leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branches 'pci/hotplug' and 'pci/resource' into next

Browse Source 
* pci/hotplug:
  PCI: ibmphp: Remove unneeded NULL test
  PCI: hotplug: Use list_for_each_entry() to simplify code
  PCI: acpiphp_ibm: Fix null dereferences on null ibm_slot

* pci/resource:
  PCI: Avoid iterating through memory outside the resource window
  PCI: Fix minimum allocation address overwrite
This commit is contained in:
Bjorn Helgaas 2016-01-15 12:33:29 -06:00
commit 472358412b
13 changed files with 67 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/pci/bus.c
View File

@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
type_mask |= IORESOURCE_TYPE_BITS;
pci_bus_for_each_resource(bus, r, i) {
resource_size_t min_used = min;
if (!r)
continue;
@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
* overrides "min".
*/
if (avail.start)
min = avail.start;
min_used = avail.start;
max = avail.end;
/* Ok, try it out.. */
ret = allocate_resource(r, res, size, min, max,
ret = allocate_resource(r, res, size, min_used, max,
align, alignf, alignf_data);
if (ret == 0)
return 0;

17
drivers/pci/hotplug/acpiphp_ibm.c
View File

@ -154,7 +154,8 @@ static union apci_descriptor *ibm_slot_from_id(int id)
ibm_slot_done:
if (ret) {
ret = kmalloc(sizeof(union apci_descriptor), GFP_KERNEL);
memcpy(ret, des, sizeof(union apci_descriptor));
if (ret)
memcpy(ret, des, sizeof(union apci_descriptor));
}
kfree(table);
return ret;
@ -175,8 +176,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status)
acpi_status stat;
unsigned long long rc;
union apci_descriptor *ibm_slot;
int id = hpslot_to_sun(slot);
ibm_slot = ibm_slot_from_id(hpslot_to_sun(slot));
ibm_slot = ibm_slot_from_id(id);
if (!ibm_slot) {
pr_err("APLS null ACPI descriptor for slot %d\n", id);
return -ENODEV;
}
pr_debug("%s: set slot %d (%d) attention status to %d\n", __func__,
ibm_slot->slot.slot_num, ibm_slot->slot.slot_id,
@ -215,8 +221,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status)
static int ibm_get_attention_status(struct hotplug_slot *slot, u8 *status)
{
union apci_descriptor *ibm_slot;
int id = hpslot_to_sun(slot);
ibm_slot = ibm_slot_from_id(hpslot_to_sun(slot));
ibm_slot = ibm_slot_from_id(id);
if (!ibm_slot) {
pr_err("APLS null ACPI descriptor for slot %d\n", id);
return -ENODEV;
}
if (ibm_slot->slot.attn & 0xa0 || ibm_slot->slot.status[1] & 0x08)
*status = 1;

24
drivers/pci/hotplug/ibmphp_core.c
View File

@ -116,11 +116,9 @@ static inline int slot_update(struct slot **sl)
static int __init get_max_slots (void)
{
struct slot *slot_cur;
struct list_head *tmp;
u8 slot_count = 0;
list_for_each(tmp, &ibmphp_slot_head) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
/* sometimes the hot-pluggable slots start with 4 (not always from 1) */
slot_count = max(slot_count, slot_cur->number);
}
@ -501,16 +499,10 @@ static int get_bus_name(struct hotplug_slot *hotplug_slot, char *value)
static int __init init_ops(void)
{
struct slot *slot_cur;
struct list_head *tmp;
int retval;
int rc;
list_for_each(tmp, &ibmphp_slot_head) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
if (!slot_cur)
return -ENODEV;
list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
debug("BEFORE GETTING SLOT STATUS, slot # %x\n",
slot_cur->number);
if (slot_cur->ctrl->revision == 0xFF)
@ -669,9 +661,7 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function)
{
struct pci_func *func_cur;
struct slot *slot_cur;
struct list_head *tmp;
list_for_each(tmp, &ibmphp_slot_head) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
if (slot_cur->func) {
func_cur = slot_cur->func;
while (func_cur) {
@ -693,14 +683,12 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function)
*************************************************************/
static void free_slots(void)
{
struct slot *slot_cur;
struct list_head *tmp;
struct list_head *next;
struct slot *slot_cur, *next;
debug("%s -- enter\n", __func__);
list_for_each_safe(tmp, next, &ibmphp_slot_head) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
list_for_each_entry_safe(slot_cur, next, &ibmphp_slot_head,
ibm_slot_list) {
pci_hp_deregister(slot_cur->hotplug_slot);
}
debug("%s -- exit\n", __func__);

