From: John Garry <john.garry@huawei.com>
To: <bhelgaas@google.com>, <rafael@kernel.org>, <arnd@arndb.de>,
<lorenzo.pieralisi@arm.com>, <bp@suse.de>
Cc: <linux@roeck-us.net>, <linux-kernel@vger.kernel.org>,
<linux-pci@vger.kernel.org>, <wangkefeng.wang@huawei.com>,
<linuxarm@huawei.com>, <agraf@suse.de>,
<andy.shevchenko@gmail.com>, "John Garry" <john.garry@huawei.com>
Subject: [PATCH v2 2/3] lib: logic_pio: Reject access to unregistered CPU MMIO regions
Date: Thu, 21 Mar 2019 02:14:09 +0800 [thread overview]
Message-ID: <1553105650-28012-3-git-send-email-john.garry@huawei.com> (raw)
In-Reply-To: <1553105650-28012-1-git-send-email-john.garry@huawei.com>
Currently when accessing logical indirect PIO addresses in
logic_{in, out}{,s}, we first ensure that the region is registered.
However, no such check exists for CPU MMIO regions. The CPU MMIO regions
would be registered by the PCI host (when PCI_IOBASE is defined) in
pci_register_io_range().
We have seen scenarios when systems which don't have a PCI host or, they
do, and the PCI host probe fails, that certain devices attempts to still
attempt to access PCI IO ports; examples are in [1] and [2].
And even though we would protect against this by ensuring the driver call
request_{muxed_}region(), some don't do this:
root@(none)$ insmod hwmon/f71805f.ko
[ 98.623872] Unable to handle kernel paging request at virtual address ffff7dfffee0002e
[ 98.639804] Mem abort info:
[ 98.645404] ESR = 0x96000046
[ 98.651525] Exception class = DABT (current EL), IL = 32 bits
[ 98.663410] SET = 0, FnV = 0
[ 98.669530] EA = 0, S1PTW = 0
[ 98.675826] Data abort info:
[ 98.681597] ISV = 0, ISS = 0x00000046
[ 98.689290] CM = 0, WnR = 1
[ 98.695237] swapper pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
[ 98.709044] [ffff7dfffee0002e] pgd=000000000141c003, pud=000000000141d003, pmd=0000000000000000
[ 98.726523] Internal error: Oops: 96000046 [#1] PREEMPT SMP
[ 98.737706] Modules linked in: f71805f(+)
[ 98.745748] CPU: 20 PID: 2736 Comm: insmod Not tainted 5.1.0-rc1-00003-g6f1bfec2a620-dirty #99
[ 98.763045] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
[ 98.781390] pstate: 80000005 (Nzcv daif -PAN -UAO)
[ 98.791008] pc : logic_outb+0x54/0xb8
[ 98.798351] lr : f71805f_find+0x2c/0x1b8 [f71805f]
[ 98.807962] sp : ffff000025fbba90
[ 98.814603] x29: ffff000025fbba90 x28: ffff000008b944d0
[ 98.825263] x27: ffff000025fbbdf0 x26: 0000000000000100
[ 98.835922] x25: ffff801f8c270580 x24: ffff000011420000
[ 98.846582] x23: ffff000025fbbb3e x22: ffff000025fbbb40
[ 98.857242] x21: ffff000008b991b8 x20: 0000000000000087
[ 98.867901] x19: 000000000000002e x18: ffffffffffffffff
[ 98.878561] x17: 0000000000000000 x16: 0000000000000000
[ 98.889220] x15: ffff00001127d6c8 x14: 0000000000000000
[ 98.899880] x13: 0000000000000000 x12: 0000000000000000
[ 98.910539] x11: 0000000000010820 x10: 0000841fdac40000
[ 98.921199] x9 : 0000000000000001 x8 : 0000000040000000
[ 98.931858] x7 : 0000000000210d00 x6 : 0000000000000000
[ 98.942517] x5 : ffff801fb6a46040 x4 : ffff841febeaeda0
[ 98.953177] x3 : 0000000000ffbffe x2 : ffff000025fbbb40
[ 98.963837] x1 : ffff7dfffee0002e x0 : ffff7dfffee00000
[ 98.974497] Process insmod (pid: 2736, stack limit = 0x(____ptrval____))
[ 98.987950] Call trace:
[ 98.992846] logic_outb+0x54/0xb8
[ 98.999489] f71805f_find+0x2c/0x1b8 [f71805f]
[ 99.008403] f71805f_init+0x38/0xe48 [f71805f]
[ 99.017317] do_one_initcall+0x5c/0x198
[ 99.025008] do_init_module+0x54/0x1b0
[ 99.032522] load_module+0x1dc4/0x2158
[ 99.040037] __se_sys_init_module+0x14c/0x1e8
[ 99.048774] __arm64_sys_init_module+0x18/0x20
[ 99.057688] el0_svc_common+0x5c/0x100
[ 99.065203] el0_svc_handler+0x2c/0x80
[ 99.072717] el0_svc+0x8/0xc
[ 99.078486] Code: d2bfdc00 f2cfbfe0 f2ffffe0 8b000021 (39000034)
[ 99.090719] ---[ end trace 10ea80bde051bbfc ]---
root@(none)$
Driver f71805f does not call request_{muxed_}region(), as it should do.
This patch adds a check to ensure that the CPU MMIO region is registered
prior to accessing the PCI IO ports.
[1] https://lkml.org/lkml/2019/3/14/630
[2] https://www.spinics.net/lists/arm-kernel/msg694702.html
Signed-off-by: John Garry <john.garry@huawei.com>
---
lib/logic_pio.c | 70 ++++++++++++++++++++++++++++---------------------
1 file changed, 40 insertions(+), 30 deletions(-)
diff --git a/lib/logic_pio.c b/lib/logic_pio.c
index feea48fd1a0d..026a4fb4b944 100644
--- a/lib/logic_pio.c
+++ b/lib/logic_pio.c
@@ -192,70 +192,80 @@ unsigned long logic_pio_trans_cpuaddr(resource_size_t addr)
}
#if defined(CONFIG_INDIRECT_PIO) && defined(PCI_IOBASE)
+#define INVALID_RANGE(range) (!range || \
+ (range->flags == LOGIC_PIO_CPU_MMIO && !range->ops))
+
#define BUILD_LOGIC_IO(bw, type) \
type logic_in##bw(unsigned long addr) \
{ \
type ret = (type)~0; \
+ struct logic_pio_hwaddr *range = find_io_range(addr); \
+ \
+ if (INVALID_RANGE(range)) { \
+ WARN_ON_ONCE(1); \
+ return ret; \
+ } \
\
if (addr < MMIO_UPPER_LIMIT) { \
ret = read##bw(PCI_IOBASE + addr); \
} else if (addr >= MMIO_UPPER_LIMIT && addr < IO_SPACE_LIMIT) { \
- struct logic_pio_hwaddr *entry = find_io_range(addr); \
- \
- if (entry && entry->ops) \
- ret = entry->ops->in(entry->hostdata, \
- addr, sizeof(type)); \
- else \
- WARN_ON_ONCE(1); \
+ ret = range->ops->in(range->hostdata, \
+ addr, sizeof(type)); \
} \
return ret; \
} \
\
void logic_out##bw(type value, unsigned long addr) \
{ \
+ struct logic_pio_hwaddr *range = find_io_range(addr); \
+ \
+ if (INVALID_RANGE(range)) { \
+ WARN_ON_ONCE(1); \
+ return; \
+ } \
+ \
if (addr < MMIO_UPPER_LIMIT) { \
write##bw(value, PCI_IOBASE + addr); \
} else if (addr >= MMIO_UPPER_LIMIT && addr < IO_SPACE_LIMIT) { \
- struct logic_pio_hwaddr *entry = find_io_range(addr); \
- \
- if (entry && entry->ops) \
- entry->ops->out(entry->hostdata, \
- addr, value, sizeof(type)); \
- else \
- WARN_ON_ONCE(1); \
+ if (range->ops && range->ops->out) \
+ range->ops->out(range->hostdata, addr, \
+ value, sizeof(type)); \
} \
} \
\
-void logic_ins##bw(unsigned long addr, void *buffer, \
+void logic_ins##bw(unsigned long addr, void *buffer, \
unsigned int count) \
{ \
+ struct logic_pio_hwaddr *range = find_io_range(addr); \
+ \
+ if (INVALID_RANGE(range)) { \
+ WARN_ON_ONCE(1); \
+ return; \
+ } \
+ \
if (addr < MMIO_UPPER_LIMIT) { \
reads##bw(PCI_IOBASE + addr, buffer, count); \
} else if (addr >= MMIO_UPPER_LIMIT && addr < IO_SPACE_LIMIT) { \
- struct logic_pio_hwaddr *entry = find_io_range(addr); \
- \
- if (entry && entry->ops) \
- entry->ops->ins(entry->hostdata, \
- addr, buffer, sizeof(type), count); \
- else \
- WARN_ON_ONCE(1); \
+ range->ops->ins(range->hostdata, addr, buffer, \
+ sizeof(type), count); \
} \
- \
} \
\
void logic_outs##bw(unsigned long addr, const void *buffer, \
unsigned int count) \
{ \
+ struct logic_pio_hwaddr *range = find_io_range(addr); \
+ \
+ if (INVALID_RANGE(range)) { \
+ WARN_ON_ONCE(1); \
+ return; \
+ } \
+ \
if (addr < MMIO_UPPER_LIMIT) { \
writes##bw(PCI_IOBASE + addr, buffer, count); \
} else if (addr >= MMIO_UPPER_LIMIT && addr < IO_SPACE_LIMIT) { \
- struct logic_pio_hwaddr *entry = find_io_range(addr); \
- \
- if (entry && entry->ops) \
- entry->ops->outs(entry->hostdata, \
- addr, buffer, sizeof(type), count); \
- else \
- WARN_ON_ONCE(1); \
+ range->ops->outs(range->hostdata, addr, buffer, \
+ sizeof(type), count); \
} \
}
--
2.17.1
next prev parent reply other threads:[~2019-03-20 18:14 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-20 18:14 [PATCH v2 0/3] Fix system crash for accessing unmapped IO port regions John Garry
2019-03-20 18:14 ` [RFC PATCH v2 1/3] resource: Request IO port regions from children of ioport_resource John Garry
2019-03-25 23:32 ` Bjorn Helgaas
2019-03-26 16:33 ` John Garry
2019-03-26 22:48 ` Bjorn Helgaas
2019-03-27 11:24 ` John Garry
2019-03-28 17:46 ` Lorenzo Pieralisi
2019-03-29 10:42 ` John Garry
2019-03-29 12:22 ` Lorenzo Pieralisi
2019-04-02 9:46 ` John Garry
2019-03-20 18:14 ` John Garry [this message]
2019-03-23 19:15 ` [PATCH v2 2/3] lib: logic_pio: Reject access to unregistered CPU MMIO regions Andy Shevchenko
2019-03-25 9:59 ` John Garry
2019-03-20 18:14 ` [PATCH v2 3/3] lib: logic_pio: Make some prints explicitly hex John Garry
2019-03-23 19:12 ` Andy Shevchenko
2019-03-25 9:48 ` John Garry
2019-03-25 15:03 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1553105650-28012-3-git-send-email-john.garry@huawei.com \
--to=john.garry@huawei.com \
--cc=agraf@suse.de \
--cc=andy.shevchenko@gmail.com \
--cc=arnd@arndb.de \
--cc=bhelgaas@google.com \
--cc=bp@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=linuxarm@huawei.com \
--cc=lorenzo.pieralisi@arm.com \
--cc=rafael@kernel.org \
--cc=wangkefeng.wang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).