diff options
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-kernel/linux')
3 files changed, 117 insertions, 0 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0119-Handle-pending-eSPI-HOST-OOB-RESET-VW-events.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0119-Handle-pending-eSPI-HOST-OOB-RESET-VW-events.patch new file mode 100644 index 000000000..fe27864a2 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0119-Handle-pending-eSPI-HOST-OOB-RESET-VW-events.patch @@ -0,0 +1,56 @@ +From 562a6d31576b91d1c7f2c9df0d12966a1f034ac6 Mon Sep 17 00:00:00 2001 +From: Saravanan Palanisamy <saravanan.palanisamy@intel.com> +Date: Wed, 23 Sep 2020 19:23:37 +0000 +Subject: [PATCH] Handle pending eSPI HOST, OOB RESET VW events. + +Add support for handling of HOST_RESET_WARN, OOB_RESET_WARN VW events received +before espi-ISR is registered. +Without this support, SoC does not boot to BIOS and wait for ACK endlessly +for these events. These events can be induced in some platforms in ME-recovery +mode. + +Tested: +1. Test: Induce HOST_RESET_WARN event before BMC uboot espi is initialized. + Expected: BMC should send HOST_RESET_ACK from uboot. PASS. +2. Test: Disable the HOST_RESET_WARN ACK support for early events in uboot, + and repeat test case 1. + Expected: BMC should send HOST_RESET_ACK from kernel(this change). PASS. + +Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@intel.com> +Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> +--- + drivers/misc/aspeed-espi-slave.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/misc/aspeed-espi-slave.c b/drivers/misc/aspeed-espi-slave.c +index cb8ed585c69f..ed7bff4d5046 100644 +--- a/drivers/misc/aspeed-espi-slave.c ++++ b/drivers/misc/aspeed-espi-slave.c +@@ -179,6 +179,24 @@ static void aspeed_espi_boot_ack(struct aspeed_espi *priv) + evt | ASPEED_ESPI_SYSEVT1_SUS_ACK); + dev_dbg(priv->dev, "Boot SYSEVT1_SUS_WARN: acked\n"); + } ++ ++ regmap_read(priv->map, ASPEED_ESPI_SYSEVT, &evt); ++ if (evt & ASPEED_ESPI_SYSEVT_HOST_RST_WARN && ++ !(evt & ASPEED_ESPI_SYSEVT_HOST_RST_ACK)) { ++ regmap_write_bits(priv->map, ASPEED_ESPI_SYSEVT, ++ ASPEED_ESPI_SYSEVT_HOST_RST_ACK, ++ ASPEED_ESPI_SYSEVT_HOST_RST_ACK); ++ dev_dbg(priv->dev, "Boot SYSEVT_HOST_RST_WARN: acked\n"); ++ } ++ ++ regmap_read(priv->map, ASPEED_ESPI_SYSEVT, &evt); ++ if (evt & ASPEED_ESPI_SYSEVT_OOB_RST_WARN && ++ !(evt & ASPEED_ESPI_SYSEVT_OOB_RST_ACK)) { ++ regmap_write_bits(priv->map, ASPEED_ESPI_SYSEVT, ++ ASPEED_ESPI_SYSEVT_OOB_RST_ACK, ++ ASPEED_ESPI_SYSEVT_OOB_RST_ACK); ++ dev_dbg(priv->dev, "Boot SYSEVT_OOB_RST_WARN: acked\n"); ++ } + } + + static irqreturn_t aspeed_espi_irq(int irq, void *arg) +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-14386/0001-net-packet-fix-overflow-in-tpacket_rcv.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-14386/0001-net-packet-fix-overflow-in-tpacket_rcv.patch new file mode 100644 index 000000000..45ab4c1b2 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-14386/0001-net-packet-fix-overflow-in-tpacket_rcv.patch @@ -0,0 +1,54 @@ +From acf69c946233259ab4d64f8869d4037a198c7f06 Mon Sep 17 00:00:00 2001 +From: Or Cohen <orcohen@paloaltonetworks.com> +Date: Thu, 3 Sep 2020 21:05:28 -0700 +Subject: [PATCH] net/packet: fix overflow in tpacket_rcv + +Using tp_reserve to calculate netoff can overflow as +tp_reserve is unsigned int and netoff is unsigned short. + +This may lead to macoff receving a smaller value then +sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr +is set, an out-of-bounds write will occur when +calling virtio_net_hdr_from_skb. + +The bug is fixed by converting netoff to unsigned int +and checking if it exceeds USHRT_MAX. + +This addresses CVE-2020-14386 + +Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") +Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> +Signed-off-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +--- + net/packet/af_packet.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index da8254e680f9..2b33e977a905 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2170,7 +2170,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + int skb_len = skb->len; + unsigned int snaplen, res; + unsigned long status = TP_STATUS_USER; +- unsigned short macoff, netoff, hdrlen; ++ unsigned short macoff, hdrlen; ++ unsigned int netoff; + struct sk_buff *copy_skb = NULL; + struct timespec64 ts; + __u32 ts_status; +@@ -2239,6 +2240,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + } + macoff = netoff - maclen; + } ++ if (netoff > USHRT_MAX) { ++ atomic_inc(&po->tp_drops); ++ goto drop_n_restore; ++ } + if (po->tp_version <= TPACKET_V2) { + if (macoff + snaplen > po->rx_ring.frame_size) { + if (po->copy_thresh && +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend index 9bb40fe5c..271b6035e 100644 --- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend @@ -89,6 +89,7 @@ SRC_URI += " \ file://0116-watchdog-aspeed-fix-AST2600-support.patch \ file://0117-Copy-raw-PECI-response-to-user-space-on-timeout.patch \ file://0118-Recalculate-AW-FCS-on-WrEndPointConfig-command.patch \ + file://0119-Handle-pending-eSPI-HOST-OOB-RESET-VW-events.patch \ " # CVE-2020-16166 vulnerability fix @@ -110,5 +111,11 @@ SRC_URI += " \ file://0002-cgroup-Fix-sock_cgroup_data-on-big-endian.patch \ " +# CVE-2020-14386 vulnerability fix +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}/CVE-2020-14386:" +SRC_URI += " \ + file://0001-net-packet-fix-overflow-in-tpacket_rcv.patch \ + " + SRC_URI += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', 'file://0005-128MB-flashmap-for-PFR.patch', '', d)}" SRC_URI += "${@bb.utils.contains('EXTRA_IMAGE_FEATURES', 'debug-tweaks', 'file://debug.cfg', '', d)}" |