kernel/git/stable/linux.git/drivers/pci/endpoint, branch linux-5.4.y

PCI: endpoint: Fix configfs group removal on driver teardown

2025-08-28T14:21:31+00:00

commit 910bdb8197f9322790c738bb32feaa11dba26909 upstream. An endpoint driver configfs attributes group is added to the epf_group list of struct pci_epf_driver by pci_epf_add_cfs() but an added group is not removed from this list when the attribute group is unregistered with pci_ep_cfs_remove_epf_group(). Add the missing list_del() call in pci_ep_cfs_remove_epf_group() to correctly remove the attribute group from the driver list. With this change, once the loop over all attribute groups in pci_epf_remove_cfs() completes, the driver epf_group list should be empty. Add a WARN_ON() to make sure of that. Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry") Signed-off-by: Damien Le Moal Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250624114544.342159-3-dlemoal@kernel.org Signed-off-by: Greg Kroah-Hartman

PCI: endpoint: Fix configfs group list head handling

2025-08-28T14:21:31+00:00

commit d79123d79a8154b4318529b7b2ff7e15806f480b upstream. Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs(). Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry") Signed-off-by: Damien Le Moal Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250624114544.342159-2-dlemoal@kernel.org Signed-off-by: Greg Kroah-Hartman

PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()

2025-03-13T11:42:58+00:00

[ Upstream commit d4929755e4d02bd3de3ae5569dab69cb9502c54f ] The devm_pci_epc_destroy() comment says destroys the EPC device, but it does not actually do that since devres_destroy() does not call devm_pci_epc_release(), and it also can not fully undo what the API devm_pci_epc_create() does, so it is faulty. Fortunately, the faulty API has not been used by current kernel tree. Use devres_release() instead of devres_destroy() so the EPC device will be released. Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-1-4d86dd573e4b@quicinc.com Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions") Signed-off-by: Zijun Hu Signed-off-by: Bjorn Helgaas Signed-off-by: Sasha Levin

PCI: endpoint: Fix missing destroy_workqueue()

2021-05-19T08:08:25+00:00

[ Upstream commit acaef7981a218813e3617edb9c01837808de063c ] Add the missing destroy_workqueue() before return from pci_epf_test_init() in the error handling case and add destroy_workqueue() in pci_epf_test_exit(). Link: https://lore.kernel.org/r/20210331084012.2091010-1-yangyingliang@huawei.com Fixes: 349e7a85b25fa ("PCI: endpoint: functions: Add an EP function to test PCI") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Lorenzo Pieralisi Signed-off-by: Sasha Levin

PCI: endpoint: Fix for concurrent memory allocation in OB address region

2020-04-17T08:50:11+00:00

commit 04e046ca57ebed3943422dee10eec9e73aec081e upstream. pci-epc-mem uses a bitmap to manage the Endpoint outbound (OB) address region. This address region will be shared by multiple endpoint functions (in the case of multi function endpoint) and it has to be protected from concurrent access to avoid updating an inconsistent state. Use a mutex to protect bitmap updates to prevent the memory allocation API from returning incorrect addresses. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Greg Kroah-Hartman

PCI: endpoint: Clear BAR before freeing its space

2019-06-11T09:57:54+00:00

Associated pci_epf_bar structure is needed in pci_epc_clear_bar() to clear a BAR correctly but it is reset in pci_epf_free_space() (that is called first) which results in pci_epc_clear_bar() failure. Reorder the pci_epc_clear_bar()/pci_epf_free_space() calls execution to fix the issue. Signed-off-by: Alan Mikhak [lorenzo.pieralisi@arm.com: reworded the commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Kishon Vijay Abraham I

PCI: endpoint: Skip odd BAR when skipping 64bit BAR

2019-06-11T09:55:36+00:00

Always skip odd BAR when skipping 64bit BARs in pci_epf_test_set_bar() and pci_epf_test_alloc_space() otherwise pci_epf_test_set_bar() will call pci_epc_set_bar() on an odd loop index when skipping reserved 64bit BAR. Moreover, pci_epf_test_alloc_space() will call pci_epf_alloc_space() on bind for an odd loop index when BAR is 64bit but leaks on subsequent unbind by not calling pci_epf_free_space(). Signed-off-by: Alan Mikhak Signed-off-by: Lorenzo Pieralisi Acked-by: Kishon Vijay Abraham I Reviewed-by: Paul Walmsley

PCI: endpoint: Allocate enough space for fixed size BAR

2019-06-11T09:55:22+00:00

PCI endpoint test function code should honor the .bar_fixed_size parameter from underlying endpoint controller drivers or results may be unexpected. In pci_epf_test_alloc_space(), check if BAR being used for test register space is a fixed size BAR. If so, allocate the required fixed size. Signed-off-by: Alan Mikhak Signed-off-by: Lorenzo Pieralisi Acked-by: Kishon Vijay Abraham I

PCI: endpoint: Set endpoint controller pointer to NULL

2019-06-11T09:55:12+00:00

Set endpoint controller pointer to NULL in pci_epc_remove_epf() to avoid -EBUSY on subsequent call to pci_epc_add_epf(). Add a check for NULL endpoint function pointer. Signed-off-by: Alan Mikhak Signed-off-by: Lorenzo Pieralisi Acked-by: Kishon Vijay Abraham I

Merge branch 'remotes/lorenzo/pci/misc'

2019-05-13T23:34:44+00:00

- Exit pcitest with error code when test fails (Jean-Jacques Hiblot) - Fix leaked of_node references in dra7xx, uniphier, layerscape, rockchip, aardvark, iproc, mediatek, rpadlpar (Wen Yang) - Fix pcitest "help" option parsing (Kishon Vijay Abraham I) - Fix Makefile bug that inadvertently removes pcitest.sh (Kishon Vijay Abraham I) - Check for alloc_workqueue() failure in endpoint test driver (Kangjie Lu) * remotes/lorenzo/pci/misc: PCI: endpoint: Fix a potential NULL pointer dereference tools: PCI: Handle pcitest.sh independently from pcitest tools: PCI: Add 'h' in optstring of getopt() PCI: mediatek: Fix a leaked reference by adding missing of_node_put() PCI: iproc: Fix a leaked reference by adding missing of_node_put() PCI: aardvark: Fix a leaked reference by adding missing of_node_put() PCI: rockchip: Fix a leaked reference by adding missing of_node_put() PCI: dwc: layerscape: Fix a leaked reference by adding missing of_node_put() PCI: uniphier: Fix a leaked reference by adding missing of_node_put() PCI: dwc: pci-dra7xx: Fix a leaked reference by adding missing of_node_put() tools: PCI: Exit with error code when test fails