Skip to content

Commit e50a803

Browse files
torvaldstorvalds
committed
Merge tag 's390-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik: - Update defconfigs - Fix early boot code by adding missing intersection check to prevent potential overwriting of the ipl report - Fix a use-after-free issue in s390-specific code related to PCI resources being retained after hot-unplugging individual functions, by removing the resources from the PCI bus's resource list and using the zpci_bar_struct's resource pointer directly * tag 's390-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfigs PCI: s390: Fix use-after-free of PCI resources with per-function hotplug s390/ipl: add missing intersection check to ipl_report handling
2 parents 17adaea + d7a0bdb commit e50a803

File tree

9 files changed

+54
-34
lines changed

9 files changed

+54
-34
lines changed

‎arch/s390/boot/ipl_report.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,19 @@ static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
5757
if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size &&
5858
intersects(initrd_data.start, initrd_data.size, safe_addr, size))
5959
safe_addr = initrd_data.start + initrd_data.size;
60+
if (intersects(safe_addr, size, (unsigned long)comps, comps->len)) {
61+
safe_addr = (unsigned long)comps + comps->len;
62+
goto repeat;
63+
}
6064
for_each_rb_entry(comp, comps)
6165
if (intersects(safe_addr, size, comp->addr, comp->len)) {
6266
safe_addr = comp->addr + comp->len;
6367
goto repeat;
6468
}
69+
if (intersects(safe_addr, size, (unsigned long)certs, certs->len)) {
70+
safe_addr = (unsigned long)certs + certs->len;
71+
goto repeat;
72+
}
6573
for_each_rb_entry(cert, certs)
6674
if (intersects(safe_addr, size, cert->addr, cert->len)) {
6775
safe_addr = cert->addr + cert->len;

