Skip to content
Snippets Groups Projects
  1. Dec 17, 2021
  2. Dec 09, 2021
  3. Dec 06, 2021
  4. Dec 02, 2021
  5. Nov 29, 2021
    • Baokun Li's avatar
      sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl · 6f48394c
      Baokun Li authored
      
      Trying to remove the fsl-sata module in the PPC64 GNU/Linux
      leads to the following warning:
       ------------[ cut here ]------------
       remove_proc_entry: removing non-empty directory 'irq/69',
         leaking at least 'fsl-sata[ff0221000.sata]'
       WARNING: CPU: 3 PID: 1048 at fs/proc/generic.c:722
         .remove_proc_entry+0x20c/0x220
       IRQMASK: 0
       NIP [c00000000033826c] .remove_proc_entry+0x20c/0x220
       LR [c000000000338268] .remove_proc_entry+0x208/0x220
       Call Trace:
        .remove_proc_entry+0x208/0x220 (unreliable)
        .unregister_irq_proc+0x104/0x140
        .free_desc+0x44/0xb0
        .irq_free_descs+0x9c/0xf0
        .irq_dispose_mapping+0x64/0xa0
        .sata_fsl_remove+0x58/0xa0 [sata_fsl]
        .platform_drv_remove+0x40/0x90
        .device_release_driver_internal+0x160/0x2c0
        .driver_detach+0x64/0xd0
        .bus_remove_driver+0x70/0xf0
        .driver_unregister+0x38/0x80
        .platform_driver_unregister+0x14/0x30
        .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl]
       ---[ end trace 0ea876d4076908f5 ]---
      
      The driver creates the mapping by calling irq_of_parse_and_map(),
      so it also has to dispose the mapping. But the easy way out is to
      simply use platform_get_irq() instead of irq_of_parse_map(). Also
      we should adapt return value checking and propagate error values.
      
      In this case the mapping is not managed by the device but by
      the of core, so the device has not to dispose the mapping.
      
      Fixes: faf0b2e5 ("drivers/ata: add support to Freescale 3.0Gbps SATA Controller")
      Cc: stable@vger.kernel.org
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
      Reviewed-by: default avatarSergei Shtylyov <sergei.shtylyov@gmail.com>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      6f48394c
    • Baokun Li's avatar
      sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl · 6c8ad7e8
      Baokun Li authored
      
      When the `rmmod sata_fsl.ko` command is executed in the PPC64 GNU/Linux,
      a bug is reported:
       ==================================================================
       BUG: Unable to handle kernel data access on read at 0x80000800805b502c
       Oops: Kernel access of bad area, sig: 11 [#1]
       NIP [c0000000000388a4] .ioread32+0x4/0x20
       LR [80000000000c6034] .sata_fsl_port_stop+0x44/0xe0 [sata_fsl]
       Call Trace:
        .free_irq+0x1c/0x4e0 (unreliable)
        .ata_host_stop+0x74/0xd0 [libata]
        .release_nodes+0x330/0x3f0
        .device_release_driver_internal+0x178/0x2c0
        .driver_detach+0x64/0xd0
        .bus_remove_driver+0x70/0xf0
        .driver_unregister+0x38/0x80
        .platform_driver_unregister+0x14/0x30
        .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl]
        .__se_sys_delete_module+0x1ec/0x2d0
        .system_call_exception+0xfc/0x1f0
        system_call_common+0xf8/0x200
       ==================================================================
      
      The triggering of the BUG is shown in the following stack:
      
      driver_detach
        device_release_driver_internal
          __device_release_driver
            drv->remove(dev) --> platform_drv_remove/platform_remove
              drv->remove(dev) --> sata_fsl_remove
                iounmap(host_priv->hcr_base);			<---- unmap
                kfree(host_priv);                             <---- free
            devres_release_all
              release_nodes
                dr->node.release(dev, dr->data) --> ata_host_stop
                  ap->ops->port_stop(ap) --> sata_fsl_port_stop
                      ioread32(hcr_base + HCONTROL)           <---- UAF
                  host->ops->host_stop(host)
      
      The iounmap(host_priv->hcr_base) and kfree(host_priv) functions should
      not be executed in drv->remove. These functions should be executed in
      host_stop after port_stop. Therefore, we move these functions to the
      new function sata_fsl_host_stop and bind the new function to host_stop.
      
      Fixes: faf0b2e5 ("drivers/ata: add support to Freescale 3.0Gbps SATA Controller")
      Cc: stable@vger.kernel.org
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
      Reviewed-by: default avatarSergei Shtylyov <sergei.shtylyov@gmail.com>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      6c8ad7e8
    • Finn Thain's avatar
      pata_falcon: Avoid type warnings from sparse · 5fad5077
      Finn Thain authored
      
      The zero day bot reported some sparse complaints in pata_falcon.c. E.g.
      
      drivers/ata/pata_falcon.c:58:41: warning: cast removes address space '__iomem' of expression
      drivers/ata/pata_falcon.c:58:41: warning: incorrect type in argument 1 (different address spaces)
      drivers/ata/pata_falcon.c:58:41:    expected unsigned short volatile [noderef] [usertype] __iomem *port
      drivers/ata/pata_falcon.c:58:41:    got unsigned short [usertype] *
      
      The same thing shows up in 8 places, all told. Avoid this by removing
      unnecessary type casts.
      
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Michael Schmitz <schmitzmic@gmail.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Suggested-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarFinn Thain <fthain@linux-m68k.org>
      Reviewed-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      5fad5077
  6. Nov 18, 2021
  7. Nov 16, 2021
  8. Nov 11, 2021
    • Damien Le Moal's avatar
      libata: libahci: declare ahci_shost_attr_group as static · 1b87bda1
      Damien Le Moal authored
      
      ahci_shost_attr_group is referenced only in drivers/ata/libahci.c.
      Declare it as static.
      
      Fixes: c3f69c7f ("scsi: ata: Switch to attribute groups")
      Cc: Bart Van Assche <bvanassche@acm.org>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      1b87bda1
    • Damien Le Moal's avatar
      libata: add horkage for missing Identify Device log · 636f6e2a
      Damien Le Moal authored
      
      ACS-3 introduced the ATA Identify Device Data log as mandatory. A
      warning message currently signals to the user if a device does not
      report supporting this log page in the log directory page, regardless
      of the ATA version of the device. Furthermore, this warning will appear
      for all attempts at accessing this missing log page during device
      revalidation.
      
      Since it is useless to constantly access the log directory and warn
      about this lack of support once we have discovered that the device
      does not support this log page, introduce the horkage flag
      ATA_HORKAGE_NO_ID_DEV_LOG to mark a device as lacking support for
      the Identify Device Data log page. Set this flag when
      ata_log_supported() returns false in ata_identify_page_supported().
      The warning is printed only if the device ATA level is 10 or above
      (ACS-3 or above), and only once on device scan. With this flag set, the
      log directory page is not accessed again to test for Identify Device
      Data log page support.
      
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
      636f6e2a
    • Xu Wang's avatar
      ata: sata_highbank: Remove unnecessary print function dev_err() · 51839e25
      Xu Wang authored
      
      The print function dev_err() is redundant because
      platform_get_irq() already prints an error.
      
      Signed-off-by: default avatarXu Wang <vulab@iscas.ac.cn>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      51839e25
    • Damien Le Moal's avatar
      libata: fix read log timeout value · 68dbbe7d
      Damien Le Moal authored
      
      Some ATA drives are very slow to respond to READ_LOG_EXT and
      READ_LOG_DMA_EXT commands issued from ata_dev_configure() when the
      device is revalidated right after resuming a system or inserting the
      ATA adapter driver (e.g. ahci). The default 5s timeout
      (ATA_EH_CMD_DFL_TIMEOUT) used for these commands is too short, causing
      errors during the device configuration. Ex:
      
      ...
      ata9: SATA max UDMA/133 abar m524288@0x9d200000 port 0x9d200400 irq 209
      ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
      ata9.00: ATA-9: XXX  XXXXXXXXXXXXXXX, XXXXXXXX, max UDMA/133
      ata9.00: qc timeout (cmd 0x2f)
      ata9.00: Read log page 0x00 failed, Emask 0x4
      ata9.00: Read log page 0x00 failed, Emask 0x40
      ata9.00: NCQ Send/Recv Log not supported
      ata9.00: Read log page 0x08 failed, Emask 0x40
      ata9.00: 27344764928 sectors, multi 16: LBA48 NCQ (depth 32), AA
      ata9.00: Read log page 0x00 failed, Emask 0x40
      ata9.00: ATA Identify Device Log not supported
      ata9.00: failed to set xfermode (err_mask=0x40)
      ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
      ata9.00: configured for UDMA/133
      ...
      
      The timeout error causes a soft reset of the drive link, followed in
      most cases by a successful revalidation as that give enough time to the
      drive to become fully ready to quickly process the read log commands.
      However, in some cases, this also fails resulting in the device being
      dropped.
      
      Fix this by using adding the ata_eh_revalidate_timeouts entries for the
      READ_LOG_EXT and READ_LOG_DMA_EXT commands. This defines a timeout
      increased to 15s, retriable one time.
      
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Tested-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@opensource.wdc.com>
      68dbbe7d
  9. Oct 27, 2021
  10. Oct 24, 2021
  11. Oct 17, 2021
  12. Oct 14, 2021
    • Wang Hai's avatar
      ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() · 776c7501
      Wang Hai authored
      
      I got a null-ptr-deref report:
      
      KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
      ...
      RIP: 0010:regulator_enable+0x84/0x260
      ...
      Call Trace:
       ahci_platform_enable_regulators+0xae/0x320
       ahci_platform_enable_resources+0x1a/0x120
       ahci_probe+0x4f/0x1b9
       platform_probe+0x10b/0x280
      ...
       entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      If devm_regulator_get() in ahci_platform_get_resources() fails,
      hpriv->phy_regulator will point to NULL, when enabling or disabling it,
      null-ptr-deref will occur.
      
      ahci_probe()
      	ahci_platform_get_resources()
      		devm_regulator_get(, "phy") // failed, let phy_regulator = NULL
      	ahci_platform_enable_resources()
      		ahci_platform_enable_regulators()
      			regulator_enable(hpriv->phy_regulator) // null-ptr-deref
      
      commit 962399bb ("ata: libahci_platform: Fix regulator_get_optional()
      misuse") replaces devm_regulator_get_optional() with devm_regulator_get(),
      but PHY regulator omits to delete "hpriv->phy_regulator = NULL;" like AHCI.
      Delete it like AHCI regulator to fix this bug.
      
      Fixes: commit 962399bb ("ata: libahci_platform: Fix regulator_get_optional() misuse")
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
      Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
      776c7501
  13. Oct 12, 2021
  14. Sep 21, 2021
  15. Sep 03, 2021
  16. Aug 18, 2021
Loading