kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'pci/hotplug'

Browse source 
- fix possible cpqphp NULL pointer dereference (Shawn Lin)

  - rescan more of the hierarchy on ACPI hotplug to fix Thunderbolt/xHCI
    hotplug (Mika Westerberg)

* pci/hotplug:
  ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
  PCI: cpqphp: Fix possible NULL pointer dereference
This commit is contained in:
Bjorn Helgaas 2018-04-04 13:27:42 -05:00 committed by Bjorn Helgaas
commit a5c6ad7840
2 changed files with 21 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
drivers/pci/hotplug/acpiphp_glue.c
View file

@ -541,6 +541,7 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot)
{
unsigned long long sta = 0;
struct acpiphp_func *func;
u32 dvid;
list_for_each_entry(func, &slot->funcs, sibling) {
if (func->flags & FUNC_HAS_STA) {
@ -551,19 +552,27 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot)
if (ACPI_SUCCESS(status) && sta)
break;
} else {
u32 dvid;
pci_bus_read_config_dword(slot->bus,
PCI_DEVFN(slot->device,
func->function),
PCI_VENDOR_ID, &dvid);
if (dvid != 0xffffffff) {
if (pci_bus_read_dev_vendor_id(slot->bus,
PCI_DEVFN(slot->device, func->function),
&dvid, 0)) {
sta = ACPI_STA_ALL;
break;
}
}
}
if (!sta) {
/*
* Check for the slot itself since it may be that the
* ACPI slot is a device below PCIe upstream port so in
* that case it may not even be reachable yet.
*/
if (pci_bus_read_dev_vendor_id(slot->bus,
PCI_DEVFN(slot->device, 0), &dvid, 0)) {
sta = ACPI_STA_ALL;
}
}
return (unsigned int)sta;
}

6
drivers/pci/hotplug/cpqphp_ctrl.c
View file

@ -2812,18 +2812,16 @@ static int configure_new_function(struct controller *ctrl, struct pci_func *func
dbg("CND: length = 0x%x\n", base);
io_node = get_io_resource(&(resources->io_head), base);
if (!io_node)
return -ENOMEM;
dbg("Got io_node start = %8.8x, length = %8.8x next (%p)\n",
io_node->base, io_node->length, io_node->next);
dbg("func (%p) io_head (%p)\n", func, func->io_head);
/* allocate the resource to the board */
if (io_node) {
base = io_node->base;
io_node->next = func->io_head;
func->io_head = io_node;
} else
return -ENOMEM;
} else if ((temp_register & 0x0BL) == 0x08) {
/* Map prefetchable memory */
base = temp_register & 0xFFFFFFF0;