Skip to content

Commit 6809054

Browse files
torvaldstorvalds
committed
Merge tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc fixes from Greg KH: "Here are some small char and misc driver fixes for 5.0-rc6. Nothing huge here, some more binderfs fixups found as people use it, and there is a "large" selftest added to validate the binderfs code, which makes up the majority of this pull request. There's also some small mei and mic fixes to resolve some reported issues. All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mic: vop: Fix crash on remove mic: vop: Fix use-after-free on remove binderfs: remove separate device_initcall() fpga: stratix10-soc: fix wrong of_node_put() in init function mic: vop: Fix broken virtqueues mei: free read cb on ctrl_wr list flush samples: mei: use /dev/mei0 instead of /dev/mei mei: me: add ice lake point device id. binderfs: respect limit on binder control creation binder: fix CONFIG_ANDROID_BINDER_DEVICES selftests: add binderfs selftests
2 parents 8c8e62c + 4bf13fd commit 6809054

File tree

14 files changed

+380
-55
lines changed

14 files changed

+380
-55
lines changed

‎drivers/android/binder.c

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5854,9 +5854,10 @@ static int __init init_binder_device(const char *name)
58545854
static int __init binder_init(void)
58555855
{
58565856
int ret;
5857-
char *device_name, *device_names, *device_tmp;
5857+
char *device_name, *device_tmp;
58585858
struct binder_device *device;
58595859
struct hlist_node *tmp;
5860+
char *device_names = NULL;
58605861

58615862
ret = binder_alloc_shrinker_init();
58625863
if (ret)
@@ -5898,23 +5899,29 @@ static int __init binder_init(void)
58985899
&transaction_log_fops);
58995900
}
59005901

5901-
/*
5902-
* Copy the module_parameter string, because we don't want to
5903-
* tokenize it in-place.
5904-
*/
5905-
device_names = kstrdup(binder_devices_param, GFP_KERNEL);
5906-
if (!device_names) {
5907-
ret = -ENOMEM;
5908-
goto err_alloc_device_names_failed;
5909-
}
5902+
if (strcmp(binder_devices_param, "") != 0) {
5903+
/*
5904+
* Copy the module_parameter string, because we don't want to
5905+
* tokenize it in-place.
5906+
*/
5907+
device_names = kstrdup(binder_devices_param, GFP_KERNEL);
5908+
if (!device_names) {
5909+
ret = -ENOMEM;
5910+
goto err_alloc_device_names_failed;
5911+
}
59105912

5911-
device_tmp = device_names;
5912-
while ((device_name = strsep(&device_tmp, ","))) {
5913-
ret = init_binder_device(device_name);
5914-
if (ret)
5915-
goto err_init_binder_device_failed;
5913+
device_tmp = device_names;
5914+
while ((device_name = strsep(&device_tmp, ","))) {
5915+
ret = init_binder_device(device_name);
5916+
if (ret)
5917+
goto err_init_binder_device_failed;
5918+
}
59165919
}
59175920

5921+
ret = init_binderfs();
5922+
if (ret)
5923+
goto err_init_binder_device_failed;
5924+
59185925
return ret;
59195926

59205927
err_init_binder_device_failed:

‎drivers/android/binder_internal.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,4 +46,13 @@ static inline bool is_binderfs_device(const struct inode *inode)
4646
}
4747
#endif
4848

49+
#ifdef CONFIG_ANDROID_BINDERFS
50+
extern int __init init_binderfs(void);
51+
#else
52+
static inline int __init init_binderfs(void)
53+
{
54+
return 0;
55+
}
56+
#endif
57+
4958
#endif /* _LINUX_BINDER_INTERNAL_H */

‎drivers/android/binderfs.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -395,6 +395,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
395395
struct inode *inode = NULL;
396396
struct dentry *root = sb->s_root;
397397
struct binderfs_info *info = sb->s_fs_info;
398+
#if defined(CONFIG_IPC_NS)
399+
bool use_reserve = (info->ipc_ns == &init_ipc_ns);
400+
#else
401+
bool use_reserve = true;
402+
#endif
398403

399404
device = kzalloc(sizeof(*device), GFP_KERNEL);
400405
if (!device)
@@ -413,7 +418,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
413418

414419
/* Reserve a new minor number for the new device. */
415420
mutex_lock(&binderfs_minors_mutex);
416-
minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
421+
minor = ida_alloc_max(&binderfs_minors,
422+
use_reserve ? BINDERFS_MAX_MINOR :
423+
BINDERFS_MAX_MINOR_CAPPED,
424+
GFP_KERNEL);
417425
mutex_unlock(&binderfs_minors_mutex);
418426
if (minor < 0) {
419427
ret = minor;
@@ -542,7 +550,7 @@ static struct file_system_type binder_fs_type = {
542550
.fs_flags = FS_USERNS_MOUNT,
543551
};
544552

