diff options
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20008.patch')
| -rw-r--r-- | meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20008.patch | 83 |
1 files changed, 83 insertions, 0 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20008.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20008.patch new file mode 100644 index 000000000..1ac478c67 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20008.patch @@ -0,0 +1,83 @@ +From f3ff5f75d8f6367eac7556c9db1227bb43e5c615 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20L=C3=B6hle?= <CLoehle@hyperstone.com> +Date: Fri, 4 Feb 2022 15:11:37 +0000 +Subject: [PATCH] mmc: block: fix read single on recovery logic + +commit 54309fde1a352ad2674ebba004a79f7d20b9f037 upstream. + +On reads with MMC_READ_MULTIPLE_BLOCK that fail, +the recovery handler will use MMC_READ_SINGLE_BLOCK for +each of the blocks, up to MMC_READ_SINGLE_RETRIES times each. +The logic for this is fixed to never report unsuccessful reads +as success to the block layer. + +On command error with retries remaining, blk_update_request was +called with whatever value error was set last to. +In case it was last set to BLK_STS_OK (default), the read will be +reported as success, even though there was no data read from the device. +This could happen on a CRC mismatch for the response, +a card rejecting the command (e.g. again due to a CRC mismatch). +In case it was last set to BLK_STS_IOERR, the error is reported correctly, +but no retries will be attempted. + +Fixes: 81196976ed946c ("mmc: block: Add blk-mq support") +Cc: stable@vger.kernel.org +Signed-off-by: Christian Loehle <cloehle@hyperstone.com> +Reviewed-by: Adrian Hunter <adrian.hunter@intel.com> +Link: https://lore.kernel.org/r/bc706a6ab08c4fe2834ba0c05a804672@hyperstone.com +Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/mmc/core/block.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 431af5e8be2f89..b575d0bfd0d68c 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1682,31 +1682,31 @@ static void mmc_blk_read_single(struct mmc_queue *mq, struct request *req) + struct mmc_card *card = mq->card; + struct mmc_host *host = card->host; + blk_status_t error = BLK_STS_OK; +- int retries = 0; + + do { + u32 status; + int err; ++ int retries = 0; + +- mmc_blk_rw_rq_prep(mqrq, card, 1, mq); ++ while (retries++ <= MMC_READ_SINGLE_RETRIES) { ++ mmc_blk_rw_rq_prep(mqrq, card, 1, mq); + +- mmc_wait_for_req(host, mrq); ++ mmc_wait_for_req(host, mrq); + +- err = mmc_send_status(card, &status); +- if (err) +- goto error_exit; +- +- if (!mmc_host_is_spi(host) && +- !mmc_ready_for_data(status)) { +- err = mmc_blk_fix_state(card, req); ++ err = mmc_send_status(card, &status); + if (err) + goto error_exit; +- } + +- if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES) +- continue; ++ if (!mmc_host_is_spi(host) && ++ !mmc_ready_for_data(status)) { ++ err = mmc_blk_fix_state(card, req); ++ if (err) ++ goto error_exit; ++ } + +- retries = 0; ++ if (!mrq->cmd->error) ++ break; ++ } + + if (mrq->cmd->error || + mrq->data->error || |