linux-stable.git/drivers/misc/mic, branch linux-3.13.y

misc: mic: fix possible signed underflow (undefined behavior) in userspace API

2014-02-22T21:34:57+00:00

commit 3b1cc9b9622a022208ec95b1259b05bbdf712eb7 upstream.

iovcnt is declared as a signed integer in both the userspace API and
as a local variable in mic_virtio.c. The while() loop in mic_virtio.c
iterates until the local variable iovcnt reaches the value 0. If
userspace passes e.g. INT_MIN as iovcnt field, this loop then appears
to depend on an undefined behavior (signed underflow) to complete.
The fix is to use unsigned integers in both the userspace API and
the local variable.

This issue was reported @ https://lkml.org/lkml/2014/1/10/10

Reported-by: Mathieu Desnoyers 
Reviewed-by: Ashutosh Dixit 
Signed-off-by: Sudeep Dutt 
Signed-off-by: Greg Kroah-Hartman

misc: mic: bug fix for interrupt acknowledgement in MSI/INTx case.

2014-02-06T19:34:01+00:00

commit df5e4e8b576108f88f79e5b4c984d51d460d2360 upstream.

The interrupt handler (mic_interrupt), called in the MSI/INTx mode,
writes to the interrupt sources register to acknowledge the
interrupt and then calls the corresponding callback handlers to handle
the same. These callback handlers acknowledge the interrupts again
leading to missed interrupts. This patch fixes the issue by removing
the interrupt acknowlegment code from the callback handlers.

Reviewed-by: Sudeep Dutt 
Reviewed-by: Nikhil Rao 
Reviewed-by: Siva Krishna Kumar Reddy Yerramreddy 
Signed-off-by: Dasaratharaman Chandramouli 
Signed-off-by: Greg Kroah-Hartman

misc: mic: Suppress memory space sparse warnings

2013-11-27T19:08:30+00:00

MIC card and host drivers are able to use virtio over the PCIe bus by
treating ioremap return values for the prefetchable BARs as pointers,
effectively treating I/O memory the same as system memory. However this
results in sparse warnings. Knowing that these warnings do not point to
a functional issue, this patch suppresses these warnings.

Reported-by: Fengguang Wu 
Reviewed-by: Sudeep Dutt 
Signed-off-by: Nikhil Rao 
Signed-off-by: Ashutosh Dixit 
Signed-off-by: Greg Kroah-Hartman

misc: mic: Fix endianness issues.

2013-11-27T19:03:38+00:00

Endianness issues are now consistent as per the documentation in
host/mic_virtio.h. Sparse warnings related to endianness are also fixed.
Note that the MIC driver implementation assumes that the host can be
both BE or LE whereas the card is always LE.

Reported-by: Fengguang Wu 
Reviewed-by: Sudeep Dutt 
Reviewed-by: Nikhil Rao 
Signed-off-by: Ashutosh Dixit 
Signed-off-by: Greg Kroah-Hartman

misc: mic: Fix user space namespace pollution from mic_common.h.

2013-11-27T19:03:38+00:00

Avoid declaring ALIGN() and __aligned() in
include/uapi/linux/mic_common.h since they pollute user space
namespace. Also, mic_aligned_size() can be simply replaced simply by
sizeof() since all structures where mic_aligned_size() is used are
declared using __attribute__ ((aligned(8)));

--
>From mail from H Peter Anvin about this:

On Fri, Nov 08, 2013 H Peter Anvin  wrote:
Subject: Namespace pollution in mic_common.h

This puts two macros, ALIGN() and __aligned(), into arbitrary user space
namespace.  This really isn't safe or acceptable, especially since those
symbols are highly generic.
...
When these structures are forced-aligned, they will in fact have padding
automatically added by the compiler to an 8-byte boundary anyway, so
mic_aligned_size() does nothing.
...

Reported-by: H Peter Anvin 
Reviewed-by: Sudeep Dutt 
Signed-off-by: Nikhil Rao 
Signed-off-by: Ashutosh Dixit 
Signed-off-by: Greg Kroah-Hartman

misc: mic: Minor bug fix in 'retry' loops.

2013-11-27T19:03:38+00:00

The bug would result in incorrect 'retry' value being printed in debug
statements as well as dead code in mic_find_vqs(...) in
drivers/misc/mic/card/mic_virtio.c.

Reported-by: Michael Opdenacker 
Reviewed-by: Ashutosh Dixit 
Signed-off-by: Sudeep Dutt 
Signed-off-by: Greg Kroah-Hartman

misc: mic: Change mic_notify(...) to return true.

2013-11-27T19:02:39+00:00

virtqueue_{kick()/notify()} methods are required to return bool due to
API changes introduced in commit 5b1bf7cb673a.

Reported-by: Fengguang Wu 
Reported-by: Geert Uytterhoeven 
Reviewed-by: Ashutosh Dixit 
Signed-off-by: Sudeep Dutt 
Signed-off-by: Greg Kroah-Hartman

tree-wide: use reinit_completion instead of INIT_COMPLETION

2013-11-15T00:32:21+00:00

Use this new function to make code more comprehensible, since we are
reinitialzing the completion, not initializing.

[akpm@linux-foundation.org: linux-next resyncs]
Signed-off-by: Wolfram Sang 
Acked-by: Linus Walleij  (personally at LCE13)
Cc: Ingo Molnar 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Merge tag 'driver-core-3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2013-11-07T02:42:15+00:00

Pull driver core / sysfs patches from Greg KH:
 "Here's the big driver core / sysfs update for 3.13-rc1.

  There's lots of dev_groups updates for different subsystems, as they
  all get slowly migrated over to the safe versions of the attribute
  groups (removing userspace races with the creation of the sysfs
  files.) Also in here are some kobject updates, devres expansions, and
  the first round of Tejun's sysfs reworking to enable it to be used by
  other subsystems as a backend for an in-kernel filesystem.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'driver-core-3.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (83 commits)
  sysfs: rename sysfs_assoc_lock and explain what it's about
  sysfs: use generic_file_llseek() for sysfs_file_operations
  sysfs: return correct error code on unimplemented mmap()
  mdio_bus: convert bus code to use dev_groups
  device: Make dev_WARN/dev_WARN_ONCE print device as well as driver name
  sysfs: separate out dup filename warning into a separate function
  sysfs: move sysfs_hash_and_remove() to fs/sysfs/dir.c
  sysfs: remove unused sysfs_get_dentry() prototype
  sysfs: honor bin_attr.attr.ignore_lockdep
  sysfs: merge sysfs_elem_bin_attr into sysfs_elem_attr
  devres: restore zeroing behavior of devres_alloc()
  sysfs: fix sysfs_write_file for bin file
  input: gameport: convert bus code to use dev_groups
  input: serio: remove bus usage of dev_attrs
  input: serio: use DEVICE_ATTR_RO()
  i2o: convert bus code to use dev_groups
  memstick: convert bus code to use dev_groups
  tifm: convert bus code to use dev_groups
  virtio: convert bus code to use dev_groups
  ipack: convert bus code to use dev_groups
  ...

misc: mic: Fixes for randconfig build errors and warnings.

2013-10-30T17:19:30+00:00

This patch fixes the build errors and warnings reported at
https://lkml.org/lkml/2013/10/29/421.

Co-author: Dasaratharaman Chandramouli 
Reviewed-by: Sudeep Dutt 
Reported-by: Jim Davis 
Signed-off-by: Ashutosh Dixit 
Signed-off-by: Greg Kroah-Hartman