545-
static int __init init_binderfs(void)
553+
int __init init_binderfs(void)
546554
{
547555
int ret;
548556

@@ -560,5 +568,3 @@ static int __init init_binderfs(void)
560568

561569
return ret;
562570
}
563-
564-
device_initcall(init_binderfs);

‎drivers/fpga/stratix10-soc.c

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -508,14 +508,11 @@ static int __init s10_init(void)
508508
return -ENODEV;
509509

510510
np = of_find_matching_node(fw_np, s10_of_match);
511-
if (!np) {
512-
of_node_put(fw_np);
511+
if (!np)
513512
return -ENODEV;
514-
}
515513

516514
of_node_put(np);
517515
ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
518-
of_node_put(fw_np);
519516
if (ret)
520517
return ret;
521518

‎drivers/misc/mei/client.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
401401
struct mei_cl_cb *cb, *next;
402402

403403
list_for_each_entry_safe(cb, next, head, list) {
404-
if (cl == cb->cl)
404+
if (cl == cb->cl) {
405405
list_del_init(&cb->list);
406+
if (cb->fop_type == MEI_FOP_READ)
407+
mei_io_cb_free(cb);
408+
}
406409
}
407410
}
408411

‎drivers/misc/mei/hw-me-regs.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,8 @@
139139
#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
140140
#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
141141

142+
#define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
143+
142144
/*
143145
* MEI HW Section
144146
*/

‎drivers/misc/mei/pci-me.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
105105
{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
106106
{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
107107

108+
{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
109+
108110
/* required last entry */
109111
{0, }
110112
};

‎drivers/misc/mic/vop/vop_main.c

Lines changed: 43 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,8 @@
4747
* @dc: Virtio device control
4848
* @vpdev: VOP device which is the parent for this virtio device
4949
* @vr: Buffer for accessing the VRING
50-
* @used: Buffer for used
50+
* @used_virt: Virtual address of used ring
51+
* @used: DMA address of used ring
5152
* @used_size: Size of the used buffer
5253
* @reset_done: Track whether VOP reset is complete
5354
* @virtio_cookie: Cookie returned upon requesting a interrupt
@@ -61,6 +62,7 @@ struct _vop_vdev {
6162
struct mic_device_ctrl __iomem *dc;
6263
struct vop_device *vpdev;
6364
void __iomem *vr[VOP_MAX_VRINGS];
65+
void *used_virt[VOP_MAX_VRINGS];
6466
dma_addr_t used[VOP_MAX_VRINGS];
6567
int used_size[VOP_MAX_VRINGS];
6668
struct completion reset_done;
@@ -260,12 +262,12 @@ static bool vop_notify(struct virtqueue *vq)
260262
static void vop_del_vq(struct virtqueue *vq, int n)
261263
{
262264
struct _vop_vdev *vdev = to_vopvdev(vq->vdev);
263-
struct vring *vr = (struct vring *)(vq + 1);
264265
struct vop_device *vpdev = vdev->vpdev;
265266

266267
dma_unmap_single(&vpdev->dev, vdev->used[n],
267268
vdev->used_size[n], DMA_BIDIRECTIONAL);
268-
free_pages((unsigned long)vr->used, get_order(vdev->used_size[n]));
269+
free_pages((unsigned long)vdev->used_virt[n],
270+
get_order(vdev->used_size[n]));
269271
vring_del_virtqueue(vq);
270272
vpdev->hw_ops->iounmap(vpdev, vdev->vr[n]);
271273
vdev->vr[n] = NULL;
@@ -283,6 +285,26 @@ static void vop_del_vqs(struct virtio_device *dev)
283285
vop_del_vq(vq, idx++);
284286
}
285287

288+
static struct virtqueue *vop_new_virtqueue(unsigned int index,
289+
unsigned int num,
290+
struct virtio_device *vdev,
291+
bool context,
292+
void *pages,
293+
bool (*notify)(struct virtqueue *vq),
294+
void (*callback)(struct virtqueue *vq),
295+
const char *name,
296+
void *used)
297+
{
298+
bool weak_barriers = false;
299+
struct vring vring;
300+
301+
vring_init(&vring, num, pages, MIC_VIRTIO_RING_ALIGN);
302+
vring.used = used;
303+
304+
return __vring_new_virtqueue(index, vring, vdev, weak_barriers, context,
305+
notify, callback, name);
306+
}
307+
286308
/*
287309
* This routine will assign vring's allocated in host/io memory. Code in
288310
* virtio_ring.c however continues to access this io memory as if it were local
@@ -302,7 +324,6 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
302324
struct _mic_vring_info __iomem *info;
303325
void *used;
304326
int vr_size, _vr_size, err, magic;
305-
struct vring *vr;
306327
u8 type = ioread8(&vdev->desc->type);
307328

