4.14-stable patches

added patches:
	media-uvcvideo-fix-division-by-zero-at-stream-start.patch
	orangefs-fix-the-size-of-a-memory-allocation-in-orangefs_bufmap_alloc.patch
	rtlwifi-rtl8192cu-fix-warning-when-calling-local_irq_restore-with-interrupts-enabled.patch

diff --git a/queue-4.14/media-uvcvideo-fix-division-by-zero-at-stream-start.patch b/queue-4.14/media-uvcvideo-fix-division-by-zero-at-stream-start.patch
new file mode 100644 (file)
index 0000000..4ef7695
--- /dev/null
+++ b/queue-4.14/media-uvcvideo-fix-division-by-zero-at-stream-start.patch
@@ -0,0 +1,43 @@
+From 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 26 Oct 2021 11:55:11 +0200
+Subject: media: uvcvideo: fix division by zero at stream start
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df upstream.
+
+Add the missing bulk-endpoint max-packet sanity check to
+uvc_video_start_transfer() to avoid division by zero in
+uvc_alloc_urb_buffers() in case a malicious device has broken
+descriptors (or when doing descriptor fuzz testing).
+
+Note that USB core will reject URBs submitted for endpoints with zero
+wMaxPacketSize but that drivers doing packet-size calculations still
+need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
+endpoint descriptors with maxpacket=0")).
+
+Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
+Cc: stable@vger.kernel.org      # 2.6.26
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -1711,6 +1711,10 @@ static int uvc_init_video(struct uvc_str
+               if (ep == NULL)
+                       return -EIO;
+ 
++              /* Reject broken descriptors. */
++              if (usb_endpoint_maxp(&ep->desc) == 0)
++                      return -EIO;
++
+               ret = uvc_init_video_bulk(stream, ep, gfp_flags);
+       }
+ 

diff --git a/queue-4.14/orangefs-fix-the-size-of-a-memory-allocation-in-orangefs_bufmap_alloc.patch b/queue-4.14/orangefs-fix-the-size-of-a-memory-allocation-in-orangefs_bufmap_alloc.patch
new file mode 100644 (file)
index 0000000..a46f0a7
--- /dev/null
+++ b/queue-4.14/orangefs-fix-the-size-of-a-memory-allocation-in-orangefs_bufmap_alloc.patch
@@ -0,0 +1,61 @@
+From 40a74870b2d1d3d44e13b3b73c6571dd34f5614d Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Mon, 27 Dec 2021 19:09:18 +0100
+Subject: orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 40a74870b2d1d3d44e13b3b73c6571dd34f5614d upstream.
+
+'buffer_index_array' really looks like a bitmap. So it should be allocated
+as such.
+When kzalloc is called, a number of bytes is expected, but a number of
+longs is passed instead.
+
+In get(), if not enough memory is allocated, un-allocated memory may be
+read or written.
+
+So use bitmap_zalloc() to safely allocate the correct memory size and
+avoid un-expected behavior.
+
+While at it, change the corresponding kfree() into bitmap_free() to keep
+the semantic.
+
+Fixes: ea2c9c9f6574 ("orangefs: bufmap rewrite")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/orangefs/orangefs-bufmap.c |    7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/fs/orangefs/orangefs-bufmap.c
++++ b/fs/orangefs/orangefs-bufmap.c
+@@ -179,7 +179,7 @@ orangefs_bufmap_free(struct orangefs_buf
+ {
+       kfree(bufmap->page_array);
+       kfree(bufmap->desc_array);
+-      kfree(bufmap->buffer_index_array);
++      bitmap_free(bufmap->buffer_index_array);
+       kfree(bufmap);
+ }
+ 
+@@ -243,8 +243,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_de
+       bufmap->desc_size = user_desc->size;
+       bufmap->desc_shift = ilog2(bufmap->desc_size);
+ 
+-      bufmap->buffer_index_array =
+-              kzalloc(DIV_ROUND_UP(bufmap->desc_count, BITS_PER_LONG), GFP_KERNEL);
++      bufmap->buffer_index_array = bitmap_zalloc(bufmap->desc_count, GFP_KERNEL);
+       if (!bufmap->buffer_index_array)
+               goto out_free_bufmap;
+ 
+@@ -267,7 +266,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_de
+ out_free_desc_array:
+       kfree(bufmap->desc_array);
+ out_free_index_array:
+-      kfree(bufmap->buffer_index_array);
++      bitmap_free(bufmap->buffer_index_array);
+ out_free_bufmap:
+       kfree(bufmap);
+ out:

diff --git a/queue-4.14/rtlwifi-rtl8192cu-fix-warning-when-calling-local_irq_restore-with-interrupts-enabled.patch b/queue-4.14/rtlwifi-rtl8192cu-fix-warning-when-calling-local_irq_restore-with-interrupts-enabled.patch
new file mode 100644 (file)
index 0000000..36f0f56
--- /dev/null
+++ b/queue-4.14/rtlwifi-rtl8192cu-fix-warning-when-calling-local_irq_restore-with-interrupts-enabled.patch
@@ -0,0 +1,45 @@
+From 8b144dedb928e4e2f433a328d58f44c3c098d63e Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 15 Dec 2021 11:11:05 -0600
+Subject: rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 8b144dedb928e4e2f433a328d58f44c3c098d63e upstream.
+
+Syzbot reports the following WARNING:
+
+[200~raw_local_irq_restore() called with IRQs enabled
+WARNING: CPU: 1 PID: 1206 at kernel/locking/irqflag-debug.c:10
+   warn_bogus_irq_restore+0x1d/0x20 kernel/locking/irqflag-debug.c:10
+
+Hardware initialization for the rtl8188cu can run for as long as 350 ms,
+and the routine may be called with interrupts disabled. To avoid locking
+the machine for this long, the current routine saves the interrupt flags
+and enables local interrupts. The problem is that it restores the flags
+at the end without disabling local interrupts first.
+
+This patch fixes commit a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long
+disable of IRQs").
+
+Reported-by: syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com
+Cc: stable@vger.kernel.org
+Fixes: a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs")
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20211215171105.20623-1-Larry.Finger@lwfinger.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+@@ -1020,6 +1020,7 @@ int rtl92cu_hw_init(struct ieee80211_hw
+       _InitPABias(hw);
+       rtl92c_dm_init(hw);
+ exit:
++      local_irq_disable();
+       local_irq_restore(flags);
+       return err;
+ }

diff --git a/queue-4.14/series b/queue-4.14/series
index c625681341fc9ab506c8159a4ca3459caa8b8c6d..706267100fc6f4ae92f46e3ac4ebb92a5b885cd4 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -8,3 +8,6 @@ random-fix-data-race-on-crng_node_pool.patch
 random-fix-data-race-on-crng-init-time.patch
 staging-wlan-ng-avoid-bitwise-vs-logical-or-warning-in-hfa384x_usb_throttlefn.patch
 drm-i915-avoid-bitwise-vs-logical-or-warning-in-snb_wm_latency_quirk.patch
+orangefs-fix-the-size-of-a-memory-allocation-in-orangefs_bufmap_alloc.patch
+media-uvcvideo-fix-division-by-zero-at-stream-start.patch
+rtlwifi-rtl8192cu-fix-warning-when-calling-local_irq_restore-with-interrupts-enabled.patch