diff options
| author | Jason Liu <jason.hui.liu@nxp.com> | 2020-01-07 14:38:57 +0800 |
|---|---|---|
| committer | Jason Liu <jason.hui.liu@nxp.com> | 2020-02-26 04:17:30 +0800 |
| commit | 1c71dac08f1ca6ceecffaf62daa5d1d3405d5dae (patch) | |
| tree | 2e8323247f914b965ee94ab3cdfaf3f374e5a1e0 /drivers/pci/controller/dwc/pci-imx6.c | |
| parent | d83e6670493c83283c32d52c018817f3ecd1d21b (diff) | |
LF-228 drivers: pci: dwc: pci-imx6: handle the abort from user-space
The driver install one hook to handle the external abort, but issue
is that if the abort introduced from user space code, the following
code unsigned long instr = *(unsigned long *)pc; which will created
another data-abort(page domain fault) if CONFIG_CPU_SW_DOMAIN_PAN.
The patch does not intent to use copy_from_user and then do the hack
due to the security consideration. In fact, we can just return and
report the external abort to user-space.
Signed-off-by: Jason Liu <jason.hui.liu@nxp.com>
Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
(cherry picked from commit 1bf9d07f50a24a08f9da2795bf39bf03ba2e7135)
Diffstat (limited to 'drivers/pci/controller/dwc/pci-imx6.c')
| -rw-r--r-- | drivers/pci/controller/dwc/pci-imx6.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c index 5115cd37f36d..26d6364c9ab7 100644 --- a/drivers/pci/controller/dwc/pci-imx6.c +++ b/drivers/pci/controller/dwc/pci-imx6.c @@ -36,6 +36,7 @@ #include <linux/pm_domain.h> #include <linux/pm_runtime.h> #include "../../pci.h" +#include <linux/uaccess.h> #include "pcie-designware.h" @@ -541,8 +542,15 @@ static int imx6q_pcie_abort_handler(unsigned long addr, unsigned int fsr, struct pt_regs *regs) { unsigned long pc = instruction_pointer(regs); - unsigned long instr = *(unsigned long *)pc; - int reg = (instr >> 12) & 15; + unsigned long instr; + int reg ; + + /* if the abort from user-space, just return and report it */ + if (user_mode(regs)) + return 1; + + instr = *(unsigned long *)pc; + reg = (instr >> 12) & 15; /* * If the instruction being executed was a read, |