Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 's390-6.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Fix IOMMU bitmap allocation in s390 PCI to avoid out of bounds access
when IOMMU pages aren't a multiple of 64
- Fix kasan crashes when accessing DCSS mapping in memory holes by
adding corresponding kasan zero shadow mappings
- Fix a memory leak in css_alloc_subchannel in case
dma_set_coherent_mask fails
* tag 's390-6.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/pci: fix iommu bitmap allocation
s390/kasan: handle DCSS mapping in memory holes
s390/cio: fix a memleak in css_alloc_subchannel
+23
-5
+6
-1
arch/s390/boot/vmem.c
+6
-1
arch/s390/boot/vmem.c
···
57
57
pmd_t pmd_z = __pmd(__pa(kasan_early_shadow_pte) | _SEGMENT_ENTRY);
58
58
pud_t pud_z = __pud(__pa(kasan_early_shadow_pmd) | _REGION3_ENTRY);
59
59
p4d_t p4d_z = __p4d(__pa(kasan_early_shadow_pud) | _REGION2_ENTRY);
60
+
unsigned long memgap_start = 0;
60
61
unsigned long untracked_end;
61
62
unsigned long start, end;
62
63
int i;
···
102
101
* +- shadow end ----+---------+- shadow end ---+
103
102
*/
104
103
105
-
for_each_physmem_usable_range(i, &start, &end)
104
+
for_each_physmem_usable_range(i, &start, &end) {
106
105
kasan_populate(start, end, POPULATE_KASAN_MAP_SHADOW);
106
+
if (memgap_start && physmem_info.info_source == MEM_DETECT_DIAG260)
107
+
kasan_populate(memgap_start, start, POPULATE_KASAN_ZERO_SHADOW);
108
+
memgap_start = end;
109
+
}
107
110
if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
108
111
untracked_end = VMALLOC_START;
109
112
/* shallowly populate kasan shadow for vmalloc and modules */
+13
-2
arch/s390/pci/pci_dma.c
+13
-2
arch/s390/pci/pci_dma.c
···
564
564
s->dma_length = 0;
565
565
}
566
566
}
567
+
568
+
static unsigned long *bitmap_vzalloc(size_t bits, gfp_t flags)
569
+
{
570
+
size_t n = BITS_TO_LONGS(bits);
571
+
size_t bytes;
572
+
573
+
if (unlikely(check_mul_overflow(n, sizeof(unsigned long), &bytes)))
574
+
return NULL;
575
+
576
+
return vzalloc(bytes);
577
+
}
567
578
568
579
int zpci_dma_init_device(struct zpci_dev *zdev)
569
580
{
···
615
604
zdev->end_dma - zdev->start_dma + 1);
616
605
zdev->end_dma = zdev->start_dma + zdev->iommu_size - 1;
617
606
zdev->iommu_pages = zdev->iommu_size >> PAGE_SHIFT;
618
-
zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
607
+
zdev->iommu_bitmap = bitmap_vzalloc(zdev->iommu_pages, GFP_KERNEL);
619
608
if (!zdev->iommu_bitmap) {
620
609
rc = -ENOMEM;
621
610
goto free_dma_table;
622
611
}
623
612
if (!s390_iommu_strict) {
624
-
zdev->lazy_bitmap = vzalloc(zdev->iommu_pages / 8);
613
+
zdev->lazy_bitmap = bitmap_vzalloc(zdev->iommu_pages, GFP_KERNEL);
625
614
if (!zdev->lazy_bitmap) {
626
615
rc = -ENOMEM;
627
616
goto free_bitmap;
+4
-2
drivers/s390/cio/css.c
+4
-2
drivers/s390/cio/css.c
···
233
233
*/
234
234
ret = dma_set_coherent_mask(&sch->dev, DMA_BIT_MASK(31));
235
235
if (ret)
236
-
goto err;
236
+
goto err_lock;
237
237
/*
238
238
* But we don't have such restrictions imposed on the stuff that
239
239
* is handled by the streaming API.
240
240
*/
241
241
ret = dma_set_mask(&sch->dev, DMA_BIT_MASK(64));
242
242
if (ret)
243
-
goto err;
243
+
goto err_lock;
244
244
245
245
return sch;
246
246
247
+
err_lock:
248
+
kfree(sch->lock);
247
249
err:
248
250
kfree(sch);
249
251
return ERR_PTR(ret);