24
drivers/pci/hotplug/ibmphp_ebda.c
View File

@ -1117,25 +1117,21 @@ int ibmphp_get_bus_index (u8 num)
void ibmphp_free_bus_info_queue (void)
{
struct bus_info *bus_info;
struct list_head *list;
struct list_head *next;
struct bus_info *bus_info, *next;
list_for_each_safe (list, next, &bus_info_head ) {
bus_info = list_entry (list, struct bus_info, bus_info_list);
list_for_each_entry_safe(bus_info, next, &bus_info_head,
bus_info_list) {
kfree (bus_info);
}
}
void ibmphp_free_ebda_hpc_queue (void)
{
struct controller *controller = NULL;
struct list_head *list;
struct list_head *next;
struct controller *controller = NULL, *next;
int pci_flag = 0;
list_for_each_safe (list, next, &ebda_hpc_head) {
controller = list_entry (list, struct controller, ebda_hpc_list);
list_for_each_entry_safe(controller, next, &ebda_hpc_head,
ebda_hpc_list) {
if (controller->ctlr_type == 0)
release_region (controller->u.isa_ctlr.io_start, (controller->u.isa_ctlr.io_end - controller->u.isa_ctlr.io_start + 1));
else if ((controller->ctlr_type == 1) && (!pci_flag)) {
@ -1148,12 +1144,10 @@ void ibmphp_free_ebda_hpc_queue (void)
void ibmphp_free_ebda_pci_rsrc_queue (void)
{
struct ebda_pci_rsrc *resource;
struct list_head *list;
struct list_head *next;
struct ebda_pci_rsrc *resource, *next;
list_for_each_safe (list, next, &ibmphp_ebda_pci_rsrc_head) {
resource = list_entry (list, struct ebda_pci_rsrc, ebda_pci_rsrc_list);
list_for_each_entry_safe(resource, next, &ibmphp_ebda_pci_rsrc_head,
ebda_pci_rsrc_list) {
kfree (resource);
resource = NULL;
}

18
drivers/pci/hotplug/ibmphp_hpc.c
View File

@ -537,7 +537,6 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus)
{
void __iomem *wpg_bbar = NULL;
struct controller *ctlr_ptr;
struct list_head *pslotlist;
u8 index, status;
int rc = 0;
int busindex;
@ -628,8 +627,8 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus)
// Not used
case READ_ALLSLOT:
list_for_each (pslotlist, &ibmphp_slot_head) {
pslot = list_entry (pslotlist, struct slot, ibm_slot_list);
list_for_each_entry(pslot, &ibmphp_slot_head,
ibm_slot_list) {
index = pslot->ctlr_index;
rc = hpc_wait_ctlr_notworking (HPC_CTLR_WORKING_TOUT, ctlr_ptr,
wpg_bbar, &status);
@ -820,7 +819,6 @@ static int poll_hpc(void *data)
{
struct slot myslot;
struct slot *pslot = NULL;
struct list_head *pslotlist;
int rc;
int poll_state = POLL_LATCH_REGISTER;
u8 oldlatchlow = 0x00;
@ -838,10 +836,10 @@ static int poll_hpc(void *data)
case POLL_LATCH_REGISTER:
oldlatchlow = curlatchlow;
ctrl_count = 0x00;
list_for_each (pslotlist, &ibmphp_slot_head) {
list_for_each_entry(pslot, &ibmphp_slot_head,
ibm_slot_list) {
if (ctrl_count >= ibmphp_get_total_controllers())
break;
pslot = list_entry (pslotlist, struct slot, ibm_slot_list);
if (pslot->ctrl->ctlr_relative_id == ctrl_count) {
ctrl_count++;
if (READ_SLOT_LATCH (pslot->ctrl)) {
@ -859,8 +857,8 @@ static int poll_hpc(void *data)
poll_state = POLL_SLEEP;
break;
case POLL_SLOTS:
list_for_each (pslotlist, &ibmphp_slot_head) {
pslot = list_entry (pslotlist, struct slot, ibm_slot_list);
list_for_each_entry(pslot, &ibmphp_slot_head,
ibm_slot_list) {
// make a copy of the old status
memcpy ((void *) &myslot, (void *) pslot,
sizeof (struct slot));
@ -870,10 +868,10 @@ static int poll_hpc(void *data)
process_changeinstatus (pslot, &myslot);
}
ctrl_count = 0x00;
list_for_each (pslotlist, &ibmphp_slot_head) {
list_for_each_entry(pslot, &ibmphp_slot_head,
ibm_slot_list) {
if (ctrl_count >= ibmphp_get_total_controllers())
break;
pslot = list_entry (pslotlist, struct slot, ibm_slot_list);
if (pslot->ctrl->ctlr_relative_id == ctrl_count) {
ctrl_count++;
if (READ_SLOT_LATCH (pslot->ctrl))

