Skip to content
This repository was archived by the owner on Jan 10, 2023. It is now read-only.

Conversation

@xichen12
Copy link

@xichen12 xichen12 commented Mar 8, 2019

Request i915/kbl_dmc_ver1_04.bin in early boot alawys fail. It thus fall
back to syfs loading which in turn depends on uventd. Our restore
process doesn't run ueventd. So the loading function() is stuck there
for 50+ seconds.

Unfortuneally, the loading function will hold a semphore which is needed
by SNAPSHOT_FREEZE.

Our ugly hack here don't request such firmware. The only drawback so far
is that adb is offline after restore. The benefit is that we eliminate
the 50s+ sucks :)

Signed-off-by: Chen, Hu [email protected]

Request i915/kbl_dmc_ver1_04.bin in early boot alawys fail. It thus fall
back to syfs loading which in turn depends on uventd. Our restore
process doesn't run ueventd. So the loading function() is stuck there
for 50+ seconds.

Unfortuneally, the loading function will hold a semphore which is needed
by SNAPSHOT_FREEZE.

Our ugly hack here don't request such firmware. The only drawback so far
is that adb is offline after restore. The benefit is that we eliminate
the 50s+ sucks :)

Signed-off-by: Chen, Hu <[email protected]>
@android-ia-srv android-ia-srv requested a review from sgnanase March 8, 2019 06:53
Copy link

@sysopenci sysopenci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Autobuild started from pull-request-changes on this PR.

FAILURE: CheckBug Bad comments/Bugs

For more information, see: /absp/builders/celadon-autobuild/builds/508

Tracked-On:
Signed-off-by: xichen12 <[email protected]>
Copy link

@sysopenci sysopenci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Autobuild started from pull-request-changes on this PR.

FAILURE: CheckBug Bad comments/Bugs

For more information, see: /absp/builders/celadon-autobuild/builds/678

Copy link

@sysopenci sysopenci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Autobuild started from pull-request-changes on this PR.

FAILURE: CheckBug Bad comments/Bugs

For more information, see: /absp/builders/celadon-autobuild/builds/679

swaroopbalan pushed a commit that referenced this pull request Aug 5, 2019
[ Upstream commit 33d4a5a7a5b4d02915d765064b2319e90a11cbde ]

Setting invalid value to /sys/devices/system/cpu/cpuX/hotplug/fail
can control `struct cpuhp_step *sp` address, results in the following
global-out-of-bounds read.

Reproducer:

  # echo -2 > /sys/devices/system/cpu/cpu0/hotplug/fail

KASAN report:

  BUG: KASAN: global-out-of-bounds in write_cpuhp_fail+0x2cd/0x2e0
  Read of size 8 at addr ffffffff89734438 by task bash/1941

  CPU: 0 PID: 1941 Comm: bash Not tainted 5.2.0-rc6+ #31
  Call Trace:
   write_cpuhp_fail+0x2cd/0x2e0
   dev_attr_store+0x58/0x80
   sysfs_kf_write+0x13d/0x1a0
   kernfs_fop_write+0x2bc/0x460
   vfs_write+0x1e1/0x560
   ksys_write+0x126/0x250
   do_syscall_64+0xc1/0x390
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7f05e4f4c970

  The buggy address belongs to the variable:
   cpu_hotplug_lock+0x98/0xa0

  Memory state around the buggy address:
   ffffffff89734300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
   ffffffff89734380: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  >ffffffff89734400: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
                                          ^
   ffffffff89734480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   ffffffff89734500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Add a sanity check for the value written from user space.

Fixes: 1db4948 ("smp/hotplug: Hotplug state fail injection")
Signed-off-by: Eiichi Tsukata <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: [email protected]
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants