Merge tag 'char-misc-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH: "Here are 4 patches to resolve some char/misc driver issues found these past weeks. One of them is a mei bugfix and another is a new mei device id. There is also a hyper-v fix for a reported issue, and a binder issue fix for a problem reported by a few people. All of these have been in my tree for a while, I don't know if linux-next is really testing much this month. But 0-day is happy with them :)" * tag 'char-misc-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binder: fix use-after-free in binder_transaction() Drivers: hv: vmbus: Fix bugs in rescind handling mei: me: add gemini lake devices id mei: always use domain runtime pm callbacks.

Linus Torvalds committed 9 years ago

Commit ae7df8f2 parents 7a263b1 512cf468 files · +115 −81Browse files

Unified · Split

8 files

drivers/android/binder.c +66 −27
drivers/hv/channel.c +3 −3
drivers/hv/channel_mgmt.c +18 −19
drivers/hv/vmbus_drv.c +1 −2
drivers/misc/mei/hw-me-regs.h +2 −0
drivers/misc/mei/pci-me.c +13 −10
drivers/misc/mei/pci-txe.c +11 −19
include/linux/hyperv.h +1 −1

drivers/android/binder.c+66−27

 	return true;
 }
+/**
+ * binder_get_node_refs_for_txn() - Get required refs on node for txn
+ * @node:         struct binder_node for which to get refs
+ * @proc:         returns @node->proc if valid
+ * @error:        if no @proc then returns BR_DEAD_REPLY
+ *
+ * User-space normally keeps the node alive when creating a transaction
+ * since it has a reference to the target. The local strong ref keeps it
+ * alive if the sending process dies before the target process processes
+ * the transaction. If the source process is malicious or has a reference
+ * counting bug, relying on the local strong ref can fail.
+ *
+ * Since user-space can cause the local strong ref to go away, we also take
+ * a tmpref on the node to ensure it survives while we are constructing
+ * the transaction. We also need a tmpref on the proc while we are
+ * constructing the transaction, so we take that here as well.
+ *
+ * Return: The target_node with refs taken or NULL if no @node->proc is NULL.
+ * Also sets @proc if valid. If the @node->proc is NULL indicating that the
+ * target proc has died, @error is set to BR_DEAD_REPLY
+ */
+static struct binder_node *binder_get_node_refs_for_txn(
+		struct binder_node *node,
+		struct binder_proc **procp,
+		uint32_t *error)
+{
+	struct binder_node *target_node = NULL;
+	binder_node_inner_lock(node);
+	if (node->proc) {
+		target_node = node;
+		binder_inc_node_nilocked(node, 1, 0, NULL);
+		binder_inc_node_tmpref_ilocked(node);
+		node->proc->tmp_ref++;
+		*procp = node->proc;
+	} else
+		*error = BR_DEAD_REPLY;
+	binder_node_inner_unlock(node);
+	return target_node;
+}
 static void binder_transaction(struct binder_proc *proc,
 			       struct binder_thread *thread,
 			       struct binder_transaction_data *tr, int reply,
 			ref = binder_get_ref_olocked(proc, tr->target.handle,
 						     true);
 			if (ref) {
-				binder_inc_node(ref->node, 1, 0, NULL);
+				target_node = binder_get_node_refs_for_txn(
-				target_node = ref->node;
+						ref->node, &target_proc,
-			}
+						&return_error);
-			binder_proc_unlock(proc);
+			} else {
-			if (target_node == NULL) {
 				binder_user_error("%d:%d got transaction to invalid handle\n",
-					proc->pid, thread->pid);
+						  proc->pid, thread->pid);
 				return_error = BR_FAILED_REPLY;
-				return_error_param = -EINVAL;
-				return_error_line = __LINE__;
-				goto err_invalid_target_handle;
 			}
+			binder_proc_unlock(proc);
 		} else {
 			mutex_lock(&context->context_mgr_node_lock);
 			target_node = context->binder_context_mgr_node;
-			if (target_node == NULL) {
+			if (target_node)
+				target_node = binder_get_node_refs_for_txn(
+						target_node, &target_proc,
+						&return_error);
+			else
 				return_error = BR_DEAD_REPLY;
-				mutex_unlock(&context->context_mgr_node_lock);
-				return_error_line = __LINE__;
-				goto err_no_context_mgr_node;
-			}
-			binder_inc_node(target_node, 1, 0, NULL);
 			mutex_unlock(&context->context_mgr_node_lock);
 		}
-		e->to_node = target_node->debug_id;
+		if (!target_node) {
-		binder_node_lock(target_node);
+			/*
-		target_proc = target_node->proc;
+			 * return_error is set above
-		if (target_proc == NULL) {
+			 */
-			binder_node_unlock(target_node);
+			return_error_param = -EINVAL;
-			return_error = BR_DEAD_REPLY;
 			return_error_line = __LINE__;
 			goto err_dead_binder;
 		}
-		binder_inner_proc_lock(target_proc);
+		e->to_node = target_node->debug_id;
-		target_proc->tmp_ref++;
-		binder_inner_proc_unlock(target_proc);
-		binder_node_unlock(target_node);
 		if (security_binder_transaction(proc->tsk,
 						target_proc->tsk) < 0) {
 			return_error = BR_FAILED_REPLY;
 	if (target_thread)
 		binder_thread_dec_tmpref(target_thread);
 	binder_proc_dec_tmpref(target_proc);
+	if (target_node)
+		binder_dec_node_tmpref(target_node);
 	/*
 	 * write barrier to synchronize with initialization
 	 * of log entry
 err_copy_data_failed:
 	trace_binder_transaction_failed_buffer_release(t->buffer);
 	binder_transaction_buffer_release(target_proc, t->buffer, offp);
+	if (target_node)
+		binder_dec_node_tmpref(target_node);
 	target_node = NULL;
 	t->buffer->transaction = NULL;
 	binder_alloc_free_buf(&target_proc->alloc, t->buffer);
 err_empty_call_stack:
 err_dead_binder:
 err_invalid_target_handle:
-err_no_context_mgr_node:
 	if (target_thread)
 		binder_thread_dec_tmpref(target_thread);
 	if (target_proc)
 		binder_proc_dec_tmpref(target_proc);
-	if (target_node)
+	if (target_node) {
 		binder_dec_node(target_node, 1, 0);
+		binder_dec_node_tmpref(target_node);
+	}
 	binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
 		     "%d:%d transaction failed %d/%d, size %lld-%lld line %d\n",

drivers/hv/channel.c+3−3

 		 */
 		return;
 	}
+	mutex_lock(&vmbus_connection.channel_mutex);
 	/*
 	 * Close all the sub-channels first and then close the
 	 * primary channel.
 		cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
 		vmbus_close_internal(cur_channel);
 		if (cur_channel->rescind) {
-			mutex_lock(&vmbus_connection.channel_mutex);
+			hv_process_channel_removal(
-			hv_process_channel_removal(cur_channel,
 					   cur_channel->offermsg.child_relid);
-			mutex_unlock(&vmbus_connection.channel_mutex);
 		}
 	}
 	/*
 	 * Now close the primary.
 	 */
 	vmbus_close_internal(channel);
+	mutex_unlock(&vmbus_connection.channel_mutex);
 }
 EXPORT_SYMBOL_GPL(vmbus_close);

drivers/hv/channel_mgmt.c+18−19

@@ -159,7 +159,7 @@ static void vmbus_rescind_cleanup(struct vmbus_channel *channel) · 158 unmodified lines
159		159
160		160
161	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);	161	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
162		162	channel->rescind = true;
163	list_for_each_entry(msginfo, &vmbus_connection.chn_msg_list,	163	list_for_each_entry(msginfo, &vmbus_connection.chn_msg_list,
164	msglistentry) {	164	msglistentry) {
165		165
@@ -381,14 +381,21 @@ static void vmbus_release_relid(u32 relid) · 215 unmodified lines
381	true);	381	true);
382	}	382	}
383		383
384	void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)	384	void hv_process_channel_removal(u32 relid)
385	{	385	{
386	unsigned long flags;	386	unsigned long flags;
387	struct vmbus_channel *primary_channel;	387	struct vmbus_channel primary_channel, channel;
388		388
389	BUG_ON(!channel->rescind);
390	BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));	389	BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
391		390
		391	/*
		392	* Make sure channel is valid as we may have raced.
		393	*/
		394	channel = relid2channel(relid);
		395	if (!channel)
		396	return;
		397
		398	BUG_ON(!channel->rescind);
392	if (channel->target_cpu != get_cpu()) {	399	if (channel->target_cpu != get_cpu()) {
393	put_cpu();	400	put_cpu();
394	smp_call_function_single(channel->target_cpu,	401	smp_call_function_single(channel->target_cpu,
@@ -515,6 +522,7 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel) · 120 unmodified lines
515	if (!fnew) {	522	if (!fnew) {
516	if (channel->sc_creation_callback != NULL)	523	if (channel->sc_creation_callback != NULL)
517	channel->sc_creation_callback(newchannel);	524	channel->sc_creation_callback(newchannel);
		525	newchannel->probe_done = true;
518	return;	526	return;
519	}	527	}
520		528
@@ -834,7 +842,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) · 313 unmodified lines
834	{	842	{
835	struct vmbus_channel_rescind_offer *rescind;	843	struct vmbus_channel_rescind_offer *rescind;
836	struct vmbus_channel *channel;	844	struct vmbus_channel *channel;
837	unsigned long flags;
838	struct device *dev;	845	struct device *dev;
839		846
840	rescind = (struct vmbus_channel_rescind_offer *)hdr;	847	rescind = (struct vmbus_channel_rescind_offer *)hdr;
@@ -873,16 +880,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) · 32 unmodified lines
873	return;	880	return;
874	}	881	}
875		882
876	spin_lock_irqsave(&channel->lock, flags);
877	channel->rescind = true;
878	spin_unlock_irqrestore(&channel->lock, flags);
879
880	/*
881	* Now that we have posted the rescind state, perform
882	* rescind related cleanup.
883	*/
884	vmbus_rescind_cleanup(channel);
885
886	/*	883	/*
887	* Now wait for offer handling to complete.	884	* Now wait for offer handling to complete.
888	*/	885	*/
@@ -901,6 +898,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) · 12 unmodified lines
901	if (channel->device_obj) {	898	if (channel->device_obj) {
902	if (channel->chn_rescind_callback) {	899	if (channel->chn_rescind_callback) {
903	channel->chn_rescind_callback(channel);	900	channel->chn_rescind_callback(channel);
		901	vmbus_rescind_cleanup(channel);
904	return;	902	return;
905	}	903	}
906	/*	904	/*
@@ -909,6 +907,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) · 2 unmodified lines
909	*/	907	*/
910	dev = get_device(&channel->device_obj->device);	908	dev = get_device(&channel->device_obj->device);
911	if (dev) {	909	if (dev) {
		910	vmbus_rescind_cleanup(channel);
912	vmbus_device_unregister(channel->device_obj);	911	vmbus_device_unregister(channel->device_obj);
913	put_device(dev);	912	put_device(dev);
914	}	913	}
@@ -921,16 +920,16 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) · 6 unmodified lines
921	* 1. Close all sub-channels first	920	* 1. Close all sub-channels first
922	* 2. Then close the primary channel.	921	* 2. Then close the primary channel.
923	*/	922	*/
		923	mutex_lock(&vmbus_connection.channel_mutex);
		924	vmbus_rescind_cleanup(channel);
924	if (channel->state == CHANNEL_OPEN_STATE) {	925	if (channel->state == CHANNEL_OPEN_STATE) {
925	/*	926	/*
926	* The channel is currently not open;	927	* The channel is currently not open;
927	* it is safe for us to cleanup the channel.	928	* it is safe for us to cleanup the channel.
928	*/	929	*/
929	mutex_lock(&vmbus_connection.channel_mutex);	930	hv_process_channel_removal(rescind->child_relid);
930	hv_process_channel_removal(channel,
931	channel->offermsg.child_relid);
932	mutex_unlock(&vmbus_connection.channel_mutex);
933	}	931	}
		932	mutex_unlock(&vmbus_connection.channel_mutex);
934	}	933	}
935	}	934	}
936		935

drivers/hv/vmbus_drv.c+1−2

@@ -768,8 +768,7 @@ static void vmbus_device_release(struct device *device) · 767 unmodified lines
768	struct vmbus_channel *channel = hv_dev->channel;	768	struct vmbus_channel *channel = hv_dev->channel;
769		769
770	mutex_lock(&vmbus_connection.channel_mutex);	770	mutex_lock(&vmbus_connection.channel_mutex);
771	hv_process_channel_removal(channel,	771	hv_process_channel_removal(channel->offermsg.child_relid);
772	channel->offermsg.child_relid);
773	mutex_unlock(&vmbus_connection.channel_mutex);	772	mutex_unlock(&vmbus_connection.channel_mutex);
774	kfree(hv_dev);	773	kfree(hv_dev);
775		774

