From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Calvin Owens <calvin@wbinvd.org>, Sasha Levin <sashal@kernel.org>
Subject: Re: [PATCH 5.10.y] pps: Fix a use-after-free
Date: Fri, 7 Feb 2025 17:51:09 -0500 [thread overview]
Message-ID: <20250207153310-2bc259bc590da831@stable.kernel.org> (raw)
In-Reply-To: <a79cc7764ee98771a74a62e1dfc3d398461e4187.1738811041.git.calvin@wbinvd.org>
[ Sasha's backport helper bot ]
Hi,
Found matching upstream commit: c79a39dc8d060b9e64e8b0fa9d245d44befeefbe
Status in newer kernel trees:
6.13.y | Present (different SHA1: d487d68916ad)
6.12.y | Present (different SHA1: 2423d77f7ee9)
6.6.y | Present (different SHA1: 73f8d5a93c8f)
6.1.y | Not found
5.15.y | Not found
5.10.y | Not found
Note: The patch differs from the upstream commit:
---
1: c79a39dc8d060 ! 1: 4ded4bb10e446 pps: Fix a use-after-free
@@ Commit message
Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
Link: https://lore.kernel.org/r/a17975fd5ae99385791929e563f72564edbcf28f.1731383727.git.calvin@wbinvd.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+ (cherry picked from commit c79a39dc8d060b9e64e8b0fa9d245d44befeefbe)
+ Signed-off-by: Calvin Owens <calvin@wbinvd.org>
## drivers/pps/clients/pps-gpio.c ##
@@ drivers/pps/clients/pps-gpio.c: static int pps_gpio_probe(struct platform_device *pdev)
@@ drivers/pps/clients/pps-ktimer.c: static int __init pps_ktimer_init(void)
}
## drivers/pps/clients/pps-ldisc.c ##
-@@ drivers/pps/clients/pps-ldisc.c: static void pps_tty_dcd_change(struct tty_struct *tty, bool active)
- pps_event(pps, &ts, active ? PPS_CAPTUREASSERT :
+@@ drivers/pps/clients/pps-ldisc.c: static void pps_tty_dcd_change(struct tty_struct *tty, unsigned int status)
+ pps_event(pps, &ts, status ? PPS_CAPTUREASSERT :
PPS_CAPTURECLEAR, NULL);
- dev_dbg(pps->dev, "PPS %s at %lu\n",
+ dev_dbg(&pps->dev, "PPS %s at %lu\n",
- active ? "assert" : "clear", jiffies);
+ status ? "assert" : "clear", jiffies);
}
@@ drivers/pps/clients/pps-ldisc.c: static int pps_tty_open(struct tty_struct *tty)
@@ drivers/pps/pps.c: EXPORT_SYMBOL(pps_lookup_dev);
{
- int err;
-
- pps_class = class_create("pps");
+ pps_class = class_create(THIS_MODULE, "pps");
if (IS_ERR(pps_class)) {
pr_err("failed to allocate class\n");
@@ drivers/pps/pps.c: static int __init pps_init(void)
@@ drivers/pps/pps.c: static int __init pps_init(void)
subsys_initcall(pps_init);
- ## drivers/ptp/ptp_ocp.c ##
-@@ drivers/ptp/ptp_ocp.c: ptp_ocp_complete(struct ptp_ocp *bp)
-
- pps = pps_lookup_dev(bp->ptp);
- if (pps)
-- ptp_ocp_symlink(bp, pps->dev, "pps");
-+ ptp_ocp_symlink(bp, &pps->dev, "pps");
-
- ptp_ocp_debugfs_add_device(bp);
-
-
## include/linux/pps_kernel.h ##
@@ include/linux/pps_kernel.h: struct pps_device {
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y | Success | Failed |
Build Errors:
Build error for stable/linux-5.10.y:
In file included from ./include/linux/kernel.h:15,
from ./include/linux/list.h:9,
from ./include/linux/kobject.h:19,
from ./include/linux/of.h:17,
from ./include/linux/clk-provider.h:9,
from drivers/clk/qcom/clk-rpmh.c:6:
drivers/clk/qcom/clk-rpmh.c: In function 'clk_rpmh_bcm_send_cmd':
./include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types]
20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
| ^~
./include/linux/minmax.h:26:18: note: in expansion of macro '__typecheck'
26 | (__typecheck(x, y) && __no_side_effects(x, y))
| ^~~~~~~~~~~
./include/linux/minmax.h:36:31: note: in expansion of macro '__safe_cmp'
36 | __builtin_choose_expr(__safe_cmp(x, y), \
| ^~~~~~~~~~
./include/linux/minmax.h:45:25: note: in expansion of macro '__careful_cmp'
45 | #define min(x, y) __careful_cmp(x, y, <)
| ^~~~~~~~~~~~~
drivers/clk/qcom/clk-rpmh.c:273:21: note: in expansion of macro 'min'
273 | cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK);
| ^~~
In file included from ./include/linux/mm.h:30,
from ./include/linux/pagemap.h:8,
from ./include/linux/buffer_head.h:14,
from fs/udf/udfdecl.h:12,
from fs/udf/super.c:41:
fs/udf/super.c: In function 'udf_fill_partdesc_info':
./include/linux/overflow.h:70:22: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types]
70 | (void) (&__a == &__b); \
| ^~
fs/udf/super.c:1155:21: note: in expansion of macro 'check_add_overflow'
1155 | if (check_add_overflow(map->s_partition_len,
| ^~~~~~~~~~~~~~~~~~
Segmentation fault
make: *** [Makefile:1207: vmlinux] Error 139
make: Target '__all' not remade because of errors.
prev parent reply other threads:[~2025-02-07 22:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-04 17:53 FAILED: patch "[PATCH] pps: Fix a use-after-free" failed to apply to 5.10-stable tree gregkh
2025-02-06 3:04 ` [PATCH 5.10.y] pps: Fix a use-after-free Calvin Owens
2025-02-07 22:51 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250207153310-2bc259bc590da831@stable.kernel.org \
--to=sashal@kernel.org \
--cc=calvin@wbinvd.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox