Unverified Commit 0c558928 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5773 patches for CVE-2023-52617 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiongfeng Wang <wangxiongfeng2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FC7NOS2Q3ZTDYOKBKU6UUWRRV3VO2KLZ/ 
Christophe JAILLET (1):
  PCI: switchtec: Fix an error handling path in switchtec_pci_probe()

Daniel Stodden (1):
  PCI: switchtec: Fix stdev_release() crash after surprise hot remove


-- 
2.20.1
 
https://gitee.com/src-openeuler/kernel/issues/I99JXH 
 
Link:https://gitee.com/openeuler/kernel/pulls/5773

 

Reviewed-by: default avatarWei Li <liwei391@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents aea60db4 6bf196a0

drivers/pci/switch/switchtec.c

+20 −9
Original line number Diff line number Diff line
@@ -1251,13 +1251,6 @@ static void stdev_release(struct device *dev) 
{

	struct switchtec_dev *stdev = to_stdev(dev);



	if (stdev->dma_mrpc) {

		iowrite32(0, &stdev->mmio_mrpc->dma_en);

		flush_wc_buf(stdev);

		writeq(0, &stdev->mmio_mrpc->dma_addr);

		dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc),

				stdev->dma_mrpc, stdev->dma_mrpc_dma_addr);

	}

	kfree(stdev);

}
@@ -1301,7 +1294,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev) 
		return ERR_PTR(-ENOMEM);



	stdev->alive = true;

	stdev->pdev = pdev;

	stdev->pdev = pci_dev_get(pdev);

	INIT_LIST_HEAD(&stdev->mrpc_queue);

	mutex_init(&stdev->mrpc_mutex);

	stdev->mrpc_busy = 0;
@@ -1335,6 +1328,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev) 
	return stdev;



err_put:

	pci_dev_put(stdev->pdev);

	put_device(&stdev->dev);

	return ERR_PTR(rc);

}
@@ -1587,6 +1581,18 @@ static int switchtec_init_pci(struct switchtec_dev *stdev, 
	return 0;

}



static void switchtec_exit_pci(struct switchtec_dev *stdev)

{

	if (stdev->dma_mrpc) {

		iowrite32(0, &stdev->mmio_mrpc->dma_en);

		flush_wc_buf(stdev);

		writeq(0, &stdev->mmio_mrpc->dma_addr);

		dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc),

				  stdev->dma_mrpc, stdev->dma_mrpc_dma_addr);

		stdev->dma_mrpc = NULL;

	}

}



static int switchtec_pci_probe(struct pci_dev *pdev,

			       const struct pci_device_id *id)

{
@@ -1609,7 +1615,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev, 
	rc = switchtec_init_isr(stdev);

	if (rc) {

		dev_err(&stdev->dev, "failed to init isr.\n");

		goto err_put;

		goto err_exit_pci;

	}



	iowrite32(SWITCHTEC_EVENT_CLEAR |
@@ -1630,6 +1636,8 @@ static int switchtec_pci_probe(struct pci_dev *pdev, 


err_devadd:

	stdev_kill(stdev);

err_exit_pci:

	switchtec_exit_pci(stdev);

err_put:

	ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));

	put_device(&stdev->dev);
@@ -1646,6 +1654,9 @@ static void switchtec_pci_remove(struct pci_dev *pdev) 
	ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));

	dev_info(&stdev->dev, "unregistered.\n");

	stdev_kill(stdev);

	switchtec_exit_pci(stdev);

	pci_dev_put(stdev->pdev);

	stdev->pdev = NULL;

	put_device(&stdev->dev);

}