aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2019-01-22ver_linux: Assign constant RE to variable name for clarityAlexander Kapshuk1-2/+4
The regular expression that matches the version number of a utility being queried is used as a constant expression in the current implementation. Assigning the RE in question to a variable gives it a meaningful name that clearly expresses the intended use of the expression without having to think about the details of implementation. Signed-off-by: Alexander Kapshuk <alexander.kapshuk@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22applicom: Fix potential Spectre v1 vulnerabilitiesGustavo A. R. Silva1-11/+24
IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap) Fix this by sanitizing IndexCard before using it to index apbs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enableBuland Singh1-1/+1
Commit '3d035f580699 ("drivers/char/hpet.c: allow user controlled mmap for user processes")' introduced a new kernel command line parameter hpet_mmap, that is required to expose the memory map of the HPET registers to user-space. Unfortunately the kernel command line parameter 'hpet_mmap' is broken and never takes effect due to missing '=' character in the __setup() code of hpet_mmap_enable. Before this patch: dmesg output with the kernel command line parameter hpet_mmap=1 [ 0.204152] HPET mmap disabled dmesg output with the kernel command line parameter hpet_mmap=0 [ 0.204192] HPET mmap disabled After this patch: dmesg output with the kernel command line parameter hpet_mmap=1 [ 0.203945] HPET mmap enabled dmesg output with the kernel command line parameter hpet_mmap=0 [ 0.204652] HPET mmap disabled Fixes: 3d035f580699 ("drivers/char/hpet.c: allow user controlled mmap for user processes") Signed-off-by: Buland Singh <bsingh@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22slimbus: core: add missing spin_lock_init on txn_lockSrinivas Kandagatla1-0/+1
Add missing spin lock intialization this also fixes the spinlock bad magic warning. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22slimbus: core: use slim_device_update_status() to update statusSrinivas Kandagatla1-19/+18
use slim_device_update_status() instead of directly calling the device_status() callback. Move slim_device_update_status() before probe to avoid forward declaration too. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22slimbus: core: do not call device_status under a lockSrinivas Kandagatla1-0/+3
Calling device_status callback under a lock would prevent drivers to do any slimbus trasactions which would invoke this lock like get_laddr(). Remove this unnecessary lock! Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22slimbus: core: match full device idSrinivas Kandagatla1-1/+3
match full slim device id instead of just product and manufacture code, this will allow drivers to be much more specific to that device. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22efirtc: remove unnecessary code efi_rtc_open & efi_rtc_closeNaveen Kumar Parna1-23/+0
There is no advantage to keep 'struct file_operations.open & .close' API's. So removed the unnecessary code efi_rtc_open & efi_rtc_close. Signed-off-by: Naveen Kumar Parna <parna.naveenkumar@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22uio: remove redundant checkChengguang Xu1-2/+2
It is not necessary to check idev->info several times under mutex lock, so just remove redundant check. Signed-off-by: Chengguang Xu <cgxu519@gmx.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22uio: fix potential memory leak in error caseChengguang Xu1-1/+1
Should jump to lable err_infoopen when idev->info is NULL in uio_open(). Signed-off-by: Chengguang Xu <cgxu519@gmx.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22drivers: platform: goldfish: fix the checkpatch complain in KconfigRoman Kiryanov1-2/+2
prefer 'help' over '---help---' for new help texts Signed-off-by: Roman Kiryanov <rkir@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22vop: Fix handling of >32 feature bitsVincent Whitchurch1-2/+2
This is needed, for example, for VIRTIO_F_IOMMU_PLATFORM. Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22vop: vringh: Do not crash if no DMA channelVincent Whitchurch1-12/+20
Fallback gracefully if no DMA channel is provided instead of dereferencing NULL pointers. Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22vop: Add definition of readq/writeq if missingVincent Whitchurch1-0/+1
