From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Nathan Chancellor <natechancellor@gmail.com>,
yuu ichii <byahu140@heisei.be>,
"Rafael J . Wysocki" <rafael.j.wysocki@intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 4.14 60/78] ACPI: sysfs: Fix pm_profile_attr type
Date: Mon, 29 Jun 2020 11:37:48 -0400 [thread overview]
Message-ID: <20200629153806.2494953-61-sashal@kernel.org> (raw)
In-Reply-To: <20200629153806.2494953-1-sashal@kernel.org>
From: Nathan Chancellor <natechancellor@gmail.com>
commit e6d701dca9893990d999fd145e3e07223c002b06 upstream.
When running a kernel with Clang's Control Flow Integrity implemented,
there is a violation that happens when accessing
/sys/firmware/acpi/pm_profile:
$ cat /sys/firmware/acpi/pm_profile
0
$ dmesg
...
[ 17.352564] ------------[ cut here ]------------
[ 17.352568] CFI failure (target: acpi_show_profile+0x0/0x8):
[ 17.352572] WARNING: CPU: 3 PID: 497 at kernel/cfi.c:29 __cfi_check_fail+0x33/0x40
[ 17.352573] Modules linked in:
[ 17.352575] CPU: 3 PID: 497 Comm: cat Tainted: G W 5.7.0-microsoft-standard+ #1
[ 17.352576] RIP: 0010:__cfi_check_fail+0x33/0x40
[ 17.352577] Code: 48 c7 c7 50 b3 85 84 48 c7 c6 50 0a 4e 84 e8 a4 d8 60 00 85 c0 75 02 5b c3 48 c7 c7 dc 5e 49 84 48 89 de 31 c0 e8 7d 06 eb ff <0f> 0b 5b c3 00 00 cc cc 00 00 cc cc 00 85 f6 74 25 41 b9 ea ff ff
[ 17.352577] RSP: 0018:ffffaa6dc3c53d30 EFLAGS: 00010246
[ 17.352578] RAX: 331267e0c06cee00 RBX: ffffffff83d85890 RCX: ffffffff8483a6f8
[ 17.352579] RDX: ffff9cceabbb37c0 RSI: 0000000000000082 RDI: ffffffff84bb9e1c
[ 17.352579] RBP: ffffffff845b2bc8 R08: 0000000000000001 R09: ffff9cceabbba200
[ 17.352579] R10: 000000000000019d R11: 0000000000000000 R12: ffff9cc947766f00
[ 17.352580] R13: ffffffff83d6bd50 R14: ffff9ccc6fa80000 R15: ffffffff845bd328
[ 17.352582] FS: 00007fdbc8d13580(0000) GS:ffff9cce91ac0000(0000) knlGS:0000000000000000
[ 17.352582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 17.352583] CR2: 00007fdbc858e000 CR3: 00000005174d0000 CR4: 0000000000340ea0
[ 17.352584] Call Trace:
[ 17.352586] ? rev_id_show+0x8/0x8
[ 17.352587] ? __cfi_check+0x45bac/0x4b640
[ 17.352589] ? kobj_attr_show+0x73/0x80
[ 17.352590] ? sysfs_kf_seq_show+0xc1/0x140
[ 17.352592] ? ext4_seq_options_show.cfi_jt+0x8/0x8
[ 17.352593] ? seq_read+0x180/0x600
[ 17.352595] ? sysfs_create_file_ns.cfi_jt+0x10/0x10
[ 17.352596] ? tlbflush_read_file+0x8/0x8
[ 17.352597] ? __vfs_read+0x6b/0x220
[ 17.352598] ? handle_mm_fault+0xa23/0x11b0
[ 17.352599] ? vfs_read+0xa2/0x130
[ 17.352599] ? ksys_read+0x6a/0xd0
[ 17.352601] ? __do_sys_getpgrp+0x8/0x8
[ 17.352602] ? do_syscall_64+0x72/0x120
[ 17.352603] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 17.352604] ---[ end trace 7b1fa81dc897e419 ]---
When /sys/firmware/acpi/pm_profile is read, sysfs_kf_seq_show is called,
which in turn calls kobj_attr_show, which gets the ->show callback
member by calling container_of on attr (casting it to struct
kobj_attribute) then calls it.
There is a CFI violation because pm_profile_attr is of type
struct device_attribute but kobj_attr_show calls ->show expecting it
to be from struct kobj_attribute. CFI checking ensures that function
pointer types match when doing indirect calls. Fix pm_profile_attr to
be defined in terms of kobj_attribute so there is no violation or
mismatch.
Fixes: 362b646062b2 ("ACPI: Export FADT pm_profile integer value to userspace")
Link: https://github.com/ClangBuiltLinux/linux/issues/1051
Reported-by: yuu ichii <byahu140@heisei.be>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index a663014cfa522..3b7e23866b42a 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -942,13 +942,13 @@ static void __exit interrupt_stats_exit(void)
}
static ssize_t
-acpi_show_profile(struct device *dev, struct device_attribute *attr,
+acpi_show_profile(struct kobject *kobj, struct kobj_attribute *attr,
char *buf)
{
return sprintf(buf, "%d\n", acpi_gbl_FADT.preferred_profile);
}
-static const struct device_attribute pm_profile_attr =
+static const struct kobj_attribute pm_profile_attr =
__ATTR(pm_profile, S_IRUGO, acpi_show_profile, NULL);
static ssize_t hotplug_enabled_show(struct kobject *kobj,
--
2.25.1
next prev parent reply other threads:[~2020-06-29 20:29 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-29 15:36 [PATCH 4.14 00/78] 4.14.186-rc1 review Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 01/78] scsi: scsi_devinfo: handle non-terminated strings Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 02/78] net: be more gentle about silly gso requests coming from user Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 03/78] block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 04/78] net: sched: export __netdev_watchdog_up() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 05/78] fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 06/78] apparmor: don't try to replace stale label in ptraceme check Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 07/78] ibmveth: Fix max MTU limit Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 08/78] mld: fix memory leak in ipv6_mc_destroy_dev() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 09/78] net: bridge: enfore alignment for ethernet address Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 10/78] net: fix memleak in register_netdevice() Sasha Levin
2020-06-29 15:36 ` [PATCH 4.14 11/78] net: usb: ax88179_178a: fix packet alignment padding Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 12/78] rocker: fix incorrect error handling in dma_rings_init Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 13/78] rxrpc: Fix notification call on completion of discarded calls Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 14/78] sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 15/78] tcp: grow window for OOO packets only for SACK flows Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 16/78] tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 17/78] ip_tunnel: fix use-after-free in ip_tunnel_lookup() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 18/78] tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 19/78] ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 20/78] net: Fix the arp error in some cases Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 21/78] net: Do not clear the sock TX queue in sk_set_socket() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 22/78] net: core: reduce recursion limit value Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 23/78] USB: ohci-sm501: Add missed iounmap() in remove Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 24/78] usb: dwc2: Postponed gadget registration to the udc class driver Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 25/78] usb: add USB_QUIRK_DELAY_INIT for Logitech C922 Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 26/78] USB: ehci: reopen solution for Synopsys HC bug Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 27/78] usb: host: xhci-mtk: avoid runtime suspend when removing hcd Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 28/78] usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 29/78] ALSA: usb-audio: add quirk for Denon DCD-1500RE Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 30/78] xhci: Fix incorrect EP_STATE_MASK Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 31/78] xhci: Fix enumeration issue when setting max packet size for FS devices Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 32/78] cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 33/78] loop: replace kill_bdev with invalidate_bdev Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 34/78] ALSA: usb-audio: uac1: Invalidate ctl on interrupt Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 35/78] ALSA: usb-audio: Clean up mixer element list traverse Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 36/78] ALSA: usb-audio: Fix OOB access of mixer element list Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 37/78] xhci: Poll for U0 after disabling USB2 LPM Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 38/78] cifs/smb3: Fix data inconsistent when punch hole Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 39/78] cifs/smb3: Fix data inconsistent when zero file range Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 40/78] efi/esrt: Fix reference count leak in esre_create_sysfs_entry Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 41/78] ARM: dts: NSP: Correct FA2 mailbox node Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 42/78] rxrpc: Fix handling of rwind from an ACK packet Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 43/78] RDMA/cma: Protect bind_list and listen_list while finding matching cm id Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 44/78] ASoC: rockchip: Fix a reference count leak Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 45/78] RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 46/78] net: qed: fix left elements count calculation Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 47/78] net: qed: fix NVMe login fails over VFs Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 48/78] net: qed: fix excessive QM ILT lines consumption Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 49/78] ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 50/78] usb: gadget: udc: Potential Oops in error handling code Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 51/78] netfilter: ipset: fix unaligned atomic access Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 52/78] net: bcmgenet: use hardware padding of runt frames Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 53/78] sched/core: Fix PI boosting between RT and DEADLINE tasks Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 54/78] ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 55/78] net: alx: fix race condition in alx_remove Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 56/78] s390/ptrace: fix setting syscall number Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 57/78] kbuild: improve cc-option to clean up all temporary files Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 58/78] blktrace: break out of blktrace setup on concurrent calls Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 59/78] ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table Sasha Levin
2020-06-29 15:37 ` Sasha Levin [this message]
2020-06-29 15:37 ` [PATCH 4.14 61/78] KVM: X86: Fix MSR range of APIC registers in X2APIC mode Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 62/78] KVM: nVMX: Plumb L2 GPA through to PML emulation Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 63/78] btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 64/78] mm/slab: use memzero_explicit() in kzfree() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 65/78] ocfs2: load global_inode_alloc Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 66/78] ocfs2: fix value of OCFS2_INVALID_SLOT Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 67/78] ocfs2: fix panic on nfs server over ocfs2 Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 68/78] arm64: perf: Report the PC value in REGS_ABI_32 mode Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 69/78] tracing: Fix event trigger to accept redundant spaces Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 70/78] drm/radeon: fix fb_div check in ni_init_smc_spll_table() Sasha Levin
2020-06-29 15:37 ` [PATCH 4.14 71/78] Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 72/78] sunrpc: fixed rollback in rpc_gssd_dummy_populate() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 73/78] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 74/78] pNFS/flexfiles: Fix list corruption if the mirror count changes Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 75/78] NFSv4 fix CLOSE not waiting for direct IO compeletion Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 76/78] ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 77/78] xfs: add agf freeblocks verify in xfs_agf_verify Sasha Levin
2020-06-29 15:38 ` [PATCH 4.14 78/78] Linux 4.14.186-rc1 Sasha Levin
2020-06-30 7:19 ` [PATCH 4.14 00/78] 4.14.186-rc1 review Naresh Kamboju
2020-06-30 9:20 ` Jon Hunter
2020-06-30 13:08 ` Sebastian Gottschall
2020-06-30 17:21 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200629153806.2494953-61-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=byahu140@heisei.be \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=natechancellor@gmail.com \
--cc=rafael.j.wysocki@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).