‎arch/s390/configs/debug_defconfig

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ CONFIG_NUMA_BALANCING=y
2323
CONFIG_MEMCG=y
2424
CONFIG_BLK_CGROUP=y
2525
CONFIG_CFS_BANDWIDTH=y
26-
CONFIG_RT_GROUP_SCHED=y
2726
CONFIG_CGROUP_PIDS=y
2827
CONFIG_CGROUP_RDMA=y
2928
CONFIG_CGROUP_FREEZER=y
@@ -90,7 +89,6 @@ CONFIG_MINIX_SUBPARTITION=y
9089
CONFIG_SOLARIS_X86_PARTITION=y
9190
CONFIG_UNIXWARE_DISKLABEL=y
9291
CONFIG_IOSCHED_BFQ=y
93-
CONFIG_BFQ_GROUP_IOSCHED=y
9492
CONFIG_BINFMT_MISC=m
9593
CONFIG_ZSWAP=y
9694
CONFIG_ZSMALLOC_STAT=y
@@ -298,7 +296,6 @@ CONFIG_IP_NF_TARGET_REJECT=m
298296
CONFIG_IP_NF_NAT=m
299297
CONFIG_IP_NF_TARGET_MASQUERADE=m
300298
CONFIG_IP_NF_MANGLE=m
301-
CONFIG_IP_NF_TARGET_CLUSTERIP=m
302299
CONFIG_IP_NF_TARGET_ECN=m
303300
CONFIG_IP_NF_TARGET_TTL=m
304301
CONFIG_IP_NF_RAW=m
@@ -340,7 +337,6 @@ CONFIG_BRIDGE_MRP=y
340337
CONFIG_VLAN_8021Q=m
341338
CONFIG_VLAN_8021Q_GVRP=y
342339
CONFIG_NET_SCHED=y
343-
CONFIG_NET_SCH_CBQ=m
344340
CONFIG_NET_SCH_HTB=m
345341
CONFIG_NET_SCH_HFSC=m
346342
CONFIG_NET_SCH_PRIO=m
@@ -351,7 +347,6 @@ CONFIG_NET_SCH_SFQ=m
351347
CONFIG_NET_SCH_TEQL=m
352348
CONFIG_NET_SCH_TBF=m
353349
CONFIG_NET_SCH_GRED=m
354-
CONFIG_NET_SCH_DSMARK=m
355350
CONFIG_NET_SCH_NETEM=m
356351
CONFIG_NET_SCH_DRR=m
357352
CONFIG_NET_SCH_MQPRIO=m
@@ -363,14 +358,11 @@ CONFIG_NET_SCH_INGRESS=m
363358
CONFIG_NET_SCH_PLUG=m
364359
CONFIG_NET_SCH_ETS=m
365360
CONFIG_NET_CLS_BASIC=m
366-
CONFIG_NET_CLS_TCINDEX=m
367361
CONFIG_NET_CLS_ROUTE4=m
368362
CONFIG_NET_CLS_FW=m
369363
CONFIG_NET_CLS_U32=m
370364
CONFIG_CLS_U32_PERF=y
371365
CONFIG_CLS_U32_MARK=y
372-
CONFIG_NET_CLS_RSVP=m
373-
CONFIG_NET_CLS_RSVP6=m
374366
CONFIG_NET_CLS_FLOW=m
375367
CONFIG_NET_CLS_CGROUP=y
376368
CONFIG_NET_CLS_BPF=m
@@ -584,7 +576,7 @@ CONFIG_DIAG288_WATCHDOG=m
584576
CONFIG_FB=y
585577
CONFIG_FRAMEBUFFER_CONSOLE=y
586578
CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
587-
# CONFIG_HID is not set
579+
# CONFIG_HID_SUPPORT is not set
588580
# CONFIG_USB_SUPPORT is not set
589581
CONFIG_INFINIBAND=m
590582
CONFIG_INFINIBAND_USER_ACCESS=m
@@ -828,6 +820,7 @@ CONFIG_PANIC_ON_OOPS=y
828820
CONFIG_DETECT_HUNG_TASK=y
829821
CONFIG_WQ_WATCHDOG=y
830822
CONFIG_TEST_LOCKUP=m
823+
CONFIG_DEBUG_PREEMPT=y
831824
CONFIG_PROVE_LOCKING=y
832825
CONFIG_LOCK_STAT=y
833826
CONFIG_DEBUG_ATOMIC_SLEEP=y
@@ -843,6 +836,7 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=300
843836
# CONFIG_RCU_TRACE is not set
844837
CONFIG_LATENCYTOP=y
845838
CONFIG_BOOTTIME_TRACING=y
839+
CONFIG_FPROBE=y
846840
CONFIG_FUNCTION_PROFILER=y
847841
CONFIG_STACK_TRACER=y
848842
CONFIG_IRQSOFF_TRACER=y
@@ -857,6 +851,7 @@ CONFIG_SAMPLES=y
857851
CONFIG_SAMPLE_TRACE_PRINTK=m
858852
CONFIG_SAMPLE_FTRACE_DIRECT=m
859853
CONFIG_SAMPLE_FTRACE_DIRECT_MULTI=m
854+
CONFIG_SAMPLE_FTRACE_OPS=m
860855
CONFIG_DEBUG_ENTRY=y
861856
CONFIG_CIO_INJECT=y
862857
CONFIG_KUNIT=m

‎arch/s390/configs/defconfig

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ CONFIG_NUMA_BALANCING=y
2121
CONFIG_MEMCG=y
2222
CONFIG_BLK_CGROUP=y
2323
CONFIG_CFS_BANDWIDTH=y
24-
CONFIG_RT_GROUP_SCHED=y
2524
CONFIG_CGROUP_PIDS=y
2625
CONFIG_CGROUP_RDMA=y
2726
CONFIG_CGROUP_FREEZER=y
@@ -85,7 +84,6 @@ CONFIG_MINIX_SUBPARTITION=y
8584
CONFIG_SOLARIS_X86_PARTITION=y
8685
CONFIG_UNIXWARE_DISKLABEL=y
8786
CONFIG_IOSCHED_BFQ=y
88-
CONFIG_BFQ_GROUP_IOSCHED=y
8987
CONFIG_BINFMT_MISC=m
9088
CONFIG_ZSWAP=y
9189
CONFIG_ZSMALLOC_STAT=y
@@ -289,7 +287,6 @@ CONFIG_IP_NF_TARGET_REJECT=m
289287
CONFIG_IP_NF_NAT=m
290288
CONFIG_IP_NF_TARGET_MASQUERADE=m
291289
CONFIG_IP_NF_MANGLE=m
292-
CONFIG_IP_NF_TARGET_CLUSTERIP=m
293290
CONFIG_IP_NF_TARGET_ECN=m
294291
CONFIG_IP_NF_TARGET_TTL=m
295292
CONFIG_IP_NF_RAW=m
@@ -330,7 +327,6 @@ CONFIG_BRIDGE_MRP=y
330327
CONFIG_VLAN_8021Q=m
331328
CONFIG_VLAN_8021Q_GVRP=y
332329
CONFIG_NET_SCHED=y
333-
CONFIG_NET_SCH_CBQ=m
334330
CONFIG_NET_SCH_HTB=m
335331
CONFIG_NET_SCH_HFSC=m
336332
CONFIG_NET_SCH_PRIO=m
@@ -341,7 +337,6 @@ CONFIG_NET_SCH_SFQ=m
341337
CONFIG_NET_SCH_TEQL=m
342338
CONFIG_NET_SCH_TBF=m
343339
CONFIG_NET_SCH_GRED=m
344-
CONFIG_NET_SCH_DSMARK=m
345340
CONFIG_NET_SCH_NETEM=m
346341
CONFIG_NET_SCH_DRR=m
347342
CONFIG_NET_SCH_MQPRIO=m
@@ -353,14 +348,11 @@ CONFIG_NET_SCH_INGRESS=m
353348
CONFIG_NET_SCH_PLUG=m
354349
CONFIG_NET_SCH_ETS=m
355350
CONFIG_NET_CLS_BASIC=m
356-
CONFIG_NET_CLS_TCINDEX=m
357351
CONFIG_NET_CLS_ROUTE4=m
358352
CONFIG_NET_CLS_FW=m
359353
CONFIG_NET_CLS_U32=m
360354
CONFIG_CLS_U32_PERF=y
361355
CONFIG_CLS_U32_MARK=y
362-
CONFIG_NET_CLS_RSVP=m
363-
CONFIG_NET_CLS_RSVP6=m
364356
CONFIG_NET_CLS_FLOW=m
365357
CONFIG_NET_CLS_CGROUP=y
366358
CONFIG_NET_CLS_BPF=m
@@ -573,7 +565,7 @@ CONFIG_DIAG288_WATCHDOG=m
573565
CONFIG_FB=y
574566
CONFIG_FRAMEBUFFER_CONSOLE=y
575567
CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
576-
# CONFIG_HID is not set
568+
# CONFIG_HID_SUPPORT is not set
577569
# CONFIG_USB_SUPPORT is not set
578570
CONFIG_INFINIBAND=m
579571
CONFIG_INFINIBAND_USER_ACCESS=m
@@ -795,6 +787,7 @@ CONFIG_RCU_REF_SCALE_TEST=m
795787
CONFIG_RCU_CPU_STALL_TIMEOUT=60
796788
CONFIG_LATENCYTOP=y
797789
CONFIG_BOOTTIME_TRACING=y
790+
CONFIG_FPROBE=y
798791
CONFIG_FUNCTION_PROFILER=y
799792
CONFIG_STACK_TRACER=y
800793
CONFIG_SCHED_TRACER=y
@@ -805,6 +798,7 @@ CONFIG_SAMPLES=y
805798
CONFIG_SAMPLE_TRACE_PRINTK=m
806799
CONFIG_SAMPLE_FTRACE_DIRECT=m
807800
CONFIG_SAMPLE_FTRACE_DIRECT_MULTI=m
801+
CONFIG_SAMPLE_FTRACE_OPS=m
808802
CONFIG_KUNIT=m
809803
CONFIG_KUNIT_DEBUGFS=y
810804
CONFIG_LKDTM=m

‎arch/s390/configs/zfcpdump_defconfig

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ CONFIG_ZFCP=y
5858
# CONFIG_VMCP is not set
5959
# CONFIG_MONWRITER is not set
6060
# CONFIG_S390_VMUR is not set
61-
# CONFIG_HID is not set
61+
# CONFIG_HID_SUPPORT is not set
6262
# CONFIG_VIRTIO_MENU is not set
6363
# CONFIG_VHOST_MENU is not set
6464
# CONFIG_IOMMU_SUPPORT is not set

‎arch/s390/pci/pci.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -544,8 +544,7 @@ static struct resource *__alloc_res(struct zpci_dev *zdev, unsigned long start,
544544
return r;
545545
}
546546

547-
int zpci_setup_bus_resources(struct zpci_dev *zdev,
548-
struct list_head *resources)
547+
int zpci_setup_bus_resources(struct zpci_dev *zdev)
549548
{
550549
unsigned long addr, size, flags;
551550
struct resource *res;
@@ -581,7 +580,6 @@ int zpci_setup_bus_resources(struct zpci_dev *zdev,
581580
return -ENOMEM;
582581
}
583582
zdev->bars[i].res = res;
584-
pci_add_resource(resources, res);
585583
}
586584
zdev->has_resources = 1;
587585

