diff mbox series

[5.10,100/142] iwlwifi: pcie: avoid potential PNVM leaks

Message ID	20210202133001.837635827@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Johannes Berg <johannes.berg@intel.com>, Luca Coelho <luciano.coelho@intel.com>, Kalle Valo <kvalo@codeaurora.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 100/142] iwlwifi: pcie: avoid potential PNVM leaks Date: Tue, 2 Feb 2021 14:37:43 +0100 Message-Id: <20210202133001.837635827@linuxfoundation.org> In-Reply-To: <20210202132957.692094111@linuxfoundation.org> References: <20210202132957.692094111@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/142] nbd: freeze the queue while were adding connections [5.10,003/142] tty: avoid using vfs_iocb_iter_write() for redirected console writes [5.10,004/142] ACPI: sysfs: Prefer "compatible" modalias [5.10,005/142] ACPI: thermal: Do not call acpi_thermal_check() directly [5.10,006/142] kernel: kexec: remove the lock operation of system_transition_mutex [5.10,007/142] ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 [5.10,008/142] ALSA: hda/via: Apply the workaround generically for Clevo machines [5.10,009/142] parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES [5.10,010/142] media: cec: add stm32 driver [5.10,011/142] media: cedrus: Fix H264 decoding [5.10,012/142] media: hantro: Fix reset_raw_fmt initialization [5.10,013/142] media: rc: fix timeout handling after switch to microsecond durations [5.10,014/142] media: rc: ite-cir: fix min_timeout calculation [5.10,015/142] media: rc: ensure that uevent can be read directly after rc device register [5.10,016/142] ARM: dts: tbs2910: rename MMC node aliases [5.10,017/142] ARM: dts: ux500: Reserve memory carveouts [5.10,018/142] ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming [5.10,019/142] wext: fix NULL-ptr-dereference with cfg80211s lack of commit() [5.10,020/142] x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled [5.10,021/142] ASoC: AMD Renoir - refine DMI entries for some Lenovo products [5.10,022/142] Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)" [5.10,023/142] drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors [5.10,024/142] drm/i915: Always flush the active worker before returning from the wait [5.10,025/142] drm/i915/gt: Always try to reserve GGTT address 0x0 [5.10,026/142] drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes [5.10,027/142] bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FE... [5.10,028/142] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family [5.10,029/142] s390: uv: Fix sysfs max number of VCPUs reporting [5.10,030/142] s390/vfio-ap: No need to disable IRQ after queue reset [5.10,031/142] PM: hibernate: flush swap writer after marking [5.10,032/142] x86/entry: Emit a symbol for register restoring thunk [5.10,033/142] efi/apple-properties: Reinstate support for boolean properties [5.10,034/142] crypto: marvel/cesa - Fix tdma descriptor on 64-bit [5.10,035/142] drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs [5.10,036/142] drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] [5.10,037/142] btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch [5.10,038/142] btrfs: fix possible free space tree corruption with online conversion [5.10,039/142] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] [5.10,040/142] KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() [5.10,041/142] KVM: arm64: Filter out v8.1+ events on v8.0 HW [5.10,042/142] KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit [5.10,043/142] KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX [5.10,044/142] KVM: nVMX: Sync unsyncd vmcs02 state to vmcs12 on migration [5.10,045/142] KVM: x86: get smi pending status correctly [5.10,046/142] KVM: Forbid the use of tagged userspace addresses for memslots [5.10,047/142] io_uring: fix wqe->lock/completion_lock deadlock [5.10,048/142] xen: Fix XenStore initialisation for XS_LOCAL [5.10,049/142] leds: trigger: fix potential deadlock with libata [5.10,050/142] arm64: dts: broadcom: Fix USB DMA address translation for Stingray [5.10,051/142] mt7601u: fix kernel crash unplugging the device [5.10,052/142] mt76: mt7663s: fix rx buffer refcounting [5.10,053/142] mt7601u: fix rx buffer refcounting [5.10,054/142] iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit. [5.10,055/142] drm/i915/gt: Clear CACHE_MODE prior to clearing residuals [5.10,056/142] drm/i915/pmu: Dont grab wakeref when enabling events [5.10,057/142] net/mlx5e: Fix IPSEC stats [5.10,058/142] ARM: dts: imx6qdl-kontron-samx6i: fix pwms for lcd-backlight [5.10,059/142] drm/nouveau/svm: fail NOUVEAU_SVM_INIT ioctl on unsupported devices [5.10,060/142] drm/vc4: Correct lbm size and calculation [5.10,061/142] drm/vc4: Correct POS1_SCL for hvs5 [5.10,062/142] drm/nouveau/dispnv50: Restore pushing of all data. [5.10,063/142] drm/i915: Check for all subplatform bits [5.10,064/142] drm/i915/selftest: Fix potential memory leak [5.10,065/142] uapi: fix big endian definition of ipv6_rpl_sr_hdr [5.10,066/142] KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM [5.10,067/142] tee: optee: replace might_sleep with cond_resched [5.10,068/142] xen-blkfront: allow discard-* nodes to be optional [5.10,069/142] blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue [5.10,070/142] clk: imx: fix Kconfig warning for i.MX SCU clk [5.10,071/142] clk: mmp2: fix build without CONFIG_PM [5.10,072/142] clk: qcom: gcc-sm250: Use floor ops for sdcc clks [5.10,073/142] ARM: imx: build suspend-imx6.S with arm instruction set [5.10,074/142] ARM: zImage: atags_to_fdt: Fix node names on added root nodes [5.10,075/142] netfilter: nft_dynset: add timeout extension to template [5.10,076/142] Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion" [5.10,077/142] Revert "block: simplify set_init_blocksize" to regain lost performance [5.10,078/142] xfrm: Fix oops in xfrm_replay_advance_bmp [5.10,079/142] xfrm: fix disable_xfrm sysctl when used on xfrm interfaces [5.10,080/142] selftests: xfrm: fix test return value override issue in xfrm_policy.sh [5.10,081/142] xfrm: Fix wraparound in xfrm_policy_addr_delta() [5.10,082/142] arm64: dts: ls1028a: fix the offset of the reset register [5.10,083/142] ARM: imx: fix imx8m dependencies [5.10,084/142] ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status [5.10,085/142] ARM: dts: imx6qdl-sr-som: fix some cubox-i platforms [5.10,086/142] arm64: dts: imx8mp: Correct the gpio ranges of gpio3 [5.10,087/142] firmware: imx: select SOC_BUS to fix firmware build [5.10,088/142] RDMA/cxgb4: Fix the reported max_recv_sge value [5.10,089/142] ASoC: dt-bindings: lpass: Fix and common up lpass dai ids [5.10,090/142] ASoC: qcom: Fix incorrect volatile registers [5.10,091/142] ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY [5.10,092/142] ASoC: qcom: lpass-ipq806x: fix bitwidth regmap field [5.10,093/142] spi: altera: Fix memory leak on error path [5.10,094/142] ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete [5.10,095/142] powerpc/64s: prevent recursive replay_soft_interrupts causing superfluous interrupt [5.10,096/142] pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() [5.10,097/142] pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn [5.10,098/142] ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies [5.10,099/142] ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup [5.10,100/142] iwlwifi: pcie: avoid potential PNVM leaks [5.10,101/142] iwlwifi: pnvm: dont skip everything when not reloading [5.10,102/142] iwlwifi: pnvm: dont try to load after failures [5.10,103/142] iwlwifi: pcie: set LTR on more devices [5.10,104/142] iwlwifi: pcie: use jiffies for memory read spin time limit [5.10,105/142] iwlwifi: pcie: reschedule in long-running memory reads [5.10,106/142] mac80211: pause TX while changing interface type [5.10,107/142] ice: fix FDir IPv6 flexbyte [5.10,108/142] ice: Implement flow for IPv6 next header (extension header) [5.10,109/142] ice: update dev_addr in ice_set_mac_address even if HW filter exists [5.10,110/142] ice: Dont allow more channels than LAN MSI-X available [5.10,111/142] ice: Fix MSI-X vector fallback logic [5.10,112/142] i40e: acquire VSI pointer only after VF is initialized [5.10,113/142] igc: fix link speed advertising [5.10,114/142] net/mlx5: Fix memory leak on flow table creation error flow [5.10,115/142] net/mlx5e: E-switch, Fix rate calculation for overflow [5.10,116/142] net/mlx5e: free page before return [5.10,117/142] net/mlx5e: Reduce tc unsupported key print level [5.10,118/142] net/mlx5: Maintain separate page trees for ECPF and PF functions [5.10,119/142] net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled [5.10,120/142] net/mlx5e: Fix CT rule + encap slow path offload and deletion [5.10,121/142] net/mlx5e: Correctly handle changing the number of queues when the interface is down [5.10,122/142] net/mlx5e: Revert parameters on errors when changing trust state without reset [5.10,123/142] net/mlx5e: Revert parameters on errors when changing MTU and LRO state without reset [5.10,124/142] net/mlx5: CT: Fix incorrect removal of tuple_nat_node from nat rhashtable [5.10,125/142] can: dev: prevent potential information leak in can_fill_info() [5.10,126/142] ACPI/IORT: Do not blindly trust DMA masks from firmware [5.10,127/142] of/device: Update dma_range_map only when dev has valid dma-ranges [5.10,128/142] iommu/amd: Use IVHD EFR for early initialization of IOMMU features [5.10,129/142] iommu/vt-d: Correctly check addr alignment in qi_flush_dev_iotlb_pasid() [5.10,130/142] nvme-multipath: Early exit if no path is available [5.10,131/142] selftests: forwarding: Specify interface when invoking mausezahn [5.10,132/142] rxrpc: Fix memory leak in rxrpc_lookup_local [5.10,133/142] NFC: fix resource leak when target index is invalid [5.10,134/142] NFC: fix possible resource leak [5.10,135/142] ASoC: mediatek: mt8183-da7219: ignore TDM DAI link by default [5.10,136/142] ASoC: mediatek: mt8183-mt6358: ignore TDM DAI link by default [5.10,137/142] ASoC: topology: Properly unregister DAI on removal [5.10,138/142] ASoC: topology: Fix memory corruption in soc_tplg_denum_create_values() [5.10,139/142] scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit [5.10,140/142] team: protect features update by RCU to avoid deadlock [5.10,141/142] tcp: make TCP_USER_TIMEOUT accurate for zero window probes [5.10,142/142] tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN

Commit Message

Greg Kroah-Hartman Feb. 2, 2021, 1:37 p.m. UTC

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 34b9434cd0d425330a0467e767f8d047ef62964d ]

If we erroneously try to set the PNVM data again after it has
already been set, we could leak the old DMA memory. Avoid that
and warn, we shouldn't be doing this.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20210115130252.929c2d680429.I086b9490e6c005f3bcaa881b617e9f61908160f3@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 +++
 1 file changed, 3 insertions(+)

diff mbox series

Patch

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
index 5512e3c630c31..eeb87cf5ee857 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -341,6 +341,9 @@  int iwl_trans_pcie_ctx_info_gen3_set_pnvm(struct iwl_trans *trans,
 		return ret;
 	}
 
+	if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
+		return -EBUSY;
+
 	prph_sc_ctrl->pnvm_cfg.pnvm_base_addr =
 		cpu_to_le64(trans_pcie->pnvm_dram.physical);
 	prph_sc_ctrl->pnvm_cfg.pnvm_size =