Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc fixes from Greg KH:
"Here are some small char and misc driver fixes for 5.0-rc6.
Nothing huge here, some more binderfs fixups found as people use it,
and there is a "large" selftest added to validate the binderfs code,
which makes up the majority of this pull request.
There's also some small mei and mic fixes to resolve some reported
issues.
All of these have been in linux-next for over a week with no reported
issues"
* tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
mic: vop: Fix crash on remove
mic: vop: Fix use-after-free on remove
binderfs: remove separate device_initcall()
fpga: stratix10-soc: fix wrong of_node_put() in init function
mic: vop: Fix broken virtqueues
mei: free read cb on ctrl_wr list flush
samples: mei: use /dev/mei0 instead of /dev/mei
mei: me: add ice lake point device id.
binderfs: respect limit on binder control creation
binder: fix CONFIG_ANDROID_BINDER_DEVICES
selftests: add binderfs selftests
+380
-55
+22
-15
drivers/android/binder.c
+22
-15
drivers/android/binder.c
···
5854
5854
static int __init binder_init(void)
5855
5855
{
5856
5856
int ret;
5857
-
char *device_name, *device_names, *device_tmp;
5857
+
char *device_name, *device_tmp;
5858
5858
struct binder_device *device;
5859
5859
struct hlist_node *tmp;
5860
+
char *device_names = NULL;
5860
5861
5861
5862
ret = binder_alloc_shrinker_init();
5862
5863
if (ret)
···
5899
5898
&transaction_log_fops);
5900
5899
}
5901
5900
5902
-
/*
5903
-
* Copy the module_parameter string, because we don't want to
5904
-
* tokenize it in-place.
5905
-
*/
5906
-
device_names = kstrdup(binder_devices_param, GFP_KERNEL);
5907
-
if (!device_names) {
5908
-
ret = -ENOMEM;
5909
-
goto err_alloc_device_names_failed;
5901
+
if (strcmp(binder_devices_param, "") != 0) {
5902
+
/*
5903
+
* Copy the module_parameter string, because we don't want to
5904
+
* tokenize it in-place.
5905
+
*/
5906
+
device_names = kstrdup(binder_devices_param, GFP_KERNEL);
5907
+
if (!device_names) {
5908
+
ret = -ENOMEM;
5909
+
goto err_alloc_device_names_failed;
5910
+
}
5911
+
5912
+
device_tmp = device_names;
5913
+
while ((device_name = strsep(&device_tmp, ","))) {
5914
+
ret = init_binder_device(device_name);
5915
+
if (ret)
5916
+
goto err_init_binder_device_failed;
5917
+
}
5910
5918
}
5911
5919
5912
-
device_tmp = device_names;
5913
-
while ((device_name = strsep(&device_tmp, ","))) {
5914
-
ret = init_binder_device(device_name);
5915
-
if (ret)
5916
-
goto err_init_binder_device_failed;
5917
-
}
5920
+
ret = init_binderfs();
5921
+
if (ret)
5922
+
goto err_init_binder_device_failed;
5918
5923
5919
5924
return ret;
5920
5925
+9
drivers/android/binder_internal.h
+9
drivers/android/binder_internal.h
+10
-4
drivers/android/binderfs.c
+10
-4
drivers/android/binderfs.c
···
395
395
struct inode *inode = NULL;
396
396
struct dentry *root = sb->s_root;
397
397
struct binderfs_info *info = sb->s_fs_info;
398
+
#if defined(CONFIG_IPC_NS)
399
+
bool use_reserve = (info->ipc_ns == &init_ipc_ns);
400
+
#else
401
+
bool use_reserve = true;
402
+
#endif
398
403
399
404
device = kzalloc(sizeof(*device), GFP_KERNEL);
400
405
if (!device)
···
418
413
419
414
/* Reserve a new minor number for the new device. */
420
415
mutex_lock(&binderfs_minors_mutex);
421
-
minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
416
+
minor = ida_alloc_max(&binderfs_minors,
417
+
use_reserve ? BINDERFS_MAX_MINOR :
418
+
BINDERFS_MAX_MINOR_CAPPED,
419
+
GFP_KERNEL);
422
420
mutex_unlock(&binderfs_minors_mutex);
423
421
if (minor < 0) {
424
422
ret = minor;
···
550
542
.fs_flags = FS_USERNS_MOUNT,
551
543
};
552
544
553
-
static int __init init_binderfs(void)
545
+
int __init init_binderfs(void)
554
546
{
555
547
int ret;
556
548
···
568
560
569
561
return ret;
570
562
}
571
-
572
-
device_initcall(init_binderfs);
+1
-4
drivers/fpga/stratix10-soc.c
+1
-4
drivers/fpga/stratix10-soc.c
···
508
508
return -ENODEV;
509
509
510
510
np = of_find_matching_node(fw_np, s10_of_match);
511
-
if (!np) {
512
-
of_node_put(fw_np);
511
+
if (!np)
513
512
return -ENODEV;
514
-
}
515
513
516
514
of_node_put(np);
517
515
ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
518
-
of_node_put(fw_np);
519
516
if (ret)
520
517
return ret;
521
518
+4
-1
drivers/misc/mei/client.c
+4
-1
drivers/misc/mei/client.c
+2
drivers/misc/mei/hw-me-regs.h
+2
drivers/misc/mei/hw-me-regs.h
+2
drivers/misc/mei/pci-me.c
+2
drivers/misc/mei/pci-me.c
+43
-30
drivers/misc/mic/vop/vop_main.c
+43
-30
drivers/misc/mic/vop/vop_main.c
···
47
47
* @dc: Virtio device control
48
48
* @vpdev: VOP device which is the parent for this virtio device
49
49
* @vr: Buffer for accessing the VRING
50
-
* @used: Buffer for used
50
+
* @used_virt: Virtual address of used ring
51
+
* @used: DMA address of used ring
51
52
* @used_size: Size of the used buffer
52
53
* @reset_done: Track whether VOP reset is complete
53
54
* @virtio_cookie: Cookie returned upon requesting a interrupt
···
62
61
struct mic_device_ctrl __iomem *dc;
63
62
struct vop_device *vpdev;
64
63
void __iomem *vr[VOP_MAX_VRINGS];
64
+
void *used_virt[VOP_MAX_VRINGS];
65
65
dma_addr_t used[VOP_MAX_VRINGS];
66
66
int used_size[VOP_MAX_VRINGS];
67
67
struct completion reset_done;
···
262
260
static void vop_del_vq(struct virtqueue *vq, int n)
263
261
{
264
262
struct _vop_vdev *vdev = to_vopvdev(vq->vdev);
265
-
struct vring *vr = (struct vring *)(vq + 1);
266
263
struct vop_device *vpdev = vdev->vpdev;
267
264
268
265
dma_unmap_single(&vpdev->dev, vdev->used[n],
269
266
vdev->used_size[n], DMA_BIDIRECTIONAL);
270
-
free_pages((unsigned long)vr->used, get_order(vdev->used_size[n]));
267
+
free_pages((unsigned long)vdev->used_virt[n],
268
+
get_order(vdev->used_size[n]));
271
269
vring_del_virtqueue(vq);
272
270
vpdev->hw_ops->iounmap(vpdev, vdev->vr[n]);
273
271
vdev->vr[n] = NULL;
···
283
281
284
282
list_for_each_entry_safe(vq, n, &dev->vqs, list)
285
283
vop_del_vq(vq, idx++);
284
+
}
285
+
286
+
static struct virtqueue *vop_new_virtqueue(unsigned int index,
287
+
unsigned int num,
288
+
struct virtio_device *vdev,
289
+
bool context,
290
+
void *pages,
291
+
bool (*notify)(struct virtqueue *vq),
292
+
void (*callback)(struct virtqueue *vq),
293
+
const char *name,
294
+
void *used)
295
+
{
296
+
bool weak_barriers = false;
297
+
struct vring vring;
298
+
299
+
vring_init(&vring, num, pages, MIC_VIRTIO_RING_ALIGN);
300
+
vring.used = used;
301
+
302
+
return __vring_new_virtqueue(index, vring, vdev, weak_barriers, context,
303
+
notify, callback, name);
286
304
}
287
305
288
306
/*
···
324
302
struct _mic_vring_info __iomem *info;
325
303
void *used;
326
304
int vr_size, _vr_size, err, magic;
327
-
struct vring *vr;
328
305
u8 type = ioread8(&vdev->desc->type);
329
306
330
307
if (index >= ioread8(&vdev->desc->num_vq))
···
343
322
return ERR_PTR(-ENOMEM);
344
323
vdev->vr[index] = va;
345
324
memset_io(va, 0x0, _vr_size);
346
-
vq = vring_new_virtqueue(
347
-
index,
348
-
le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN,
349
-
dev,
350
-
false,
351
-
ctx,
352
-
(void __force *)va, vop_notify, callback, name);
353
-
if (!vq) {
354
-
err = -ENOMEM;
355
-
goto unmap;
356
-
}
325
+
357
326
info = va + _vr_size;
358
327
magic = ioread32(&info->magic);
359
328
···
352
341
goto unmap;
353
342
}
354
343
355
-
/* Allocate and reassign used ring now */
356
344
vdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
357
345
sizeof(struct vring_used_elem) *
358
346
le16_to_cpu(config.num));
359
347
used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
360
348
get_order(vdev->used_size[index]));
349
+
vdev->used_virt[index] = used;
361
350
if (!used) {
362
351
err = -ENOMEM;
363
352
dev_err(_vop_dev(vdev), "%s %d err %d\n",
364
353
__func__, __LINE__, err);
365
-
goto del_vq;
354
+
goto unmap;
366
355
}
356
+
357
+
vq = vop_new_virtqueue(index, le16_to_cpu(config.num), dev, ctx,
358
+
(void __force *)va, vop_notify, callback,
359
+
name, used);
360
+
if (!vq) {
361
+
err = -ENOMEM;
362
+
goto free_used;
363
+
}
364
+
367
365
vdev->used[index] = dma_map_single(&vpdev->dev, used,
368
366
vdev->used_size[index],
369
367
DMA_BIDIRECTIONAL);
···
380
360
err = -ENOMEM;
381
361
dev_err(_vop_dev(vdev), "%s %d err %d\n",
382
362
__func__, __LINE__, err);
383
-
goto free_used;
363
+
goto del_vq;
384
364
}
385
365
writeq(vdev->used[index], &vqconfig->used_address);
386
-
/*
387
-
* To reassign the used ring here we are directly accessing
388
-
* struct vring_virtqueue which is a private data structure
389
-
* in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
390
-
* vring_new_virtqueue() would ensure that
391
-
* (&vq->vring == (struct vring *) (&vq->vq + 1));
392
-
*/
393
-
vr = (struct vring *)(vq + 1);
394
-
vr->used = used;
395
366
396
367
vq->priv = vdev;
397
368
return vq;
369
+
del_vq:
370
+
vring_del_virtqueue(vq);
398
371
free_used:
399
372
free_pages((unsigned long)used,
400
373
get_order(vdev->used_size[index]));
401
-
del_vq:
402
-
vring_del_virtqueue(vq);
403
374
unmap:
404
375
vpdev->hw_ops->iounmap(vpdev, vdev->vr[index]);
405
376
return ERR_PTR(err);
···
592
581
int ret = -1;
593
582
594
583
if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
584
+
struct device *dev = get_device(&vdev->vdev.dev);
585
+
595
586
dev_dbg(&vpdev->dev,
596
587
"%s %d config_change %d type %d vdev %p\n",
597
588
__func__, __LINE__,
···
605
592
iowrite8(-1, &dc->h2c_vdev_db);
606
593
if (status & VIRTIO_CONFIG_S_DRIVER_OK)
607
594
wait_for_completion(&vdev->reset_done);
608
-
put_device(&vdev->vdev.dev);
595
+
put_device(dev);
609
596
iowrite8(1, &dc->guest_ack);
610
597
dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
611
598
__func__, __LINE__, ioread8(&dc->guest_ack));
+1
-1
samples/mei/mei-amt-version.c
+1
-1
samples/mei/mei-amt-version.c
+1
tools/testing/selftests/Makefile
+1
tools/testing/selftests/Makefile
+1
tools/testing/selftests/filesystems/binderfs/.gitignore
+1
tools/testing/selftests/filesystems/binderfs/.gitignore
···
1
+
binderfs_test
+6
tools/testing/selftests/filesystems/binderfs/Makefile
+6
tools/testing/selftests/filesystems/binderfs/Makefile
+275
tools/testing/selftests/filesystems/binderfs/binderfs_test.c
+275
tools/testing/selftests/filesystems/binderfs/binderfs_test.c
···
1
+
// SPDX-License-Identifier: GPL-2.0
2
+
3
+
#define _GNU_SOURCE
4
+
#include <errno.h>
5
+
#include <fcntl.h>
6
+
#include <sched.h>
7
+
#include <stdbool.h>
8
+
#include <stdio.h>
9
+
#include <stdlib.h>
10
+
#include <string.h>
11
+
#include <sys/ioctl.h>
12
+
#include <sys/mount.h>
13
+
#include <sys/stat.h>
14
+
#include <sys/types.h>
15
+
#include <unistd.h>
16
+
#include <linux/android/binder.h>
17
+
#include <linux/android/binderfs.h>
18
+
#include "../../kselftest.h"
19
+
20
+
static ssize_t write_nointr(int fd, const void *buf, size_t count)
21
+
{
22
+
ssize_t ret;
23
+
again:
24
+
ret = write(fd, buf, count);
25
+
if (ret < 0 && errno == EINTR)
26
+
goto again;
27
+
28
+
return ret;
29
+
}
30
+
31
+
static void write_to_file(const char *filename, const void *buf, size_t count,
32
+
int allowed_errno)
33
+
{
34
+
int fd, saved_errno;
35
+
ssize_t ret;
36
+
37
+
fd = open(filename, O_WRONLY | O_CLOEXEC);
38
+
if (fd < 0)
39
+
ksft_exit_fail_msg("%s - Failed to open file %s\n",
40
+
strerror(errno), filename);
41
+
42
+
ret = write_nointr(fd, buf, count);
43
+
if (ret < 0) {
44
+
if (allowed_errno && (errno == allowed_errno)) {
45
+
close(fd);
46
+
return;
47
+
}
48
+
49
+
goto on_error;
50
+
}
51
+
52
+
if ((size_t)ret != count)
53
+
goto on_error;
54
+
55
+
close(fd);
56
+
return;
57
+
58
+
on_error:
59
+
saved_errno = errno;
60
+
close(fd);
61
+
errno = saved_errno;
62
+
63
+
if (ret < 0)
64
+
ksft_exit_fail_msg("%s - Failed to write to file %s\n",
65
+
strerror(errno), filename);
66
+
67
+
ksft_exit_fail_msg("Failed to write to file %s\n", filename);
68
+
}
69
+
70
+
static void change_to_userns(void)
71
+
{
72
+
int ret;
73
+
uid_t uid;
74
+
gid_t gid;
75
+
/* {g,u}id_map files only allow a max of 4096 bytes written to them */
76
+
char idmap[4096];
77
+
78
+
uid = getuid();
79
+
gid = getgid();
80
+
81
+
ret = unshare(CLONE_NEWUSER);
82
+
if (ret < 0)
83
+
ksft_exit_fail_msg("%s - Failed to unshare user namespace\n",
84
+
strerror(errno));
85
+
86
+
write_to_file("/proc/self/setgroups", "deny", strlen("deny"), ENOENT);
87
+
88
+
ret = snprintf(idmap, sizeof(idmap), "0 %d 1", uid);
89
+
if (ret < 0 || (size_t)ret >= sizeof(idmap))
90
+
ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
91
+
strerror(errno));
92
+
93
+
write_to_file("/proc/self/uid_map", idmap, strlen(idmap), 0);
94
+
95
+
ret = snprintf(idmap, sizeof(idmap), "0 %d 1", gid);
96
+
if (ret < 0 || (size_t)ret >= sizeof(idmap))
97
+
ksft_exit_fail_msg("%s - Failed to prepare uid mapping\n",
98
+
strerror(errno));
99
+
100
+
write_to_file("/proc/self/gid_map", idmap, strlen(idmap), 0);
101
+
102
+
ret = setgid(0);
103
+
if (ret)
104
+
ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
105
+
strerror(errno));
106
+
107
+
ret = setuid(0);
108
+
if (ret)
109
+
ksft_exit_fail_msg("%s - Failed to setgid(0)\n",
110
+
strerror(errno));
111
+
}
112
+
113
+
static void change_to_mountns(void)
114
+
{
115
+
int ret;
116
+
117
+
ret = unshare(CLONE_NEWNS);
118
+
if (ret < 0)
119
+
ksft_exit_fail_msg("%s - Failed to unshare mount namespace\n",
120
+
strerror(errno));
121
+
122
+
ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
123
+
if (ret < 0)
124
+
ksft_exit_fail_msg("%s - Failed to mount / as private\n",
125
+
strerror(errno));
126
+
}
127
+
128
+
static void rmdir_protect_errno(const char *dir)
129
+
{
130
+
int saved_errno = errno;
131
+
(void)rmdir(dir);
132
+
errno = saved_errno;
133
+
}
134
+
135
+
static void __do_binderfs_test(void)
136
+
{
137
+
int fd, ret, saved_errno;
138
+
size_t len;
139
+
ssize_t wret;
140
+
bool keep = false;
141
+
struct binderfs_device device = { 0 };
142
+
struct binder_version version = { 0 };
143
+
144
+
change_to_mountns();
145
+
146
+
ret = mkdir("/dev/binderfs", 0755);
147
+
if (ret < 0) {
148
+
if (errno != EEXIST)
149
+
ksft_exit_fail_msg(
150
+
"%s - Failed to create binderfs mountpoint\n",
151
+
strerror(errno));
152
+
153
+
keep = true;
154
+
}
155
+
156
+
ret = mount(NULL, "/dev/binderfs", "binder", 0, 0);
