提交 b27bee6f 编写于 作者: F fengsheng 提交者: Xie XiuQi

drivers : sysctl fixup memory usage issues

driver inclusion
category: Bugfix
bugzilla: NA
CVE: NA

1. fixup Memory use after free issue when driver uninstall
2. ut_hisi_sysctl_get_hllc_crc_ecc add input parameter judgment
Signed-off-by: Nfengsheng <fengsheng5@huawei.com>
Reviewed-by: Nzhangmu <zhangmu1@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 af8692ce
...@@ -48,9 +48,8 @@ ...@@ -48,9 +48,8 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#define DEBUG #define DEBUG
#define SYSCTL_DRIVER_VERSION "1.8.15.0" #define SYSCTL_DRIVER_VERSION "1.8.15.2"
/* debug���� */
unsigned int g_sysctrl_debug; unsigned int g_sysctrl_debug;
/* sysctrl reg base address */ /* sysctrl reg base address */
...@@ -668,6 +667,9 @@ unsigned long ut_hisi_sysctl_get_hllc_crc_ecc(u8 chip_id, u32 hllc_id) ...@@ -668,6 +667,9 @@ unsigned long ut_hisi_sysctl_get_hllc_crc_ecc(u8 chip_id, u32 hllc_id)
unsigned int ret; unsigned int ret;
hllc_crc_ecc_info hllc_crc_ecc; hllc_crc_ecc_info hllc_crc_ecc;
if (hllc_id >= HLLC_NUM_MAX)
return SYSCTL_ERR_PARAM; /* the upper 32 bits. */
memset(&hllc_crc_ecc, 0, sizeof(hllc_crc_ecc_info)); memset(&hllc_crc_ecc, 0, sizeof(hllc_crc_ecc_info));
ret = hisi_sysctl_get_hllc_crc_ecc(chip_id, &hllc_crc_ecc); ret = hisi_sysctl_get_hllc_crc_ecc(chip_id, &hllc_crc_ecc);
pr_info("hllc_crc_ecc.hllc_crc_ecc[%d]:0x%x.\n", hllc_id, hllc_crc_ecc.hllc_crc_ecc[hllc_id]); pr_info("hllc_crc_ecc.hllc_crc_ecc[%d]:0x%x.\n", hllc_id, hllc_crc_ecc.hllc_crc_ecc[hllc_id]);
......
...@@ -126,17 +126,17 @@ static int sysctl_tdh_mem_access_open(u8 chip_id) ...@@ -126,17 +126,17 @@ static int sysctl_tdh_mem_access_open(u8 chip_id)
static inline bool sysctl_is_hest_type_generic_v2(struct ghes *ghes) static inline bool sysctl_is_hest_type_generic_v2(struct ghes *ghes)
{ {
return ghes->generic->header.type == ACPI_HEST_TYPE_GENERIC_ERROR_V2; return ghes->generic->header.type == ACPI_HEST_TYPE_GENERIC_ERROR_V2;
} }
static int sysctl_map_gen_v2(const struct ghes *ghes) static int sysctl_map_gen_v2(const struct ghes *ghes)
{ {
return apei_map_generic_address(&ghes->generic_v2->read_ack_register); return apei_map_generic_address(&ghes->generic_v2->read_ack_register);
} }
static void sysctl_unmap_gen_v2(const struct ghes *ghes) static void sysctl_unmap_gen_v2(const struct ghes *ghes)
{ {
apei_unmap_generic_address(&ghes->generic_v2->read_ack_register); apei_unmap_generic_address(&ghes->generic_v2->read_ack_register);
} }
static int sysctl_correlation_reg_report(const struct hisi_oem_type1_err_sec *ras_cper) static int sysctl_correlation_reg_report(const struct hisi_oem_type1_err_sec *ras_cper)
{ {
...@@ -381,15 +381,6 @@ static int sysctl_ghes_read_estatus(struct ghes *sysctl_ghes, int silent) ...@@ -381,15 +381,6 @@ static int sysctl_ghes_read_estatus(struct ghes *sysctl_ghes, int silent)