32
drivers/pci/hotplug/ibmphp_res.c
View File

@ -203,15 +203,13 @@ int __init ibmphp_rsrc_init (void)
struct bus_node *newbus = NULL;
struct bus_node *bus_cur;
struct bus_node *bus_prev;
struct list_head *tmp;
struct resource_node *new_io = NULL;
struct resource_node *new_mem = NULL;
struct resource_node *new_pfmem = NULL;
int rc;
struct list_head *tmp_ebda;
list_for_each (tmp_ebda, &ibmphp_ebda_pci_rsrc_head) {
curr = list_entry (tmp_ebda, struct ebda_pci_rsrc, ebda_pci_rsrc_list);
list_for_each_entry(curr, &ibmphp_ebda_pci_rsrc_head,
ebda_pci_rsrc_list) {
if (!(curr->rsrc_type & PCIDEVMASK)) {
/* EBDA still lists non PCI devices, so ignore... */
debug ("this is not a PCI DEVICE in rsrc_init, please take care\n");
@ -369,8 +367,7 @@ int __init ibmphp_rsrc_init (void)
}
}
list_for_each (tmp, &gbuses) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
list_for_each_entry(bus_cur, &gbuses, bus_list) {
/* This is to get info about PPB resources, since EBDA doesn't put this info into the primary bus info */
rc = update_bridge_ranges (&bus_cur);
if (rc)
@ -1571,19 +1568,16 @@ int ibmphp_find_resource (struct bus_node *bus, u32 start_address, struct resour
***********************************************************************/
void ibmphp_free_resources (void)
{
struct bus_node *bus_cur = NULL;
struct bus_node *bus_cur = NULL, *next;
struct bus_node *bus_tmp;
struct range_node *range_cur;
struct range_node *range_tmp;
struct resource_node *res_cur;
struct resource_node *res_tmp;
struct list_head *tmp;
struct list_head *next;
int i = 0;
flags = 1;
list_for_each_safe (tmp, next, &gbuses) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
list_for_each_entry_safe(bus_cur, next, &gbuses, bus_list) {
if (bus_cur->noIORanges) {
range_cur = bus_cur->rangeIO;
for (i = 0; i < bus_cur->noIORanges; i++) {
@ -1691,10 +1685,8 @@ static int __init once_over (void)
struct resource_node *pfmem_prev;
struct resource_node *mem;
struct bus_node *bus_cur;
struct list_head *tmp;
list_for_each (tmp, &gbuses) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
list_for_each_entry(bus_cur, &gbuses, bus_list) {
if ((!bus_cur->rangePFMem) && (bus_cur->firstPFMem)) {
for (pfmem_cur = bus_cur->firstPFMem, pfmem_prev = NULL; pfmem_cur; pfmem_prev = pfmem_cur, pfmem_cur = pfmem_cur->next) {
pfmem_cur->fromMem = 1;
@ -1767,14 +1759,10 @@ struct bus_node *ibmphp_find_res_bus (u8 bus_number)
static struct bus_node *find_bus_wprev (u8 bus_number, struct bus_node **prev, u8 flag)
{
struct bus_node *bus_cur;
struct list_head *tmp;
struct list_head *tmp_prev;
list_for_each (tmp, &gbuses) {
tmp_prev = tmp->prev;
bus_cur = list_entry (tmp, struct bus_node, bus_list);
list_for_each_entry(bus_cur, &gbuses, bus_list) {
if (flag)
*prev = list_entry (tmp_prev, struct bus_node, bus_list);
*prev = list_prev_entry(bus_cur, bus_list);
if (bus_cur->busno == bus_number)
return bus_cur;
}
@ -1788,7 +1776,6 @@ void ibmphp_print_test (void)
struct bus_node *bus_cur = NULL;
struct range_node *range;
struct resource_node *res;
struct list_head *tmp;
debug_pci ("*****************START**********************\n");
@ -1797,8 +1784,7 @@ void ibmphp_print_test (void)
return;
}
list_for_each (tmp, &gbuses) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
list_for_each_entry(bus_cur, &gbuses, bus_list) {
debug_pci ("This is bus # %d. There are\n", bus_cur->busno);
debug_pci ("IORanges = %d\t", bus_cur->noIORanges);
debug_pci ("MemRanges = %d\t", bus_cur->noMemRanges);

4
drivers/pci/hotplug/pci_hotplug_core.c
View File

@ -396,10 +396,8 @@ static void fs_remove_slot(struct pci_slot *pci_slot)
static struct hotplug_slot *get_slot_from_name(const char *name)
{
struct hotplug_slot *slot;
struct list_head *tmp;
list_for_each(tmp, &pci_hotplug_slot_list) {
slot = list_entry(tmp, struct hotplug_slot, slot_list);
list_for_each_entry(slot, &pci_hotplug_slot_list, slot_list) {
if (strcmp(hotplug_slot_name(slot), name) == 0)
return slot;
}

7
drivers/pci/hotplug/pcihp_skeleton.c
View File

@ -321,17 +321,14 @@ error:
static void __exit cleanup_slots(void)
{
struct list_head *tmp;
struct list_head *next;
struct slot *slot;
struct slot *slot, *next;
/*
* Unregister all of our slots with the pci_hotplug subsystem.
* Memory will be freed in release_slot() callback after slot's
* lifespan is finished.
*/
list_for_each_safe(tmp, next, &slot_list) {
slot = list_entry(tmp, struct slot, slot_list);
list_for_each_entry_safe(slot, next, &slot_list, slot_list) {
list_del(&slot->slot_list);
pci_hp_deregister(slot->hotplug_slot);
}

7
drivers/pci/hotplug/rpadlpar_core.c
View File

@ -114,11 +114,10 @@ static struct device_node *find_dlpar_node(char *drc_name, int *node_type)
*/
static struct slot *find_php_slot(struct device_node *dn)
{
struct list_head *tmp, *n;
struct slot *slot;
struct slot *slot, *next;
list_for_each_safe(tmp, n, &rpaphp_slot_head) {
slot = list_entry(tmp, struct slot, rpaphp_slot_list);
list_for_each_entry_safe(slot, next, &rpaphp_slot_head,
rpaphp_slot_list) {
if (slot->dn == dn)
return slot;
}

7
drivers/pci/hotplug/rpaphp_core.c
View File

@ -356,8 +356,7 @@ EXPORT_SYMBOL_GPL(rpaphp_add_slot);
static void __exit cleanup_slots(void)
{
struct list_head *tmp, *n;
struct slot *slot;
struct slot *slot, *next;
/*
* Unregister all of our slots with the pci_hotplug subsystem,
@ -365,8 +364,8 @@ static void __exit cleanup_slots(void)
* memory will be freed in release_slot callback.
*/
list_for_each_safe(tmp, n, &rpaphp_slot_head) {
slot = list_entry(tmp, struct slot, rpaphp_slot_list);
list_for_each_entry_safe(slot, next, &rpaphp_slot_head,
rpaphp_slot_list) {
list_del(&slot->rpaphp_slot_list);
pci_hp_deregister(slot->hotplug_slot);
}

7
drivers/pci/hotplug/s390_pci_hpc.c
View File

@ -201,11 +201,10 @@ error:
void zpci_exit_slot(struct zpci_dev *zdev)
{
struct list_head *tmp, *n;
struct slot *slot;
struct slot *slot, *next;
list_for_each_safe(tmp, n, &s390_hotplug_slot_list) {
slot = list_entry(tmp, struct slot, slot_list);
list_for_each_entry_safe(slot, next, &s390_hotplug_slot_list,
slot_list) {
if (slot->zdev != zdev)
continue;
list_del(&slot->slot_list);

7
drivers/pci/hotplug/shpchp_core.c
View File

@ -178,12 +178,9 @@ error:
void cleanup_slots(struct controller *ctrl)
{
struct list_head *tmp;
struct list_head *next;
struct slot *slot;
struct slot *slot, *next;
list_for_each_safe(tmp, next, &ctrl->slot_list) {
slot = list_entry(tmp, struct slot, slot_list);
list_for_each_entry_safe(slot, next, &ctrl->slot_list, slot_list) {
list_del(&slot->slot_list);
cancel_delayed_work(&slot->work);
destroy_workqueue(slot->wq);

3
drivers/pci/rom.c
View File

@ -92,6 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
last_image = readb(pds + 21) & 0x80;
length = readw(pds + 16);
image += length * 512;
/* Avoid iterating through memory outside the resource window */
if (image > rom + size)
break;
} while (length && !last_image);
/* never return a size larger than the PCI resource window */