@@ -590,17 +588,23 @@ int zpci_setup_bus_resources(struct zpci_dev *zdev,
590588

591589
static void zpci_cleanup_bus_resources(struct zpci_dev *zdev)
592590
{
591+
struct resource *res;
593592
int i;
594593

594+
pci_lock_rescan_remove();
595595
for (i = 0; i < PCI_STD_NUM_BARS; i++) {
596-
if (!zdev->bars[i].size || !zdev->bars[i].res)
596+
res = zdev->bars[i].res;
597+
if (!res)
597598
continue;
598599

600+
release_resource(res);
601+
pci_bus_remove_resource(zdev->zbus->bus, res);
599602
zpci_free_iomap(zdev, zdev->bars[i].map_idx);
600-
release_resource(zdev->bars[i].res);
601-
kfree(zdev->bars[i].res);
603+
zdev->bars[i].res = NULL;
604+
kfree(res);
602605
}
603606
zdev->has_resources = 0;
607+
pci_unlock_rescan_remove();
604608
}
605609

606610
int pcibios_device_add(struct pci_dev *pdev)

‎arch/s390/pci/pci_bus.c

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,7 @@ static int zpci_nb_devices;
4141
*/
4242
static int zpci_bus_prepare_device(struct zpci_dev *zdev)
4343
{
44-
struct resource_entry *window, *n;
45-
struct resource *res;
46-
int rc;
44+
int rc, i;
4745

4846
if (!zdev_enabled(zdev)) {
4947
rc = zpci_enable_device(zdev);
@@ -57,10 +55,10 @@ static int zpci_bus_prepare_device(struct zpci_dev *zdev)
5755
}
5856

5957
if (!zdev->has_resources) {
60-
zpci_setup_bus_resources(zdev, &zdev->zbus->resources);
61-
resource_list_for_each_entry_safe(window, n, &zdev->zbus->resources) {
62-
res = window->res;
63-
pci_bus_add_resource(zdev->zbus->bus, res, 0);
58+
zpci_setup_bus_resources(zdev);
59+
for (i = 0; i < PCI_STD_NUM_BARS; i++) {
60+
if (zdev->bars[i].res)
61+
pci_bus_add_resource(zdev->zbus->bus, zdev->bars[i].res, 0);
6462
}
6563
}
6664

‎arch/s390/pci/pci_bus.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,7 @@ static inline void zpci_zdev_get(struct zpci_dev *zdev)
3030

3131
int zpci_alloc_domain(int domain);
3232
void zpci_free_domain(int domain);
33-
int zpci_setup_bus_resources(struct zpci_dev *zdev,
34-
struct list_head *resources);
33+
int zpci_setup_bus_resources(struct zpci_dev *zdev);
3534

3635
static inline struct zpci_dev *zdev_from_bus(struct pci_bus *bus,
3736
unsigned int devfn)

‎drivers/pci/bus.c

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,27 @@ struct resource *pci_bus_resource_n(const struct pci_bus *bus, int n)
7676
}
7777
EXPORT_SYMBOL_GPL(pci_bus_resource_n);
7878

79+
void pci_bus_remove_resource(struct pci_bus *bus, struct resource *res)
80+
{
81+
struct pci_bus_resource *bus_res, *tmp;
82+
int i;
83+
84+
for (i = 0; i < PCI_BRIDGE_RESOURCE_NUM; i++) {
85+
if (bus->resource[i] == res) {
86+
bus->resource[i] = NULL;
87+
return;
88+
}
89+
}
90+
91+
list_for_each_entry_safe(bus_res, tmp, &bus->resources, list) {
92+
if (bus_res->res == res) {
93+
list_del(&bus_res->list);
94+
kfree(bus_res);
95+
return;
96+
}
97+
}
98+
}
99+
79100
void pci_bus_remove_resources(struct pci_bus *bus)
80101
{
81102
int i;

‎include/linux/pci.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1438,6 +1438,7 @@ void pci_bus_add_resource(struct pci_bus *bus, struct resource *res,
14381438
unsigned int flags);
14391439
struct resource *pci_bus_resource_n(const struct pci_bus *bus, int n);
14401440
void pci_bus_remove_resources(struct pci_bus *bus);
1441+
void pci_bus_remove_resource(struct pci_bus *bus, struct resource *res);
14411442
int devm_request_pci_bus_resources(struct device *dev,
14421443
struct list_head *resources);
14431444

0 commit comments

Comments
 (0)