<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/ntb/hw, branch for-next</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>ntb: idt: Replace deprecated PCI functions</title>
<updated>2024-10-30T21:07:38+00:00</updated>
<author>
<name>Philipp Stanner</name>
<email>pstanner@redhat.com</email>
</author>
<published>2024-10-30T11:27:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=5915997a8eb4b8a8e8aa3b0fe6cb85265822c2ba'/>
<id>5915997a8eb4b8a8e8aa3b0fe6cb85265822c2ba</id>
<content type='text'>
pcim_iomap_table() and pcim_iomap_regions_request_all() have been
deprecated by the PCI subsystem in commit e354bb84a4c1 ("PCI: Deprecate
pcim_iomap_table(), pcim_iomap_regions_request_all()").

Replace these functions with their successors, pcim_iomap() and
pcim_request_all_regions().

Link: https://lore.kernel.org/r/20241030112743.104395-8-pstanner@redhat.com
Signed-off-by: Philipp Stanner &lt;pstanner@redhat.com&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Acked-by: Serge Semin &lt;fancer.lancer@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
pcim_iomap_table() and pcim_iomap_regions_request_all() have been
deprecated by the PCI subsystem in commit e354bb84a4c1 ("PCI: Deprecate
pcim_iomap_table(), pcim_iomap_regions_request_all()").

Replace these functions with their successors, pcim_iomap() and
pcim_request_all_regions().

Link: https://lore.kernel.org/r/20241030112743.104395-8-pstanner@redhat.com
Signed-off-by: Philipp Stanner &lt;pstanner@redhat.com&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Acked-by: Serge Semin &lt;fancer.lancer@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition</title>
<updated>2024-09-20T14:50:38+00:00</updated>
<author>
<name>Kaixin Wang</name>
<email>kxwang23@m.fudan.edu.cn</email>
</author>
<published>2024-09-09T17:20:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e51aded92d42784313ba16c12f4f88cc4f973bbb'/>
<id>e51aded92d42784313ba16c12f4f88cc4f973bbb</id>
<content type='text'>
In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev
function, then &amp;sndev-&gt;check_link_status_work is bound with
check_link_status_work. switchtec_ntb_link_notification may be called
to start the work.

If we remove the module which will call switchtec_ntb_remove to make
cleanup, it will free sndev through kfree(sndev), while the work
mentioned above will be used. The sequence of operations that may lead
to a UAF bug is as follows:

CPU0                                 CPU1

                        | check_link_status_work
switchtec_ntb_remove    |
kfree(sndev);           |
                        | if (sndev-&gt;link_force_down)
                        | // use sndev

Fix it by ensuring that the work is canceled before proceeding with
the cleanup in switchtec_ntb_remove.

Signed-off-by: Kaixin Wang &lt;kxwang23@m.fudan.edu.cn&gt;
Reviewed-by: Logan Gunthorpe &lt;logang@deltatee.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev
function, then &amp;sndev-&gt;check_link_status_work is bound with
check_link_status_work. switchtec_ntb_link_notification may be called
to start the work.

If we remove the module which will call switchtec_ntb_remove to make
cleanup, it will free sndev through kfree(sndev), while the work
mentioned above will be used. The sequence of operations that may lead
to a UAF bug is as follows:

CPU0                                 CPU1

                        | check_link_status_work
switchtec_ntb_remove    |
kfree(sndev);           |
                        | if (sndev-&gt;link_force_down)
                        | // use sndev

Fix it by ensuring that the work is canceled before proceeding with
the cleanup in switchtec_ntb_remove.

Signed-off-by: Kaixin Wang &lt;kxwang23@m.fudan.edu.cn&gt;
Reviewed-by: Logan Gunthorpe &lt;logang@deltatee.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: idt: Fix the cacography in ntb_hw_idt.c</title>
<updated>2024-09-20T14:50:38+00:00</updated>
<author>
<name>zhang jiao</name>
<email>zhangjiao2@cmss.chinamobile.com</email>
</author>
<published>2024-09-04T06:54:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=87a7d7150589f68cd7938b208310c93d1e4c3773'/>
<id>87a7d7150589f68cd7938b208310c93d1e4c3773</id>
<content type='text'>
The word 'swtich' is wrong, so fix it.

Signed-off-by: zhang jiao &lt;zhangjiao2@cmss.chinamobile.com&gt;
Acked-by: Serge Semin &lt;fancer.lancer@gmail.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The word 'swtich' is wrong, so fix it.

Signed-off-by: zhang jiao &lt;zhangjiao2@cmss.chinamobile.com&gt;
Acked-by: Serge Semin &lt;fancer.lancer@gmail.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NTB: epf: don't misuse kernel-doc marker</title>
<updated>2024-09-20T14:50:38+00:00</updated>
<author>
<name>Randy Dunlap</name>
<email>rdunlap@infradead.org</email>
</author>
<published>2023-12-06T05:59:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=b669fafd51b454f45fde5b0c6ba228ffa19e859d'/>
<id>b669fafd51b454f45fde5b0c6ba228ffa19e859d</id>
<content type='text'>
Use "/*" instead of "/**" for common C comments to prevent warnings
from scripts/kernel-doc.

ntb_hw_epf.c:15: warning: expecting prototype for Host side endpoint driver to implement Non(). Prototype was for NTB_EPF_COMMAND() instead

Signed-off-by: Randy Dunlap &lt;rdunlap@infradead.org&gt;
Cc: Jon Mason &lt;jdmason@kudzu.us&gt;
Cc: Dave Jiang &lt;dave.jiang@intel.com&gt;
Cc: Allen Hubbe &lt;allenbh@gmail.com&gt;
Cc: ntb@lists.linux.dev
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use "/*" instead of "/**" for common C comments to prevent warnings
from scripts/kernel-doc.

ntb_hw_epf.c:15: warning: expecting prototype for Host side endpoint driver to implement Non(). Prototype was for NTB_EPF_COMMAND() instead

Signed-off-by: Randy Dunlap &lt;rdunlap@infradead.org&gt;
Cc: Jon Mason &lt;jdmason@kudzu.us&gt;
Cc: Dave Jiang &lt;dave.jiang@intel.com&gt;
Cc: Allen Hubbe &lt;allenbh@gmail.com&gt;
Cc: ntb@lists.linux.dev
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()</title>
<updated>2024-09-20T14:50:38+00:00</updated>
<author>
<name>Jinjie Ruan</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-08-31T12:39:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e229897d373a87ee09ec5cc4ecd4bb2f895fc16b'/>
<id>e229897d373a87ee09ec5cc4ecd4bb2f895fc16b</id>
<content type='text'>
The debugfs_create_dir() function returns error pointers.
It never returns NULL. So use IS_ERR() to check it.

Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The debugfs_create_dir() function returns error pointers.
It never returns NULL. So use IS_ERR() to check it.

Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
Signed-off-by: Jinjie Ruan &lt;ruanjinjie@huawei.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>PCI: switchtec: Make switchtec_class constant</title>
<updated>2024-06-10T20:03:30+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2024-06-10T08:20:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=8a74e4eaa72c14f997df6d820effb6aac400d470'/>
<id>8a74e4eaa72c14f997df6d820effb6aac400d470</id>
<content type='text'>
Now that the driver core allows for struct class to be in read-only memory,
we should make all 'class' structures declared at build time placing them
into read-only memory, instead of having to be dynamically allocated at
runtime.

Link: https://lore.kernel.org/r/2024061053-online-unwound-b173@gregkh
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Reviewed-By: Logan Gunthorpe &lt;logang@deltatee.com&gt;
Cc: Kurt Schwemmer &lt;kurt.schwemmer@microsemi.com&gt;
Cc: Jon Mason &lt;jdmason@kudzu.us&gt;
Cc: Allen Hubbe &lt;allenbh@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Now that the driver core allows for struct class to be in read-only memory,
we should make all 'class' structures declared at build time placing them
into read-only memory, instead of having to be dynamically allocated at
runtime.

Link: https://lore.kernel.org/r/2024061053-online-unwound-b173@gregkh
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Reviewed-By: Logan Gunthorpe &lt;logang@deltatee.com&gt;
Cc: Kurt Schwemmer &lt;kurt.schwemmer@microsemi.com&gt;
Cc: Jon Mason &lt;jdmason@kudzu.us&gt;
Cc: Allen Hubbe &lt;allenbh@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: idt: Use PCI_IRQ_INTX instead of PCI_IRQ_LEGACY</title>
<updated>2024-04-25T17:53:30+00:00</updated>
<author>
<name>Damien Le Moal</name>
<email>dlemoal@kernel.org</email>
</author>
<published>2024-03-25T07:09:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=895e51977d91e0727dd8abc46dee96903a602b48'/>
<id>895e51977d91e0727dd8abc46dee96903a602b48</id>
<content type='text'>
Use the macro PCI_IRQ_INTX instead of the deprecated PCI_IRQ_LEGACY macro.

Link: https://lore.kernel.org/r/20240325070944.3600338-9-dlemoal@kernel.org
Signed-off-by: Damien Le Moal &lt;dlemoal@kernel.org&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use the macro PCI_IRQ_INTX instead of the deprecated PCI_IRQ_LEGACY macro.

Link: https://lore.kernel.org/r/20240325070944.3600338-9-dlemoal@kernel.org
Signed-off-by: Damien Le Moal &lt;dlemoal@kernel.org&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: amd: Drop unnecessary error check for debugfs_create_dir</title>
<updated>2023-08-18T13:50:06+00:00</updated>
<author>
<name>Ruan Jinjie</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2023-08-17T06:32:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=28e70ed9d0fab935f78b565d9c026585559b86a4'/>
<id>28e70ed9d0fab935f78b565d9c026585559b86a4</id>
<content type='text'>
This patch removes the error checking for debugfs_create_dir in
ntb_hw_amd.c. This is because the DebugFS kernel API is developed
in a way that the caller can safely ignore the errors that
occur during the creation of DebugFS nodes. The debugfs APIs have
a IS_ERR() judge in start_creating() which can handle it
gracefully. so these checks are unnecessary.

Signed-off-by: Ruan Jinjie &lt;ruanjinjie@huawei.com&gt;
Acked-by: Sanjay R Mehta &lt;sanju.mehta@amd.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch removes the error checking for debugfs_create_dir in
ntb_hw_amd.c. This is because the DebugFS kernel API is developed
in a way that the caller can safely ignore the errors that
occur during the creation of DebugFS nodes. The debugfs APIs have
a IS_ERR() judge in start_creating() which can handle it
gracefully. so these checks are unnecessary.

Signed-off-by: Ruan Jinjie &lt;ruanjinjie@huawei.com&gt;
Acked-by: Sanjay R Mehta &lt;sanju.mehta@amd.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: hw: amd: Fix debugfs_create_dir error checking</title>
<updated>2023-07-08T17:55:44+00:00</updated>
<author>
<name>Anup Sharma</name>
<email>anupnewsmail@gmail.com</email>
</author>
<published>2023-05-12T20:24:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=bff6efc54bd0e27a332eb733525d7f698fd4a5b7'/>
<id>bff6efc54bd0e27a332eb733525d7f698fd4a5b7</id>
<content type='text'>
The debugfs_create_dir function returns ERR_PTR in case of error, and the
only correct way to check if an error occurred is 'IS_ERR' inline function.
This patch will replace the null-comparison with IS_ERR.

Signed-off-by: Anup Sharma &lt;anupnewsmail@gmail.com&gt;
Suggested-by: Ivan Orlov &lt;ivan.orlov0322@gmail.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The debugfs_create_dir function returns ERR_PTR in case of error, and the
only correct way to check if an error occurred is 'IS_ERR' inline function.
This patch will replace the null-comparison with IS_ERR.

Signed-off-by: Anup Sharma &lt;anupnewsmail@gmail.com&gt;
Suggested-by: Ivan Orlov &lt;ivan.orlov0322@gmail.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ntb: intel: Remove redundant pci_clear_master</title>
<updated>2023-07-08T15:02:37+00:00</updated>
<author>
<name>Cai Huoqing</name>
<email>cai.huoqing@linux.dev</email>
</author>
<published>2023-03-24T01:32:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=d353fb4b70402f487c1c68bc0a86f526dc8384f3'/>
<id>d353fb4b70402f487c1c68bc0a86f526dc8384f3</id>
<content type='text'>
Remove pci_clear_master to simplify the code,
the bus-mastering is also cleared in do_pci_disable_device,
like this:
./drivers/pci/pci.c:2197
static void do_pci_disable_device(struct pci_dev *dev)
{
	u16 pci_command;

	pci_read_config_word(dev, PCI_COMMAND, &amp;pci_command);
	if (pci_command &amp; PCI_COMMAND_MASTER) {
		pci_command &amp;= ~PCI_COMMAND_MASTER;
		pci_write_config_word(dev, PCI_COMMAND, pci_command);
	}

	pcibios_disable_device(dev);
}.
And dev-&gt;is_busmaster is set to 0 in pci_disable_device.

Signed-off-by: Cai Huoqing &lt;cai.huoqing@linux.dev&gt;
Acked-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Remove pci_clear_master to simplify the code,
the bus-mastering is also cleared in do_pci_disable_device,
like this:
./drivers/pci/pci.c:2197
static void do_pci_disable_device(struct pci_dev *dev)
{
	u16 pci_command;

	pci_read_config_word(dev, PCI_COMMAND, &amp;pci_command);
	if (pci_command &amp; PCI_COMMAND_MASTER) {
		pci_command &amp;= ~PCI_COMMAND_MASTER;
		pci_write_config_word(dev, PCI_COMMAND, pci_command);
	}

	pcibios_disable_device(dev);
}.
And dev-&gt;is_busmaster is set to 0 in pci_disable_device.

Signed-off-by: Cai Huoqing &lt;cai.huoqing@linux.dev&gt;
Acked-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Signed-off-by: Jon Mason &lt;jdmason@kudzu.us&gt;
</pre>
</div>
</content>
</entry>
</feed>
