mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-07 19:49:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'acpi-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Browse Source 
Pull ACPI fixes from Rafael Wysocki:
 "These fix three new issues in the ACPI APEI error injection code and
  an ACPI platform firmware runtime update interface issue:

   - Make ACPI APEI error injection check the version of the request
     when mapping the EINJ parameter structure in the BIOS reserved
     memory to prevent injecting errors based on an uninitialized
     field (Tony Luck)

   - Fix potential NULL dereference in __einj_error_inject() that may
     occur when memory allocation fails (Charles Han)

   - Remove the __exit annotation from einj_remove(), so it can be
     called on errors during faux device probe (Uwe Kleine-König)

   - Use a security-version-number check instead of a runtime version
     check during ACPI platform firmware runtime driver updates to
     prevent those updates from failing due to false-positive driver
     version check failures (Chen Yu)"

* tag 'acpi-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: pfr_update: Fix the driver update version check
  ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text
  ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject()
  ACPI: APEI: EINJ: Check if user asked for EINJV2 injection
This commit is contained in:
Linus Torvalds
2025-08-21 16:07:15 -04:00
parent 26d6ed49cd 670b51121e
commit f70e1e7980
3 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/acpi/apei/einj-core.c
View File

@@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void)
memcpy_fromio(&v5param, p, v5param_size);
acpi5 = 1;
check_vendor_extension(pa_v5, &v5param);
if (available_error_type & ACPI65_EINJV2_SUPP) {
if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
len = v5param.einjv2_struct.length;
offset = offsetof(struct einjv2_extension_struct, component_arr);
max_nr_components = (len - offset) /
@@ -540,6 +540,9 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
struct set_error_type_with_address *v5param;
v5param = kmalloc(v5param_size, GFP_KERNEL);
if (!v5param)
return -ENOMEM;
memcpy_fromio(v5param, einj_param, v5param_size);
v5param->type = type;
if (type & ACPI5_VENDOR_BIT) {
@@ -1091,7 +1094,7 @@ static int __init einj_probe(struct faux_device *fdev)
return rc;
}
static void __exit einj_remove(struct faux_device *fdev)
static void einj_remove(struct faux_device *fdev)
{
struct apei_exec_context ctx;
@@ -1114,15 +1117,9 @@ static void __exit einj_remove(struct faux_device *fdev)
}
static struct faux_device *einj_dev;
/*
* einj_remove() lives in .exit.text. For drivers registered via
* platform_driver_probe() this is ok because they cannot get unbound at
* runtime. So mark the driver struct with __refdata to prevent modpost
* triggering a section mismatch warning.
*/
static struct faux_device_ops einj_device_ops __refdata = {
static struct faux_device_ops einj_device_ops = {
.probe = einj_probe,
.remove = __exit_p(einj_remove),
.remove = einj_remove,
};
static int __init einj_init(void)

2
drivers/acpi/pfr_update.c
View File

@@ -329,7 +329,7 @@ static bool applicable_image(const void *data, struct pfru_update_cap_info *cap,
if (type == PFRU_CODE_INJECT_TYPE)
return payload_hdr->rt_ver >= cap->code_rt_version;
return payload_hdr->rt_ver >= cap->drv_rt_version;
return payload_hdr->svn_ver >= cap->drv_svn;
}
static void print_update_debug_info(struct pfru_updated_result *result,

1
include/uapi/linux/pfrut.h
View File

@@ -89,6 +89,7 @@ struct pfru_payload_hdr {
__u32 hw_ver;
__u32 rt_ver;
__u8 platform_id[16];
__u32 svn_ver;
};
enum pfru_dsm_status {