6.6-stable patches

added patches:
	media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch
	revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch
	revert-wifi-mac80211-fix-rcu-list-iterations.patch

diff --git a/queue-6.6/media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch b/queue-6.6/media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch
new file mode 100644 (file)
index 0000000..559c34d
--- /dev/null
+++ b/queue-6.6/media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch
@@ -0,0 +1,35 @@
+From ecf2b43018da9579842c774b7f35dbe11b5c38dd Mon Sep 17 00:00:00 2001
+From: Benoit Sevens <bsevens@google.com>
+Date: Thu, 7 Nov 2024 14:22:02 +0000
+Subject: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
+
+From: Benoit Sevens <bsevens@google.com>
+
+commit ecf2b43018da9579842c774b7f35dbe11b5c38dd upstream.
+
+This can lead to out of bounds writes since frames of this type were not
+taken into account when calculating the size of the frames buffer in
+uvc_parse_streaming.
+
+Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
+Signed-off-by: Benoit Sevens <bsevens@google.com>
+Cc: stable@vger.kernel.org
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -371,7 +371,7 @@ static int uvc_parse_format(struct uvc_d
+        * Parse the frame descriptors. Only uncompressed, MJPEG and frame
+        * based formats have frame descriptors.
+        */
+-      while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
++      while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
+              buffer[2] == ftype) {
+               unsigned int maxIntervalIndex;
+ 

diff --git a/queue-6.6/revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch b/queue-6.6/revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch
new file mode 100644 (file)
index 0000000..2a383a5
--- /dev/null
+++ b/queue-6.6/revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch
@@ -0,0 +1,119 @@
+From pulehui@huaweicloud.com  Sun Nov 10 06:09:10 2024
+From: Pu Lehui <pulehui@huaweicloud.com>
+Date: Thu, 31 Oct 2024 06:37:02 +0000
+Subject: Revert "selftests/bpf: Implement get_hw_ring_size function to retrieve current and max interface size"
+To: stable@vger.kernel.org, bpf@vger.kernel.org
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>, Pu Lehui <pulehui@huawei.com>
+Message-ID: <20241031063702.3256343-1-pulehui@huaweicloud.com>
+
+From: Pu Lehui <pulehui@huawei.com>
+
+This reverts commit c8c590f07ad7ffaa6ef11e90b81202212077497b which is
+commit 90a695c3d31e1c9f0adb8c4c80028ed4ea7ed5ab upstream.
+
+Commit c8c590f07ad7 ("selftests/bpf: Implement get_hw_ring_size function
+to retrieve current and max interface size") will cause the following
+bpf selftests compilation error in the 6.6 stable branch, and it is not
+the Stable-dep-of of commit 103c0431c7fb ("selftests/bpf: Drop unneeded
+error.h includes"). So let's revert commit c8c590f07ad7 to fix this
+compilation error.
+
+  ./network_helpers.h:66:43: error: 'struct ethtool_ringparam' declared
+    inside parameter list will not be visible outside of this definition or
+    declaration [-Werror]
+      66 | int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param);
+
+Signed-off-by: Pu Lehui <pulehui@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/network_helpers.c           |   24 ----------------
+ tools/testing/selftests/bpf/network_helpers.h           |    4 --
+ tools/testing/selftests/bpf/prog_tests/flow_dissector.c |    1 
+ tools/testing/selftests/bpf/xdp_hw_metadata.c           |   14 +++++++++
+ 4 files changed, 15 insertions(+), 28 deletions(-)
+
+--- a/tools/testing/selftests/bpf/network_helpers.c
++++ b/tools/testing/selftests/bpf/network_helpers.c
+@@ -465,27 +465,3 @@ int get_socket_local_port(int sock_fd)
+ 
+       return -1;
+ }
+-
+-int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param)
+-{
+-      struct ifreq ifr = {0};
+-      int sockfd, err;
+-
+-      sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+-      if (sockfd < 0)
+-              return -errno;
+-
+-      memcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
+-
+-      ring_param->cmd = ETHTOOL_GRINGPARAM;
+-      ifr.ifr_data = (char *)ring_param;
+-
+-      if (ioctl(sockfd, SIOCETHTOOL, &ifr) < 0) {
+-              err = errno;
+-              close(sockfd);
+-              return -err;
+-      }
+-
+-      close(sockfd);
+-      return 0;
+-}
+--- a/tools/testing/selftests/bpf/network_helpers.h
++++ b/tools/testing/selftests/bpf/network_helpers.h
+@@ -9,11 +9,8 @@ typedef __u16 __sum16;
+ #include <linux/if_packet.h>
+ #include <linux/ip.h>
+ #include <linux/ipv6.h>
+-#include <linux/ethtool.h>
+-#include <linux/sockios.h>
+ #include <netinet/tcp.h>
+ #include <bpf/bpf_endian.h>
+-#include <net/if.h>
+ 
+ #define MAGIC_VAL 0x1234
+ #define NUM_ITER 100000
+@@ -63,7 +60,6 @@ int make_sockaddr(int family, const char
+                 struct sockaddr_storage *addr, socklen_t *len);
+ char *ping_command(int family);
+ int get_socket_local_port(int sock_fd);
+-int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param);
+ 
+ struct nstoken;
+ /**
+--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
++++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c
+@@ -2,6 +2,7 @@
+ #define _GNU_SOURCE
+ #include <test_progs.h>
+ #include <network_helpers.h>
++#include <linux/if.h>
+ #include <linux/if_tun.h>
+ #include <sys/uio.h>
+ 
+--- a/tools/testing/selftests/bpf/xdp_hw_metadata.c
++++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c
+@@ -288,6 +288,20 @@ static int verify_metadata(struct xsk *r
+       return 0;
+ }
+ 
++struct ethtool_channels {
++      __u32   cmd;
++      __u32   max_rx;
++      __u32   max_tx;
++      __u32   max_other;
++      __u32   max_combined;
++      __u32   rx_count;
++      __u32   tx_count;
++      __u32   other_count;
++      __u32   combined_count;
++};
++
++#define ETHTOOL_GCHANNELS     0x0000003c /* Get no of channels */
++
+ static int rxq_num(const char *ifname)
+ {
+       struct ethtool_channels ch = {

