linux/drivers/edac, branch v5.3

EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec

2019-06-27T17:24:47Z

Commit 9da21b1509d8 ("EDAC: Poll timeout cannot be zero, p2") assumes edac_mc_poll_msec to be unsigned long, but the type of the variable still remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds write. Reproducer: # echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec KASAN report: BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150 Write of size 8 at addr ffffffffb91b2d00 by task bash/1996 CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014 Call Trace: dump_stack+0xca/0x13e print_address_description.cold+0x5/0x246 __kasan_report.cold+0x75/0x9a ? edac_set_poll_msec+0x140/0x150 kasan_report+0xe/0x20 edac_set_poll_msec+0x140/0x150 ? dimmdev_location_show+0x30/0x30 ? vfs_lock_file+0xe0/0xe0 ? _raw_spin_lock+0x87/0xe0 param_attr_store+0x1b5/0x310 ? param_array_set+0x4f0/0x4f0 module_attr_store+0x58/0x80 ? module_attr_show+0x80/0x80 sysfs_kf_write+0x13d/0x1a0 kernfs_fop_write+0x2bc/0x460 ? sysfs_kf_bin_read+0x270/0x270 ? kernfs_notify+0x1f0/0x1f0 __vfs_write+0x81/0x100 vfs_write+0x1e1/0x560 ksys_write+0x126/0x250 ? __ia32_sys_read+0xb0/0xb0 ? do_syscall_64+0x1f/0x390 do_syscall_64+0xc1/0x390 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fa7caa5e970 Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04 RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970 RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001 RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700 R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005 The buggy address belongs to the variable: edac_mc_poll_msec+0x0/0x40 Memory state around the buggy address: ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa >ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa ^ ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Fix it by changing the type of edac_mc_poll_msec to unsigned int. The reason why this patch adopts unsigned int rather than unsigned long is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid integer conversion bugs and unsigned int will be large enough for edac_mc_poll_msec. Reviewed-by: James Morse Fixes: 9da21b1509d8 ("EDAC: Poll timeout cannot be zero, p2") Signed-off-by: Eiichi Tsukata Signed-off-by: Tony Luck

EDAC, skx, i10nm: Fix source ID register offset

2019-06-26T17:07:27Z

The source ID register offset for Skylake server is 0xf0, while for Icelake server is 0xf8. Pass the correct offset to get the source ID. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck

EDAC, i10nm: Check ECC enabling status per channel

2019-06-26T17:06:09Z

The i10nm_edac only checks the ECC enabling status for the first channel of the memory controller. If there aren't memory DIMMs populated on the first channel, but at least one DIMM populated on the second channel, it will wrongly report that the ECC for the memory controller is disabled that fails to load the i10nm_edac driver. Fix it by checking ECC enabling status per channel. [Tony: Also report which channel has ECC disabled] Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck

EDAC, i10nm: Add Intel additional Ice-Lake support

2019-06-20T18:44:36Z

Two new CPU models share the same memory controller architecture with Jacobsville/Tremont, so can use the same i10nm EDAC driver. Add ICX and ICX-D CPU model numbers for EDAC support. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck

EDAC: Make edac_debugfs_create_x*() return void

2019-06-20T18:44:36Z

The return values of edac_debugfs_create_x16() and edac_debugfs_create_x8() are never checked (as they don't need to be), so no need to have them return anything, just make the functions return void instead. This is done with the goal of being able to change the debugfs_create_x* functions to also not return a value. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Borislav Petkov Cc: James Morse Cc: linux-edac Cc: Mauro Carvalho Chehab Link: https://lkml.kernel.org/r/20190611175433.GA5108@kroah.com

EDAC/aspeed: Remove set but not used variable 'np'

2019-06-20T18:44:36Z

Fix the following -Wunused-but-set-variable warning: drivers/edac/aspeed_edac.c: In function aspeed_probe: drivers/edac/aspeed_edac.c:284:22: warning: variable np set but not used [-Wunused-but-set-variable] It is never used and can be removed. Signed-off-by: YueHaibing Signed-off-by: Borislav Petkov Reviewed-by: Andrew Jeffery Reviewed-by: Stefan Schaeckeler Cc: James Morse Cc: Joel Stanley Cc: linux-arm-kernel@lists.infradead.org Cc: linux-aspeed@lists.ozlabs.org Cc: linux-edac Cc: Mauro Carvalho Chehab Link: https://lkml.kernel.org/r/20190525144153.2028-1-yuehaibing@huawei.com

EDAC/ie31200: Reformat PCI device table

2019-06-20T18:44:36Z

Reformat device table after Coffee Lake additions to be more readable. No functional change. Signed-off-by: Marco Elver Signed-off-by: Borislav Petkov Acked-by: Tony Luck Cc: James Morse Cc: Jason Baron Cc: linux-edac Cc: Mauro Carvalho Chehab Link: https://lkml.kernel.org/r/20190610191422.177931-2-elver@google.com

EDAC/ie31200: Add Intel Coffee Lake CPU support

2019-06-20T18:44:36Z

Coffee Lake seems to work like Skylake and Kaby Lake. Add all device IDs for Coffee Lake-S CPUs according to datasheet. [ bp: Massage. ] Signed-off-by: Marco Elver Signed-off-by: Borislav Petkov Acked-by: Tony Luck Cc: James Morse Cc: Jason Baron Cc: linux-edac Cc: Mauro Carvalho Chehab Link: https://lkml.kernel.org/r/20190610191422.177931-1-elver@google.com

EDAC/sifive: Add EDAC platform driver for SiFive SoCs

2019-06-20T18:44:36Z

Add an EDAC driver for SiFive SoCs. The initial version supports ECC event monitoring and reporting through the EDAC framework for the SiFive L2 cache controller. It registers for notifier events from the L2 cache controller driver (arch/riscv/mm/sifive_l2_cache.c) for L2 ECC events. [ bp: Massage commit message. ] Signed-off-by: Yash Shah Signed-off-by: Borislav Petkov Reviewed-by: James Morse Cc: Albert Ou Cc: "David S. Miller" Cc: Greg Kroah-Hartman Cc: Jonathan Cameron Cc: Linus Walleij Cc: linux-edac Cc: linux-riscv@lists.infradead.org Cc: Mauro Carvalho Chehab Cc: Nicolas Ferre Cc: Palmer Dabbelt Cc: "Paul E. McKenney" Cc: Paul Walmsley Cc: sachin.ghadi@sifive.com Link: https://lkml.kernel.org/r/1557142026-15949-2-git-send-email-yash.shah@sifive.com

EDAC/sb_edac: Remove redundant update of tad_base

2019-06-20T18:44:36Z

The variable tad_base is being set to a value that is never read and is being over-written on the next iteration of a for-loop. This assignment is therefore redundant and can be removed. Signed-off-by: Colin Ian King Signed-off-by: Borislav Petkov Acked-by: Tony Luck Cc: James Morse Cc: kernel-janitors@vger.kernel.org Cc: linux-edac Cc: Mauro Carvalho Chehab Cc: Qiuxu Zhuo Link: https://lkml.kernel.org/r/20190508224201.27120-1-colin.king@canonical.com