forked from luck/tmp_suning_uos_patched
72f2be3432
commit a8bd29bd49c4156ea0ec5a97812333e2aeef44e7 upstream. The pciconfig_read() syscall reads PCI configuration space using hardware-dependent config accessors. If the read fails on PCI, most accessors don't return an error; they pretend the read was successful and got ~0 data from the device, so the syscall returns success with ~0 data in the buffer. When the accessor does return an error, pciconfig_read() normally fills the user's buffer with ~0 and returns an error in errno. But aftere4585da22a("pci syscall.c: Switch to refcounting API"), we don't fill the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error. Userspace may rely on the ~0 data to detect errors, but aftere4585da22a, that would not detect CAP_SYS_ADMIN errors. Restore the original behaviour of filling the buffer with ~0 when the CAP_SYS_ADMIN check fails. [bhelgaas: commit log, fold in Nathan's fix https://lore.kernel.org/r/20210803200836.500658-1-nathan@kernel.org] Fixes:e4585da22a("pci syscall.c: Switch to refcounting API") Link: https://lore.kernel.org/r/20210729233755.1509616-1-kw@linux.com Signed-off-by: Krzysztof Wilczyński <kw@linux.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
139 lines
2.7 KiB
C
139 lines
2.7 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* For architectures where we want to allow direct access to the PCI config
|
|
* stuff - it would probably be preferable on PCs too, but there people
|
|
* just do it by hand with the magic northbridge registers.
|
|
*/
|
|
|
|
#include <linux/errno.h>
|
|
#include <linux/pci.h>
|
|
#include <linux/security.h>
|
|
#include <linux/syscalls.h>
|
|
#include <linux/uaccess.h>
|
|
#include "pci.h"
|
|
|
|
SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
|
|
unsigned long, off, unsigned long, len, void __user *, buf)
|
|
{
|
|
struct pci_dev *dev;
|
|
u8 byte;
|
|
u16 word;
|
|
u32 dword;
|
|
long err;
|
|
int cfg_ret;
|
|
|
|
err = -EPERM;
|
|
dev = NULL;
|
|
if (!capable(CAP_SYS_ADMIN))
|
|
goto error;
|
|
|
|
err = -ENODEV;
|
|
dev = pci_get_domain_bus_and_slot(0, bus, dfn);
|
|
if (!dev)
|
|
goto error;
|
|
|
|
switch (len) {
|
|
case 1:
|
|
cfg_ret = pci_user_read_config_byte(dev, off, &byte);
|
|
break;
|
|
case 2:
|
|
cfg_ret = pci_user_read_config_word(dev, off, &word);
|
|
break;
|
|
case 4:
|
|
cfg_ret = pci_user_read_config_dword(dev, off, &dword);
|
|
break;
|
|
default:
|
|
err = -EINVAL;
|
|
goto error;
|
|
}
|
|
|
|
err = -EIO;
|
|
if (cfg_ret)
|
|
goto error;
|
|
|
|
switch (len) {
|
|
case 1:
|
|
err = put_user(byte, (unsigned char __user *)buf);
|
|
break;
|
|
case 2:
|
|
err = put_user(word, (unsigned short __user *)buf);
|
|
break;
|
|
case 4:
|
|
err = put_user(dword, (unsigned int __user *)buf);
|
|
break;
|
|
}
|
|
pci_dev_put(dev);
|
|
return err;
|
|
|
|
error:
|
|
/* ??? XFree86 doesn't even check the return value. They
|
|
just look for 0xffffffff in the output, since that's what
|
|
they get instead of a machine check on x86. */
|
|
switch (len) {
|
|
case 1:
|
|
put_user(-1, (unsigned char __user *)buf);
|
|
break;
|
|
case 2:
|
|
put_user(-1, (unsigned short __user *)buf);
|
|
break;
|
|
case 4:
|
|
put_user(-1, (unsigned int __user *)buf);
|
|
break;
|
|
}
|
|
pci_dev_put(dev);
|
|
return err;
|
|
}
|
|
|
|
SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
|
|
unsigned long, off, unsigned long, len, void __user *, buf)
|
|
{
|
|
struct pci_dev *dev;
|
|
u8 byte;
|
|
u16 word;
|
|
u32 dword;
|
|
int err = 0;
|
|
|
|
if (!capable(CAP_SYS_ADMIN) ||
|
|
security_locked_down(LOCKDOWN_PCI_ACCESS))
|
|
return -EPERM;
|
|
|
|
dev = pci_get_domain_bus_and_slot(0, bus, dfn);
|
|
if (!dev)
|
|
return -ENODEV;
|
|
|
|
switch (len) {
|
|
case 1:
|
|
err = get_user(byte, (u8 __user *)buf);
|
|
if (err)
|
|
break;
|
|
err = pci_user_write_config_byte(dev, off, byte);
|
|
if (err)
|
|
err = -EIO;
|
|
break;
|
|
|
|
case 2:
|
|
err = get_user(word, (u16 __user *)buf);
|
|
if (err)
|
|
break;
|
|
err = pci_user_write_config_word(dev, off, word);
|
|
if (err)
|
|
err = -EIO;
|
|
break;
|
|
|
|
case 4:
|
|
err = get_user(dword, (u32 __user *)buf);
|
|
if (err)
|
|
break;
|
|
err = pci_user_write_config_dword(dev, off, dword);
|
|
if (err)
|
|
err = -EIO;
|
|
break;
|
|
|
|
default:
|
|
err = -EINVAL;
|
|
break;
|
|
}
|
|
pci_dev_put(dev);
|
|
return err;
|
|
}
|