5.15-stable patches

added patches:
	lib-buildid-fix-build-id-parsing-logic.patch
	media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch

diff --git a/queue-5.15/lib-buildid-fix-build-id-parsing-logic.patch b/queue-5.15/lib-buildid-fix-build-id-parsing-logic.patch
new file mode 100644 (file)
index 0000000..0558356
--- /dev/null
+++ b/queue-5.15/lib-buildid-fix-build-id-parsing-logic.patch
@@ -0,0 +1,37 @@
+From jolsa@kernel.org  Tue Nov 19 13:00:07 2024
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Mon,  4 Nov 2024 18:52:53 +0100
+Subject: lib/buildid: Fix build ID parsing logic
+To: stable@vger.kernel.org
+Cc: Andrii Nakryiko <andrii@kernel.org>, bpf@vger.kernel.org, Daniel Borkmann <daniel@iogearbox.net>
+Message-ID: <20241104175256.2327164-2-jolsa@kernel.org>
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+The parse_build_id_buf does not account Elf32_Nhdr header size
+when getting the build id data pointer and returns wrong build
+id data as result.
+
+This is problem only stable trees that merged 8fa2b6817a95 fix,
+the upstream build id code was refactored and returns proper
+build id.
+
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Fixes: 8fa2b6817a95 ("lib/buildid: harden build ID parsing logic")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/buildid.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/buildid.c
++++ b/lib/buildid.c
+@@ -40,7 +40,7 @@ static int parse_build_id_buf(unsigned c
+                   name_sz == note_name_sz &&
+                   memcmp(nhdr + 1, note_name, note_name_sz) == 0 &&
+                   desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) {
+-                      data = note_start + note_off + ALIGN(note_name_sz, 4);
++                      data = note_start + note_off + sizeof(Elf32_Nhdr) + ALIGN(note_name_sz, 4);
+                       memcpy(build_id, data, desc_sz);
+                       memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz);
+                       if (size)

diff --git a/queue-5.15/media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch b/queue-5.15/media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch
new file mode 100644 (file)
index 0000000..79f25d9
--- /dev/null
+++ b/queue-5.15/media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch
@@ -0,0 +1,57 @@
+From a4aebaf6e6efff548b01a3dc49b4b9074751c15b Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Date: Wed, 6 Nov 2024 21:50:55 +0100
+Subject: media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+commit a4aebaf6e6efff548b01a3dc49b4b9074751c15b upstream.
+
+When CONFIG_DVB_DYNAMIC_MINORS, ret is not initialized, and a
+semaphore is left at the wrong state, in case of errors.
+
+Make the code simpler and avoid mistakes by having just one error
+check logic used weather DVB_DYNAMIC_MINORS is used or not.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202410201717.ULWWdJv8-lkp@intel.com/
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Link: https://lore.kernel.org/r/9e067488d8935b8cf00959764a1fa5de85d65725.1730926254.git.mchehab+huawei@kernel.org
+Cc: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dvbdev.c |   15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -544,6 +544,9 @@ int dvb_register_device(struct dvb_adapt
+       for (minor = 0; minor < MAX_DVB_MINORS; minor++)
+               if (dvb_minors[minor] == NULL)
+                       break;
++#else
++      minor = nums2minor(adap->num, type, id);
++#endif
+       if (minor >= MAX_DVB_MINORS) {
+               if (new_node) {
+                       list_del (&new_node->list_head);
+@@ -557,17 +560,7 @@ int dvb_register_device(struct dvb_adapt
+               mutex_unlock(&dvbdev_register_lock);
+               return -EINVAL;
+       }
+-#else
+-      minor = nums2minor(adap->num, type, id);
+-      if (minor >= MAX_DVB_MINORS) {
+-              dvb_media_device_free(dvbdev);
+-              list_del(&dvbdev->list_head);
+-              kfree(dvbdev);
+-              *pdvbdev = NULL;
+-              mutex_unlock(&dvbdev_register_lock);
+-              return ret;
+-      }
+-#endif
++
+       dvbdev->minor = minor;
+       dvb_minors[minor] = dvb_device_get(dvbdev);
+       up_write(&minor_rwsem);

diff --git a/queue-5.15/series b/queue-5.15/series
index c8c19808aa039b7cb051edf95b5e8d8e61cb03fe..ca5049bbe1b340ae4ebaa515fe5ec983267a0aad 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -18,3 +18,5 @@ revert-mmc-dw_mmc-fix-idmac-operation-with-pages-bigger-than-4k.patch
 drm-bridge-tc358768-fix-dsi-command-tx.patch
 mmc-sunxi-mmc-add-d1-mmc-variant.patch
 mmc-sunxi-mmc-fix-a100-compatible-description.patch
+lib-buildid-fix-build-id-parsing-logic.patch
+media-dvbdev-fix-the-logic-when-dvb_dynamic_minors-is-not-set.patch