6.1-stable patches

added patches:
	asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch
	net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch

diff --git a/queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch b/queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch
new file mode 100644 (file)
index 0000000..2fb0d52
--- /dev/null
+++ b/queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch
@@ -0,0 +1,48 @@
+From de156f3cf70e17dc6ff4c3c364bb97a6db961ffd Mon Sep 17 00:00:00 2001
+From: Mingcong Bai <jeffbai@aosc.io>
+Date: Wed, 6 Nov 2024 10:40:50 +0800
+Subject: ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022
+
+From: Mingcong Bai <jeffbai@aosc.io>
+
+commit de156f3cf70e17dc6ff4c3c364bb97a6db961ffd upstream.
+
+Xiaomi Book Pro 14 2022 (MIA2210-AD) requires a quirk entry for its
+internal microphone to be enabled.
+
+This is likely due to similar reasons as seen previously on Redmi Book
+14/15 Pro 2022 models (since they likely came with similar firmware):
+
+- commit dcff8b7ca92d ("ASoC: amd: yc: Add Xiaomi Redmi Book Pro 15 2022
+  into DMI table")
+- commit c1dd6bf61997 ("ASoC: amd: yc: Add Xiaomi Redmi Book Pro 14 2022
+  into DMI table")
+
+A quirk would likely be needed for Xiaomi Book Pro 15 2022 models, too.
+However, I do not have such device on hand so I will leave it for now.
+
+Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
+Link: https://patch.msgid.link/20241106024052.15748-1-jeffbai@aosc.io
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: WangYuli <wangyuli@uniontech.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -342,6 +342,13 @@ static const struct dmi_system_id yc_acp
+       {
+               .driver_data = &acp6x_card,
+               .matches = {
++                      DMI_MATCH(DMI_BOARD_VENDOR, "TIMI"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14 2022"),
++              }
++      },
++      {
++              .driver_data = &acp6x_card,
++              .matches = {
+                       DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."),
+                       DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 C7VF"),
+               }

