APPLIED: [SRU][R][PATCH 0/2] HVPIPE ioctl generates trace and returns failure

[Mehmet Basaran]

Patches were already applied to resolute:linux master-next branch via
upstream stable updates.

Thanks.

-------------- next part --------------
Massimiliano Pellizzer <massimiliano.pellizzer at canonical.com> writes:

> BugLink: https://bugs.launchpad.net/bugs/2152161
>
> [ Impact ]
>
> A kernel null pointer dereference oops is triggered on IBM pseries machines
> when a userspace process opens the HVPIPE character device (/dev/papr-hvpipe)
> and issues an ioctl to obtain a file descriptor for a specific HMC source ID.
> The root cause is a semantic misuse of a kernel file descriptor preparation macro
> (FD_PREPARE / retain_and_null_ptr) introduced by an upstream refactoring commit,
> which nullified a pointer that was subsequently reused in a list-insertion operation,
> leading to a write to address 0x0.
>
> [ Fix ]
>
> Backport the fix commit and it's dependency:
> - 7a4f0846ee6c pseries/papr-hvpipe: Fix race with interrupt handler
> - 1b9f7aafa44f pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
>
> [ Test Plan ]
>
> Compile tested only.
>
> [ Regression Potential ]
>
> The fix affects hvpipe's src_info registration ordering
> relative to file descriptor creation.
> An issue with this patch may break HMC communication.
>
>
> Ritesh Harjani (IBM) (2):
>   pseries/papr-hvpipe: Fix race with interrupt handler
>   pseries/papr-hvpipe: Fix null ptr deref in
>     papr_hvpipe_dev_create_handle()
>
>  arch/powerpc/platforms/pseries/papr-hvpipe.c | 69 +++++++++++---------
>  1 file changed, 37 insertions(+), 32 deletions(-)
>
> --
> 2.53.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260619/284dd485/attachment-0001.sig>