All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	"Sergei Shtylyov" <sergei.shtylyov@cogentembedded.com>,
	"Lorenzo Pieralisi" <lorenzo.pieralisi@arm.com>,
	"Bjorn Helgaas" <bhelgaas@google.com>,
	"Thomas Petazzoni" <thomas.petazzoni@bootlin.com>,
	"Linus Walleij" <linus.walleij@linaro.org>,
	"Marek Behún" <kabel@kernel.org>
Subject: [PATCH 4.14 032/106] PCI: aardvark: Fix I/O space page leak
Date: Mon,  6 Dec 2021 15:55:40 +0100	[thread overview]
Message-ID: <20211206145556.468249434@linuxfoundation.org> (raw)
In-Reply-To: <20211206145555.386095297@linuxfoundation.org>

From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

commit 1df3e5b3feebf29a3ecfa0c0f06f79544ca573e4 upstream.

When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
driver was left disabled, the kernel crashed with this BUG:

  kernel BUG at lib/ioremap.c:72!
  Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
  Hardware name: Renesas Condor board based on r8a77980 (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80000005 (Nzcv daif -PAN -UAO)
  pc : ioremap_page_range+0x370/0x3c8
  lr : ioremap_page_range+0x40/0x3c8
  sp : ffff000008da39e0
  x29: ffff000008da39e0 x28: 00e8000000000f07
  x27: ffff7dfffee00000 x26: 0140000000000000
  x25: ffff7dfffef00000 x24: 00000000000fe100
  x23: ffff80007b906000 x22: ffff000008ab8000
  x21: ffff000008bb1d58 x20: ffff7dfffef00000
  x19: ffff800009c30fb8 x18: 0000000000000001
  x17: 00000000000152d0 x16: 00000000014012d0
  x15: 0000000000000000 x14: 0720072007200720
  x13: 0720072007200720 x12: 0720072007200720
  x11: 0720072007300730 x10: 00000000000000ae
  x9 : 0000000000000000 x8 : ffff7dffff000000
  x7 : 0000000000000000 x6 : 0000000000000100
  x5 : 0000000000000000 x4 : 000000007b906000
  x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
  x1 : 0000000040000000 x0 : 00e80000fe100f07
  Process kworker/0:1 (pid: 39, stack limit = 0x        (ptrval))
  Call trace:
   ioremap_page_range+0x370/0x3c8
   pci_remap_iospace+0x7c/0xac
   pci_parse_request_of_pci_ranges+0x13c/0x190
   rcar_pcie_probe+0x4c/0xb04
   platform_drv_probe+0x50/0xbc
   driver_probe_device+0x21c/0x308
   __device_attach_driver+0x98/0xc8
   bus_for_each_drv+0x54/0x94
   __device_attach+0xc4/0x12c
   device_initial_probe+0x10/0x18
   bus_probe_device+0x90/0x98
   deferred_probe_work_func+0xb0/0x150
   process_one_work+0x12c/0x29c
   worker_thread+0x200/0x3fc
   kthread+0x108/0x134
   ret_from_fork+0x10/0x18
  Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)

It turned out that pci_remap_iospace() wasn't undone when the driver's
probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
the probe was retried, finally causing the BUG due to trying to remap
already remapped pages.

The Aardvark PCI controller driver has the same issue.
Replace pci_remap_iospace() with its devm_ managed version to fix the bug.

Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[lorenzo.pieralisi@arm.com: updated the commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/host/pci-aardvark.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -932,7 +932,7 @@ static int advk_pcie_parse_request_of_pc
 					     0,	0xF8000000, 0,
 					     lower_32_bits(res->start),
 					     OB_PCIE_IO);
-			err = pci_remap_iospace(res, iobase);
+			err = devm_pci_remap_iospace(dev, res, iobase);
 			if (err) {
 				dev_warn(dev, "error %d: failed to map resource %pR\n",
 					 err, res);



  parent reply	other threads:[~2021-12-06 15:08 UTC|newest]

Thread overview: 110+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-06 14:55 [PATCH 4.14 000/106] 4.14.257-rc1 review Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 001/106] USB: serial: option: add Telit LE910S1 0x9200 composition Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 002/106] USB: serial: option: add Fibocom FM101-GL variants Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 003/106] usb: hub: Fix usb enumeration issue due to address0 race Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 004/106] usb: hub: Fix locking issues with address0_mutex Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 005/106] binder: fix test regression due to sender_euid change Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 006/106] ALSA: ctxfi: Fix out-of-range access Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 007/106] media: cec: copy sequence field for the reply Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 008/106] HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 009/106] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 010/106] fuse: fix page stealing Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 011/106] xen: dont continue xenstore initialization in case of errors Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 012/106] xen: detect uninitialized xenbus in xenbus_init Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 013/106] tracing: Fix pid filtering when triggers are attached Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 014/106] netfilter: ipvs: Fix reuse connection if RS weight is 0 Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 015/106] ARM: dts: BCM5301X: Fix I2C controller interrupt Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 016/106] ARM: dts: BCM5301X: Add interrupt properties to GPIO node Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 017/106] ASoC: topology: Add missing rwsem around snd_ctl_remove() calls Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 018/106] net: ieee802154: handle iftypes as u32 Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 019/106] NFSv42: Dont fail clone() unless the OP_CLONE operation failed Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 020/106] ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 021/106] scsi: mpt3sas: Fix kernel panic during drive powercycle test Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 022/106] drm/vc4: fix error code in vc4_create_object() Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 023/106] ipv6: fix typos in __ip6_finish_output() Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 024/106] net/smc: Ensure the active closing peer first closes clcsock Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 025/106] PM: hibernate: use correct mode for swsusp_close() Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 026/106] tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 027/106] MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 028/106] net/smc: Dont call clcsock shutdown twice when smc shutdown Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 029/106] vhost/vsock: fix incorrect used length reported to the guest Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 030/106] tracing: Check pid filtering when creating events Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 031/106] s390/mm: validate VMA in PGSTE manipulation functions Greg Kroah-Hartman
2021-12-06 14:55 ` Greg Kroah-Hartman [this message]
2021-12-06 14:55 ` [PATCH 4.14 033/106] PCI: aardvark: Fix a leaked reference by adding missing of_node_put() Greg Kroah-Hartman
2021-12-06 14:55   ` Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 034/106] PCI: aardvark: Wait for endpoint to be ready before training link Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 035/106] PCI: aardvark: Train link immediately after enabling training Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 036/106] PCI: aardvark: Improve link training Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 037/106] PCI: aardvark: Issue PERST via GPIO Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 038/106] PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 039/106] PCI: aardvark: Indicate error in val when config read fails Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 040/106] PCI: aardvark: Introduce an advk_pcie_valid_device() helper Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 041/106] PCI: aardvark: Dont touch PCIe registers if no card connected Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 042/106] PCI: aardvark: Fix compilation on s390 Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 043/106] PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link() Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 044/106] PCI: aardvark: Update comment about disabling link training Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 045/106] PCI: aardvark: Remove PCIe outbound window configuration Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 046/106] PCI: aardvark: Configure PCIe resources from ranges DT property Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 047/106] PCI: aardvark: Fix PCIe Max Payload Size setting Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 048/106] PCI: Add PCI_EXP_LNKCTL2_TLS* macros Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 049/106] PCI: aardvark: Fix link training Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 050/106] PCI: aardvark: Fix checking for link up via LTSSM state Greg Kroah-Hartman