157
+
if (ret < 0) {
158
+
if (errno != ENODEV)
159
+
ksft_exit_fail_msg("%s - Failed to mount binderfs\n",
160
+
strerror(errno));
161
+
162
+
keep ? : rmdir_protect_errno("/dev/binderfs");
163
+
ksft_exit_skip(
164
+
"The Android binderfs filesystem is not available\n");
165
+
}
166
+
167
+
/* binderfs mount test passed */
168
+
ksft_inc_pass_cnt();
169
+
170
+
memcpy(device.name, "my-binder", strlen("my-binder"));
171
+
172
+
fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC);
173
+
if (fd < 0)
174
+
ksft_exit_fail_msg(
175
+
"%s - Failed to open binder-control device\n",
176
+
strerror(errno));
177
+
178
+
ret = ioctl(fd, BINDER_CTL_ADD, &device);
179
+
saved_errno = errno;
180
+
close(fd);
181
+
errno = saved_errno;
182
+
if (ret < 0) {
183
+
keep ? : rmdir_protect_errno("/dev/binderfs");
184
+
ksft_exit_fail_msg(
185
+
"%s - Failed to allocate new binder device\n",
186
+
strerror(errno));
187
+
}
188
+
189
+
ksft_print_msg(
190
+
"Allocated new binder device with major %d, minor %d, and name %s\n",
191
+
device.major, device.minor, device.name);
192
+
193
+
/* binder device allocation test passed */
194
+
ksft_inc_pass_cnt();
195
+
196
+
fd = open("/dev/binderfs/my-binder", O_CLOEXEC | O_RDONLY);
197
+
if (fd < 0) {
198
+
keep ? : rmdir_protect_errno("/dev/binderfs");
199
+
ksft_exit_fail_msg("%s - Failed to open my-binder device\n",
200
+
strerror(errno));
201
+
}
202
+
203
+
ret = ioctl(fd, BINDER_VERSION, &version);
204
+
saved_errno = errno;
205
+
close(fd);
206
+
errno = saved_errno;
207
+
if (ret < 0) {
208
+
keep ? : rmdir_protect_errno("/dev/binderfs");
209
+
ksft_exit_fail_msg(
210
+
"%s - Failed to open perform BINDER_VERSION request\n",
211
+
strerror(errno));
212
+
}
213
+
214
+
ksft_print_msg("Detected binder version: %d\n",
215
+
version.protocol_version);
216
+
217
+
/* binder transaction with binderfs binder device passed */
218
+
ksft_inc_pass_cnt();
219
+
220
+
ret = unlink("/dev/binderfs/my-binder");
221
+
if (ret < 0) {
222
+
keep ? : rmdir_protect_errno("/dev/binderfs");
223
+
ksft_exit_fail_msg("%s - Failed to delete binder device\n",
224
+
strerror(errno));
225
+
}
226
+
227
+
/* binder device removal passed */
228
+
ksft_inc_pass_cnt();
229
+
230
+
ret = unlink("/dev/binderfs/binder-control");
231
+
if (!ret) {
232
+
keep ? : rmdir_protect_errno("/dev/binderfs");
233
+
ksft_exit_fail_msg("Managed to delete binder-control device\n");
234
+
} else if (errno != EPERM) {
235
+
keep ? : rmdir_protect_errno("/dev/binderfs");
236
+
ksft_exit_fail_msg(
237
+
"%s - Failed to delete binder-control device but exited with unexpected error code\n",
238
+
strerror(errno));
239
+
}
240
+
241
+
/* binder-control device removal failed as expected */
242
+
ksft_inc_xfail_cnt();
243
+
244
+
on_error:
245
+
ret = umount2("/dev/binderfs", MNT_DETACH);
246
+
keep ?: rmdir_protect_errno("/dev/binderfs");
247
+
if (ret < 0)
248
+
ksft_exit_fail_msg("%s - Failed to unmount binderfs\n",
249
+
strerror(errno));
250
+
251
+
/* binderfs unmount test passed */
252
+
ksft_inc_pass_cnt();
253
+
}
254
+
255
+
static void binderfs_test_privileged()
256
+
{
257
+
if (geteuid() != 0)
258
+
ksft_print_msg(
259
+
"Tests are not run as root. Skipping privileged tests\n");
260
+
else
261
+
__do_binderfs_test();
262
+
}
263
+
264
+
static void binderfs_test_unprivileged()
265
+
{
266
+
change_to_userns();
267
+
__do_binderfs_test();
268
+
}
269
+
270
+
int main(int argc, char *argv[])
271
+
{
272
+
binderfs_test_privileged();
273
+
binderfs_test_unprivileged();
274
+
ksft_exit_pass();
275
+
}