Include <linux/io-64-nonatomic-lo-hi.h> so that readq/writeq are replaced by two readl/writel on systems that do not support them. The values read/written are pointers which will be 32-bit on 32-bit systems so the non-atomicity should not matter. Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22vop: Use %z for size_tVincent Whitchurch1-2/+2
Fixes these kind of errors on 32-bit: drivers/misc/mic/vop/vop_vringh.c:590:3: error: format '%lx' expects argument of type 'long unsigned int', but argument 7 has type 'size_t {aka unsigned int}' [-Werror=format=] Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22powerpc: Adopt nvram module for PPC64Finn Thain7-163/+9
Adopt nvram module to reduce code duplication. This means CONFIG_NVRAM becomes available to PPC64 builds. Previously it was only available to PPC32 builds because it depended on CONFIG_GENERIC_NVRAM. The IOC_NVRAM_GET_OFFSET ioctl as implemented on PPC64 validates the offset returned by pmac_get_partition(). Do the same in the nvram module. Note that the old PPC32 generic_nvram module lacked this test. So when CONFIG_PPC32 && CONFIG_PPC_PMAC, the IOC_NVRAM_GET_OFFSET ioctl would have returned 0 (always). But when CONFIG_PPC64 && CONFIG_PPC_PMAC, the IOC_NVRAM_GET_OFFSET ioctl would have returned -1 (which is -EPERM) when the requested partition was not found. With this patch, the result is now -EINVAL on both PPC32 and PPC64 when the requested PowerMac NVRAM partition is not found. This is a userspace- visible change, in the non-existent partition case, which would be in an error path for an IOC_NVRAM_GET_OFFSET ioctl syscall. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22char/generic_nvram: Remove as unusedFinn Thain2-165/+1
Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22powerpc: Enable HAVE_ARCH_NVRAM_OPS and disable GENERIC_NVRAMFinn Thain8-33/+33
Switch PPC32 kernels from the generic_nvram module to the nvram module. Also fix a theoretical bug where CHRP omits the chrp_nvram_init() call when CONFIG_NVRAM_MODULE=m. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22powerpc, fbdev: Use NV_CMODE and NV_VMODE only when CONFIG_PPC32 && CONFIG_PPC_PMAC && CONFIG_NVRAMFinn Thain6-75/+48
This patch addresses inconsistencies in Mac framebuffer drivers and their use of Kconfig symbols relating to NVRAM, so PPC64 can use CONFIG_NVRAM. The defined(CONFIG_NVRAM) condition is replaced with the weaker IS_REACHABLE(CONFIG_NVRAM) condition, like atari_scsi. Macintosh framebuffer drivers use default settings for color mode and video mode that are found in NVRAM. On PCI Macs, MacOS stores display settings in the Name Registry (NR) partition in NVRAM*. On NuBus Macs, there is no NR partition and MacOS stores display mode settings in PRAM**. Early-model Macs are the ones most likely to benefit from these settings, since they are more likely to have a fixed-frequency monitor connected to the built-in framebuffer device. Moreover, a single NV_CMODE value and a single NV_VMODE value provide for only one display. The NV_CMODE and NV_VMODE constants are apparently offsets into the NR partition for Old World machines. This also suggests that these defaults are not useful on later models. The NR partition seems to be optional on New World machines. CONFIG_NVRAM cannot be enabled on PPC64 at present. It is safe to say that NVRAM support in PowerMac fbdev drivers is only applicable to CONFIG_PPC32 so make this condition explicit. This means matroxfb driver won't crash on PPC64 when CONFIG_NVRAM becomes available there. For imsttfb, add the missing CONFIG_NVRAM test to prevent a build failure, since PPC64 does not implement nvram_read_byte(). Also add a missing machine_is(powermac) check. Change the inconsistent dependency on CONFIG_PPC and the matching #ifdef tests to CONFIG_PPC_PMAC. For valkyriefb, to improve clarity and consistency with the other PowerMac fbdev drivers, test for CONFIG_PPC_PMAC instead of !CONFIG_MAC. Remove a bogus comment regarding PRAM. * See GetPreferredConfiguration and SavePreferredConfiguration in "Designing PCI Cards and Drivers for Power Macintosh Computers". ** See SetDefaultMode and GetDefaultMode in "Designing Cards and Drivers for the Macintosh Family". Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22powerpc: Implement nvram ioctlsFinn Thain2-0/+40