goto error_read_block; goto error_read_block;
} }
pr_info("[INFO] SYSCTL RAS HISILICON Error : ghes source id is %d.\n",
sysctl_ghes->generic->header.source_id);
pr_info("[INFO] SYSCTL RAS HISILICON Error : error status addr is 0x%llx.\n",
sysctl_ghes->buffer_paddr);
pr_info("[INFO] SYSCTL RAS HISILICON Error : data_length is %d.\n",
sysctl_ghes->estatus->data_length);
pr_info("[INFO] SYSCTL RAS HISILICON Error : severity is %d.\n",
sysctl_ghes->estatus->error_severity);
if (cper_estatus_check(sysctl_ghes->estatus)) { if (cper_estatus_check(sysctl_ghes->estatus)) {
pr_err("[ERROR] SYSCTL RAS cper_estatus_check fail.\n"); pr_err("[ERROR] SYSCTL RAS cper_estatus_check fail.\n");
goto error_read_block; goto error_read_block;
...@@ -467,8 +458,6 @@ static int sysctl_hisi_error_handler(struct work_struct *work) ...@@ -467,8 +458,6 @@ static int sysctl_hisi_error_handler(struct work_struct *work)
struct ghes *sysctl_ghes = NULL; struct ghes *sysctl_ghes = NULL;
(void)work; (void)work;
pr_info("[INFO] SYSCTL RAS %s start.\n", __func__);
rcu_read_lock(); rcu_read_lock();
list_for_each_entry_rcu(sysctl_ghes, &hisi_ghes_list, list) { list_for_each_entry_rcu(sysctl_ghes, &hisi_ghes_list, list) {
if (!sysctl_ghes_proc(sysctl_ghes)) if (!sysctl_ghes_proc(sysctl_ghes))
...@@ -476,9 +465,6 @@ static int sysctl_hisi_error_handler(struct work_struct *work) ...@@ -476,9 +465,6 @@ static int sysctl_hisi_error_handler(struct work_struct *work)
} }
rcu_read_unlock(); rcu_read_unlock();
pr_info("[INFO] SYSCTL RAS sysctl_ghes_proc ret: %d.\n", ret);
pr_info("[INFO] SYSCTL RAS %s end.\n", __func__);
return ret; return ret;
} }
...@@ -559,6 +545,7 @@ int hip_sysctl_local_ras_init(void) ...@@ -559,6 +545,7 @@ int hip_sysctl_local_ras_init(void)
static void his_ghes_list_free(void) static void his_ghes_list_free(void)
{ {
struct ghes *node = NULL; struct ghes *node = NULL;
struct ghes *tmp_node = NULL;
rcu_read_lock(); rcu_read_lock();
list_for_each_entry_rcu(node, &hisi_ghes_list, list) { list_for_each_entry_rcu(node, &hisi_ghes_list, list) {
...@@ -574,8 +561,27 @@ static void his_ghes_list_free(void) ...@@ -574,8 +561,27 @@ static void his_ghes_list_free(void)
if (sysctl_is_hest_type_generic_v2(node)) if (sysctl_is_hest_type_generic_v2(node))
sysctl_unmap_gen_v2(node); sysctl_unmap_gen_v2(node);
kfree(node); /* Release the node of the previous loop. */
if (tmp_node != NULL) {
kfree(tmp_node);
tmp_node = NULL;
}
/* Record the node of the current loop. */
tmp_node = node;
/* hisi_ghes_list isn't a member of node. */
if (node->list.next == &hisi_ghes_list) {
node = NULL;
break;
}
} }
if (tmp_node != NULL) {
kfree(tmp_node);
tmp_node = NULL;
}
rcu_read_unlock(); rcu_read_unlock();
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册