Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc fixes from Greg KH:
"Here are a few small char/misc driver fixes for 4.20-rc5 that resolve
a number of reported issues.
The "largest" here is the thunderbolt patch, which resolves an issue
with NVM upgrade, the smallest being some fsi driver fixes. There's
also a hyperv bugfix, and the usual binder bugfixes.
All of these have been in linux-next with no reported issues"
* tag 'char-misc-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
thunderbolt: Prevent root port runtime suspend during NVM upgrade
Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
binder: fix race that allows malicious free of live buffer
fsi: fsi-scom.c: Remove duplicate header
fsi: master-ast-cf: select GENERIC_ALLOCATOR
+67
-25
+12
-9
drivers/android/binder.c
+12
-9
drivers/android/binder.c
···
2974
2974
t->buffer = NULL;
2975
2975
goto err_binder_alloc_buf_failed;
2976
2976
}
2977
-
t->buffer->allow_user_free = 0;
2978
2977
t->buffer->debug_id = t->debug_id;
2979
2978
t->buffer->transaction = t;
2980
2979
t->buffer->target_node = target_node;
···
3509
3510
3510
3511
buffer = binder_alloc_prepare_to_free(&proc->alloc,
3511
3512
data_ptr);
3512
-
if (buffer == NULL) {
3513
-
binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
3514
-
proc->pid, thread->pid, (u64)data_ptr);
3515
-
break;
3516
-
}
3517
-
if (!buffer->allow_user_free) {
3518
-
binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
3519
-
proc->pid, thread->pid, (u64)data_ptr);
3513
+
if (IS_ERR_OR_NULL(buffer)) {
3514
+
if (PTR_ERR(buffer) == -EPERM) {
3515
+
binder_user_error(
3516
+
"%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
3517
+
proc->pid, thread->pid,
3518
+
(u64)data_ptr);
3519
+
} else {
3520
+
binder_user_error(
3521
+
"%d:%d BC_FREE_BUFFER u%016llx no match\n",
3522
+
proc->pid, thread->pid,
3523
+
(u64)data_ptr);
3524
+
}
3520
3525
break;
3521
3526
}
3522
3527
binder_debug(BINDER_DEBUG_FREE_BUFFER,
+6
-10
drivers/android/binder_alloc.c
+6
-10
drivers/android/binder_alloc.c
···
151
151
else {
152
152
/*
153
153
* Guard against user threads attempting to
154
-
* free the buffer twice
154
+
* free the buffer when in use by kernel or
155
+
* after it's already been freed.
155
156
*/
156
-
if (buffer->free_in_progress) {
157
-
binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
158
-
"%d:%d FREE_BUFFER u%016llx user freed buffer twice\n",
159
-
alloc->pid, current->pid,
160
-
(u64)user_ptr);
161
-
return NULL;
162
-
}
163
-
buffer->free_in_progress = 1;
157
+
if (!buffer->allow_user_free)
158
+
return ERR_PTR(-EPERM);
159
+
buffer->allow_user_free = 0;
164
160
return buffer;
165
161
}
166
162
}
···
496
500
497
501
rb_erase(best_fit, &alloc->free_buffers);
498
502
buffer->free = 0;
499
-
buffer->free_in_progress = 0;
503
+
buffer->allow_user_free = 0;
500
504
binder_insert_allocated_buffer_locked(alloc, buffer);
501
505
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
502
506
"%d: binder_alloc_buf size %zd got %pK\n",
+1
-2
drivers/android/binder_alloc.h
+1
-2
drivers/android/binder_alloc.h
+1
drivers/fsi/Kconfig
+1
drivers/fsi/Kconfig
···
46
46
tristate "FSI master based on Aspeed ColdFire coprocessor"
47
47
depends on GPIOLIB
48
48
depends on GPIO_ASPEED
49
+
select GENERIC_ALLOCATOR
49
50
---help---
50
51
This option enables a FSI master using the AST2400 and AST2500 GPIO
51
52
lines driven by the internal ColdFire coprocessor. This requires
-1
drivers/fsi/fsi-scom.c
-1
drivers/fsi/fsi-scom.c
+8
drivers/hv/channel.c
+8
drivers/hv/channel.c
···
516
516
}
517
517
wait_for_completion(&msginfo->waitevent);
518
518
519
+
if (msginfo->response.gpadl_created.creation_status != 0) {
520
+
pr_err("Failed to establish GPADL: err = 0x%x\n",
521
+
msginfo->response.gpadl_created.creation_status);
522
+
523
+
ret = -EDQUOT;
524
+
goto cleanup;
525
+
}
526
+
519
527
if (channel->rescind) {
520
528
ret = -ENODEV;
521
529
goto cleanup;
+1
-1
drivers/misc/mic/scif/scif_rma.c
+1
-1
drivers/misc/mic/scif/scif_rma.c
+38
-2
drivers/thunderbolt/switch.c
+38
-2
drivers/thunderbolt/switch.c
···
863
863
}
864
864
static DEVICE_ATTR(key, 0600, key_show, key_store);
865
865
866
+
static void nvm_authenticate_start(struct tb_switch *sw)
867
+
{
868
+
struct pci_dev *root_port;
869
+
870
+
/*
871
+
* During host router NVM upgrade we should not allow root port to
872
+
* go into D3cold because some root ports cannot trigger PME
873
+
* itself. To be on the safe side keep the root port in D0 during
874
+
* the whole upgrade process.
875
+
*/
876
+
root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
877
+
if (root_port)
878
+
pm_runtime_get_noresume(&root_port->dev);
879
+
}
880
+
881
+
static void nvm_authenticate_complete(struct tb_switch *sw)
882
+
{
883
+
struct pci_dev *root_port;
884
+
885
+
root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
886
+
if (root_port)
887
+
pm_runtime_put(&root_port->dev);
888
+
}
889
+
866
890
static ssize_t nvm_authenticate_show(struct device *dev,
867
891
struct device_attribute *attr, char *buf)
868
892
{
···
936
912
937
913
sw->nvm->authenticating = true;
938
914
939
-
if (!tb_route(sw))
915
+
if (!tb_route(sw)) {
916
+
/*
917
+
* Keep root port from suspending as long as the
918
+
* NVM upgrade process is running.
919
+
*/
920
+
nvm_authenticate_start(sw);
940
921
ret = nvm_authenticate_host(sw);
941
-
else
922
+
if (ret)
923
+
nvm_authenticate_complete(sw);
924
+
} else {
942
925
ret = nvm_authenticate_device(sw);
926
+
}
943
927
pm_runtime_mark_last_busy(&sw->dev);
944
928
pm_runtime_put_autosuspend(&sw->dev);
945
929
}
···
1365
1333
ret = dma_port_flash_update_auth_status(sw->dma_port, &status);
1366
1334
if (ret <= 0)
1367
1335
return ret;
1336
+
1337
+
/* Now we can allow root port to suspend again */
1338
+
if (!tb_route(sw))
1339
+
nvm_authenticate_complete(sw);
1368
1340
1369
1341
if (status) {
1370
1342
tb_sw_info(sw, "switch flash authentication failed\n");