Commit 81c4b5bf authored by Lukas Wunner's avatar Lukas Wunner Committed by Bjorn Helgaas
Browse files

PCI: hotplug: Constify hotplug_slot_ops 

Hotplug drivers cannot declare their hotplug_slot_ops const, making them
attractive targets for attackers, because upon registration of a hotplug
slot, __pci_hp_initialize() writes to the "owner" and "mod_name" members
in that struct.

Fix by moving these members to struct hotplug_slot and constify every
driver's hotplug_slot_ops except for pciehp.

pciehp constructs its hotplug_slot_ops at runtime based on the PCIe
port's capabilities, hence cannot declare them const.  It can be
converted to __write_rarely once that's mainlined:
http://www.openwall.com/lists/kernel-hardening/2016/11/16/3



Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Reviewed-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>  # drivers/pci/hotplug/rpa*
Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com> # drivers/platform/x86
Cc: Len Brown <lenb@kernel.org>
Cc: Scott Murray <scott@spiteful.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Oliver OHalloran <oliveroh@au1.ibm.com>
Cc: Gavin Shan <gwshan@linux.vnet.ibm.com>
Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Cc: Corentin Chary <corentin.chary@gmail.com>
Cc: Darren Hart <dvhart@infradead.org>
parent d7587142

drivers/pci/hotplug/acpiphp_core.c

+1 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ static int get_attention_status(struct hotplug_slot *slot, u8 *value); 
static int get_latch_status(struct hotplug_slot *slot, u8 *value);

static int get_adapter_status(struct hotplug_slot *slot, u8 *value);



static struct hotplug_slot_ops acpi_hotplug_slot_ops = {

static const struct hotplug_slot_ops acpi_hotplug_slot_ops = {

	.enable_slot		= enable_slot,

	.disable_slot		= disable_slot,

	.set_attention_status	= set_attention_status,

drivers/pci/hotplug/cpci_hotplug_core.c

+1 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ static int get_attention_status(struct hotplug_slot *slot, u8 *value); 
static int get_adapter_status(struct hotplug_slot *slot, u8 *value);

static int get_latch_status(struct hotplug_slot *slot, u8 *value);



static struct hotplug_slot_ops cpci_hotplug_slot_ops = {

static const struct hotplug_slot_ops cpci_hotplug_slot_ops = {

	.enable_slot = enable_slot,

	.disable_slot = disable_slot,

	.set_attention_status = set_attention_status,

drivers/pci/hotplug/cpqphp_core.c

+1 −1
Original line number Diff line number Diff line
@@ -560,7 +560,7 @@ static int get_adapter_status(struct hotplug_slot *hotplug_slot, u8 *value) 
	return 0;

}



static struct hotplug_slot_ops cpqphp_hotplug_slot_ops = {

static const struct hotplug_slot_ops cpqphp_hotplug_slot_ops = {

	.set_attention_status =	set_attention_status,

	.enable_slot =		process_SI,

	.disable_slot =		process_SS,

drivers/pci/hotplug/ibmphp.h

+1 −1
Original line number Diff line number Diff line
@@ -740,7 +740,7 @@ int ibmphp_do_disable_slot(struct slot *slot_cur); 
int ibmphp_update_slot_info(struct slot *);	/* This function is called from HPC, so we need it to not be be static */

int ibmphp_configure_card(struct pci_func *, u8);

int ibmphp_unconfigure_card(struct slot **, int);

extern struct hotplug_slot_ops ibmphp_hotplug_slot_ops;

extern const struct hotplug_slot_ops ibmphp_hotplug_slot_ops;



#endif				//__IBMPHP_H

drivers/pci/hotplug/ibmphp_core.c

+1 −1
Original line number Diff line number Diff line
@@ -1259,7 +1259,7 @@ error: 
	goto exit;

}



struct hotplug_slot_ops ibmphp_hotplug_slot_ops = {

const struct hotplug_slot_ops ibmphp_hotplug_slot_ops = {

	.set_attention_status =		set_attention_status,

	.enable_slot =			enable_slot,

	.disable_slot =			ibmphp_disable_slot,

CRA Git | Maintained and supported by SUSTech CRA and CCSE