Unverified Commit 21df7c23 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12289 CVE-2024-46691 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/CH5V245XL4AQ7F4L5O2V7KCE6RFXPRP2/ 
CVE-2024-46691

Bjorn Andersson (1):
  usb: typec: ucsi: Move unregister out of atomic section


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAR60S 
 
Link:https://gitee.com/openeuler/kernel/pulls/12289

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 0e8f4e8e 8d477b4a

drivers/soc/qcom/pmic_glink.c

+9 −1
Original line number Diff line number Diff line
@@ -115,8 +115,16 @@ EXPORT_SYMBOL_GPL(pmic_glink_client_register); 
int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len)

{

	struct pmic_glink *pg = client->pg;

	int ret;



	mutex_lock(&pg->state_lock);

	if (!pg->ept)

		ret = -ECONNRESET;

	else

		ret = rpmsg_send(pg->ept, data, len);

	mutex_unlock(&pg->state_lock);



	return rpmsg_send(pg->ept, data, len);

	return ret;

}

EXPORT_SYMBOL_GPL(pmic_glink_send);

drivers/usb/typec/ucsi/ucsi_glink.c

+22 −5
Original line number Diff line number Diff line
@@ -72,6 +72,9 @@ struct pmic_glink_ucsi { 


	struct work_struct notify_work;

	struct work_struct register_work;

	spinlock_t state_lock;

	bool ucsi_registered;

	bool pd_running;



	u8 read_buf[UCSI_BUF_SIZE];

};
@@ -254,6 +257,8 @@ static void pmic_glink_ucsi_register(struct work_struct *work) 
	struct pmic_glink_ucsi *ucsi = container_of(work, struct pmic_glink_ucsi, register_work);

	int orientation;

	int i;

	unsigned long flags;

	bool pd_running;



	for (i = 0; i < PMIC_GLINK_MAX_PORTS; i++) {

		if (!ucsi->port_orientation[i])
@@ -267,7 +272,17 @@ static void pmic_glink_ucsi_register(struct work_struct *work) 
		}

	}



	spin_lock_irqsave(&ucsi->state_lock, flags);

	pd_running = ucsi->pd_running;

	spin_unlock_irqrestore(&ucsi->state_lock, flags);



	if (!ucsi->ucsi_registered && pd_running) {

		ucsi_register(ucsi->ucsi);

		ucsi->ucsi_registered = true;

	} else if (ucsi->ucsi_registered && !pd_running) {

		ucsi_unregister(ucsi->ucsi);

		ucsi->ucsi_registered = false;

	}

}



static void pmic_glink_ucsi_callback(const void *data, size_t len, void *priv)
@@ -291,11 +306,12 @@ static void pmic_glink_ucsi_callback(const void *data, size_t len, void *priv) 
static void pmic_glink_ucsi_pdr_notify(void *priv, int state)

{

	struct pmic_glink_ucsi *ucsi = priv;

	unsigned long flags;



	if (state == SERVREG_SERVICE_STATE_UP)

	spin_lock_irqsave(&ucsi->state_lock, flags);

	ucsi->pd_running = (state == SERVREG_SERVICE_STATE_UP);

	spin_unlock_irqrestore(&ucsi->state_lock, flags);

	schedule_work(&ucsi->register_work);

	else if (state == SERVREG_SERVICE_STATE_DOWN)

		ucsi_unregister(ucsi->ucsi);

}



static void pmic_glink_ucsi_destroy(void *data)
@@ -328,6 +344,7 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, 
	init_completion(&ucsi->read_ack);

	init_completion(&ucsi->write_ack);

	init_completion(&ucsi->sync_ack);

	spin_lock_init(&ucsi->state_lock);

	mutex_init(&ucsi->lock);



	ucsi->ucsi = ucsi_create(dev, &pmic_glink_ucsi_ops);