Unverified Commit bbccee0a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9574 [sync] PR-8683: v4 Fix CVE-2024-35879 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/8683 
 
PR sync from: Zhang Zekun <zhangzekun11@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VE5GAVWGXH2LSW2UJKDYTDACD3AAUPX4/ 
Fix CVE-2024-35879

v4:
remove the declare in device.h

v3:
Fix format error

Herve Codina (2):
  driver core: Introduce device_link_wait_removal()
  of: dynamic: Synchronize of_changeset_destroy() with the devlink
    removals

Zhang Zekun (1):
  driver core: Fix kabi broken


-- 
2.17.1
 
https://gitee.com/src-openeuler/kernel/issues/I9QG3P 
 
Link:https://gitee.com/openeuler/kernel/pulls/9574

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 925e4ae2 1b7399c1

drivers/base/core.c

+23 −3
Original line number Diff line number Diff line
@@ -53,6 +53,7 @@ static unsigned int defer_sync_state_count = 1; 
static unsigned int defer_fw_devlink_count;

static LIST_HEAD(deferred_fw_devlink);

static DEFINE_MUTEX(defer_fw_devlink_lock);

static struct workqueue_struct *device_link_wq;

static bool fw_devlink_is_permissive(void);



#ifdef CONFIG_SRCU
@@ -364,12 +365,26 @@ static void devlink_dev_release(struct device *dev) 
	/*

	 * It may take a while to complete this work because of the SRCU

	 * synchronization in device_link_release_fn() and if the consumer or

	 * supplier devices get deleted when it runs, so put it into the "long"

	 * workqueue.

	 * supplier devices get deleted when it runs, so put it into the

	 * dedicated workqueue.

	 */

	queue_work(system_long_wq, &link->rm_work);

	queue_work(device_link_wq, &link->rm_work);

}



/**

 * device_link_wait_removal - Wait for ongoing devlink removal jobs to terminate

 */

void device_link_wait_removal(void)

{

	/*

	 * devlink removal jobs are queued in the dedicated work queue.

	 * To be sure that all removal jobs are terminated, ensure that any

	 * scheduled work has run to completion.

	 */

	flush_workqueue(device_link_wq);

}

EXPORT_SYMBOL_GPL(device_link_wait_removal);



static struct class devlink_class = {

	.name = "devlink",

	.owner = THIS_MODULE,
@@ -3385,9 +3400,14 @@ int __init devices_init(void) 
	sysfs_dev_char_kobj = kobject_create_and_add("char", dev_kobj);

	if (!sysfs_dev_char_kobj)

		goto char_kobj_err;

	device_link_wq = alloc_workqueue("device_link_wq", 0, 0);

	if (!device_link_wq)

		goto wq_err;



	return 0;



 wq_err:

	kobject_put(sysfs_dev_char_kobj);

 char_kobj_err:

	kobject_put(sysfs_dev_block_kobj);

 block_kobj_err:

drivers/of/dynamic.c

+11 −0
Original line number Diff line number Diff line
@@ -688,6 +688,17 @@ void of_changeset_destroy(struct of_changeset *ocs) 
{

	struct of_changeset_entry *ce, *cen;



	/*

	 * When a device is deleted, the device links to/from it are also queued

	 * for deletion. Until these device links are freed, the devices

	 * themselves aren't freed. If the device being deleted is due to an

	 * overlay change, this device might be holding a reference to a device

	 * node that will be freed. So, wait until all already pending device

	 * links are deleted before freeing a device node. This ensures we don't

	 * free any device node that has a non-zero reference count.

	 */

	device_link_wait_removal();



	list_for_each_entry_safe_reverse(ce, cen, &ocs->entries, node)

		__of_changeset_entry_destroy(ce);

}

include/linux/of.h

+2 −0
Original line number Diff line number Diff line
@@ -1443,6 +1443,8 @@ static inline int of_reconfig_get_state_change(unsigned long action, 
}

#endif /* CONFIG_OF_DYNAMIC */



void device_link_wait_removal(void);



/**

 * of_device_is_system_power_controller - Tells if system-power-controller is found for device_node

 * @np: Pointer to the given device_node