[4.2.y-ckt stable] Patch "vfio/platform: store mapped memory in region, instead of an on-stack copy" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    vfio/platform: store mapped memory in region, instead of an on-stack copy

to the linux-4.2.y-queue branch of the 4.2.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-4.2.y-queue

This patch is scheduled to be released in version 4.2.8-ckt1.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 4.2.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 645a747473805754011c954b5bae8c3f397f24cf Mon Sep 17 00:00:00 2001
From: James Morse <james.morse at arm.com>
Date: Thu, 29 Oct 2015 16:50:43 +0000
Subject: vfio/platform: store mapped memory in region, instead of an on-stack
 copy

commit 1b4bb2eaa9b2583521611b4aa978f9f499c92cd4 upstream.

vfio_platform_{read,write}_mmio() call ioremap_nocache() to map
a region of io memory, which they store in struct vfio_platform_region to
be eventually re-used, or unmapped by vfio_platform_regions_cleanup().

These functions receive a copy of their struct vfio_platform_region
argument on the stack - so these mapped areas are always allocated, and
always leaked.

Pass this argument as a pointer instead.

Fixes: 6e3f26456009 "vfio/platform: read and write support for the device fd"
Signed-off-by: James Morse <james.morse at arm.com>
Acked-by: Baptiste Reynal <b.reynal at virtualopensystems.com>
Tested-by: Baptiste Reynal <b.reynal at virtualopensystems.com>
Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/vfio/platform/vfio_platform_common.c | 36 ++++++++++++++--------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
index e43efb5..8c216de 100644
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -307,17 +307,17 @@ static long vfio_platform_ioctl(void *device_data,
 	return -ENOTTY;
 }

-static ssize_t vfio_platform_read_mmio(struct vfio_platform_region reg,
+static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg,
 				       char __user *buf, size_t count,
 				       loff_t off)
 {
 	unsigned int done = 0;

-	if (!reg.ioaddr) {
-		reg.ioaddr =
-			ioremap_nocache(reg.addr, reg.size);
+	if (!reg->ioaddr) {
+		reg->ioaddr =
+			ioremap_nocache(reg->addr, reg->size);

-		if (!reg.ioaddr)
+		if (!reg->ioaddr)
 			return -ENOMEM;
 	}

@@ -327,7 +327,7 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region reg,
 		if (count >= 4 && !(off % 4)) {
 			u32 val;

-			val = ioread32(reg.ioaddr + off);
+			val = ioread32(reg->ioaddr + off);
 			if (copy_to_user(buf, &val, 4))
 				goto err;

@@ -335,7 +335,7 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region reg,
 		} else if (count >= 2 && !(off % 2)) {
 			u16 val;

-			val = ioread16(reg.ioaddr + off);
+			val = ioread16(reg->ioaddr + off);
 			if (copy_to_user(buf, &val, 2))
 				goto err;

@@ -343,7 +343,7 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region reg,
 		} else {
 			u8 val;

-			val = ioread8(reg.ioaddr + off);
+			val = ioread8(reg->ioaddr + off);
 			if (copy_to_user(buf, &val, 1))
 				goto err;

@@ -376,7 +376,7 @@ static ssize_t vfio_platform_read(void *device_data, char __user *buf,
 		return -EINVAL;

 	if (vdev->regions[index].type & VFIO_PLATFORM_REGION_TYPE_MMIO)
-		return vfio_platform_read_mmio(vdev->regions[index],
+		return vfio_platform_read_mmio(&vdev->regions[index],
 							buf, count, off);
 	else if (vdev->regions[index].type & VFIO_PLATFORM_REGION_TYPE_PIO)
 		return -EINVAL; /* not implemented */
@@ -384,17 +384,17 @@ static ssize_t vfio_platform_read(void *device_data, char __user *buf,
 	return -EINVAL;
 }

-static ssize_t vfio_platform_write_mmio(struct vfio_platform_region reg,
+static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg,
 					const char __user *buf, size_t count,
 					loff_t off)
 {
 	unsigned int done = 0;

-	if (!reg.ioaddr) {
-		reg.ioaddr =
-			ioremap_nocache(reg.addr, reg.size);
+	if (!reg->ioaddr) {
+		reg->ioaddr =
+			ioremap_nocache(reg->addr, reg->size);

-		if (!reg.ioaddr)
+		if (!reg->ioaddr)
 			return -ENOMEM;
 	}

@@ -406,7 +406,7 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region reg,

 			if (copy_from_user(&val, buf, 4))
 				goto err;
-			iowrite32(val, reg.ioaddr + off);
+			iowrite32(val, reg->ioaddr + off);

 			filled = 4;
 		} else if (count >= 2 && !(off % 2)) {
@@ -414,7 +414,7 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region reg,

 			if (copy_from_user(&val, buf, 2))
 				goto err;
-			iowrite16(val, reg.ioaddr + off);
+			iowrite16(val, reg->ioaddr + off);

 			filled = 2;
 		} else {
@@ -422,7 +422,7 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region reg,

 			if (copy_from_user(&val, buf, 1))
 				goto err;
-			iowrite8(val, reg.ioaddr + off);
+			iowrite8(val, reg->ioaddr + off);

 			filled = 1;
 		}
@@ -452,7 +452,7 @@ static ssize_t vfio_platform_write(void *device_data, const char __user *buf,
 		return -EINVAL;

 	if (vdev->regions[index].type & VFIO_PLATFORM_REGION_TYPE_MMIO)
-		return vfio_platform_write_mmio(vdev->regions[index],
+		return vfio_platform_write_mmio(&vdev->regions[index],
 							buf, count, off);
 	else if (vdev->regions[index].type & VFIO_PLATFORM_REGION_TYPE_PIO)
 		return -EINVAL; /* not implemented */
--
1.9.1