5.4-stable patches

added patches:
	of-module-add-buffer-overflow-check-in-of_modalias.patch
	sch_htb-make-htb_qlen_notify-idempotent.patch

diff --git a/queue-5.4/of-module-add-buffer-overflow-check-in-of_modalias.patch b/queue-5.4/of-module-add-buffer-overflow-check-in-of_modalias.patch
new file mode 100644 (file)
index 0000000..f6455af
--- /dev/null
+++ b/queue-5.4/of-module-add-buffer-overflow-check-in-of_modalias.patch
@@ -0,0 +1,46 @@
+From cf7385cb26ac4f0ee6c7385960525ad534323252 Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+Date: Sun, 14 Apr 2024 11:51:39 +0300
+Subject: of: module: add buffer overflow check in of_modalias()
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+commit cf7385cb26ac4f0ee6c7385960525ad534323252 upstream.
+
+In of_modalias(), if the buffer happens to be too small even for the 1st
+snprintf() call, the len parameter will become negative and str parameter
+(if not NULL initially) will point beyond the buffer's end. Add the buffer
+overflow check after the 1st snprintf() call and fix such check after the
+strlen() call (accounting for the terminating NUL char).
+
+Fixes: bc575064d688 ("of/device: use of_property_for_each_string to parse compatible strings")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/bbfc6be0-c687-62b6-d015-5141b93f313e@omp.ru
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: "Uwe Kleine-König" <ukleinek@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/device.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -213,14 +213,15 @@ static ssize_t of_device_get_modalias(st
+       csize = snprintf(str, len, "of:N%pOFn%c%s", dev->of_node, 'T',
+                        of_node_get_device_type(dev->of_node));
+       tsize = csize;
++      if (csize >= len)
++              csize = len > 0 ? len - 1 : 0;
+       len -= csize;
+-      if (str)
+-              str += csize;
++      str += csize;
+ 
+       of_property_for_each_string(dev->of_node, "compatible", p, compat) {
+               csize = strlen(compat) + 1;
+               tsize += csize;
+-              if (csize > len)
++              if (csize >= len)
+                       continue;
+ 
+               csize = snprintf(str, len, "C%s", compat);

diff --git a/queue-5.4/sch_htb-make-htb_qlen_notify-idempotent.patch b/queue-5.4/sch_htb-make-htb_qlen_notify-idempotent.patch
new file mode 100644 (file)
index 0000000..e417665
--- /dev/null
+++ b/queue-5.4/sch_htb-make-htb_qlen_notify-idempotent.patch
@@ -0,0 +1,38 @@
+From 5ba8b837b522d7051ef81bacf3d95383ff8edce5 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 3 Apr 2025 14:10:23 -0700
+Subject: sch_htb: make htb_qlen_notify() idempotent
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+commit 5ba8b837b522d7051ef81bacf3d95383ff8edce5 upstream.
+
+htb_qlen_notify() always deactivates the HTB class and in fact could
+trigger a warning if it is already deactivated. Therefore, it is not
+idempotent and not friendly to its callers, like fq_codel_dequeue().
+
+Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
+life.
+
+Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250403211033.166059-2-xiyou.wangcong@gmail.com
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_htb.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -1173,6 +1173,8 @@ static void htb_qlen_notify(struct Qdisc
+ {
+       struct htb_class *cl = (struct htb_class *)arg;
+ 
++      if (!cl->prio_activity)
++              return;
+       htb_deactivate(qdisc_priv(sch), cl);
+ }
+ 

diff --git a/queue-5.4/series b/queue-5.4/series
index c33fab78ad22a0108fa265ce6fbd22555c5f915c..b5f7ad7aa0fde012b5855d064bd8eabff47a707e 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -18,3 +18,5 @@ lan743x-fix-endianness-when-accessing-descriptors.patch
 net-lan743x-fix-memleak-issue-when-gso-enabled.patch
 net-fec-err007885-workaround-for-conventional-tx.patch
 pci-imx6-skip-controller_id-generation-logic-for-i.mx7d.patch
+of-module-add-buffer-overflow-check-in-of_modalias.patch
+sch_htb-make-htb_qlen_notify-idempotent.patch