Add the powerpc-specific ioctls to the nvram module. This allows the nvram module to replace the generic_nvram module. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22powerpc: Define missing ppc_md.nvram_size for CHRP and PowerMacFinn Thain2-4/+19
Add the nvram_size() function to those PowerPC platforms that don't already have one: CHRP and PowerMac. This means that the ppc_md.nvram_size() function can be called by nvram_get_size(). Since we are addressing CHRP inconsistencies here, rename chrp_nvram_read and chrp_nvram_write, which break the naming convention used across powerpc platforms for NVRAM accessor functions. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22char/nvram: Add "devname:nvram" module aliasFinn Thain1-0/+1
Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k: Dispatch nvram_ops calls to Atari or Mac functionsFinn Thain6-17/+108
A multi-platform kernel binary has to decide at run-time how to dispatch the arch_nvram_ops calls. Add a platform-independent arch_nvram_ops struct for this, to replace the atari-specific one. Enable CONFIG_HAVE_ARCH_NVRAM_OPS for Macs. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22macintosh/via-cuda: Don't rely on Cuda to end a transferFinn Thain1-3/+5
Certain Cuda transfers have to be ended by the driver. According to Apple's open source Cuda driver, as found in mkLinux and XNU, this applies to any "open ended request such as PRAM read". This fixes an infinite polling loop in cuda_pram_read_byte(). Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k/mac: Fix PRAM accessorsFinn Thain2-10/+35
PMU-based m68k Macs pre-date PowerMac-style NVRAM. Use the appropriate PMU commands. Also implement the missing XPRAM accessors for VIA-based Macs. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k/mac: Use macros for RTC accesses not magic numbersFinn Thain1-18/+41
This is intended to improve code style and not affect code behaviour. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k/mac: Adopt naming and calling conventions for PRAM routinesFinn Thain1-38/+23
Adopt the existing *_read_byte and *_write_byte naming convention. Rename via_pram_readbyte and via_pram_writebyte to avoid confusion. Adjust calling conventions of mac_pram_* functions to match the struct nvram_ops methods. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k/atari: Implement arch_nvram_ops methods and enable CONFIG_HAVE_ARCH_NVRAM_OPSFinn Thain4-1/+30
Atari RTC NVRAM uses a checksum so implement the remaining arch_nvram_ops methods for the set_checksum and initialize ioctls. Enable CONFIG_HAVE_ARCH_NVRAM_OPS. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22char/nvram: Implement NVRAM read/write methodsFinn Thain2-48/+104
Refactor the RTC "CMOS" NVRAM functions so that they can be used as arch_nvram_ops methods. Checksumming logic is moved from the misc device operations to the nvram read/write operations. This makes the misc device implementation more generic. This preserves the locking mechanism such that "read if checksum valid" and "write and update checksum" remain atomic operations. Some platforms implement byte-range read/write methods which are similar to file_operations struct methods. Other platforms provide only byte-at-a-time methods. The former are more efficient but may be unavailable so fall back on the latter methods when necessary. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22char/nvram: Allow the set_checksum and initialize ioctls to be omittedFinn Thain2-30/+42
The drivers/char/nvram.c module has previously supported only RTC "CMOS" NVRAM, for which it provides appropriate checksum ioctls. Make these ioctls optional so the module can be re-used with other kinds of NVRAM. The ops struct methods that implement the ioctls now return error codes so that a multi-platform kernel binary can do the right thing when running on hardware without a suitable NVRAM. Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22char/nvram: Adopt arch_nvram_opsFinn Thain2-6/+56
NVRAMs on different platforms and architectures have different attributes and access methods. E.g. some platforms have byte-at-a-time accessor functions while others have byte-range accessor functions. Some have checksum functionality while others do not. By calling ops struct methods via the common wrapper functions, the nvram module and other drivers can make use of the available NVRAM functionality in a portable way. Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22powerpc: Replace nvram_* extern declarations with standard headerFinn Thain5-31/+6
