From 8a3b21c3365f2a75bc5c56dd18cce03e2eb3fe8c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 17 Apr 2025 16:21:36 +0200 Subject: [PATCH] 6.1-stable patches added patches: acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch --- ...violation-when-accessing-sysfs-files.patch | 105 ++++++++++++++++++ queue-6.1/series | 1 + 2 files changed, 106 insertions(+) create mode 100644 queue-6.1/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch diff --git a/queue-6.1/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch b/queue-6.1/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch new file mode 100644 index 0000000000..cfe32b10b7 --- /dev/null +++ b/queue-6.1/acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch @@ -0,0 +1,105 @@ +From dd4f730b557ce701a2cd4f604bf1e57667bd8b6e Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 10 Feb 2025 21:28:25 -0500 +Subject: ACPI: platform-profile: Fix CFI violation when accessing sysfs files + +From: Nathan Chancellor + +commit dd4f730b557ce701a2cd4f604bf1e57667bd8b6e upstream. + +When an attribute group is created with sysfs_create_group(), the +->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() +and ->store() callbacks to kobj_attr_show() and kobj_attr_store() +respectively. These functions use container_of() to get the respective +callback from the passed attribute, meaning that these callbacks need to +be of the same type as the callbacks in 'struct kobj_attribute'. + +However, ->show() and ->store() in the platform_profile driver are +defined for struct device_attribute with the help of DEVICE_ATTR_RO() +and DEVICE_ATTR_RW(), which results in a CFI violation when accessing +platform_profile or platform_profile_choices under /sys/firmware/acpi +because the types do not match: + + CFI failure at kobj_attr_show+0x19/0x30 (target: platform_profile_choices_show+0x0/0x140; expected type: 0x7a69590c) + +There is no functional issue from the type mismatch because the layout +of 'struct kobj_attribute' and 'struct device_attribute' are the same, +so the container_of() cast does not break anything aside from CFI. + +Change the type of platform_profile_choices_show() and +platform_profile_{show,store}() to match the callbacks in +'struct kobj_attribute' and update the attribute variables to +match, which resolves the CFI violation. + +Cc: All applicable +Fixes: a2ff95e018f1 ("ACPI: platform: Add platform profile support") +Reported-by: John Rowley +Closes: https://github.com/ClangBuiltLinux/linux/issues/2047 +Tested-by: John Rowley +Reviewed-by: Sami Tolvanen +Signed-off-by: Nathan Chancellor +Acked-by: Greg Kroah-Hartman +Reviewed-by: Mark Pearson +Tested-by: Mark Pearson +Link: https://patch.msgid.link/20250210-acpi-platform_profile-fix-cfi-violation-v3-1-ed9e9901c33a@kernel.org +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +[nathan: Fix conflicts in older stable branches] +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/platform_profile.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/acpi/platform_profile.c ++++ b/drivers/acpi/platform_profile.c +@@ -22,8 +22,8 @@ static const char * const profile_names[ + }; + static_assert(ARRAY_SIZE(profile_names) == PLATFORM_PROFILE_LAST); + +-static ssize_t platform_profile_choices_show(struct device *dev, +- struct device_attribute *attr, ++static ssize_t platform_profile_choices_show(struct kobject *kobj, ++ struct kobj_attribute *attr, + char *buf) + { + int len = 0; +@@ -49,8 +49,8 @@ static ssize_t platform_profile_choices_ + return len; + } + +-static ssize_t platform_profile_show(struct device *dev, +- struct device_attribute *attr, ++static ssize_t platform_profile_show(struct kobject *kobj, ++ struct kobj_attribute *attr, + char *buf) + { + enum platform_profile_option profile = PLATFORM_PROFILE_BALANCED; +@@ -77,8 +77,8 @@ static ssize_t platform_profile_show(str + return sysfs_emit(buf, "%s\n", profile_names[profile]); + } + +-static ssize_t platform_profile_store(struct device *dev, +- struct device_attribute *attr, ++static ssize_t platform_profile_store(struct kobject *kobj, ++ struct kobj_attribute *attr, + const char *buf, size_t count) + { + int err, i; +@@ -115,12 +115,12 @@ static ssize_t platform_profile_store(st + return count; + } + +-static DEVICE_ATTR_RO(platform_profile_choices); +-static DEVICE_ATTR_RW(platform_profile); ++static struct kobj_attribute attr_platform_profile_choices = __ATTR_RO(platform_profile_choices); ++static struct kobj_attribute attr_platform_profile = __ATTR_RW(platform_profile); + + static struct attribute *platform_profile_attrs[] = { +- &dev_attr_platform_profile_choices.attr, +- &dev_attr_platform_profile.attr, ++ &attr_platform_profile_choices.attr, ++ &attr_platform_profile.attr, + NULL + }; + diff --git a/queue-6.1/series b/queue-6.1/series index e7ae3fd805..e32c230f7b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -158,3 +158,4 @@ pci-fix-reference-leak-in-pci_alloc_child_bus.patch pinctrl-qcom-clear-latched-interrupt-status-when-changing-irq-type.patch selftests-mptcp-close-fd_in-before-returning-in-main_loop.patch arm64-errata-add-newer-arm-cores-to-the-spectre_bhb_loop_affected-lists.patch +acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch -- 2.47.3