diff options
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2024-35984.patch')
| -rw-r--r-- | meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2024-35984.patch | 63 |
1 files changed, 63 insertions, 0 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2024-35984.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2024-35984.patch new file mode 100644 index 000000000..39f07ce42 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2024-35984.patch @@ -0,0 +1,63 @@ +From 357c64ef1ef39b1e7cd91ab6bdd304d043702c83 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang <wsa+renesas@sang-engineering.com> +Date: Fri, 26 Apr 2024 08:44:08 +0200 +Subject: [PATCH] i2c: smbus: fix NULL function pointer dereference + +[ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] + +Baruch reported an OOPS when using the designware controller as target +only. Target-only modes break the assumption of one transfer function +always being available. Fix this by always checking the pointer in +__i2c_transfer. + +Reported-by: Baruch Siach <baruch@tkos.co.il> +Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.1712761976.git.baruch@tkos.co.il +Fixes: 4b1acc43331d ("i2c: core changes for slave support") +[wsa: dropped the simplification in core-smbus to avoid theoretical regressions] +Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> +Tested-by: Baruch Siach <baruch@tkos.co.il> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/i2c/i2c-core-base.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index be242605df91..43eededcb654 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -2200,7 +2200,7 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, + * Returns negative errno, else the number of messages executed. + * + * Adapter lock must be held when calling this function. No debug logging +- * takes place. adap->algo->master_xfer existence isn't checked. ++ * takes place. + */ + int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + { +@@ -2209,6 +2209,11 @@ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + unsigned long timeout; + int ret, try; + ++ if (!adap->algo->master_xfer) { ++ dev_dbg(&adap->dev, "I2C level transfers not supported\n"); ++ return -EOPNOTSUPP; ++ } ++ + if (WARN_ON(!msgs || num < 1)) + return -EINVAL; + +@@ -2302,11 +2307,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + bool do_bus_lock = true; + int ret; + +- if (!adap->algo->master_xfer) { +- dev_dbg(&adap->dev, "I2C level transfers not supported\n"); +- return -EOPNOTSUPP; +- } +- + /* REVISIT the fault reporting model here is weak: + * + * - When we get an error after receiving N bytes from a slave, +-- +2.25.1 + |