE;
u32 drp_error, trp_error, i;
int ret;
@@ -358,7 +358,6 @@ static int qcom_llcc_edac_probe(struct platform_device *pdev)
edev_ctl->dev_name = dev_name(dev);
edev_ctl->ctl_name = "llcc";
edev_ctl->panic_on_ue = LLCC_ERP_PANIC_ON_UE;
- edev_ctl->pvt_info = llcc_driv_data;
rc = edac_device_add_device(edev_ctl);
if (rc)
--
2.25.1
Following s390 build warnings / errors noticed on stable-rc 4.19 queue.
Regressions found on s390:
- build/gcc-11-tinyconfig
- build/gcc-10-tinyconfig
Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
git_repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc-queues
git_describe: v4.19.269-363-g176f3d59718e
Build: v4.19.269-363-g176f3d59718e
Details: https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_4.19-sanity…
make --silent --keep-going --jobs=8
O=/home/tuxbuild/.cache/tuxmake/builds/1/build ARCH=s390
CROSS_COMPILE=s390x-linux-gnu- 'CC=sccache s390x-linux-gnu-gcc'
'HOSTCC=sccache gcc'
In function 'setup_lowcore_dat_off',
inlined from 'setup_arch' at /builds/linux/arch/s390/kernel/setup.c:958:2:
/builds/linux/arch/s390/kernel/setup.c:342:9: warning: 'memcpy'
reading 128 bytes from a region of size 0 [-Wstringop-overread]
342 | memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
343 | sizeof(lc->stfle_fac_list));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
/builds/linux/arch/s390/kernel/setup.c:344:9: warning: 'memcpy'
reading 128 bytes from a region of size 0 [-Wstringop-overread]
344 | memcpy(lc->alt_stfle_fac_list, S390_lowcore.alt_stfle_fac_list,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
345 | sizeof(lc->alt_stfle_fac_list));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /builds/linux/arch/s390/kernel/lgr.c:13:
In function 'stfle',
inlined from 'lgr_info_get' at /builds/linux/arch/s390/kernel/lgr.c:122:2:
/builds/linux/arch/s390/include/asm/facility.h:88:9: warning: 'memcpy'
reading 4 bytes from a region of size 0 [-Wstringop-overread]
88 | memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
s390x-linux-gnu-ld: drivers/base/platform.o: in function
`devm_platform_get_and_ioremap_resource':
platform.c:(.text+0x43a): undefined reference to `devm_ioremap_resource'
s390x-linux-gnu-ld: drivers/base/platform.o: in function
`devm_platform_ioremap_resource':
platform.c:(.text+0x478): undefined reference to `devm_ioremap_resource'
make[1]: *** [/builds/linux/Makefile:1055: vmlinux] Error 1
Build details,
https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_4.19-sanity…https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_4.19-sanity…
Build logs,
https://storage.tuxsuite.com/public/linaro/lkft/builds/2JXXJr2fBrwWGJISB1Ic…
Steps to reproduce:
--------------------
# To install tuxmake on your system globally:
# sudo pip3 install -U tuxmake
#
# See https://docs.tuxmake.org/ for complete documentation.
# Original tuxmake command with fragments listed below.
# tuxmake --runtime podman --target-arch s390 --toolchain gcc-11
--kconfig tinyconfig
--
Linaro LKFT
https://lkft.linaro.org
Changes since v1:
- V1: https://lore.kernel.org/lkml/cover.1670005163.git.reinette.chatre@intel.com/
- Cover trimmed after obtaining needed information.
- Added Reviewed-by tags.
- cc stable team.
- Please see individual patches for patch specific changes.
Dear Maintainers,
I have been using the IDXD driver to experiment with the upcoming core
changes in support of IMS ([1], [2], [3]). As part of this work I
happened to exercise the error paths within IDXD and encountered
a few issues that are addressed in this series. These changes are
independent from IMS and just aims to make the IDXD driver more
robust against errors.
Your feedback is greatly appreciated.
Reinette
[1] https://lore.kernel.org/lkml/20221111132706.104870257@linutronix.de
[2] https://lore.kernel.org/lkml/20221111131813.914374272@linutronix.dexo
[3] https://lore.kernel.org/lkml/20221111133158.196269823@linutronix.de
Reinette Chatre (3):
dmaengine: idxd: Let probe fail when workqueue cannot be enabled
dmaengine: idxd: Prevent use after free on completion memory
dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
drivers/dma/idxd/device.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
base-commit: 76dcd734eca23168cb008912c0f69ff408905235
--
2.34.1