kernel/drivers/misc/genwqe/card_dev.c, branch linux-5.1.y

genwqe: Prevent an integer overflow in the ioctl

2019-06-11T10:19:18Z

commit 110080cea0d0e4dfdb0b536e7f8a5633ead6a781 upstream. There are a couple potential integer overflows here. round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE); The first thing is that the "m->size + (...)" addition could overflow, and the second is that round_up() overflows to zero if the result is within PAGE_SIZE of the type max. In this code, the "m->size" variable is an u64 but we're saving the result in "map_size" which is an unsigned long and genwqe_user_vmap() takes an unsigned long as well. So I have used ULONG_MAX as the upper bound. From a practical perspective unsigned long is fine/better than trying to change all the types to u64. Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") Signed-off-by: Dan Carpenter Cc: stable Signed-off-by: Greg Kroah-Hartman

signal/GenWQE: Fix sending of SIGKILL

2018-09-15T14:07:19Z

The genweq_add_file and genwqe_del_file by caching current without using reference counting embed the assumption that a file descriptor will never be passed from one process to another. It even embeds the assumption that the the thread that opened the file will be in existence when the process terminates. Neither of which are guaranteed to be true. Therefore replace caching the task_struct of the opener with pid of the openers thread group id. All the knowledge of the opener is used for is as the target of SIGKILL and a SIGKILL will kill the entire process group. Rename genwqe_force_sig to genwqe_terminate, remove it's unncessary signal argument, update it's ownly caller, and use kill_pid instead of force_sig. The work force_sig does in changing signal handling state is not relevant to SIGKILL sent as SEND_SIG_PRIV. The exact same processess will be killed just with less work, and less confusion. The work done by force_sig is really only needed for handling syncrhonous exceptions. It will still be possible to cause genwqe_device_remove to wait 8 seconds by passing a file descriptor to another process but the possible user after free is fixed. Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue") Cc: stable@vger.kernel.org Cc: Greg Kroah-Hartman Cc: Frank Haverkamp Cc: Joerg-Stephan Vogt Cc: Michael Jung Cc: Michael Ruettger Cc: Kleber Sacilotto de Souza Cc: Sebastian Ott Cc: Eberhard S. Amann Cc: Gabriel Krisman Bertazi Cc: Guilherme G. Piccoli Signed-off-by: "Eric W. Biederman"

misc: genwqe: remove several redundant variables

2018-07-03T11:01:47Z

The variables val16, type, pci_dev and type are set but are never used hence they are redundant and can be removed. Cleans up clang warnings: warning: variable 'type' set but not used [-Wunused-but-set-variable] warning: variable 'val16' set but not used [-Wunused-but-set-variable] warning: variable 'pci_dev' set but not used [-Wunused-but-set-variable] warning: variable 'type' set but not used [-Wunused-but-set-variable] Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman

genwqe: Remove unused parameter in some functions

2017-12-19T09:54:44Z

This is a clean-up patch, no functional changes intended. It removes the unused parameter of type "struct ddcb_requ*" from the functions genwqe_user_vmap() and genwqe_user_vunmap(). Signed-off-by: Guilherme G. Piccoli Signed-off-by: Greg Kroah-Hartman

genwqe: Make defines uppercase

2017-12-19T09:54:44Z

This is a clean-up patch, no functional changes intended. It makes all defines uppercase, following a "tradition" that helps to make code clearer. Signed-off-by: Guilherme G. Piccoli Signed-off-by: Greg Kroah-Hartman

genwqe: Remove unused variable and rename function

2017-12-19T09:54:44Z

This is a clean-up patch, no functional changes intended. It removes an unused variable from do_execute_ddcb() and also renames the function free_user_pages(), prepending "genwqe" prefix in order to clarify the code. Signed-off-by: Guilherme G. Piccoli Signed-off-by: Greg Kroah-Hartman

