Skip to content

V7 subsystem#7

Open
houlz0507 wants to merge 4 commits into
Xilinx:v5.10-xoclv2from
houlz0507:v7-subsystem
Open

V7 subsystem#7
houlz0507 wants to merge 4 commits into
Xilinx:v5.10-xoclv2from
houlz0507:v7-subsystem

Conversation

@houlz0507
Copy link
Copy Markdown
Collaborator

@houlz0507 houlz0507 commented Jul 12, 2021

No description provided.

@houlz0507
Copy link
Copy Markdown
Collaborator Author

houlz0507 commented Jul 12, 2021

  1. Move devctl to mfd/ as xrt-devctl.ko
  2. Move xrt/include to include/linux/xrt
  3. Add xrt_device_id, and xrt-devctl.ko exports alias "xrt:d*"
  4. create group load and hold xrt-devctl.ko

maxzhen
maxzhen reviewed Jul 12, 2021
View reviewed changes
Copy link
Copy Markdown
Collaborator

@maxzhen maxzhen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

leaf driver IDs are still hard-coded?

Comment thread drivers/fpga/xrt/lib/group.c Outdated
Comment on lines +140 to +144
ret = xrt_drv_get(did);
if (ret) {
request_module("xrt:d%08X", did);
ret = xrt_drv_get(did);
}
Copy link
Copy Markdown
Collaborator

@maxzhen maxzhen Jul 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we just blindly call request_module(), then xrt_drv_get()? is there any unwanted side effect if we call request_module() when the module has already been loaded? or even hide request_module() inside xrt_drv_get()?

Comment thread drivers/fpga/xrt/lib/lib-drv.c
data->xdrv = xdrv;
if (xdrv->driver.owner && xdrv->driver.owner != THIS_MODULE) {
if (try_module_get(xdrv->driver.owner))
*(int *)data->arg = 0;
Copy link
Copy Markdown
Collaborator

@maxzhen maxzhen Jul 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if try_module_get() failed, do we want to return some error code through data->arg?

sonals
sonals approved these changes Jul 13, 2021
View reviewed changes
Copy link
Copy Markdown
Member

@sonals sonals left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be v8?

@houlz0507
Copy link
Copy Markdown
Collaborator Author

houlz0507 commented Jul 13, 2021

This should be v8?
Sure. I should check. :)

houlz0507 pushed a commit to houlz0507/linux-xoclv2 that referenced this pull request Oct 7, 2022
@davem330
ipv6: sr: fix out-of-bounds read when setting HMAC data.
84a5358 
The SRv6 layer allows defining HMAC data that can later be used to sign IPv6
Segment Routing Headers. This configuration is realised via netlink through
four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and
SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual
length of the SECRET attribute, it is possible to provide invalid combinations
(e.g., secret = "", secretlen = 64). This case is not checked in the code and
with an appropriately crafted netlink message, an out-of-bounds read of up
to 64 bytes (max secret length) can occur past the skb end pointer and into
skb_shared_info:

Breakpoint 1, seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208
208		memcpy(hinfo->secret, secret, slen);
(gdb) bt
 #0  seg6_genl_sethmac (skb=<optimized out>, info=<optimized out>) at net/ipv6/seg6.c:208
 #1  0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600,
    extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 <init_net>, family=<optimized out>,
    family=<optimized out>) at net/netlink/genetlink.c:731
 Xilinx#2  0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00,
    family=0xffffffff82fef6c0 <seg6_genl_family>) at net/netlink/genetlink.c:775
 Xilinx#3  genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792
 Xilinx#4  0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 <genl_rcv_msg>)
    at net/netlink/af_netlink.c:2501
 Xilinx#5  0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803
 Xilinx#6  0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000)
    at net/netlink/af_netlink.c:1319
 Xilinx#7  netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=<optimized out>)
    at net/netlink/af_netlink.c:1345
 Xilinx#8  0xffffffff81dff9a4 in netlink_sendmsg (sock=<optimized out>, msg=0xffffc90000ba7e48, len=<optimized out>) at net/netlink/af_netlink.c:1921
...
(gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *)0xffff88800b1f9f00)->end
$1 = 0xffff88800b1b76c0
(gdb) p/x secret
$2 = 0xffff88800b1b76c0
(gdb) p slen
$3 = 64 '@'

The OOB data can then be read back from userspace by dumping HMAC state. This
commit fixes this by ensuring SECRETLEN cannot exceed the actual length of
SECRET.

Reported-by: Lucas Leong <wmliang.tw@gmail.com>
Tested: verified that EINVAL is correctly returned when secretlen > len(secret)
Fixes: 4f4853d ("ipv6: sr: implement API to control SR HMAC structure")
Signed-off-by: David Lebrun <dlebrun@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
houlz0507 pushed a commit to houlz0507/linux-xoclv2 that referenced this pull request Oct 7, 2022
@tatokis @tiwai
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_al…
d29f590 
…loc()

The voice allocator sometimes begins allocating from near the end of the
array and then wraps around, however snd_emu10k1_pcm_channel_alloc()
accesses the newly allocated voices as if it never wrapped around.

This results in out of bounds access if the first voice has a high enough
index so that first_voice + requested_voice_count > NUM_G (64).
The more voices are requested, the more likely it is for this to occur.

This was initially discovered using PipeWire, however it can be reproduced
by calling aplay multiple times with 16 channels:
aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero

UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40
index 65 is out of range for type 'snd_emu10k1_voice [64]'
CPU: 1 PID: 31977 Comm: aplay Tainted: G        W IOE      6.0.0-rc2-emu10k1+ Xilinx#7
Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002    07/22/2010
Call Trace:
<TASK>
dump_stack_lvl+0x49/0x63
dump_stack+0x10/0x16
ubsan_epilogue+0x9/0x3f
__ubsan_handle_out_of_bounds.cold+0x44/0x49
snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1]
snd_pcm_hw_params+0x29f/0x600 [snd_pcm]
snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm]
? exit_to_user_mode_prepare+0x35/0x170
? do_syscall_64+0x69/0x90
? syscall_exit_to_user_mode+0x26/0x50
? do_syscall_64+0x69/0x90
? exit_to_user_mode_prepare+0x35/0x170
snd_pcm_ioctl+0x27/0x40 [snd_pcm]
__x64_sys_ioctl+0x95/0xd0
do_syscall_64+0x5c/0x90
? do_syscall_64+0x69/0x90
? do_syscall_64+0x69/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasossah.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sonals sonals sonals approved these changes

@maxzhen maxzhen maxzhen approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@houlz0507 @sonals @maxzhen