Remove the nvram_read_byte() and nvram_write_byte() declarations in powerpc/include/asm/nvram.h and use the cross-platform static functions in linux/nvram.h instead. Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k/atari: Implement arch_nvram_ops structFinn Thain2-0/+63
By implementing an arch_nvram_ops struct, a platform can re-use the drivers/char/nvram.c module without needing any arch-specific code in that module. Atari does so here. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22nvram: Replace nvram_* function exports with static functionsFinn Thain4-68/+38
Replace nvram_* functions with static functions in nvram.h. These will become wrappers for struct nvram_ops method calls. This patch effectively disables existing NVRAM functionality so as to allow the rest of the series to be bisected without build failures. That functionality is gradually re-implemented in subsequent patches. Replace the sole validate-checksum-and-read-byte sequence with a call to nvram_read() which will gain the same semantics in subsequent patches. Remove unused exports. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22char/nvram: Re-order functions to remove forward declarations and #ifdefsFinn Thain1-95/+72
Also give functions more sensible names: nvram_misc_* for misc device ops, nvram_proc_* for proc file ops and nvram_module_* for init and exit functions. This prevents name collisions with nvram.h helper functions and improves readability. Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22m68k/atari: Move Atari-specific code out of drivers/char/nvram.cFinn Thain3-245/+280
Move the m68k-specific code out of the driver to make the driver generic. I've used 'SPDX-License-Identifier: GPL-2.0+' for the new file because the old file is covered by MODULE_LICENSE("GPL"). Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-22scsi/atari_scsi: Don't select CONFIG_NVRAMFinn Thain3-8/+5
On powerpc, setting CONFIG_NVRAM=n builds a kernel with no NVRAM support. Setting CONFIG_NVRAM=m enables the /dev/nvram misc device module without enabling NVRAM support in drivers. Setting CONFIG_NVRAM=y enables the misc device (built-in) and also enables NVRAM support in drivers. m68k shares the valkyriefb driver with powerpc, and since that driver uses NVRAM, it is affected by CONFIG_ATARI_SCSI, because of the use of "select NVRAM". We can avoid the "select" here, but drivers still have to interpret the CONFIG_NVRAM symbol consistently regardless of platform. In this patch and the subsequent fbdev driver patch, the convention is adopted across all relevant platforms whereby NVRAM functionality gets enabled in a given device driver when the nvram misc device is built-in or when both drivers are modules. Acked-by: Michael Schmitz <schmitzmic@gmail.com> Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-18misc: enclosure: Use struct_size() in kzalloc()Gustavo A. R. Silva1-3/+1
One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; void *entry[]; }; instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-18misc/sgi-gru/grufault: fix a style errorPeng Hao1-2/+2
Fix a style error. Remove redundant space. Signed-off-by: Peng Hao <peng.hao2@zte.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-18misc/mic/vop/vop_main : remove unneeded semicolonPeng Hao1-2/+2
Remove unnecessary semicolon in two functions. Signed-off-by: Peng Hao <peng.hao2@zte.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-18misc/ics932s401: Add a missing check to i2c_smbus_read_word_dataAditya Pakki1-0/+2
ics932s401_update_device may fail reading in i2c_smbus_read_word_data due to error in i2c_smbus_xfer. The fix checks the status and defaults the register to 0. Signed-off-by: Aditya Pakki <pakki001@umn.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-18drivers: misc: ad525x_dpot: clean indentation issue, remove tabsColin Ian King1-13/+11
There is a hunk of code in a case statement that is indented one level too deeply, fix this by removing extra tabs. Also remove one empty line. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-18lkdtm: change snprintf to scnprintf for possible overflowSilvio Cesare1-2/+2
Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems. 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf. 2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration. The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE. Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Greg KH <greg@kroah.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-13mei: squash single_recv_buf into one bit in client propertiesAlexander Usyskin1-1/+2
single_recv_buf member of struct mei_client_properties has a boolean value and can be represented in on bit, to free other 7 bits for another usage. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-10Merge tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into char-misc-nextGreg Kroah-Hartman4-19/+31
Kees writes: lkdtm updates and new tests - Check NULL dereferences (Christophe Leroy) - Print real addresses for debugging (Christophe Leroy) - Drop CONFIG_BLOCK dependency * tag 'lkdtm-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lkdtm: Add tests for NULL pointer dereference lkdtm: Print real addresses lkdtm: Do not depend on BLOCK and clean up headers
2019-01-09lkdtm: Add tests for NULL pointer dereferenceChristophe Leroy3-0/+22
Introduce lkdtm tests for NULL pointer dereference: check access or exec at NULL address, since these errors tend to be reported differently from the general fault error text. For example from x86: pr_alert("BUG: unable to handle kernel %s at %px\n", address < PAGE_SIZE ? "NULL pointer dereference" : "paging request", (void *)address); Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr> Signed-off-by: Kees Cook <keescook@chromium.org>
2019-01-09lkdtm: Print real addressesChristophe Leroy1-9/+9
Today, when doing a lkdtm test before the readiness of the random generator, (ptrval) is printed instead of the address at which it perform the fault: [ 1597.337030] lkdtm: Performing direct entry EXEC_USERSPACE [ 1597.337142] lkdtm: attempting ok execution at (ptrval) [ 1597.337398] lkdtm: attempting bad execution at (ptrval) [ 1597.337460] kernel tried to execute user page (77858000) -exploit attempt? (uid: 0) [ 1597.344769] Unable to handle kernel paging request for instruction fetch [ 1597.351392] Faulting instruction address: 0x77858000 [ 1597.356312] Oops: Kernel access of bad area, sig: 11 [#1] If the lkdtm test is done later on, it prints an hashed address. In both cases this is pointless. The purpose of the test is to ensure the kernel generates an Oops at the expected address, so real addresses needs to be printed. This patch fixes that. Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr> Signed-off-by: Kees Cook <keescook@chromium.org>
2019-01-09lkdtm: Do not depend on BLOCK and clean up headersKees Cook2-10/+0
After the transition to kprobes, symbols are resolved at runtime. This means there is no need to have all the Kconfig and header logic to avoid build failures. This also paves the way to having arbitrary test locations. Reported-by: Christophe Leroy <christophe.leroy@c-s.fr> Signed-off-by: Kees Cook <keescook@chromium.org>
2019-01-06Linux 5.0-rc1Linus Torvalds1-3/+3
2019-01-06Merge tag 'kbuild-v4.21-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuildLinus Torvalds94-694/+150
Pull more Kbuild updates from Masahiro Yamada: - improve boolinit.cocci and use_after_iter.cocci semantic patches - fix alignment for kallsyms - move 'asm goto' compiler test to Kconfig and clean up jump_label CONFIG option - generate asm-generic wrappers automatically if arch does not implement mandatory UAPI headers - remove redundant generic-y defines - misc cleanups * tag 'kbuild-v4.21-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: rename generated .*conf-cfg to *conf-cfg kbuild: remove unnecessary stubs for archheader and archscripts kbuild: use assignment instead of define ... endef for filechk_* rules arch: remove redundant UAPI generic-y defines kbuild: generate asm-generic wrappers if mandatory headers are missing arch: remove stale comments "UAPI Header export list" riscv: remove redundant kernel-space generic-y kbuild: change filechk to surround the given command with { } kbuild: remove redundant target cleaning on failure kbuild: clean up rule_dtc_dt_yaml kbuild: remove UIMAGE_IN and UIMAGE_OUT jump_label: move 'asm goto' support test to Kconfig kallsyms: lower alignment on ARM scripts: coccinelle: boolinit: drop warnings on named constants scripts: coccinelle: check for redeclaration kconfig: remove unused "file" field of yylval union nds32: remove redundant kernel-space generic-y nios2: remove unneeded HAS_DMA define