Wenwen Wang
6b995f4eec
misc: mic: fix a DMA pool free failure ...
In _scif_prog_signal(), the boolean variable 'x100' is used to indicate
whether the MIC Coprocessor is X100. If 'x100' is true, the status
descriptor will be used to write the value to the destination. Otherwise, a
DMA pool will be allocated for this purpose. Specifically, if the DMA pool
is allocated successfully, two memory addresses will be returned. One is
for the CPU and the other is for the device to access the DMA pool. The
former is stored to the variable 'status' and the latter is stored to the
variable 'src'. After the allocation, the address in 'src' is saved to
'status->src_dma_addr', which is actually in the DMA pool, and 'src' is
then modified.
Later on, if an error occurs, the execution flow will transfer to the label
'dma_fail', which will check 'x100' and free up the allocated DMA pool if
'x100' is false. The point here is that 'status->src_dma_addr' is used for
freeing up the DMA pool. As mentioned before, 'status->src_dma_addr' is in
the DMA pool. And thus, the device is able to modify this data. This can
potentially cause failures when freeing up the DMA pool because of the
modified device address.
This patch avoids the above issue by using the variable 'src' (with
necessary calculation) to free up the DMA pool.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-15 20:47:40 +02:00
Merge branch 'acpi-bus'
2018-09-07 10:05:20 +02:00
binder: make symbol 'binder_free_buf' static
2018-10-02 15:53:53 -07:00
for-linus-20180920
2018-09-21 09:41:05 +02:00
Char/Misc driver patches for 4.19-rc1
2018-08-18 11:04:51 -07:00
Char/Misc fixes for 4.19-rc7
2018-10-07 08:15:57 +02:00
for-linus-20180929
2018-09-29 14:52:14 -07:00
Bluetooth: hci_ldisc: Free rw_semaphore on close
2018-09-11 13:33:57 +02:00
Merge branch 'perm-fix' into omap-for-v4.19/fixes-v2
2018-08-28 09:58:03 -07:00
cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
2018-08-29 08:09:20 -06:00
A few fixes that came around or after the merge window, except
2018-09-12 19:33:56 -10:00
clk: x86: Stop marking clocks as CLK_IS_CRITICAL
2018-09-17 18:47:58 -07:00
clocksource/drivers/timer-atmel-pit: Properly handle error cases
2018-09-27 12:01:45 +02:00
cpufreq: qcom-kryo: Fix section annotations
2018-09-29 15:01:10 +02:00
cpuidle: menu: Retain tick when shallow state is selected
2018-08-25 13:16:08 +02:00
crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()
2018-09-28 12:45:37 +08:00
device-dax: Add missing address_space_operations
2018-09-22 09:07:33 -07:00
Char/Misc driver patches for 4.19-rc1
2018-08-18 11:04:51 -07:00
dmaengine: mic_x100_dma: use devm_kzalloc to fix an issue
2018-08-27 11:16:04 +05:30
EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[]
2018-08-17 15:13:34 +02:00
extcon: int3496: Convert to use SPDX identifier
2018-08-28 11:21:15 +09:00
firewire: use 64-bit time_t based interfaces
2018-08-17 16:20:27 -07:00
gsmi: Add GSMI commands to log S0ix info
2018-10-15 20:32:26 +02:00
Merge 4.19-rc7 into char-misc-next
2018-10-08 15:33:21 +02:00
gpiolib: Free the last requested descriptor
2018-09-18 16:36:05 -07:00
Merge branch 'drm-fixes-4.19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
2018-10-05 08:39:35 +10:00
HID: intel-ish-hid: Enable Ice Lake mobile
2018-09-24 11:46:15 +02:00
Merge 4.19-rc7 into char-misc-next
2018-10-08 15:33:21 +02:00
Various bug fixes for nct6775 driver
2018-09-19 22:59:30 +02:00
stm class: Use memcat_p()
2018-10-11 12:12:55 +02:00
i2c: designware: Call i2c_dw_clk_rate() only when calculating timings
2018-10-05 13:40:05 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide
2018-08-22 07:40:33 -07:00
First set of IIO fixes for the 4.19 cycle.
2018-09-09 09:33:29 +02:00
Second rc pull request
2018-09-27 21:53:55 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2018-09-28 18:04:50 -07:00
iommu/amd: Clear memory encryption mask from physical address
2018-10-05 10:20:24 +02:00
irqchip/gic-v3-its: Cap lpi_id_bits to reduce memory footprint
2018-09-06 20:31:59 +02:00
isdn: Disable IIOCDBGVAR
2018-08-16 12:26:24 -07:00
macintosh: therm_windtunnel: drop using attach_adapter
2018-08-24 14:42:42 +02:00
mailbox: Add support for i.MX messaging unit
2018-08-15 09:53:07 +05:30
- Fix a DM thinp __udivdi3 undefined on 32-bit bug introduced during
2018-10-05 16:09:56 -07:00
media: v4l: event: Prevent freeing event subscriptions while accessed
2018-10-03 06:32:51 -04:00
memory: ti-aemif: fix a potential NULL-pointer dereference
2018-09-06 10:04:07 -07:00
mfd: omap-usb-host: Fix dts probe of children
2018-09-11 16:47:33 +01:00
misc: mic: fix a DMA pool free failure
2018-10-15 20:47:40 +02:00
mmc: slot-gpio: Fix debounce time to use miliseconds again
2018-09-28 17:43:48 +02:00
mtd: devices: m25p80: Make sure the buffer passed in op is DMA-able
2018-09-18 10:17:48 +02:00
net: mvpp2: Extract the correct ethtype from the skb for tx csum offload
2018-10-05 14:52:43 -07:00
libnvdimm-for-4.19_dax-memory-failure
2018-08-25 18:43:59 -07:00
nvme: properly propagate errors in nvme_mpath_init
2018-09-25 16:21:40 -07:00
nvmem: hide unused nvmem_find_cell_by_index function
2018-10-15 15:56:15 +02:00
Devicetree fixes for 4.19, part 2:
2018-09-14 13:03:17 -10:00
Char/Misc driver patches for 4.19-rc1
2018-08-18 11:04:51 -07:00
pci-v4.19-fixes-3
2018-10-05 16:11:16 -07:00
pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function
2018-08-18 12:30:42 -07:00
Char/Misc driver patches for 4.19-rc1
2018-08-18 11:04:51 -07:00
Revert "pinctrl: intel: Do pin translation when lock IRQ"
2018-09-25 12:50:00 +02:00
platform: goldfish: pipe: Add a blank line to separate varibles and code
2018-10-15 20:36:46 +02:00
treewide: convert ISO_8859-1 text comments to utf-8
2018-08-23 18:48:43 -07:00
Char/Misc driver patches for 4.19-rc1
2018-08-18 11:04:51 -07:00
pwm: mediatek: Add MT7628 support
2018-08-20 11:36:07 +02:00
drivers/rapidio/devices/rio_mport_cdev.c: remove redundant pointer md
2018-08-22 10:52:51 -07:00
regulator: fix crash caused by null driver data
2018-09-20 09:04:51 -07:00
remoteproc/davinci: use the reset framework
2018-08-16 17:39:55 -07:00
ARM: SoC: late updates
2018-08-25 14:12:36 -07:00
RTC for 4.19
2018-08-20 16:30:27 -07:00
s390: qeth: Fix potential array overrun in cmd/rc lookup
2018-09-28 10:27:26 -07:00
scsi: qedi: Initialize the stats mutex lock
2018-09-28 02:28:05 -04:00
slimbus: core: add support to uevent
2018-09-25 20:21:02 +02:00
soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift()
2018-09-25 13:57:26 -07:00
soundwire: intel: Remove duplicate assignment
2018-08-27 09:49:48 +05:30
spi: Fixes for v4.19
2018-09-28 18:04:06 -07:00
ssb: Remove SSB_WARN_ON, SSB_BUG_ON and SSB_DEBUG
2018-08-09 18:47:47 +03:00
media fixes for v4.19-rc5
2018-09-24 15:16:41 +02:00
scsi: target: iscsi: Use bin2hex instead of a re-implementation
2018-09-21 12:32:30 -04:00
ARM: SoC driver updates
2018-08-23 13:52:46 -07:00
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
2018-08-28 16:11:34 -07:00
Merge 4.19-rc7 into char-misc-next
2018-10-08 15:33:21 +02:00
Revert "serial: sh-sci: Allow for compressed SCIF address"
2018-10-02 14:38:16 -07:00
uio: Convert a few more users to using %pOFn instead of device_node.name
2018-10-02 15:59:29 -07:00
usb: xhci-mtk: resume USB3 roothub first
2018-10-01 17:59:02 -07:00
powerpc updates for 4.19
2018-08-17 11:32:50 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-08-27 11:59:39 -07:00
video/fbdev/stifb: Fix spelling mistake in fall-through annotation
2018-09-26 18:50:54 +02:00
virtio, vhost: fixes, tweaks
2018-08-24 08:45:19 -07:00
vme: remove unneeded kfree
2018-09-14 15:25:57 +02:00
w1: omap-hdq: fix missing bus unregister at removal
2018-10-02 15:36:10 -07:00
include/linux/compiler*.h: make compiler-*.h mutually exclusive
2018-08-22 17:31:34 -07:00
xen: issue warning message when out of grant maptrack entries
2018-09-19 11:27:42 -04:00
Char/Misc driver patches for 4.19-rc1
2018-08-18 11:04:51 -07:00
6b995f4eec