[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2020-36782

*** BLURB HERE *** Qinglang Miao (1): i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails Zhang Qilong (1): PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- include/linux/pm_runtime.h | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.34.1

From: Zhang Qilong <zhangqilong3@huawei.com> mainline inclusion from mainline-v5.10-rc5 commit dd8088d5a8969dc2b42f71d7bc01c25c61a78066 category: bugfix bugzilla: NA CVE: CVE-2020-36782 --------------------------- In many case, we need to check return value of pm_runtime_get_sync, but it brings a trouble to the usage counter processing. Many callers forget to decrease the usage counter when it failed, which could resulted in reference leak. It has been discussed a lot[0][1]. So we add a function to deal with the usage counter for better coding. [0]https://lkml.org/lkml/2020/6/14/88 [1]https://patchwork.ozlabs.org/project/linux-tegra/list/?series=178139 Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com> Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Conflicts: include/linux/pm_runtime.h Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> --- include/linux/pm_runtime.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h index f0fc4700b6ff..98e922e6ff30 100644 --- a/include/linux/pm_runtime.h +++ b/include/linux/pm_runtime.h @@ -225,6 +225,27 @@ static inline int pm_runtime_get_sync(struct device *dev) return __pm_runtime_resume(dev, RPM_GET_PUT); } +/** + * pm_runtime_resume_and_get - Bump up usage counter of a device and resume it. + * @dev: Target device. + * + * Resume @dev synchronously and if that is successful, increment its runtime + * PM usage counter. Return 0 if the runtime PM usage counter of @dev has been + * incremented or a negative error code otherwise. + */ +static inline int pm_runtime_resume_and_get(struct device *dev) +{ + int ret; + + ret = __pm_runtime_resume(dev, RPM_GET_PUT); + if (ret < 0) { + pm_runtime_put_noidle(dev); + return ret; + } + + return 0; +} + static inline int pm_runtime_put(struct device *dev) { return __pm_runtime_idle(dev, RPM_GET_PUT | RPM_ASYNC); -- 2.34.1

From: Qinglang Miao <miaoqinglang@huawei.com> mainline inclusion from mainline-v5.13-rc1 commit 278e5bbdb9a94fa063c0f9bcde2479d0b8042462 category: bugfix bugzilla: NA CVE: CVE-2020-36782 --------------------------- The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable. However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: 13d6eb20fc79 ("i2c: imx-lpi2c: add runtime pm support") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> --- drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c index 06c4c767af32..d5182c446b79 100644 --- a/drivers/i2c/busses/i2c-imx-lpi2c.c +++ b/drivers/i2c/busses/i2c-imx-lpi2c.c @@ -265,7 +265,7 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct *lpi2c_imx) unsigned int temp; int ret; - ret = pm_runtime_get_sync(lpi2c_imx->adapter.dev.parent); + ret = pm_runtime_resume_and_get(lpi2c_imx->adapter.dev.parent); if (ret < 0) return ret; -- 2.34.1

反馈: 您发送到kernel@openeuler.org的补丁/补丁集,已成功转换为PR! PR链接地址: https://gitee.com/openeuler/kernel/pulls/4815 邮件列表地址:https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/O... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/4815 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/O...
-
patchwork bot
-
Zhang Xiaoxu