| Message ID | 20241112222009.42056-2-yuxuan.luo@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | CVE-2024-40967 | expand |
On Tue, 12 Nov 2024 at 23:21, Yuxuan Luo <yuxuan.luo@canonical.com> wrote: > > From: Esben Haabendal <esben@geanix.com> > > By waiting at most 1 second for USR2_TXDC to be set, we avoid a potential > deadlock. > > In case of the timeout, there is not much we can do, so we simply ignore > the transmitter state and optimistically try to continue. > > Signed-off-by: Esben Haabendal <esben@geanix.com> > Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> > Link: https://lore.kernel.org/r/919647898c337a46604edcabaf13d42d80c0915d.1712837613.git.esben@geanix.com > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > (backported from commit e533e4c62e9993e62e947ae9bbec34e4c7ae81c2) > [yuxuan.luo: read_poll_timeout_atomic() function is not introduced until > 57a29df34146 (“iopoll: Introduce read_poll_timeout_atomic macro”), > however, readx_poll_timeout_atomic() can be used interchangeably. > ] > CVE-2024-40967 > Signed-off-by: Yuxuan Luo <yuxuan.luo@canonical.com> > --- > drivers/tty/serial/imx.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c > index 80cb72350ceaa..990d58fdeec61 100644 > --- a/drivers/tty/serial/imx.c > +++ b/drivers/tty/serial/imx.c > @@ -30,6 +30,7 @@ > #include <linux/of.h> > #include <linux/of_device.h> > #include <linux/io.h> > +#include <linux/iopoll.h> > #include <linux/dma-mapping.h> > > #include <asm/irq.h> > @@ -1939,7 +1940,7 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count) > { > struct imx_port *sport = imx_uart_ports[co->index]; > struct imx_port_ucrs old_ucr; > - unsigned int ucr1; > + unsigned int ucr1, usr2; > unsigned long flags = 0; > int locked = 1; > > @@ -1971,8 +1972,8 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count) > * Finally, wait for transmitter to become empty > * and restore UCR1/2/3 > */ > - while (!(imx_uart_readl(sport, USR2) & USR2_TXDC)); > - > + readx_poll_timeout_atomic(imx_uart_readl, usr2, usr2 & USR2_TXDC, > + 0, USEC_PER_SEC, false, sport, USR2); The usage of readx_poll_timeout_atomic() introduces an error which does not allow the kernel to compile: error: macro "readx_poll_timeout_atomic" passed 8 arguments, but takes just 6 In order to trigger the compile-time error it is necessary to enable CONFIG_SERIAL_IMX_CONSOLE. > imx_uart_ucrs_restore(sport, &old_ucr); > > if (locked) > -- > 2.43.0 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team The patch is missing the [SRU] tag in the subject.
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c index 80cb72350ceaa..990d58fdeec61 100644 --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -30,6 +30,7 @@ #include <linux/of.h> #include <linux/of_device.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/dma-mapping.h> #include <asm/irq.h> @@ -1939,7 +1940,7 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count) { struct imx_port *sport = imx_uart_ports[co->index]; struct imx_port_ucrs old_ucr; - unsigned int ucr1; + unsigned int ucr1, usr2; unsigned long flags = 0; int locked = 1; @@ -1971,8 +1972,8 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count) * Finally, wait for transmitter to become empty * and restore UCR1/2/3 */ - while (!(imx_uart_readl(sport, USR2) & USR2_TXDC)); - + readx_poll_timeout_atomic(imx_uart_readl, usr2, usr2 & USR2_TXDC, + 0, USEC_PER_SEC, false, sport, USR2); imx_uart_ucrs_restore(sport, &old_ucr); if (locked)