diff --git a/queue-6.6/revert-wifi-mac80211-fix-rcu-list-iterations.patch b/queue-6.6/revert-wifi-mac80211-fix-rcu-list-iterations.patch
new file mode 100644 (file)
index 0000000..59dca5d
--- /dev/null
+++ b/queue-6.6/revert-wifi-mac80211-fix-rcu-list-iterations.patch
@@ -0,0 +1,71 @@
+From b16c79dcfd1f0c92b817e6f39e5880d34581dd63 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sun, 10 Nov 2024 06:02:40 +0100
+Subject: Revert "wifi: mac80211: fix RCU list iterations"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit f37319609335d3eb2f7edfec4bad7996668a4d29 which is
+commit ac35180032fbc5d80b29af00ba4881815ceefcb6 upstream.
+
+It should not have been backported here due to lack of other rcu
+changes in the stable branches.
+
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/chan.c |    4 +---
+ net/mac80211/mlme.c |    2 +-
+ net/mac80211/scan.c |    2 +-
+ net/mac80211/util.c |    4 +---
+ 4 files changed, 4 insertions(+), 8 deletions(-)
+
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -245,9 +245,7 @@ ieee80211_get_max_required_bw(struct iee
+       enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT;
+       struct sta_info *sta;
+ 
+-      lockdep_assert_wiphy(sdata->local->hw.wiphy);
+-
+-      list_for_each_entry(sta, &sdata->local->sta_list, list) {
++      list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) {
+               if (sdata != sta->sdata &&
+                   !(sta->sdata->bss && sta->sdata->bss == sdata->bss))
+                       continue;
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -732,7 +732,7 @@ static bool ieee80211_add_vht_ie(struct
+               bool disable_mu_mimo = false;
+               struct ieee80211_sub_if_data *other;
+ 
+-              list_for_each_entry(other, &local->interfaces, list) {
++              list_for_each_entry_rcu(other, &local->interfaces, list) {
+                       if (other->vif.bss_conf.mu_mimo_owner) {
+                               disable_mu_mimo = true;
+                               break;
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -490,7 +490,7 @@ static void __ieee80211_scan_completed(s
+        * the scan was in progress; if there was none this will
+        * just be a no-op for the particular interface.
+        */
+-      list_for_each_entry(sdata, &local->interfaces, list) {
++      list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+               if (ieee80211_sdata_running(sdata))
+                       wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
+       }
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -745,9 +745,7 @@ static void __iterate_interfaces(struct
+       struct ieee80211_sub_if_data *sdata;
+       bool active_only = iter_flags & IEEE80211_IFACE_ITER_ACTIVE;
+ 
+-      list_for_each_entry_rcu(sdata, &local->interfaces, list,
+-                              lockdep_is_held(&local->iflist_mtx) ||
+-                              lockdep_is_held(&local->hw.wiphy->mtx)) {
++      list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+               switch (sdata->vif.type) {
+               case NL80211_IFTYPE_MONITOR:
+                       if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))

diff --git a/queue-6.6/series b/queue-6.6/series
index 34c0eba20068f63589c6c39e752b2c51fcc736bf..86f5ea54337f331ed023cb258248481dcdf3d219 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -96,3 +96,6 @@ arm64-kconfig-make-sme-depend-on-broken-for-now.patch
 arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch
 btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch
 riscv-purgatory-align-riscv_kernel_entry.patch
+revert-wifi-mac80211-fix-rcu-list-iterations.patch
+revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch
+media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch