This is a note to let you know that I've just added the patch titled cxl/pci: Fix lockdown level to the 5.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: cxl-pci-fix-lockdown-level.patch and it can be found in the queue-5.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b Mon Sep 17 00:00:00 2001 From: Dan Williams <dan.j.williams@xxxxxxxxx> Date: Fri, 3 Sep 2021 19:20:45 -0700 Subject: cxl/pci: Fix lockdown level From: Dan Williams <dan.j.williams@xxxxxxxxx> commit 9e56614c44b994b78fc9fcb2070bcbe3f5df0d7b upstream. A proposed rework of security_locked_down() users identified that the cxl_pci driver was passing the wrong lockdown_reason. Update cxl_mem_raw_command_allowed() to fail raw command access when raw pci access is also disabled. Fixes: 13237183c735 ("cxl/mem: Add a "RAW" send command") Cc: Ben Widawsky <ben.widawsky@xxxxxxxxx> Cc: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Cc: Ondrej Mosnacek <omosnace@xxxxxxxxxx> Cc: Paul Moore <paul@xxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/163072204525.2250120.16615792476976546735.stgit@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/cxl/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/cxl/pci.c +++ b/drivers/cxl/pci.c @@ -568,7 +568,7 @@ static bool cxl_mem_raw_command_allowed( if (!IS_ENABLED(CONFIG_CXL_MEM_RAW_COMMANDS)) return false; - if (security_locked_down(LOCKDOWN_NONE)) + if (security_locked_down(LOCKDOWN_PCI_ACCESS)) return false; if (cxl_raw_allow_all) Patches currently in stable-queue which might be from dan.j.williams@xxxxxxxxx are queue-5.14/cxl-pci-fix-debug-message-in-cxl_probe_regs.patch queue-5.14/cxl-pci-fix-lockdown-level.patch queue-5.14/cxl-acpi-do-not-add-dsdt-disabled-acpi0016-host-bridge-ports.patch