Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5c6ad78 authored by Bjorn Helgaas's avatar Bjorn Helgaas Committed by Bjorn Helgaas
Browse files

Merge branch 'pci/hotplug' 

  - fix possible cpqphp NULL pointer dereference (Shawn Lin)

  - rescan more of the hierarchy on ACPI hotplug to fix Thunderbolt/xHCI
    hotplug (Mika Westerberg)

* pci/hotplug:
  ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
  PCI: cpqphp: Fix possible NULL pointer dereference
parents 315271b0 13d3047c

drivers/pci/hotplug/acpiphp_glue.c

+16 −7
Original line number Diff line number Diff line
@@ -541,6 +541,7 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot) 
{

	unsigned long long sta = 0;

	struct acpiphp_func *func;

	u32 dvid;



	list_for_each_entry(func, &slot->funcs, sibling) {

		if (func->flags & FUNC_HAS_STA) {
@@ -551,19 +552,27 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot) 
			if (ACPI_SUCCESS(status) && sta)

				break;

		} else {

			u32 dvid;



			pci_bus_read_config_dword(slot->bus,

						  PCI_DEVFN(slot->device,

							    func->function),

						  PCI_VENDOR_ID, &dvid);

			if (dvid != 0xffffffff) {

			if (pci_bus_read_dev_vendor_id(slot->bus,

					PCI_DEVFN(slot->device, func->function),

					&dvid, 0)) {

				sta = ACPI_STA_ALL;

				break;

			}

		}

	}



	if (!sta) {

		/*

		 * Check for the slot itself since it may be that the

		 * ACPI slot is a device below PCIe upstream port so in

		 * that case it may not even be reachable yet.

		 */

		if (pci_bus_read_dev_vendor_id(slot->bus,

				PCI_DEVFN(slot->device, 0), &dvid, 0)) {

			sta = ACPI_STA_ALL;

		}

	}



	return (unsigned int)sta;

}

drivers/pci/hotplug/cpqphp_ctrl.c

+5 −7
Original line number Diff line number Diff line
@@ -2812,18 +2812,16 @@ static int configure_new_function(struct controller *ctrl, struct pci_func *func 


					dbg("CND:      length = 0x%x\n", base);

					io_node = get_io_resource(&(resources->io_head), base);

					if (!io_node)

						return -ENOMEM;

					dbg("Got io_node start = %8.8x, length = %8.8x next (%p)\n",

					    io_node->base, io_node->length, io_node->next);

					dbg("func (%p) io_head (%p)\n", func, func->io_head);



					/* allocate the resource to the board */

					if (io_node) {

					base = io_node->base;



					io_node->next = func->io_head;

					func->io_head = io_node;

					} else

						return -ENOMEM;

				} else if ((temp_register & 0x0BL) == 0x08) {

					/* Map prefetchable memory */

					base = temp_register & 0xFFFFFFF0;