diff --git a/queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch b/queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch
new file mode 100644 (file)
index 0000000..f1e1f73
--- /dev/null
+++ b/queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch
@@ -0,0 +1,152 @@
+From b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 Mon Sep 17 00:00:00 2001
+From: Dmitry Antipov <dmantipov@yandex.ru>
+Date: Fri, 18 Oct 2024 08:13:39 +0300
+Subject: net: sched: use RCU read-side critical section in taprio_dump()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 upstream.
+
+Fix possible use-after-free in 'taprio_dump()' by adding RCU
+read-side critical section there. Never seen on x86 but
+found on a KASAN-enabled arm64 system when investigating
+https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa:
+
+[T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0
+[T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862
+[T15862]
+[T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2
+[T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024
+[T15862] Call trace:
+[T15862]  dump_backtrace+0x20c/0x220
+[T15862]  show_stack+0x2c/0x40
+[T15862]  dump_stack_lvl+0xf8/0x174
+[T15862]  print_report+0x170/0x4d8
+[T15862]  kasan_report+0xb8/0x1d4
+[T15862]  __asan_report_load4_noabort+0x20/0x2c
+[T15862]  taprio_dump+0xa0c/0xbb0
+[T15862]  tc_fill_qdisc+0x540/0x1020
+[T15862]  qdisc_notify.isra.0+0x330/0x3a0
+[T15862]  tc_modify_qdisc+0x7b8/0x1838
+[T15862]  rtnetlink_rcv_msg+0x3c8/0xc20
+[T15862]  netlink_rcv_skb+0x1f8/0x3d4
+[T15862]  rtnetlink_rcv+0x28/0x40
+[T15862]  netlink_unicast+0x51c/0x790
+[T15862]  netlink_sendmsg+0x79c/0xc20
+[T15862]  __sock_sendmsg+0xe0/0x1a0
+[T15862]  ____sys_sendmsg+0x6c0/0x840
+[T15862]  ___sys_sendmsg+0x1ac/0x1f0
+[T15862]  __sys_sendmsg+0x110/0x1d0
+[T15862]  __arm64_sys_sendmsg+0x74/0xb0
+[T15862]  invoke_syscall+0x88/0x2e0
+[T15862]  el0_svc_common.constprop.0+0xe4/0x2a0
+[T15862]  do_el0_svc+0x44/0x60
+[T15862]  el0_svc+0x50/0x184
+[T15862]  el0t_64_sync_handler+0x120/0x12c
+[T15862]  el0t_64_sync+0x190/0x194
+[T15862]
+[T15862] Allocated by task 15857:
+[T15862]  kasan_save_stack+0x3c/0x70
+[T15862]  kasan_save_track+0x20/0x3c
+[T15862]  kasan_save_alloc_info+0x40/0x60
+[T15862]  __kasan_kmalloc+0xd4/0xe0
+[T15862]  __kmalloc_cache_noprof+0x194/0x334
+[T15862]  taprio_change+0x45c/0x2fe0
+[T15862]  tc_modify_qdisc+0x6a8/0x1838
+[T15862]  rtnetlink_rcv_msg+0x3c8/0xc20
+[T15862]  netlink_rcv_skb+0x1f8/0x3d4
+[T15862]  rtnetlink_rcv+0x28/0x40
+[T15862]  netlink_unicast+0x51c/0x790
+[T15862]  netlink_sendmsg+0x79c/0xc20
+[T15862]  __sock_sendmsg+0xe0/0x1a0
+[T15862]  ____sys_sendmsg+0x6c0/0x840
+[T15862]  ___sys_sendmsg+0x1ac/0x1f0
+[T15862]  __sys_sendmsg+0x110/0x1d0
+[T15862]  __arm64_sys_sendmsg+0x74/0xb0
+[T15862]  invoke_syscall+0x88/0x2e0
+[T15862]  el0_svc_common.constprop.0+0xe4/0x2a0
+[T15862]  do_el0_svc+0x44/0x60
+[T15862]  el0_svc+0x50/0x184
+[T15862]  el0t_64_sync_handler+0x120/0x12c
+[T15862]  el0t_64_sync+0x190/0x194
+[T15862]
+[T15862] Freed by task 6192:
+[T15862]  kasan_save_stack+0x3c/0x70
+[T15862]  kasan_save_track+0x20/0x3c
+[T15862]  kasan_save_free_info+0x4c/0x80
+[T15862]  poison_slab_object+0x110/0x160
+[T15862]  __kasan_slab_free+0x3c/0x74
+[T15862]  kfree+0x134/0x3c0
+[T15862]  taprio_free_sched_cb+0x18c/0x220
+[T15862]  rcu_core+0x920/0x1b7c
+[T15862]  rcu_core_si+0x10/0x1c
+[T15862]  handle_softirqs+0x2e8/0xd64
+[T15862]  __do_softirq+0x14/0x20
+
+Fixes: 18cdd2f0998a ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex")
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+[Lee: Backported from linux-6.6.y to linux-6.1.y and fixed conflicts]
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c |   18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1995,9 +1995,6 @@ static int taprio_dump(struct Qdisc *sch
+       struct nlattr *nest, *sched_nest;
+       unsigned int i;
+ 
+-      oper = rtnl_dereference(q->oper_sched);
+-      admin = rtnl_dereference(q->admin_sched);
+-
+       opt.num_tc = netdev_get_num_tc(dev);
+       memcpy(opt.prio_tc_map, dev->prio_tc_map, sizeof(opt.prio_tc_map));
+ 
+@@ -2024,18 +2021,23 @@ static int taprio_dump(struct Qdisc *sch
+           nla_put_u32(skb, TCA_TAPRIO_ATTR_TXTIME_DELAY, q->txtime_delay))
+               goto options_error;
+ 
++      rcu_read_lock();
++
++      oper = rtnl_dereference(q->oper_sched);
++      admin = rtnl_dereference(q->admin_sched);
++
+       if (taprio_dump_tc_entries(q, skb))
+-              goto options_error;
++              goto options_error_rcu;
+ 
+       if (oper && dump_schedule(skb, oper))
+-              goto options_error;
++              goto options_error_rcu;
+ 
+       if (!admin)
+               goto done;
+ 
+       sched_nest = nla_nest_start_noflag(skb, TCA_TAPRIO_ATTR_ADMIN_SCHED);
+       if (!sched_nest)
+-              goto options_error;
++              goto options_error_rcu;
+ 
+       if (dump_schedule(skb, admin))
+               goto admin_error;
+@@ -2043,11 +2045,15 @@ static int taprio_dump(struct Qdisc *sch
+       nla_nest_end(skb, sched_nest);
+ 
+ done:
++      rcu_read_unlock();
+       return nla_nest_end(skb, nest);
+ 
+ admin_error:
+       nla_nest_cancel(skb, sched_nest);
+ 
++options_error_rcu:
++      rcu_read_unlock();
++
+ options_error:
+       nla_nest_cancel(skb, nest);
+ 

diff --git a/queue-6.1/series b/queue-6.1/series
index a7e76762929e24d7a49283ad665013c3544583ba..ab4d33c960354b06d7f70007d3c5a4720e996b7f 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -91,3 +91,5 @@ usb-serial-option-add-quectel-rg650v.patch
 irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch
 ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch
 ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch
+asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch
+net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch