Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47235841 authored by Bjorn Helgaas's avatar Bjorn Helgaas
Browse files

Merge branches 'pci/hotplug' and 'pci/resource' into next 

* pci/hotplug:
  PCI: ibmphp: Remove unneeded NULL test
  PCI: hotplug: Use list_for_each_entry() to simplify code
  PCI: acpiphp_ibm: Fix null dereferences on null ibm_slot

* pci/resource:
  PCI: Avoid iterating through memory outside the resource window
  PCI: Fix minimum allocation address overwrite
parents c111e8bf 4058937a 47b975d2

drivers/pci/bus.c

+4 −2
Original line number Diff line number Diff line
@@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, 
	type_mask |= IORESOURCE_TYPE_BITS;



	pci_bus_for_each_resource(bus, r, i) {

		resource_size_t min_used = min;



		if (!r)

			continue;
@@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, 
		 * overrides "min".

		 */

		if (avail.start)

			min = avail.start;

			min_used = avail.start;



		max = avail.end;



		/* Ok, try it out.. */

		ret = allocate_resource(r, res, size, min, max,

		ret = allocate_resource(r, res, size, min_used, max,

					align, alignf, alignf_data);

		if (ret == 0)

			return 0;

drivers/pci/hotplug/acpiphp_ibm.c

+14 −3
Original line number Diff line number Diff line
@@ -154,6 +154,7 @@ static union apci_descriptor *ibm_slot_from_id(int id) 
ibm_slot_done:

	if (ret) {

		ret = kmalloc(sizeof(union apci_descriptor), GFP_KERNEL);

		if (ret)

			memcpy(ret, des, sizeof(union apci_descriptor));

	}

	kfree(table);
@@ -175,8 +176,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status) 
	acpi_status stat;

	unsigned long long rc;

	union apci_descriptor *ibm_slot;

	int id = hpslot_to_sun(slot);



	ibm_slot = ibm_slot_from_id(hpslot_to_sun(slot));

	ibm_slot = ibm_slot_from_id(id);

	if (!ibm_slot) {

		pr_err("APLS null ACPI descriptor for slot %d\n", id);

		return -ENODEV;

	}



	pr_debug("%s: set slot %d (%d) attention status to %d\n", __func__,

			ibm_slot->slot.slot_num, ibm_slot->slot.slot_id,
@@ -215,8 +221,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status) 
static int ibm_get_attention_status(struct hotplug_slot *slot, u8 *status)

{

	union apci_descriptor *ibm_slot;

	int id = hpslot_to_sun(slot);



	ibm_slot = ibm_slot_from_id(hpslot_to_sun(slot));

	ibm_slot = ibm_slot_from_id(id);

	if (!ibm_slot) {

		pr_err("APLS null ACPI descriptor for slot %d\n", id);

		return -ENODEV;

	}



	if (ibm_slot->slot.attn & 0xa0 || ibm_slot->slot.status[1] & 0x08)

		*status = 1;

drivers/pci/hotplug/ibmphp_core.c

+6 −18
Original line number Diff line number Diff line
@@ -116,11 +116,9 @@ static inline int slot_update(struct slot **sl) 
static int __init get_max_slots (void)

{

	struct slot *slot_cur;

	struct list_head *tmp;

	u8 slot_count = 0;



	list_for_each(tmp, &ibmphp_slot_head) {

		slot_cur = list_entry(tmp, struct slot, ibm_slot_list);

	list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {

		/* sometimes the hot-pluggable slots start with 4 (not always from 1) */

		slot_count = max(slot_count, slot_cur->number);

	}
@@ -501,16 +499,10 @@ static int get_bus_name(struct hotplug_slot *hotplug_slot, char *value) 
static int __init init_ops(void)

{

	struct slot *slot_cur;

	struct list_head *tmp;

	int retval;

	int rc;



	list_for_each(tmp, &ibmphp_slot_head) {

		slot_cur = list_entry(tmp, struct slot, ibm_slot_list);



		if (!slot_cur)

			return -ENODEV;



	list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {

		debug("BEFORE GETTING SLOT STATUS, slot # %x\n",

							slot_cur->number);

		if (slot_cur->ctrl->revision == 0xFF)
@@ -669,9 +661,7 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function) 
{

	struct pci_func *func_cur;

	struct slot *slot_cur;

	struct list_head *tmp;

	list_for_each(tmp, &ibmphp_slot_head) {

		slot_cur = list_entry(tmp, struct slot, ibm_slot_list);

	list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {

		if (slot_cur->func) {

			func_cur = slot_cur->func;

			while (func_cur) {
@@ -693,14 +683,12 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function) 
 *************************************************************/

static void free_slots(void)

{

	struct slot *slot_cur;

	struct list_head *tmp;

	struct list_head *next;

	struct slot *slot_cur, *next;



	debug("%s -- enter\n", __func__);



	list_for_each_safe(tmp, next, &ibmphp_slot_head) {

		slot_cur = list_entry(tmp, struct slot, ibm_slot_list);

	list_for_each_entry_safe(slot_cur, next, &ibmphp_slot_head,

				 ibm_slot_list) {

		pci_hp_deregister(slot_cur->hotplug_slot);

	}

	debug("%s -- exit\n", __func__);

drivers/pci/hotplug/ibmphp_ebda.c

+9 −15
Original line number Diff line number Diff line
@@ -1117,25 +1117,21 @@ int ibmphp_get_bus_index (u8 num) 


void ibmphp_free_bus_info_queue (void)

{

	struct bus_info *bus_info;

	struct list_head *list;

	struct list_head *next;

	struct bus_info *bus_info, *next;



	list_for_each_safe (list, next, &bus_info_head ) {

		bus_info = list_entry (list, struct bus_info, bus_info_list);

	list_for_each_entry_safe(bus_info, next, &bus_info_head,

				 bus_info_list) {

		kfree (bus_info);

	}

}



void ibmphp_free_ebda_hpc_queue (void)

{

	struct controller *controller = NULL;

	struct list_head *list;

	struct list_head *next;

	struct controller *controller = NULL, *next;

	int pci_flag = 0;



	list_for_each_safe (list, next, &ebda_hpc_head) {

		controller = list_entry (list, struct controller, ebda_hpc_list);

	list_for_each_entry_safe(controller, next, &ebda_hpc_head,

				 ebda_hpc_list) {

		if (controller->ctlr_type == 0)

			release_region (controller->u.isa_ctlr.io_start, (controller->u.isa_ctlr.io_end - controller->u.isa_ctlr.io_start + 1));

		else if ((controller->ctlr_type == 1) && (!pci_flag)) {
@@ -1148,12 +1144,10 @@ void ibmphp_free_ebda_hpc_queue (void) 


void ibmphp_free_ebda_pci_rsrc_queue (void)

{

	struct ebda_pci_rsrc *resource;

	struct list_head *list;

	struct list_head *next;

	struct ebda_pci_rsrc *resource, *next;



	list_for_each_safe (list, next, &ibmphp_ebda_pci_rsrc_head) {

		resource = list_entry (list, struct ebda_pci_rsrc, ebda_pci_rsrc_list);

	list_for_each_entry_safe(resource, next, &ibmphp_ebda_pci_rsrc_head,

				 ebda_pci_rsrc_list) {

		kfree (resource);

		resource = NULL;

	}

drivers/pci/hotplug/ibmphp_hpc.c

+8 −10
Original line number Diff line number Diff line
@@ -537,7 +537,6 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus) 
{

	void __iomem *wpg_bbar = NULL;

	struct controller *ctlr_ptr;

	struct list_head *pslotlist;

	u8 index, status;

	int rc = 0;

	int busindex;
@@ -628,8 +627,8 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus) 


			// Not used

		case READ_ALLSLOT:

			list_for_each (pslotlist, &ibmphp_slot_head) {

				pslot = list_entry (pslotlist, struct slot, ibm_slot_list);

			list_for_each_entry(pslot, &ibmphp_slot_head,

					    ibm_slot_list) {

				index = pslot->ctlr_index;

				rc = hpc_wait_ctlr_notworking (HPC_CTLR_WORKING_TOUT, ctlr_ptr,

								wpg_bbar, &status);
@@ -820,7 +819,6 @@ static int poll_hpc(void *data) 
{

	struct slot myslot;

	struct slot *pslot = NULL;

	struct list_head *pslotlist;

	int rc;

	int poll_state = POLL_LATCH_REGISTER;

	u8 oldlatchlow = 0x00;
@@ -838,10 +836,10 @@ static int poll_hpc(void *data) 
		case POLL_LATCH_REGISTER:

			oldlatchlow = curlatchlow;

			ctrl_count = 0x00;

			list_for_each (pslotlist, &ibmphp_slot_head) {

			list_for_each_entry(pslot, &ibmphp_slot_head,

					    ibm_slot_list) {

				if (ctrl_count >= ibmphp_get_total_controllers())

					break;

				pslot = list_entry (pslotlist, struct slot, ibm_slot_list);

				if (pslot->ctrl->ctlr_relative_id == ctrl_count) {

					ctrl_count++;

					if (READ_SLOT_LATCH (pslot->ctrl)) {
@@ -859,8 +857,8 @@ static int poll_hpc(void *data) 
			poll_state = POLL_SLEEP;

			break;

		case POLL_SLOTS:

			list_for_each (pslotlist, &ibmphp_slot_head) {

				pslot = list_entry (pslotlist, struct slot, ibm_slot_list);

			list_for_each_entry(pslot, &ibmphp_slot_head,

					    ibm_slot_list) {

				// make a copy of the old status

				memcpy ((void *) &myslot, (void *) pslot,

					sizeof (struct slot));
@@ -870,10 +868,10 @@ static int poll_hpc(void *data) 
					process_changeinstatus (pslot, &myslot);

			}

			ctrl_count = 0x00;

			list_for_each (pslotlist, &ibmphp_slot_head) {

			list_for_each_entry(pslot, &ibmphp_slot_head,

					    ibm_slot_list) {

				if (ctrl_count >= ibmphp_get_total_controllers())

					break;

				pslot = list_entry (pslotlist, struct slot, ibm_slot_list);

				if (pslot->ctrl->ctlr_relative_id == ctrl_count) {

					ctrl_count++;

					if (READ_SLOT_LATCH (pslot->ctrl))