genwqe: Take R/W permissions into account when dealing with memory pages

2017-10-23T09:34:42Z

Currently we assume userspace pages are always writable when doing memory pinning. This is not true, specially since userspace applications may allocate their memory the way they want, we have no control over it. If a read-only page is set for pinning, currently the driver fails due to get_user_pages_fast() refusing to map read-only pages as writable. This patch changes this behavior, by taking the permission flags of the pages into account in both pinning/unpinning process, as well as in the DMA data copy-back to userpace (which we shouldn't try to do blindly, since it will fail in case of read-only-pages). Signed-off-by: Frank Haverkamp Signed-off-by: Guilherme G. Piccoli Signed-off-by: Greg Kroah-Hartman

sched/headers: Prepare for new header dependencies before moving code to

2017-03-02T07:42:29Z

We are going to split out of , which will have to be picked up from other headers and a couple of .c files. Create a trivial placeholder file that just maps to to make this patch obviously correct and bisectable. Include the new header in the files that are going to need it. Acked-by: Linus Torvalds Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar

locking/atomic, kref: Add kref_read()

2017-01-14T10:37:18Z

Since we need to change the implementation, stop exposing internals. Provide kref_read() to read the current reference count; typically used for debug messages. Kills two anti-patterns: atomic_read(&kref->refcount) kref->refcount.counter Signed-off-by: Peter Zijlstra (Intel) Cc: Andrew Morton Cc: Greg Kroah-Hartman Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar

misc/genwqe: get rid of atomic allocations

2015-10-04T11:42:33Z

we received reports of failed allocations in genwqe code: [ 733.550955] genwqe_gzip: page allocation failure: order:1, mode:0x20 [ 733.550964] CPU: 2 PID: 1846 Comm: genwqe_gzip Not tainted 4.3.0-rc3-00042-g3225031 #78 [ 733.550968] 000000002782b830 000000002782b8c0 0000000000000002 0000000000000000 000000002782b960 000000002782b8d8 000000002782b8d8 00000000001134a0 0000000000000000 0000000000892b2a 0000000000871d0a 000000000000000b 000000002782b920 000000002782b8c0 0000000000000000 0000000000000000 0000000000000000 00000000001134a0 000000002782b8c0 000000002782b920 [ 733.551003] Call Trace: [ 733.551013] ([<0000000000113388>] show_trace+0xf8/0x158) [ 733.551018] [<0000000000113452>] show_stack+0x6a/0xe8 [ 733.551024] [<00000000004611d4>] dump_stack+0x7c/0xd8 [ 733.551031] [<000000000024dc22>] warn_alloc_failed+0xda/0x150 [ 733.551036] [<000000000025268e>] __alloc_pages_nodemask+0x94e/0xbc0 [ 733.551041] [<000000000012bcd8>] s390_dma_alloc+0x70/0x1a0 [ 733.551054] [<000003ff804d8e8c>] __genwqe_alloc_consistent+0x84/0xd0 [genwqe_card] [ 733.551063] [<000003ff804d90c2>] genwqe_alloc_sync_sgl+0x13a/0x328 [genwqe_card] [ 733.551066] [<000003ff804d41a0>] do_execute_ddcb+0x1f8/0x388 [genwqe_card] [ 733.551069] [<000003ff804d48c8>] genwqe_ioctl+0x598/0xd50 [genwqe_card] [ 733.551072] [<00000000002cc90c>] do_vfs_ioctl+0x3f4/0x590 [ 733.551074] [<00000000002ccb46>] SyS_ioctl+0x9e/0xb0 [ 733.551078] [<00000000006c8166>] system_call+0xd6/0x258 [ 733.551080] [<000003fffd25819a>] 0x3fffd25819a [ 733.551082] no locks held by genwqe_gzip/1846. This specific allocation and some others in genwqe are unnecessary flagged as atomic. All of genwqe's atomic allocations happen in a context where it's allowed to sleep. Change these to use GFP_KERNEL. Signed-off-by: Sebastian Ott Acked-by: Frank Haverkamp Signed-off-by: Greg Kroah-Hartman