2021-12-06 14:55 ` [PATCH 4.14 051/106] pinctrl: armada-37xx: Correct mpp definitions Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 052/106] pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 053/106] pinctrl: armada-37xx: Correct PWM pins definitions Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 054/106] arm64: dts: marvell: armada-37xx: declare PCIe reset pin Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 055/106] arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 056/106] hugetlbfs: flush TLBs correctly after huge_pmd_unshare Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 057/106] proc/vmcore: fix clearing user buffer by properly using clear_user() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 058/106] NFC: add NCI_UNREG flag to eliminate the race Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 059/106] fuse: release pipe buf after last use Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 060/106] xen: sync include/xen/interface/io/ring.h with Xens newest version Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 061/106] xen/blkfront: read response from backend only once Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 062/106] xen/blkfront: dont take local copy of a request from the ring page Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 063/106] xen/blkfront: dont trust the backend response data blindly Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 064/106] xen/netfront: read response from backend only once Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 065/106] xen/netfront: dont read data from request on the ring page Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 066/106] xen/netfront: disentangle tx_skb_freelist Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 067/106] xen/netfront: dont trust the backend response data blindly Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 068/106] tty: hvc: replace BUG_ON() with negative return value Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 069/106] shm: extend forced shm destroy to support objects from several IPC nses Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 070/106] ipc: WARN if trying to remove ipc object which is absent Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 071/106] NFSv42: Fix pagecache invalidation after COPY/CLONE Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 072/106] hugetlb: take PMD sharing into account when flushing tlb/caches Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 073/106] net: return correct error code Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 074/106] platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 075/106] s390/setup: avoid using memblock_enforce_memory_limit Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 076/106] btrfs: check-integrity: fix a warning on write caching disabled disk Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 077/106] thermal: core: Reset previous low and high trip during thermal zone init Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 078/106] scsi: iscsi: Unblock session then wake up error handler Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 079/106] ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 080/106] net: tulip: de4x5: fix the problem that the array lp->phy[8] may be out of bound Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 081/106] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 082/106] perf hist: Fix memory leak of a perf_hpp_fmt Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 083/106] vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 084/106] kprobes: Limit max data_size of the kretprobe instances Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 085/106] sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 086/106] sata_fsl: fix warning in remove_proc_entry " Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 087/106] fs: add fget_many() and fput_many() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 088/106] fget: check that the fd still exists after getting a ref to it Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 089/106] natsemi: xtensa: fix section mismatch warnings Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 090/106] net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 091/106] net: mpls: Fix notifications when deleting a device Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 092/106] siphash: use _unaligned version by default Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 093/106] net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 094/106] net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 095/106] net/rds: correct socket tunable error in rds_tcp_tune() Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 096/106] net/smc: Keep smc_close_final rc during active close Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 097/106] parisc: Fix KBUILD_IMAGE for self-extracting kernel Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 098/106] parisc: Fix "make install" on newer debian releases Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 099/106] vgacon: Propagate console boot parameters before calling `vc_resize Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 100/106] xhci: Fix commad ring abort, write all 64 bits to CRCR register Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 101/106] usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 102/106] x86/64/mm: Map all kernel memory into trampoline_pgd Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 103/106] tty: serial: msm_serial: Deactivate RX DMA for polling support Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 104/106] serial: pl011: Add ACPI SBSA UART match id Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 105/106] serial: core: fix transmit-buffer reset and memleak Greg Kroah-Hartman
2021-12-06 14:56 ` [PATCH 4.14 106/106] parisc: Mark cr16 CPU clocksource unstable on all SMP machines Greg Kroah-Hartman
2021-12-07  9:36 ` [PATCH 4.14 000/106] 4.14.257-rc1 review Jon Hunter
2021-12-07 20:40 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211206145556.468249434@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=bhelgaas@google.com \
    --cc=kabel@kernel.org \
    --cc=linus.walleij@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lorenzo.pieralisi@arm.com \
    --cc=sergei.shtylyov@cogentembedded.com \
    --cc=stable@vger.kernel.org \
    --cc=thomas.petazzoni@bootlin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.