308329
if (index >= ioread8(&vdev->desc->num_vq))
@@ -322,17 +343,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
322343
return ERR_PTR(-ENOMEM);
323344
vdev->vr[index] = va;
324345
memset_io(va, 0x0, _vr_size);
325-
vq = vring_new_virtqueue(
326-
index,
327-
le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN,
328-
dev,
329-
false,
330-
ctx,
331-
(void __force *)va, vop_notify, callback, name);
332-
if (!vq) {
333-
err = -ENOMEM;
334-
goto unmap;
335-
}
346+
336347
info = va + _vr_size;
337348
magic = ioread32(&info->magic);
338349

@@ -341,45 +352,45 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
341352
goto unmap;
342353
}
343354

344-
/* Allocate and reassign used ring now */
345355
vdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
346356
sizeof(struct vring_used_elem) *
347357
le16_to_cpu(config.num));
348358
used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
349359
get_order(vdev->used_size[index]));
360+
vdev->used_virt[index] = used;
350361
if (!used) {
351362
err = -ENOMEM;
352363
dev_err(_vop_dev(vdev), "%s %d err %d\n",
353364
__func__, __LINE__, err);
354-
goto del_vq;
365+
goto unmap;
366+
}
367+
368+
vq = vop_new_virtqueue(index, le16_to_cpu(config.num), dev, ctx,
369+
(void __force *)va, vop_notify, callback,
370+
name, used);
371+
if (!vq) {
372+
err = -ENOMEM;
373+
goto free_used;
355374
}
375+
356376
vdev->used[index] = dma_map_single(&vpdev->dev, used,
357377
vdev->used_size[index],
358378
DMA_BIDIRECTIONAL);
359379
if (dma_mapping_error(&vpdev->dev, vdev->used[index])) {
360380
err = -ENOMEM;
361381
dev_err(_vop_dev(vdev), "%s %d err %d\n",
362382
__func__, __LINE__, err);
363-
goto free_used;
383+
goto del_vq;
364384
}
365385
writeq(vdev->used[index], &vqconfig->used_address);
366-
/*
367-
* To reassign the used ring here we are directly accessing
368-
* struct vring_virtqueue which is a private data structure
369-
* in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
370-
* vring_new_virtqueue() would ensure that
371-
* (&vq->vring == (struct vring *) (&vq->vq + 1));
372-
*/
373-
vr = (struct vring *)(vq + 1);
374-
vr->used = used;
375386

376387
vq->priv = vdev;
377388
return vq;
389+
del_vq:
390+
vring_del_virtqueue(vq);
378391
free_used:
379392
free_pages((unsigned long)used,
380393
get_order(vdev->used_size[index]));
381-
del_vq:
382-
vring_del_virtqueue(vq);
383394
unmap:
384395
vpdev->hw_ops->iounmap(vpdev, vdev->vr[index]);
385396
return ERR_PTR(err);
@@ -581,6 +592,8 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
581592
int ret = -1;
582593

583594
if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
595+
struct device *dev = get_device(&vdev->vdev.dev);
596+
584597
dev_dbg(&vpdev->dev,
585598
"%s %d config_change %d type %d vdev %p\n",
586599
__func__, __LINE__,
@@ -592,7 +605,7 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
592605
iowrite8(-1, &dc->h2c_vdev_db);
593606
if (status & VIRTIO_CONFIG_S_DRIVER_OK)
594607
wait_for_completion(&vdev->reset_done);
595-
put_device(&vdev->vdev.dev);
608+
put_device(dev);
596609
iowrite8(1, &dc->guest_ack);
597610
dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
598611
__func__, __LINE__, ioread8(&dc->guest_ack));

‎samples/mei/mei-amt-version.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ static bool mei_init(struct mei *me, const uuid_le *guid,
117117

118118
me->verbose = verbose;
119119

120-
me->fd = open("/dev/mei", O_RDWR);
120+
me->fd = open("/dev/mei0", O_RDWR);
121121
if (me->fd == -1) {
122122
mei_err(me, "Cannot establish a handle to the Intel MEI driver\n");
123123
goto err;

‎tools/testing/selftests/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ TARGETS += drivers/dma-buf
1010
TARGETS += efivarfs
1111
TARGETS += exec
1212
TARGETS += filesystems
13+
TARGETS += filesystems/binderfs
1314
TARGETS += firmware
1415
TARGETS += ftrace
1516
TARGETS += futex

‎tools/testing/selftests/filesystems/binderfs/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
binderfs_test

‎tools/testing/selftests/filesystems/binderfs/Makefile

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# SPDX-License-Identifier: GPL-2.0
2+
3+
CFLAGS += -I../../../../../usr/include/
4+
TEST_GEN_PROGS := binderfs_test
5+
6+
include ../../lib.mk

0 commit comments

Comments
 (0)