drivers/misc/mei/hw-me-regs.h+2−0

@@ -127,6 +127,8 @@ · 126 unmodified lines
127	#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */	127	#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
128	#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */	128	#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
129		129
		130	#define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */
		131
130	#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */	132	#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
131	#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */	133	#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
132		134

drivers/misc/mei/pci-me.c+13−10

 	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
 	pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 	/*
-	* For not wake-able HW runtime pm framework
+	 * ME maps runtime suspend/resume to D0i states,
-	* can't be used on pci device level.
+	 * hence we need to go around native PCI runtime service which
-	* Use domain runtime pm callbacks instead.
+	 * eventually brings the device into D3cold/hot state,
-	*/
+	 * but the mei device cannot wake up from D3 unlike from D0i3.
-	if (!pci_dev_run_wake(pdev))
+	 * To get around the PCI device native runtime pm,
-		mei_me_set_pm_domain(dev);
+	 * ME uses runtime pm domain handlers which take precedence
+	 * over the driver's pm handlers.
+	 */
+	mei_me_set_pm_domain(dev);
 	if (mei_pg_is_enabled(dev))
 		pm_runtime_put_noidle(&pdev->dev);
 	dev_dbg(&pdev->dev, "shutdown\n");
 	mei_stop(dev);
-	if (!pci_dev_run_wake(pdev))
+	mei_me_unset_pm_domain(dev);
-		mei_me_unset_pm_domain(dev);
 	mei_disable_interrupts(dev);
 	free_irq(pdev->irq, dev);
 	dev_dbg(&pdev->dev, "stop\n");
 	mei_stop(dev);
-	if (!pci_dev_run_wake(pdev))
+	mei_me_unset_pm_domain(dev);
-		mei_me_unset_pm_domain(dev);
 	mei_disable_interrupts(dev);

drivers/misc/mei/pci-txe.c+11−19

 	pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 	/*
-	* For not wake-able HW runtime pm framework
+	 * TXE maps runtime suspend/resume to own power gating states,
-	* can't be used on pci device level.
+	 * hence we need to go around native PCI runtime service which
-	* Use domain runtime pm callbacks instead.
+	 * eventually brings the device into D3cold/hot state.
-	*/
+	 * But the TXE device cannot wake up from D3 unlike from own
-	if (!pci_dev_run_wake(pdev))
+	 * power gating. To get around PCI device native runtime pm,
-		mei_txe_set_pm_domain(dev);
+	 * TXE uses runtime pm domain handlers which take precedence.
+	 */
+	mei_txe_set_pm_domain(dev);
 	pm_runtime_put_noidle(&pdev->dev);
 	dev_dbg(&pdev->dev, "shutdown\n");
 	mei_stop(dev);
-	if (!pci_dev_run_wake(pdev))
+	mei_txe_unset_pm_domain(dev);
-		mei_txe_unset_pm_domain(dev);
 	mei_disable_interrupts(dev);
 	free_irq(pdev->irq, dev);
 	mei_stop(dev);
-	if (!pci_dev_run_wake(pdev))
+	mei_txe_unset_pm_domain(dev);
-		mei_txe_unset_pm_domain(dev);
 	mei_disable_interrupts(dev);
 	free_irq(pdev->irq, dev);
 	else
 		ret = -EAGAIN;
-	/*
+	/* keep irq on we are staying in D0 */
-	 * If everything is okay we're about to enter PCI low
-	 * power state (D3) therefor we need to disable the
-	 * interrupts towards host.
-	 * However if device is not wakeable we do not enter
-	 * D-low state and we need to keep the interrupt kicking
-	 */
-	if (!ret && pci_dev_run_wake(pdev))
-		mei_disable_interrupts(dev);
 	dev_dbg(&pdev->dev, "rpm: txe: runtime suspend ret=%d\n", ret);

include/linux/hyperv.h+1−1

@@ -1403,7 +1403,7 @@ extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr icmsghdrp, u8 buf, · 1402 unmodified lines
1403	const int *srv_version, int srv_vercnt,	1403	const int *srv_version, int srv_vercnt,
1404	int nego_fw_version, int nego_srv_version);	1404	int nego_fw_version, int nego_srv_version);
1405		1405
1406	void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);	1406	void hv_process_channel_removal(u32 relid);
1407		1407
1408	void vmbus_setevent(struct vmbus_channel *channel);	1408	void vmbus_setevent(struct vmbus_channel *channel);
1409	/*	1409	/*

Merge tag 'char-misc-4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code